John O'Keefe
cc5677eb17
14 endpoints backfilled: devices pending/approve/reject; users
password/profile/profile-delete self-service (admin variants in prose);
admin list_users + update_user_max_devices; progress history; book
matching; new password-rules doc.
Gate fix: authLabel missed JWT middleware written inline as
createJWTMiddleware(cfg) (uppercase 'JWT') — reported auth 'none' for
/api/auth self-service routes and would have for any wrapper-inlined
group. Labeled 'JWTMiddleware' + fallthrough 'jwt' case.
Claude registry: 12 entries. Drift fixed by gate: list_users on-device —
handler returns raw []database.Users (bare array, full model incl.
password_hash — real leak the API emits; pinned + documented; earlier
draft had invented {users,total,limit,offset} wrapper). max-devices
response is {message} only. books/match is GET /api/books/match
{matches, action}. progress history sessions = ReadingHistory rows
(pgtype fields). make test 9/9.
1.3 KiB
1.3 KiB
method, path, auth, area
| method | path | auth | area |
|---|---|---|---|
| DELETE | /api/auth/profile | jwt | authentication |
Delete User
Delete a user account. Supports both self-deletion and admin deletion.
Endpoints:
- Self-deletion:
DELETE /api/auth/profile - Admin deletion:
DELETE /api/auth/profile/:id
Auth: Required
Self-Deletion
Users can delete their own account. This permanently removes the user and all associated data.
Endpoint: DELETE /api/auth/profile
Admin Deletion
Admins can delete any user account by providing the user ID in the URL.
URL Parameter: :id - Target user's UUID
Endpoint: DELETE /api/auth/profile/:id
Response (200 OK)
{
"message": "account deleted"
}
Error Responses
| Code | Description |
|---|---|
| 400 | Cannot delete the last admin |
| 401 | Invalid or expired token |
| 403 | Admin access required (trying to delete another user) |
| 404 | User not found (admin mode only) |
Safety Rules
- The last remaining admin cannot be deleted
- Self-deletion requires the user to not be the last admin
- Admin deletion is restricted to admin role only