Extensions: delete-user-data should allow for deleting by value

[AlexAmin]

[READ] Step 1: Are you in the right place?

Yes

[REQUIRED] Step 2: Extension name

This feature request is for extension: delete-user-data

What feature would you like to see?

When setting up delete-user-data, it would be great if we could also delete items by a value. In the friendlymarket codelab for example, we store items in the forsale collection. Each item then contains the uid of the user in the seller field. The path here is forsale/{Item UID}/seller

Right now, the extension only allows us to delete items if the UID is part of the path. It would be great if we could also delete items that have a UID as a value.

How would you use it?

In the friendlymarket example, I could delete all items a user is selling when the user wants their account deleted

[Ehesp]

This could prove to be a tricky one. Currently on Firestore & RTDB the path created is passed to a doc/ref and deleted/removed. In order to delete by a value, the database would need to be queried and then delete each match one by one. This would both increase read/writes on your project and may hit some difficulties when it comes to un-indexed queries.

[AlexAmin]

That is absolutely true. It would cause a large increase in read/writes.

Deleting all user data can be important though.
One example (using the friendlymarket example again) imagine a user having 10 items for sale. If we now delete their user account only, their items will still be on sale. Another user might attempt to buy them and will run into issues because the seller no longer exists.

Another example is that if a user wishes for their data to be deleted in accordance with GDPR, aren't we then forced to delete everything (including their items for sale)?

Possible Solution
Maybe an option would be to allow for some kind of extended delete within the extension configuration dashboard that would warn the developer of increased read / write.

This is something that is really common in relational databases but in Firebase we have to do this kind of cleanup ourselves (Which is fine, because this is where extensions could really help out)

[Ehesp]

Yeah they're fair points, so I totally understand where you're coming from! Let me pick this up with the Firebase team. It will need a bit of planning; off the top of my head I'm not 100% sure that Storage can be queried by file value - it may have to use list which is do-able, however could take a long time on a large storage bucket.

[AlexAmin]

Actually for storage we wouldn't have to query so much. We should be keeping references to files in our storage bucket within our database.

In friendlymarket its the image field. So in the extension config we could be asking for the name of the field that has the reference to the item in storage. That way we could directly execute the delete.

Files without references could just be attributed to bugs and would probably be covered by a different use-case, right?

[Ehesp]

XFN Review: There are possible ways to implement this functionality, however require careful consideration:

• Firestore/Database: Creates additional reads/writes & uncertainty around data indices.
• Storage: Not queryable, so would need to list/paginate through all items to match file name.

[karayu]

Thanks so much for the feature request Alex! This feature would definitely make this extension a lot more powerful and helpful for GDPR.

In chatting with others, there is quite a bit of complexity in this feature since the relationship between a user and an item can be different. Someone could be helping manage an item's sale rather than the seller themselves and in that case we would want to delete only if the user who left is a seller and not if they are the marketer.

We'd like to think about this feature request as a separate and more powerful extension. I'm going to close this for now but we'll be tracking internally as a new extension. Thanks again for the suggestion and using extensions!