feat(api/v2): add user account-deletion flow on /api/v2
This commit is contained in:
kolaente
kolaente
parent
a610ccbbac
commit
b8894ac1c1
|
|
@ -0,0 +1,172 @@
|
||||||
|
// Vikunja is a to-do list application to facilitate your life.
|
||||||
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
||||||
|
//
|
||||||
|
// This program is free software: you can redistribute it and/or modify
|
||||||
|
// it under the terms of the GNU Affero General Public License as published by
|
||||||
|
// the Free Software Foundation, either version 3 of the License, or
|
||||||
|
// (at your option) any later version.
|
||||||
|
//
|
||||||
|
// This program is distributed in the hope that it will be useful,
|
||||||
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
// GNU Affero General Public License for more details.
|
||||||
|
//
|
||||||
|
// You should have received a copy of the GNU Affero General Public License
|
||||||
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
package apiv2
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"net/http"
|
||||||
|
|
||||||
|
"code.vikunja.io/api/pkg/db"
|
||||||
|
"code.vikunja.io/api/pkg/user"
|
||||||
|
|
||||||
|
"github.com/danielgtaylor/huma/v2"
|
||||||
|
"xorm.io/xorm"
|
||||||
|
)
|
||||||
|
|
||||||
|
type userDeletionPasswordBody struct {
|
||||||
|
Body struct {
|
||||||
|
Password string `json:"password" doc:"The authenticated user's password. Required for local users; ignored for users authenticated via an external provider."`
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
type userDeletionConfirmBody struct {
|
||||||
|
Body struct {
|
||||||
|
Token string `json:"token" required:"true" minLength:"1" doc:"The deletion confirmation token from the email sent by the request-deletion endpoint."`
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func RegisterUserDeletionRoutes(api huma.API) {
|
||||||
|
tags := []string{"user"}
|
||||||
|
|
||||||
|
Register(api, huma.Operation{
|
||||||
|
OperationID: "user-deletion-request",
|
||||||
|
Summary: "Request account deletion",
|
||||||
|
Description: "Starts deletion of the authenticated user's account. Local users must provide their password; a confirmation email is then sent and deletion only proceeds once confirmed.",
|
||||||
|
Method: http.MethodPost,
|
||||||
|
Path: "/user/deletion/request",
|
||||||
|
Tags: tags,
|
||||||
|
DefaultStatus: http.StatusNoContent,
|
||||||
|
}, userDeletionRequest)
|
||||||
|
|
||||||
|
Register(api, huma.Operation{
|
||||||
|
OperationID: "user-deletion-confirm",
|
||||||
|
Summary: "Confirm account deletion",
|
||||||
|
Description: "Confirms a requested account deletion using the token from the confirmation email and schedules the account for deletion.",
|
||||||
|
Method: http.MethodPost,
|
||||||
|
Path: "/user/deletion/confirm",
|
||||||
|
Tags: tags,
|
||||||
|
DefaultStatus: http.StatusNoContent,
|
||||||
|
}, userDeletionConfirm)
|
||||||
|
|
||||||
|
Register(api, huma.Operation{
|
||||||
|
OperationID: "user-deletion-cancel",
|
||||||
|
Summary: "Cancel account deletion",
|
||||||
|
Description: "Cancels a scheduled account deletion. Local users must provide their password.",
|
||||||
|
Method: http.MethodPost,
|
||||||
|
Path: "/user/deletion/cancel",
|
||||||
|
Tags: tags,
|
||||||
|
DefaultStatus: http.StatusNoContent,
|
||||||
|
}, userDeletionCancel)
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() { AddRouteRegistrar(RegisterUserDeletionRoutes) }
|
||||||
|
|
||||||
|
// authUserFromCtx resolves the full DB user for the authenticated caller, refusing
|
||||||
|
// link shares (which have no account to delete) with a 403.
|
||||||
|
func authUserFromCtx(ctx context.Context, s *xorm.Session) (*user.User, error) {
|
||||||
|
a, err := authFromCtx(ctx)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
authUser, is := a.(*user.User)
|
||||||
|
if !is {
|
||||||
|
return nil, huma.Error403Forbidden("only users can manage account deletion")
|
||||||
|
}
|
||||||
|
// The auth user from the JWT claims is partial; re-fetch for the password hash.
|
||||||
|
u, err := user.GetUserByID(s, authUser.ID)
|
||||||
|
if err != nil {
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
return u, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func userDeletionRequest(ctx context.Context, in *userDeletionPasswordBody) (*emptyBody, error) {
|
||||||
|
s := db.NewSession()
|
||||||
|
defer s.Close()
|
||||||
|
|
||||||
|
u, err := authUserFromCtx(ctx, s)
|
||||||
|
if err != nil {
|
||||||
|
_ = s.Rollback()
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if u.IsLocalUser() {
|
||||||
|
if err := user.CheckUserPassword(u, in.Body.Password); err != nil {
|
||||||
|
_ = s.Rollback()
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := user.RequestDeletion(s, u); err != nil {
|
||||||
|
_ = s.Rollback()
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := s.Commit(); err != nil {
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
return &emptyBody{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func userDeletionConfirm(ctx context.Context, in *userDeletionConfirmBody) (*emptyBody, error) {
|
||||||
|
s := db.NewSession()
|
||||||
|
defer s.Close()
|
||||||
|
|
||||||
|
u, err := authUserFromCtx(ctx, s)
|
||||||
|
if err != nil {
|
||||||
|
_ = s.Rollback()
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := user.ConfirmDeletion(s, u, in.Body.Token); err != nil {
|
||||||
|
_ = s.Rollback()
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := s.Commit(); err != nil {
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
return &emptyBody{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func userDeletionCancel(ctx context.Context, in *userDeletionPasswordBody) (*emptyBody, error) {
|
||||||
|
s := db.NewSession()
|
||||||
|
defer s.Close()
|
||||||
|
|
||||||
|
u, err := authUserFromCtx(ctx, s)
|
||||||
|
if err != nil {
|
||||||
|
_ = s.Rollback()
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
if u.IsLocalUser() {
|
||||||
|
if err := user.CheckUserPassword(u, in.Body.Password); err != nil {
|
||||||
|
_ = s.Rollback()
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := user.CancelDeletion(s, u); err != nil {
|
||||||
|
_ = s.Rollback()
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := s.Commit(); err != nil {
|
||||||
|
return nil, translateDomainError(err)
|
||||||
|
}
|
||||||
|
return &emptyBody{}, nil
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,194 @@
|
||||||
|
// Vikunja is a to-do list application to facilitate your life.
|
||||||
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
||||||
|
//
|
||||||
|
// This program is free software: you can redistribute it and/or modify
|
||||||
|
// it under the terms of the GNU Affero General Public License as published by
|
||||||
|
// the Free Software Foundation, either version 3 of the License, or
|
||||||
|
// (at your option) any later version.
|
||||||
|
//
|
||||||
|
// This program is distributed in the hope that it will be useful,
|
||||||
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
// GNU Affero General Public License for more details.
|
||||||
|
//
|
||||||
|
// You should have received a copy of the GNU Affero General Public License
|
||||||
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
package webtests
|
||||||
|
|
||||||
|
import (
|
||||||
|
"net/http"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"code.vikunja.io/api/pkg/db"
|
||||||
|
"code.vikunja.io/api/pkg/models"
|
||||||
|
"code.vikunja.io/api/pkg/modules/auth"
|
||||||
|
"code.vikunja.io/api/pkg/user"
|
||||||
|
|
||||||
|
"github.com/stretchr/testify/assert"
|
||||||
|
"github.com/stretchr/testify/require"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
userDeletionRequestPath = "/api/v2/user/deletion/request"
|
||||||
|
userDeletionConfirmPath = "/api/v2/user/deletion/confirm"
|
||||||
|
userDeletionCancelPath = "/api/v2/user/deletion/cancel"
|
||||||
|
// testUserPassword is the plaintext password for every local fixture user.
|
||||||
|
testUserPassword = "12345678"
|
||||||
|
)
|
||||||
|
|
||||||
|
// deletionTokenFor reads the cleartext account-deletion token RequestDeletion
|
||||||
|
// stored for the user. RequestDeletion only mails the token, so the test pulls
|
||||||
|
// it straight from user_tokens (kind 3 = TokenAccountDeletion).
|
||||||
|
func deletionTokenFor(t *testing.T, userID int64) string {
|
||||||
|
t.Helper()
|
||||||
|
s := db.NewSession()
|
||||||
|
defer s.Close()
|
||||||
|
tok := struct {
|
||||||
|
Token string `xorm:"token"`
|
||||||
|
}{}
|
||||||
|
has, err := s.Table("user_tokens").
|
||||||
|
Where("user_id = ? AND kind = ?", userID, 3).
|
||||||
|
Get(&tok)
|
||||||
|
require.NoError(t, err)
|
||||||
|
require.True(t, has, "RequestDeletion must have stored a deletion token for user %d", userID)
|
||||||
|
return tok.Token
|
||||||
|
}
|
||||||
|
|
||||||
|
func deletionScheduledFor(t *testing.T, userID int64) bool {
|
||||||
|
t.Helper()
|
||||||
|
s := db.NewSession()
|
||||||
|
defer s.Close()
|
||||||
|
u, err := user.GetUserByID(s, userID)
|
||||||
|
require.NoError(t, err)
|
||||||
|
return !u.DeletionScheduledAt.IsZero()
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestHumaUserDeletion ports v1's account-deletion flow (request → confirm →
|
||||||
|
// cancel) to v2. v1 returned 200/204 with a confirmation message body; v2
|
||||||
|
// normalises all three to an empty 204 (the action returns no resource), so
|
||||||
|
// every success here asserts 204 + empty body.
|
||||||
|
func TestHumaUserDeletion(t *testing.T) {
|
||||||
|
t.Run("Request - wrong password rejected", func(t *testing.T) {
|
||||||
|
e, err := setupTestEnv()
|
||||||
|
require.NoError(t, err)
|
||||||
|
token := humaTokenFor(t, &testuser1)
|
||||||
|
|
||||||
|
rec := humaRequest(t, e, http.MethodPost, userDeletionRequestPath, `{"password":"wrong"}`, token, "")
|
||||||
|
assert.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
||||||
|
assert.False(t, deletionScheduledFor(t, testuser1.ID), "a rejected request must not schedule deletion")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Confirm - invalid token rejected", func(t *testing.T) {
|
||||||
|
e, err := setupTestEnv()
|
||||||
|
require.NoError(t, err)
|
||||||
|
token := humaTokenFor(t, &testuser1)
|
||||||
|
|
||||||
|
rec := humaRequest(t, e, http.MethodPost, userDeletionConfirmPath, `{"token":"not-a-real-token"}`, token, "")
|
||||||
|
assert.Equal(t, http.StatusBadRequest, rec.Code, "body: %s", rec.Body.String())
|
||||||
|
assert.False(t, deletionScheduledFor(t, testuser1.ID))
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Confirm - missing token is a validation error", func(t *testing.T) {
|
||||||
|
e, err := setupTestEnv()
|
||||||
|
require.NoError(t, err)
|
||||||
|
token := humaTokenFor(t, &testuser1)
|
||||||
|
|
||||||
|
rec := humaRequest(t, e, http.MethodPost, userDeletionConfirmPath, `{"token":""}`, token, "")
|
||||||
|
assert.Equal(t, http.StatusUnprocessableEntity, rec.Code, "body: %s", rec.Body.String())
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Request then confirm schedules deletion", func(t *testing.T) {
|
||||||
|
e, err := setupTestEnv()
|
||||||
|
require.NoError(t, err)
|
||||||
|
token := humaTokenFor(t, &testuser1)
|
||||||
|
|
||||||
|
req := humaRequest(t, e, http.MethodPost, userDeletionRequestPath, `{"password":"`+testUserPassword+`"}`, token, "")
|
||||||
|
require.Equal(t, http.StatusNoContent, req.Code, "body: %s", req.Body.String())
|
||||||
|
assert.Empty(t, req.Body.String(), "v2 normalises the request action to an empty 204")
|
||||||
|
assert.False(t, deletionScheduledFor(t, testuser1.ID), "request alone must not schedule; confirmation does")
|
||||||
|
|
||||||
|
confirm := humaRequest(t, e, http.MethodPost, userDeletionConfirmPath,
|
||||||
|
`{"token":"`+deletionTokenFor(t, testuser1.ID)+`"}`, token, "")
|
||||||
|
require.Equal(t, http.StatusNoContent, confirm.Code, "body: %s", confirm.Body.String())
|
||||||
|
assert.Empty(t, confirm.Body.String())
|
||||||
|
assert.True(t, deletionScheduledFor(t, testuser1.ID), "confirm must schedule the deletion")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Cancel - wrong password rejected", func(t *testing.T) {
|
||||||
|
e, err := setupTestEnv()
|
||||||
|
require.NoError(t, err)
|
||||||
|
token := humaTokenFor(t, &testuser1)
|
||||||
|
|
||||||
|
// Schedule first so there is something to cancel.
|
||||||
|
req := humaRequest(t, e, http.MethodPost, userDeletionRequestPath, `{"password":"`+testUserPassword+`"}`, token, "")
|
||||||
|
require.Equal(t, http.StatusNoContent, req.Code, "body: %s", req.Body.String())
|
||||||
|
confirm := humaRequest(t, e, http.MethodPost, userDeletionConfirmPath,
|
||||||
|
`{"token":"`+deletionTokenFor(t, testuser1.ID)+`"}`, token, "")
|
||||||
|
require.Equal(t, http.StatusNoContent, confirm.Code, "body: %s", confirm.Body.String())
|
||||||
|
require.True(t, deletionScheduledFor(t, testuser1.ID))
|
||||||
|
|
||||||
|
cancel := humaRequest(t, e, http.MethodPost, userDeletionCancelPath, `{"password":"wrong"}`, token, "")
|
||||||
|
assert.Equal(t, http.StatusForbidden, cancel.Code, "body: %s", cancel.Body.String())
|
||||||
|
assert.True(t, deletionScheduledFor(t, testuser1.ID), "a rejected cancel must leave the deletion scheduled")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Cancel - correct password clears the schedule", func(t *testing.T) {
|
||||||
|
e, err := setupTestEnv()
|
||||||
|
require.NoError(t, err)
|
||||||
|
token := humaTokenFor(t, &testuser1)
|
||||||
|
|
||||||
|
req := humaRequest(t, e, http.MethodPost, userDeletionRequestPath, `{"password":"`+testUserPassword+`"}`, token, "")
|
||||||
|
require.Equal(t, http.StatusNoContent, req.Code, "body: %s", req.Body.String())
|
||||||
|
confirm := humaRequest(t, e, http.MethodPost, userDeletionConfirmPath,
|
||||||
|
`{"token":"`+deletionTokenFor(t, testuser1.ID)+`"}`, token, "")
|
||||||
|
require.Equal(t, http.StatusNoContent, confirm.Code, "body: %s", confirm.Body.String())
|
||||||
|
require.True(t, deletionScheduledFor(t, testuser1.ID))
|
||||||
|
|
||||||
|
cancel := humaRequest(t, e, http.MethodPost, userDeletionCancelPath, `{"password":"`+testUserPassword+`"}`, token, "")
|
||||||
|
require.Equal(t, http.StatusNoContent, cancel.Code, "body: %s", cancel.Body.String())
|
||||||
|
assert.Empty(t, cancel.Body.String())
|
||||||
|
assert.False(t, deletionScheduledFor(t, testuser1.ID), "cancel must clear the scheduled deletion")
|
||||||
|
})
|
||||||
|
|
||||||
|
t.Run("Unauthenticated", func(t *testing.T) {
|
||||||
|
e, err := setupTestEnv()
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
for _, path := range []string{userDeletionRequestPath, userDeletionConfirmPath, userDeletionCancelPath} {
|
||||||
|
rec := humaRequest(t, e, http.MethodPost, path, `{}`, "", "")
|
||||||
|
assert.Equal(t, http.StatusUnauthorized, rec.Code, "%s body: %s", path, rec.Body.String())
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
// TestHumaUserDeletion_LinkShareForbidden asserts a link share — which has no
|
||||||
|
// account — is refused (403) on every deletion action.
|
||||||
|
func TestHumaUserDeletion_LinkShareForbidden(t *testing.T) {
|
||||||
|
e, err := setupTestEnv()
|
||||||
|
require.NoError(t, err)
|
||||||
|
token, err := auth.NewLinkShareJWTAuthtoken(&models.LinkSharing{
|
||||||
|
ID: 1,
|
||||||
|
Hash: "test",
|
||||||
|
ProjectID: 1,
|
||||||
|
Permission: models.PermissionRead,
|
||||||
|
SharingType: models.SharingTypeWithoutPassword,
|
||||||
|
SharedByID: 1,
|
||||||
|
})
|
||||||
|
require.NoError(t, err)
|
||||||
|
|
||||||
|
for _, tc := range []struct {
|
||||||
|
name string
|
||||||
|
path string
|
||||||
|
body string
|
||||||
|
}{
|
||||||
|
{"request", userDeletionRequestPath, `{"password":"` + testUserPassword + `"}`},
|
||||||
|
{"confirm", userDeletionConfirmPath, `{"token":"x"}`},
|
||||||
|
{"cancel", userDeletionCancelPath, `{"password":"` + testUserPassword + `"}`},
|
||||||
|
} {
|
||||||
|
t.Run(tc.name, func(t *testing.T) {
|
||||||
|
rec := humaRequest(t, e, http.MethodPost, tc.path, tc.body, token, "")
|
||||||
|
assert.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue