feat: Add GDPR endpoint to openvsx admin API

server/src/main/java/org/eclipse/openvsx/admin/AdminAPI.java

@@ -1118,6 +1118,60 @@ public ResponseEntity<ResultJson> revokePublisherTokens(
         }
     }
 
+    @PostMapping(
+        path = "/api/publisher/{provider}/{username}/delete",
+        produces = MediaType.APPLICATION_JSON_VALUE
+    )
+    @CrossOrigin
+    @Operation(summary = "Forget a user in response to a data-protection erasure request")
+    @MutatingOperation
+    @ApiResponse(
+            responseCode = "200",
+            description = "A success message is returned in JSON format",
+            content = @Content(schema = @Schema(implementation = ResultJson.class))
+    )
+    @ApiResponse(
+            responseCode = "403",
+            description = "An administration token is required",
+            content = @Content(schema = @Schema(implementation = ResultJson.class))
+    )
+    @ApiResponse(
+            responseCode = "404",
+            description = "User not found",
+            content = @Content()
+    )
+    public ResponseEntity<ResultJson> forgetUser(
+            @PathVariable @Parameter(description = "Authentication provider", example = "github") String provider,
+            @PathVariable @Parameter(description = "Provider-specific username") String username,
+            @RequestParam(value = "token") @Parameter(description = "A personal access token") String tokenValue
+    ) {
+        try {
+            var adminUser = admins.checkAdminUser(tokenValue);
+            var result = admins.forgetUser(provider, username, adminUser);
+            return ResponseEntity.ok(result);
+        } catch (ErrorResultException exc) {
+            return exc.toResponseEntity();
+        }
+    }
+
+    @PostMapping(
+            path = "/publisher/{provider}/{authId}/delete",
+            produces = MediaType.APPLICATION_JSON_VALUE
+    )
+    @MutatingOperation
+    public ResponseEntity<ResultJson> forgetUser(
+            @PathVariable String provider,
+            @PathVariable String authId
+    ) {
+        try {
+            var adminUser = admins.checkAdminUser();
+            var result = admins.forgetUser(provider, authId, adminUser);
+            return ResponseEntity.ok(result);
+        } catch (ErrorResultException exc) {
+            return exc.toResponseEntity();
+        }
+    }
+
     @GetMapping(
         path = "/settings",
         produces = MediaType.APPLICATION_JSON_VALUE

server/src/main/java/org/eclipse/openvsx/admin/AdminService.java

@@ -9,6 +9,14 @@
  ********************************************************************************/
 package org.eclipse.openvsx.admin;
 
+import static org.eclipse.openvsx.entities.FileResource.CHANGELOG;
+import static org.eclipse.openvsx.entities.FileResource.DOWNLOAD;
+import static org.eclipse.openvsx.entities.FileResource.ICON;
+import static org.eclipse.openvsx.entities.FileResource.LICENSE;
+import static org.eclipse.openvsx.entities.FileResource.MANIFEST;
+import static org.eclipse.openvsx.entities.FileResource.README;
+import static org.eclipse.openvsx.entities.FileResource.VSIXMANIFEST;
+
 import java.time.ZoneId;
 import java.util.Comparator;
 import java.util.LinkedHashMap;
@@ -17,19 +25,9 @@
 import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
+import java.util.stream.Stream;
 
-import jakarta.persistence.EntityManager;
-import jakarta.transaction.Transactional;
 import org.apache.commons.lang3.StringUtils;
-import org.jobrunr.scheduling.JobRequestScheduler;
-import org.jobrunr.scheduling.cron.Cron;
-import org.springframework.boot.context.event.ApplicationStartedEvent;
-import org.springframework.context.event.EventListener;
-import org.springframework.data.domain.Page;
-import org.springframework.data.domain.Pageable;
-import org.springframework.http.HttpStatus;
-import org.springframework.stereotype.Component;
-
 import org.eclipse.openvsx.ExtensionService;
 import org.eclipse.openvsx.ExtensionValidator;
 import org.eclipse.openvsx.UserService;
@@ -54,15 +52,24 @@
 import org.eclipse.openvsx.repositories.RepositoryService;
 import org.eclipse.openvsx.search.SearchUtilService;
 import org.eclipse.openvsx.storage.StorageUtilService;
-import org.eclipse.openvsx.util.*;
+import org.eclipse.openvsx.util.ErrorResultException;
+import org.eclipse.openvsx.util.LogService;
+import org.eclipse.openvsx.util.NamingUtil;
+import org.eclipse.openvsx.util.NotFoundException;
+import org.eclipse.openvsx.util.TargetPlatformVersion;
+import org.eclipse.openvsx.util.TimeUtil;
+import org.eclipse.openvsx.util.UrlUtil;
+import org.jobrunr.scheduling.JobRequestScheduler;
+import org.jobrunr.scheduling.cron.Cron;
+import org.springframework.boot.context.event.ApplicationStartedEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.Pageable;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Component;
 
-import static org.eclipse.openvsx.entities.FileResource.CHANGELOG;
-import static org.eclipse.openvsx.entities.FileResource.DOWNLOAD;
-import static org.eclipse.openvsx.entities.FileResource.ICON;
-import static org.eclipse.openvsx.entities.FileResource.LICENSE;
-import static org.eclipse.openvsx.entities.FileResource.MANIFEST;
-import static org.eclipse.openvsx.entities.FileResource.README;
-import static org.eclipse.openvsx.entities.FileResource.VSIXMANIFEST;
+import jakarta.persistence.EntityManager;
+import jakarta.transaction.Transactional;
 
 @Component
 public class AdminService {
@@ -538,6 +545,91 @@ public ResultJson revokePublisherTokens(String provider, String loginName, UserD
         return result;
     }
 
+    /**
+     * Forget a user in line with a data-protection (GDPR) erasure request.
+     *
+     * <p>The user record is anonymised in place rather than deleted, so that retained content
+     * (extension reviews, security scan and file decisions, and audit logs) keeps referring to a
+     * row that no longer holds any personal data. Extensions in namespaces where the user was the
+     * sole member are unpublished but kept in the database and storage, so people who have already
+     * installed them are unaffected.
+     *
+     * @param provider the authentication provider the user belongs to
+     * @param username the provider-specific username of the user to forget
+     * @param admin the administrator performing the erasure
+     */
+    @Transactional(rollbackOn = ErrorResultException.class)
+    public ResultJson forgetUser(String provider, String username, UserData admin) {
+        var user = repositories.findUserByLoginName(provider, username);
+        if (user == null) {
+            throw new ErrorResultException(userNotFoundMessage(provider + "/" + username), HttpStatus.NOT_FOUND);
+        }
+
+        // Handle namespace memberships, removing the users active memberships where found
+        var removedMembershipCount = 0;
+        for (var membership : repositories.findMemberships(user).toList()) {
+            var namespace = membership.getNamespace();
+            users.removeNamespaceMember(namespace, user);
+            removedMembershipCount++;
+            search.updateSearchEntries(repositories.findActiveExtensions(namespace).toList());
+        }
+
+        var removedExtensionCount = 0;
+        // Delete all published extension versions for the user, both active and not
+        var allVersions = Stream.concat(repositories.findVersionsByUser(user, true).stream(),
+                repositories.findVersionsByUser(user, false).stream()).toList();
+        for (var version : allVersions) {
+            extensions.deleteExtensionVersion(user, version);
+            removedExtensionCount++;
+        }
+
+        // Remove customer memberships. The customer and its rate-limit tokens are organisation-level
+        // and shared, so they are retained.
+        var removedCustomerMembershipCount = 0;
+        for (var customerMembership : repositories.findCustomerMemberships(user).toList()) {
+            entityManager.remove(customerMembership);
+            removedCustomerMembershipCount++;
+        }
+
+        // Personal access tokens. Delete tokens that no retained extension version references;
+        // scrub and deactivate the rest so retained versions still resolve a publisher.
+        var deletedTokenCount = 0;
+        var scrubbedTokenCount = 0;
+        for (var token : repositories.findAccessTokens(user).toList()) {
+            if (repositories.countVersionsByAccessToken(token) == 0) {
+                entityManager.remove(token);
+                deletedTokenCount++;
+            } else {
+                token.setActive(false);
+                token.setValue(null);
+                token.setDescription(null);
+                scrubbedTokenCount++;
+            }
+        }
+
+        // Anonymise the user record in place. Reviews, scan and file decisions, and audit logs
+        // keep referencing this row, which no longer holds any personal data.
+        var tombstoneLogin = "deleted-user-" + user.getId();
+        user.setLoginName(tombstoneLogin);
+        user.setFullName(null);
+        user.setEmail(null);
+        user.setAvatarUrl(null);
+        user.setAuthId(null);
+        user.setProviderUrl(null);
+        user.setEclipsePersonId(null);
+        user.setEclipseToken(null);
+        user.setRole(null);
+
+        // The success message deliberately contains no personal data, only the tombstone id and counts.
+        var result = ResultJson.success("Forgot user " + tombstoneLogin
+                + ": unpublished " + removedExtensionCount + " extensions, removed "
+                + removedMembershipCount + " namespace memberships, removed "
+                + removedCustomerMembershipCount + " customer memberships, deleted "
+                + deletedTokenCount + " tokens, scrubbed " + scrubbedTokenCount + " tokens.");
+        logs.logAction(admin, result);
+        return result;
+    }
+
     public UserData checkAdminUser() {
         return checkAdminUser(users.findLoggedInUser());
     }

server/src/main/java/org/eclipse/openvsx/repositories/ExtensionVersionRepository.java

@@ -55,6 +55,8 @@ Streamable<ExtensionVersion> findByVersionAndExtensionNameIgnoreCaseAndExtension
 
     Streamable<ExtensionVersion> findByPublishedWithAndActive(PersonalAccessToken publishedWith, boolean active);
 
+    long countByPublishedWith(PersonalAccessToken publishedWith);
+
     Streamable<ExtensionVersion> findByPublishedWithUserAndActive(UserData user, boolean active);
 
     Streamable<ExtensionVersion> findAll();

server/src/main/java/org/eclipse/openvsx/repositories/RepositoryService.java

@@ -355,6 +355,10 @@ public Streamable<ExtensionVersion> findVersionsByAccessToken(PersonalAccessToke
         return extensionVersionRepo.findByPublishedWithAndActive(publishedWith, active);
     }
 
+    public long countVersionsByAccessToken(PersonalAccessToken publishedWith) {
+        return extensionVersionRepo.countByPublishedWith(publishedWith);
+    }
+
     public Streamable<ExtensionVersion> findVersionsByUser(UserData user, boolean active) {
         return extensionVersionRepo.findByPublishedWithUserAndActive(user, active);
     }

server/src/main/java/org/eclipse/openvsx/repositories/UserDataRepository.java

@@ -19,6 +19,8 @@ public interface UserDataRepository extends Repository<UserData, Long> {
 
     UserData findByProviderAndLoginName(String provider, String loginName);
 
+    UserData findByProviderAndAuthId(String provider, String authId);
+
     Page<UserData> findByLoginNameStartingWith(String loginNameStart, Pageable page);
 
     long count();