Package io.meeds.social.security.service

Class AccountDeactivationService

java.lang.Object

io.meeds.social.security.service.AccountDeactivationService

@Service
public class AccountDeactivationService
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ACCOUNT_DEACTIVATION_REQUESTED_EVENT
static final String	ACCOUNT_DELETION_REQUESTED_EVENT
static final org.exoplatform.commons.api.settings.data.Scope	DELETION_REQUEST_SCOPE	Coordinates of the per-user marker recording a confirmed deletion request: one row per requester under its user context, valued with the request time in epoch milliseconds.
static final String	DELETION_REQUEST_SETTING_NAME
static final String	UI_CREATION_SOURCE	The only creation source qualifying an account as managed by the platform itself, as stamped by the users management UI (org.exoplatform.portal.rest.UserRestResourcesV1#CREATION_SOURCE_UI).

Constructor Summary

Constructors

Constructor	Description
AccountDeactivationService()

Method Summary

Modifier and Type	Method	Description
boolean	isDeactivationAllowed(String username)	The deactivation is offered only for accounts whose lifecycle belongs to the platform: the super user and externally synchronized accounts (LDAP) are excluded, and among the others only those created through the platform UI qualify.
boolean	isDeletionAllowed(String username)	The deletion request rides the deactivation one: it is offered only when the admin enabled it on top of the deactivation, to users already qualifying for the deactivation.
void	requestDeactivation(String username, String otpMethod, String otpCode, boolean deleteRequested)	Deactivates the account of the designated user after validating the OTP code: this is the single authoritative OTP validation of the flow.
protected void	sendUserConfirmationEmail(String username, boolean deleteRequested)	Sends the confirmation email to the user, before the account gets disabled.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ACCOUNT_DEACTIVATION_REQUESTED_EVENT

public static final String ACCOUNT_DEACTIVATION_REQUESTED_EVENT

See Also:

• Constant Field Values

ACCOUNT_DELETION_REQUESTED_EVENT

public static final String ACCOUNT_DELETION_REQUESTED_EVENT

See Also:

• Constant Field Values

DELETION_REQUEST_SCOPE

public static final org.exoplatform.commons.api.settings.data.Scope DELETION_REQUEST_SCOPE

Coordinates of the per-user marker recording a confirmed deletion request: one row per requester under its user context, valued with the request time in epoch milliseconds. The deletion processing job reads them back through SettingService#getContextsByTypeAndScopeAndSettingName.

DELETION_REQUEST_SETTING_NAME

public static final String DELETION_REQUEST_SETTING_NAME

See Also:

• Constant Field Values

UI_CREATION_SOURCE

public static final String UI_CREATION_SOURCE

The only creation source qualifying an account as managed by the platform itself, as stamped by the users management UI (org.exoplatform.portal.rest.UserRestResourcesV1#CREATION_SOURCE_UI).

See Also:

• Constant Field Values

Constructor Details

AccountDeactivationService

public AccountDeactivationService()

Method Details

isDeactivationAllowed

public boolean isDeactivationAllowed(String username)

The deactivation is offered only for accounts whose lifecycle belongs to the platform: the super user and externally synchronized accounts (LDAP) are excluded, and among the others only those created through the platform UI qualify. An account with no creation source predates the stamping of that attribute: it keeps the option rather than losing it on an unknown provenance.

isDeletionAllowed

public boolean isDeletionAllowed(String username)

The deletion request rides the deactivation one: it is offered only when the admin enabled it on top of the deactivation, to users already qualifying for the deactivation.

requestDeactivation

public void requestDeactivation(String username,
 String otpMethod,
 String otpCode,
 boolean deleteRequested)
                         throws IllegalAccessException

Deactivates the account of the designated user after validating the OTP code: this is the single authoritative OTP validation of the flow. When the deletion is also requested, the request time is durably recorded before the account gets disabled, so a recording failure never silently downgrades a deletion request to a plain deactivation; without a deletion request, any stale marker left by a previously re-enabled account is cleared instead.

Throws:

IllegalStateException - when the deactivation isn't allowed for the user (admin option off, externally synchronized account or account whose creation source isn't managed by the platform), or when the deletion is requested while the admin deletion option is off

IllegalAccessException - when the OTP code is blank, invalid or the validation tentatives are exhausted

sendUserConfirmationEmail

protected void sendUserConfirmationEmail(String username,
 boolean deleteRequested)

Sends the confirmation email to the user, before the account gets disabled. When the deletion was also requested, the email additionally reminds that the account will be deleted in 30 days. The sending is best effort: a mail server failure doesn't prevent the deactivation deliberately requested by the user.