Skip to content

AO3-6015 Add script to provide user data for guests - #5998

Open
pmonfort wants to merge 2 commits into
otwcode:masterfrom
pmonfort:AO3-6015
Open

AO3-6015 Add script to provide user data for guests#5998
pmonfort wants to merge 2 commits into
otwcode:masterfrom
pmonfort:AO3-6015

Conversation

@pmonfort

Copy link
Copy Markdown
Contributor

Pull Request Checklist

Issue

https://otwarchive.atlassian.net/browse/AO3-6015

Purpose

Adds script/get_email_data.rb, a console script that col a given email address (guest activity and account history), following the same output format as script/get_user_data.rb.

The report includes:

  • URLs, IP addresses, and user agents for comments left by
  • Name, summary, content, and IP addresses of abuse reports
  • Name, summary, content, and user agents of support tickets
  • Users listing the email address as their fannish next of kin
  • Previous usernames, previous email addresses, and IP addresses from audits, including the destroy action

PR #4997 was closed because it searched the audits table with LIKE '%email%', which can't use an index and requires a full table scan. This PR takes a different approach:

  • Fast path (default): user ids are found through indexed lookups on users.email, users.unconfirmed_email, and user_past_emails (AO3-7249), and audits are then loaded by auditable_id, sive queries.
  • Deep search (opt-in): deleted accounts are gone fromta only survives in audits. The script asks the operatorwhether to search the audits table, and only then runs the LIKE query, split into bounded primary-key chunks so no single query runs unbounded. Candidates are verified against the exact emailor guest@example.com can't pull in data from aguest@example.com.

Notes:

  • IPs from audits recorded by an admin (for example, when an admin deleted the account) are excluded, following the same principle as AO3-5486 about not revealing admins' IP addresses.
  • User agents from abuse reports and IP addresses from support tickets are not persisted in the database (they're only in-memory attributes), so the report can't include them.
  • Accounts deleted before the audits table existed (July 2 that data doesn't exist anywhere.

Testing Instructions

  1. In the Rails console environment, run bundle exec rails r script/get_email_data.rb
  2. Enter the email address of a guest who has left comments, abuse reports, or support tickets, and answer n to the deep search prompt
  3. Check the report includes the guest data and no audits scan runs
  4. Create a user with that email, change their username and email address, then run the script again with the old email
  5. Check the report includes the previous username, previous email, and the IPs from those changes
  6. Delete the user, run the script again, and answer y to the deep search prompt
  7. Check the report still finds the deleted account's username and history

References

Replaces the approach from #4997. Output format follows #3393 and #3403 (AO3-5486)

Credit

Pablo Monfort (he/him), based on previous work by brianjaustin in #4997 and sarken in #3393

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant