[DCR] [GDPR support] Add ability to delete data related to a userID from Bot State

[p-nagpal]

Issue

It is not possible to query conversation state related to a user ID. To fully support GDPR delete requests, we need the ability to query&delete both User and Conversation state records to understand if a userId was part of it.

Proposed change

Add userId metadata field to Conversation state.

Component Impact

Describe which components need to be updated

Customer Impact

Describe the impact on customers

Tracking Status

Dotnet SDK

• [ ] PR
• [ ] Merged

Javascript SDK

• [ ] PR
• [ ] Merged

Java SDK

• [ ] PR
• [ ] Merged

Python SDK

• [ ] PR
• [ ] Merged

Emulator

• [ ] PR
• [ ] Merged

Samples

• [ ] PR
• [ ] Merged

Docs

• [ ] PR
• [ ] Merged

Tools

• [ ] PR
• [ ] Merged

[dcr]

[christopheranderson]

Chatted with @p-nagpal offline. The easiest way to enable this seems to be to store extra data regarding which users are associated with each record. In order to efficiently query this data, it should be indexed (which will add some cost to the insertion equal the size and number of properties indexed). This would require changes to the recent Cosmos store provider which moved to V3 SDK to allow for indexing.

One idea is to create a top-level metadata property bag which we index everything in. Then add user. Presumably, any metadata we'd ever want to store would want indexing to do queries on (since it's not useful otherwise).

Suppose a schema like this:

{
    "id":"<guid>",
    "data":{ "what": "ever" },
    "metadata":{
         "users":["<user1>", "<user2>"]
    }
}

We could use a indexing policy path like /metadata/*.

[vishwacsena]

Have the host do this. Not a requirement for stable release.

[gabog]

Hi @vishwacsena, can we close this one?