'Delete user' - BACK #152
'Delete user' - BACK #152
Conversation
hyunnbunt
commented
Jul 24, 2025
- Connect '/auth/self/deactivate-user' API request to a new module 'deactivateSelfUser'
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
Thank you for your submission, we really appreciate it! ❤️ Like many open-source projects, we ask that you sign our Individual Contributor License Agreement before we can accept your contribution. If you are contributing on behalf of a company, please contact us at help@plasmic.app to sign a Corporate Contributor License Agreement. You can sign the individual CLA by posting a comment with the below text. I have read, agree to, and hereby sign Plasmic's Individual Contributor License Agreement You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot. |
| @@ -1318,6 +1318,10 @@ export function addMainAppServerRoutes( | |||
| sensitiveRateLimiter, | |||
| withNext(authRoutes.updateSelfPassword) | |||
| ); | |||
| app.post( | |||
There was a problem hiding this comment.
Use app.delete("/api/v1/auth/self") as the route
| @@ -338,6 +338,22 @@ export async function updateSelfPassword(req: Request, res: Response) { | |||
| ); | |||
| } | |||
|
|
|||
| export async function deactivateSelfUser(req: Request, res: Response) { | |||
| const mgr = superDbMgr(req); | |||
There was a problem hiding this comment.
This would allow anyone to delete anyone in the database. Only the currently logged in user should be able to delete themselves. You need to use checkUserIdIsSelf to get the user ID.
| @@ -338,6 +338,22 @@ export async function updateSelfPassword(req: Request, res: Response) { | |||
| ); | |||
| } | |||
|
|
|||
| export async function deactivateSelfUser(req: Request, res: Response) { | |||
| const mgr = superDbMgr(req); | |||
| const email = req.body.email; | |||
There was a problem hiding this comment.
There should not be a user identifier passed to the server, since the server already has access to the cookie that identifies the user.
| res.clearCookie("plasmic-observer"); | ||
| // Must reset the session to prevent session fixation attacks, reset the CSRF | ||
| // token, etc. | ||
| if (req.session) { | ||
| await util.promisify(req.session.destroy.bind(req.session))(); | ||
| } |
There was a problem hiding this comment.
I think we should just call doLogout instead. Can you also move the highlighted lines into the doLogout function?
| @@ -338,6 +338,22 @@ export async function updateSelfPassword(req: Request, res: Response) { | |||
| ); | |||
| } | |||
|
|
|||
| export async function deactivateSelfUser(req: Request, res: Response) { | |||
| export async function deleteSelf(req: Request, res: Response) { | ||
| const mgr = userDbMgr(req); | ||
|
|
||
| const id = getUser(req, { allowUnverifiedEmail: true }).id; |
There was a problem hiding this comment.
I believe you can call checkUserIdIsSelf() without an argument, it will return the current user ID of the DbMgr. So getUser should be unnecessary.