Allow users to delete their own accounts #34

New Issue

2026-07-29T17:40:59-07:00

westfarn commented

2026-07-29 17:40:59 -07:00

Summary

Add a self-service API so authenticated users can delete their own account. CustomUser already has a soft-delete flag (deleted), but there is no user-facing endpoint to trigger it.

Context

Model already has CustomUser.deleted ("This is to hid accounts") and conversations support soft-delete via Conversation.deleted.
Company managers can toggle another user's is_active via company-user management; that is not account self-deletion.
Existing auth endpoints: create, get, invite, password reset/set, logout/blacklist — no delete/deactivate-self route.

Requirements

Add an authenticated endpoint (e.g. DELETE /user/ or POST /user/delete/) that only deletes the requesting user.
Soft-delete the account: set deleted=True (and likely is_active=False) so the user can no longer authenticate.
Invalidate sessions: blacklist refresh/access tokens (or equivalent) so existing JWTs stop working after delete.
Soft-delete (or otherwise hide) the user's conversations so they no longer appear in lists/RAG.
Reject delete for users who should not self-delete if product policy requires it (document any exceptions, e.g. last company manager) — default: any authenticated non-staff user can delete themselves.
Do not allow deleting another user's account via this endpoint.
Return a clear success response; subsequent auth/get-user calls should fail or treat the user as gone.

Privacy / data notes

Decide and document whether personal data is anonymized at delete time vs kept under soft-delete for admin/audit.
If full purge later: chats, documents, RAG vectors, auth events, invites — call out as follow-up if out of scope for soft-delete v1.

Acceptance criteria

Authenticated self-delete endpoint exists and is wired in urls.py
Calling it sets user.deleted=True (and blocks login / token obtain)
Existing refresh tokens are invalidated / blacklisted after delete
User cannot call the endpoint for another account
User's conversations are hidden (soft-deleted or equivalent)
Tests cover happy path, unauthenticated, and cross-user denial
Documented for frontend: endpoint, method, expected response, and post-delete redirect/logout behavior

## Summary Add a self-service API so authenticated users can delete their own account. `CustomUser` already has a soft-delete flag (`deleted`), but there is no user-facing endpoint to trigger it. ## Context - Model already has `CustomUser.deleted` ("This is to hid accounts") and conversations support soft-delete via `Conversation.deleted`. - Company managers can toggle another user's `is_active` via company-user management; that is not account self-deletion. - Existing auth endpoints: create, get, invite, password reset/set, logout/blacklist — no delete/deactivate-self route. ## Requirements - Add an authenticated endpoint (e.g. `DELETE /user/` or `POST /user/delete/`) that only deletes the **requesting** user. - Soft-delete the account: set `deleted=True` (and likely `is_active=False`) so the user can no longer authenticate. - Invalidate sessions: blacklist refresh/access tokens (or equivalent) so existing JWTs stop working after delete. - Soft-delete (or otherwise hide) the user's conversations so they no longer appear in lists/RAG. - Reject delete for users who should not self-delete if product policy requires it (document any exceptions, e.g. last company manager) — default: any authenticated non-staff user can delete themselves. - Do **not** allow deleting another user's account via this endpoint. - Return a clear success response; subsequent auth/get-user calls should fail or treat the user as gone. ## Privacy / data notes - Decide and document whether personal data is anonymized at delete time vs kept under soft-delete for admin/audit. - If full purge later: chats, documents, RAG vectors, auth events, invites — call out as follow-up if out of scope for soft-delete v1. ## Acceptance criteria - [ ] Authenticated self-delete endpoint exists and is wired in `urls.py` - [ ] Calling it sets `user.deleted=True` (and blocks login / token obtain) - [ ] Existing refresh tokens are invalidated / blacklisted after delete - [ ] User cannot call the endpoint for another account - [ ] User's conversations are hidden (soft-deleted or equivalent) - [ ] Tests cover happy path, unauthenticated, and cross-user denial - [ ] Documented for frontend: endpoint, method, expected response, and post-delete redirect/logout behavior

westfarn referenced this issue from a commit

2026-08-01 12:15:13 -07:00

Add account self-delete and subscription lifecycle sync (#34)

westfarn referenced a pull request that will close this issue

2026-08-01 12:15:17 -07:00

Add account self-delete and subscription lifecycle sync (#34) #39

westfarn referenced this issue from ai_ml_operations/chat_web_app

2026-08-01 12:15:19 -07:00

Add subscription upgrade/change/cancel UX and account self-delete (#75) #76

westfarn referenced this issue from a commit

2026-08-01 12:24:12 -07:00

Add subscription upgrade/change/cancel UX and account self-delete (#75) (#76)