feat(auth): implement Facebook data deletion callback and backfill command

.github/workflows/nightly_unit_tests.yml

@@ -32,6 +32,9 @@ jobs:
       SSL_ENABLED: false
       SESSION_DRIVER: redis
       PHP_VERSION: 8.3
+      FACEBOOK_CLIENT_ID: 214242500242860
+      FACEBOOK_CLIENT_SECRET: e62fa81aa898699d8cebf14bf5e586aa
+      FACEBOOK_REDIRECT_URI: /auth/login/facebook/callback
     services:
       mysql:
         image: mysql:8.0

.github/workflows/pull_request_unit_tests.yml

@@ -37,6 +37,9 @@ jobs:
       PHP_VERSION: 8.3
       OTEL_SDK_DISABLED: true
       OTEL_SERVICE_ENABLED: false
+      FACEBOOK_CLIENT_ID: 214242500242860
+      FACEBOOK_CLIENT_SECRET: e62fa81aa898699d8cebf14bf5e586aa
+      FACEBOOK_REDIRECT_URI: /auth/login/facebook/callback
     services:
       mysql:
         image: mysql:8.0

.github/workflows/push.yml

@@ -33,6 +33,9 @@ jobs:
       PHP_VERSION: 8.3
       OTEL_SDK_DISABLED: true
       OTEL_SERVICE_ENABLED: false
+      FACEBOOK_CLIENT_ID: 214242500242860
+      FACEBOOK_CLIENT_SECRET: e62fa81aa898699d8cebf14bf5e586aa
+      FACEBOOK_REDIRECT_URI: /auth/login/facebook/callback
     services:
       mysql:
         image: mysql:8.0

app/Console/Commands/FacebookDataDeletionBackfill.php

@@ -0,0 +1,108 @@
+<?php namespace App\Console\Commands;
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+use App\Services\Auth\IFacebookDataDeletionService;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Class FacebookDataDeletionBackfill
+ * Processes the "Download User Identifiers" CSV Facebook lets admins export
+ * from the app dashboard's Advanced Settings, unlinking each app-scoped ID
+ * from its matching OpenStackID user (same logic as the live callback).
+ * @package App\Console\Commands
+ */
+final class FacebookDataDeletionBackfill extends Command
+{
+    /**
+     * The console command name.
+     *
+     * @var string
+     */
+    protected $name = 'idp:facebook-data-deletion-backfill';
+
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'idp:facebook-data-deletion-backfill {path : Absolute path to the Facebook user identifiers CSV}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Process a Facebook "Download User Identifiers" CSV export, unlinking each app-scoped ID from its OpenStackID user.';
+
+    /**
+     * @var IFacebookDataDeletionService
+     */
+    private $service;
+
+    /**
+     * FacebookDataDeletionBackfill constructor.
+     * @param IFacebookDataDeletionService $service
+     */
+    public function __construct(IFacebookDataDeletionService $service)
+    {
+        parent::__construct();
+        $this->service = $service;
+    }
+
+    /**
+     * @return int
+     */
+    public function handle()
+    {
+        $path = $this->argument('path');
+
+        if (!is_readable($path)) {
+            $this->error(sprintf("File %s is not readable.", $path));
+            return 1;
+        }
+
+        $matched = 0;
+        $not_found = 0;
+        $skipped = 0;
+
+        $handle = @fopen($path, 'r');
+        if ($handle === false) {
+            $this->error(sprintf("Unable to open file %s.", $path));
+            return 1;
+        }
+
+        while (($line = fgets($handle)) !== false) {
+            $external_id = trim($line, " \t\n\r\0\x0B\"'");
+
+            if ($external_id === '') {
+                $skipped++;
+                continue;
+            }
+
+            $result = $this->service->processDeletionRequest($external_id);
+
+            if ($result['status'] === 'completed') {
+                $matched++;
+            } else {
+                $not_found++;
+            }
+
+            Log::debug(sprintf("FacebookDataDeletionBackfill::handle processed request with status %s", $result['status']));
+        }
+        fclose($handle);
+
+        $this->info(sprintf("Processed CSV: %d matched, %d not found, %d skipped blank lines.", $matched, $not_found, $skipped));
+        return 0;
+    }
+}

app/Console/Kernel.php

@@ -29,6 +29,7 @@ class Kernel extends ConsoleKernel
         Commands\CleanOAuth2StaleData::class,
         Commands\CleanOpenIdStaleData::class,
         Commands\CreateSuperAdmin::class,
+        Commands\FacebookDataDeletionBackfill::class,
         Commands\SpammerProcess\RebuildUserSpammerEstimator::class,
         Commands\SpammerProcess\UserSpammerProcessor::class,
     ];

app/Http/Controllers/Api/FacebookDataDeletionController.php

@@ -0,0 +1,91 @@
+<?php namespace App\Http\Controllers\Api;
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+use App\Http\Controllers\Controller;
+use App\libs\Auth\FacebookSignedRequestParser;
+use App\Services\Auth\IFacebookDataDeletionService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Class FacebookDataDeletionController
+ * Implements Facebook's Data Deletion Request Callback.
+ * @see https://developers.facebook.com/documentation/development/create-an-app/app-dashboard/data-deletion-callback
+ * @package App\Http\Controllers\Api
+ */
+final class FacebookDataDeletionController extends Controller
+{
+    /**
+     * @var IFacebookDataDeletionService
+     */
+    private $service;
+
+    /**
+     * FacebookDataDeletionController constructor.
+     * @param IFacebookDataDeletionService $service
+     */
+    public function __construct(IFacebookDataDeletionService $service)
+    {
+        $this->service = $service;
+    }
+
+    /**
+     * @param Request $request
+     * @return \Illuminate\Http\JsonResponse
+     */
+    public function handle(Request $request)
+    {
+        $signed_request = $request->input('signed_request');
+
+        if (!is_string($signed_request) || $signed_request === '') {
+            Log::warning("FacebookDataDeletionController::handle missing signed_request");
+            return response()->json([
+                'error' => ['code' => 'invalid_request', 'message' => 'signed_request is required.']
+            ], 400);
+        }
+
+        $secret = Config::get('services.facebook.client_secret');
+        $data = FacebookSignedRequestParser::parse($signed_request, $secret);
+
+        if (is_null($data)) {
+            Log::warning("FacebookDataDeletionController::handle invalid signed_request");
+            return response()->json([
+                'error' => ['code' => 'invalid_signature', 'message' => 'Invalid signed_request.']
+            ], 400);
+        }
+
+        $result = $this->service->processDeletionRequest((string)$data['user_id']);
+
+        return response()->json([
+            'url' => $result['url'],
+            'confirmation_code' => $result['confirmation_code'],
+        ], 200);
+    }
+
+    /**
+     * @param Request $request
+     * @param string $confirmation_code
+     * @return \Illuminate\Contracts\View\View
+     */
+    public function status(Request $request, string $confirmation_code)
+    {
+        $result = $this->service->getStatus($confirmation_code);
+
+        if (is_null($result)) {
+            abort(404);
+        }
+
+        return view('auth.facebook_data_deletion_status', ['result' => $result]);
+    }
+}

app/Repositories/DoctrineUserRepository.php

@@ -140,4 +140,22 @@ public function getByIdWithGroups(int $id): ?User
 
         return $qb->getQuery()->getOneOrNullResult();
     }
+
+    /**
+     * @param string $provider
+     * @param string $external_id
+     * @return User|null
+     */
+    public function getByExternalId(string $provider, string $external_id): ?User
+    {
+        return $this->getEntityManager()
+            ->createQueryBuilder()
+            ->select("e")
+            ->from($this->getBaseEntity(), "e")
+            ->Where("e.external_provider = :provider AND e.external_id = :external_id")
+            ->setParameter("provider", $provider)
+            ->setParameter("external_id", $external_id)
+            ->getQuery()
+            ->getOneOrNullResult();
+    }
 }