Storage Records are not Invalidated due to Disabled Publishing of Legal Tag Status Changes
This issue is caused by this MR: !231 (merged) which was introduced as a result of this issue: osdu/platform/system/storage#117.
As a result of the above MR, legal service no longer publishes messages of legal tag status change events to the message queue. These legal tag status events are consumed by storage service to invalidate records (i.e. soft delete) to prevent any associated records from being accessed after the legal tag has expired. This functionality is required to enforce legal compliance. Currently, storage records are still accessible with expired legal tags.
This issue can be reproduced by the following steps:
- Create a legal tag with an expiration date some day in the future.
- Create a record in storage service using the new legal tag.
- Manually modify the expiration date field for the legal tag.
- Trigger legal service to invalidate tags by sending a GET request to /api/legal/v1/jobs/updateLegalTagStatus
- Wait approx. 1 min for the process to complete.
- Send a request to retrieve the record with the expired legal tag.
Expected Result: Response from storage service will return a 404; record not found.
Actual Result: Response from storage service returned 200 status along with the record.
This workflow is described here: https://community.opengroup.org/osdu/platform/security-and-compliance/legal/-/blob/master/docs/tutorial/ComplianceService.md#Compliance-on-consumption