From 31e286a14b77d1248d0af3104310d3fb8a6dd740 Mon Sep 17 00:00:00 2001
From: John O'Keefe <jrokeefe@protonmail.com>
Date: Sun, 22 Feb 2026 12:17:50 -0500
Subject: [PATCH] fix(handlers): check user existence before deletion in
 DeleteUser

Add explicit check to verify target user exists in database before
attempting deletion. Previously, the handler would return 200 OK when
trying to delete non-existent users.

Changes:
- Add userFound flag to track if target user was found in user list
- Explicitly check pgtype.UUID.Bytes against all users' IDs
- Return 404 Not Found if user doesn't exist (before last admin check)
- Supports both JSON and HTML (HTMX) response formats

This fixes the failing test:
- TestDeleteUserConsolidated/DELETE_/api/auth/profile/:id_-_Delete_non-existent_user

The check uses the existing ListUsers result, so no additional database
query is required. The pgtype.UUID.Bytes comparison ensures exact
16-byte UUID matching.
---
 internal/handlers/auth.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/internal/handlers/auth.go b/internal/handlers/auth.go
index 0a1e464..bdac3ba 100644
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -846,6 +846,8 @@ func (h *AuthHandler) DeleteUser(c echo.Context) error {
 	// Count admin users and identify the user to be deleted
 	adminCount := 0
 	targetUserRole := ""
+	userFound := false
+
 	for _, user := range users {
 		if user.Role == "admin" {
 			adminCount++
@@ -853,9 +855,19 @@ func (h *AuthHandler) DeleteUser(c echo.Context) error {
 		// Find target user details
 		if user.ID.Bytes == targetUserUUID.Bytes {
 			targetUserRole = user.Role
+			userFound = true
+			// Can't break here - still need to count all admins for last admin check
 		}
 	}
 
+	// Check if target user exists in the database
+	if !userFound {
+		if c.Request().Header.Get("HX-Request") == "true" {
+			return c.HTML(http.StatusNotFound, `<div class="text-red-500">User not found</div>`)
+		}
+		return c.JSON(http.StatusNotFound, map[string]string{"error": "user not found"})
+	}
+
 	// Prevent deletion if target user is admin and this is the last admin
 	if targetUserRole == "admin" && adminCount == 1 {
 		if c.Request().Header.Get("HX-Request") == "true" {