E-mail confirmation, bots, deleting users

Why the e-mail is confirmed, protection from bots without outside services, delete for good or anonymise.

How the portal keeps bots out, why the e-mail is confirmed, and how to delete a user for good without breaking GCP.

E-mail confirmation

Until the owner opens the link from the letter, the account stays closed. Bots never open the letter, so they stay unconfirmed and a Portal Owner deletes them in one go.

After sign-up a letter comes with a “Confirm the e-mail” button. The link works once and for 24 hours; the database keeps only its hash.
Until the address is confirmed, nobody can sign in. A person who lost the letter simply signs in with the password: the portal sends a new link (at most once a minute and five a day).
A study invitation came to the same address, so invited people are confirmed at once. A password reset by a link from the mail confirms the address too.
The Portal Owner sees the status “E-mail not confirmed” and can mark the address confirmed by hand when they know the person.
If the server has no mail set up, nothing can be confirmed, so the check switches itself off and Users and Settings show a warning.

Protection from bots

We use neither Google reCAPTCHA nor Cloudflare: they send visitors’ data abroad (152-FZ) and may stop working under sanctions. Instead, checks that a person never notices:

A trap. The form has a field people cannot see. A bot fills it and gets the usual “check your mail” page, but no account is made.
Fill time. A form sent back in under 3 seconds, or older than 3 hours, is refused.
Limits per network address and per e-mail. At most 5 sign-ups an hour and 20 a day from one address, 60 failed sign-ins an hour, 3 password letters an hour to one e-mail.
Throwaway mail and links. Addresses at known throwaway mail services (mailinator, yopmail, temp-mail and others) are refused; the Portal Owner adds more domains in Settings → Protection from bots. The name, organisation and position cannot contain links: bots use them to send advertising through our welcome letters.

Deleting a user for good

The portal checks whether the account left records in the work and offers only the allowed option.

Open the user’s card (Administration → Users → the person); the section “Delete the account for good” is at the bottom. Type their e-mail to confirm.

No records in the work (a bot, or a person who only signed up): the account is deleted completely, as if it never existed.
Records in the work (entered or changed data, signed, was in a team, made projects): it cannot be deleted, because GCP and 21 CFR Part 11 require the audit trail to keep who did what. The portal offers anonymisation: the name, e-mail, organisation, position and password are wiped for good, sign-in closes, team memberships end, letters in the queue are dropped. The records and the audit trail stay and point to the account number (#N).
A Portal Owner cannot be deleted until the Portal Owner rights are removed. Nobody can delete themselves.
Every deletion and anonymisation goes to the portal audit trail by the account number, without the e-mail.

Deleting all bots at once

Users → Delete the bots… lists the accounts that have not confirmed their e-mail within the chosen time (1 hour, a day, 3 or 7 days) and left no records. Portal Owners, the demo team and anyone with records in a study are never on the list. Type the number of accounts to confirm.

The demo team is not bots. The “Demo project” button makes invented people with @demo.invalid addresses. They are inactive, nobody can sign in as them and they get no letters. In the list of users they have their own filter “Demo team” and are deleted once no demo project is left.

Commands on the server

For the server administrator (in /opt/youedc-platform):

docker compose exec yp_app flask --app wsgi users-recent --days 7: sign-ups of the week, when, from which address, e-mail confirmed or not, and network addresses with suspiciously many sign-ups.
docker compose exec yp_app flask --app wsgi users-purge-unconfirmed --hours 24: list the unconfirmed accounts without records; with --yes delete them.
docker compose exec yp_app flask --app wsgi user-delete EMAIL: show what would happen (deletion or anonymisation); with --yes do it.