Pulp

I agree 100% that the spam has become a major problem but I have a concern about this solution: most of these actions are irreversible. Imagine if the script were to accidentally identify one of your issues or comments as spam--all of your issues, comments, etc would be gone forever. Perhaps we could have some sort of human validation as a step (at least to begin, until we confirm that the script won't cause false positives)? Or maybe we could limit the script to people who aren't in a redmine User Group (ie new users)?

I agree, let's ensure that this script has a human with it when it runs to ensure that not one mistake is made. It should include human confirmation of spam and also confirmation of the things to delete pre-deletion. Overall the Redmine data is crucially important.

We already have a pulpbot redmine user account that has the permissions to delete users as step #5 above. Or perhaps remove locked users who have been locked for a long time (another indication of spam or obsolete users.) Additionally, we can create a new user specifically for this clean up.

The up-to-date REST API docs https://www.redmine.org/projects/redmine/wiki/Rest_api.

I asked Redmine support about the following actions supported through the API:

• remove an issue (I believe it's supported)
• remove a comment from an issue
• remove an attachment from an issue
• lock a user
• we need to read/list different resources (users, issues, etc) individually and in bulk (I think it's supported)

Here is the reply:

I think everything except updating / removing journal notes should be possible right now. For the latter, there is an open issue on redmine.org. I'll see what we can do about this, maybe it's not too hard to implement. I can't promise you any implementation date right now unfortunately.
In order to remove an attachment, you would first have to get hold of it's ID (by getting the issue details including attachments), and then use the attachments API to delete it.

I commented on the upstream API feature gap https://www.redmine.org/issues/10171#note-6

I'm in favor of us implementing spam cleanup with all of the API features we currently.