Class: Admin::Privacy::DeletionRequestsController

Inherits:

CrmController

Object
ActionController::Base
ApplicationController
CrmController
Admin::Privacy::DeletionRequestsController

show all

Defined in:: app/controllers/admin/privacy/deletion_requests_controller.rb

Overview

Controller: admin review queue for privacy deletion requests.

Constant Summary collapse

MANUAL_SOURCES =

::Privacy::DeletionRequest::SOURCES - %w[facebook_callback]

Constants included from Www::SeoHelper

Constants included from IconHelper

IconHelper::CUSTOM_ICON_MAP, IconHelper::CUSTOM_SVG_DIR, IconHelper::DEFAULT_FAMILY

Instance Method Summary collapse

#approve ⇒ Object
POST /admin/privacy/deletion_requests/:id/approve — clear the Tier-3 hold and re-enqueue the worker.
#create ⇒ Object
POST /admin/privacy/deletion_requests — create a manual request, resolve account_id / party_id from email or account_id input, then enqueue the worker.
#decline ⇒ Object
POST /admin/privacy/deletion_requests/:id/decline — terminal "no".
#index ⇒ Object
GET /admin/privacy/deletion_requests.
#new ⇒ Object
GET /admin/privacy/deletion_requests/new — manual intake form for requests that arrived by email / postal mail / in-person rather than through Meta's webhook.
#retry_request ⇒ Object
POST /admin/privacy/deletion_requests/:id/retry — failed → pending, re-enqueue.
#show ⇒ Object
GET /admin/privacy/deletion_requests/:id.

Methods inherited from CrmController

#access_denied, #context_id, #context_object, #crm_home_path, #current_ability, #default_url_options, #download_temp, #get_tempfile_path_for_download, #init_status_job_collector, #initialize_crm_lazy_chunks, #persist_enqueued_status_jobs, #record_not_found, #redirect_to_job_or_fallback, #render_edit_action, #set_context, #set_download_path, #stash_file_for_temp_download, #sync_admin_presence_cookie

Methods inherited from ApplicationController

#account_impersonated?, #add_to_flash, #after_sign_in_path_for, #bypass_forgery_protection?, #chat_enabled?, #cloudflare_cleared?, #default_catalog, #default_url_options, #enable_turbo_frames, #find_publication, #fix_invalid_accept_header, #init_js_utils, #is_globals_call?, #layout_by_resource, #locale_store, #redirect_to, #require_employee_for_crm, #set_base_host, #set_real_ip, #set_report_errors_for, #should_render_layout?, #stamp_impersonation_context, #warmlyyours_canada_ip?, #warmlyyours_ip?, #y

Methods included from Controllers::ReturnPathHandling

#check_for_return_path, #redirect_to_return_path_or_default

Methods included from Controllers::AnalyticsEvents

#consume_queued_analytics_events, #track_event

Methods included from Controllers::DeviceDetection

#device_detector, #is_ie?

Methods included from Controllers::SubdomainDetection

#is_crm_request?, #is_www_request?, #json_request?

Methods included from Controllers::TurboSafeRedirect

#redirect_to

Methods included from Controllers::TrackingDetection

#bot_request?, #gdpr_country?, #gdpr_country_data, #prevent_bots, #set_tracking_cookie, #track_visitor?

Methods included from Controllers::AcceleratedFileSending

#send_file_accelerated, #send_upload_accelerated

Methods included from Controllers::ErrorRendering

#excp_string, #mail_to_for_error_reporting, #render_400, #render_404, #render_406, #render_410, #render_500, #render_invalid_authenticity_token, #render_ip_spoof_error, #render_unpermitted_parameters, #safe_referer_or_fallback

Methods included from Controllers::TurnstileVerification

#load_turnstile_script_tag, #turnstile_lazy_widget, #turnstile_script_tag, #turnstile_widget, #validate_turnstile!

Methods included from Controllers::CloudflareCaching

edge_cached, #edge_cached_action?, #reset_cloudflare_cache, #set_cloudflare_cache, #skip_edge_cache!, #skip_session

Methods included from Controllers::Webpackable

#preload_webpack_fonts, #webpack_css_include, #webpack_css_url, #webpack_js_include, #wpd_is_running?

Methods included from Controllers::Localizable

#cloudflare_country_locale, #determine_request_locale, #geocoder_locale, #guest_user_locale_check, #locale_optional_www_auth_path?, #param_locale, #set_locale, #set_request_locale, #skip_localization?, #warmlyyours_ip_locale

Methods included from Controllers::Authenticable

#access_denied, #authenticate_account, #authenticate_account!, #authenticate_account_from_login_token!, #check_is_a_manager, #check_is_a_sales_manager, #check_is_an_admin, #check_is_an_employee, #check_party, #clear_mismatched_guest_user, #create_guest_user, #credentials?, #current_or_guest_user, #current_or_guest_user_id_read_only, #current_user, #devise_mapping, #fully_logged_in?, #generate_bot_id, #guest_user, #identifiable?, #init_current_user, #initialize_guest, #load_context_user, #logging_in, #resource, #resource_name, #restrict_access_for_non_employees, #scrubbed_request_path, #user_object, #warn_on_session_guest_id_leak

Methods included from ApplicationHelper

#better_number_to_currency, #check_force_logout, #check_or_cross, #check_or_times, #embedded_tab_frame_id, #error_messages, #general_disclaimer_on_product_installation_and_local_codes, #gridjs_from_html_table, #gridjs_table, #is_wy_ip, #line_break, #parent_layout, #pass_or_fail, #render_error_messages_list, #render_video_card, #resolved_auth_form_turbo_frame, #return_path_or, #safe_css_color, #set_return_path_if_present, #set_section_if_present, #tab_frame_id, #to_underscore, #track_page?, #turbo_section_wrapper, #turbo_tabs_request?, #url_on_same_domain_as_request, #widget_index_daily_focus_index_path, #working_hours?, #yes_or_no, #yes_or_no_highlighted, #yes_or_no_with_check_or_cross, #youtube_video

Methods included from UppyUploaderHelper

#file_uploader, #image_uploader, #large_file_uploader_s3, #lead_sketch_uploader, #rma_image_uploader, #rma_image_uploader_s3, #uppy_uploader, #video_uploader

Methods included from Www::ImagesHelper

#image_asset_tag, #image_asset_url

Methods included from Www::SeoHelper

#add_page_schema, #add_webpage_schema, #canada?, #company_social_links, #ensure_context_json, #json_ld_script_tag, #local_business_schema, #online_store_id, #online_store_schema, #page_main_entity, #page_main_entity_json, #render_auto_collection_page_schema, #render_collection_page_schema, #render_local_business_schema, #render_online_store_schema, #render_page_schemas, #render_page_video_schemas, #render_webpage_schema, #render_webpage_schema_with_collections, #usa?

Methods included from UrlsHelper

#catalog_breadcrumb_links, #catalog_link, #catalog_link_for_product_line, #catalog_link_for_sku, #cms_link, #delocalized_path, #path_to_sales_product_sku, #path_to_sales_product_sku_for_product_line, #path_to_sales_product_sku_for_product_line_slug, #product_line_from_catalog_link, #protocol_neutral_url, #sanitize_external_url, #valid_external_url?

Methods included from IconHelper

#account_nav_icon, #fa_icon, #star_rating_html

Instance Method Details

#approve ⇒ `Object`

POST /admin/privacy/deletion_requests/:id/approve — clear the Tier-3
hold and re-enqueue the worker.

# File 'app/controllers/admin/privacy/deletion_requests_controller.rb', line 91

def approve
  return redirect_back_with_error(:approve) unless @request.can_start_processing?

  @request.update!(reviewed_by: current_account, reviewed_at: Time.current)
  ::Privacy::DataDeletionWorker.perform_async(@request.id)
  flash[:success] = "Approved request ##{@request.id}; scrub enqueued."
  redirect_to admin_privacy_deletion_request_path(@request)
end

#create ⇒ `Object`

POST /admin/privacy/deletion_requests — create a manual request,
resolve account_id / party_id from email or account_id input,
then enqueue the worker. The same Tier-3 review gate + scrub
pipeline applies; admin doesn't need to do anything else unless a
trigger fires (in which case they get a held_for_review email).

# File 'app/controllers/admin/privacy/deletion_requests_controller.rb', line 46

def create
  @sources = MANUAL_SOURCES
  attrs    = manual_request_params

  @request = ::Privacy::DeletionRequest.new(
    source: attrs[:source].presence_in(MANUAL_SOURCES) || 'manual_email'
  )
  # Echo the virtual attrs so a re-render preserves what the admin typed.
  @request.account_lookup  = attrs[:account_lookup]
  @request.contact_email   = attrs[:contact_email]
  @request.intake_notes    = attrs[:intake_notes]
  @request.require_account = attrs[:require_account]

  if attrs[:account_lookup].blank?
    @request.errors.add(:account_lookup,
                        "can't be blank — enter an account email, login, or numeric account ID")
    render :new, status: :unprocessable_entity
    return
  end

  account = resolve_account(attrs[:account_lookup])
  if account.nil? && attrs[:require_account] == '1'
    @request.errors.add(:account_lookup,
                        "did not match any account. Uncheck 'Require matching account' to record a no_account_found row anyway.")
    render :new, status: :unprocessable_entity
    return
  end

  @request.account = account
  @request.party   = account&.party
  @request.data = {
    contact_email:  attrs[:contact_email].presence,
    account_lookup: attrs[:account_lookup],
    intake_notes:   attrs[:intake_notes].presence,
    created_by:     current_account.email
  }.compact
  @request.save!

  ::Privacy::DataDeletionWorker.perform_async(@request.id)
  flash[:success] = "Created request ##{@request.id}; worker enqueued."
  redirect_to admin_privacy_deletion_request_path(@request)
end

#decline ⇒ `Object`

POST /admin/privacy/deletion_requests/:id/decline — terminal "no".

# File 'app/controllers/admin/privacy/deletion_requests_controller.rb', line 101

def decline
  return redirect_back_with_error(:decline) unless @request.can_decline?

  @request.update!(reviewed_by: current_account, reviewed_at: Time.current)
  @request.decline
  flash[:success] = "Declined request ##{@request.id}."
  redirect_to admin_privacy_deletion_request_path(@request)
end

#index ⇒ `Object`

GET /admin/privacy/deletion_requests

# File 'app/controllers/admin/privacy/deletion_requests_controller.rb', line 23

def index
  @needs_review_requests = ::Privacy::DeletionRequest.needs_review.recent.limit(100)
  @recent_requests       = ::Privacy::DeletionRequest.recent.limit(100)
end

#new ⇒ `Object`

GET /admin/privacy/deletion_requests/new — manual intake form for
requests that arrived by email / postal mail / in-person rather
than through Meta's webhook.

# File 'app/controllers/admin/privacy/deletion_requests_controller.rb', line 36

def new
  @request = ::Privacy::DeletionRequest.new(source: 'manual_email')
  @sources = MANUAL_SOURCES
end

#retry_request ⇒ `Object`

POST /admin/privacy/deletion_requests/:id/retry — failed → pending, re-enqueue.

# File 'app/controllers/admin/privacy/deletion_requests_controller.rb', line 111

def retry_request
  return redirect_back_with_error(:retry) unless @request.can_retry_processing?

  @request.retry_processing
  ::Privacy::DataDeletionWorker.perform_async(@request.id)
  flash[:success] = "Re-enqueued request ##{@request.id}."
  redirect_to admin_privacy_deletion_request_path(@request)
end

#show ⇒ `Object`

GET /admin/privacy/deletion_requests/:id



29
30
31

# File 'app/controllers/admin/privacy/deletion_requests_controller.rb', line 29

def show
  # Renders details + actions; no extra setup needed.
end