User Deactivation and Deletion¶
Feature Overview¶
Enables staffing company administrators to deactivate or delete users from both the local system and Auth0, ensuring former employees no longer have access while maintaining compliance with data protection regulations.
User Stories¶
US-UM-14: Deactivate User Account with Auth0 Synchronization¶
As a staffing company administrator, I want to temporarily deactivate user accounts in both the local system and Auth0, So that I can quickly suspend access for users on leave or under review without permanently removing their data.
Acceptance Criteria: - Given I am logged in as a staffing company administrator - When I navigate to the user management section - Then I should see a list of all users - When I select a user - Then I should see an option to deactivate the account - When I select deactivate - Then I should be prompted to confirm the action - When I confirm - Then: - The user's account should be immediately deactivated in the local database - The corresponding Auth0 account should be blocked - The systems should be synchronized to ensure consistent access control - And the user should no longer be able to log in through any authentication method - And the user's status should be updated to "Inactive" in the system - And the action should be logged for audit purposes in both systems - And I should be able to reactivate the account later if needed
US-UM-15: Delete User Account with Auth0 Synchronization¶
As a staffing company administrator, I want to permanently delete user accounts from both the local system and Auth0, So that former employees no longer have access to the platform and their data is removed in compliance with data protection regulations.
Acceptance Criteria: - Given I am logged in as a staffing company administrator - When I navigate to the user management section - Then I should see a list of all users - When I select a user - Then I should see an option to delete the account - When I select delete - Then I should be presented with a warning about the permanent nature of this action - And I should be required to enter my password to confirm - When I confirm the deletion - Then: - The user's account should be permanently removed from the local database - The corresponding Auth0 account should be deleted - The systems should be synchronized to ensure complete removal - And all personal data should be deleted in compliance with data protection regulations - And the action should be logged for audit purposes in both systems - And a confirmation message should be displayed - And the system should handle any synchronization errors gracefully
US-UM-16: Transfer User Responsibilities Before Account Removal¶
As a staffing company administrator, I want to transfer a user's responsibilities before deletion from both systems, So that important work and data ownership is not lost when an employee leaves.
Acceptance Criteria: - Given I am logged in as a staffing company administrator - When I initiate the process to delete a user account - Then I should be prompted to transfer the user's responsibilities - And I should see a list of items owned by the user that need reassignment - When I select another active user to receive these responsibilities - Then the system should transfer ownership of all items - And provide a summary of the transfers - When I confirm the transfers - Then: - The deletion process should continue in the local database - The Auth0 account deletion should proceed - All system permissions should be updated to reflect the transfers - And the receiving user should be notified of their new responsibilities
US-UM-17: Bulk Deactivation of User Accounts with Auth0 Synchronization¶
As a staffing company administrator, I want to deactivate multiple user accounts at once in both systems, So that I can efficiently manage access during organizational changes or projects ending.
Acceptance Criteria: - Given I am logged in as a staffing company administrator - When I navigate to the user management section - Then I should be able to select multiple users - When I select the bulk action "Deactivate" - Then I should be prompted to confirm the action - When I confirm - Then: - All selected accounts should be deactivated simultaneously in the local database - All corresponding Auth0 accounts should be blocked - The systems should be synchronized to ensure consistent access control - And the system should display a summary of the deactivated accounts - And all actions should be logged for audit purposes in both systems - And affected users should no longer be able to log in through any authentication method - And the system should handle any synchronization errors gracefully
US-UM-18: View Comprehensive Deactivation and Deletion Logs¶
As a staffing company administrator, I want to view logs of all account deactivations and deletions from both local system and Auth0, So that I can maintain a comprehensive audit trail for compliance and security purposes.
Acceptance Criteria: - Given I am logged in as a staffing company administrator - When I navigate to the user management audit section - Then I should see a log of all account deactivations and deletions - And each log entry should include: - Date and time of the action - Type of action (deactivation or deletion) - User affected - Administrator who performed the action - Reason provided (if applicable) - Systems affected (local database, Auth0, or both) - Synchronization status - And I should be able to filter logs by date range, action type, user, and system - And I should be able to export the logs for compliance reporting - And I should be able to see any synchronization issues that occurred
US-UM-19: Reactivate User Account with Auth0 Synchronization¶
As a staffing company administrator, I want to reactivate previously deactivated user accounts in both systems, So that returning employees can regain access to the platform without creating new accounts.
Acceptance Criteria: - Given I am logged in as a staffing company administrator - When I navigate to the user management section - Then I should be able to view inactive users - When I select an inactive user - Then I should see an option to reactivate the account - When I select reactivate - Then: - The user's account should be restored to active status in the local database - The corresponding Auth0 account should be unblocked - The systems should be synchronized to ensure consistent access control - And the user should receive a notification about the reactivation - And the user should be able to log in again through all previously configured authentication methods - And the action should be logged for audit purposes in both systems - And the system should handle any synchronization errors gracefully
US-UM-20: Handle Auth0 Account Conflicts¶
As a staffing company administrator, I want to resolve conflicts between local user accounts and Auth0 accounts, So that I can maintain data integrity and ensure proper access control.
Acceptance Criteria: - Given I am logged in as a staffing company administrator - When I navigate to the user management section - Then I should see indicators for users with Auth0 synchronization issues - When I select a user with synchronization issues - Then I should see details about the specific conflict - And I should be presented with options to resolve the conflict: - Update local account to match Auth0 - Update Auth0 account to match local - Manually reconcile differences - When I select a resolution option - Then the system should apply the changes to synchronize the accounts - And provide a confirmation of successful resolution - And log the resolution actions for audit purposes - And the user should be notified if any significant changes were made to their account
Dependencies¶
- User Creation and Administration feature must be implemented
- Audit logging system for tracking all account actions
- Compliance with data protection regulations for data deletion
- Auth0 tenant setup and configuration
- Integration between local database and Auth0