Clean up Redis hashes when deleting/anonymizing users #4621

ref DEV-1809

pkg/lib/facade/coordinator.go

@@ -126,6 +126,7 @@ type OAuthService interface {
 type SessionManager interface {
 	Delete(session session.ListableSession) error
 	List(userID string) ([]session.ListableSession, error)
+	CleanUpForDeletingUserID(userID string) error
 }
 
 type StdAttrsService interface {
@@ -671,7 +672,7 @@ func (c *Coordinator) UserDelete(userID string, isScheduledDeletion bool) error
 	}
 
 	// Sessions:
-	if err = c.terminateAllSessions(userID); err != nil {
+	if err = c.terminateAllSessionsAndCleanUp(userID); err != nil {
 		return err
 	}
 
@@ -826,6 +827,31 @@ func (c *Coordinator) markOAuthEmailAsVerified(info *identity.Info) error {
 	return nil
 }
 
+func (c *Coordinator) terminateAllSessionsAndCleanUp(userID string) error {
+	err := c.terminateAllSessions(userID)
+	if err != nil {
+		return err
+	}
+
+	// According to https://redis.io/docs/latest/commands/hdel/
+	// When the last field of a Redis hash is deleted, the hash is deleted.
+	// So in most case, we do not actually need this.
+	// However, List() does not actually return every key that the Redis hash has,
+	// so having CleanUpForDeletingUserID ensures we delete the hash.
+
+	err = c.IDPSessions.CleanUpForDeletingUserID(userID)
+	if err != nil {
+		return err
+	}
+
+	err = c.OAuthSessions.CleanUpForDeletingUserID(userID)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (c *Coordinator) terminateAllSessions(userID string) error {
 	idpSessions, err := c.IDPSessions.List(userID)
 	if err != nil {
@@ -1062,7 +1088,7 @@ func (c *Coordinator) UserAnonymize(userID string, IsScheduledAnonymization bool
 	}
 
 	// Sessions:
-	if err = c.terminateAllSessions(userID); err != nil {
+	if err = c.terminateAllSessionsAndCleanUp(userID); err != nil {
 		return err
 	}
 

pkg/lib/oauth/redis/store.go

@@ -727,3 +727,17 @@ func (s *Store) ConsumePreAuthenticatedURLToken(tokenHash string) (*oauth.PreAut
 
 	return t, nil
 }
+
+func (s *Store) CleanUpForDeletingUserID(userID string) (err error) {
+	ctx := context.Background()
+	listKey := offlineGrantListKey(string(s.AppID), userID)
+
+	err = s.Redis.WithConn(func(conn *goredis.Conn) error {
+		_, err := conn.Del(ctx, listKey).Result()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	return
+}

pkg/lib/oauth/session_manager.go

@@ -94,3 +94,7 @@ func (m *SessionManager) TerminateAllExcept(userID string, currentSession sessio
 
 	return deletedSessions, nil
 }
+
+func (m *SessionManager) CleanUpForDeletingUserID(userID string) error {
+	return m.Store.CleanUpForDeletingUserID(userID)
+}

pkg/lib/oauth/store_grant.go

@@ -48,6 +48,8 @@ type OfflineGrantStore interface {
 
 	ListOfflineGrants(userID string) ([]*OfflineGrant, error)
 	ListClientOfflineGrants(clientID string, userID string) ([]*OfflineGrant, error)
+
+	CleanUpForDeletingUserID(userID string) error
 }
 
 type IDPSessionProvider interface {

pkg/lib/session/idpsession/manager.go

@@ -79,3 +79,7 @@ func (m *Manager) TerminateAllExcept(userID string, currentSession session.Resol
 
 	return deletedSessions, nil
 }
+
+func (m *Manager) CleanUpForDeletingUserID(userID string) error {
+	return m.Store.CleanUpForDeletingUserID(userID)
+}

pkg/lib/session/idpsession/store.go

@@ -19,4 +19,6 @@ type Store interface {
 	Delete(*IDPSession) error
 	// List lists the sessions belonging to the user, in ascending creation time order
 	List(userID string) ([]*IDPSession, error)
+	// CleanUpForDeletingUserID cleans up for a deleting user ID.
+	CleanUpForDeletingUserID(userID string) error
 }

pkg/lib/session/idpsession/store_redis.go

@@ -169,6 +169,19 @@ func (s *StoreRedis) Delete(session *IDPSession) (err error) {
 	return
 }
 
+func (s *StoreRedis) CleanUpForDeletingUserID(userID string) (err error) {
+	ctx := context.Background()
+	listKey := sessionListKey(s.AppID, userID)
+	err = s.Redis.WithConn(func(conn *goredis.Conn) error {
+		_, err := conn.Del(ctx, listKey).Result()
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+	return
+}
+
 //nolint:gocognit
 func (s *StoreRedis) List(userID string) (sessions []*IDPSession, err error) {
 	ctx := context.Background()