fix: Delete user from rules when user is deleted

appinfo/info.xml

@@ -13,7 +13,7 @@ Approve/reject files based on workflows defined by admins.
 **Warning**: The DocuSign integration is no longer part of this app
 and can be installed with [this app](https://apps.nextcloud.com/apps/integration_docusign).
 ]]></description>
-	<version>3.3.1</version>
+	<version>3.3.2-dev.0</version>
 	<licence>agpl</licence>
 	<author>Julien Veyssier</author>
 	<namespace>Approval</namespace>

lib/AppInfo/Application.php

@@ -12,6 +12,7 @@
 use OCA\Approval\Listener\LoadAdditionalScriptsListener;
 use OCA\Approval\Listener\LoadSidebarScripts;
 use OCA\Approval\Listener\UpdateFilesListener;
+use OCA\Approval\Listener\UserDeletedListener;
 use OCA\Approval\Notification\Notifier;
 use OCA\Approval\Service\ApprovalService;
 use OCA\DAV\Events\SabrePluginAddEvent;
@@ -24,6 +25,7 @@
 use OCP\EventDispatcher\IEventDispatcher;
 use OCP\FilesMetadata\Event\MetadataBackgroundEvent;
 use OCP\SystemTag\TagAssignedEvent;
+use OCP\User\Events\UserDeletedEvent;
 use Override;
 
 class Application extends App implements IBootstrap {
@@ -68,6 +70,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerNotifierService(Notifier::class);
 		$context->registerDashboardWidget(ApprovalPendingWidget::class);
 		$context->registerEventListener(MetadataBackgroundEvent::class, UpdateFilesListener::class);
+		$context->registerEventListener(UserDeletedEvent::class, UserDeletedListener::class);
 	}
 
 	#[Override]

lib/Listener/UserDeletedListener.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Approval\Listener;
+
+use OCA\Approval\Service\RuleService;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\User\Events\UserDeletedEvent;
+
+/** @template-implements IEventListener<UserDeletedEvent> */
+class UserDeletedListener implements IEventListener {
+	public function __construct(
+		private RuleService $ruleService,
+	) {
+	}
+
+	public function handle(Event $event): void {
+		if (!($event instanceof UserDeletedEvent)) {
+			return;
+		}
+
+		$this->ruleService->deleteUserFromRules($event->getUser()->getUID());
+	}
+}

lib/Migration/Version030302Date20260820101934.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Approval\Migration;
+
+use Closure;
+use OCA\Approval\AppInfo\Application;
+use OCP\DB\QueryBuilder\IQueryBuilder;
+use OCP\IDBConnection;
+use OCP\IUserManager;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+
+class Version030302Date20260820101934 extends SimpleMigrationStep {
+
+	public function __construct(
+		private IDBConnection $connection,
+		private IUserManager $userManager,
+	) {
+	}
+
+	public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options): void {
+		foreach (['approvers', 'requesters'] as $role) {
+			$qb = $this->connection->getQueryBuilder();
+			$qb->selectDistinct('entity_id')
+				->from('approval_rule_' . $role)
+				->where(
+					$qb->expr()->eq('entity_type', $qb->createNamedParameter(Application::TYPE_USER, IQueryBuilder::PARAM_INT))
+				);
+
+			$result = $qb->executeQuery();
+			$userIds = $result->fetchAll(\PDO::FETCH_COLUMN);
+			$result->closeCursor();
+
+			foreach ($userIds as $userId) {
+				if ($this->userManager->get($userId) === null) {
+					$deleteQb = $this->connection->getQueryBuilder();
+					$deleteQb->delete('approval_rule_' . $role)
+						->where(
+							$deleteQb->expr()->eq('entity_type', $deleteQb->createNamedParameter(Application::TYPE_USER, IQueryBuilder::PARAM_INT))
+						)
+						->andWhere(
+							$deleteQb->expr()->eq('entity_id', $deleteQb->createNamedParameter($userId, IQueryBuilder::PARAM_STR))
+						);
+					$deleteQb->executeStatement();
+				}
+			}
+		}
+	}
+}

lib/Service/ApprovalService.php

@@ -853,7 +853,6 @@ public function propFind(int $nodeId): int {
 		return $state['state'];
 	}
 
-
 	/**
 	 * Get approval state for multiple files and loads all the tags at once
 	 *

lib/Service/RuleService.php

@@ -572,6 +572,28 @@ public function clearRuleCaches(): void {
 		$cache->remove('approval_tags');
 	}
 
+	/**
+	 * Remove a user from approval approvers and requesters.
+	 */
+	public function deleteUserFromRules(string $userId): void {
+		$this->cachedRules = null;
+		$qb = $this->db->getQueryBuilder();
+
+		foreach (['approvers', 'requesters'] as $role) {
+			$qb->delete('approval_rule_' . $role)
+				->where(
+					$qb->expr()->eq('entity_type', $qb->createNamedParameter(Application::TYPE_USER, IQueryBuilder::PARAM_INT))
+				)
+				->andWhere(
+					$qb->expr()->eq('entity_id', $qb->createNamedParameter($userId, IQueryBuilder::PARAM_STR))
+				);
+			$qb->executeStatement();
+			$qb = $qb->resetQueryParts();
+		}
+
+		$this->clearRuleCaches();
+	}
+
 	/**
 	 * Checks that the approval of the file was after the time given.
 	 * This does not verify that the file was actually approved.

tests/unit/Service/ApprovalServiceTest.php

@@ -240,6 +240,15 @@ public function testGetRuleAuthorizedUserIds() {
 		$this->assertEquals('user1', $uidRequesters[0]);
 	}
 
+	public function testDeleteUserFromRules(): void {
+		$this->ruleService->deleteUserFromRules('user1');
+
+		$rule = $this->ruleService->getRule($this->idRule1);
+		$this->assertNotNull($rule);
+		$this->assertCount(0, $rule['approvers']);
+		$this->assertCount(0, $rule['requesters']);
+	}
+
 	public function testGetApprovalState(): void {
 		$uf = $this->root->getUserFolder('user1');
 		$file1 = $uf->newFile('file1.txt', 'content');