Merge pull request #20381 from mozilla/PAY-3438

feat(payments-api): Delete glean/nimbus data on account deletion

Author: david1alvarez

apps/payments/api/.env

@@ -58,6 +58,11 @@ GLEAN_CONFIG__VERSION=0.0.0
 GLEAN_CONFIG__CHANNEL='development'
 GLEAN_CONFIG__LOGGER_APP_NAME='fxa-payments-next'
 
+# Nimbus Manager Config
+NIMBUS_MANAGER__ENABLED=false
+NIMBUS_MANAGER__NAMESPACE=
+NIMBUS_MANAGER__DELETION_NAMESPACES=
+
 # FXA Webhook Config
 FXA_WEBHOOK_CONFIG__FXA_WEBHOOK_ISSUER=https://accounts.firefox.com/
 FXA_WEBHOOK_CONFIG__FXA_WEBHOOK_JWKS_URI=https://oauth.accounts.firefox.com/v1/jwks/

apps/payments/next/.env

@@ -170,6 +170,7 @@ NIMBUS_CLIENT__TIMEOUT_MS=100
 # Nimbus Manager
 NIMBUS_MANAGER__ENABLED=true
 NIMBUS_MANAGER__NAMESPACE=e0066f05-3967-4f6e-8492-03933512611a
+NIMBUS_MANAGER__DELETION_NAMESPACES=e0066f05-3967-4f6e-8492-03933512611a
 
 # Other
 CONTENT_SERVER_URL=http://localhost:3030

libs/payments/experiments/src/lib/nimbus.manager.config.ts

@@ -4,19 +4,35 @@
 
 import { faker } from '@faker-js/faker';
 import { Provider } from '@nestjs/common';
-import { IsBoolean, IsString } from 'class-validator';
+import { Transform } from 'class-transformer';
+import { IsBoolean, IsOptional, IsString } from 'class-validator';
 
 export class NimbusManagerConfig {
   @IsBoolean()
   public readonly enabled!: boolean;
 
   @IsString()
   public readonly namespace!: string;
+
+  @IsOptional()
+  @IsString({ each: true })
+  @Transform(({ value }) => {
+    if (typeof value !== 'string') {
+      return value;
+    }
+    const deletionNamespaces = value
+      .split(',')
+      .map((namespace) => namespace.trim())
+      .filter(Boolean);
+    return deletionNamespaces.length > 0 ? deletionNamespaces : undefined;
+  })
+  public readonly deletionNamespaces?: string[];
 }
 
 export const MockNimbusManagerConfig = {
   enabled: faker.datatype.boolean(),
   namespace: faker.string.uuid(),
+  deletionNamespaces: [faker.string.uuid(), faker.string.uuid()],
 } satisfies NimbusManagerConfig;
 
 export const MockNimbusManagerConfigProvider = {

libs/payments/experiments/src/lib/nimbus.manager.spec.ts

@@ -80,6 +80,7 @@ describe('NimbusClient', () => {
       nimbusUserId,
       language: mockContext.language || undefined,
       region: mockContext.region || undefined,
+      preview: false,
     };
 
     beforeEach(() => {
@@ -97,6 +98,7 @@ describe('NimbusClient', () => {
       expect(nimbusClient.fetchExperiments).toHaveBeenCalledWith({
         clientId: nimbusUserId,
         context: mockContext,
+        preview: false,
       });
     });
 
@@ -153,4 +155,47 @@ describe('NimbusClient', () => {
       );
     });
   });
+
+  describe('generateAllNimbusIdsForDeletion', () => {
+    const mockFxaUid = faker.string.uuid();
+    const mockNimbusUserId = faker.string.uuid();
+
+    beforeEach(() => {
+      mockedGenerateNimbusId.mockReturnValue(mockNimbusUserId);
+    });
+
+    it('returns a nimbus id for the primary namespace and each deletion namespace', () => {
+      const result = nimbusManager.generateAllNimbusIdsForDeletion(mockFxaUid);
+
+      expect(result).toHaveLength(
+        mockNimbusManagerConfig.deletionNamespaces.length + 1
+      );
+      expect(mockedGenerateNimbusId).toHaveBeenCalledWith(
+        mockNimbusManagerConfig.namespace,
+        mockFxaUid
+      );
+      for (const ns of mockNimbusManagerConfig.deletionNamespaces) {
+        expect(mockedGenerateNimbusId).toHaveBeenCalledWith(ns, mockFxaUid);
+      }
+    });
+
+    it('returns only the primary namespace id when deletionNamespaces is undefined', () => {
+      const originalDeletionNamespaces =
+        mockNimbusManagerConfig.deletionNamespaces;
+      Object.defineProperty(mockNimbusManagerConfig, 'deletionNamespaces', {
+        value: undefined,
+        writable: true,
+      });
+
+      const result = nimbusManager.generateAllNimbusIdsForDeletion(mockFxaUid);
+
+      expect(result).toHaveLength(1);
+      expect(mockedGenerateNimbusId).toHaveBeenCalledWith(
+        mockNimbusManagerConfig.namespace,
+        mockFxaUid
+      );
+
+      mockNimbusManagerConfig.deletionNamespaces = originalDeletionNamespaces;
+    });
+  });
 });

libs/payments/experiments/src/lib/nimbus.manager.ts

@@ -60,4 +60,13 @@ export class NimbusManager {
       return generateNimbusId(this.nimbusManagerConfig.namespace);
     }
   }
+
+  // Returns a list of unique Nimbus IDs for a given fxaUid to be used for deletion
+  generateAllNimbusIdsForDeletion(fxaUid: string): string[] {
+    const namespaceSet = new Set([
+      this.nimbusManagerConfig.namespace,
+      ...(this.nimbusManagerConfig.deletionNamespaces ?? []),
+    ]);
+    return Array.from(namespaceSet).map((ns) => generateNimbusId(ns, fxaUid));
+  }
 }

libs/payments/metrics/src/lib/glean/glean.service.spec.ts

@@ -8,6 +8,7 @@ import { PaymentsGleanService } from './glean.service';
 import { MockPaymentsGleanFactory } from './glean.test-provider';
 import {
   MockPaymentsGleanConfigProvider,
+  PaymentsGleanConfig,
 } from './glean.config';
 import {
   AccountsMetricsDataFactory,
@@ -64,6 +65,7 @@ describe('PaymentsGleanService', () => {
   let accountManager: AccountManager;
   let customerManager: CustomerManager;
   let nimbusManager: NimbusManager;
+  let gleanConfig: PaymentsGleanConfig;
   let logger: Logger;
 
   beforeEach(async () => {
@@ -102,9 +104,70 @@ describe('PaymentsGleanService', () => {
     accountManager = moduleRef.get(AccountManager);
     customerManager = moduleRef.get(CustomerManager);
     nimbusManager = moduleRef.get(NimbusManager);
+    gleanConfig = moduleRef.get(PaymentsGleanConfig);
     logger = moduleRef.get(Logger);
   });
 
+  describe('handleUserDelete', () => {
+    const mockUid = 'test-uid-123';
+    const mockNimbusIds = ['nimbus-id-1', 'nimbus-id-2'];
+
+    beforeEach(() => {
+      jest
+        .spyOn(nimbusManager, 'generateAllNimbusIdsForDeletion')
+        .mockReturnValue(mockNimbusIds);
+      jest.spyOn(logger, 'log').mockImplementation(() => {});
+    });
+
+    it('logs one entry per nimbus user id', () => {
+      paymentsGleanService.handleUserDelete(mockUid);
+
+      expect(
+        nimbusManager.generateAllNimbusIdsForDeletion
+      ).toHaveBeenCalledWith(mockUid);
+      expect(logger.log).toHaveBeenCalledTimes(mockNimbusIds.length);
+      for (const nimbusUserId of mockNimbusIds) {
+        expect(logger.log).toHaveBeenCalledWith('glean.user.delete', {
+          uid: mockUid,
+          nimbus_user_id: nimbusUserId,
+        });
+      }
+    });
+
+    it('still logs deletion even when glean is disabled', () => {
+      gleanConfig.enabled = false;
+
+      paymentsGleanService.handleUserDelete(mockUid);
+
+      expect(
+        nimbusManager.generateAllNimbusIdsForDeletion
+      ).toHaveBeenCalledWith(mockUid);
+      expect(logger.log).toHaveBeenCalledTimes(mockNimbusIds.length);
+      for (const nimbusUserId of mockNimbusIds) {
+        expect(logger.log).toHaveBeenCalledWith('glean.user.delete', {
+          uid: mockUid,
+          nimbus_user_id: nimbusUserId,
+        });
+      }
+
+      gleanConfig.enabled = true;
+    });
+
+    it('logs a single entry when one namespace is configured', () => {
+      jest
+        .spyOn(nimbusManager, 'generateAllNimbusIdsForDeletion')
+        .mockReturnValue(['single-nimbus-id']);
+
+      paymentsGleanService.handleUserDelete(mockUid);
+
+      expect(logger.log).toHaveBeenCalledTimes(1);
+      expect(logger.log).toHaveBeenCalledWith('glean.user.delete', {
+        uid: mockUid,
+        nimbus_user_id: 'single-nimbus-id',
+      });
+    });
+  });
+
   describe('recordGenericSubManageEvent', () => {
     const mockEventData = GenericGleanSubManageEventFactory();
 

libs/payments/metrics/src/lib/glean/glean.service.ts

@@ -201,6 +201,26 @@ export class PaymentsGleanService {
     };
   }
 
+  handleUserDelete(uid: string): void {
+    try {
+      const nimbusUserIds =
+        this.nimbusManager.generateAllNimbusIdsForDeletion(uid);
+      for (const nimbusUserId of nimbusUserIds) {
+        // PAY-3438: Log format consumed by BigQuery ETL for Glean Shredder.
+        // Do not change jsonPayload.type or field names without updating the ETL query.
+        this.log.log('glean.user.delete', {
+          uid,
+          nimbus_user_id: nimbusUserId,
+        });
+      }
+    } catch (error) {
+      this.log.error(
+        `Failed to generate Nimbus deletion ids for uid ${uid}`,
+        error instanceof Error ? error.stack : undefined
+      );
+    }
+  }
+
   async recordGenericSubManageEvent({
     eventName,
     uid,

libs/payments/metrics/src/lib/glean/glean.test-provider.ts

@@ -1,3 +1,4 @@
+import { PaymentsGleanService } from './glean.service';
 import { PaymentsGleanProvider } from './glean.types';
 
 /**
@@ -18,3 +19,18 @@ export const MockPaymentsGleanFactory = {
       recordSubscriptionTrialConverted: () => {},
     }) as any,
 };
+
+export const MockPaymentsGleanServiceFactory = {
+  provide: PaymentsGleanService,
+  useFactory: () =>
+    ({
+      handleUserDelete: () => {},
+      recordGenericSubManageEvent: () => {},
+      retrieveSubManageMetricsData: () => {},
+      mapStripeMetricsData: () => {},
+      mapAccountsMetricsData: () => {},
+      mapSubPlatCmsMetricsData: () => {},
+      mapSessionMetricsData: () => {},
+      mapExperimentationMetricsData: () => {},
+    }) as any,
+};

libs/payments/webhooks/src/lib/fxa-webhooks.controller.spec.ts

@@ -4,6 +4,7 @@
 
 import { Test } from '@nestjs/testing';
 import { Logger } from '@nestjs/common';
+import { MockPaymentsGleanServiceFactory } from '@fxa/payments/metrics';
 import { FxaWebhooksController } from './fxa-webhooks.controller';
 import { FxaWebhookService } from './fxa-webhooks.service';
 import { MockFxaWebhookConfigProvider } from './fxa-webhooks.config';
@@ -21,6 +22,7 @@ describe('FxaWebhooksController', () => {
         FxaWebhookService,
         MockFxaWebhookConfigProvider,
         MockStatsDProvider,
+        MockPaymentsGleanServiceFactory,
       ],
     }).compile();
 

libs/payments/webhooks/src/lib/fxa-webhooks.service.spec.ts

@@ -8,6 +8,7 @@ import * as Sentry from '@sentry/nestjs';
 import { JWTool, PrivateJWK } from '@fxa/vendored/jwtool';
 import { StatsDService } from '@fxa/shared/metrics/statsd';
 import type { StatsD } from 'hot-shots';
+import { PaymentsGleanService } from '@fxa/payments/metrics';
 import { FxaWebhookService } from './fxa-webhooks.service';
 import { FxaWebhookConfig } from './fxa-webhooks.config';
 import {
@@ -43,6 +44,7 @@ jest.mock('@type-cacheable/core', () => {
       descriptor;
 
   const Cacheable = jest.fn(() => noopDecorator);
+  const CacheClear = jest.fn(() => noopDecorator);
 
   const defaultExport = {
     setOptions: jest.fn(),
@@ -52,6 +54,7 @@ jest.mock('@type-cacheable/core', () => {
     __esModule: true,
     default: defaultExport,
     Cacheable,
+    CacheClear,
   };
 });
 
@@ -121,6 +124,7 @@ describe('FxaWebhookService', () => {
   let service: FxaWebhookService;
   let statsd: { increment: jest.Mock; timing: jest.Mock };
   let logger: { error: jest.Mock; log: jest.Mock };
+  let paymentsGleanService: { handleUserDelete: jest.Mock };
   let originalFetch: typeof global.fetch;
 
   beforeEach(async () => {
@@ -129,6 +133,7 @@ describe('FxaWebhookService', () => {
 
     logger = { error: jest.fn(), log: jest.fn() };
     statsd = { increment: jest.fn(), timing: jest.fn() };
+    paymentsGleanService = { handleUserDelete: jest.fn() };
 
     const module = await Test.createTestingModule({
       providers: [
@@ -143,6 +148,10 @@ describe('FxaWebhookService', () => {
           } satisfies FxaWebhookConfig,
         },
         { provide: StatsDService, useValue: statsd as unknown as StatsD },
+        {
+          provide: PaymentsGleanService,
+          useValue: paymentsGleanService,
+        },
       ],
     }).compile();
 
@@ -224,6 +233,9 @@ describe('FxaWebhookService', () => {
         'handleDeleteUser',
         expect.objectContaining({ sub: TEST_UID })
       );
+      expect(paymentsGleanService.handleUserDelete).toHaveBeenCalledWith(
+        TEST_UID
+      );
     });
 
     it('handles metrics-opt-out event', async () => {