codidact
Profile deletion sends password-reset email
When a user self-deletes an account, we send email confirming the deletion (good), and then we send mail saying "your password has been reset", which is part of account deletion. That's a little odd and maybe we don't want to be sending extra email to someone who wants to leave. For this use case we should not send that email.
The other way an account gets deleted is if an admin deletes a user network-wide, which is how spammers are handled. This doesn't send a message about deletion, but it does send the password message. I don't know if we want to send any email for admin deletions, but if we do, it shouldn't be the password message but a deletion message.
Should we send any email?
- Pro: In the rare case that a legitimate account gets admin-deleted, the human who might care gets notified.
- Con: But there's nothing the person can do about it, really -- there's no account-recovery path.
- Con: Most spammers don't use real email addresses, so we're sending mail that bounces. And if spammers do use a real address (impersonation), the recipient -- who knows nothing about Codidact -- is likely to report our email as spam.
- Con: Do we want to tell spammers (who used real email addresses) that we're on to them?
Did I miss any pros to mitigate the cons?
On further review, we send email to usernumber@deleted.localhost, so this message is not reaching the user. We're sending email to a bogus address, so it's just spurious sending.
It appears that this is controlled by Devise and we can't customize it -- you can set it to send email for password resets, or not. The parameter is config.send_password_change_notification in config/initializers/devise.rb. Our controller code doesn't send this email.
Assuming that what I've said here is correct, we can close this issue (nothing to do).
Reopening because I'm told that Devise allows for a lot of customization via method overrides and we can probably do something about this email. Low priority because the email isn't actually reaching people (but it's still better to not send it).