feat: account deletion endpoints

crates/adapters/http-axum/src/api/mod.rs

@@ -48,7 +48,11 @@ pub fn router() -> Router<AppState> {
         .route("/diary/export", routing::get(diary::export_diary))
         .route("/activity-feed", routing::get(diary::get_activity_feed))
         .route("/users", routing::get(users::list_users))
-        .route("/users/{id}", routing::get(user_profile::get_user_profile))
+        .route("/users/me", routing::delete(users::delete_me))
+        .route(
+            "/users/{id}",
+            routing::get(user_profile::get_user_profile).delete(users::delete_user),
+        )
         .route("/import/sessions", routing::post(import::api_post_session))
         .route(
             "/import/sessions/{id}",

crates/adapters/http-axum/src/api/users.rs

@@ -1,10 +1,12 @@
-use crate::extractors::{Body, Upload};
+use crate::extractors::{Body, PathId, Upload};
 use crate::{errors::ApiError, extractors::AuthenticatedUser, state::AppState};
-use api_types::{ProfileResponse, UserSummaryDto, UsersResponse};
+use api_types::{DeleteAccountRequest, ProfileResponse, UserSummaryDto, UsersResponse};
 use application::users::{
-    get_users, queries::GetUsersQuery, update_profile, update_profile_fields,
+    get_users, queries::GetUsersQuery, request_account_deletion, update_profile,
+    update_profile_fields,
 };
 use axum::{Json, extract::State, http::StatusCode, response::IntoResponse};
+use domain::value_objects::UserId;
 
 #[utoipa::path(
     get, path = "/api/v1/profile",
@@ -155,3 +157,61 @@ pub async fn list_users(State(state): State<AppState>) -> Result<Json<UsersRespo
             .collect(),
     }))
 }
+
+async fn delete_account(
+    state: &AppState,
+    actor: UserId,
+    target: UserId,
+    password: &str,
+) -> Result<StatusCode, ApiError> {
+    request_account_deletion::execute(
+        &state.app_ctx.deps.users.request_account_deletion,
+        actor,
+        target,
+        password,
+    )
+    .await?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+#[utoipa::path(
+    delete, path = "/api/v1/users/me",
+    request_body = DeleteAccountRequest,
+    responses(
+        (status = 204, description = "Account deleted"),
+        (status = 400, description = "Invalid input", body = api_types::ErrorResponse),
+        (status = 401, description = "Unauthorized or incorrect password", body = api_types::ErrorResponse),
+        (status = 409, description = "The last admin cannot be deleted", body = api_types::ErrorResponse),
+    ),
+    security(("bearer_auth" = []))
+)]
+pub async fn delete_me(
+    State(state): State<AppState>,
+    AuthenticatedUser(user_id): AuthenticatedUser,
+    Body(req): Body<DeleteAccountRequest>,
+) -> Result<StatusCode, ApiError> {
+    delete_account(&state, user_id.clone(), user_id, &req.password).await
+}
+
+#[utoipa::path(
+    delete, path = "/api/v1/users/{id}",
+    params(("id" = uuid::Uuid, Path, description = "User ID")),
+    request_body = DeleteAccountRequest,
+    responses(
+        (status = 204, description = "Account deleted"),
+        (status = 400, description = "Invalid input", body = api_types::ErrorResponse),
+        (status = 401, description = "Unauthorized or incorrect password", body = api_types::ErrorResponse),
+        (status = 403, description = "Admin only", body = api_types::ErrorResponse),
+        (status = 404, description = "User not found", body = api_types::ErrorResponse),
+        (status = 409, description = "The last admin cannot be deleted", body = api_types::ErrorResponse),
+    ),
+    security(("bearer_auth" = []))
+)]
+pub async fn delete_user(
+    State(state): State<AppState>,
+    AuthenticatedUser(actor): AuthenticatedUser,
+    PathId(target): PathId<uuid::Uuid>,
+    Body(req): Body<DeleteAccountRequest>,
+) -> Result<StatusCode, ApiError> {
+    delete_account(&state, actor, UserId::from_uuid(target), &req.password).await
+}

crates/adapters/http-axum/src/html/auth.rs

@@ -82,7 +82,7 @@ pub async fn post_login(
     }
 }
 
-pub async fn get_logout(State(state): State<AppState>) -> impl IntoResponse {
+pub(super) async fn get_logout(State(state): State<AppState>) -> impl IntoResponse {
     let val = format!(
         "token=; HttpOnly; Path=/; SameSite=Strict; Max-Age=0{}",
         secure_flag(state.app_ctx.config.secure_cookies)

crates/adapters/http-axum/src/html/forms.rs

@@ -62,6 +62,13 @@ pub struct RegisterForm {
     pub csrf_token: String,
 }
 
+#[derive(Deserialize)]
+pub struct DeleteAccountForm {
+    pub password: String,
+    #[serde(rename = "_csrf", default)]
+    pub csrf_token: String,
+}
+
 #[derive(Deserialize)]
 pub struct ErrorQuery {
     pub error: Option<String>,

crates/adapters/http-axum/src/html/mod.rs

@@ -73,6 +73,11 @@ pub fn router() -> Router<AppState> {
             "/settings/profile",
             routing::get(users::get_profile_settings).post(users::post_profile_settings),
         )
+        .route(
+            "/settings/account/delete",
+            routing::post(users::post_delete_own_account),
+        )
+        .route("/users/{id}/delete", routing::post(users::post_delete_user))
         .route("/tags/{tag}", routing::get(tags::get_tag))
         .route(
             "/users/{id}/watchlist",

crates/adapters/http-axum/src/html/templates/users.rs

@@ -189,5 +189,6 @@ pub struct ProfileSettingsTemplate<'a> {
     pub also_known_as: Option<&'a str>,
     pub profile_fields: &'a [(String, String)],
     pub saved: bool,
+    pub error: Option<&'a str>,
     pub embed_url: String,
 }

crates/adapters/http-axum/src/html/users.rs

@@ -1,3 +1,4 @@
+use crate::html::forms::DeleteAccountForm;
 use crate::html::helpers::build_page_context;
 use crate::html::templates::{
     ProfileSettingsTemplate, RemoteActorDisplay, UserSummaryView, UsersTemplate,
@@ -13,11 +14,16 @@ use application::users::{
     update_profile_fields,
 };
 use axum::{
+    Form,
     extract::{Extension, Multipart, Path, Query, State},
     http::StatusCode,
     response::IntoResponse,
 };
-use domain::{errors::DomainError, value_objects::Username};
+use domain::{
+    errors::DomainError,
+    value_objects::{UserId, Username},
+};
+use uuid::Uuid;
 
 pub async fn get_users_list(
     OptionalCookieUser(user_id): OptionalCookieUser,
@@ -76,6 +82,7 @@ pub async fn get_user_by_username(
 #[derive(serde::Deserialize, Default)]
 pub struct SavedQuery {
     pub saved: Option<String>,
+    pub error: Option<String>,
 }
 
 pub async fn get_profile_settings(
@@ -109,6 +116,7 @@ pub async fn get_profile_settings(
         also_known_as: settings.also_known_as.as_deref(),
         profile_fields: &settings.fields,
         saved,
+        error: params.error.as_deref(),
         embed_url: format!(
             "{}/users/{}?embed=true",
             state.app_ctx.config.base_url,
@@ -177,3 +185,61 @@ pub async fn post_profile_settings(
 
     axum::response::Redirect::to("/settings/profile?saved=1").into_response()
 }
+
+async fn delete_account(
+    state: &AppState,
+    actor: UserId,
+    target: UserId,
+    password: &str,
+) -> Result<(), DomainError> {
+    application::users::request_account_deletion::execute(
+        &state.app_ctx.deps.users.request_account_deletion,
+        actor,
+        target,
+        password,
+    )
+    .await
+}
+
+pub async fn post_delete_own_account(
+    RequiredCookieUser(user_id): RequiredCookieUser,
+    State(state): State<AppState>,
+    Extension(csrf): Extension<CsrfToken>,
+    Form(form): Form<DeleteAccountForm>,
+) -> impl IntoResponse {
+    if crate::html::csrf::mismatch(&csrf, &form.csrf_token) {
+        return StatusCode::FORBIDDEN.into_response();
+    }
+    match delete_account(&state, user_id.clone(), user_id, &form.password).await {
+        Ok(()) => super::auth::get_logout(State(state)).await.into_response(),
+        Err(e) => axum::response::Redirect::to(&format!(
+            "/settings/profile?error={}",
+            crate::html::helpers::encode_domain_error(&e)
+        ))
+        .into_response(),
+    }
+}
+
+pub async fn post_delete_user(
+    RequiredCookieUser(actor): RequiredCookieUser,
+    State(state): State<AppState>,
+    Extension(csrf): Extension<CsrfToken>,
+    Path(target): Path<Uuid>,
+    Form(form): Form<DeleteAccountForm>,
+) -> impl IntoResponse {
+    if crate::html::csrf::mismatch(&csrf, &form.csrf_token) {
+        return StatusCode::FORBIDDEN.into_response();
+    }
+    let target_id = UserId::from_uuid(target);
+    let own = actor == target_id;
+    match delete_account(&state, actor, target_id, &form.password).await {
+        // An admin removing their own account ends their own session too.
+        Ok(()) if own => super::auth::get_logout(State(state)).await.into_response(),
+        Ok(()) => axum::response::Redirect::to("/users").into_response(),
+        Err(e) => axum::response::Redirect::to(&format!(
+            "/users/{target}?error={}",
+            crate::html::helpers::encode_domain_error(&e)
+        ))
+        .into_response(),
+    }
+}

crates/adapters/http-axum/src/openapi/users.rs

@@ -1,6 +1,7 @@
 use api_types::{
-    ProfileFieldDto, ProfileResponse, ProfileViewData, UpdateProfileFieldsRequest, UserProfileBase,
-    UserProfileResponse, UserStatsDto, UserSummaryDto, UsersResponse,
+    DeleteAccountRequest, ProfileFieldDto, ProfileResponse, ProfileViewData,
+    UpdateProfileFieldsRequest, UserProfileBase, UserProfileResponse, UserStatsDto, UserSummaryDto,
+    UsersResponse,
 };
 use utoipa::OpenApi;
 
@@ -12,6 +13,8 @@ use utoipa::OpenApi;
         crate::api::users::get_profile,
         crate::api::users::update_profile_handler,
         crate::api::users::update_profile_fields_handler,
+        crate::api::users::delete_me,
+        crate::api::users::delete_user,
     ),
     components(schemas(
         UsersResponse,
@@ -23,6 +26,7 @@ use utoipa::OpenApi;
         ProfileResponse,
         UpdateProfileFieldsRequest,
         ProfileFieldDto,
+        DeleteAccountRequest,
     ))
 )]
 pub struct UsersDoc;