Skip to content

fix!: redacting user retirement data in lms #37886

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ktyagiapphelix2u wants to merge 3 commits into
base: master
Choose a base branch
from
+40 −4
Open

fix!: redacting user retirement data in lms #37886

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
19fc427
fix: redacting user retirement data in lms
ktyagiapphelix2u Jan 14, 2026
5ac51b6
fix: redacting user retirement data in lms
ktyagiapphelix2u Jan 21, 2026
b0e4bce
fix: redacting user retirement data in lms
ktyagiapphelix2u Jan 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 21 additions & 1 deletion openedx/core/djangoapps/user_api/accounts/tests/test_retirement_views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1080,7 +1080,27 @@ def cleanup_and_assert_status(self, data=None, expected_status=status.HTTP_204_N

def test_simple_success(self):
self.cleanup_and_assert_status()
assert not UserRetirementStatus.objects.all()
# Records should be deleted after redaction
retirements = UserRetirementStatus.objects.all()
assert retirements.count() == 0

def test_custom_redacted_values(self):
"""Test that custom redacted values are applied before deletion."""
custom_username = 'username-redacted-12345'
custom_email = 'email-redacted-67890'
custom_name = 'name-redacted-abcde'

data = {
'usernames': self.usernames,
'redacted_username': custom_username,
'redacted_email': custom_email,
'redacted_name': custom_name
}
self.cleanup_and_assert_status(data=data)

# Records should be deleted after redaction
retirements = UserRetirementStatus.objects.all()
assert retirements.count() == 0

def test_leaves_other_users(self):
remaining_usernames = []
Expand Down
22 changes: 19 additions & 3 deletions openedx/core/djangoapps/user_api/accounts/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1024,14 +1024,20 @@ def cleanup(self, request):

```
{
'usernames': ['user1', 'user2', ...]
'usernames': ['user1', 'user2', ...],
'redacted_username': 'Value to store in username field',
'redacted_email': 'Value to store in email field',
'redacted_name': 'Value to store in name field'
}
```

Deletes a batch of retirement requests by username.
Redacts a batch of retirement requests by redacting PII fields.
"""
try:
usernames = request.data["usernames"]
redacted_username = request.data.get("redacted_username", "redacted")
redacted_email = request.data.get("redacted_email", "redacted")
redacted_name = request.data.get("redacted_name", "redacted")

if not isinstance(usernames, list):
raise TypeError("Usernames should be an array.")
Expand All @@ -1045,7 +1051,17 @@ def cleanup(self, request):
if len(usernames) != len(retirements):
raise UserRetirementStatus.DoesNotExist("Not all usernames exist in the COMPLETE state.")

retirements.delete()
# Redact PII fields first, then delete. This ensures that when Fivetran syncs
# the delete as a soft-delete to the data warehouse, the record will already
# contain redacted values instead of sensitive PII, eliminating the need for
# custom data warehouse cleanup jobs.
Comment on lines +1054 to +1057
Copy link
Contributor

@robrap robrap Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is an update that doesn't focus on 2U-specific technologies.

            # Redact PII fields first, then delete. In case an ETL tool is syncing data
            # to a downstream data warehouse, and treats the deletes as soft-deletes,
            # the data will have first been redacted, protecting the sensitive PII.

for retirement in retirements:
retirement.original_username = redacted_username
retirement.original_email = redacted_email
retirement.original_name = redacted_name
retirement.save()
retirement.delete()

return Response(status=status.HTTP_204_NO_CONTENT)
except (RetirementStateError, UserRetirementStatus.DoesNotExist, TypeError) as exc:
return Response(str(exc), status=status.HTTP_400_BAD_REQUEST)
Expand Down
Loading