push

pushy

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

controllers/client/profile.controller.js

@@ -165,6 +165,35 @@ exports.deleteAvatar = async (req, res) => {
   }
 };
 
+// ─── DELETE own account ────────────────────────────────────────────────────────
+
+exports.deleteAccount = async (req, res) => {
+  try {
+    const user = await mdl_Users.findByPk(req.user.user_id);
+    if (!user) return R.error(res, 'User not found.', 404);
+
+    // Revoke all active sessions first
+    await mdl_UserSessions.update(
+      { is_active: false, logout_info: { date: new Date().toISOString(), ip_address: req.ip, reason: 'account_deleted' } },
+      { where: { user_id: req.user.user_id, is_active: true } },
+    );
+
+    // Anonymize email before soft-delete so the unique slot is freed for re-registration
+    await user.update({ email: `deleted_${req.user.user_id}@deleted.invalid`, deletedBy: req.user.user_id });
+    await user.destroy(); // paranoid soft-delete — sets deleted_at
+
+    logActivity(req.user.user_id, 'delete_account');
+
+    res.clearCookie('refreshToken');
+    res.clearCookie('_csrf');
+
+    return R.success(res, 'Account deleted.');
+  } catch (err) {
+    console.error('[CLIENT] deleteAccount error:', err);
+    return R.error(res, 'Could not delete account.', 500);
+  }
+};
+
 // ─── GET own achievements ──────────────────────────────────────────────────────
 
 exports.getAchievements = async (req, res) => {