GKaszewski/movies-diary
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: account deletion endpoints

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-10-26 02:49:07 +01:00
parent 54c8433c78
commit 0beedfbf0a
14 changed files with 420 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
crates/adapters/http-axum/src/api/mod.rs
View File

@@ -48,7 +48,11 @@ pub fn router() -> Router<AppState> {
.route("/diary/export", routing::get(diary::export_diary))
.route("/activity-feed", routing::get(diary::get_activity_feed))
.route("/users", routing::get(users::list_users))
.route("/users/{id}", routing::get(user_profile::get_user_profile))
.route("/users/me", routing::delete(users::delete_me))
.route(
"/users/{id}",
routing::get(user_profile::get_user_profile).delete(users::delete_user),
)
.route("/import/sessions", routing::post(import::api_post_session))
.route(
"/import/sessions/{id}",

66
crates/adapters/http-axum/src/api/users.rs
View File

@@ -1,10 +1,12 @@
use crate::extractors::{Body, Upload};
use crate::extractors::{Body, PathId, Upload};
use crate::{errors::ApiError, extractors::AuthenticatedUser, state::AppState};
use api_types::{ProfileResponse, UserSummaryDto, UsersResponse};
use api_types::{DeleteAccountRequest, ProfileResponse, UserSummaryDto, UsersResponse};
use application::users::{
get_users, queries::GetUsersQuery, update_profile, update_profile_fields,
get_users, queries::GetUsersQuery, request_account_deletion, update_profile,
update_profile_fields,
};
use axum::{Json, extract::State, http::StatusCode, response::IntoResponse};
use domain::value_objects::UserId;
#[utoipa::path(
get, path = "/api/v1/profile",
@@ -155,3 +157,61 @@ pub async fn list_users(State(state): State<AppState>) -> Result<Json<UsersRespo
.collect(),
}))
}
async fn delete_account(
state: &AppState,
actor: UserId,
target: UserId,
password: &str,
) -> Result<StatusCode, ApiError> {
request_account_deletion::execute(
&state.app_ctx.deps.users.request_account_deletion,
actor,
target,
password,
)
.await?;
Ok(StatusCode::NO_CONTENT)
}
#[utoipa::path(
delete, path = "/api/v1/users/me",
request_body = DeleteAccountRequest,
responses(
(status = 204, description = "Account deleted"),
(status = 400, description = "Invalid input", body = api_types::ErrorResponse),
(status = 401, description = "Unauthorized or incorrect password", body = api_types::ErrorResponse),
(status = 409, description = "The last admin cannot be deleted", body = api_types::ErrorResponse),
),
security(("bearer_auth" = []))
)]
pub async fn delete_me(
State(state): State<AppState>,
AuthenticatedUser(user_id): AuthenticatedUser,
Body(req): Body<DeleteAccountRequest>,
) -> Result<StatusCode, ApiError> {
delete_account(&state, user_id.clone(), user_id, &req.password).await
}
#[utoipa::path(
delete, path = "/api/v1/users/{id}",
params(("id" = uuid::Uuid, Path, description = "User ID")),
request_body = DeleteAccountRequest,
responses(
(status = 204, description = "Account deleted"),
(status = 400, description = "Invalid input", body = api_types::ErrorResponse),
(status = 401, description = "Unauthorized or incorrect password", body = api_types::ErrorResponse),
(status = 403, description = "Admin only", body = api_types::ErrorResponse),
(status = 404, description = "User not found", body = api_types::ErrorResponse),
(status = 409, description = "The last admin cannot be deleted", body = api_types::ErrorResponse),
),
security(("bearer_auth" = []))
)]
pub async fn delete_user(
State(state): State<AppState>,
AuthenticatedUser(actor): AuthenticatedUser,
PathId(target): PathId<uuid::Uuid>,
Body(req): Body<DeleteAccountRequest>,
) -> Result<StatusCode, ApiError> {
delete_account(&state, actor, UserId::from_uuid(target), &req.password).await
}

2
crates/adapters/http-axum/src/html/auth.rs
View File

@@ -82,7 +82,7 @@ pub async fn post_login(
}
}
pub async fn get_logout(State(state): State<AppState>) -> impl IntoResponse {
pub(super) async fn get_logout(State(state): State<AppState>) -> impl IntoResponse {
let val = format!(
"token=; HttpOnly; Path=/; SameSite=Strict; Max-Age=0{}",
secure_flag(state.app_ctx.config.secure_cookies)

7
crates/adapters/http-axum/src/html/forms.rs
View File

@@ -62,6 +62,13 @@ pub struct RegisterForm {
pub csrf_token: String,
}
#[derive(Deserialize)]
pub struct DeleteAccountForm {
pub password: String,
#[serde(rename = "_csrf", default)]
pub csrf_token: String,
}
#[derive(Deserialize)]
pub struct ErrorQuery {
pub error: Option<String>,

5
crates/adapters/http-axum/src/html/mod.rs
View File

@@ -73,6 +73,11 @@ pub fn router() -> Router<AppState> {
"/settings/profile",
routing::get(users::get_profile_settings).post(users::post_profile_settings),
)
.route(
"/settings/account/delete",
routing::post(users::post_delete_own_account),
)
.route("/users/{id}/delete", routing::post(users::post_delete_user))
.route("/tags/{tag}", routing::get(tags::get_tag))
.route(
"/users/{id}/watchlist",

1
crates/adapters/http-axum/src/html/templates/users.rs
View File

@@ -189,5 +189,6 @@ pub struct ProfileSettingsTemplate<'a> {
pub also_known_as: Option<&'a str>,
pub profile_fields: &'a [(String, String)],
pub saved: bool,
pub error: Option<&'a str>,
pub embed_url: String,
}

68
crates/adapters/http-axum/src/html/users.rs
View File

@@ -1,3 +1,4 @@
use crate::html::forms::DeleteAccountForm;
use crate::html::helpers::build_page_context;
use crate::html::templates::{
ProfileSettingsTemplate, RemoteActorDisplay, UserSummaryView, UsersTemplate,
@@ -13,11 +14,16 @@ use application::users::{
update_profile_fields,
};
use axum::{
Form,
extract::{Extension, Multipart, Path, Query, State},
http::StatusCode,
response::IntoResponse,
};
use domain::{errors::DomainError, value_objects::Username};
use domain::{
errors::DomainError,
value_objects::{UserId, Username},
};
use uuid::Uuid;
pub async fn get_users_list(
OptionalCookieUser(user_id): OptionalCookieUser,
@@ -76,6 +82,7 @@ pub async fn get_user_by_username(
#[derive(serde::Deserialize, Default)]
pub struct SavedQuery {
pub saved: Option<String>,
pub error: Option<String>,
}
pub async fn get_profile_settings(
@@ -109,6 +116,7 @@ pub async fn get_profile_settings(
also_known_as: settings.also_known_as.as_deref(),
profile_fields: &settings.fields,
saved,
error: params.error.as_deref(),
embed_url: format!(
"{}/users/{}?embed=true",
state.app_ctx.config.base_url,
@@ -177,3 +185,61 @@ pub async fn post_profile_settings(
axum::response::Redirect::to("/settings/profile?saved=1").into_response()
}
async fn delete_account(
state: &AppState,
actor: UserId,
target: UserId,
password: &str,
) -> Result<(), DomainError> {
application::users::request_account_deletion::execute(
&state.app_ctx.deps.users.request_account_deletion,
actor,
target,
password,
)
.await
}
pub async fn post_delete_own_account(
RequiredCookieUser(user_id): RequiredCookieUser,
State(state): State<AppState>,
Extension(csrf): Extension<CsrfToken>,
Form(form): Form<DeleteAccountForm>,
) -> impl IntoResponse {
if crate::html::csrf::mismatch(&csrf, &form.csrf_token) {
return StatusCode::FORBIDDEN.into_response();
}
match delete_account(&state, user_id.clone(), user_id, &form.password).await {
Ok(()) => super::auth::get_logout(State(state)).await.into_response(),
Err(e) => axum::response::Redirect::to(&format!(
"/settings/profile?error={}",
crate::html::helpers::encode_domain_error(&e)
))
.into_response(),
}
}
pub async fn post_delete_user(
RequiredCookieUser(actor): RequiredCookieUser,
State(state): State<AppState>,
Extension(csrf): Extension<CsrfToken>,
Path(target): Path<Uuid>,
Form(form): Form<DeleteAccountForm>,
) -> impl IntoResponse {
if crate::html::csrf::mismatch(&csrf, &form.csrf_token) {
return StatusCode::FORBIDDEN.into_response();
}
let target_id = UserId::from_uuid(target);
let own = actor == target_id;
match delete_account(&state, actor, target_id, &form.password).await {
// An admin removing their own account ends their own session too.
Ok(()) if own => super::auth::get_logout(State(state)).await.into_response(),
Ok(()) => axum::response::Redirect::to("/users").into_response(),
Err(e) => axum::response::Redirect::to(&format!(
"/users/{target}?error={}",
crate::html::helpers::encode_domain_error(&e)
))
.into_response(),
}
}

8
crates/adapters/http-axum/src/openapi/users.rs
View File

@@ -1,6 +1,7 @@
use api_types::{
ProfileFieldDto, ProfileResponse, ProfileViewData, UpdateProfileFieldsRequest, UserProfileBase,
UserProfileResponse, UserStatsDto, UserSummaryDto, UsersResponse,
DeleteAccountRequest, ProfileFieldDto, ProfileResponse, ProfileViewData,
UpdateProfileFieldsRequest, UserProfileBase, UserProfileResponse, UserStatsDto, UserSummaryDto,
UsersResponse,
};
use utoipa::OpenApi;
@@ -12,6 +13,8 @@ use utoipa::OpenApi;
crate::api::users::get_profile,
crate::api::users::update_profile_handler,
crate::api::users::update_profile_fields_handler,
crate::api::users::delete_me,
crate::api::users::delete_user,
),
components(schemas(
UsersResponse,
@@ -23,6 +26,7 @@ use utoipa::OpenApi;
ProfileResponse,
UpdateProfileFieldsRequest,
ProfileFieldDto,
DeleteAccountRequest,
))
)]
pub struct UsersDoc;

14
crates/adapters/http-axum/templates/profile.html
View File

@@ -97,6 +97,20 @@
</section>
{% endif %}
{% if ctx.is_admin && !is_own_profile %}
<section class="profile-manage">
<h3>Admin</h3>
{% if let Some(err) = error %}
<p class="error">{{ err }}</p>
{% endif %}
<form method="POST" action="/users/{{ profile_user_id }}/delete">
<input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
<input type="password" name="password" placeholder="Your password" required autocomplete="current-password">
<button type="submit">Delete user</button>
</form>
</section>
{% endif %}
<div class="view-tabs">
<a href="?view=recent" class="view-tab {% if view == "recent" %}active{% endif %}">Recent</a>
<a href="?view=ratings" class="view-tab {% if view == "ratings" %}active{% endif %}">Top Rated</a>

18
crates/adapters/http-axum/templates/profile_settings.html
View File

@@ -7,6 +7,9 @@
{% if saved %}
<p class="success">Saved.</p>
{% endif %}
{% if let Some(err) = error %}
<p class="error">{{ err }}</p>
{% endif %}
<form method="post" action="/settings/profile" enctype="multipart/form-data">
<input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
@@ -62,4 +65,19 @@
<p style="font-size:.85em;opacity:.7;margin-bottom:.5rem">Add your diary to your blog or website:</p>
<pre style="background:rgba(255,255,255,0.06);padding:12px;border-radius:8px;font-size:.8em;overflow-x:auto;white-space:pre-wrap;word-break:break-all"><code>&lt;iframe src="{{ embed_url }}" width="100%" height="600" style="border:none;border-radius:8px" loading="lazy"&gt;&lt;/iframe&gt;</code></pre>
</section>
<section style="margin-top:2rem;padding-top:1rem;border-top:1px solid rgba(255,255,255,0.1)">
<h3>Delete account</h3>
<p style="font-size:.85em;opacity:.7;margin-bottom:.5rem">
Permanently removes your account and everything on it: reviews, watchlist, goals, follows and uploaded images. This cannot be undone.
</p>
<form method="post" action="/settings/account/delete">
<input type="hidden" name="_csrf" value="{{ ctx.csrf_token }}">
<label>
Confirm with your password<br>
<input type="password" name="password" required autocomplete="current-password">
</label>
<button type="submit">Delete my account</button>
</form>
</section>
{% endblock %}