Repository: svthalia/concrexit

Issue:
Dataminimization breaks editing user profiles
### Describe the bug
I cannot edit the profiles and user information of users whose data has been minimized. 

### How to reproduce
Steps to reproduce the behaviour:
1. View member information with missing data fields (due to minimization)
2. Try to edit a value (e.g. email address)
3. Save form
4. Form cannot be saved because of data inconsistency errors

### Expected behaviour
Edits in incomplete profiles can still happen even though information is missing

### Screenshots
<img width="526" alt="image" src="https://user-images.githubusercontent.com/1576660/90406160-0cf79800-e0a5-11ea-8072-e8e311c58b75.png">


### Additional context
I was trying to change someones email address, so they could reset their password and renew their membership

Dataminimization breaks editing user profiles
### Describe the bug
I cannot edit the profiles and user information of users whose data has been minimized. 

### How to reproduce
Steps to reproduce the behaviour:
1. View member information with missing data fields (due to minimization)
2. Try to edit a value (e.g. email address)
3. Save form
4. Form cannot be saved because of data inconsistency errors

### Expected behaviour
Edits in incomplete profiles can still happen even though information is missing

### Screenshots
<img width="526" alt="image" src="https://user-images.githubusercontent.com/1576660/90406160-0cf79800-e0a5-11ea-8072-e8e311c58b75.png">


### Additional context
I was trying to change someones email address, so they could reset their password and renew their membership



Discussion:
Suggested fix: Allow these fields to be null or empty, or remove the whole profile when minimizing and add some process to restore the profile after renewal
We cannot allow these fields to be blank because they are user editable.

It is mostly connected to https://github.com/svthalia/concrexit/issues/706, because renewals without profile information should technically not be possible at all.

I think what you want here is a way for you to change the email address and password of a user without editing the profile.
> I think what you want here is a way for you to change the email address and password of a user without editing the profile.

Yes, and I think this is mostly fine because the people who have access to the user backend will be pretty careful with the data.

Related to this: I have changed addresses to `N/A` and `Unknown` values in the past because other changes were necessary and I did not see the need to ask a couple dozen people for their address and wait for that to be filled in. I think empty or null values would be better in this case
We could technically also data minimise and not set the fields to blank values? `<unknown>` as city works just fine
Yeah that could be a viable solution
Suggested fix: Allow these fields to be null or empty, or remove the whole profile when minimizing and add some process to restore the profile after renewal
We cannot allow these fields to be blank because they are user editable.

It is mostly connected to https://github.com/svthalia/concrexit/issues/706, because renewals without profile information should technically not be possible at all.

I think what you want here is a way for you to change the email address and password of a user without editing the profile.
> I think what you want here is a way for you to change the email address and password of a user without editing the profile.

Yes, and I think this is mostly fine because the people who have access to the user backend will be pretty careful with the data.

Related to this: I have changed addresses to `N/A` and `Unknown` values in the past because other changes were necessary and I did not see the need to ask a couple dozen people for their address and wait for that to be filled in. I think empty or null values would be better in this case
We could technically also data minimise and not set the fields to blank values? `<unknown>` as city works just fine
Yeah that could be a viable solution

Resolving patch:
diff --git a/website/members/services.py b/website/members/services.py
--- a/website/members/services.py
+++ b/website/members/services.py
@@ -1,5 +1,5 @@
 """Services defined in the members package"""
-from datetime import date
+from datetime import date, datetime
 from typing import Callable, List, Dict, Any
 
 from django.conf import settings
@@ -225,12 +225,12 @@ def execute_data_minimisation(dry_run=False, members=None) -> List[Member]:
             profile = member.profile
             profile.student_number = None
             profile.phone_number = None
-            profile.address_street = None
+            profile.address_street = "<removed> 1"
             profile.address_street2 = None
-            profile.address_postal_code = None
-            profile.address_city = None
-            profile.address_country = None
-            profile.birthday = None
+            profile.address_postal_code = "<removed>"
+            profile.address_city = "<removed>"
+            profile.address_country = "NL"
+            profile.birthday = datetime(1900, 1, 1)
             profile.emergency_contact_phone_number = None
             profile.emergency_contact = None
             member.bank_accounts.all().delete()


Test patch: