Account Expiration and Inactivity Detection¶
Feature Overview¶
Implements policies for account expiration and detection of inactive accounts through Auth0 and the local database to enhance security, maintain data hygiene, and ensure compliance with data protection regulations.
User Stories¶
US-UM-56: Configure Auth0 Account Expiration Policies¶
As a platform administrator, I want to configure Auth0 account expiration policies synchronized with the local database, So that inactive accounts are automatically disabled after a specified period in both systems.
Acceptance Criteria: - Given I am logged in as a platform administrator - When I navigate to the security policy settings - Then I should see options to configure account expiration policies - And I should be able to set: - Inactivity threshold period (e.g., 90 days, 180 days) - Warning notification schedule (e.g., 30, 15, 7 days before expiration) - Action to take upon expiration (disable, delete, archive) - Different policies for different user roles - Which system is authoritative for inactivity tracking - When I update these policies - Then: - The changes should be applied to Auth0 tenant settings - The local database should be updated with the same policies - The changes should be applied organization-wide - And the changes should be logged for audit purposes in both systems
US-UM-57: Detect Inactive Accounts Across Systems¶
As a platform administrator, I want to automatically detect inactive user accounts in both Auth0 and the local database, So that I can maintain platform security and data hygiene across both systems.
Acceptance Criteria: - Given account expiration policies are configured - When the system runs the scheduled inactivity check - Then: - It should check Auth0 logs for last login activity - It should check local database for last activity - It should identify accounts that have not logged in during the specified inactivity threshold period - It should flag these accounts as potentially inactive in both systems - And it should generate a report of inactive accounts for administrators - And the report should include: - User details - Last login date in Auth0 - Last activity date in local database - Days remaining until expiration - Any synchronization issues between systems - And the detection process should be logged for audit purposes in both systems - And the system should initiate the notification process for accounts approaching expiration
US-UM-58: Notify Users of Impending Auth0 Account Expiration¶
As a staffing company user, I want to receive notifications when my account is approaching expiration due to inactivity, So that I can take action to prevent losing access.
Acceptance Criteria: - Given my account has been flagged as approaching the inactivity threshold - When the notification schedule triggers - Then: - I should receive email notifications at the defined intervals - The emails should be sent through Auth0 email templates - The local system should track notification status - And the notifications should: - Clearly explain the reason for potential expiration - Specify the expiration date - Provide instructions on how to prevent expiration - Include contact information for support - Explain that both Auth0 and local account access will be affected - When I log in after receiving a notification - Then: - My inactivity timer should reset in Auth0 - My inactivity timer should reset in the local database - The systems should be synchronized to ensure consistent status - And I should see a confirmation that my account is now active
US-UM-59: Process Expired Accounts Across Systems¶
As a platform administrator, I want to the system to automatically process expired accounts according to policy in both Auth0 and the local database, So that inactive accounts are handled consistently and securely across both systems.
Acceptance Criteria: - Given an account has reached its expiration date due to inactivity - When the system processes expired accounts - Then: - It should apply the configured action (disable, delete, or archive) in the local database - It should apply the corresponding action in Auth0 (block, delete) - It should ensure synchronization between both systems - And it should send a final notification to the user - And it should notify administrators of the action taken - And it should log the action for audit purposes in both systems - And if the action is to disable: - The account should be blocked in Auth0 - The account should be marked as inactive in the local database - The user should be prevented from logging in through any authentication method - And if the action is to delete: - The account should be deleted from Auth0 - The account should be removed from the local database in compliance with data protection regulations - And if the action is to archive: - The account should be blocked in Auth0 - The account data should be securely archived in the local database for the required retention period
US-UM-60: Reactivate Expired Account Across Systems¶
As a staffing company user with an expired account, I want to reactivate my account in both Auth0 and the local database, So that I can regain access to the platform.
Acceptance Criteria: - Given my account has been disabled due to inactivity - When I attempt to log in - Then I should see a message explaining that my account is inactive - And I should be provided with options to reactivate my account - When I select to reactivate my account - Then I should be guided through a secure verification process - And this process should include: - Identity verification through Auth0 - Password reset through Auth0 - Confirmation of account details - Acceptance of current terms and conditions - When I complete the reactivation process - Then: - My Auth0 account should be unblocked - My local account should be restored to active status - The systems should be synchronized to ensure consistent status - And I should be able to log in through Auth0 - And the reactivation should be logged for audit purposes in both systems
US-UM-61: View Account Expiration Analytics Across Systems¶
As a staffing company administrator, I want to view analytics on account expiration and inactivity across both Auth0 and the local database, So that I can monitor user engagement and take proactive measures.
Acceptance Criteria: - Given I am logged in as a staffing company administrator - When I navigate to the user analytics dashboard - Then I should see statistics on account activity including: - Number of active accounts in both systems - Number of accounts approaching expiration - Number of expired/disabled accounts - Trends in account activity over time - Auth0 login patterns - System synchronization status - And I should be able to filter data by date range, user roles, and system - And I should be able to drill down to see specific users in each category - And I should be able to see any discrepancies between Auth0 and local database status - And I should be able to export reports for analysis and compliance purposes - And I should receive recommendations for improving user engagement
US-UM-62: Synchronize Account Status Between Systems¶
As a platform administrator, I want to ensure account status is synchronized between Auth0 and the local database, So that account expiration and inactivity policies are consistently enforced.
Acceptance Criteria: - Given I am logged in as a platform administrator - When I navigate to the system integration dashboard - Then I should see the status of Auth0 and local database synchronization - And I should see any account status synchronization issues - And I should be able to: - View users with account status synchronization issues - Trigger manual synchronization for specific users - Configure automatic synchronization settings - Set which system is authoritative for account status - When synchronization issues are detected - Then the system should: - Log the discrepancy - Attempt automatic resolution based on configured policies - Alert administrators for manual intervention if needed - And I should be able to view reports on synchronization status and history - And I should be able to configure synchronization frequency and triggers
Dependencies¶
- User Creation and Administration feature must be implemented
- Email service integration for sending notifications
- Audit logging system for tracking account status changes
- Compliance with data protection regulations for account deletion
- Auth0 tenant setup and configuration
- Auth0 Management API integration