From b7771b75abe6c7ec39511f4bfe4ed32392f7a4b2 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 5 Jul 2026 15:41:45 +0000 Subject: [PATCH 1/9] feat(hutch): self-serve account deletion (App Store 5.1.1(v)) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The iOS app supports in-app account creation, so Apple requires users to be able to initiate account deletion from within the app. Neither the app nor readplace.com offered self-serve deletion; the privacy policy told users to email, which Apple rejects. Add end-to-end deletion. Server pipeline (mirrors the export/cancel-subscription workers): - DeleteAccountCommand + publisher + EventBridge/in-memory wrappers. - delete-account worker: an idempotent, DLQ-backed scrub of every user-owned store — auth row + Gmail claim, sessions, OAuth grants, saved articles, digest queue, reader-ready state, iOS onboarding, inbox emails/links (+ their S3 objects) and forwarding addresses, S3 exports, password-reset tokens, and a live Stripe subscription + customer. Founding-member and trialing accounts are first-class branches with no Stripe call. - Synchronous POST /account/delete teardown (destroy sessions -> revoke every OAuth token -> clear the session cookie -> publish the command -> redirect to the logged-out home) so the account is unusable the instant the user confirms. - Per-store bulk delete/revoke primitives next to each store, mirrored in the in-memory fixtures, unit-tested. Clients: - Siren: a `class` field on SirenAction, a new account resource with a bare destructive `delete-account` action, and an `account` discovery link. - Web: an /account danger zone behind an hx-confirm, and a privacy-policy rewrite pointing at the self-serve path. - iOS: a `delete-account` presentation case, the row destructive-confirm generalized to any destructive collection affordance (keyed on isDestructive, not the name), and forceLogout after a successful account-ending invoke. Also: an injectable no-op Apple-revocation seam (Phase 6 slots in when SIWA is extended to persist a refresh token) and a webhook-race fix so a late SubscriptionCancelled event on a just-deleted account is an idempotent no-op rather than a DLQ poison. Product decisions applied (plan defaults; flag for review): D1 inbox addresses tombstoned (PII stripped, hash kept reserved so it can never be re-minted and leak mail); D2 Stripe customer deleted; D3 raw .eml deleted; D4 password-reset tokens scan-deleted by email (that table has no TTL); D5 native/hx destructive confirm, no forced re-auth; D6 PITR/deletion-protection retention documented out of band. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01RkzGzig54ovfhxFHM9FyG3 --- projects/hutch/src/e2e/e2e-server.main.ts | 1 + projects/hutch/src/infra/index.ts | 111 ++++ projects/hutch/src/runtime/app.ts | 13 +- .../hutch/src/runtime/delete-account.main.ts | 147 +++++ .../delete-account-handler.test.ts | 527 ++++++++++++++++++ .../delete-account/delete-account-handler.ts | 158 ++++++ .../revoke-external-idp-tokens.test.ts | 14 + .../revoke-external-idp-tokens.ts | 25 + ...dle-subscription-cancelled-handler.test.ts | 22 + .../handle-subscription-cancelled-handler.ts | 15 +- .../dynamodb-article-store.test.ts | 36 ++ .../article-store/dynamodb-article-store.ts | 20 + .../runtime/providers/auth/dynamodb-auth.ts | 26 + .../dynamodb-digest-queue.test.ts | 42 ++ .../digest-queue/dynamodb-digest-queue.ts | 20 +- .../eventbridge-delete-account-command.ts | 14 + .../dynamodb-inbox-address.test.ts | 75 +++ .../inbox-address/dynamodb-inbox-address.ts | 23 + .../dynamodb-inbox-email-link.test.ts | 110 ++++ .../inbox-email/dynamodb-inbox-email-link.ts | 28 + .../inbox-email/dynamodb-inbox-email.test.ts | 128 +++++ .../inbox-email/dynamodb-inbox-email.ts | 28 + .../inbox-email/s3-delete-objects.test.ts | 61 ++ .../inbox-email/s3-delete-objects.ts | 23 + .../dynamodb-ios-onboarding-signal.test.ts | 11 + .../dynamodb-ios-onboarding-signal.ts | 8 +- .../providers/oauth/dynamodb-oauth-model.ts | 51 +- .../dynamodb-password-reset.test.ts | 64 +++ .../password-reset/dynamodb-password-reset.ts | 31 +- .../dynamodb-reader-ready-state.test.ts | 11 + .../dynamodb-reader-ready-state.ts | 8 +- .../stripe-subscriptions.test.ts | 72 +++ .../stripe-subscriptions.ts | 25 + .../dynamodb-subscription-providers.test.ts | 26 + .../dynamodb-subscription-writes.ts | 7 + .../user-data-export/s3-user-data-export.ts | 31 +- .../user-data-export.types.ts | 2 + projects/hutch/src/runtime/server.ts | 7 + projects/hutch/src/runtime/test-app.ts | 2 + .../src/runtime/web/api/account-siren.test.ts | 19 + .../src/runtime/web/api/account-siren.ts | 23 + .../src/runtime/web/api/api.routes.test.ts | 1 + .../runtime/web/api/collection-siren.test.ts | 5 +- .../src/runtime/web/api/collection-siren.ts | 1 + projects/hutch/src/runtime/web/api/siren.ts | 4 + .../runtime/web/pages/account/account.page.ts | 57 +- .../web/pages/account/account.route.test.ts | 80 +++ .../web/pages/account/account.styles.css | 26 + .../web/pages/account/account.template.html | 10 + .../runtime/web/pages/account/account.url.ts | 1 + .../pages/account/account.view-model.test.ts | 15 + .../web/pages/account/account.view-model.ts | 16 +- .../web/pages/admin/recrawl.route.test.ts | 1 + .../web/pages/privacy/privacy.template.html | 2 +- .../web/pages/queue/queue.card.route.test.ts | 6 + .../pages/queue/queue.freshness.route.test.ts | 1 + .../queue/queue.listing.filters.route.test.ts | 1 + .../pages/queue/queue.listing.route.test.ts | 1 + .../pages/queue/queue.mutations.route.test.ts | 1 + .../queue/queue.reader-presence.route.test.ts | 1 + .../queue/queue.reader.advanced.route.test.ts | 14 + .../pages/queue/queue.reader.route.test.ts | 18 + .../queue/queue.save-content.route.test.ts | 2 + .../pages/queue/queue.save-html.route.test.ts | 3 + .../queue/queue.share-balloon.route.test.ts | 1 + .../pages/view/view.metadata.route.test.ts | 14 + .../runtime/web/pages/view/view.route.test.ts | 27 + .../App/AffordancePresentation.swift | 17 + .../ios-readplace/App/ReadingListView.swift | 51 +- .../Tests/AffordancePresentationTests.swift | 22 + .../domain/src/inbox/inbox-address.schema.ts | 8 + .../domain/src/inbox/inbox-address.types.ts | 10 + .../src/inbox/inbox-email-link.types.ts | 11 + .../domain/src/inbox/inbox-email.types.ts | 11 + src/packages/domain/src/inbox/index.ts | 7 +- .../hutch-infra-components/src/events.ts | 10 + .../hutch-infra-components/src/index.ts | 2 + .../provider-contracts/src/article-store.ts | 5 + src/packages/provider-contracts/src/auth.ts | 2 + .../provider-contracts/src/digest-queue.ts | 3 + src/packages/provider-contracts/src/events.ts | 4 + .../src/ios-onboarding-signal.ts | 3 + src/packages/provider-contracts/src/oauth.ts | 4 +- .../provider-contracts/src/password-reset.ts | 2 + .../src/reader-ready-state.ts | 3 + .../src/stripe-subscriptions.ts | 2 + .../src/subscription-providers.ts | 2 + src/packages/test-fixtures/src/fixture.ts | 12 +- .../in-memory-article-store.test.ts | 28 + .../article-store/in-memory-article-store.ts | 9 + .../src/providers/auth/in-memory-auth.test.ts | 37 ++ .../src/providers/auth/in-memory-auth.ts | 14 + .../digest-queue/digest-queue.types.ts | 1 + .../in-memory-digest-queue.test.ts | 12 + .../digest-queue/in-memory-digest-queue.ts | 10 +- .../in-memory-delete-account-command.ts | 16 + .../src/providers/events/index.ts | 2 + .../publish-delete-account-command.types.ts | 1 + .../in-memory-inbox-address.test.ts | 33 ++ .../inbox-address/in-memory-inbox-address.ts | 15 + .../in-memory-inbox-email-link.test.ts | 49 ++ .../inbox-email/in-memory-inbox-email-link.ts | 17 + .../inbox-email/in-memory-inbox-email.test.ts | 54 ++ .../inbox-email/in-memory-inbox-email.ts | 13 + .../in-memory-ios-onboarding-signal.test.ts | 26 + .../in-memory-ios-onboarding-signal.ts | 9 +- .../src/providers/oauth/oauth-model.test.ts | 89 +++ .../src/providers/oauth/oauth-model.ts | 18 + .../in-memory-password-reset.test.ts | 23 + .../in-memory-password-reset.ts | 10 +- .../password-reset/password-reset.types.ts | 1 + .../in-memory-reader-ready-state.test.ts | 26 + .../in-memory-reader-ready-state.ts | 8 +- .../in-memory-subscription-providers.test.ts | 18 + .../in-memory-subscription-providers.ts | 7 + .../subscription-providers.types.ts | 1 + .../web-test-harness/src/bundle.types.ts | 6 + 117 files changed, 3074 insertions(+), 44 deletions(-) create mode 100644 projects/hutch/src/runtime/delete-account.main.ts create mode 100644 projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts create mode 100644 projects/hutch/src/runtime/delete-account/delete-account-handler.ts create mode 100644 projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.test.ts create mode 100644 projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts create mode 100644 projects/hutch/src/runtime/providers/events/eventbridge-delete-account-command.ts create mode 100644 projects/hutch/src/runtime/providers/inbox-email/s3-delete-objects.test.ts create mode 100644 projects/hutch/src/runtime/providers/inbox-email/s3-delete-objects.ts create mode 100644 projects/hutch/src/runtime/web/api/account-siren.test.ts create mode 100644 projects/hutch/src/runtime/web/api/account-siren.ts create mode 100644 src/packages/test-fixtures/src/providers/events/in-memory-delete-account-command.ts create mode 100644 src/packages/test-fixtures/src/providers/events/publish-delete-account-command.types.ts diff --git a/projects/hutch/src/e2e/e2e-server.main.ts b/projects/hutch/src/e2e/e2e-server.main.ts index 68b021fba..9bb9e67c7 100644 --- a/projects/hutch/src/e2e/e2e-server.main.ts +++ b/projects/hutch/src/e2e/e2e-server.main.ts @@ -129,6 +129,7 @@ const { app: hutchApp, auth, email } = createTestApp({ publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/infra/index.ts b/projects/hutch/src/infra/index.ts index 08187621f..3e183b36a 100644 --- a/projects/hutch/src/infra/index.ts +++ b/projects/hutch/src/infra/index.ts @@ -6,6 +6,7 @@ import { HutchLambda, HutchAPIGateway, HutchDynamoDBAccess, HutchEventBus, Hutch import { CancelSubscriptionCommand, CrawlEmailLinkPreview, + DeleteAccountCommand, EmailReceivedEvent, ExportUserDataCommand, SendTrialFeedbackEmailCommand, @@ -524,6 +525,116 @@ const exportUserDataLambdaWithSQS = new HutchSQSBackedLambda("export-user-data", eventBus.subscribe(ExportUserDataCommand, exportUserDataLambdaWithSQS); +// --- DeleteAccount worker Lambda --- +// Durable, DLQ-backed scrub of every user-owned store when an account is +// deleted. Runs behind SQS at-least-once with an email alert on the DLQ so a +// stuck erasure is never silent. + +const deleteAccountDynamodb = new HutchDynamoDBAccess("delete-account-dynamodb", { + tables: [ + { arn: storage.usersTable.arn, includeIndexes: true }, + { arn: storage.sessionsTable.arn, includeIndexes: true }, + { arn: storage.oauthTable.arn, includeIndexes: true }, + { arn: storage.userArticlesTable.arn, includeIndexes: true }, + { arn: storage.digestQueueTable.arn, includeIndexes: false }, + { arn: storage.readerReadyNotificationsTable.arn, includeIndexes: false }, + { arn: storage.onboardingTable.arn, includeIndexes: false }, + { arn: storage.subscriptionProvidersTable.arn, includeIndexes: false }, + { arn: storage.inboxEmailsTable.arn, includeIndexes: false }, + { arn: storage.inboxEmailLinksTable.arn, includeIndexes: false }, + { arn: storage.inboxAddressesTable.arn, includeIndexes: true }, + { arn: storage.passwordResetTokensTable.arn, includeIndexes: false }, + ], + actions: [ + "dynamodb:GetItem", + "dynamodb:Query", + "dynamodb:Scan", + "dynamodb:DeleteItem", + "dynamodb:UpdateItem", + "dynamodb:TransactWriteItems", + ], +}); + +// The write-policy helpers grant only PutObject, so a delete worker needs an +// explicit s3:DeleteObject grant (+ ListBucket for the export-prefix listing). +const deleteAccountS3Policy = { + name: "delete-account-s3-delete", + policy: JSON.stringify({ + Version: "2012-10-17", + Statement: [ + { + Effect: "Allow", + Action: ["s3:DeleteObject"], + Resource: [ + `arn:aws:s3:::${rawEmailBucketName}/*`, + `arn:aws:s3:::${contentBucketName}/*`, + `arn:aws:s3:::${userExportBucketName}/*`, + ], + }, + { + Effect: "Allow", + Action: ["s3:ListBucket"], + Resource: [ + `arn:aws:s3:::${rawEmailBucketName}`, + `arn:aws:s3:::${contentBucketName}`, + `arn:aws:s3:::${userExportBucketName}`, + ], + }, + ], + }), +}; + +const deleteAccountQueue = new HutchSQS("delete-account", { + // Matches the worker Lambda timeout so a single in-flight scrub cannot be + // redelivered while still running. + visibilityTimeoutSeconds: 900, +}); + +const deleteAccountLambda = new HutchLambda("delete-account", { + entryPoint: "./src/runtime/delete-account.main.ts", + outputDir: ".lib/delete-account", + assetDir: "./src/runtime", + memorySize: 1024, + timeout: 900, + environment: { + PERSISTENCE: "prod", + DYNAMODB_USERS_TABLE: storage.usersTable.name, + DYNAMODB_SESSIONS_TABLE: storage.sessionsTable.name, + DYNAMODB_OAUTH_TABLE: storage.oauthTable.name, + DYNAMODB_ARTICLES_TABLE: storage.articlesTable.name, + DYNAMODB_USER_ARTICLES_TABLE: storage.userArticlesTable.name, + DYNAMODB_DIGEST_QUEUE_TABLE: storage.digestQueueTable.name, + DYNAMODB_READER_READY_NOTIFICATIONS_TABLE: storage.readerReadyNotificationsTable.name, + DYNAMODB_ONBOARDING_TABLE: storage.onboardingTable.name, + DYNAMODB_SUBSCRIPTION_PROVIDERS_TABLE: storage.subscriptionProvidersTable.name, + DYNAMODB_INBOX_EMAILS_TABLE: storage.inboxEmailsTable.name, + DYNAMODB_INBOX_EMAIL_LINKS_TABLE: storage.inboxEmailLinksTable.name, + DYNAMODB_INBOX_ADDRESSES_TABLE: storage.inboxAddressesTable.name, + DYNAMODB_PASSWORD_RESET_TOKENS_TABLE: storage.passwordResetTokensTable.name, + RAW_EMAIL_BUCKET_NAME: rawEmailBucketName, + CONTENT_BUCKET_NAME: contentBucketName, + USER_EXPORT_BUCKET_NAME: userExportBucketName, + STRIPE_SECRET_KEY: requireEnv("STRIPE_SECRET_KEY"), + EVENT_BUS_ARN: eventBus.eventBusArn, + TRIAL_SCHEDULER_GROUP_NAME: trialSchedulerGroupName, + TRIAL_SCHEDULER_ROLE_ARN: trialSchedulerRole.arn, + }, + policies: [ + ...deleteAccountDynamodb.policies, + deleteAccountS3Policy, + cancelSubscriptionSchedulerManagePolicy, + ], +}); + +const deleteAccountLambdaWithSQS = new HutchSQSBackedLambda("delete-account", { + lambda: deleteAccountLambda, + queue: deleteAccountQueue, + alertEmailDLQEntry: alertEmail, + batchSize: 1, +}); + +eventBus.subscribe(DeleteAccountCommand, deleteAccountLambdaWithSQS); + // --- Inbound email receive worker Lambda --- // Drains the SES→SNS receipt notifications: fetches the raw .eml from the raw // bucket, resolves each recipient, parses + sanitizes the body into the content diff --git a/projects/hutch/src/runtime/app.ts b/projects/hutch/src/runtime/app.ts index a5b07b3e2..4bbf7f85f 100644 --- a/projects/hutch/src/runtime/app.ts +++ b/projects/hutch/src/runtime/app.ts @@ -25,6 +25,7 @@ import { initReadabilityParser, linkedinSiteRules, mediumSiteRules, theInformati import { initRefreshArticleIfStale } from "@packages/finalize-article"; import { createOAuthModel, + createRevokeAllUserOAuthTokens, initInMemoryOAuthClients, initInMemoryOAuthModel, } from "@packages/test-fixtures/providers/oauth"; @@ -67,10 +68,12 @@ import { initEventBridgeSaveLinkRawPdfCommand } from "./providers/events/eventbr import { initEventBridgeRefreshArticleContent, initPutRefreshHtml } from "@packages/refresh-article-content"; import { initEventBridgeUpdateFetchTimestamp } from "./providers/events/eventbridge-update-fetch-timestamp"; import { initEventBridgeExportUserDataCommand } from "./providers/events/eventbridge-export-user-data-command"; +import { initEventBridgeDeleteAccountCommand } from "./providers/events/eventbridge-delete-account-command"; import { initEventBridgeCancelSubscriptionCommand } from "./providers/events/eventbridge-cancel-subscription-command"; import { initEventBridgeSubscriptionReactivated } from "./providers/events/eventbridge-subscription-reactivated"; import { initInMemoryCancelSubscriptionCommand, + initInMemoryDeleteAccountCommand, initInMemoryExportUserDataCommand, initInMemorySubscriptionReactivated, } from "@packages/test-fixtures/providers/events"; @@ -221,6 +224,7 @@ function initProviders() { const { publishRefreshArticleContent } = initEventBridgeRefreshArticleContent({ publishEvent, putRefreshHtml }); const { publishUpdateFetchTimestamp } = initEventBridgeUpdateFetchTimestamp({ publishEvent }); const { publishExportUserDataCommand } = initEventBridgeExportUserDataCommand({ publishEvent }); + const { publishDeleteAccountCommand } = initEventBridgeDeleteAccountCommand({ publishEvent }); const { publishCancelSubscriptionCommand } = initEventBridgeCancelSubscriptionCommand({ publishEvent }); const { publishSubscriptionReactivated } = initEventBridgeSubscriptionReactivated({ publishEvent }); const { putPendingHtml } = initPutPendingHtml({ client: new S3Client({}), bucketName: pendingHtmlBucketName }); @@ -368,6 +372,7 @@ function initProviders() { googleAuth, appleAuth, oauthModel, + revokeAllUserOAuthTokens: oauthModel.revokeAllUserOAuthTokens, validateAccessToken: createValidateAccessToken(oauthModel), findOAuthClient: oauthClientLookup.findClient, validateOAuthRedirectUri: oauthClientLookup.validateRedirectUri, @@ -380,6 +385,7 @@ function initProviders() { publishSaveLinkRawPdfCommand, publishUpdateFetchTimestamp, publishExportUserDataCommand, + publishDeleteAccountCommand, publishCancelSubscriptionCommand, publishSubscriptionReactivated, putPendingHtml, @@ -403,11 +409,13 @@ function initProviders() { const articleStore = initInMemoryArticleStore(); const oauthClients = initInMemoryOAuthClients({ now: () => new Date() }); const oauthClientLookup = initOAuthClientLookup({ dynamic: oauthClients }); - const oauthModel = createOAuthModel(initInMemoryOAuthModel(), { + const oauthModelDeps = initInMemoryOAuthModel(); + const oauthModel = createOAuthModel(oauthModelDeps, { findUserById: auth.findUserById, findClient: oauthClientLookup.findClient, markClientActive: oauthClientLookup.markClientActive, }); + const revokeAllUserOAuthTokens = createRevokeAllUserOAuthTokens(oauthModelDeps); const devStripe = initInMemoryStripeCheckout({ checkoutBaseUrl: "https://checkout.stripe.test", now: () => new Date() }); const devStripeSubscriptions = initInMemoryStripeSubscriptions(); const devPendingSignup = initInMemoryPendingSignup(); @@ -545,6 +553,7 @@ function initProviders() { const { publishSaveLinkRawHtmlCommand } = initInMemorySaveLinkRawHtmlCommand({ logger: consoleLogger }); const { publishSaveLinkRawPdfCommand } = initInMemorySaveLinkRawPdfCommand({ logger: consoleLogger }); const { publishExportUserDataCommand } = initInMemoryExportUserDataCommand({ logger: consoleLogger }); + const { publishDeleteAccountCommand } = initInMemoryDeleteAccountCommand({ logger: consoleLogger }); const { publishCancelSubscriptionCommand } = initInMemoryCancelSubscriptionCommand({ logger: consoleLogger }); const { publishSubscriptionReactivated } = initInMemorySubscriptionReactivated({ logger: consoleLogger }); const { putPendingHtml } = initInMemoryPendingHtml(); @@ -614,6 +623,7 @@ function initProviders() { googleAuth, appleAuth, oauthModel, + revokeAllUserOAuthTokens, validateAccessToken: createValidateAccessToken(oauthModel), findOAuthClient: oauthClientLookup.findClient, validateOAuthRedirectUri: oauthClientLookup.validateRedirectUri, @@ -626,6 +636,7 @@ function initProviders() { publishSaveLinkRawPdfCommand, publishUpdateFetchTimestamp, publishExportUserDataCommand, + publishDeleteAccountCommand, publishCancelSubscriptionCommand, publishSubscriptionReactivated, putPendingHtml, diff --git a/projects/hutch/src/runtime/delete-account.main.ts b/projects/hutch/src/runtime/delete-account.main.ts new file mode 100644 index 000000000..e3659eaf5 --- /dev/null +++ b/projects/hutch/src/runtime/delete-account.main.ts @@ -0,0 +1,147 @@ +/* c8 ignore start -- composition root, no logic to test */ +import { S3Client } from "@aws-sdk/client-s3"; +import { SchedulerClient } from "@aws-sdk/client-scheduler"; +import { createDynamoDocumentClient } from "@packages/hutch-storage-client"; +import { HutchLogger, consoleLogger } from "@packages/hutch-logger"; +import { requireEnv } from "@packages/require-env"; +import { initDynamoDbAuth } from "./providers/auth/dynamodb-auth"; +import { initRevokeAllUserOAuthTokens } from "./providers/oauth/dynamodb-oauth-model"; +import { initDynamoDbArticleStore } from "./providers/article-store/dynamodb-article-store"; +import { initDynamoDbDigestQueue } from "./providers/digest-queue/dynamodb-digest-queue"; +import { initDynamoDbReaderReadyState } from "./providers/reader-ready-state/dynamodb-reader-ready-state"; +import { initIosOnboardingSignal } from "./providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal"; +import { initDynamoDbSubscriptionProviders } from "./providers/subscription-providers/dynamodb-subscription-providers"; +import { initStripeSubscriptions } from "./providers/stripe-subscriptions/stripe-subscriptions"; +import { initAwsTrialScheduler } from "./providers/trial-scheduler/aws-trial-scheduler"; +import { initDynamoDbInboxEmail } from "./providers/inbox-email/dynamodb-inbox-email"; +import { initDynamoDbInboxEmailLink } from "./providers/inbox-email/dynamodb-inbox-email-link"; +import { initS3DeleteObjects } from "./providers/inbox-email/s3-delete-objects"; +import { initDynamoDbInboxAddress } from "./providers/inbox-address/dynamodb-inbox-address"; +import { initS3UserDataExport } from "./providers/user-data-export/s3-user-data-export"; +import { initDynamoDbPasswordReset } from "./providers/password-reset/dynamodb-password-reset"; +import { initNoopRevokeExternalIdpTokens } from "./delete-account/revoke-external-idp-tokens"; +import { initDeleteAccountHandler } from "./delete-account/delete-account-handler"; + +const logger = HutchLogger.from(consoleLogger); +const now = () => new Date(); +const dynamoClient = createDynamoDocumentClient(); +const s3Client = new S3Client({}); + +const auth = initDynamoDbAuth({ + client: dynamoClient, + usersTableName: requireEnv("DYNAMODB_USERS_TABLE"), + sessionsTableName: requireEnv("DYNAMODB_SESSIONS_TABLE"), +}); + +const revokeAllUserOAuthTokens = initRevokeAllUserOAuthTokens({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_OAUTH_TABLE"), +}); + +const articleStore = initDynamoDbArticleStore({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_ARTICLES_TABLE"), + userArticlesTableName: requireEnv("DYNAMODB_USER_ARTICLES_TABLE"), + logger, +}); + +const digestQueue = initDynamoDbDigestQueue({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_DIGEST_QUEUE_TABLE"), +}); + +const readerReadyState = initDynamoDbReaderReadyState({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_READER_READY_NOTIFICATIONS_TABLE"), +}); + +const onboarding = initIosOnboardingSignal({ + client: dynamoClient, + onboardingTableName: requireEnv("DYNAMODB_ONBOARDING_TABLE"), + now, +}); + +const subscriptionProviders = initDynamoDbSubscriptionProviders({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_SUBSCRIPTION_PROVIDERS_TABLE"), + now, +}); + +const stripeSubscriptions = initStripeSubscriptions({ + apiKey: requireEnv("STRIPE_SECRET_KEY"), + fetch: globalThis.fetch, +}); + +const trialScheduler = initAwsTrialScheduler({ + client: new SchedulerClient({}), + scheduleGroupName: requireEnv("TRIAL_SCHEDULER_GROUP_NAME"), + schedulerRoleArn: requireEnv("TRIAL_SCHEDULER_ROLE_ARN"), + eventBusArn: requireEnv("EVENT_BUS_ARN"), +}); + +const inboxEmail = initDynamoDbInboxEmail({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_INBOX_EMAILS_TABLE"), +}); + +const inboxEmailLink = initDynamoDbInboxEmailLink({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_INBOX_EMAIL_LINKS_TABLE"), +}); + +const inboxAddress = initDynamoDbInboxAddress({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_INBOX_ADDRESSES_TABLE"), + now, +}); + +const deleteRawEmailObjects = initS3DeleteObjects({ + client: s3Client, + bucketName: requireEnv("RAW_EMAIL_BUCKET_NAME"), +}); + +const deleteEmailContentObjects = initS3DeleteObjects({ + client: s3Client, + bucketName: requireEnv("CONTENT_BUCKET_NAME"), +}); + +const { deleteUserExports } = initS3UserDataExport({ + client: s3Client, + bucketName: requireEnv("USER_EXPORT_BUCKET_NAME"), + now, +}); + +const passwordReset = initDynamoDbPasswordReset({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_PASSWORD_RESET_TOKENS_TABLE"), +}); + +const revokeExternalIdpTokens = initNoopRevokeExternalIdpTokens({ logger }); + +export const handler = initDeleteAccountHandler({ + findEmailByUserId: auth.findEmailByUserId, + findSubscriptionByUserId: subscriptionProviders.findByUserId, + cancelStripeSubscription: stripeSubscriptions.cancelImmediately, + deleteStripeCustomer: stripeSubscriptions.deleteCustomer, + deleteSubscription: subscriptionProviders.deleteSubscription, + deleteTrialEndSchedule: trialScheduler.deleteTrialEndSchedule, + deleteDeferredCancellationSchedule: trialScheduler.deleteDeferredCancellationSchedule, + deleteTrialFeedbackEmailSchedule: trialScheduler.deleteTrialFeedbackEmailSchedule, + deleteAllInboxEmails: inboxEmail.deleteAllEmailsByUserId, + deleteAllInboxLinks: inboxEmailLink.deleteAllLinksByUserId, + tombstoneInboxAddresses: inboxAddress.tombstoneUserAddresses, + deleteRawEmailObjects, + deleteEmailContentObjects, + deleteAllUserArticles: articleStore.deleteAllUserArticles, + deleteDigestByUser: digestQueue.deleteDigestByUser, + deleteReaderReadyState: readerReadyState.deleteReaderReadyState, + deleteOnboarding: onboarding.deleteOnboarding, + deleteUserExports, + deletePasswordResetTokensByEmail: passwordReset.deleteTokensByEmail, + revokeExternalIdpTokens, + revokeAllUserOAuthTokens, + destroyUserSessions: auth.destroyUserSessions, + closeUserAccount: auth.closeUserAccount, + logger, +}); +/* c8 ignore stop */ diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts new file mode 100644 index 000000000..61ce097cd --- /dev/null +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts @@ -0,0 +1,527 @@ +import assert from "node:assert/strict"; +import { MinutesSchema } from "@packages/domain/article"; +import { + AliasNameSchema, + DELETED_ACCOUNT_INBOX_OWNER, + EmailLinkOrdinalSchema, + InboxAddressSchema, + MessageIdSchema, +} from "@packages/domain/inbox"; +import type { UserId } from "@packages/domain/user"; +import { HutchLogger, noopLogger } from "@packages/hutch-logger"; +import { initInMemoryArticleStore } from "@packages/test-fixtures/providers/article-store"; +import { initInMemoryAuth } from "@packages/test-fixtures/providers/auth"; +import { initInMemoryDigestQueue } from "@packages/test-fixtures/providers/digest-queue"; +import { + initInMemoryInboxAddress, +} from "@packages/test-fixtures/providers/inbox-address"; +import { + initInMemoryInboxEmail, + initInMemoryInboxEmailLink, +} from "@packages/test-fixtures/providers/inbox-email"; +import { initInMemoryIosOnboardingSignal } from "@packages/test-fixtures/providers/ios-onboarding-signal"; +import { + createRevokeAllUserOAuthTokens, + initInMemoryOAuthModel, +} from "@packages/test-fixtures/providers/oauth"; +import { initInMemoryReaderReadyState } from "@packages/test-fixtures/providers/reader-ready-state"; +import { initInMemorySubscriptionProviders } from "@packages/test-fixtures/providers/subscription-providers"; +import { buildLambdaContext } from "@packages/test-fixtures/lambda-context"; +import { buildSqsEvent } from "@packages/test-fixtures/sqs"; +import { initDeleteAccountHandler } from "./delete-account-handler"; +import { initNoopRevokeExternalIdpTokens } from "./revoke-external-idp-tokens"; + +const SEED_NOW = new Date("2026-07-05T00:00:00.000Z"); +const COOLDOWN_MS = 1000 * 60 * 60 * 24 * 365; + +function bodyFor(userId: string): string { + return JSON.stringify({ detail: { userId } }); +} + +function articleMetadata(title: string) { + return { title, siteName: "example.com", excerpt: "An excerpt", wordCount: 100 }; +} + +function sorted(values: string[]): string[] { + return [...values].sort(); +} + +function buildSubject() { + const auth = initInMemoryAuth({ + hashPassword: async (password) => `hashed:${password}`, + verifyPassword: async (password, stored) => stored === `hashed:${password}`, + }); + const oauthDeps = initInMemoryOAuthModel(); + const articleStore = initInMemoryArticleStore(); + const digest = initInMemoryDigestQueue(); + const readerReady = initInMemoryReaderReadyState(); + const onboarding = initInMemoryIosOnboardingSignal(); + const subs = initInMemorySubscriptionProviders({ now: () => SEED_NOW }); + const inboxEmail = initInMemoryInboxEmail(); + const inboxLink = initInMemoryInboxEmailLink(); + const inboxAddress = initInMemoryInboxAddress({ now: () => SEED_NOW }); + + const cancelStripeCalls: Array<{ subscriptionId: string }> = []; + const deleteCustomerCalls: Array<{ customerId: string }> = []; + const deleteSubscriptionCalls: UserId[] = []; + const trialEndCalls: UserId[] = []; + const deferredCancelCalls: UserId[] = []; + const trialFeedbackCalls: UserId[] = []; + const rawEmailDeleteArgs: string[][] = []; + const bodyEmailDeleteArgs: string[][] = []; + const deleteExportsCalls: UserId[] = []; + const passwordResetCalls: string[] = []; + const revokeIdpCalls: UserId[] = []; + + // The noop is exercised through this wrapper so its own logging line stays + // covered while the spy still records each invocation. + const noopRevoke = initNoopRevokeExternalIdpTokens({ logger: HutchLogger.from(noopLogger) }); + + // Test-only failure injection: the article-store fake throws for any user id + // added here, so a batch can carry one poisoned record beside a healthy one. + const articleDeleteThrowIds = new Set(); + + const handler = initDeleteAccountHandler({ + findEmailByUserId: auth.findEmailByUserId, + findSubscriptionByUserId: subs.findByUserId, + cancelStripeSubscription: async ({ subscriptionId }: { subscriptionId: string }) => { + cancelStripeCalls.push({ subscriptionId }); + }, + deleteStripeCustomer: async ({ customerId }: { customerId: string }) => { + deleteCustomerCalls.push({ customerId }); + }, + deleteSubscription: async ({ userId }: { userId: UserId }) => { + deleteSubscriptionCalls.push(userId); + await subs.deleteSubscription({ userId }); + }, + deleteTrialEndSchedule: async ({ userId }: { userId: UserId }) => { + trialEndCalls.push(userId); + }, + deleteDeferredCancellationSchedule: async ({ userId }: { userId: UserId }) => { + deferredCancelCalls.push(userId); + }, + deleteTrialFeedbackEmailSchedule: async ({ userId }: { userId: UserId }) => { + trialFeedbackCalls.push(userId); + }, + deleteAllInboxEmails: inboxEmail.deleteAllEmailsByUserId, + deleteAllInboxLinks: inboxLink.deleteAllLinksByUserId, + tombstoneInboxAddresses: inboxAddress.tombstoneUserAddresses, + deleteRawEmailObjects: async (keys: string[]) => { + rawEmailDeleteArgs.push(keys); + }, + deleteEmailContentObjects: async (keys: string[]) => { + bodyEmailDeleteArgs.push(keys); + }, + deleteAllUserArticles: async (userId: UserId) => { + if (articleDeleteThrowIds.has(userId)) { + throw new Error("simulated deleteAllUserArticles failure"); + } + await articleStore.deleteAllUserArticles(userId); + }, + deleteDigestByUser: digest.deleteDigestByUser, + deleteReaderReadyState: readerReady.deleteReaderReadyState, + deleteOnboarding: onboarding.deleteOnboarding, + deleteUserExports: async (userId: UserId) => { + deleteExportsCalls.push(userId); + }, + deletePasswordResetTokensByEmail: async (email: string) => { + passwordResetCalls.push(email); + }, + revokeExternalIdpTokens: async (userId: UserId) => { + revokeIdpCalls.push(userId); + await noopRevoke(userId); + }, + revokeAllUserOAuthTokens: createRevokeAllUserOAuthTokens(oauthDeps), + destroyUserSessions: auth.destroyUserSessions, + closeUserAccount: auth.closeUserAccount, + logger: HutchLogger.from(noopLogger), + }); + + return { + handler, + auth, + oauthDeps, + articleStore, + digest, + readerReady, + onboarding, + subs, + inboxEmail, + inboxLink, + inboxAddress, + cancelStripeCalls, + deleteCustomerCalls, + deleteSubscriptionCalls, + trialEndCalls, + deferredCancelCalls, + trialFeedbackCalls, + rawEmailDeleteArgs, + bodyEmailDeleteArgs, + deleteExportsCalls, + passwordResetCalls, + revokeIdpCalls, + failArticleDeleteFor: (userId: UserId): void => { + articleDeleteThrowIds.add(userId); + }, + }; +} + +type Subject = ReturnType; + +interface SeededAccount { + userId: UserId; + email: string; + address: string; + ramA: string; + ramB: string; + rawKeys: string[]; + bodyKeys: string[]; + sessionId: string; +} + +async function seedAccount( + s: Subject, + opts: { + label: string; + email: string; + subscription: "active" | "trialing" | "none"; + }, +): Promise { + const { label, email, subscription } = opts; + const subscriptionId = `sub_${label}`; + const customerId = `cus_${label}`; + + const created = await s.auth.createUser({ email, password: "password-123" }); + assert(created.ok, "expected the seeded user to be created"); + const userId = created.userId; + const storedEmail = await s.auth.findEmailByUserId(userId); + assert(storedEmail !== null, "expected the seeded user to resolve an email"); + const sessionId = await s.auth.createSession({ userId, emailVerified: true }); + + await s.articleStore.saveArticle({ + userId, + url: `https://example.com/${label}/article`, + metadata: articleMetadata(`${label} article`), + estimatedReadTime: MinutesSchema.parse(4), + }); + + await s.digest.enqueueDigestItem({ + userId, + url: `https://example.com/${label}/digest`, + enqueuedAt: SEED_NOW.toISOString(), + retentionMs: COOLDOWN_MS, + }); + + const claimed = await s.readerReady.claimReaderReadyEmailSlot({ + userId, + now: SEED_NOW, + cooldownMs: COOLDOWN_MS, + }); + assert(claimed, "expected the reader-ready slot to seed as claimed"); + + await s.onboarding.recordIosSavedArticle({ userId }); + + if (subscription === "active") { + await s.subs.upsertActive({ userId, subscriptionId, customerId }); + } else if (subscription === "trialing") { + await s.subs.upsertTrialing({ userId, trialEndsAt: "2026-08-01T00:00:00.000Z" }); + } + + const ramA = `2026-07-05T00:00:00.000Z#<${label}-a@x>`; + const ramB = `2026-07-04T00:00:00.000Z#<${label}-b@x>`; + const rawKeyA = `inbound/${label}-a`; + const rawKeyB = `inbound/${label}-b`; + const bodyKeyA = `content/${label}-a.html`; + const recipientAddress = InboxAddressSchema.parse("in-3f9a2c@read.place"); + + await s.inboxEmail.putEmail({ + userId, + receivedAtMessageId: ramA, + messageId: MessageIdSchema.parse(`<${label}-a@x>`), + recipientAddress, + senderEmail: "news@example.com", + subject: "Received newsletter", + status: "received", + receivedAt: "2026-07-05T00:00:00.000Z", + rawEmailS3Key: rawKeyA, + bodyS3Key: bodyKeyA, + }); + await s.inboxEmail.putEmail({ + userId, + receivedAtMessageId: ramB, + messageId: MessageIdSchema.parse(`<${label}-b@x>`), + recipientAddress, + senderEmail: "spam@example.com", + subject: "Rejected message", + status: "rejected", + receivedAt: "2026-07-04T00:00:00.000Z", + rawEmailS3Key: rawKeyB, + bodyS3Key: undefined, + }); + + await s.inboxLink.putLink({ + userId, + receivedAtMessageId: ramA, + ordinal: EmailLinkOrdinalSchema.parse("0000"), + url: `https://example.com/${label}/link`, + status: "pending", + title: undefined, + excerpt: undefined, + siteName: undefined, + imageUrl: undefined, + failureReason: undefined, + }); + await s.inboxLink.putLinksMeta({ + userId, + receivedAtMessageId: ramA, + meta: { truncated: true }, + }); + + const addressEntry = await s.inboxAddress.createAddress({ + userId, + domain: "read.place", + name: AliasNameSchema.parse("news"), + }); + + s.oauthDeps.userIdIndex.set(userId, new Set([`at-${label}`])); + + return { + userId, + email: storedEmail, + address: addressEntry.address, + ramA, + ramB, + rawKeys: [rawKeyA, rawKeyB], + bodyKeys: [bodyKeyA], + sessionId, + }; +} + +/** A present reader-ready slot blocks a same-instant claim (returns false); an + * absent slot allows it (returns true). This is the only readable signal the + * fixture exposes, so deletion is inferred from a now-allowed claim. */ +async function readerReadySlotPresent(s: Subject, userId: UserId): Promise { + const claimed = await s.readerReady.claimReaderReadyEmailSlot({ + userId, + now: SEED_NOW, + cooldownMs: COOLDOWN_MS, + }); + return !claimed; +} + +async function run(s: Subject, records: Array<{ messageId: string; body: string }>) { + const result = await s.handler(buildSqsEvent(records), buildLambdaContext(), () => {}); + assert(result, "handler must return an SQSBatchResponse"); + return result; +} + +describe("delete-account handler", () => { + it("scrubs every user-owned store for the deleted account and leaves a second account untouched", async () => { + const s = buildSubject(); + const victim = await seedAccount(s, { + label: "u1", + email: "u1@example.com", + subscription: "active", + }); + const bystander = await seedAccount(s, { + label: "u2", + email: "u2@example.com", + subscription: "active", + }); + + const result = await run(s, [{ messageId: "msg-u1", body: bodyFor(victim.userId) }]); + + assert.deepEqual(result.batchItemFailures, []); + + // Victim: every store now returns empty / none. + assert.equal((await s.articleStore.findArticlesByUser({ userId: victim.userId })).total, 0); + assert.equal((await s.digest.listDigestItemsByUser(victim.userId)).length, 0); + assert.equal(await readerReadySlotPresent(s, victim.userId), false); + assert.deepEqual(await s.onboarding.getIosAppSignals({ userId: victim.userId }), { + installed: false, + savedArticle: false, + }); + assert.equal(await s.subs.findByUserId(victim.userId), undefined); + assert.equal((await s.inboxEmail.listEmailsByUserId(victim.userId)).length, 0); + const victimLinks = await s.inboxLink.listLinksByEmail({ + userId: victim.userId, + receivedAtMessageId: victim.ramA, + }); + assert.equal(victimLinks.links.length, 0); + assert.equal(victimLinks.meta, undefined); + + // Inbox address is tombstoned, not deleted: the row survives under the + // reserved sentinel owner and no longer resolves for the victim. + const tombstoned = await s.inboxAddress.findByAddress(InboxAddressSchema.parse(victim.address)); + assert(tombstoned, "expected the tombstoned address row to survive"); + assert.equal(tombstoned.userId, DELETED_ACCOUNT_INBOX_OWNER); + assert.equal((await s.inboxAddress.listAddressesByUserId(victim.userId)).length, 0); + + // OAuth grants, sessions, and the identity row are gone. + assert.equal(s.oauthDeps.userIdIndex.has(victim.userId), false); + assert.equal(await s.auth.getSessionUserId(victim.sessionId), null); + assert.equal(await s.auth.findEmailByUserId(victim.userId), null); + + // S3 object deletes received exactly the seeded raw + body keys. + assert.equal(s.rawEmailDeleteArgs.length, 1); + assert.deepEqual(sorted(s.rawEmailDeleteArgs[0]), sorted(victim.rawKeys)); + assert.equal(s.bodyEmailDeleteArgs.length, 1); + assert.deepEqual(sorted(s.bodyEmailDeleteArgs[0]), sorted(victim.bodyKeys)); + + // Password-reset tokens purged by the email captured before deletion. + assert.deepEqual(s.passwordResetCalls, [victim.email]); + + // Billing side effects fired for the active subscription. + assert.deepEqual(s.cancelStripeCalls, [{ subscriptionId: "sub_u1" }]); + assert.deepEqual(s.deleteCustomerCalls, [{ customerId: "cus_u1" }]); + assert.deepEqual(s.deleteSubscriptionCalls, [victim.userId]); + assert.deepEqual(s.deleteExportsCalls, [victim.userId]); + assert.deepEqual(s.revokeIdpCalls, [victim.userId]); + + // Bystander: everything intact. + assert.equal((await s.articleStore.findArticlesByUser({ userId: bystander.userId })).total, 1); + assert.equal((await s.digest.listDigestItemsByUser(bystander.userId)).length, 1); + assert.equal(await readerReadySlotPresent(s, bystander.userId), true); + assert.deepEqual(await s.onboarding.getIosAppSignals({ userId: bystander.userId }), { + installed: true, + savedArticle: true, + }); + const bystanderSub = await s.subs.findByUserId(bystander.userId); + assert(bystanderSub, "expected the bystander subscription to survive"); + assert.equal(bystanderSub.status, "active"); + assert.equal((await s.inboxEmail.listEmailsByUserId(bystander.userId)).length, 2); + assert.equal( + ( + await s.inboxLink.listLinksByEmail({ + userId: bystander.userId, + receivedAtMessageId: bystander.ramA, + }) + ).links.length, + 1, + ); + const bystanderAddress = await s.inboxAddress.findByAddress( + InboxAddressSchema.parse(bystander.address), + ); + assert(bystanderAddress, "expected the bystander address to survive"); + assert.equal(bystanderAddress.userId, bystander.userId); + assert.equal((await s.inboxAddress.listAddressesByUserId(bystander.userId)).length, 1); + assert.equal(s.oauthDeps.userIdIndex.has(bystander.userId), true); + assert(await s.auth.getSessionUserId(bystander.sessionId)); + assert.equal(await s.auth.findEmailByUserId(bystander.userId), bystander.email); + }); + + it("active subscription branch — cancels Stripe, deletes the customer, and drops the local row", async () => { + const s = buildSubject(); + const account = await seedAccount(s, { + label: "active", + email: "active@example.com", + subscription: "active", + }); + + const result = await run(s, [{ messageId: "msg", body: bodyFor(account.userId) }]); + + assert.deepEqual(result.batchItemFailures, []); + assert.deepEqual(s.cancelStripeCalls, [{ subscriptionId: "sub_active" }]); + assert.deepEqual(s.deleteCustomerCalls, [{ customerId: "cus_active" }]); + assert.deepEqual(s.deleteSubscriptionCalls, [account.userId]); + assert.equal(await s.subs.findByUserId(account.userId), undefined); + }); + + it("trialing branch — no Stripe calls, but the row is dropped and all three schedules deleted", async () => { + const s = buildSubject(); + const account = await seedAccount(s, { + label: "trial", + email: "trial@example.com", + subscription: "trialing", + }); + + const result = await run(s, [{ messageId: "msg", body: bodyFor(account.userId) }]); + + assert.deepEqual(result.batchItemFailures, []); + assert.deepEqual(s.cancelStripeCalls, []); + assert.deepEqual(s.deleteCustomerCalls, []); + assert.deepEqual(s.deleteSubscriptionCalls, [account.userId]); + assert.deepEqual(s.trialEndCalls, [account.userId]); + assert.deepEqual(s.deferredCancelCalls, [account.userId]); + assert.deepEqual(s.trialFeedbackCalls, [account.userId]); + }); + + it("founding-member branch — no subscription row, so no billing calls, but the schedules are still deleted", async () => { + const s = buildSubject(); + const account = await seedAccount(s, { + label: "founder", + email: "founder@example.com", + subscription: "none", + }); + + const result = await run(s, [{ messageId: "msg", body: bodyFor(account.userId) }]); + + assert.deepEqual(result.batchItemFailures, []); + assert.deepEqual(s.cancelStripeCalls, []); + assert.deepEqual(s.deleteCustomerCalls, []); + assert.deepEqual(s.deleteSubscriptionCalls, []); + assert.deepEqual(s.trialEndCalls, [account.userId]); + assert.deepEqual(s.deferredCancelCalls, [account.userId]); + assert.deepEqual(s.trialFeedbackCalls, [account.userId]); + }); + + it("is idempotent — a second run against the now-empty account does not throw and reports no failures", async () => { + const s = buildSubject(); + const account = await seedAccount(s, { + label: "again", + email: "again@example.com", + subscription: "active", + }); + + const first = await run(s, [{ messageId: "msg-1", body: bodyFor(account.userId) }]); + assert.deepEqual(first.batchItemFailures, []); + + // The identity row is gone, so the second run finds no email (email === null + // branch) and no subscription — every teardown step is a stable no-op. + const second = await run(s, [{ messageId: "msg-2", body: bodyFor(account.userId) }]); + assert.deepEqual(second.batchItemFailures, []); + + // Billing and password-reset only fired on the first, data-bearing run. + assert.deepEqual(s.cancelStripeCalls, [{ subscriptionId: "sub_again" }]); + assert.deepEqual(s.passwordResetCalls, [account.email]); + }); + + it("reports the failing record in batchItemFailures while a second valid record in the same batch still succeeds", async () => { + const s = buildSubject(); + const poisoned = await seedAccount(s, { + label: "boom", + email: "boom@example.com", + subscription: "active", + }); + const healthy = await seedAccount(s, { + label: "ok", + email: "ok@example.com", + subscription: "active", + }); + s.failArticleDeleteFor(poisoned.userId); + + const result = await run(s, [ + { messageId: "msg-boom", body: bodyFor(poisoned.userId) }, + { messageId: "msg-ok", body: bodyFor(healthy.userId) }, + ]); + + assert.deepEqual(result.batchItemFailures, [{ itemIdentifier: "msg-boom" }]); + // The healthy record processed to completion despite its sibling failing. + assert.equal(await s.subs.findByUserId(healthy.userId), undefined); + assert.equal((await s.articleStore.findArticlesByUser({ userId: healthy.userId })).total, 0); + assert.equal(await s.auth.findEmailByUserId(healthy.userId), null); + }); + + it("invokes revokeExternalIdpTokens exactly once per deletion", async () => { + const s = buildSubject(); + const account = await seedAccount(s, { + label: "idp", + email: "idp@example.com", + subscription: "none", + }); + + await run(s, [{ messageId: "msg", body: bodyFor(account.userId) }]); + + assert.deepEqual(s.revokeIdpCalls, [account.userId]); + }); +}); diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts new file mode 100644 index 000000000..9a8e7b71a --- /dev/null +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts @@ -0,0 +1,158 @@ +import type { + Handler, + SQSBatchItemFailure, + SQSBatchResponse, + SQSEvent, +} from "aws-lambda"; +import { z } from "zod"; +import { type UserId, UserIdSchema } from "@packages/domain/user"; +import type { HutchLogger } from "@packages/hutch-logger"; +import { DeleteAccountCommand } from "@packages/hutch-infra-components"; +import type { + CloseUserAccount, + DestroyUserSessions, + FindEmailByUserId, +} from "@packages/provider-contracts/auth"; +import type { RevokeAllUserOAuthTokens } from "@packages/provider-contracts/oauth"; +import type { DeleteAllUserArticles } from "@packages/provider-contracts/article-store"; +import type { DeleteDigestByUser } from "@packages/provider-contracts/digest-queue"; +import type { DeleteReaderReadyState } from "@packages/provider-contracts/reader-ready-state"; +import type { DeleteOnboarding } from "@packages/provider-contracts/ios-onboarding-signal"; +import type { DeletePasswordResetTokensByEmail } from "@packages/provider-contracts/password-reset"; +import type { + DeleteSubscription, + FindSubscriptionByUserId, +} from "@packages/provider-contracts/subscription-providers"; +import type { + CancelSubscriptionImmediately, + DeleteCustomer, +} from "@packages/provider-contracts/stripe-subscriptions"; +import type { + DeleteDeferredCancellationSchedule, + DeleteTrialEndSchedule, + DeleteTrialFeedbackEmailSchedule, +} from "@packages/provider-contracts/trial-scheduler"; +import type { + InboxAddressStore, + InboxEmailLinkStore, + InboxEmailStore, +} from "@packages/domain/inbox"; +import type { DeleteUserExports } from "../providers/user-data-export/user-data-export.types"; +import type { RevokeExternalIdpTokens } from "./revoke-external-idp-tokens"; + +export interface DeleteAccountHandlerDependencies { + findEmailByUserId: FindEmailByUserId; + findSubscriptionByUserId: FindSubscriptionByUserId; + cancelStripeSubscription: CancelSubscriptionImmediately; + deleteStripeCustomer: DeleteCustomer; + deleteSubscription: DeleteSubscription; + deleteTrialEndSchedule: DeleteTrialEndSchedule; + deleteDeferredCancellationSchedule: DeleteDeferredCancellationSchedule; + deleteTrialFeedbackEmailSchedule: DeleteTrialFeedbackEmailSchedule; + deleteAllInboxEmails: InboxEmailStore["deleteAllEmailsByUserId"]; + deleteAllInboxLinks: InboxEmailLinkStore["deleteAllLinksByUserId"]; + tombstoneInboxAddresses: InboxAddressStore["tombstoneUserAddresses"]; + deleteRawEmailObjects: (keys: string[]) => Promise; + deleteEmailContentObjects: (keys: string[]) => Promise; + deleteAllUserArticles: DeleteAllUserArticles; + deleteDigestByUser: DeleteDigestByUser; + deleteReaderReadyState: DeleteReaderReadyState; + deleteOnboarding: DeleteOnboarding; + deleteUserExports: DeleteUserExports; + deletePasswordResetTokensByEmail: DeletePasswordResetTokensByEmail; + revokeExternalIdpTokens: RevokeExternalIdpTokens; + revokeAllUserOAuthTokens: RevokeAllUserOAuthTokens; + destroyUserSessions: DestroyUserSessions; + closeUserAccount: CloseUserAccount; + logger: HutchLogger; +} + +/** Erase every user-owned store for a deleted account. Each step is idempotent + * because the queue is at-least-once (a double-confirm enqueues twice) and a + * step that throws redrives the whole record — so re-running against a partially + * scrubbed account must converge, never throw on already-absent data. */ +async function processCommand( + userId: UserId, + deps: DeleteAccountHandlerDependencies, +): Promise { + // Capture the delivery email before the user row is deleted — password-reset + // tokens are keyed by email, and closeUserAccount removes the row that + // findEmailByUserId reads. + const email = await deps.findEmailByUserId(userId); + + // Billing first: cancel any live subscription and delete the Stripe customer + // (which detaches every card) before dropping the local row. Founding members + // have no row; trialing users have a row but no subscriptionId/customerId. + const subscription = await deps.findSubscriptionByUserId(userId); + if (subscription) { + if (subscription.subscriptionId) { + await deps.cancelStripeSubscription({ subscriptionId: subscription.subscriptionId }); + } + if (subscription.customerId) { + await deps.deleteStripeCustomer({ customerId: subscription.customerId }); + } + await deps.deleteSubscription({ userId }); + } + + // Delete every per-user schedule so a later fire can't dispatch a command at + // a deleted account. All three are ResourceNotFound-idempotent. + await deps.deleteTrialEndSchedule({ userId }); + await deps.deleteDeferredCancellationSchedule({ userId }); + await deps.deleteTrialFeedbackEmailSchedule({ userId }); + + // Inbox: delete the email rows (returns their ids + S3 keys), then the link + // rows keyed off those ids (that table has no userId index), then the S3 + // objects, then tombstone the forwarding addresses (kept reserved, PII + // stripped, so a freed hash can never be re-minted to leak another user's + // mail). + const { receivedAtMessageIds, rawEmailS3Keys, bodyS3Keys } = + await deps.deleteAllInboxEmails(userId); + await deps.deleteAllInboxLinks(userId, receivedAtMessageIds); + await deps.deleteRawEmailObjects(rawEmailS3Keys); + await deps.deleteEmailContentObjects(bodyS3Keys); + await deps.tombstoneInboxAddresses(userId); + + // Saved articles and the remaining per-user stores. + await deps.deleteAllUserArticles(userId); + await deps.deleteDigestByUser(userId); + await deps.deleteReaderReadyState(userId); + await deps.deleteOnboarding({ userId }); + await deps.deleteUserExports(userId); + if (email !== null) { + await deps.deletePasswordResetTokensByEmail(email); + } + + // Credentials last: revoke external IdP tokens, kill OAuth grants and every + // session, then delete the identity row (and its Gmail uniqueness claim). + await deps.revokeExternalIdpTokens(userId); + await deps.revokeAllUserOAuthTokens(userId); + await deps.destroyUserSessions(userId); + await deps.closeUserAccount(userId); + + deps.logger.info("[delete-account] completed", { userId }); +} + +export function initDeleteAccountHandler( + deps: DeleteAccountHandlerDependencies, +): Handler { + return async (event) => { + const batchItemFailures: SQSBatchItemFailure[] = []; + + for (const record of event.Records) { + try { + const envelope = z.object({ detail: z.unknown() }).parse(JSON.parse(record.body)); + const detail = DeleteAccountCommand.detailSchema.parse(envelope.detail); + const userId = UserIdSchema.parse(detail.userId); + await processCommand(userId, deps); + } catch (error) { + deps.logger.error("[delete-account] record failed", { + messageId: record.messageId, + error, + }); + batchItemFailures.push({ itemIdentifier: record.messageId }); + } + } + + return { batchItemFailures }; + }; +} diff --git a/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.test.ts b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.test.ts new file mode 100644 index 000000000..de375e7d0 --- /dev/null +++ b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.test.ts @@ -0,0 +1,14 @@ +import assert from "node:assert/strict"; +import { HutchLogger, noopLogger } from "@packages/hutch-logger"; +import { UserIdSchema } from "@packages/domain/user"; +import { initNoopRevokeExternalIdpTokens } from "./revoke-external-idp-tokens"; + +describe("initNoopRevokeExternalIdpTokens", () => { + it("resolves without throwing — no external IdP refresh token is persisted yet", async () => { + const revokeExternalIdpTokens = initNoopRevokeExternalIdpTokens({ + logger: HutchLogger.from(noopLogger), + }); + + await assert.doesNotReject(revokeExternalIdpTokens(UserIdSchema.parse("user-1"))); + }); +}); diff --git a/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts new file mode 100644 index 000000000..84a1ce9ce --- /dev/null +++ b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts @@ -0,0 +1,25 @@ +import type { UserId } from "@packages/domain/user"; +import type { HutchLogger } from "@packages/hutch-logger"; + +/** Revoke a user's tokens at any external identity provider they signed in + * through, as part of account deletion. Injected into the delete worker so the + * real Apple `/auth/revoke` call can be added without touching the teardown. */ +export type RevokeExternalIdpTokens = (userId: UserId) => Promise; + +/** The only IdPs today are Google (which persists no token) and Sign in with + * Apple — whose merged sign-in flow discards Apple's `refresh_token`, so there + * is nothing to revoke yet. This no-op is the injectable seam: when SIWA is + * extended to persist the refresh token, its runtime implementation replaces + * this at the composition root and the worker is unchanged. Apple *requires* + * revocation once both SIWA and account deletion ship, so this must be swapped + * for the real call in the same change that persists the token. */ +export function initNoopRevokeExternalIdpTokens(deps: { + logger: HutchLogger; +}): RevokeExternalIdpTokens { + return async (userId) => { + deps.logger.info( + "[delete-account] no external IdP token to revoke — Apple revocation pending SIWA refresh-token persistence", + { userId }, + ); + }; +} diff --git a/projects/hutch/src/runtime/handle-subscription-cancelled/handle-subscription-cancelled-handler.test.ts b/projects/hutch/src/runtime/handle-subscription-cancelled/handle-subscription-cancelled-handler.test.ts index 54019da89..f7b191092 100644 --- a/projects/hutch/src/runtime/handle-subscription-cancelled/handle-subscription-cancelled-handler.test.ts +++ b/projects/hutch/src/runtime/handle-subscription-cancelled/handle-subscription-cancelled-handler.test.ts @@ -1,6 +1,7 @@ import assert from "node:assert/strict"; import type { SQSEvent } from "aws-lambda"; import { buildLambdaContext } from "@packages/test-fixtures/lambda-context"; +import { ConditionalCheckFailedException } from "@packages/hutch-storage-client"; import { UserIdSchema } from "@packages/domain/user"; import { HutchLogger, noopLogger } from "@packages/hutch-logger"; import { initHandleSubscriptionCancelledHandler } from "./handle-subscription-cancelled-handler"; @@ -137,6 +138,27 @@ describe("handle-subscription-cancelled-handler", () => { assert.equal(result.batchItemFailures[0].itemIdentifier, "msg-fail"); }); + it("treats a missing subscription row (account deleted) as an idempotent no-op, not a failure", async () => { + const { emit, captured } = makeEmit(); + const handler = initHandleSubscriptionCancelledHandler({ + markCancelledByUserId: async () => { + throw new ConditionalCheckFailedException({ $metadata: {}, message: "row gone" }); + }, + emit, + logger: HutchLogger.from(noopLogger), + }); + + const result = await handler( + buildSqsEvent([{ messageId: "msg-gone", body: buildEventBridgeBody({ userId: USER_ID }) }]), + buildLambdaContext(), + () => {}, + ); + + assert(result); + assert.equal(result.batchItemFailures.length, 0); + assert.deepStrictEqual(captured, []); + }); + it("reports a batch item failure for malformed JSON", async () => { const handler = initHandleSubscriptionCancelledHandler({ markCancelledByUserId: async () => {}, diff --git a/projects/hutch/src/runtime/handle-subscription-cancelled/handle-subscription-cancelled-handler.ts b/projects/hutch/src/runtime/handle-subscription-cancelled/handle-subscription-cancelled-handler.ts index 0829b8c9b..dc4a9a0ec 100644 --- a/projects/hutch/src/runtime/handle-subscription-cancelled/handle-subscription-cancelled-handler.ts +++ b/projects/hutch/src/runtime/handle-subscription-cancelled/handle-subscription-cancelled-handler.ts @@ -5,6 +5,7 @@ import type { SQSEvent, } from "aws-lambda"; import { z } from "zod"; +import { ConditionalCheckFailedException } from "@packages/hutch-storage-client"; import { UserIdSchema } from "@packages/domain/user"; import type { HutchLogger } from "@packages/hutch-logger"; import { SubscriptionCancelledEvent } from "@packages/hutch-infra-components"; @@ -24,7 +25,19 @@ export function initHandleSubscriptionCancelledHandler(deps: { const envelope = z.object({ detail: z.unknown() }).parse(JSON.parse(record.body)); const detail = SubscriptionCancelledEvent.detailSchema.parse(envelope.detail); const userId = UserIdSchema.parse(detail.userId); - await deps.markCancelledByUserId({ userId }); + try { + await deps.markCancelledByUserId({ userId }); + } catch (error) { + // The subscription row is gone — account deletion removed it before + // this (possibly duplicate) cancellation event was processed. The + // desired end state already holds, so treat the missing row as an + // idempotent no-op instead of failing the record into the DLQ. + if (!(error instanceof ConditionalCheckFailedException)) throw error; + deps.logger.info("[SubscriptionCancelled] no subscription row (account deleted) — no-op", { + userId, + }); + continue; + } deps.emit.cancelled({ userId, reason: detail.reason, diff --git a/projects/hutch/src/runtime/providers/article-store/dynamodb-article-store.test.ts b/projects/hutch/src/runtime/providers/article-store/dynamodb-article-store.test.ts index a4caa5558..c1c962247 100644 --- a/projects/hutch/src/runtime/providers/article-store/dynamodb-article-store.test.ts +++ b/projects/hutch/src/runtime/providers/article-store/dynamodb-article-store.test.ts @@ -582,6 +582,42 @@ describe("initDynamoDbArticleStore deleteArticle", () => { }); }); +describe("initDynamoDbArticleStore deleteAllUserArticles", () => { + it("pages the userId-savedAt-index and deletes every userArticles row by its (userId, url) key across pages", async () => { + const { client, commands } = createFakeClient({ + QueryCommand: { + queue: [ + { Items: [userArticleItem({ url: "a" })], Count: 1, LastEvaluatedKey: { userId: USER, url: "a" } }, + { Items: [userArticleItem({ url: "b" })], Count: 1 }, + ], + }, + }); + + await initStore(client).deleteAllUserArticles(USER); + + const queries = commands.filter((c) => c.name === "QueryCommand"); + expect(queries).toHaveLength(2); + expect(queries[0]?.input.IndexName).toBe("userId-savedAt-index"); + expect(queries[0]?.input.KeyConditionExpression).toBe("userId = :userId"); + expect((queries[0]?.input.ExpressionAttributeValues as Record)[":userId"]).toBe(USER); + expect(queries[1]?.input.ExclusiveStartKey).toEqual({ userId: USER, url: "a" }); + + const deletes = commands.filter((c) => c.name === "DeleteCommand"); + expect(deletes.map((d) => d.input.Key)).toEqual([ + { userId: USER, url: "a" }, + { userId: USER, url: "b" }, + ]); + }); + + it("issues no deletes when the user has no saved rows", async () => { + const { client, commands } = createFakeClient({ QueryCommand: { default: { Items: [], Count: 0 } } }); + + await initStore(client).deleteAllUserArticles(USER); + + expect(commands.some((c) => c.name === "DeleteCommand")).toBe(false); + }); +}); + describe("initDynamoDbArticleStore updateArticleStatus", () => { it("stamps readAt when marking an article read", async () => { const { client, commands } = createFakeClient({ diff --git a/projects/hutch/src/runtime/providers/article-store/dynamodb-article-store.ts b/projects/hutch/src/runtime/providers/article-store/dynamodb-article-store.ts index 04e2f153c..47baf0407 100644 --- a/projects/hutch/src/runtime/providers/article-store/dynamodb-article-store.ts +++ b/projects/hutch/src/runtime/providers/article-store/dynamodb-article-store.ts @@ -5,6 +5,7 @@ import { batchGetFromTable, defineDynamoTable, dynamoField, + forEachQueryPage, } from "@packages/hutch-storage-client"; import { z } from "zod"; import type { SavedArticle } from "@packages/domain/article"; @@ -17,6 +18,7 @@ import type { UserId } from "@packages/domain/user"; import type { BumpArticleSavedAt, CountArticlesByUser, + DeleteAllUserArticles, DeleteArticle, FindArticleById, FindArticleByUrl, @@ -129,6 +131,7 @@ export function initDynamoDbArticleStore(deps: { findArticlesByUser: FindArticlesByUser; countArticlesByUser: CountArticlesByUser; deleteArticle: DeleteArticle; + deleteAllUserArticles: DeleteAllUserArticles; updateArticleStatus: UpdateArticleStatus; findArticleFreshness: FindArticleFreshness; markArticleViewed: MarkArticleViewed; @@ -405,6 +408,22 @@ export function initDynamoDbArticleStore(deps: { return true; }; + const deleteAllUserArticles: DeleteAllUserArticles = async (userId) => { + await forEachQueryPage( + userArticles, + { + IndexName: "userId-savedAt-index", + KeyConditionExpression: "userId = :userId", + ExpressionAttributeValues: { ":userId": userId }, + }, + async (rows) => { + await Promise.all( + rows.map((row) => userArticles.delete({ Key: { userId: row.userId, url: row.url } })), + ); + }, + ); + }; + const updateArticleStatus: UpdateArticleStatus = async (routeId, userId, status) => { const article = await findArticleByRouteId(routeId); if (!article) return false; @@ -593,6 +612,7 @@ export function initDynamoDbArticleStore(deps: { findArticlesByUser, countArticlesByUser, deleteArticle, + deleteAllUserArticles, updateArticleStatus, findArticleFreshness, markArticleViewed, diff --git a/projects/hutch/src/runtime/providers/auth/dynamodb-auth.ts b/projects/hutch/src/runtime/providers/auth/dynamodb-auth.ts index bb92f9631..07c5b0a1b 100644 --- a/projects/hutch/src/runtime/providers/auth/dynamodb-auth.ts +++ b/projects/hutch/src/runtime/providers/auth/dynamodb-auth.ts @@ -24,6 +24,7 @@ import { } from "@packages/domain/user"; import { SESSION_TTL_SECONDS, SessionRow, initGetSessionUserId } from "@packages/web-session"; import type { + CloseUserAccount, CountUsers, CreateAppleUser, CreateGoogleUser, @@ -89,6 +90,7 @@ export function initDynamoDbAuth(deps: { getSessionUserId: GetSessionUserId; destroySession: DestroySession; destroyUserSessions: DestroyUserSessions; + closeUserAccount: CloseUserAccount; countUsers: CountUsers; markEmailVerified: MarkEmailVerified; markSessionEmailVerified: MarkSessionEmailVerified; @@ -363,6 +365,29 @@ export function initDynamoDbAuth(deps: { return row ? row.email : null; }; + const closeUserAccount: CloseUserAccount = async (userId) => { + const email = await findEmailByUserId(userId); + if (email === null) return; + const claimKey = gmailIdentityKey(email); + if (claimKey === null) { + await users.delete({ Key: { email } }); + return; + } + await deps.client.send( + new TransactWriteCommand({ + TransactItems: [ + { Delete: { TableName: deps.usersTableName, Key: { email } } }, + { + Delete: { + TableName: deps.usersTableName, + Key: { email: `${CLAIM_PK_PREFIX}${claimKey}` }, + }, + }, + ], + }), + ); + }; + const findUserContactByUserId: FindUserContactByUserId = async (userId) => { const { items } = await users.query({ IndexName: "userId-index", @@ -425,6 +450,7 @@ export function initDynamoDbAuth(deps: { getSessionUserId, destroySession, destroyUserSessions, + closeUserAccount, countUsers, markEmailVerified, markSessionEmailVerified, diff --git a/projects/hutch/src/runtime/providers/digest-queue/dynamodb-digest-queue.test.ts b/projects/hutch/src/runtime/providers/digest-queue/dynamodb-digest-queue.test.ts index 035b85ab9..b5597045a 100644 --- a/projects/hutch/src/runtime/providers/digest-queue/dynamodb-digest-queue.test.ts +++ b/projects/hutch/src/runtime/providers/digest-queue/dynamodb-digest-queue.test.ts @@ -107,6 +107,48 @@ describe("initDynamoDbDigestQueue", () => { }); }); + describe("deleteDigestByUser", () => { + it("pages the user partition and deletes every row by its (userId, url) key", async () => { + const { client, commands } = createFakeClient({ + queryPages: [ + { + Items: [ + { userId: USER, url: "example.com/a", originalUrl: "https://example.com/a", enqueuedAt: "t1" }, + ], + LastEvaluatedKey: { userId: USER, url: "example.com/a" }, + }, + { + Items: [ + { userId: USER, url: "example.com/b", originalUrl: "https://example.com/b", enqueuedAt: "t2" }, + ], + }, + ], + }); + + await initQueue(client).deleteDigestByUser(USER); + + const queries = commands.filter((c) => c.name === "QueryCommand"); + expect(queries).toHaveLength(2); + expect(queries[0]?.input.KeyConditionExpression).toBe("userId = :userId"); + expect((queries[0]?.input.ExpressionAttributeValues as Record)[":userId"]).toBe(USER); + expect(queries[1]?.input.ExclusiveStartKey).toEqual({ userId: USER, url: "example.com/a" }); + + const deletes = commands.filter((c) => c.name === "DeleteCommand"); + expect(deletes.map((d) => d.input.Key)).toEqual([ + { userId: USER, url: "example.com/a" }, + { userId: USER, url: "example.com/b" }, + ]); + }); + + it("issues no deletes when the user has no queued rows", async () => { + const { client, commands } = createFakeClient({}); + + await initQueue(client).deleteDigestByUser(USER); + + expect(commands.some((c) => c.name === "DeleteCommand")).toBe(false); + }); + }); + describe("scanPendingDigestUsers", () => { it("scans every page and returns each distinct userId once", async () => { const other = UserIdSchema.parse("user-2"); diff --git a/projects/hutch/src/runtime/providers/digest-queue/dynamodb-digest-queue.ts b/projects/hutch/src/runtime/providers/digest-queue/dynamodb-digest-queue.ts index 0d598fd87..b69aff37a 100644 --- a/projects/hutch/src/runtime/providers/digest-queue/dynamodb-digest-queue.ts +++ b/projects/hutch/src/runtime/providers/digest-queue/dynamodb-digest-queue.ts @@ -2,12 +2,14 @@ import { type DynamoDBDocumentClient, defineDynamoTable, dynamoField, + forEachQueryPage, } from "@packages/hutch-storage-client"; import { z } from "zod"; import { UserIdSchema } from "@packages/domain/user"; import type { UserId } from "@packages/domain/user"; import { ArticleResourceUniqueId } from "@packages/article-resource-unique-id"; import type { + DeleteDigestByUser, DeleteDigestItem, DigestQueueItem, EnqueueDigestItem, @@ -35,6 +37,7 @@ export function initDynamoDbDigestQueue(deps: { enqueueDigestItem: EnqueueDigestItem; listDigestItemsByUser: ListDigestItemsByUser; deleteDigestItem: DeleteDigestItem; + deleteDigestByUser: DeleteDigestByUser; scanPendingDigestUsers: ScanPendingDigestUsers; } { const table = defineDynamoTable({ @@ -84,6 +87,21 @@ export function initDynamoDbDigestQueue(deps: { await table.delete({ Key: { userId, url } }); }; + const deleteDigestByUser: DeleteDigestByUser = async (userId) => { + await forEachQueryPage( + table, + { + KeyConditionExpression: "userId = :userId", + ExpressionAttributeValues: { ":userId": userId }, + }, + async (rows) => { + await Promise.all( + rows.map((row) => table.delete({ Key: { userId: row.userId, url: row.url } })), + ); + }, + ); + }; + const scanPendingDigestUsers: ScanPendingDigestUsers = async () => { const users = new Set(); let exclusiveStartKey: Record | undefined; @@ -99,5 +117,5 @@ export function initDynamoDbDigestQueue(deps: { return [...users]; }; - return { enqueueDigestItem, listDigestItemsByUser, deleteDigestItem, scanPendingDigestUsers }; + return { enqueueDigestItem, listDigestItemsByUser, deleteDigestItem, deleteDigestByUser, scanPendingDigestUsers }; } diff --git a/projects/hutch/src/runtime/providers/events/eventbridge-delete-account-command.ts b/projects/hutch/src/runtime/providers/events/eventbridge-delete-account-command.ts new file mode 100644 index 000000000..e14f42703 --- /dev/null +++ b/projects/hutch/src/runtime/providers/events/eventbridge-delete-account-command.ts @@ -0,0 +1,14 @@ +/* c8 ignore start -- thin SDK wrapper, only used in prod path */ +import type { PublishEvent } from "@packages/hutch-infra-components/runtime"; +import { DeleteAccountCommand } from "@packages/hutch-infra-components"; +import type { PublishDeleteAccountCommand } from "@packages/provider-contracts/events"; + +export function initEventBridgeDeleteAccountCommand(deps: { + publishEvent: PublishEvent; +}): { publishDeleteAccountCommand: PublishDeleteAccountCommand } { + return { + publishDeleteAccountCommand: (params) => + deps.publishEvent(DeleteAccountCommand, params), + }; +} +/* c8 ignore stop */ diff --git a/projects/hutch/src/runtime/providers/inbox-address/dynamodb-inbox-address.test.ts b/projects/hutch/src/runtime/providers/inbox-address/dynamodb-inbox-address.test.ts index 3f020526f..54ab64604 100644 --- a/projects/hutch/src/runtime/providers/inbox-address/dynamodb-inbox-address.test.ts +++ b/projects/hutch/src/runtime/providers/inbox-address/dynamodb-inbox-address.test.ts @@ -5,6 +5,7 @@ import { } from "@packages/hutch-storage-client"; import { AliasNameSchema, + DELETED_ACCOUNT_INBOX_OWNER, INBOX_ADDRESS_MAX_PER_USER, InboxAddressLimitReachedError, InboxAddressSchema, @@ -31,6 +32,7 @@ interface CapturedCommand { ConditionExpression?: string; UpdateExpression?: string; ExpressionAttributeValues?: Record; + ExpressionAttributeNames?: Record; }; } @@ -299,4 +301,77 @@ describe("initDynamoDbInboxAddress", () => { expect(await store.findByAddress(address)).toBeUndefined(); }); }); + + describe("tombstoneUserAddresses", () => { + it("reassigns each owned address to the sentinel owner, stripping the alias and stamping disabledAt, keeping every row", async () => { + const commands: CapturedCommand[] = []; + const store = initDynamoDbInboxAddress({ + client: createFakeClient((cmd) => { + const command = cmd as CapturedCommand; + commands.push(command); + if (command.input.IndexName) { + return { + Items: [ + { + address: "news-aaaaaa@read.place", + userId: "user-1", + name: "news", + token: "aaaaaa", + createdAt: "2026-06-20T00:00:00.000Z", + disabledAt: null, + }, + { + address: "news-bbbbbb@read.place", + userId: "user-1", + name: "news", + token: "bbbbbb", + createdAt: "2026-06-20T00:00:00.000Z", + disabledAt: "2026-06-21T00:00:00.000Z", + }, + ], + Count: 2, + }; + } + return {}; + }) as DynamoDBDocumentClient, + tableName: TABLE, + now: () => NOW, + }); + + await store.tombstoneUserAddresses(USER); + + const updates = commands.filter((c) => c.input.UpdateExpression); + expect(updates).toHaveLength(2); + for (const update of updates) { + expect(update.input.UpdateExpression).toBe( + "SET userId = :tomb, disabledAt = if_not_exists(disabledAt, :now) REMOVE #name", + ); + expect(update.input.ConditionExpression).toBe("userId = :uid"); + expect(update.input.ExpressionAttributeNames).toEqual({ "#name": "name" }); + expect(update.input.ExpressionAttributeValues?.[":tomb"]).toBe(DELETED_ACCOUNT_INBOX_OWNER); + expect(update.input.ExpressionAttributeValues?.[":uid"]).toBe(USER); + expect(update.input.ExpressionAttributeValues?.[":now"]).toBe(NOW.toISOString()); + } + expect(updates.map((u) => u.input.Key)).toEqual([ + { address: "news-aaaaaa@read.place" }, + { address: "news-bbbbbb@read.place" }, + ]); + }); + + it("issues no update when the user owns no addresses", async () => { + const commands: CapturedCommand[] = []; + const store = initDynamoDbInboxAddress({ + client: createFakeClient((cmd) => { + commands.push(cmd as CapturedCommand); + return { Items: [], Count: 0 }; + }) as DynamoDBDocumentClient, + tableName: TABLE, + now: () => NOW, + }); + + await store.tombstoneUserAddresses(USER); + + expect(commands.some((c) => c.input.UpdateExpression)).toBe(false); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/inbox-address/dynamodb-inbox-address.ts b/projects/hutch/src/runtime/providers/inbox-address/dynamodb-inbox-address.ts index 9cf379740..caeebbf92 100644 --- a/projects/hutch/src/runtime/providers/inbox-address/dynamodb-inbox-address.ts +++ b/projects/hutch/src/runtime/providers/inbox-address/dynamodb-inbox-address.ts @@ -11,6 +11,7 @@ import { AliasNameSchema, buildInboxAddress, countLiveAddresses, + DELETED_ACCOUNT_INBOX_OWNER, generateInboxToken, INBOX_ADDRESS_MAX_CREATE_ATTEMPTS, INBOX_ADDRESS_MAX_PER_USER, @@ -19,6 +20,7 @@ import { InboxAddressSchema, type InboxAddressStore, InboxTokenSchema, + type TombstoneUserAddresses, } from "@packages/domain/inbox"; const InboxAddressRow = z.object({ @@ -75,6 +77,26 @@ export function initDynamoDbInboxAddress(deps: { return items.map(toEntry); }; + const tombstoneUserAddresses: TombstoneUserAddresses = async (userId) => { + const addresses = await listAddressesByUserId(userId); + await Promise.all( + addresses.map((entry) => + table.update({ + Key: { address: entry.address }, + UpdateExpression: + "SET userId = :tomb, disabledAt = if_not_exists(disabledAt, :now) REMOVE #name", + ConditionExpression: "userId = :uid", + ExpressionAttributeNames: { "#name": "name" }, + ExpressionAttributeValues: { + ":tomb": DELETED_ACCOUNT_INBOX_OWNER, + ":uid": userId, + ":now": deps.now().toISOString(), + }, + }), + ), + ); + }; + return { createAddress: async ({ userId, domain, name }) => { // Bound the live addresses a user can hold. disabledAt is not a key @@ -119,5 +141,6 @@ export function initDynamoDbInboxAddress(deps: { const row = await table.get({ address }); return row === undefined ? undefined : toEntry(row); }, + tombstoneUserAddresses, }; } diff --git a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email-link.test.ts b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email-link.test.ts index 80bb9765c..2104b5d5c 100644 --- a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email-link.test.ts +++ b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email-link.test.ts @@ -15,6 +15,46 @@ function createFakeClient(impl: (input: unknown) => unknown): Partial; +} + +/** Records commands by SDK class name and replays a sequence of query pages, + * each carrying its rows and the LastEvaluatedKey that drives the next page + * (omitted on the final page). Queries past the last page replay it. */ +function createPaginatedClient( + pages: { rows: Record[]; lastEvaluatedKey?: Record }[], +): { client: DynamoDBDocumentClient; commands: RecordedCommand[] } { + const commands: RecordedCommand[] = []; + let queryCount = 0; + const client = { + send: (async (command: { constructor: { name: string }; input: Record }) => { + const name = command.constructor.name; + commands.push({ name, input: command.input }); + if (name === "QueryCommand") { + const page = pages[Math.min(queryCount, pages.length - 1)]; + queryCount += 1; + return { Items: page.rows, Count: page.rows.length, LastEvaluatedKey: page.lastEvaluatedKey }; + } + return {}; + }) as SendFn, + }; + return { client: client as typeof client & DynamoDBDocumentClient, commands }; +} + +function linkRow(overrides: Record = {}): Record { + return { + userLinkGroup: GROUP, + ordinal: "0000", + userId: USER, + receivedAtMessageId: RAM, + url: "https://a.test", + status: "pending", + ...overrides, + }; +} + interface CapturedCommand { input: { Item?: Record; @@ -294,4 +334,74 @@ describe("initDynamoDbInboxEmailLink", () => { expect(found).toBeUndefined(); }); }); + + describe("deleteLinksByEmail", () => { + it("queries the email's partition and deletes every link row and the meta row", async () => { + const { client, commands } = createPaginatedClient([ + { + rows: [ + linkRow({ ordinal: "0000" }), + linkRow({ ordinal: "0001", url: "https://b.test" }), + { userLinkGroup: GROUP, ordinal: "meta", userId: USER, receivedAtMessageId: RAM, truncated: true }, + ], + }, + ]); + const store = initDynamoDbInboxEmailLink({ client, tableName: TABLE }); + + await store.deleteLinksByEmail({ userId: USER, receivedAtMessageId: RAM }); + + const query = commands.find((c) => c.name === "QueryCommand"); + expect(query?.input.KeyConditionExpression).toBe("userLinkGroup = :g"); + expect(query?.input.ExpressionAttributeValues).toEqual({ ":g": GROUP }); + const deletes = commands.filter((c) => c.name === "DeleteCommand"); + expect(deletes.map((c) => c.input.Key)).toEqual([ + { userLinkGroup: GROUP, ordinal: "0000" }, + { userLinkGroup: GROUP, ordinal: "0001" }, + { userLinkGroup: GROUP, ordinal: "meta" }, + ]); + }); + + it("paginates the partition, feeding each page's key back as ExclusiveStartKey", async () => { + const { client, commands } = createPaginatedClient([ + { rows: [linkRow({ ordinal: "0000" })], lastEvaluatedKey: { userLinkGroup: GROUP, ordinal: "0000" } }, + { rows: [linkRow({ ordinal: "0001" })] }, + ]); + const store = initDynamoDbInboxEmailLink({ client, tableName: TABLE }); + + await store.deleteLinksByEmail({ userId: USER, receivedAtMessageId: RAM }); + + const queries = commands.filter((c) => c.name === "QueryCommand"); + expect(queries).toHaveLength(2); + expect(queries[1]?.input.ExclusiveStartKey).toEqual({ userLinkGroup: GROUP, ordinal: "0000" }); + expect(commands.filter((c) => c.name === "DeleteCommand")).toHaveLength(2); + }); + }); + + describe("deleteAllLinksByUserId", () => { + it("loops deleteLinksByEmail across every provided email id", async () => { + const ramA = "2026-06-23T00:00:00.000Z#"; + const ramB = "2026-06-24T00:00:00.000Z#"; + const { client, commands } = createPaginatedClient([{ rows: [linkRow({ ordinal: "0000" })] }]); + const store = initDynamoDbInboxEmailLink({ client, tableName: TABLE }); + + await store.deleteAllLinksByUserId(USER, [ramA, ramB]); + + const queries = commands.filter((c) => c.name === "QueryCommand"); + expect(queries.map((q) => q.input.ExpressionAttributeValues)).toEqual([ + { ":g": `${USER}#${ramA}` }, + { ":g": `${USER}#${ramB}` }, + ]); + // One page (hence one delete) replayed per email id. + expect(commands.filter((c) => c.name === "DeleteCommand")).toHaveLength(2); + }); + + it("issues no query or delete when the id list is empty", async () => { + const { client, commands } = createPaginatedClient([{ rows: [] }]); + const store = initDynamoDbInboxEmailLink({ client, tableName: TABLE }); + + await store.deleteAllLinksByUserId(USER, []); + + expect(commands).toHaveLength(0); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email-link.ts b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email-link.ts index 5be4fd134..e34a270f2 100644 --- a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email-link.ts +++ b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email-link.ts @@ -4,6 +4,7 @@ import { type DynamoDBDocumentClient, defineDynamoTable, dynamoField, + forEachQueryPage, } from "@packages/hutch-storage-client"; import { z } from "zod"; import { @@ -75,6 +76,27 @@ export function initDynamoDbInboxEmailLink(deps: { schema: InboxEmailLinkRow, }); + const deleteLinksByEmail: InboxEmailLinkStore["deleteLinksByEmail"] = async ({ + userId, + receivedAtMessageId, + }) => { + const group = groupKey({ userId, receivedAtMessageId }); + await forEachQueryPage( + table, + { + KeyConditionExpression: "userLinkGroup = :g", + ExpressionAttributeValues: { ":g": group }, + }, + async (rows) => { + await Promise.all( + rows.map((row) => + table.delete({ Key: { userLinkGroup: row.userLinkGroup, ordinal: row.ordinal } }), + ), + ); + }, + ); + }; + return { putLink: async (link) => { // A pending link carries no preview fields; the document client does not @@ -184,5 +206,11 @@ export function initDynamoDbInboxEmailLink(deps: { if (row === undefined) return undefined; return toEntry(row); }, + deleteLinksByEmail, + deleteAllLinksByUserId: async (userId, receivedAtMessageIds) => { + for (const receivedAtMessageId of receivedAtMessageIds) { + await deleteLinksByEmail({ userId, receivedAtMessageId }); + } + }, }; } diff --git a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.test.ts b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.test.ts index 88f1f3c86..8cc5cafbe 100644 --- a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.test.ts +++ b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.test.ts @@ -19,6 +19,50 @@ function createFakeClient(impl: (input: unknown) => unknown): Partial; +} + +/** Records commands by SDK class name and replays a sequence of query pages, + * each carrying its rows and the LastEvaluatedKey that drives the next page + * (omitted on the final page). Queries past the last page replay it. */ +function createPaginatedClient( + pages: { rows: Record[]; lastEvaluatedKey?: Record }[], +): { client: DynamoDBDocumentClient; commands: RecordedCommand[] } { + const commands: RecordedCommand[] = []; + let queryCount = 0; + const client = { + send: (async (command: { constructor: { name: string }; input: Record }) => { + const name = command.constructor.name; + commands.push({ name, input: command.input }); + if (name === "QueryCommand") { + const page = pages[Math.min(queryCount, pages.length - 1)]; + queryCount += 1; + return { Items: page.rows, Count: page.rows.length, LastEvaluatedKey: page.lastEvaluatedKey }; + } + return {}; + }) as SendFn, + }; + return { client: client as typeof client & DynamoDBDocumentClient, commands }; +} + +function emailRow(overrides: Record = {}): Record { + return { + userId: "user-1", + receivedAtMessageId: "2026-06-23T00:00:00.000Z#", + messageId: "", + recipientAddress: "in-3f9a2c@read.place", + senderEmail: "news@example.com", + subject: "Weekly digest", + status: "received", + receivedAt: "2026-06-23T00:00:00.000Z", + rawEmailS3Key: "inbound/m-1", + bodyS3Key: "content/m-1/content.html", + ...overrides, + }; +} + interface CapturedCommand { input: { Item?: Record; @@ -221,4 +265,88 @@ describe("initDynamoDbInboxEmail", () => { ).toBeUndefined(); }); }); + + describe("deleteAllEmailsByUserId", () => { + it("drains the user's emails, returning raw and body keys and deleting each row", async () => { + const { client, commands } = createPaginatedClient([ + { + rows: [ + emailRow({ + receivedAtMessageId: "2026-06-23T09:00:00.000Z#", + rawEmailS3Key: "inbound/a", + bodyS3Key: "content/a/content.html", + }), + emailRow({ + receivedAtMessageId: "2026-06-23T08:00:00.000Z#", + status: "rejected", + rawEmailS3Key: "inbound/b", + // A rejected row renders no body, so DynamoDB returns null here, + // which the row schema normalizes to undefined. + bodyS3Key: null, + }), + ], + }, + ]); + const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); + + const result = await store.deleteAllEmailsByUserId(USER); + + expect(result.receivedAtMessageIds).toEqual([ + "2026-06-23T09:00:00.000Z#", + "2026-06-23T08:00:00.000Z#", + ]); + expect(result.rawEmailS3Keys).toEqual(["inbound/a", "inbound/b"]); + expect(result.bodyS3Keys).toEqual(["content/a/content.html"]); + const query = commands.find((c) => c.name === "QueryCommand"); + expect(query?.input.KeyConditionExpression).toBe("userId = :uid"); + expect(query?.input.ExpressionAttributeValues).toEqual({ ":uid": USER }); + const deletes = commands.filter((c) => c.name === "DeleteCommand"); + expect(deletes.map((c) => c.input.Key)).toEqual([ + { userId: USER, receivedAtMessageId: "2026-06-23T09:00:00.000Z#" }, + { userId: USER, receivedAtMessageId: "2026-06-23T08:00:00.000Z#" }, + ]); + }); + + it("paginates the query, feeding each page's key back as ExclusiveStartKey", async () => { + const { client, commands } = createPaginatedClient([ + { + rows: [ + emailRow({ receivedAtMessageId: "r1", rawEmailS3Key: "inbound/1", bodyS3Key: null }), + ], + lastEvaluatedKey: { userId: "user-1", receivedAtMessageId: "r1" }, + }, + { + rows: [ + emailRow({ receivedAtMessageId: "r2", rawEmailS3Key: "inbound/2", bodyS3Key: null }), + ], + }, + ]); + const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); + + const result = await store.deleteAllEmailsByUserId(USER); + + const queries = commands.filter((c) => c.name === "QueryCommand"); + expect(queries).toHaveLength(2); + expect(queries[0]?.input.ExclusiveStartKey).toBeUndefined(); + expect(queries[1]?.input.ExclusiveStartKey).toEqual({ + userId: "user-1", + receivedAtMessageId: "r1", + }); + expect(result.rawEmailS3Keys).toEqual(["inbound/1", "inbound/2"]); + expect(result.bodyS3Keys).toEqual([]); + expect(commands.filter((c) => c.name === "DeleteCommand")).toHaveLength(2); + }); + + it("returns empty key lists and issues no delete when the user has no emails", async () => { + const { client, commands } = createPaginatedClient([{ rows: [] }]); + const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); + + expect(await store.deleteAllEmailsByUserId(USER)).toEqual({ + receivedAtMessageIds: [], + rawEmailS3Keys: [], + bodyS3Keys: [], + }); + expect(commands.some((c) => c.name === "DeleteCommand")).toBe(false); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.ts b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.ts index d1b2ec516..de8efb675 100644 --- a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.ts +++ b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.ts @@ -3,6 +3,7 @@ import { type DynamoDBDocumentClient, defineDynamoTable, dynamoField, + forEachQueryPage, } from "@packages/hutch-storage-client"; import { z } from "zod"; import { @@ -64,5 +65,32 @@ export function initDynamoDbInboxEmail(deps: { }, getEmail: async ({ userId, receivedAtMessageId }) => table.get({ userId, receivedAtMessageId }), + deleteAllEmailsByUserId: async (userId) => { + const receivedAtMessageIds: string[] = []; + const rawEmailS3Keys: string[] = []; + const bodyS3Keys: string[] = []; + await forEachQueryPage( + table, + { + KeyConditionExpression: "userId = :uid", + ExpressionAttributeValues: { ":uid": userId }, + }, + async (rows) => { + for (const row of rows) { + receivedAtMessageIds.push(row.receivedAtMessageId); + rawEmailS3Keys.push(row.rawEmailS3Key); + if (row.bodyS3Key !== undefined) bodyS3Keys.push(row.bodyS3Key); + } + await Promise.all( + rows.map((row) => + table.delete({ + Key: { userId, receivedAtMessageId: row.receivedAtMessageId }, + }), + ), + ); + }, + ); + return { receivedAtMessageIds, rawEmailS3Keys, bodyS3Keys }; + }, }; } diff --git a/projects/hutch/src/runtime/providers/inbox-email/s3-delete-objects.test.ts b/projects/hutch/src/runtime/providers/inbox-email/s3-delete-objects.test.ts new file mode 100644 index 000000000..1ea6f5211 --- /dev/null +++ b/projects/hutch/src/runtime/providers/inbox-email/s3-delete-objects.test.ts @@ -0,0 +1,61 @@ +import type { S3Client } from "@aws-sdk/client-s3"; +import { initS3DeleteObjects } from "./s3-delete-objects"; + +type SendFn = S3Client["send"]; + +interface CapturedCommand { + input: { Bucket?: string; Delete?: { Objects?: { Key?: string }[] } }; +} + +function recordingClient(): { + client: Pick; + commands: CapturedCommand[]; +} { + const commands: CapturedCommand[] = []; + return { + client: { + send: (async (cmd: unknown) => { + commands.push(cmd as CapturedCommand); + return {}; + }) as unknown as SendFn, + }, + commands, + }; +} + +describe("initS3DeleteObjects", () => { + it("issues no request when there are no keys", async () => { + const { client, commands } = recordingClient(); + const del = initS3DeleteObjects({ client, bucketName: "raw-bucket" }); + + await del([]); + + expect(commands).toHaveLength(0); + }); + + it("deletes a batch of keys in one request against the target bucket", async () => { + const { client, commands } = recordingClient(); + const del = initS3DeleteObjects({ client, bucketName: "raw-bucket" }); + + await del(["inbound/a", "inbound/b"]); + + expect(commands).toHaveLength(1); + expect(commands[0].input.Bucket).toBe("raw-bucket"); + expect(commands[0].input.Delete?.Objects).toEqual([ + { Key: "inbound/a" }, + { Key: "inbound/b" }, + ]); + }); + + it("splits into requests of at most 1000 keys", async () => { + const { client, commands } = recordingClient(); + const del = initS3DeleteObjects({ client, bucketName: "content-bucket" }); + const keys = Array.from({ length: 1001 }, (_, i) => `content/${i}`); + + await del(keys); + + expect(commands).toHaveLength(2); + expect(commands[0].input.Delete?.Objects).toHaveLength(1000); + expect(commands[1].input.Delete?.Objects).toEqual([{ Key: "content/1000" }]); + }); +}); diff --git a/projects/hutch/src/runtime/providers/inbox-email/s3-delete-objects.ts b/projects/hutch/src/runtime/providers/inbox-email/s3-delete-objects.ts new file mode 100644 index 000000000..ec45f6faf --- /dev/null +++ b/projects/hutch/src/runtime/providers/inbox-email/s3-delete-objects.ts @@ -0,0 +1,23 @@ +import { DeleteObjectsCommand, type S3Client } from "@aws-sdk/client-s3"; + +/** DeleteObjects accepts at most 1000 keys per request. */ +const DELETE_OBJECTS_MAX_KEYS = 1000; + +export function initS3DeleteObjects(deps: { + client: Pick; + bucketName: string; +}): (keys: string[]) => Promise { + return async (keys) => { + // An empty key list issues no request — an empty DeleteObjects call is a + // pointless round-trip and S3 rejects a zero-length Objects list. + for (let i = 0; i < keys.length; i += DELETE_OBJECTS_MAX_KEYS) { + const batch = keys.slice(i, i + DELETE_OBJECTS_MAX_KEYS); + await deps.client.send( + new DeleteObjectsCommand({ + Bucket: deps.bucketName, + Delete: { Objects: batch.map((Key) => ({ Key })) }, + }), + ); + } + }; +} diff --git a/projects/hutch/src/runtime/providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal.test.ts b/projects/hutch/src/runtime/providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal.test.ts index a0eab04fe..ea82fb974 100644 --- a/projects/hutch/src/runtime/providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal.test.ts +++ b/projects/hutch/src/runtime/providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal.test.ts @@ -103,4 +103,15 @@ describe("initIosOnboardingSignal", () => { expect(signals).toEqual({ installed: true, savedArticle: true }); }); }); + + describe("deleteOnboarding", () => { + it("deletes the single onboarding row by the userId PK", async () => { + const { client, commands } = createFakeClient({}); + + await initSignal(client).deleteOnboarding({ userId: USER }); + + const del = commands.find((c) => c.name === "DeleteCommand"); + expect(del?.input.Key).toEqual({ userId: "user-1" }); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal.ts b/projects/hutch/src/runtime/providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal.ts index 31b146cdb..5365c12a5 100644 --- a/projects/hutch/src/runtime/providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal.ts +++ b/projects/hutch/src/runtime/providers/ios-onboarding-signal/dynamodb-ios-onboarding-signal.ts @@ -6,6 +6,7 @@ import { import { z } from "zod"; import { UserIdSchema } from "@packages/domain/user"; import type { + DeleteOnboarding, GetIosAppSignals, RecordIosAnyActivity, RecordIosSavedArticle, @@ -32,6 +33,7 @@ export function initIosOnboardingSignal(deps: { recordIosAnyActivity: RecordIosAnyActivity; recordIosSavedArticle: RecordIosSavedArticle; getIosAppSignals: GetIosAppSignals; + deleteOnboarding: DeleteOnboarding; } { const onboarding = defineDynamoTable({ client: deps.client, @@ -61,5 +63,9 @@ export function initIosOnboardingSignal(deps: { return { installed: !!row?.iosAppActivatedAt, savedArticle: !!row?.iosAppSavedAt }; }; - return { recordIosAnyActivity, recordIosSavedArticle, getIosAppSignals }; + const deleteOnboarding: DeleteOnboarding = async ({ userId }) => { + await onboarding.delete({ Key: { userId } }); + }; + + return { recordIosAnyActivity, recordIosSavedArticle, getIosAppSignals, deleteOnboarding }; } diff --git a/projects/hutch/src/runtime/providers/oauth/dynamodb-oauth-model.ts b/projects/hutch/src/runtime/providers/oauth/dynamodb-oauth-model.ts index 41155d4c5..9a55f58a0 100644 --- a/projects/hutch/src/runtime/providers/oauth/dynamodb-oauth-model.ts +++ b/projects/hutch/src/runtime/providers/oauth/dynamodb-oauth-model.ts @@ -3,6 +3,7 @@ import assert from "node:assert"; import { type DynamoDBDocumentClient, defineDynamoTable, + forEachQueryPage, } from "@packages/hutch-storage-client"; import { z } from "zod"; import type { @@ -18,6 +19,7 @@ import type { FindOAuthClient, MarkOAuthClientActive, OAuthModel, + RevokeAllUserOAuthTokens, } from "@packages/provider-contracts/oauth"; import type { FindUserById } from "@packages/provider-contracts/auth"; import { generateToken } from "@packages/domain/oauth"; @@ -55,17 +57,63 @@ const RefreshIndexRow = z.object({ accessToken: z.string(), }); +/** Bulk-revoke every OAuth grant a user holds (account deletion + logout-all). + * Needs only the table — the delete worker reuses it without wiring the full + * OAuth2 model. The userId-index projects both token# and code# rows, so query + * it through a permissive schema and branch on the pk prefix; refresh# rows + * carry no userId and are reached via each token row's refreshToken. */ +export function initRevokeAllUserOAuthTokens(deps: { + client: DynamoDBDocumentClient; + tableName: string; +}): RevokeAllUserOAuthTokens { + const { client, tableName } = deps; + const authCodes = defineDynamoTable({ client, tableName, schema: AuthCodeRow }); + const tokens = defineDynamoTable({ client, tableName, schema: TokenRow }); + const refreshIndex = defineDynamoTable({ client, tableName, schema: RefreshIndexRow }); + const byUser = defineDynamoTable({ + client, + tableName, + schema: z.object({ pk: z.string(), userId: z.string(), refreshToken: z.string().optional() }), + }); + + return async (userId) => { + await forEachQueryPage( + byUser, + { + IndexName: "userId-index", + KeyConditionExpression: "userId = :userId", + ExpressionAttributeValues: { ":userId": userId }, + }, + async (rows) => { + await Promise.all( + rows.map(async (row) => { + if (row.pk.startsWith("token#")) { + await tokens.delete({ Key: { pk: row.pk } }); + if (row.refreshToken) { + await refreshIndex.delete({ Key: { pk: `refresh#${row.refreshToken}` } }); + } + } else if (row.pk.startsWith("code#")) { + await authCodes.delete({ Key: { pk: row.pk } }); + } + }), + ); + }, + ); + }; +} + export function initDynamoDbOAuthModel(deps: { client: DynamoDBDocumentClient; tableName: string; findUserById: FindUserById; findClient: FindOAuthClient; markClientActive: MarkOAuthClientActive; -}): OAuthModel { +}): OAuthModel & { revokeAllUserOAuthTokens: RevokeAllUserOAuthTokens } { const { client, tableName, findUserById, findClient, markClientActive } = deps; const authCodes = defineDynamoTable({ client, tableName, schema: AuthCodeRow }); const tokens = defineDynamoTable({ client, tableName, schema: TokenRow }); const refreshIndex = defineDynamoTable({ client, tableName, schema: RefreshIndexRow }); + const revokeAllUserOAuthTokens = initRevokeAllUserOAuthTokens({ client, tableName }); async function resolveClient(clientId: string): Promise { const found = await findClient(clientId); @@ -74,6 +122,7 @@ export function initDynamoDbOAuthModel(deps: { } return { + revokeAllUserOAuthTokens, async getClient(clientId: string, _clientSecret: string): Promise { return resolveClient(clientId); }, diff --git a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.test.ts b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.test.ts index ab364df05..1323e4dc2 100644 --- a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.test.ts +++ b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.test.ts @@ -30,6 +30,30 @@ function createFakeClient(opts: { return { client: client as typeof client & DynamoDBDocumentClient, commands }; } +interface ScanPage { + Items: Record[]; + LastEvaluatedKey?: Record; +} + +/** Replays a queue of Scan pages in order and records every command so the + * scan filter and the per-token deletes can be asserted. */ +function createScanClient(pages: ScanPage[]): { + client: DynamoDBDocumentClient; + commands: CapturedCommand[]; +} { + const commands: CapturedCommand[] = []; + let scanCall = 0; + const client = { + send: (async (command: { constructor: { name: string }; input: Record }) => { + const name = command.constructor.name; + commands.push({ name, input: command.input }); + if (name === "ScanCommand") return pages[scanCall++]; + return {}; + }) as DynamoDBDocumentClient["send"], + }; + return { client: client as typeof client & DynamoDBDocumentClient, commands }; +} + const TABLE = "password-reset-tokens"; function initStore(client: DynamoDBDocumentClient) { @@ -117,4 +141,44 @@ describe("initDynamoDbPasswordReset", () => { ); }); }); + + describe("deleteTokensByEmail", () => { + it("scans every page filtering by email and deletes each token by its primary key", async () => { + const { client, commands } = createScanClient([ + { + Items: [{ token: "aaa" }, { token: "bbb" }], + LastEvaluatedKey: { token: "bbb" }, + }, + { Items: [{ token: "ccc" }] }, + ]); + + await initStore(client).deleteTokensByEmail("user@example.com"); + + const scans = commands.filter((c) => c.name === "ScanCommand"); + expect(scans).toHaveLength(2); + expect(scans[0]?.input.TableName).toBe(TABLE); + expect(scans[0]?.input.FilterExpression).toBe("email = :e"); + expect(scans[0]?.input.ExpressionAttributeValues).toEqual({ ":e": "user@example.com" }); + expect(scans[0]?.input.ProjectionExpression).toBe("#tk"); + expect(scans[0]?.input.ExpressionAttributeNames).toEqual({ "#tk": "token" }); + expect(scans[0]?.input.ExclusiveStartKey).toBeUndefined(); + expect(scans[1]?.input.ExclusiveStartKey).toEqual({ token: "bbb" }); + + const deletes = commands.filter((c) => c.name === "DeleteCommand"); + expect(deletes.map((d) => d.input.Key)).toEqual([ + { token: "aaa" }, + { token: "bbb" }, + { token: "ccc" }, + ]); + }); + + it("issues no deletes when the email matches no tokens", async () => { + const { client, commands } = createScanClient([{ Items: [] }]); + + await initStore(client).deleteTokensByEmail("nobody@example.com"); + + expect(commands.filter((c) => c.name === "ScanCommand")).toHaveLength(1); + expect(commands.filter((c) => c.name === "DeleteCommand")).toHaveLength(0); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts index fa39cef1a..78c83b36f 100644 --- a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts +++ b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts @@ -8,6 +8,7 @@ import { import { z } from "zod"; import type { CreatePasswordResetToken, + DeletePasswordResetTokensByEmail, VerifyPasswordResetToken, } from "@packages/provider-contracts/password-reset"; import { PasswordResetTokenSchema } from "@packages/provider-contracts/password-reset"; @@ -20,12 +21,17 @@ const PasswordResetRow = z.object({ expiresAt: z.number(), }); +const TokenKeyRow = z.object({ + token: z.string(), +}); + export function initDynamoDbPasswordReset(deps: { client: DynamoDBDocumentClient; tableName: string; }): { createPasswordResetToken: CreatePasswordResetToken; verifyPasswordResetToken: VerifyPasswordResetToken; + deleteTokensByEmail: DeletePasswordResetTokensByEmail; } { const table = defineDynamoTable({ client: deps.client, @@ -33,6 +39,12 @@ export function initDynamoDbPasswordReset(deps: { schema: PasswordResetRow, }); + const tokenKeyTable = defineDynamoTable({ + client: deps.client, + tableName: deps.tableName, + schema: TokenKeyRow, + }); + const createPasswordResetToken: CreatePasswordResetToken = async ({ email }) => { const token = PasswordResetTokenSchema.parse(randomBytes(32).toString("hex")); const expiresAt = Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS; @@ -66,5 +78,22 @@ export function initDynamoDbPasswordReset(deps: { } }; - return { createPasswordResetToken, verifyPasswordResetToken }; + const deleteTokensByEmail: DeletePasswordResetTokensByEmail = async (email) => { + // This table carries no TTL attribute, so an unexpired reset token would + // outlive the deleted account unless every row for the email is purged now. + let ExclusiveStartKey: Record | undefined; + do { + const { items, lastEvaluatedKey } = await tokenKeyTable.scan({ + FilterExpression: "email = :e", + ExpressionAttributeValues: { ":e": email }, + ProjectionExpression: "#tk", + ExpressionAttributeNames: { "#tk": "token" }, + ExclusiveStartKey, + }); + for (const { token } of items) await table.delete({ Key: { token } }); + ExclusiveStartKey = lastEvaluatedKey; + } while (ExclusiveStartKey); + }; + + return { createPasswordResetToken, verifyPasswordResetToken, deleteTokensByEmail }; } diff --git a/projects/hutch/src/runtime/providers/reader-ready-state/dynamodb-reader-ready-state.test.ts b/projects/hutch/src/runtime/providers/reader-ready-state/dynamodb-reader-ready-state.test.ts index 48ae5d88d..bc16682d0 100644 --- a/projects/hutch/src/runtime/providers/reader-ready-state/dynamodb-reader-ready-state.test.ts +++ b/projects/hutch/src/runtime/providers/reader-ready-state/dynamodb-reader-ready-state.test.ts @@ -133,4 +133,15 @@ describe("initDynamoDbReaderReadyState", () => { ).rejects.toThrow("throttled"); }); }); + + describe("deleteReaderReadyState", () => { + it("deletes the single cooldown row by the userId PK", async () => { + const { client, commands } = createFakeClient({}); + + await initStore(client).deleteReaderReadyState(USER); + + const del = commands.find((c) => c.name === "DeleteCommand"); + expect(del?.input.Key).toEqual({ userId: USER }); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/reader-ready-state/dynamodb-reader-ready-state.ts b/projects/hutch/src/runtime/providers/reader-ready-state/dynamodb-reader-ready-state.ts index 096d6c0cd..43003d54c 100644 --- a/projects/hutch/src/runtime/providers/reader-ready-state/dynamodb-reader-ready-state.ts +++ b/projects/hutch/src/runtime/providers/reader-ready-state/dynamodb-reader-ready-state.ts @@ -8,6 +8,7 @@ import { z } from "zod"; import { UserIdSchema } from "@packages/domain/user"; import type { ClaimReaderReadyEmailSlot, + DeleteReaderReadyState, ReleaseReaderReadyEmailSlot, } from "@packages/provider-contracts/reader-ready-state"; @@ -24,6 +25,7 @@ export function initDynamoDbReaderReadyState(deps: { }): { claimReaderReadyEmailSlot: ClaimReaderReadyEmailSlot; releaseReaderReadyEmailSlot: ReleaseReaderReadyEmailSlot; + deleteReaderReadyState: DeleteReaderReadyState; } { const table = defineDynamoTable({ client: deps.client, @@ -65,5 +67,9 @@ export function initDynamoDbReaderReadyState(deps: { } }; - return { claimReaderReadyEmailSlot, releaseReaderReadyEmailSlot }; + const deleteReaderReadyState: DeleteReaderReadyState = async (userId) => { + await table.delete({ Key: { userId } }); + }; + + return { claimReaderReadyEmailSlot, releaseReaderReadyEmailSlot, deleteReaderReadyState }; } diff --git a/projects/hutch/src/runtime/providers/stripe-subscriptions/stripe-subscriptions.test.ts b/projects/hutch/src/runtime/providers/stripe-subscriptions/stripe-subscriptions.test.ts index cb71fcb67..aab5ef2ae 100644 --- a/projects/hutch/src/runtime/providers/stripe-subscriptions/stripe-subscriptions.test.ts +++ b/projects/hutch/src/runtime/providers/stripe-subscriptions/stripe-subscriptions.test.ts @@ -325,4 +325,76 @@ describe("initStripeSubscriptions", () => { ); }); }); + + describe("deleteCustomer", () => { + it("issues DELETE /v1/customers/ with the bearer token", async () => { + let receivedUrl: string | undefined; + let receivedInit: RequestInit | undefined; + const fakeFetch: typeof globalThis.fetch = async (input, init) => { + receivedUrl = typeof input === "string" ? input : input.toString(); + receivedInit = init; + return jsonResponse(200, { id: "cus_to_delete", deleted: true }); + }; + + const stripe = initStripeSubscriptions({ apiKey: "sk_test_abc", fetch: fakeFetch }); + + await stripe.deleteCustomer({ customerId: "cus_to_delete" }); + + assert.equal(receivedUrl, "https://api.stripe.com/v1/customers/cus_to_delete"); + assert.equal(receivedInit?.method, "DELETE"); + const headers = new Headers(receivedInit?.headers); + assert.equal(headers.get("Authorization"), "Bearer sk_test_abc"); + assert.equal(headers.get("Stripe-Version"), "2026-04-22.dahlia"); + }); + + it("URL-encodes the customer id so unusual characters reach Stripe intact", async () => { + let receivedUrl: string | undefined; + const fakeFetch: typeof globalThis.fetch = async (input) => { + receivedUrl = typeof input === "string" ? input : input.toString(); + return jsonResponse(200, {}); + }; + + const stripe = initStripeSubscriptions({ apiKey: "sk_test_abc", fetch: fakeFetch }); + + await stripe.deleteCustomer({ customerId: "cus with/slash" }); + + assert.equal( + receivedUrl, + "https://api.stripe.com/v1/customers/cus%20with%2Fslash", + ); + }); + + it("treats 404 as success — the customer is already gone, which is the goal state", async () => { + const fakeFetch: typeof globalThis.fetch = async () => + jsonResponse(404, { error: { code: "resource_missing", message: "No such customer" } }); + + const stripe = initStripeSubscriptions({ apiKey: "sk_test_abc", fetch: fakeFetch }); + + await stripe.deleteCustomer({ customerId: "cus_gone" }); + }); + + it("throws with the Stripe error message when the API returns a non-2xx other than 404", async () => { + const fakeFetch: typeof globalThis.fetch = async () => + jsonResponse(500, { error: { code: "api_error", message: "Stripe is down" } }); + + const stripe = initStripeSubscriptions({ apiKey: "sk_test_abc", fetch: fakeFetch }); + + await assert.rejects( + () => stripe.deleteCustomer({ customerId: "cus_kaboom" }), + /Stripe deleteCustomer failed \(500\): Stripe is down/, + ); + }); + + it("falls back to a generic error message when the Stripe error shape is unrecognised", async () => { + const fakeFetch: typeof globalThis.fetch = async () => + jsonResponse(503, { unexpected: "shape" }); + + const stripe = initStripeSubscriptions({ apiKey: "sk_test_abc", fetch: fakeFetch }); + + await assert.rejects( + () => stripe.deleteCustomer({ customerId: "cus_x" }), + /Stripe deleteCustomer failed \(503\): Stripe error/, + ); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/stripe-subscriptions/stripe-subscriptions.ts b/projects/hutch/src/runtime/providers/stripe-subscriptions/stripe-subscriptions.ts index 53a102cea..90da48689 100644 --- a/projects/hutch/src/runtime/providers/stripe-subscriptions/stripe-subscriptions.ts +++ b/projects/hutch/src/runtime/providers/stripe-subscriptions/stripe-subscriptions.ts @@ -2,6 +2,7 @@ import { z } from "zod"; import type { CancelSubscriptionImmediately, CreateSubscriptionOnExistingCustomer, + DeleteCustomer, ReverseScheduledCancellation, ScheduleCancellationAtPeriodEnd, } from "@packages/provider-contracts/stripe-subscriptions"; @@ -43,6 +44,7 @@ export function initStripeSubscriptions(deps: { createSubscriptionOnExistingCustomer: CreateSubscriptionOnExistingCustomer; scheduleCancellationAtPeriodEnd: ScheduleCancellationAtPeriodEnd; reverseScheduledCancellation: ReverseScheduledCancellation; + deleteCustomer: DeleteCustomer; } { const stripeHeaders = { Authorization: `Bearer ${deps.apiKey}`, @@ -176,10 +178,33 @@ export function initStripeSubscriptions(deps: { } }; + const deleteCustomer: DeleteCustomer = async ({ customerId }) => { + const response = await deps.fetch( + `${STRIPE_API}/customers/${encodeURIComponent(customerId)}`, + { + method: "DELETE", + headers: stripeHeaders, + }, + ); + + // 404 means the customer is already gone — the desired end state; succeed + // silently so SQS at-least-once retries after a successful delete don't + // poison the queue. + if (response.status === 404) { + return; + } + + if (!response.ok) { + const message = await readStripeErrorMessage(response); + throw new Error(`Stripe deleteCustomer failed (${response.status}): ${message}`); + } + }; + return { cancelImmediately, createSubscriptionOnExistingCustomer, scheduleCancellationAtPeriodEnd, reverseScheduledCancellation, + deleteCustomer, }; } diff --git a/projects/hutch/src/runtime/providers/subscription-providers/dynamodb-subscription-providers.test.ts b/projects/hutch/src/runtime/providers/subscription-providers/dynamodb-subscription-providers.test.ts index f83537010..a00f6aaf8 100644 --- a/projects/hutch/src/runtime/providers/subscription-providers/dynamodb-subscription-providers.test.ts +++ b/projects/hutch/src/runtime/providers/subscription-providers/dynamodb-subscription-providers.test.ts @@ -403,6 +403,32 @@ describe("initDynamoDbSubscriptionProviders", () => { }); }); + describe("deleteSubscription", () => { + it("issues an unconditioned Delete keyed by userId so it is idempotent", async () => { + let received: unknown; + const client = createFakeClient((input) => { + received = input; + return {}; + }); + const subs = initDynamoDbSubscriptionProviders({ + client: client as DynamoDBDocumentClient, + tableName: TABLE, + now: NOW, + }); + + await subs.deleteSubscription({ userId: USER_ID }); + + const command = received as { + input: { + Key?: Record; + ConditionExpression?: string; + }; + }; + expect(command.input.Key).toEqual({ userId: USER_ID }); + expect(command.input.ConditionExpression).toBeUndefined(); + }); + }); + describe("findByUserId with trialFeedbackEmailSentAt", () => { it("parses a cancelled trial row that carries trialFeedbackEmailSentAt", async () => { const client = createFakeClient(() => ({ diff --git a/projects/hutch/src/runtime/providers/subscription-providers/dynamodb-subscription-writes.ts b/projects/hutch/src/runtime/providers/subscription-providers/dynamodb-subscription-writes.ts index 675f65fe5..38e25f813 100644 --- a/projects/hutch/src/runtime/providers/subscription-providers/dynamodb-subscription-writes.ts +++ b/projects/hutch/src/runtime/providers/subscription-providers/dynamodb-subscription-writes.ts @@ -3,6 +3,7 @@ import { defineDynamoTable, } from "@packages/hutch-storage-client"; import type { + DeleteSubscription, MarkSubscriptionActive, MarkSubscriptionCancelledByUserId, MarkSubscriptionPendingCancellation, @@ -26,6 +27,7 @@ export function initDynamoDbSubscriptionWrites(deps: { markCancelledByUserId: MarkSubscriptionCancelledByUserId; markActive: MarkSubscriptionActive; markTrialFeedbackEmailSent: MarkTrialFeedbackEmailSent; + deleteSubscription: DeleteSubscription; } { const table = defineDynamoTable({ client: deps.client, @@ -126,6 +128,10 @@ export function initDynamoDbSubscriptionWrites(deps: { }); }; + const deleteSubscription: DeleteSubscription = async ({ userId }) => { + await table.delete({ Key: { userId } }); + }; + return { upsertTrialing, upsertActive, @@ -133,5 +139,6 @@ export function initDynamoDbSubscriptionWrites(deps: { markCancelledByUserId, markActive, markTrialFeedbackEmailSent, + deleteSubscription, }; } diff --git a/projects/hutch/src/runtime/providers/user-data-export/s3-user-data-export.ts b/projects/hutch/src/runtime/providers/user-data-export/s3-user-data-export.ts index 0e907087f..9672e837f 100644 --- a/projects/hutch/src/runtime/providers/user-data-export/s3-user-data-export.ts +++ b/projects/hutch/src/runtime/providers/user-data-export/s3-user-data-export.ts @@ -1,17 +1,23 @@ /* c8 ignore start -- thin AWS SDK wrapper, tested via integration */ -import { GetObjectCommand, PutObjectCommand, type S3Client } from "@aws-sdk/client-s3"; +import { + DeleteObjectsCommand, + GetObjectCommand, + ListObjectsV2Command, + PutObjectCommand, + type S3Client, +} from "@aws-sdk/client-s3"; import { getSignedUrl } from "@aws-sdk/s3-request-presigner"; import { EXPORT_DOWNLOAD_TTL_SECONDS, EXPORT_S3_KEY_PREFIX, } from "../../web/pages/export/export-ttl"; -import type { UploadUserDataExport } from "./user-data-export.types"; +import type { DeleteUserExports, UploadUserDataExport } from "./user-data-export.types"; export function initS3UserDataExport(deps: { client: S3Client; bucketName: string; now: () => Date; -}): { uploadUserDataExport: UploadUserDataExport } { +}): { uploadUserDataExport: UploadUserDataExport; deleteUserExports: DeleteUserExports } { const { client, bucketName, now } = deps; const uploadUserDataExport: UploadUserDataExport = async ({ userId, body }) => { @@ -38,6 +44,23 @@ export function initS3UserDataExport(deps: { return { s3Key, downloadUrl }; }; - return { uploadUserDataExport }; + const deleteUserExports: DeleteUserExports = async (userId) => { + const Prefix = `${EXPORT_S3_KEY_PREFIX}${userId}/`; + let ContinuationToken: string | undefined; + do { + const list = await client.send( + new ListObjectsV2Command({ Bucket: bucketName, Prefix, ContinuationToken }), + ); + const objects = (list.Contents ?? []).flatMap((o) => (o.Key ? [{ Key: o.Key }] : [])); + if (objects.length > 0) { + await client.send( + new DeleteObjectsCommand({ Bucket: bucketName, Delete: { Objects: objects } }), + ); + } + ContinuationToken = list.IsTruncated ? list.NextContinuationToken : undefined; + } while (ContinuationToken); + }; + + return { uploadUserDataExport, deleteUserExports }; } /* c8 ignore stop */ diff --git a/projects/hutch/src/runtime/providers/user-data-export/user-data-export.types.ts b/projects/hutch/src/runtime/providers/user-data-export/user-data-export.types.ts index 82657d43b..06af6c314 100644 --- a/projects/hutch/src/runtime/providers/user-data-export/user-data-export.types.ts +++ b/projects/hutch/src/runtime/providers/user-data-export/user-data-export.types.ts @@ -13,3 +13,5 @@ export interface UploadUserDataExportResult { export type UploadUserDataExport = ( params: UploadUserDataExportParams, ) => Promise; + +export type DeleteUserExports = (userId: UserId) => Promise; diff --git a/projects/hutch/src/runtime/server.ts b/projects/hutch/src/runtime/server.ts index 7b52472ce..79db431a2 100644 --- a/projects/hutch/src/runtime/server.ts +++ b/projects/hutch/src/runtime/server.ts @@ -49,6 +49,7 @@ import type { } from "@packages/provider-contracts/trial-scheduler"; import type { PublishCancelSubscriptionCommand, + PublishDeleteAccountCommand, PublishSubscriptionReactivated, } from "@packages/provider-contracts/events"; import type { @@ -115,6 +116,7 @@ import type { FindOAuthClient, OAuthModel, RegisterOAuthClient, + RevokeAllUserOAuthTokens, ValidateAccessToken, ValidateOAuthRedirectUri, } from "@packages/provider-contracts/oauth"; @@ -247,6 +249,7 @@ interface AppDependencies { baseUrl: string; logError: (message: string, error?: Error) => void; oauthModel: OAuthModel; + revokeAllUserOAuthTokens: RevokeAllUserOAuthTokens; validateAccessToken: ValidateAccessToken; findOAuthClient: FindOAuthClient; validateOAuthRedirectUri: ValidateOAuthRedirectUri; @@ -258,6 +261,7 @@ interface AppDependencies { publishSaveLinkRawHtmlCommand: PublishSaveLinkRawHtmlCommand; publishSaveLinkRawPdfCommand: PublishSaveLinkRawPdfCommand; publishExportUserDataCommand: PublishExportUserDataCommand; + publishDeleteAccountCommand: PublishDeleteAccountCommand; findEmailByUserId: FindEmailByUserId; putPendingHtml: PutPendingHtml; putPendingPdf: PutPendingPdf; @@ -1092,6 +1096,9 @@ export function createApp(dependencies: AppDependencies): Express { upsertTrialingSubscription: deps.subscriptionProviders.upsertTrialing, markActiveSubscription: deps.subscriptionProviders.markActive, findEmailByUserId: deps.findEmailByUserId, + destroyUserSessions: deps.destroyUserSessions, + revokeAllUserOAuthTokens: deps.revokeAllUserOAuthTokens, + publishDeleteAccountCommand: deps.publishDeleteAccountCommand, publishCancelSubscriptionCommand: deps.publishCancelSubscriptionCommand, publishSubscriptionReactivated: deps.publishSubscriptionReactivated, createCheckoutSession: deps.createCheckoutSession, diff --git a/projects/hutch/src/runtime/test-app.ts b/projects/hutch/src/runtime/test-app.ts index eb06432fc..34a086205 100644 --- a/projects/hutch/src/runtime/test-app.ts +++ b/projects/hutch/src/runtime/test-app.ts @@ -140,6 +140,7 @@ function flattenFixtureToAppDependencies( publishSaveLinkRawPdfCommand: fixture.events.publishSaveLinkRawPdfCommand, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, putPendingHtml: fixture.pendingHtml.putPendingHtml, @@ -148,6 +149,7 @@ function flattenFixtureToAppDependencies( markSummaryPending: fixture.summary.markSummaryPending, refreshArticleIfStale: fixture.freshness.refreshArticleIfStale, oauthModel: fixture.oauth.oauthModel, + revokeAllUserOAuthTokens: fixture.oauth.revokeAllUserOAuthTokens, validateAccessToken: fixture.oauth.validateAccessToken, findOAuthClient: fixture.oauth.findClient, validateOAuthRedirectUri: fixture.oauth.validateRedirectUri, diff --git a/projects/hutch/src/runtime/web/api/account-siren.test.ts b/projects/hutch/src/runtime/web/api/account-siren.test.ts new file mode 100644 index 000000000..cbecef292 --- /dev/null +++ b/projects/hutch/src/runtime/web/api/account-siren.test.ts @@ -0,0 +1,19 @@ +import { toAccountEntity } from "./account-siren"; + +describe("toAccountEntity", () => { + it("advertises a self link and a bare destructive delete-account action", () => { + expect(toAccountEntity()).toEqual({ + class: ["account"], + links: [{ rel: ["self"], href: "/account" }], + actions: [ + { + name: "delete-account", + title: "Delete account", + href: "/account/delete", + method: "POST", + class: ["destructive"], + }, + ], + }); + }); +}); diff --git a/projects/hutch/src/runtime/web/api/account-siren.ts b/projects/hutch/src/runtime/web/api/account-siren.ts new file mode 100644 index 000000000..09769f0ed --- /dev/null +++ b/projects/hutch/src/runtime/web/api/account-siren.ts @@ -0,0 +1,23 @@ +import type { SirenEntity, SirenLink } from "./siren"; + +/** The account resource as Siren. Carries the account-scoped affordances a + * client can act on — today just irreversible deletion, advertised as a bare + * no-body POST tagged with the reserved "destructive" role token so the client + * gates it behind its own confirmation. */ +export function toAccountEntity(): SirenEntity { + const links: SirenLink[] = [{ rel: ["self"], href: "/account" }]; + + return { + class: ["account"], + links, + actions: [ + { + name: "delete-account", + title: "Delete account", + href: "/account/delete", + method: "POST", + class: ["destructive"], + }, + ], + }; +} diff --git a/projects/hutch/src/runtime/web/api/api.routes.test.ts b/projects/hutch/src/runtime/web/api/api.routes.test.ts index 90a944f1d..27a3b5cad 100644 --- a/projects/hutch/src/runtime/web/api/api.routes.test.ts +++ b/projects/hutch/src/runtime/web/api/api.routes.test.ts @@ -319,6 +319,7 @@ describe("POST /queue (Siren save article)", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/api/collection-siren.test.ts b/projects/hutch/src/runtime/web/api/collection-siren.test.ts index 1007086fd..dafdf3de3 100644 --- a/projects/hutch/src/runtime/web/api/collection-siren.test.ts +++ b/projects/hutch/src/runtime/web/api/collection-siren.test.ts @@ -110,6 +110,7 @@ describe("toArticleCollectionEntity", () => { expect(entity.links).toContainEqual({ rel: ["self"], href: "/queue" }); expect(entity.links).toContainEqual({ rel: ["root"], href: "/queue" }); + expect(entity.links).toContainEqual({ rel: ["account"], title: "Account", href: "/account" }); }); it("advertises a titled add-links-help link so already-installed clients resolve the help URL", () => { @@ -168,7 +169,7 @@ describe("toArticleCollectionEntity", () => { const entity = toArticleCollectionEntity(result, { page: 2, pageSize: 20 }); const linkRels = entity.links?.map((l) => l.rel[0]); - expect(linkRels).toEqual(["self", "root", "add-links-help", "prev"]); + expect(linkRels).toEqual(["self", "root", "account", "add-links-help", "prev"]); }); it("single page omits both pagination links", () => { @@ -182,7 +183,7 @@ describe("toArticleCollectionEntity", () => { const entity = toArticleCollectionEntity(result, {}); const linkRels = entity.links?.map((l) => l.rel[0]); - expect(linkRels).toEqual(["self", "root", "add-links-help"]); + expect(linkRels).toEqual(["self", "root", "account", "add-links-help"]); }); it("preserves query params in pagination links", () => { diff --git a/projects/hutch/src/runtime/web/api/collection-siren.ts b/projects/hutch/src/runtime/web/api/collection-siren.ts index c30dbdf4b..a8f5864fa 100644 --- a/projects/hutch/src/runtime/web/api/collection-siren.ts +++ b/projects/hutch/src/runtime/web/api/collection-siren.ts @@ -41,6 +41,7 @@ export function toArticleCollectionEntity( const links: SirenLink[] = [ { rel: ["self"], href: `/queue${buildQueryString(queryParams)}` }, { rel: ["root"], href: "/queue" }, + { rel: ["account"], title: "Account", href: "/account" }, ]; // Older iOS builds resolve the Share-help URL from this rel; the current client diff --git a/projects/hutch/src/runtime/web/api/siren.ts b/projects/hutch/src/runtime/web/api/siren.ts index 29309ee35..f6c05d0fe 100644 --- a/projects/hutch/src/runtime/web/api/siren.ts +++ b/projects/hutch/src/runtime/web/api/siren.ts @@ -11,6 +11,10 @@ export interface SirenAction { title?: string; type?: string; fields?: SirenField[]; + /* A reserved semantic-role token the client maps to its own presentation + * (e.g. ["destructive"] → a red, confirm-gated control). The server never + * sends a CSS class; presentation stays entirely client-side. */ + class?: string[]; } export interface SirenLink { diff --git a/projects/hutch/src/runtime/web/pages/account/account.page.ts b/projects/hutch/src/runtime/web/pages/account/account.page.ts index e238cb120..820e4b87d 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.page.ts +++ b/projects/hutch/src/runtime/web/pages/account/account.page.ts @@ -2,7 +2,9 @@ import assert from "node:assert"; import type { Request, Response, Router } from "express"; import express from "express"; import type { HutchLogger } from "@packages/hutch-logger"; -import type { FindEmailByUserId } from "@packages/provider-contracts/auth"; +import { SESSION_COOKIE_NAME } from "@packages/web-session"; +import type { DestroyUserSessions, FindEmailByUserId } from "@packages/provider-contracts/auth"; +import type { RevokeAllUserOAuthTokens } from "@packages/provider-contracts/oauth"; import type { CreateCheckoutSession, CheckoutSessionId, @@ -15,6 +17,7 @@ import type { } from "@packages/provider-contracts/subscription-providers"; import type { PublishCancelSubscriptionCommand, + PublishDeleteAccountCommand, PublishSubscriptionReactivated, } from "@packages/provider-contracts/events"; import type { @@ -34,6 +37,9 @@ import type { } from "@packages/provider-contracts/trial-scheduler"; import type { StorePendingSignup } from "@packages/provider-contracts/pending-signup"; import { Base } from "../../base.component"; +import { wantsSiren } from "../../content-negotiation"; +import { SIREN_MEDIA_TYPE } from "../../api/siren"; +import { toAccountEntity } from "../../api/account-siren"; import type { BuildBannerState } from "../../banner-state"; import { HxRedirectPage } from "../../hx-redirect-page"; import { sendComponent } from "@packages/web-shell"; @@ -62,6 +68,9 @@ interface AccountDependencies { upsertTrialingSubscription: UpsertTrialingSubscription; markActiveSubscription: MarkSubscriptionActive; findEmailByUserId: FindEmailByUserId; + destroyUserSessions: DestroyUserSessions; + revokeAllUserOAuthTokens: RevokeAllUserOAuthTokens; + publishDeleteAccountCommand: PublishDeleteAccountCommand; publishCancelSubscriptionCommand: PublishCancelSubscriptionCommand; publishSubscriptionReactivated: PublishSubscriptionReactivated; createCheckoutSession: CreateCheckoutSession; @@ -135,6 +144,10 @@ export function initAccountRoutes(deps: AccountDependencies): Router { router.get("/", async (req: Request, res: Response) => { assert(req.userId, "userId required - route must be protected by requireAuth"); + if (wantsSiren(req)) { + res.type(SIREN_MEDIA_TYPE).json(toAccountEntity()); + return; + } const access = await deps.getEffectiveAccess(req.userId); const row = await deps.findSubscriptionByUserId(req.userId); const cardSection = await loadCardSection({ @@ -314,6 +327,27 @@ export function initAccountRoutes(deps: AccountDependencies): Router { res.redirect(303, buildAccountUrl({ cancelling: true })); }); + /** Irreversible account deletion. The synchronous work here is the + * security-critical teardown that must take effect the instant the user + * confirms — every session and bearer token dies at once — after which the + * durable, at-least-once scrub of every user-owned store runs asynchronously + * via DeleteAccountCommand. Sessions are destroyed before tokens are revoked + * (mirroring /oauth/revoke) so a failed step leaves the account still usable + * for a safe retry rather than half-torn-down. */ + router.post("/delete", async (req: Request, res: Response) => { + assert(req.userId, "userId required - route must be protected by requireAuth"); + const userId = req.userId; + await deps.destroyUserSessions(userId); + await deps.revokeAllUserOAuthTokens(userId); + res.clearCookie(SESSION_COOKIE_NAME, { path: "/" }); + await deps.publishDeleteAccountCommand({ userId }); + // Deletion logs the user out, so the whole page (nav, banner) must reset to + // the guest view. A boosted form would only swap
and leave a stale + // signed-in chrome, so force a full navigation to the logged-out home — + // HX-Redirect for HTMX requests, a plain 303 otherwise. + redirectFullPage(req, res, "/"); + }); + router.post("/reactivate", async (req: Request, res: Response) => { assert(req.userId, "userId required - route must be protected by requireAuth"); const userId = req.userId; @@ -397,13 +431,14 @@ export function initAccountRoutes(deps: AccountDependencies): Router { return checkout; } - /** HTMX intercepts hx-boost forms via XHR. A 303 Location to an external - * origin (Stripe Checkout) makes HTMX issue a cross-origin XHR and then - * fail to swap the response into
, so the browser never leaves - * /account. HxRedirectPage carries HTMX's HX-Redirect header, which - * triggers `window.location.href = url`. Plain (non-HTMX) form posts - * still get the 303 Location, so progressive enhancement is preserved. */ - function redirectToCheckout(req: Request, res: Response, url: string): void { + /** Force the browser to fully navigate to `url` rather than swap
. + * HTMX intercepts hx-boost forms via XHR; a 303 Location to an external origin + * (Stripe Checkout) makes HTMX issue a cross-origin XHR and never leave the + * page, and a same-origin 303 only swaps
(leaving stale chrome — wrong + * after a logout-like action). HxRedirectPage carries HTMX's HX-Redirect + * header, which triggers `window.location.href = url`. Plain (non-HTMX) form + * posts still get the 303 Location, so progressive enhancement is preserved. */ + function redirectFullPage(req: Request, res: Response, url: string): void { if (req.get("HX-Request") === "true") { sendComponent(req, res, HxRedirectPage(url)); return; @@ -417,7 +452,7 @@ export function initAccountRoutes(deps: AccountDependencies): Router { > = { trialing: async (req, res) => { const checkout = await startCheckout(req); - redirectToCheckout(req, res, checkout.url); + redirectFullPage(req, res, checkout.url); }, cancelled: async (req, res) => { assert(req.userId, "userId required - route must be protected by requireAuth"); @@ -430,7 +465,7 @@ export function initAccountRoutes(deps: AccountDependencies): Router { { userId }, ); const checkout = await startCheckout(req); - redirectToCheckout(req, res, checkout.url); + redirectFullPage(req, res, checkout.url); return; } try { @@ -455,7 +490,7 @@ export function initAccountRoutes(deps: AccountDependencies): Router { { userId, error: err instanceof Error ? err.message : String(err) }, ); const checkout = await startCheckout(req); - redirectToCheckout(req, res, checkout.url); + redirectFullPage(req, res, checkout.url); } }, noop: async (_req, res) => { diff --git a/projects/hutch/src/runtime/web/pages/account/account.route.test.ts b/projects/hutch/src/runtime/web/pages/account/account.route.test.ts index 80b277946..cc2323754 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/account/account.route.test.ts @@ -1239,3 +1239,83 @@ describe("POST /account/cards/confirm — post-attach cap reconciliation", () => expect(response.headers.location).toBe("/login"); }); }); + +describe("GET /account (Siren)", () => { + it("emits the account entity with a destructive delete-account action for a Siren client", async () => { + const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); + const { agent } = await loginUser(harness, "siren@example.com"); + + const response = await agent + .get("/account") + .set("Accept", "application/vnd.siren+json"); + + expect(response.status).toBe(200); + expect(response.headers["content-type"]).toContain("application/vnd.siren+json"); + const deleteAction = response.body.actions.find( + (a: { name: string }) => a.name === "delete-account", + ); + assert(deleteAction, "delete-account action must be present"); + expect(deleteAction.href).toBe("/account/delete"); + expect(deleteAction.method).toBe("POST"); + expect(deleteAction.class).toEqual(["destructive"]); + }); +}); + +describe("POST /account/delete", () => { + it("destroys the session, clears the cookie, and redirects to the logged-out home", async () => { + const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); + const { agent } = await loginUser(harness, "delete-me@example.com"); + + const response = await agent.post("/account/delete"); + + expect(response.status).toBe(303); + expect(response.headers.location).toBe("/"); + const rawSetCookie = response.headers["set-cookie"]; + const setCookie = Array.isArray(rawSetCookie) ? rawSetCookie : []; + assert( + setCookie.some((c) => c.startsWith("hutch_sid=")), + "the session cookie must be cleared", + ); + + // The session was destroyed, so the agent's cookie no longer authenticates. + const after = await agent.get("/account"); + expect(after.status).toBe(303); + expect(after.headers.location).toBe("/login"); + }); + + it("returns an HX-Redirect to the logged-out home for a boosted (HTMX) request", async () => { + const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); + const { agent } = await loginUser(harness, "delete-hx@example.com"); + + const response = await agent.post("/account/delete").set("HX-Request", "true"); + + expect(response.status).toBe(200); + expect(response.headers["hx-redirect"]).toBe("/"); + }); + + it("redirects unauthenticated callers to /login", async () => { + const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); + const response = await request(harness.server).post("/account/delete"); + expect(response.status).toBe(303); + expect(response.headers.location).toBe("/login"); + }); +}); + +describe("GET /account (danger zone)", () => { + it("renders a destructive delete-account form pointing at /account/delete", async () => { + const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); + const agent = await loginAgent(harness.server, harness.auth); + + const response = await agent.get("/account"); + const doc = new JSDOM(response.text).window.document; + + const danger = doc.querySelector("[data-test-account-danger]"); + assert(danger, "the danger zone must render"); + const deleteForm = danger.querySelector('[data-test-danger-action="delete-account"]'); + assert(deleteForm, "the delete-account form must render"); + expect(deleteForm.getAttribute("method")).toBe("POST"); + expect(deleteForm.getAttribute("action")).toBe( + "/account/delete?utm_source=account&utm_medium=internal&utm_content=delete-account", + ); + }); +}); diff --git a/projects/hutch/src/runtime/web/pages/account/account.styles.css b/projects/hutch/src/runtime/web/pages/account/account.styles.css index 5a573509c..915b8b8cd 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.styles.css +++ b/projects/hutch/src/runtime/web/pages/account/account.styles.css @@ -119,6 +119,32 @@ text-decoration: underline; } +.account-danger { + padding: 20px; + border-radius: var(--radius-sm); + background: var(--muted); + border-left: 3px solid var(--error); + margin-bottom: 16px; +} + +.account-danger__heading { + font-size: 1.25rem; + font-weight: 700; + margin: 0 0 12px; + color: var(--foreground); +} + +.account-danger__body { + font-size: 0.9375rem; + margin: 0 0 12px; + color: var(--foreground); + line-height: 1.45; +} + +.account-danger__action-form { + margin: 0; +} + /* purgecss-ignore-start: account-cards and its state modifiers are interpolated from CardSectionViewModel.stateClass / item.itemClass in account.template.html */ .account-cards { padding: 20px; diff --git a/projects/hutch/src/runtime/web/pages/account/account.template.html b/projects/hutch/src/runtime/web/pages/account/account.template.html index 8ccc10afe..47b3fec2e 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.template.html +++ b/projects/hutch/src/runtime/web/pages/account/account.template.html @@ -81,4 +81,14 @@ {{/if}} +
diff --git a/projects/hutch/src/runtime/web/pages/account/account.url.ts b/projects/hutch/src/runtime/web/pages/account/account.url.ts index bcbb1d909..8c34ea562 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.url.ts +++ b/projects/hutch/src/runtime/web/pages/account/account.url.ts @@ -6,6 +6,7 @@ export function buildAccountUrl(params?: { cancelling?: boolean }): string { } export const ACCOUNT_CANCEL_URL = "/account/cancel"; +export const ACCOUNT_DELETE_URL = "/account/delete"; export const ACCOUNT_REACTIVATE_URL = "/account/reactivate"; export const ACCOUNT_SUBSCRIBE_URL = "/account/subscribe"; export const ACCOUNT_ERROR_PAYMENT_METHOD_URL = "/account?error=payment_method"; diff --git a/projects/hutch/src/runtime/web/pages/account/account.view-model.test.ts b/projects/hutch/src/runtime/web/pages/account/account.view-model.test.ts index 9532fd524..518739abe 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.view-model.test.ts +++ b/projects/hutch/src/runtime/web/pages/account/account.view-model.test.ts @@ -73,6 +73,21 @@ describe("toAccountViewModel — actions", () => { assert.deepEqual(vm.actions, []); }); + it("exposes the destructive delete-account danger action in every state, separate from the state actions", () => { + const vm = toAccountViewModel( + { tier: "founding", access: "full", banner: "none" }, + baseQuery, + now, + ); + assert.equal(vm.dangerAction.key, "delete-account"); + assert.equal(vm.dangerAction.variant, "destructive"); + assert.equal(vm.dangerAction.method, "POST"); + assert.equal( + vm.dangerAction.href, + "/account/delete?utm_source=account&utm_medium=internal&utm_content=delete-account", + ); + }); + it("active paid users get a destructive cancel form (POST) — no GET confirmation step", () => { const vm = toAccountViewModel( { tier: "paid", access: "full", banner: "none" }, diff --git a/projects/hutch/src/runtime/web/pages/account/account.view-model.ts b/projects/hutch/src/runtime/web/pages/account/account.view-model.ts index d982f840d..5f42608af 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.view-model.ts +++ b/projects/hutch/src/runtime/web/pages/account/account.view-model.ts @@ -5,6 +5,7 @@ import { type LocalTime, toAbsoluteDate, withInternalTracking } from "@packages/ import { ACCOUNT_CANCEL_URL, ACCOUNT_CARDS_NEW_URL, + ACCOUNT_DELETE_URL, ACCOUNT_REACTIVATE_URL, ACCOUNT_SUBSCRIBE_URL, buildCardPrimaryUrl, @@ -23,7 +24,7 @@ export type AccountCardState = | "inactive" | "error-payment-method"; -export type AccountActionKey = "subscribe" | "cancel-form" | "reactivate-form"; +export type AccountActionKey = "subscribe" | "cancel-form" | "reactivate-form" | "delete-account"; export type AccountActionVariant = "primary" | "secondary" | "destructive"; @@ -48,6 +49,9 @@ export interface AccountViewModel { showCancellingNotice: boolean; stateIsErrorPaymentMethod: boolean; actions: AccountAction[]; + /** The irreversible "delete account" control. Kept out of the state-dependent + * `actions` array so the danger zone renders in every subscription state. */ + dangerAction: AccountAction; } function formatTrialDaysLeft(trialEndsAt: string, now: Date): { daysLeft: number; daysLeftWord: "day" | "days" } { @@ -112,6 +116,14 @@ const REACTIVATE_FORM_ACTION = action({ href: ACCOUNT_REACTIVATE_URL, }); +const DELETE_ACCOUNT_ACTION = action({ + key: "delete-account", + name: "Delete account", + variant: "destructive", + method: "POST", + href: ACCOUNT_DELETE_URL, +}); + export type CardSectionState = "no-customer" | "loaded" | "provider-error"; export type CardActionKey = "promote" | "remove"; @@ -271,6 +283,7 @@ function baseFor(state: AccountCardState, actions: AccountAction[]): { showCancellingNotice: false; stateIsErrorPaymentMethod: false; actions: AccountAction[]; + dangerAction: AccountAction; } { return { state, @@ -279,6 +292,7 @@ function baseFor(state: AccountCardState, actions: AccountAction[]): { showCancellingNotice: false, stateIsErrorPaymentMethod: false, actions, + dangerAction: DELETE_ACCOUNT_ACTION, }; } diff --git a/projects/hutch/src/runtime/web/pages/admin/recrawl.route.test.ts b/projects/hutch/src/runtime/web/pages/admin/recrawl.route.test.ts index 96a6e1430..878bae7fe 100644 --- a/projects/hutch/src/runtime/web/pages/admin/recrawl.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/admin/recrawl.route.test.ts @@ -75,6 +75,7 @@ function buildHarness(options: { adminEmails: readonly string[] }): RecrawlHarne publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/privacy/privacy.template.html b/projects/hutch/src/runtime/web/pages/privacy/privacy.template.html index 805b8ff5e..080ffdf1a 100644 --- a/projects/hutch/src/runtime/web/pages/privacy/privacy.template.html +++ b/projects/hutch/src/runtime/web/pages/privacy/privacy.template.html @@ -48,7 +48,7 @@

Cookies

Your rights

-

You have the right to access, correct, export, or delete your personal data at any time. Contact me at the address below to exercise these rights.

+

You have the right to access, correct, export, or delete your personal data at any time. You can export your data from the Export page and permanently delete your account — along with every saved article and your reading history — from your Account page. Contact me at the address below for anything else.

diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.card.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.card.route.test.ts index 199dd3e92..2d1487281 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.card.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.card.route.test.ts @@ -45,6 +45,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -94,6 +95,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -165,6 +167,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -212,6 +215,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -269,6 +273,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -340,6 +345,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.freshness.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.freshness.route.test.ts index 82f43c888..3769e9d84 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.freshness.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.freshness.route.test.ts @@ -56,6 +56,7 @@ describe("Queue freshness integration", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: async (p) => { timestampPublished.push(p); }, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.listing.filters.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.listing.filters.route.test.ts index e4e1511d4..244a6953c 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.listing.filters.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.listing.filters.route.test.ts @@ -75,6 +75,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.listing.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.listing.route.test.ts index 329b9da38..3046d5825 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.listing.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.listing.route.test.ts @@ -168,6 +168,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.mutations.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.mutations.route.test.ts index 32e9fb59e..25c4f9c8c 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.mutations.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.mutations.route.test.ts @@ -182,6 +182,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.reader-presence.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.reader-presence.route.test.ts index d6561750e..c14a6f7d2 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.reader-presence.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.reader-presence.route.test.ts @@ -44,6 +44,7 @@ function buildHarness() { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.reader.advanced.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.reader.advanced.route.test.ts index 3512591b8..29b985b47 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.reader.advanced.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.reader.advanced.route.test.ts @@ -38,6 +38,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -101,6 +102,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -159,6 +161,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -212,6 +215,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -270,6 +274,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -325,6 +330,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -384,6 +390,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -576,6 +583,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -648,6 +656,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -702,6 +711,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -749,6 +759,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -786,6 +797,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -824,6 +836,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -870,6 +883,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts index ad7cf5cd3..dea61bcd2 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts @@ -48,6 +48,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -112,6 +113,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -170,6 +172,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -238,6 +241,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -304,6 +308,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -474,6 +479,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -545,6 +551,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -629,6 +636,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -679,6 +687,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -750,6 +759,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -807,6 +817,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -886,6 +897,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -955,6 +967,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1022,6 +1035,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1073,6 +1087,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1132,6 +1147,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1188,6 +1204,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1235,6 +1252,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.save-content.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.save-content.route.test.ts index 62a6f8529..26ac3406a 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.save-content.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.save-content.route.test.ts @@ -69,6 +69,7 @@ describe("POST /queue/save-content with PDF", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -159,6 +160,7 @@ describe("POST /queue/save-content with HTML", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.save-html.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.save-html.route.test.ts index 3a2272dff..50f8108ad 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.save-html.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.save-html.route.test.ts @@ -68,6 +68,7 @@ describe("POST /queue/save-html", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -152,6 +153,7 @@ describe("POST /queue/save-html", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -341,6 +343,7 @@ describe("Collection-Siren advertises both save actions", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.share-balloon.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.share-balloon.route.test.ts index 7e9a51ea5..666297e5b 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.share-balloon.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.share-balloon.route.test.ts @@ -50,6 +50,7 @@ async function saveAndOpenReader(appOrigin: string): Promise { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/view/view.metadata.route.test.ts b/projects/hutch/src/runtime/web/pages/view/view.metadata.route.test.ts index 3a0563432..f3234af3b 100644 --- a/projects/hutch/src/runtime/web/pages/view/view.metadata.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/view/view.metadata.route.test.ts @@ -74,6 +74,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -141,6 +142,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -182,6 +184,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -226,6 +229,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -403,6 +407,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -448,6 +453,7 @@ describe("View routes", () => { publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -521,6 +527,7 @@ describe("View routes", () => { publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -580,6 +587,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -623,6 +631,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -671,6 +680,7 @@ describe("View routes", () => { publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -729,6 +739,7 @@ describe("View routes", () => { publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -777,6 +788,7 @@ describe("View routes", () => { publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -866,6 +878,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -905,6 +918,7 @@ describe("View routes", () => { publishSaveLinkRawPdfCommand: fixture.events.publishSaveLinkRawPdfCommand, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, diff --git a/projects/hutch/src/runtime/web/pages/view/view.route.test.ts b/projects/hutch/src/runtime/web/pages/view/view.route.test.ts index 2eab84e91..c949ec93b 100644 --- a/projects/hutch/src/runtime/web/pages/view/view.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/view/view.route.test.ts @@ -76,6 +76,7 @@ function buildReaderHarness() { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -107,6 +108,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -190,6 +192,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -260,6 +263,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -301,6 +305,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -341,6 +346,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -383,6 +389,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -429,6 +436,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -476,6 +484,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -526,6 +535,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -577,6 +587,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -703,6 +714,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -757,6 +769,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -804,6 +817,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -840,6 +854,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -878,6 +893,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -915,6 +931,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -952,6 +969,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1004,6 +1022,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1040,6 +1059,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1088,6 +1108,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1136,6 +1157,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1184,6 +1206,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1236,6 +1259,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1288,6 +1312,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1467,6 +1492,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, @@ -1530,6 +1556,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/ios-readplace/App/AffordancePresentation.swift b/projects/ios-readplace/App/AffordancePresentation.swift index e5e0ed211..f57ede44f 100644 --- a/projects/ios-readplace/App/AffordancePresentation.swift +++ b/projects/ios-readplace/App/AffordancePresentation.swift @@ -56,6 +56,15 @@ struct AffordancePresentation { isDestructive = true removesItem = true isToolbarControl = true + case "delete-account": + // Account-level, irreversible: destructive so the View confirms before + // invoking, but `removesItem = false` — there is no reading-list row to + // drop; it tears down the whole account. + systemImage = "person.crop.circle.badge.xmark" + tint = .red + isDestructive = true + removesItem = false + isToolbarControl = true case "search": systemImage = "magnifyingglass" tint = nil @@ -104,6 +113,14 @@ extension Affordance { rel == "add-links-help" } + /// Whether invoking this affordance ends the user's session, so the client must + /// tear down local auth (session cookie, tokens, WebKit store) once it succeeds. + /// This is inherently specific to account deletion — a purge is also destructive + /// yet keeps the session — so unlike the generic `isDestructive` routing it keys + /// on the token. The server has already revoked everything server-side; this only + /// clears the now-dead local traces so the app returns to the login screen. + var endsSession: Bool { token == "delete-account" } + /// Whether the client can invoke this affordance from a bare toolbar control. /// Per the contract, a field-requiring action whose fields carry no /// server-provided `value` is not invokable by a bare control: the value must diff --git a/projects/ios-readplace/App/ReadingListView.swift b/projects/ios-readplace/App/ReadingListView.swift index 278a0b4c9..26da0dfe3 100644 --- a/projects/ios-readplace/App/ReadingListView.swift +++ b/projects/ios-readplace/App/ReadingListView.swift @@ -12,15 +12,17 @@ struct ReadingListView: View { /// never background the app (Control Center, the notification shade, a call or /// permission banner); those must not trigger a re-read. @State private var didEnterBackground = false - /// A destructive item action awaiting confirmation, carried with the row it acts - /// on. A destructive control (e.g. `delete`) is irreversible, so it routes here - /// for an explicit confirm before the invoke fires, rather than acting on the tap. + /// A destructive affordance awaiting confirmation. A destructive control (e.g. + /// `delete`, `delete-account`) is irreversible, so it routes here for an explicit + /// confirm before the invoke fires, rather than acting on the tap. `article` is + /// nil for a collection-level control (e.g. account deletion), which acts on no + /// row. @State private var pendingDestructive: PendingDestructive? private struct PendingDestructive: Identifiable { let affordance: Affordance - let article: Article - var id: String { "\(affordance.id):\(article.id)" } + let article: Article? + var id: String { "\(affordance.id):\(article?.id ?? "collection")" } } init(session: AppSession) { @@ -93,14 +95,13 @@ struct ReadingListView: View { presenting: pendingDestructive ) { pending in Button(pending.affordance.label, role: .destructive) { - if let action = pending.affordance.action { - Task { await viewModel.invoke(action, on: pending.article) } - } - pendingDestructive = nil + confirmDestructive(pending) } Button("Cancel", role: .cancel) { pendingDestructive = nil } - } message: { _ in - Text("This can't be undone.") + } message: { pending in + Text(pending.affordance.endsSession + ? "This permanently deletes your account, every saved article, and your reading history. It can't be undone." + : "This can't be undone.") } } } @@ -116,6 +117,34 @@ struct ReadingListView: View { case let .open(link): viewModel.open(link: link) case let .invoke(action): + // A destructive collection control (e.g. account deletion) is + // irreversible, so route it through the same confirmation the row + // controls use — keyed on `isDestructive`, never on the action name — and + // only invoke once the user confirms. The confirm gate lives here rather + // than in `ToolbarRoute.route` so routing stays name-agnostic. + if affordance.presentation.isDestructive { + pendingDestructive = PendingDestructive(affordance: affordance, article: nil) + } else { + Task { await viewModel.invokeCollection(action) } + } + } + } + + /// Performs a confirmed destructive affordance. A row control invokes on its + /// article; a collection control invokes on the collection and, when it ends the + /// session (account deletion), tears down local auth so the app returns to the + /// login screen with no residual traces. + private func confirmDestructive(_ pending: PendingDestructive) { + defer { pendingDestructive = nil } + guard let action = pending.affordance.action else { return } + if let article = pending.article { + Task { await viewModel.invoke(action, on: article) } + } else if pending.affordance.endsSession { + Task { + await viewModel.invokeCollection(action) + session.forceLogout() + } + } else { Task { await viewModel.invokeCollection(action) } } } diff --git a/projects/ios-readplace/Tests/AffordancePresentationTests.swift b/projects/ios-readplace/Tests/AffordancePresentationTests.swift index 77c139e2c..3d178eeb3 100644 --- a/projects/ios-readplace/Tests/AffordancePresentationTests.swift +++ b/projects/ios-readplace/Tests/AffordancePresentationTests.swift @@ -48,6 +48,28 @@ final class AffordancePresentationTests: XCTestCase { XCTAssertTrue(presentation.removesItem) } + func testDeleteAccountMapsToADestructiveToolbarControlThatRemovesNoRow() { + // Account deletion is irreversible (destructive, so the View confirms) and a + // toolbar control, but it acts on the whole account, not a reading-list row — + // so removesItem is false, unlike `delete`. + let presentation = AffordancePresentation(token: "delete-account") + XCTAssertEqual(presentation.systemImage, "person.crop.circle.badge.xmark") + XCTAssertEqual(presentation.tint, .red) + XCTAssertTrue(presentation.isDestructive) + XCTAssertFalse(presentation.removesItem, "there is no reading-list row to drop") + XCTAssertTrue(presentation.isToolbarControl) + } + + func testEndsSessionIsTrueOnlyForAccountDeletion() throws { + // The client tears down local auth after a successful invoke only for account + // deletion — a purge is destructive too but keeps the session — so this keys + // on the token, not on `isDestructive`. + let deleteAccount = try XCTUnwrap(Affordance(action: action(name: "delete-account", href: "/account/delete"))) + XCTAssertTrue(deleteAccount.endsSession) + let delete = try XCTUnwrap(Affordance(action: action(name: "delete", href: "/queue/a1/delete"))) + XCTAssertFalse(delete.endsSession, "a row delete is destructive but keeps the session") + } + func testSearchMapsToANeutralMagnifierControl() { let presentation = AffordancePresentation(token: "search") XCTAssertEqual(presentation.systemImage, "magnifyingglass") diff --git a/src/packages/domain/src/inbox/inbox-address.schema.ts b/src/packages/domain/src/inbox/inbox-address.schema.ts index ccd86629f..a03a8fe0a 100644 --- a/src/packages/domain/src/inbox/inbox-address.schema.ts +++ b/src/packages/domain/src/inbox/inbox-address.schema.ts @@ -1,5 +1,6 @@ import { randomInt } from "node:crypto"; import { z } from "zod"; +import { UserIdSchema } from "../user"; /** Opaque per-newsletter token in a forwarding address. Six lowercase base36 * characters (a–z0–9) — short enough to be memorable/typeable, ~2.2B @@ -111,3 +112,10 @@ export function normalizeAliasName(raw: string): AliasName | undefined { /** The alias every account's first forwarding address is minted under at signup, * so a brand-new user lands on `inbox-@…` without having to name one. */ export const DEFAULT_INBOX_ALIAS: AliasName = AliasNameSchema.parse("inbox"); + +/** The reserved owner an address is reassigned to when its real owner deletes + * their account. An address row is never deleted — a freed hash could be + * re-minted for another user and leak their forwarded mail — so account deletion + * tombstones instead: it strips the PII alias and repoints `userId` at this + * sentinel so the row unlinks from the real user while the hash stays reserved. */ +export const DELETED_ACCOUNT_INBOX_OWNER = UserIdSchema.parse("deleted-account"); diff --git a/src/packages/domain/src/inbox/inbox-address.types.ts b/src/packages/domain/src/inbox/inbox-address.types.ts index ce072c2b0..30e0a991b 100644 --- a/src/packages/domain/src/inbox/inbox-address.types.ts +++ b/src/packages/domain/src/inbox/inbox-address.types.ts @@ -16,6 +16,13 @@ export interface InboxAddressEntry { disabledAt: string | undefined; } +/** Account-deletion primitive: unlinks every address the user owns from them + * without deleting any row (a freed hash could be re-minted for another user and + * leak their forwarded mail). For each owned address it strips the PII alias, + * repoints `userId` at the reserved `DELETED_ACCOUNT_INBOX_OWNER` sentinel, and + * stamps `disabledAt` if not already set. Ownership-guarded per row. */ +export type TombstoneUserAddresses = (userId: UserId) => Promise; + export interface InboxAddressStore { /** Mints a fresh address for the user under the chosen alias `name`. A user * may hold many (one per newsletter) up to `INBOX_ADDRESS_MAX_PER_USER`; at @@ -46,4 +53,7 @@ export interface InboxAddressStore { * just-minted address. Returns `undefined` for an unknown address; a returned * entry with `disabledAt !== undefined` means the caller must reject the mail. */ findByAddress: (address: InboxAddress) => Promise; + /** Tombstones every address the user owns as part of account deletion. See + * {@link TombstoneUserAddresses}. */ + tombstoneUserAddresses: TombstoneUserAddresses; } diff --git a/src/packages/domain/src/inbox/inbox-email-link.types.ts b/src/packages/domain/src/inbox/inbox-email-link.types.ts index cd14a50d7..a04bee709 100644 --- a/src/packages/domain/src/inbox/inbox-email-link.types.ts +++ b/src/packages/domain/src/inbox/inbox-email-link.types.ts @@ -72,4 +72,15 @@ export interface InboxEmailLinkStore { receivedAtMessageId: string; ordinal: EmailLinkOrdinal; }) => Promise; + /** Account-deletion primitive: deletes every link row — and the reserved meta + * row — in one email's partition. There is no userId GSI, so the caller + * supplies the parent email's sort key to name the partition. */ + deleteLinksByEmail: (input: { + userId: UserId; + receivedAtMessageId: string; + }) => Promise; + /** Convenience over {@link deleteLinksByEmail} for the delete worker: loops it + * across every one of the user's emails, whose sort keys the worker gathers + * before deleting the email rows themselves. */ + deleteAllLinksByUserId: (userId: UserId, receivedAtMessageIds: string[]) => Promise; } diff --git a/src/packages/domain/src/inbox/inbox-email.types.ts b/src/packages/domain/src/inbox/inbox-email.types.ts index 563e3f127..e52ed109b 100644 --- a/src/packages/domain/src/inbox/inbox-email.types.ts +++ b/src/packages/domain/src/inbox/inbox-email.types.ts @@ -35,4 +35,15 @@ export interface InboxEmailStore { userId: UserId; receivedAtMessageId: string; }) => Promise; + /** Account-deletion primitive: drains every email the user owns, deleting each + * row and returning the S3 keys so the caller drives object deletion. The raw + * `.eml` keys (always present) and the rendered-body keys (only on `received` + * rows) are returned separately because they live in different buckets. + * `receivedAtMessageIds` are returned so the caller can purge the matching + * link rows, whose table has no `userId` index to enumerate on its own. */ + deleteAllEmailsByUserId: (userId: UserId) => Promise<{ + receivedAtMessageIds: string[]; + rawEmailS3Keys: string[]; + bodyS3Keys: string[]; + }>; } diff --git a/src/packages/domain/src/inbox/index.ts b/src/packages/domain/src/inbox/index.ts index f1a9be605..156283bb7 100644 --- a/src/packages/domain/src/inbox/index.ts +++ b/src/packages/domain/src/inbox/index.ts @@ -1,4 +1,8 @@ -export type { InboxAddressEntry, InboxAddressStore } from "./inbox-address.types"; +export type { + InboxAddressEntry, + InboxAddressStore, + TombstoneUserAddresses, +} from "./inbox-address.types"; export { countLiveAddresses, isLiveAddress } from "./inbox-address.live"; export { InboxTokenSchema, @@ -12,6 +16,7 @@ export { INBOX_ADDRESS_MAX_PER_USER, DEFAULT_INBOX_ALIAS, InboxAddressLimitReachedError, + DELETED_ACCOUNT_INBOX_OWNER, generateInboxToken, buildInboxAddress, aliasNameFromAddress, diff --git a/src/packages/hutch-infra-components/src/events.ts b/src/packages/hutch-infra-components/src/events.ts index 577d9e706..af3bea4a9 100644 --- a/src/packages/hutch-infra-components/src/events.ts +++ b/src/packages/hutch-infra-components/src/events.ts @@ -400,6 +400,16 @@ export const ExportUserDataCommand = defineEvent({ }); export type ExportUserDataDetail = z.infer; +export const DeleteAccountCommand = defineEvent({ + name: "delete-account-command", + source: "hutch.api", + detailType: "DeleteAccountCommand", + detailSchema: z.object({ + userId: z.string(), + }), +}); +export type DeleteAccountDetail = z.infer; + export const UserDataExportedEvent = defineEvent({ name: "user-data-exported", source: "hutch.export-user-data", diff --git a/src/packages/hutch-infra-components/src/index.ts b/src/packages/hutch-infra-components/src/index.ts index 06117251d..295484327 100644 --- a/src/packages/hutch-infra-components/src/index.ts +++ b/src/packages/hutch-infra-components/src/index.ts @@ -47,6 +47,8 @@ export { type UpdateFetchTimestampDetail, ExportUserDataCommand, type ExportUserDataDetail, + DeleteAccountCommand, + type DeleteAccountDetail, UserDataExportedEvent, type UserDataExportedDetail, UserDataExportFailedEvent, diff --git a/src/packages/provider-contracts/src/article-store.ts b/src/packages/provider-contracts/src/article-store.ts index 2b3dc5879..53296a212 100644 --- a/src/packages/provider-contracts/src/article-store.ts +++ b/src/packages/provider-contracts/src/article-store.ts @@ -192,3 +192,8 @@ export type FindUserArticleNotificationState = (params: { export type ContentProvider = (articleResourceUniqueId: ArticleResourceUniqueId) => Promise; export type ReadArticleContent = (url: string) => Promise; + +/** Delete every per-user article row for a user (account deletion). Only the + * per-user gateway rows are removed; the URL-keyed global article cache is + * shared across users and left untouched. */ +export type DeleteAllUserArticles = (userId: UserId) => Promise; diff --git a/src/packages/provider-contracts/src/auth.ts b/src/packages/provider-contracts/src/auth.ts index 6bbbf5892..1163318e2 100644 --- a/src/packages/provider-contracts/src/auth.ts +++ b/src/packages/provider-contracts/src/auth.ts @@ -55,6 +55,8 @@ export type DestroySession = (sessionId: string) => Promise; export type DestroyUserSessions = (userId: UserId) => Promise; +export type CloseUserAccount = (userId: UserId) => Promise; + export type CountUsers = () => Promise; export type MarkEmailVerified = (email: string) => Promise; diff --git a/src/packages/provider-contracts/src/digest-queue.ts b/src/packages/provider-contracts/src/digest-queue.ts index b23088c1d..529ee1f83 100644 --- a/src/packages/provider-contracts/src/digest-queue.ts +++ b/src/packages/provider-contracts/src/digest-queue.ts @@ -42,3 +42,6 @@ export type DeleteDigestItem = (params: { * Scan — sound because the queue is sparse (only users with a pending * reader-ready article ever have rows, and rows are drained on send). */ export type ScanPendingDigestUsers = () => Promise; + +/** Delete every queued article for a user (account deletion). */ +export type DeleteDigestByUser = (userId: UserId) => Promise; diff --git a/src/packages/provider-contracts/src/events.ts b/src/packages/provider-contracts/src/events.ts index d49138e4d..5c2d643df 100644 --- a/src/packages/provider-contracts/src/events.ts +++ b/src/packages/provider-contracts/src/events.ts @@ -10,6 +10,10 @@ export type PublishExportUserDataCommand = (params: { requestedAt: string; }) => Promise; +export type PublishDeleteAccountCommand = (params: { + userId: UserId; +}) => Promise; + export type PublishLinkSaved = (params: { url: string; userId: UserId; diff --git a/src/packages/provider-contracts/src/ios-onboarding-signal.ts b/src/packages/provider-contracts/src/ios-onboarding-signal.ts index d94cbf11e..08b6764b2 100644 --- a/src/packages/provider-contracts/src/ios-onboarding-signal.ts +++ b/src/packages/provider-contracts/src/ios-onboarding-signal.ts @@ -22,3 +22,6 @@ export type RecordIosSavedArticle = (params: { export type GetIosAppSignals = (params: { userId: UserId; }) => Promise<{ installed: boolean; savedArticle: boolean }>; + +/** Delete the single iOS onboarding row for a user (account deletion). */ +export type DeleteOnboarding = (params: { userId: UserId }) => Promise; diff --git a/src/packages/provider-contracts/src/oauth.ts b/src/packages/provider-contracts/src/oauth.ts index b9c0082bb..db54fde1a 100644 --- a/src/packages/provider-contracts/src/oauth.ts +++ b/src/packages/provider-contracts/src/oauth.ts @@ -3,7 +3,7 @@ import type { RefreshTokenModel, } from "@node-oauth/oauth2-server"; import type { AccessToken, OAuthClient } from "@packages/domain/oauth"; -import type { AuthenticatedUserId } from "@packages/domain/user"; +import type { AuthenticatedUserId, UserId } from "@packages/domain/user"; export type OAuthModel = AuthorizationCodeModel & RefreshTokenModel; @@ -11,6 +11,8 @@ export type ValidateAccessToken = ( accessToken: AccessToken, ) => Promise<{ userId: AuthenticatedUserId; emailVerified: boolean } | null>; +export type RevokeAllUserOAuthTokens = (userId: UserId) => Promise; + export interface RegisterOAuthClientInput { redirectUris: string[]; clientName?: string; diff --git a/src/packages/provider-contracts/src/password-reset.ts b/src/packages/provider-contracts/src/password-reset.ts index 34b1395c3..0de9de694 100644 --- a/src/packages/provider-contracts/src/password-reset.ts +++ b/src/packages/provider-contracts/src/password-reset.ts @@ -10,3 +10,5 @@ export type VerifyPasswordResetToken = (token: PasswordResetToken) => Promise< | { ok: true; email: string } | { ok: false; reason: "invalid-token" } >; + +export type DeletePasswordResetTokensByEmail = (email: string) => Promise; diff --git a/src/packages/provider-contracts/src/reader-ready-state.ts b/src/packages/provider-contracts/src/reader-ready-state.ts index 1c6cb5a78..e85c1c59f 100644 --- a/src/packages/provider-contracts/src/reader-ready-state.ts +++ b/src/packages/provider-contracts/src/reader-ready-state.ts @@ -19,3 +19,6 @@ export type ReleaseReaderReadyEmailSlot = (params: { userId: UserId; claimedAt: Date; }) => Promise; + +/** Delete the single reader-ready cooldown row for a user (account deletion). */ +export type DeleteReaderReadyState = (userId: UserId) => Promise; diff --git a/src/packages/provider-contracts/src/stripe-subscriptions.ts b/src/packages/provider-contracts/src/stripe-subscriptions.ts index abbf50625..56a62b572 100644 --- a/src/packages/provider-contracts/src/stripe-subscriptions.ts +++ b/src/packages/provider-contracts/src/stripe-subscriptions.ts @@ -17,3 +17,5 @@ export type ScheduleCancellationAtPeriodEnd = (input: { export type ReverseScheduledCancellation = (input: { subscriptionId: string; }) => Promise; + +export type DeleteCustomer = (input: { customerId: string }) => Promise; diff --git a/src/packages/provider-contracts/src/subscription-providers.ts b/src/packages/provider-contracts/src/subscription-providers.ts index 72c147551..5bcec1080 100644 --- a/src/packages/provider-contracts/src/subscription-providers.ts +++ b/src/packages/provider-contracts/src/subscription-providers.ts @@ -49,6 +49,8 @@ export type MarkSubscriptionCancelledByUserId = (input: { export type MarkSubscriptionActive = (input: { userId: UserId }) => Promise; +export type DeleteSubscription = (input: { userId: UserId }) => Promise; + export type MarkTrialFeedbackEmailSent = (input: { userId: UserId; sentAt: string; diff --git a/src/packages/test-fixtures/src/fixture.ts b/src/packages/test-fixtures/src/fixture.ts index 6b55efcbb..83467c9a7 100644 --- a/src/packages/test-fixtures/src/fixture.ts +++ b/src/packages/test-fixtures/src/fixture.ts @@ -34,10 +34,12 @@ import type { ExtractLinksFromPageUrl } from "@packages/extract-links-from-page" import { initInMemorySaveLinkRawHtmlCommand } from "./providers/events/in-memory-save-link-raw-html-command"; import { initInMemorySaveLinkRawPdfCommand } from "./providers/events/in-memory-save-link-raw-pdf-command"; import { initInMemoryExportUserDataCommand } from "./providers/events/in-memory-export-user-data-command"; +import { initInMemoryDeleteAccountCommand } from "./providers/events/in-memory-delete-account-command"; import { initInMemoryCancelSubscriptionCommand } from "./providers/events/in-memory-cancel-subscription-command"; import { initInMemorySubscriptionReactivated } from "./providers/events/in-memory-subscription-reactivated"; import { createOAuthModel, + createRevokeAllUserOAuthTokens, initInMemoryOAuthModel, } from "./providers/oauth/oauth-model"; import { initInMemoryOAuthClients } from "./providers/oauth/in-memory-oauth-clients"; @@ -268,6 +270,9 @@ export function createDefaultTestAppFixture(appOrigin: string): TestAppFixture { const { publishExportUserDataCommand } = initInMemoryExportUserDataCommand({ logger: noopLogger, }); + const { publishDeleteAccountCommand } = initInMemoryDeleteAccountCommand({ + logger: noopLogger, + }); const { publishCancelSubscriptionCommand } = initInMemoryCancelSubscriptionCommand({ logger: noopLogger, }); @@ -276,12 +281,14 @@ export function createDefaultTestAppFixture(appOrigin: string): TestAppFixture { }); const oauthClients = initInMemoryOAuthClients({ now: () => new Date() }); const oauthClientLookup = initOAuthClientLookup({ dynamic: oauthClients }); - const oauthModel = createOAuthModel(initInMemoryOAuthModel(), { + const oauthModelDeps = initInMemoryOAuthModel(); + const oauthModel = createOAuthModel(oauthModelDeps, { appOrigin, findUserById: auth.findUserById, findClient: oauthClientLookup.findClient, markClientActive: oauthClientLookup.markClientActive, }); + const revokeAllUserOAuthTokens = createRevokeAllUserOAuthTokens(oauthModelDeps); const stripe = initInMemoryStripeCheckout({ checkoutBaseUrl: "https://checkout.stripe.test", now: () => new Date() }); const pendingSignup = initInMemoryPendingSignup(); const subscriptionProviders = initInMemorySubscriptionProviders({ now: () => new Date() }); @@ -313,6 +320,7 @@ export function createDefaultTestAppFixture(appOrigin: string): TestAppFixture { return { auth: { ...auth, hashPassword: fastHashPassword }, articleStore: { + deleteAllUserArticles: articleStoreMemory.deleteAllUserArticles, findArticleById: articleStoreMemory.findArticleById, findArticleByUrl: articleStoreMemory.findArticleByUrl, findArticleUrlById: articleStoreMemory.findArticleUrlById, @@ -357,6 +365,7 @@ export function createDefaultTestAppFixture(appOrigin: string): TestAppFixture { publishStaleCheckRequested: initInMemoryStaleCheckRequested({ logger: noopLogger }).publishStaleCheckRequested, publishUpdateFetchTimestamp: createInMemoryPublishUpdateFetchTimestamp(), publishExportUserDataCommand, + publishDeleteAccountCommand, publishCancelSubscriptionCommand, publishSubscriptionReactivated, }, @@ -372,6 +381,7 @@ export function createDefaultTestAppFixture(appOrigin: string): TestAppFixture { freshness: { refreshArticleIfStale: createNoopRefreshArticleIfStale() }, oauth: { oauthModel, + revokeAllUserOAuthTokens, validateAccessToken: createValidateAccessToken(oauthModel), findClient: oauthClientLookup.findClient, validateRedirectUri: oauthClientLookup.validateRedirectUri, diff --git a/src/packages/test-fixtures/src/providers/article-store/in-memory-article-store.test.ts b/src/packages/test-fixtures/src/providers/article-store/in-memory-article-store.test.ts index fe2f77432..8c474ef71 100644 --- a/src/packages/test-fixtures/src/providers/article-store/in-memory-article-store.test.ts +++ b/src/packages/test-fixtures/src/providers/article-store/in-memory-article-store.test.ts @@ -519,6 +519,34 @@ describe("initInMemoryArticleStore", () => { }); }); + describe("deleteAllUserArticles", () => { + it("removes every row for the user while leaving the global article and other users' rows intact", async () => { + const store = initInMemoryArticleStore(); + const a1 = await store.saveArticle(makeArticleParams({ userId: USER_A, url: "https://example.com/1" })); + await store.saveArticle(makeArticleParams({ userId: USER_A, url: "https://example.com/2" })); + const shared = await store.saveArticle(makeArticleParams({ userId: USER_A })); + await store.saveArticle(makeArticleParams({ userId: USER_B })); + + await store.deleteAllUserArticles(USER_A); + + expect(await store.countArticlesByUser({ userId: USER_A })).toBe(0); + expect(await store.findArticleById(a1.id, USER_A)).toBeNull(); + // Another user's relationship to the shared article survives. + expect((await store.findArticleById(shared.id, USER_B))?.url).toBe("https://example.com/article"); + // The global article cache is untouched (still resolvable by URL). + expect((await store.findArticleByUrl("https://example.com/1"))?.url).toBe("https://example.com/1"); + }); + + it("is a no-op when the user has no saved articles", async () => { + const store = initInMemoryArticleStore(); + await store.saveArticle(makeArticleParams({ userId: USER_B })); + + await store.deleteAllUserArticles(USER_A); + + expect(await store.countArticlesByUser({ userId: USER_B })).toBe(1); + }); + }); + describe("freshness operations", () => { it("findArticleFreshness returns null for unknown URL", async () => { const store = initInMemoryArticleStore(); diff --git a/src/packages/test-fixtures/src/providers/article-store/in-memory-article-store.ts b/src/packages/test-fixtures/src/providers/article-store/in-memory-article-store.ts index ea28862a0..6f602aea5 100644 --- a/src/packages/test-fixtures/src/providers/article-store/in-memory-article-store.ts +++ b/src/packages/test-fixtures/src/providers/article-store/in-memory-article-store.ts @@ -11,6 +11,7 @@ import type { UserId } from "@packages/domain/user"; import type { BumpArticleSavedAt, CountArticlesByUser, + DeleteAllUserArticles, DeleteArticle, FindArticleById, FindArticleByUrl, @@ -85,6 +86,7 @@ export function initInMemoryArticleStore(): { findArticlesByUser: FindArticlesByUser; countArticlesByUser: CountArticlesByUser; deleteArticle: DeleteArticle; + deleteAllUserArticles: DeleteAllUserArticles; updateArticleStatus: UpdateArticleStatus; markArticleViewed: MarkArticleViewed; markSummaryToggled: MarkSummaryToggled; @@ -263,6 +265,12 @@ export function initInMemoryArticleStore(): { return true; }; + const deleteAllUserArticles: DeleteAllUserArticles = async (userId) => { + for (const [key, ua] of userArticles) { + if (ua.userId === userId) userArticles.delete(key); + } + }; + const updateArticleStatus: UpdateArticleStatus = async (id, userId, status) => { const article = findArticleByRouteId(id); if (!article) return false; @@ -395,6 +403,7 @@ export function initInMemoryArticleStore(): { findArticlesByUser, countArticlesByUser, deleteArticle, + deleteAllUserArticles, updateArticleStatus, markArticleViewed, markSummaryToggled, diff --git a/src/packages/test-fixtures/src/providers/auth/in-memory-auth.test.ts b/src/packages/test-fixtures/src/providers/auth/in-memory-auth.test.ts index 88742b0a0..8a951b954 100644 --- a/src/packages/test-fixtures/src/providers/auth/in-memory-auth.test.ts +++ b/src/packages/test-fixtures/src/providers/auth/in-memory-auth.test.ts @@ -133,6 +133,43 @@ describe("initInMemoryAuth", () => { }); }); + describe("closeUserAccount", () => { + it("removes the user row and releases the Gmail claim", async () => { + const auth = makeAuth(); + const created = await auth.createUser({ email: "john.doe@gmail.com", password: "password123" }); + assert(created.ok, "User creation failed"); + + await auth.closeUserAccount(created.userId); + + expect(await auth.findUserById(created.userId)).toBeNull(); + // The released claim lets a dotted spelling of the same mailbox register again. + const recreated = await auth.createUser({ email: "johndoe@gmail.com", password: "password456" }); + expect(recreated.ok).toBe(true); + }); + + it("removes a non-Gmail user row without touching any claim", async () => { + const auth = makeAuth(); + const created = await auth.createUser({ email: "temp@example.com", password: "password123" }); + assert(created.ok, "User creation failed"); + + await auth.closeUserAccount(created.userId); + + expect(await auth.findUserById(created.userId)).toBeNull(); + const recreated = await auth.createUser({ email: "temp@example.com", password: "password456" }); + expect(recreated.ok).toBe(true); + }); + + it("is a no-op for an unknown userId, leaving existing users intact", async () => { + const auth = makeAuth(); + const created = await auth.createUser({ email: "keep@example.com", password: "password123" }); + assert(created.ok, "User creation failed"); + + await auth.closeUserAccount(UserIdSchema.parse("nobody")); + + expect(await auth.findUserById(created.userId)).not.toBeNull(); + }); + }); + describe("verifyCredentials", () => { it("should verify correct password", async () => { const auth = makeAuth(); diff --git a/src/packages/test-fixtures/src/providers/auth/in-memory-auth.ts b/src/packages/test-fixtures/src/providers/auth/in-memory-auth.ts index ea8f04fbd..e7bb16e50 100644 --- a/src/packages/test-fixtures/src/providers/auth/in-memory-auth.ts +++ b/src/packages/test-fixtures/src/providers/auth/in-memory-auth.ts @@ -9,6 +9,7 @@ import { gmailIdentityKey, } from "@packages/domain/user"; import type { + CloseUserAccount, CountUsers, CreateAppleUser, CreateGoogleUser, @@ -59,6 +60,7 @@ export function initInMemoryAuth(opts: { getSessionUserId: GetSessionUserId; destroySession: DestroySession; destroyUserSessions: DestroyUserSessions; + closeUserAccount: CloseUserAccount; countUsers: CountUsers; markEmailVerified: MarkEmailVerified; markSessionEmailVerified: MarkSessionEmailVerified; @@ -212,6 +214,17 @@ export function initInMemoryAuth(opts: { } }; + const closeUserAccount: CloseUserAccount = async (userId) => { + for (const [email, user] of users) { + if (user.id === userId) { + users.delete(email); + const claimKey = gmailIdentityKey(user.email); + if (claimKey !== null) gmailClaims.delete(claimKey); + return; + } + } + }; + const countUsers: CountUsers = async () => { return users.size; }; @@ -299,6 +312,7 @@ export function initInMemoryAuth(opts: { getSessionUserId, destroySession, destroyUserSessions, + closeUserAccount, countUsers, markEmailVerified, markSessionEmailVerified, diff --git a/src/packages/test-fixtures/src/providers/digest-queue/digest-queue.types.ts b/src/packages/test-fixtures/src/providers/digest-queue/digest-queue.types.ts index 7eb24ec6d..48251c68e 100644 --- a/src/packages/test-fixtures/src/providers/digest-queue/digest-queue.types.ts +++ b/src/packages/test-fixtures/src/providers/digest-queue/digest-queue.types.ts @@ -1,4 +1,5 @@ export type { + DeleteDigestByUser, DeleteDigestItem, DigestQueueItem, EnqueueDigestItem, diff --git a/src/packages/test-fixtures/src/providers/digest-queue/in-memory-digest-queue.test.ts b/src/packages/test-fixtures/src/providers/digest-queue/in-memory-digest-queue.test.ts index aa183123a..4fd95f0ad 100644 --- a/src/packages/test-fixtures/src/providers/digest-queue/in-memory-digest-queue.test.ts +++ b/src/packages/test-fixtures/src/providers/digest-queue/in-memory-digest-queue.test.ts @@ -55,6 +55,18 @@ describe("initInMemoryDigestQueue", () => { expect(await queue.listDigestItemsByUser(USER)).toEqual([]); }); + it("deletes every queued item for a user, leaving other users' items intact", async () => { + const queue = initInMemoryDigestQueue(); + await enqueue(queue, { userId: USER, url: "https://example.com/a", enqueuedAt: "t1" }); + await enqueue(queue, { userId: USER, url: "https://example.com/b", enqueuedAt: "t2" }); + await enqueue(queue, { userId: OTHER, url: "https://example.com/c", enqueuedAt: "t3" }); + + await queue.deleteDigestByUser(USER); + + expect(await queue.listDigestItemsByUser(USER)).toEqual([]); + expect(await queue.listDigestItemsByUser(OTHER)).toHaveLength(1); + }); + it("returns each distinct pending user once from a scan", async () => { const queue = initInMemoryDigestQueue(); await enqueue(queue, { userId: USER, url: "https://example.com/a", enqueuedAt: "t1" }); diff --git a/src/packages/test-fixtures/src/providers/digest-queue/in-memory-digest-queue.ts b/src/packages/test-fixtures/src/providers/digest-queue/in-memory-digest-queue.ts index 26a8363ea..193fb026c 100644 --- a/src/packages/test-fixtures/src/providers/digest-queue/in-memory-digest-queue.ts +++ b/src/packages/test-fixtures/src/providers/digest-queue/in-memory-digest-queue.ts @@ -1,6 +1,7 @@ import { ArticleResourceUniqueId } from "@packages/article-resource-unique-id"; import type { UserId } from "@packages/domain/user"; import type { + DeleteDigestByUser, DeleteDigestItem, DigestQueueItem, EnqueueDigestItem, @@ -12,6 +13,7 @@ export function initInMemoryDigestQueue(): { enqueueDigestItem: EnqueueDigestItem; listDigestItemsByUser: ListDigestItemsByUser; deleteDigestItem: DeleteDigestItem; + deleteDigestByUser: DeleteDigestByUser; scanPendingDigestUsers: ScanPendingDigestUsers; } { const rows = new Map(); @@ -29,9 +31,15 @@ export function initInMemoryDigestQueue(): { rows.delete(keyOf(userId, url)); }; + const deleteDigestByUser: DeleteDigestByUser = async (userId) => { + for (const [key, row] of rows) { + if (row.userId === userId) rows.delete(key); + } + }; + const scanPendingDigestUsers: ScanPendingDigestUsers = async () => [ ...new Set([...rows.values()].map((row) => row.userId)), ]; - return { enqueueDigestItem, listDigestItemsByUser, deleteDigestItem, scanPendingDigestUsers }; + return { enqueueDigestItem, listDigestItemsByUser, deleteDigestItem, deleteDigestByUser, scanPendingDigestUsers }; } diff --git a/src/packages/test-fixtures/src/providers/events/in-memory-delete-account-command.ts b/src/packages/test-fixtures/src/providers/events/in-memory-delete-account-command.ts new file mode 100644 index 000000000..4b6396f78 --- /dev/null +++ b/src/packages/test-fixtures/src/providers/events/in-memory-delete-account-command.ts @@ -0,0 +1,16 @@ +import type { HutchLogger } from "@packages/hutch-logger"; +import type { PublishDeleteAccountCommand } from "@packages/provider-contracts/events"; + +export function initInMemoryDeleteAccountCommand(deps: { + logger: HutchLogger; +}): { publishDeleteAccountCommand: PublishDeleteAccountCommand } { + const { logger } = deps; + + const publishDeleteAccountCommand: PublishDeleteAccountCommand = async (params) => { + logger.info("[DeleteAccountCommand] published (in-memory no-op)", { + userId: params.userId, + }); + }; + + return { publishDeleteAccountCommand }; +} diff --git a/src/packages/test-fixtures/src/providers/events/index.ts b/src/packages/test-fixtures/src/providers/events/index.ts index ec20e624e..3928d4115 100644 --- a/src/packages/test-fixtures/src/providers/events/index.ts +++ b/src/packages/test-fixtures/src/providers/events/index.ts @@ -1,4 +1,5 @@ export * from "./publish-cancel-subscription-command.types"; +export * from "./publish-delete-account-command.types"; export * from "./publish-export-user-data-command.types"; export * from "./publish-link-saved.types"; export * from "./publish-recrawl-link-initiated.types"; @@ -15,6 +16,7 @@ export * from "./publish-subscription-reactivated.types"; export * from "./publish-subscription-start-request-command.types"; export * from "./publish-update-fetch-timestamp.types"; export * from "./in-memory-cancel-subscription-command"; +export * from "./in-memory-delete-account-command"; export * from "./in-memory-export-user-data-command"; export * from "./in-memory-link-saved"; export * from "./in-memory-recrawl-link-initiated"; diff --git a/src/packages/test-fixtures/src/providers/events/publish-delete-account-command.types.ts b/src/packages/test-fixtures/src/providers/events/publish-delete-account-command.types.ts new file mode 100644 index 000000000..7605e0726 --- /dev/null +++ b/src/packages/test-fixtures/src/providers/events/publish-delete-account-command.types.ts @@ -0,0 +1 @@ +export type { PublishDeleteAccountCommand } from "@packages/provider-contracts/events"; diff --git a/src/packages/test-fixtures/src/providers/inbox-address/in-memory-inbox-address.test.ts b/src/packages/test-fixtures/src/providers/inbox-address/in-memory-inbox-address.test.ts index b0282e4ef..0a1d2b1fb 100644 --- a/src/packages/test-fixtures/src/providers/inbox-address/in-memory-inbox-address.test.ts +++ b/src/packages/test-fixtures/src/providers/inbox-address/in-memory-inbox-address.test.ts @@ -3,6 +3,7 @@ import { ConditionalCheckFailedException } from "@packages/hutch-storage-client" import { UserIdSchema } from "@packages/domain/user"; import { AliasNameSchema, + DELETED_ACCOUNT_INBOX_OWNER, INBOX_ADDRESS_MAX_PER_USER, InboxAddressLimitReachedError, InboxAddressSchema, @@ -151,4 +152,36 @@ describe("initInMemoryInboxAddress", () => { assert(found, "expected the disabled address to resolve"); expect(found.disabledAt).toBe("2026-06-23T12:00:00.000Z"); }); + + describe("tombstoneUserAddresses", () => { + it("unlinks the owner's addresses to the reserved owner, keeps every row, and stamps disabledAt only when unset", async () => { + let clock = new Date("2026-06-01T00:00:00.000Z"); + const store = initInMemoryInboxAddress({ now: () => clock }); + const live = await store.createAddress({ userId: owner, domain: DOMAIN, name: NAME }); + const alreadyDisabled = await store.createAddress({ userId: owner, domain: DOMAIN, name: NAME }); + await store.disableAddress({ userId: owner, address: alreadyDisabled.address }); + const otherOwned = await store.createAddress({ userId: otherUser, domain: DOMAIN, name: NAME }); + clock = new Date("2026-07-01T00:00:00.000Z"); + + await store.tombstoneUserAddresses(owner); + + // The owner no longer resolves any address … + expect(await store.listAddressesByUserId(owner)).toHaveLength(0); + // … but each hash stays reserved under the sentinel owner, disabled. + const liveRow = await store.findByAddress(live.address); + assert(liveRow, "expected the tombstoned live address to survive"); + expect(liveRow.userId).toBe(DELETED_ACCOUNT_INBOX_OWNER); + expect(liveRow.disabledAt).toBe("2026-07-01T00:00:00.000Z"); + // An address disabled before deletion keeps its original disabledAt. + const disabledRow = await store.findByAddress(alreadyDisabled.address); + assert(disabledRow, "expected the tombstoned disabled address to survive"); + expect(disabledRow.userId).toBe(DELETED_ACCOUNT_INBOX_OWNER); + expect(disabledRow.disabledAt).toBe("2026-06-01T00:00:00.000Z"); + // Another user's address is untouched. + const [otherRow] = await store.listAddressesByUserId(otherUser); + expect(otherRow.address).toBe(otherOwned.address); + expect(otherRow.userId).toBe(otherUser); + expect(otherRow.disabledAt).toBeUndefined(); + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/inbox-address/in-memory-inbox-address.ts b/src/packages/test-fixtures/src/providers/inbox-address/in-memory-inbox-address.ts index b3386b5d6..c8a2b0f0d 100644 --- a/src/packages/test-fixtures/src/providers/inbox-address/in-memory-inbox-address.ts +++ b/src/packages/test-fixtures/src/providers/inbox-address/in-memory-inbox-address.ts @@ -1,6 +1,8 @@ import { ConditionalCheckFailedException } from "@packages/hutch-storage-client"; import { + aliasNameFromAddress, buildInboxAddress, + DELETED_ACCOUNT_INBOX_OWNER, generateInboxToken, INBOX_ADDRESS_MAX_PER_USER, InboxAddressLimitReachedError, @@ -46,5 +48,18 @@ export function initInMemoryInboxAddress(deps: { now: () => Date }): InboxAddres rows.set(address, { ...row, disabledAt: deps.now().toISOString() }); }, findByAddress: async (address) => rows.get(address), + tombstoneUserAddresses: async (userId) => { + for (const [address, entry] of rows) { + if (entry.userId !== userId) continue; + rows.set(address, { + ...entry, + userId: DELETED_ACCOUNT_INBOX_OWNER, + // The dynamo path REMOVEs the PII `name` column and reads backfill the + // label from the address; model that resolved post-strip state here. + name: aliasNameFromAddress(entry.address), + disabledAt: entry.disabledAt ?? deps.now().toISOString(), + }); + } + }, }; } diff --git a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email-link.test.ts b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email-link.test.ts index 1b572f31b..7d77a920a 100644 --- a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email-link.test.ts +++ b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email-link.test.ts @@ -134,4 +134,53 @@ describe("initInMemoryInboxEmailLink", () => { expect(found.failureReason).toBe("crawl-failed"); expect(found.title).toBeUndefined(); }); + + describe("deleteLinksByEmail", () => { + it("removes every link and the meta row for one email, leaving another email untouched", async () => { + const store = initInMemoryInboxEmailLink(); + const otherRam = "2026-06-24T00:00:00.000Z#"; + await store.putLink(makeLink({ ordinal: EmailLinkOrdinalSchema.parse("0000") })); + await store.putLink(makeLink({ ordinal: EmailLinkOrdinalSchema.parse("0001") })); + await store.putLinksMeta({ + userId: owner, + receivedAtMessageId: RAM, + meta: { truncated: true }, + }); + await store.putLink(makeLink({ receivedAtMessageId: otherRam })); + + await store.deleteLinksByEmail({ userId: owner, receivedAtMessageId: RAM }); + + const cleared = await store.listLinksByEmail({ userId: owner, receivedAtMessageId: RAM }); + expect(cleared.links).toHaveLength(0); + expect(cleared.meta).toBeUndefined(); + const survivor = await store.listLinksByEmail({ + userId: owner, + receivedAtMessageId: otherRam, + }); + expect(survivor.links).toHaveLength(1); + }); + }); + + describe("deleteAllLinksByUserId", () => { + it("clears every provided email's links and leaves another user's links intact", async () => { + const store = initInMemoryInboxEmailLink(); + const ramA = "2026-06-23T00:00:00.000Z#"; + const ramB = "2026-06-24T00:00:00.000Z#"; + await store.putLink(makeLink({ receivedAtMessageId: ramA })); + await store.putLink(makeLink({ receivedAtMessageId: ramB })); + await store.putLink(makeLink({ userId: otherUser, receivedAtMessageId: ramA })); + + await store.deleteAllLinksByUserId(owner, [ramA, ramB]); + + expect( + (await store.listLinksByEmail({ userId: owner, receivedAtMessageId: ramA })).links, + ).toHaveLength(0); + expect( + (await store.listLinksByEmail({ userId: owner, receivedAtMessageId: ramB })).links, + ).toHaveLength(0); + expect( + (await store.listLinksByEmail({ userId: otherUser, receivedAtMessageId: ramA })).links, + ).toHaveLength(1); + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email-link.ts b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email-link.ts index 9a91b205b..983a389fa 100644 --- a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email-link.ts +++ b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email-link.ts @@ -13,6 +13,17 @@ export function initInMemoryInboxEmailLink(): InboxEmailLinkStore { `${input.userId}#${input.receivedAtMessageId}`; const linkKey = (group: string, ordinal: string) => `${group}#${ordinal}`; + const deleteLinksByEmail: InboxEmailLinkStore["deleteLinksByEmail"] = async ({ + userId, + receivedAtMessageId, + }) => { + const group = groupKey({ userId, receivedAtMessageId }); + for (const [key, link] of links) { + if (groupKey(link) === group) links.delete(key); + } + metas.delete(group); + }; + return { putLink: async (link) => { const key = linkKey(groupKey(link), link.ordinal); @@ -59,5 +70,11 @@ export function initInMemoryInboxEmailLink(): InboxEmailLinkStore { }, getLink: async ({ userId, receivedAtMessageId, ordinal }) => links.get(linkKey(groupKey({ userId, receivedAtMessageId }), ordinal)), + deleteLinksByEmail, + deleteAllLinksByUserId: async (userId, receivedAtMessageIds) => { + for (const receivedAtMessageId of receivedAtMessageIds) { + await deleteLinksByEmail({ userId, receivedAtMessageId }); + } + }, }; } diff --git a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.test.ts b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.test.ts index 48f732900..40385a19b 100644 --- a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.test.ts +++ b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.test.ts @@ -93,4 +93,58 @@ describe("initInMemoryInboxEmail", () => { await store.getEmail({ userId: owner, receivedAtMessageId: "missing" }), ).toBeUndefined(); }); + + describe("deleteAllEmailsByUserId", () => { + it("deletes the owner's emails and returns their raw and body S3 keys", async () => { + const store = initInMemoryInboxEmail(); + await store.putEmail( + makeEntry({ + receivedAtMessageId: "2026-06-23T09:00:00.000Z#", + rawEmailS3Key: "inbound/a", + bodyS3Key: "content/a/content.html", + }), + ); + await store.putEmail( + makeEntry({ + receivedAtMessageId: "2026-06-23T08:00:00.000Z#", + status: "rejected", + rawEmailS3Key: "inbound/b", + bodyS3Key: undefined, + }), + ); + + const { rawEmailS3Keys, bodyS3Keys } = await store.deleteAllEmailsByUserId(owner); + + expect(rawEmailS3Keys).toEqual(["inbound/a", "inbound/b"]); + expect(bodyS3Keys).toEqual(["content/a/content.html"]); + expect(await store.listEmailsByUserId(owner)).toHaveLength(0); + }); + + it("leaves another user's emails intact", async () => { + const store = initInMemoryInboxEmail(); + await store.putEmail(makeEntry({ rawEmailS3Key: "inbound/owner" })); + await store.putEmail( + makeEntry({ + userId: otherUser, + receivedAtMessageId: "2026-06-23T10:00:00.000Z#", + rawEmailS3Key: "inbound/other", + }), + ); + + const { rawEmailS3Keys } = await store.deleteAllEmailsByUserId(owner); + + expect(rawEmailS3Keys).toEqual(["inbound/owner"]); + expect(await store.listEmailsByUserId(otherUser)).toHaveLength(1); + }); + + it("returns empty key lists for a user with no emails", async () => { + const store = initInMemoryInboxEmail(); + + expect(await store.deleteAllEmailsByUserId(owner)).toEqual({ + receivedAtMessageIds: [], + rawEmailS3Keys: [], + bodyS3Keys: [], + }); + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.ts b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.ts index df4b1c914..76ef03670 100644 --- a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.ts +++ b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.ts @@ -21,5 +21,18 @@ export function initInMemoryInboxEmail(): InboxEmailStore { ), getEmail: async ({ userId, receivedAtMessageId }) => rows.get(keyOf(userId, receivedAtMessageId)), + deleteAllEmailsByUserId: async (userId) => { + const receivedAtMessageIds: string[] = []; + const rawEmailS3Keys: string[] = []; + const bodyS3Keys: string[] = []; + for (const [key, row] of rows) { + if (row.userId !== userId) continue; + receivedAtMessageIds.push(row.receivedAtMessageId); + rawEmailS3Keys.push(row.rawEmailS3Key); + if (row.bodyS3Key !== undefined) bodyS3Keys.push(row.bodyS3Key); + rows.delete(key); + } + return { receivedAtMessageIds, rawEmailS3Keys, bodyS3Keys }; + }, }; } diff --git a/src/packages/test-fixtures/src/providers/ios-onboarding-signal/in-memory-ios-onboarding-signal.test.ts b/src/packages/test-fixtures/src/providers/ios-onboarding-signal/in-memory-ios-onboarding-signal.test.ts index fb4ac01df..ce6f9e903 100644 --- a/src/packages/test-fixtures/src/providers/ios-onboarding-signal/in-memory-ios-onboarding-signal.test.ts +++ b/src/packages/test-fixtures/src/providers/ios-onboarding-signal/in-memory-ios-onboarding-signal.test.ts @@ -45,4 +45,30 @@ describe("initInMemoryIosOnboardingSignal", () => { savedArticle: false, }); }); + + it("clears both the installed and saved signals for a user on deleteOnboarding", async () => { + const store = initInMemoryIosOnboardingSignal(); + await store.recordIosSavedArticle({ userId: USER }); + + await store.deleteOnboarding({ userId: USER }); + + expect(await store.getIosAppSignals({ userId: USER })).toEqual({ + installed: false, + savedArticle: false, + }); + }); + + it("leaves another user's signals intact on deleteOnboarding", async () => { + const store = initInMemoryIosOnboardingSignal(); + const other = "user-2" as UserId; + await store.recordIosSavedArticle({ userId: USER }); + await store.recordIosSavedArticle({ userId: other }); + + await store.deleteOnboarding({ userId: USER }); + + expect(await store.getIosAppSignals({ userId: other })).toEqual({ + installed: true, + savedArticle: true, + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/ios-onboarding-signal/in-memory-ios-onboarding-signal.ts b/src/packages/test-fixtures/src/providers/ios-onboarding-signal/in-memory-ios-onboarding-signal.ts index 39a9b0c8f..4805e3dd1 100644 --- a/src/packages/test-fixtures/src/providers/ios-onboarding-signal/in-memory-ios-onboarding-signal.ts +++ b/src/packages/test-fixtures/src/providers/ios-onboarding-signal/in-memory-ios-onboarding-signal.ts @@ -1,5 +1,6 @@ import type { UserId } from "@packages/domain/user"; import type { + DeleteOnboarding, GetIosAppSignals, RecordIosAnyActivity, RecordIosSavedArticle, @@ -9,6 +10,7 @@ export function initInMemoryIosOnboardingSignal(): { recordIosAnyActivity: RecordIosAnyActivity; recordIosSavedArticle: RecordIosSavedArticle; getIosAppSignals: GetIosAppSignals; + deleteOnboarding: DeleteOnboarding; } { const activated = new Set(); const saved = new Set(); @@ -27,5 +29,10 @@ export function initInMemoryIosOnboardingSignal(): { savedArticle: saved.has(userId), }); - return { recordIosAnyActivity, recordIosSavedArticle, getIosAppSignals }; + const deleteOnboarding: DeleteOnboarding = async ({ userId }) => { + activated.delete(userId); + saved.delete(userId); + }; + + return { recordIosAnyActivity, recordIosSavedArticle, getIosAppSignals, deleteOnboarding }; } diff --git a/src/packages/test-fixtures/src/providers/oauth/oauth-model.test.ts b/src/packages/test-fixtures/src/providers/oauth/oauth-model.test.ts index d3503aefe..c832d5d28 100644 --- a/src/packages/test-fixtures/src/providers/oauth/oauth-model.test.ts +++ b/src/packages/test-fixtures/src/providers/oauth/oauth-model.test.ts @@ -8,6 +8,7 @@ import type { } from "@node-oauth/oauth2-server"; import { createOAuthModel, + createRevokeAllUserOAuthTokens, initInMemoryOAuthModel, } from "./oauth-model"; @@ -785,3 +786,91 @@ describe("createOAuthModel", () => { }); }); }); + +describe("createRevokeAllUserOAuthTokens", () => { + const OTHER_USER_ID = "user-other" as UserId; + + it("removes the user's tokens, refresh index entries, auth codes, and userId index entry while sparing other users", async () => { + const deps = initInMemoryOAuthModel(); + const model = createOAuthModel(deps); + + const client = await model.getClient(TEST_CLIENT_ID, ""); + assert(client, "Test client must exist"); + + await model.saveToken( + createTestToken({ accessToken: "access-1", refreshToken: "refresh-1" }), + client, + { id: TEST_USER_ID }, + ); + await model.saveAuthorizationCode( + createTestAuthCode({ authorizationCode: "code-1" }), + client, + { id: TEST_USER_ID }, + ); + await model.saveToken( + createTestToken({ accessToken: "other-access", refreshToken: "other-refresh" }), + client, + { id: OTHER_USER_ID }, + ); + await model.saveAuthorizationCode( + createTestAuthCode({ authorizationCode: "other-code" }), + client, + { id: OTHER_USER_ID }, + ); + + const revokeAllUserOAuthTokens = createRevokeAllUserOAuthTokens(deps); + await revokeAllUserOAuthTokens(TEST_USER_ID); + + expect(deps.tokens.has("access-1")).toBe(false); + expect(deps.refreshTokenIndex.has("refresh-1")).toBe(false); + expect(deps.userIdIndex.has(TEST_USER_ID)).toBe(false); + expect(deps.codes.has("code-1")).toBe(false); + + expect(deps.tokens.has("other-access")).toBe(true); + expect(deps.refreshTokenIndex.has("other-refresh")).toBe(true); + expect(deps.userIdIndex.has(OTHER_USER_ID)).toBe(true); + expect(deps.codes.has("other-code")).toBe(true); + }); + + it("leaves the refresh index untouched for a token that had no refresh token", async () => { + const deps = initInMemoryOAuthModel(); + const model = createOAuthModel(deps); + + const client = await model.getClient(TEST_CLIENT_ID, ""); + assert(client, "Test client must exist"); + + await model.saveToken( + createTestToken({ accessToken: "access-no-refresh", refreshToken: "" }), + client, + { id: TEST_USER_ID }, + ); + + const revokeAllUserOAuthTokens = createRevokeAllUserOAuthTokens(deps); + await revokeAllUserOAuthTokens(TEST_USER_ID); + + expect(deps.tokens.has("access-no-refresh")).toBe(false); + expect(deps.userIdIndex.has(TEST_USER_ID)).toBe(false); + expect(deps.refreshTokenIndex.size).toBe(0); + }); + + it("is a no-op for a user with no tokens or codes", async () => { + const deps = initInMemoryOAuthModel(); + + const revokeAllUserOAuthTokens = createRevokeAllUserOAuthTokens(deps); + await revokeAllUserOAuthTokens(TEST_USER_ID); + + expect(deps.tokens.size).toBe(0); + expect(deps.userIdIndex.size).toBe(0); + expect(deps.codes.size).toBe(0); + }); + + it("cleans up a userId index entry that references a missing token without throwing", async () => { + const deps = initInMemoryOAuthModel(); + deps.userIdIndex.set(TEST_USER_ID, new Set(["missing-access"])); + + const revokeAllUserOAuthTokens = createRevokeAllUserOAuthTokens(deps); + await revokeAllUserOAuthTokens(TEST_USER_ID); + + expect(deps.userIdIndex.has(TEST_USER_ID)).toBe(false); + }); +}); diff --git a/src/packages/test-fixtures/src/providers/oauth/oauth-model.ts b/src/packages/test-fixtures/src/providers/oauth/oauth-model.ts index 16f9c974e..045a168bc 100644 --- a/src/packages/test-fixtures/src/providers/oauth/oauth-model.ts +++ b/src/packages/test-fixtures/src/providers/oauth/oauth-model.ts @@ -11,6 +11,7 @@ import type { MarkOAuthClientActive, FindOAuthClient, OAuthModel, + RevokeAllUserOAuthTokens, } from "@packages/provider-contracts/oauth"; import type { FindUserById } from "@packages/provider-contracts/auth"; import type { UserId } from "@packages/domain/user"; @@ -72,6 +73,23 @@ export function initInMemoryOAuthModel(): OAuthModelDeps { export type { OAuthModel }; +export function createRevokeAllUserOAuthTokens(deps: OAuthModelDeps): RevokeAllUserOAuthTokens { + return async (userId) => { + const accessTokens = deps.userIdIndex.get(userId); + if (accessTokens) { + for (const accessToken of accessTokens) { + const stored = deps.tokens.get(accessToken); + if (stored?.refreshToken) deps.refreshTokenIndex.delete(stored.refreshToken); + deps.tokens.delete(accessToken); + } + deps.userIdIndex.delete(userId); + } + for (const [code, stored] of deps.codes) { + if (stored.userId === userId) deps.codes.delete(code); + } + }; +} + export function createOAuthModel( deps: OAuthModelDeps, options?: { diff --git a/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.test.ts b/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.test.ts index 2bfe18abd..a1e84e498 100644 --- a/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.test.ts +++ b/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.test.ts @@ -33,4 +33,27 @@ describe("initInMemoryPasswordReset", () => { await verifyPasswordResetToken(PasswordResetTokenSchema.parse(unknown)), ).toEqual({ ok: false, reason: "invalid-token" }); }); + + it("deletes every token for the given email and leaves other emails' tokens intact", async () => { + const { createPasswordResetToken, verifyPasswordResetToken, deleteTokensByEmail } = + initInMemoryPasswordReset(); + const firstForTarget = await createPasswordResetToken({ email: "target@example.com" }); + const secondForTarget = await createPasswordResetToken({ email: "target@example.com" }); + const otherToken = await createPasswordResetToken({ email: "other@example.com" }); + + await deleteTokensByEmail("target@example.com"); + + expect(await verifyPasswordResetToken(firstForTarget)).toEqual({ + ok: false, + reason: "invalid-token", + }); + expect(await verifyPasswordResetToken(secondForTarget)).toEqual({ + ok: false, + reason: "invalid-token", + }); + expect(await verifyPasswordResetToken(otherToken)).toEqual({ + ok: true, + email: "other@example.com", + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.ts b/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.ts index c3b9e7896..25432a9bd 100644 --- a/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.ts +++ b/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.ts @@ -1,6 +1,7 @@ import { randomBytes } from "node:crypto"; import type { CreatePasswordResetToken, + DeletePasswordResetTokensByEmail, PasswordResetToken, VerifyPasswordResetToken, } from "@packages/provider-contracts/password-reset"; @@ -9,6 +10,7 @@ import { PasswordResetTokenSchema } from "./password-reset.schema"; export function initInMemoryPasswordReset(): { createPasswordResetToken: CreatePasswordResetToken; verifyPasswordResetToken: VerifyPasswordResetToken; + deleteTokensByEmail: DeletePasswordResetTokensByEmail; } { const tokens = new Map(); @@ -27,5 +29,11 @@ export function initInMemoryPasswordReset(): { return { ok: true, email: entry.email }; }; - return { createPasswordResetToken, verifyPasswordResetToken }; + const deleteTokensByEmail: DeletePasswordResetTokensByEmail = async (email) => { + for (const [token, entry] of tokens) { + if (entry.email === email) tokens.delete(token); + } + }; + + return { createPasswordResetToken, verifyPasswordResetToken, deleteTokensByEmail }; } diff --git a/src/packages/test-fixtures/src/providers/password-reset/password-reset.types.ts b/src/packages/test-fixtures/src/providers/password-reset/password-reset.types.ts index db1df9526..672fa2ba1 100644 --- a/src/packages/test-fixtures/src/providers/password-reset/password-reset.types.ts +++ b/src/packages/test-fixtures/src/providers/password-reset/password-reset.types.ts @@ -1,5 +1,6 @@ export type { CreatePasswordResetToken, + DeletePasswordResetTokensByEmail, PasswordResetToken, VerifyPasswordResetToken, } from "@packages/provider-contracts/password-reset"; diff --git a/src/packages/test-fixtures/src/providers/reader-ready-state/in-memory-reader-ready-state.test.ts b/src/packages/test-fixtures/src/providers/reader-ready-state/in-memory-reader-ready-state.test.ts index 1e7369a67..2621fbb99 100644 --- a/src/packages/test-fixtures/src/providers/reader-ready-state/in-memory-reader-ready-state.test.ts +++ b/src/packages/test-fixtures/src/providers/reader-ready-state/in-memory-reader-ready-state.test.ts @@ -107,4 +107,30 @@ describe("initInMemoryReaderReadyState", () => { expect(second).toBe(false); }); }); + + describe("deleteReaderReadyState", () => { + it("clears the cooldown row so the user can immediately claim again", async () => { + const store = initInMemoryReaderReadyState(); + await store.claimReaderReadyEmailSlot({ + userId: USER, + now: new Date("2026-05-30T10:00:00.000Z"), + cooldownMs: COOLDOWN_MS, + }); + + await store.deleteReaderReadyState(USER); + + const reclaimed = await store.claimReaderReadyEmailSlot({ + userId: USER, + now: new Date("2026-05-30T10:01:00.000Z"), + cooldownMs: COOLDOWN_MS, + }); + expect(reclaimed).toBe(true); + }); + + it("is a no-op when the user has no cooldown row", async () => { + const store = initInMemoryReaderReadyState(); + + await expect(store.deleteReaderReadyState(USER)).resolves.toBeUndefined(); + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/reader-ready-state/in-memory-reader-ready-state.ts b/src/packages/test-fixtures/src/providers/reader-ready-state/in-memory-reader-ready-state.ts index 744f367b6..e9b81b970 100644 --- a/src/packages/test-fixtures/src/providers/reader-ready-state/in-memory-reader-ready-state.ts +++ b/src/packages/test-fixtures/src/providers/reader-ready-state/in-memory-reader-ready-state.ts @@ -1,12 +1,14 @@ import type { UserId } from "@packages/domain/user"; import type { ClaimReaderReadyEmailSlot, + DeleteReaderReadyState, ReleaseReaderReadyEmailSlot, } from "@packages/provider-contracts/reader-ready-state"; export function initInMemoryReaderReadyState(): { claimReaderReadyEmailSlot: ClaimReaderReadyEmailSlot; releaseReaderReadyEmailSlot: ReleaseReaderReadyEmailSlot; + deleteReaderReadyState: DeleteReaderReadyState; } { const lastSentByUser = new Map(); @@ -26,5 +28,9 @@ export function initInMemoryReaderReadyState(): { } }; - return { claimReaderReadyEmailSlot, releaseReaderReadyEmailSlot }; + const deleteReaderReadyState: DeleteReaderReadyState = async (userId) => { + lastSentByUser.delete(userId); + }; + + return { claimReaderReadyEmailSlot, releaseReaderReadyEmailSlot, deleteReaderReadyState }; } diff --git a/src/packages/test-fixtures/src/providers/subscription-providers/in-memory-subscription-providers.test.ts b/src/packages/test-fixtures/src/providers/subscription-providers/in-memory-subscription-providers.test.ts index dad15e8f2..ba0c1b319 100644 --- a/src/packages/test-fixtures/src/providers/subscription-providers/in-memory-subscription-providers.test.ts +++ b/src/packages/test-fixtures/src/providers/subscription-providers/in-memory-subscription-providers.test.ts @@ -172,6 +172,24 @@ describe("initInMemorySubscriptionProviders", () => { ).rejects.toThrow(/No subscription row/); }); + it("deleteSubscription removes the row so the user has no subscription", async () => { + const subs = initInMemorySubscriptionProviders({ now: fixedNow("2026-05-22T00:00:00.000Z") }); + await subs.upsertActive({ userId, subscriptionId: "sub_del", customerId: "cus_del" }); + + await subs.deleteSubscription({ userId }); + + expect(await subs.findByUserId(userId)).toBeUndefined(); + expect(await subs.findBySubscriptionId("sub_del")).toBeUndefined(); + }); + + it("deleteSubscription is a no-op for an unknown user", async () => { + const subs = initInMemorySubscriptionProviders({ now: fixedNow("2026-05-22T00:00:00.000Z") }); + + await subs.deleteSubscription({ userId }); + + expect(await subs.findByUserId(userId)).toBeUndefined(); + }); + it("seedRow lets tests inject hypothetical row shapes (e.g. trialing with customerId)", async () => { const subs = initInMemorySubscriptionProviders({ now: fixedNow("2026-05-22T00:00:00.000Z") }); diff --git a/src/packages/test-fixtures/src/providers/subscription-providers/in-memory-subscription-providers.ts b/src/packages/test-fixtures/src/providers/subscription-providers/in-memory-subscription-providers.ts index 47c990d3d..17cc50d73 100644 --- a/src/packages/test-fixtures/src/providers/subscription-providers/in-memory-subscription-providers.ts +++ b/src/packages/test-fixtures/src/providers/subscription-providers/in-memory-subscription-providers.ts @@ -1,6 +1,7 @@ import assert from "node:assert"; import type { UserId } from "@packages/domain/user"; import type { + DeleteSubscription, FindSubscriptionBySubscriptionId, FindSubscriptionByUserId, MarkSubscriptionActive, @@ -23,6 +24,7 @@ export function initInMemorySubscriptionProviders(opts: { markCancelledByUserId: MarkSubscriptionCancelledByUserId; markActive: MarkSubscriptionActive; markTrialFeedbackEmailSent: MarkTrialFeedbackEmailSent; + deleteSubscription: DeleteSubscription; seedRow: (row: SubscriptionRecord) => void; } { const rows = new Map(); @@ -109,6 +111,10 @@ export function initInMemorySubscriptionProviders(opts: { }); }; + const deleteSubscription: DeleteSubscription = async ({ userId }) => { + rows.delete(userId); + }; + /** Test-only escape hatch for seeding hypothetical row shapes (e.g. a * trialing row that also has a customerId — production paths never write * this combination, but the trial-end charge handler must still cover the @@ -126,6 +132,7 @@ export function initInMemorySubscriptionProviders(opts: { markCancelledByUserId, markActive, markTrialFeedbackEmailSent, + deleteSubscription, seedRow, }; } diff --git a/src/packages/test-fixtures/src/providers/subscription-providers/subscription-providers.types.ts b/src/packages/test-fixtures/src/providers/subscription-providers/subscription-providers.types.ts index 53d53fd06..340ef3141 100644 --- a/src/packages/test-fixtures/src/providers/subscription-providers/subscription-providers.types.ts +++ b/src/packages/test-fixtures/src/providers/subscription-providers/subscription-providers.types.ts @@ -1,4 +1,5 @@ export type { + DeleteSubscription, FindSubscriptionBySubscriptionId, FindSubscriptionByUserId, MarkSubscriptionActive, diff --git a/src/packages/web-test-harness/src/bundle.types.ts b/src/packages/web-test-harness/src/bundle.types.ts index a623be2f6..d28e298d3 100644 --- a/src/packages/web-test-harness/src/bundle.types.ts +++ b/src/packages/web-test-harness/src/bundle.types.ts @@ -28,6 +28,7 @@ import type { CreateUserWithPasswordHash, CreateVerificationToken, DeleteArticle, + DeleteAllUserArticles, DeleteDeferredCancellationSchedule, DeleteTrialEndSchedule, DestroySession, @@ -69,6 +70,7 @@ import type { MarkSubscriptionPendingCancellation, MarkSummaryPending, OAuthModel, + RevokeAllUserOAuthTokens, FindOAuthClient, RegisterOAuthClient, ValidateOAuthRedirectUri, @@ -78,6 +80,7 @@ import type { SavedCard, SetPrimaryCard, PublishCancelSubscriptionCommand, + PublishDeleteAccountCommand, PublishExportUserDataCommand, PublishLinkSaved, PublishRecrawlLinkInitiated, @@ -204,6 +207,7 @@ export interface StripeSubscriptionsBundle { } export interface ArticleStoreBundle { + deleteAllUserArticles: DeleteAllUserArticles; findArticleById: FindArticleById; findArticleByUrl: FindArticleByUrl; findArticleUrlById: FindArticleUrlById; @@ -260,6 +264,7 @@ export interface EventsBundle { publishStaleCheckRequested: PublishStaleCheckRequested; publishUpdateFetchTimestamp: PublishUpdateFetchTimestamp; publishExportUserDataCommand: PublishExportUserDataCommand; + publishDeleteAccountCommand: PublishDeleteAccountCommand; publishCancelSubscriptionCommand: PublishCancelSubscriptionCommand; publishSubscriptionReactivated: PublishSubscriptionReactivated; } @@ -285,6 +290,7 @@ export interface FreshnessBundle { export interface OAuthBundle { oauthModel: OAuthModel; + revokeAllUserOAuthTokens: RevokeAllUserOAuthTokens; validateAccessToken: ValidateAccessToken; findClient: FindOAuthClient; validateRedirectUri: ValidateOAuthRedirectUri; From 5ba5cf724a4b3c7bea2ebd3039612dc5dacb54ba Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Sun, 5 Jul 2026 16:05:28 +0000 Subject: [PATCH 2/9] fix(hutch): wire publishDeleteAccountCommand into merged-in reader fixtures Merging origin/main brought in #871's new events fixtures in queue.reader.route.test.ts and view.route.test.ts, which predate this branch's now-required publishDeleteAccountCommand field on EventsBundle. The text merge is clean but the merged tree failed to type-check (TS2741). Add the missing property in its canonical EventsBundle order so the PR-merged-into-main tree that CI compiles passes again. Resolves CI failure (attempt #1). Co-authored-by: Fayner Brack Co-Authored-By: Claude Opus 4.8 (1M context) --- .../hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts | 1 + projects/hutch/src/runtime/web/pages/view/view.route.test.ts | 1 + 2 files changed, 2 insertions(+) diff --git a/projects/hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts b/projects/hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts index 4d6c92641..4dee3391c 100644 --- a/projects/hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/queue/queue.reader.route.test.ts @@ -112,6 +112,7 @@ describe("Queue routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, diff --git a/projects/hutch/src/runtime/web/pages/view/view.route.test.ts b/projects/hutch/src/runtime/web/pages/view/view.route.test.ts index 08a790338..12b175679 100644 --- a/projects/hutch/src/runtime/web/pages/view/view.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/view/view.route.test.ts @@ -150,6 +150,7 @@ describe("View routes", () => { publishStaleCheckRequested: fixture.events.publishStaleCheckRequested, publishUpdateFetchTimestamp: fixture.events.publishUpdateFetchTimestamp, publishExportUserDataCommand: fixture.events.publishExportUserDataCommand, + publishDeleteAccountCommand: fixture.events.publishDeleteAccountCommand, publishCancelSubscriptionCommand: fixture.events.publishCancelSubscriptionCommand, publishSubscriptionReactivated: fixture.events.publishSubscriptionReactivated, }, From cd906eeb697f7e222dc7ce36008b0bad7ac22dcd Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Sun, 5 Jul 2026 16:50:40 +0000 Subject: [PATCH 3/9] fix(hutch): address medium-priority review issues in account deletion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both fixes harden the delete-account async scrub against at-least-once redrives — the failure mode a compliance feature must converge through. M1 — Inbox .eml/body S3 objects were orphaned on a partial or redriven scrub. The scrub deleted the DynamoDB email rows (which hold the only pointers to the S3 objects; the keys carry no userId) and only then the S3 objects, so a failure in between lost the keys and left the raw message + rendered body in S3 permanently. Split the email store into a read-only listDeletionReferencesByUserId (run first, rows survive) and a void deleteAllEmailsByUserId (run last); the scrub now deletes the S3 objects and link rows before the email rows that index them, so a redrive re-derives the keys from the surviving rows. M2 — A redrive that re-ran the billing block re-cancelled an already- cancelled Stripe subscription, which returns a non-404 and poisoned the queue into the DLQ. Deleting the Stripe customer already cascades the cancellation (and detaches every card) and then blocks all further operations on the customer, so the explicit immediate-cancel was both redundant and the source of the poison. Removed it; deleteCustomer is 404-idempotent, so a redrive converges. cancelImmediately stays defined and unit-tested for future use. Added handler redrive tests proving both: an S3-delete failure re-derives the keys instead of orphaning them, and a local-row-delete failure re-runs the customer delete idempotently with no re-cancel. Co-authored-by: Fayner Brack Co-Authored-By: Claude Opus 4.8 (1M context) --- .../hutch/src/runtime/delete-account.main.ts | 2 +- .../delete-account-handler.test.ts | 93 ++++++++++++++++--- .../delete-account/delete-account-handler.ts | 38 ++++---- .../inbox-email/dynamodb-inbox-email.test.ts | 92 ++++++++++++++---- .../inbox-email/dynamodb-inbox-email.ts | 15 ++- .../domain/src/inbox/inbox-email.types.ts | 20 ++-- .../inbox-email/in-memory-inbox-email.test.ts | 68 +++++++++++--- .../inbox-email/in-memory-inbox-email.ts | 11 ++- 8 files changed, 269 insertions(+), 70 deletions(-) diff --git a/projects/hutch/src/runtime/delete-account.main.ts b/projects/hutch/src/runtime/delete-account.main.ts index e3659eaf5..60b7eea82 100644 --- a/projects/hutch/src/runtime/delete-account.main.ts +++ b/projects/hutch/src/runtime/delete-account.main.ts @@ -121,12 +121,12 @@ const revokeExternalIdpTokens = initNoopRevokeExternalIdpTokens({ logger }); export const handler = initDeleteAccountHandler({ findEmailByUserId: auth.findEmailByUserId, findSubscriptionByUserId: subscriptionProviders.findByUserId, - cancelStripeSubscription: stripeSubscriptions.cancelImmediately, deleteStripeCustomer: stripeSubscriptions.deleteCustomer, deleteSubscription: subscriptionProviders.deleteSubscription, deleteTrialEndSchedule: trialScheduler.deleteTrialEndSchedule, deleteDeferredCancellationSchedule: trialScheduler.deleteDeferredCancellationSchedule, deleteTrialFeedbackEmailSchedule: trialScheduler.deleteTrialFeedbackEmailSchedule, + listInboxDeletionReferences: inboxEmail.listDeletionReferencesByUserId, deleteAllInboxEmails: inboxEmail.deleteAllEmailsByUserId, deleteAllInboxLinks: inboxEmailLink.deleteAllLinksByUserId, tombstoneInboxAddresses: inboxAddress.tombstoneUserAddresses, diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts index 61ce097cd..911c0fc1a 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts @@ -61,7 +61,6 @@ function buildSubject() { const inboxLink = initInMemoryInboxEmailLink(); const inboxAddress = initInMemoryInboxAddress({ now: () => SEED_NOW }); - const cancelStripeCalls: Array<{ subscriptionId: string }> = []; const deleteCustomerCalls: Array<{ customerId: string }> = []; const deleteSubscriptionCalls: UserId[] = []; const trialEndCalls: UserId[] = []; @@ -81,16 +80,22 @@ function buildSubject() { // added here, so a batch can carry one poisoned record beside a healthy one. const articleDeleteThrowIds = new Set(); + // Test-only one-shot failures: each flag makes its step throw exactly once + // (self-clearing), so the record fails on the first delivery and its redrive + // then runs clean — the interleavings that exercise idempotency on retry. + const injectedFailures = { deleteSubscriptionOnce: false, deleteRawEmailOnce: false }; + const handler = initDeleteAccountHandler({ findEmailByUserId: auth.findEmailByUserId, findSubscriptionByUserId: subs.findByUserId, - cancelStripeSubscription: async ({ subscriptionId }: { subscriptionId: string }) => { - cancelStripeCalls.push({ subscriptionId }); - }, deleteStripeCustomer: async ({ customerId }: { customerId: string }) => { deleteCustomerCalls.push({ customerId }); }, deleteSubscription: async ({ userId }: { userId: UserId }) => { + if (injectedFailures.deleteSubscriptionOnce) { + injectedFailures.deleteSubscriptionOnce = false; + throw new Error("simulated deleteSubscription failure"); + } deleteSubscriptionCalls.push(userId); await subs.deleteSubscription({ userId }); }, @@ -103,10 +108,15 @@ function buildSubject() { deleteTrialFeedbackEmailSchedule: async ({ userId }: { userId: UserId }) => { trialFeedbackCalls.push(userId); }, + listInboxDeletionReferences: inboxEmail.listDeletionReferencesByUserId, deleteAllInboxEmails: inboxEmail.deleteAllEmailsByUserId, deleteAllInboxLinks: inboxLink.deleteAllLinksByUserId, tombstoneInboxAddresses: inboxAddress.tombstoneUserAddresses, deleteRawEmailObjects: async (keys: string[]) => { + if (injectedFailures.deleteRawEmailOnce) { + injectedFailures.deleteRawEmailOnce = false; + throw new Error("simulated deleteRawEmailObjects failure"); + } rawEmailDeleteArgs.push(keys); }, deleteEmailContentObjects: async (keys: string[]) => { @@ -149,7 +159,6 @@ function buildSubject() { inboxEmail, inboxLink, inboxAddress, - cancelStripeCalls, deleteCustomerCalls, deleteSubscriptionCalls, trialEndCalls, @@ -163,6 +172,12 @@ function buildSubject() { failArticleDeleteFor: (userId: UserId): void => { articleDeleteThrowIds.add(userId); }, + failDeleteSubscriptionOnce: (): void => { + injectedFailures.deleteSubscriptionOnce = true; + }, + failRawEmailDeleteOnce: (): void => { + injectedFailures.deleteRawEmailOnce = true; + }, }; } @@ -371,8 +386,8 @@ describe("delete-account handler", () => { // Password-reset tokens purged by the email captured before deletion. assert.deepEqual(s.passwordResetCalls, [victim.email]); - // Billing side effects fired for the active subscription. - assert.deepEqual(s.cancelStripeCalls, [{ subscriptionId: "sub_u1" }]); + // Billing side effects fired for the active subscription: deleting the + // Stripe customer cancels the subscription and detaches the cards. assert.deepEqual(s.deleteCustomerCalls, [{ customerId: "cus_u1" }]); assert.deepEqual(s.deleteSubscriptionCalls, [victim.userId]); assert.deepEqual(s.deleteExportsCalls, [victim.userId]); @@ -410,7 +425,7 @@ describe("delete-account handler", () => { assert.equal(await s.auth.findEmailByUserId(bystander.userId), bystander.email); }); - it("active subscription branch — cancels Stripe, deletes the customer, and drops the local row", async () => { + it("active subscription branch — deletes the Stripe customer (which cancels the sub) and drops the local row", async () => { const s = buildSubject(); const account = await seedAccount(s, { label: "active", @@ -421,7 +436,6 @@ describe("delete-account handler", () => { const result = await run(s, [{ messageId: "msg", body: bodyFor(account.userId) }]); assert.deepEqual(result.batchItemFailures, []); - assert.deepEqual(s.cancelStripeCalls, [{ subscriptionId: "sub_active" }]); assert.deepEqual(s.deleteCustomerCalls, [{ customerId: "cus_active" }]); assert.deepEqual(s.deleteSubscriptionCalls, [account.userId]); assert.equal(await s.subs.findByUserId(account.userId), undefined); @@ -438,7 +452,6 @@ describe("delete-account handler", () => { const result = await run(s, [{ messageId: "msg", body: bodyFor(account.userId) }]); assert.deepEqual(result.batchItemFailures, []); - assert.deepEqual(s.cancelStripeCalls, []); assert.deepEqual(s.deleteCustomerCalls, []); assert.deepEqual(s.deleteSubscriptionCalls, [account.userId]); assert.deepEqual(s.trialEndCalls, [account.userId]); @@ -457,7 +470,6 @@ describe("delete-account handler", () => { const result = await run(s, [{ messageId: "msg", body: bodyFor(account.userId) }]); assert.deepEqual(result.batchItemFailures, []); - assert.deepEqual(s.cancelStripeCalls, []); assert.deepEqual(s.deleteCustomerCalls, []); assert.deepEqual(s.deleteSubscriptionCalls, []); assert.deepEqual(s.trialEndCalls, [account.userId]); @@ -482,7 +494,7 @@ describe("delete-account handler", () => { assert.deepEqual(second.batchItemFailures, []); // Billing and password-reset only fired on the first, data-bearing run. - assert.deepEqual(s.cancelStripeCalls, [{ subscriptionId: "sub_again" }]); + assert.deepEqual(s.deleteCustomerCalls, [{ customerId: "cus_again" }]); assert.deepEqual(s.passwordResetCalls, [account.email]); }); @@ -524,4 +536,61 @@ describe("delete-account handler", () => { assert.deepEqual(s.revokeIdpCalls, [account.userId]); }); + + it("redrive after a failed local subscription delete re-runs the Stripe customer delete idempotently and converges", async () => { + const s = buildSubject(); + const account = await seedAccount(s, { + label: "redrive", + email: "redrive@example.com", + subscription: "active", + }); + + // First delivery: the Stripe customer delete succeeds, but dropping the + // local subscription row throws — so the record fails and redrives with the + // row still present, re-running the billing branch on the retry. + s.failDeleteSubscriptionOnce(); + const first = await run(s, [{ messageId: "msg-1", body: bodyFor(account.userId) }]); + assert.deepEqual(first.batchItemFailures, [{ itemIdentifier: "msg-1" }]); + + const second = await run(s, [{ messageId: "msg-2", body: bodyFor(account.userId) }]); + assert.deepEqual(second.batchItemFailures, []); + + // The customer delete ran on both deliveries; deleting an already-deleted + // Stripe customer is a 404-idempotent no-op, and there is no separate + // re-cancel of the already-cancelled subscription — the interleaving that + // used to throw a non-404 and poison the queue into the DLQ. + assert.deepEqual(s.deleteCustomerCalls, [ + { customerId: "cus_redrive" }, + { customerId: "cus_redrive" }, + ]); + assert.equal(await s.subs.findByUserId(account.userId), undefined); + assert.equal(await s.auth.findEmailByUserId(account.userId), null); + }); + + it("redrive after a failed raw-email S3 delete re-derives the keys from the surviving rows instead of orphaning them", async () => { + const s = buildSubject(); + const account = await seedAccount(s, { + label: "orphan", + email: "orphan@example.com", + subscription: "none", + }); + + // First delivery: the raw-email S3 delete throws. The email rows are read + // (not deleted) before the S3 delete, so they survive the failed record — + // the keys can be re-derived on the redrive rather than being lost. + s.failRawEmailDeleteOnce(); + const first = await run(s, [{ messageId: "msg-1", body: bodyFor(account.userId) }]); + assert.deepEqual(first.batchItemFailures, [{ itemIdentifier: "msg-1" }]); + assert.deepEqual(s.rawEmailDeleteArgs, []); + + const second = await run(s, [{ messageId: "msg-2", body: bodyFor(account.userId) }]); + assert.deepEqual(second.batchItemFailures, []); + + // The redrive re-read the surviving rows and re-derived the raw keys, so the + // .eml objects are deleted rather than left orphaned in S3, and only then + // were the rows removed. + assert.equal(s.rawEmailDeleteArgs.length, 1); + assert.deepEqual(sorted(s.rawEmailDeleteArgs[0]), sorted(account.rawKeys)); + assert.equal((await s.inboxEmail.listEmailsByUserId(account.userId)).length, 0); + }); }); diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts index 9a8e7b71a..a5e402d47 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts @@ -23,10 +23,7 @@ import type { DeleteSubscription, FindSubscriptionByUserId, } from "@packages/provider-contracts/subscription-providers"; -import type { - CancelSubscriptionImmediately, - DeleteCustomer, -} from "@packages/provider-contracts/stripe-subscriptions"; +import type { DeleteCustomer } from "@packages/provider-contracts/stripe-subscriptions"; import type { DeleteDeferredCancellationSchedule, DeleteTrialEndSchedule, @@ -43,12 +40,12 @@ import type { RevokeExternalIdpTokens } from "./revoke-external-idp-tokens"; export interface DeleteAccountHandlerDependencies { findEmailByUserId: FindEmailByUserId; findSubscriptionByUserId: FindSubscriptionByUserId; - cancelStripeSubscription: CancelSubscriptionImmediately; deleteStripeCustomer: DeleteCustomer; deleteSubscription: DeleteSubscription; deleteTrialEndSchedule: DeleteTrialEndSchedule; deleteDeferredCancellationSchedule: DeleteDeferredCancellationSchedule; deleteTrialFeedbackEmailSchedule: DeleteTrialFeedbackEmailSchedule; + listInboxDeletionReferences: InboxEmailStore["listDeletionReferencesByUserId"]; deleteAllInboxEmails: InboxEmailStore["deleteAllEmailsByUserId"]; deleteAllInboxLinks: InboxEmailLinkStore["deleteAllLinksByUserId"]; tombstoneInboxAddresses: InboxAddressStore["tombstoneUserAddresses"]; @@ -80,14 +77,18 @@ async function processCommand( // findEmailByUserId reads. const email = await deps.findEmailByUserId(userId); - // Billing first: cancel any live subscription and delete the Stripe customer - // (which detaches every card) before dropping the local row. Founding members - // have no row; trialing users have a row but no subscriptionId/customerId. + // Billing first: delete the Stripe customer — which immediately cancels any + // live subscription and detaches every card — then drop the local row. + // Deleting the customer is the ONLY Stripe write: Stripe cascades the + // cancellation and then blocks further operations on the customer, so a + // separate immediate-cancel would be redundant and, on an at-least-once + // redrive, a non-idempotent re-cancel of an already-cancelled subscription + // that throws and poisons the queue into the DLQ. deleteCustomer instead + // treats an already-gone customer as success, so a redrive converges. + // Founding members have no row; trialing users have a row but no customerId + // (a local trial with no Stripe object). const subscription = await deps.findSubscriptionByUserId(userId); if (subscription) { - if (subscription.subscriptionId) { - await deps.cancelStripeSubscription({ subscriptionId: subscription.subscriptionId }); - } if (subscription.customerId) { await deps.deleteStripeCustomer({ customerId: subscription.customerId }); } @@ -100,16 +101,21 @@ async function processCommand( await deps.deleteDeferredCancellationSchedule({ userId }); await deps.deleteTrialFeedbackEmailSchedule({ userId }); - // Inbox: delete the email rows (returns their ids + S3 keys), then the link - // rows keyed off those ids (that table has no userId index), then the S3 - // objects, then tombstone the forwarding addresses (kept reserved, PII + // Inbox: read the pointers the email rows hold (S3 keys + link message-ids) + // while the rows still exist, then delete the S3 objects and link rows, and + // only then the email rows themselves. The rows are the sole index for those + // S3 objects (whose keys carry no userId) and link rows (no userId index), so + // deleting the rows last lets an at-least-once redrive re-derive the pointers + // from the still-present rows instead of orphaning the raw `.eml`/body objects + // in S3. Finally tombstone the forwarding addresses (kept reserved, PII // stripped, so a freed hash can never be re-minted to leak another user's // mail). const { receivedAtMessageIds, rawEmailS3Keys, bodyS3Keys } = - await deps.deleteAllInboxEmails(userId); - await deps.deleteAllInboxLinks(userId, receivedAtMessageIds); + await deps.listInboxDeletionReferences(userId); await deps.deleteRawEmailObjects(rawEmailS3Keys); await deps.deleteEmailContentObjects(bodyS3Keys); + await deps.deleteAllInboxLinks(userId, receivedAtMessageIds); + await deps.deleteAllInboxEmails(userId); await deps.tombstoneInboxAddresses(userId); // Saved articles and the remaining per-user stores. diff --git a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.test.ts b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.test.ts index 8cc5cafbe..e9667f0aa 100644 --- a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.test.ts +++ b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.test.ts @@ -266,8 +266,8 @@ describe("initDynamoDbInboxEmail", () => { }); }); - describe("deleteAllEmailsByUserId", () => { - it("drains the user's emails, returning raw and body keys and deleting each row", async () => { + describe("listDeletionReferencesByUserId", () => { + it("returns raw and body keys and message ids for the user without deleting any row", async () => { const { client, commands } = createPaginatedClient([ { rows: [ @@ -289,22 +289,19 @@ describe("initDynamoDbInboxEmail", () => { ]); const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); - const result = await store.deleteAllEmailsByUserId(USER); + const refs = await store.listDeletionReferencesByUserId(USER); - expect(result.receivedAtMessageIds).toEqual([ + expect(refs.receivedAtMessageIds).toEqual([ "2026-06-23T09:00:00.000Z#", "2026-06-23T08:00:00.000Z#", ]); - expect(result.rawEmailS3Keys).toEqual(["inbound/a", "inbound/b"]); - expect(result.bodyS3Keys).toEqual(["content/a/content.html"]); + expect(refs.rawEmailS3Keys).toEqual(["inbound/a", "inbound/b"]); + expect(refs.bodyS3Keys).toEqual(["content/a/content.html"]); const query = commands.find((c) => c.name === "QueryCommand"); expect(query?.input.KeyConditionExpression).toBe("userId = :uid"); expect(query?.input.ExpressionAttributeValues).toEqual({ ":uid": USER }); - const deletes = commands.filter((c) => c.name === "DeleteCommand"); - expect(deletes.map((c) => c.input.Key)).toEqual([ - { userId: USER, receivedAtMessageId: "2026-06-23T09:00:00.000Z#" }, - { userId: USER, receivedAtMessageId: "2026-06-23T08:00:00.000Z#" }, - ]); + // Read-only: the rows survive so a redrive can re-derive the keys. + expect(commands.some((c) => c.name === "DeleteCommand")).toBe(false); }); it("paginates the query, feeding each page's key back as ExclusiveStartKey", async () => { @@ -323,7 +320,7 @@ describe("initDynamoDbInboxEmail", () => { ]); const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); - const result = await store.deleteAllEmailsByUserId(USER); + const refs = await store.listDeletionReferencesByUserId(USER); const queries = commands.filter((c) => c.name === "QueryCommand"); expect(queries).toHaveLength(2); @@ -332,16 +329,16 @@ describe("initDynamoDbInboxEmail", () => { userId: "user-1", receivedAtMessageId: "r1", }); - expect(result.rawEmailS3Keys).toEqual(["inbound/1", "inbound/2"]); - expect(result.bodyS3Keys).toEqual([]); - expect(commands.filter((c) => c.name === "DeleteCommand")).toHaveLength(2); + expect(refs.rawEmailS3Keys).toEqual(["inbound/1", "inbound/2"]); + expect(refs.bodyS3Keys).toEqual([]); + expect(commands.some((c) => c.name === "DeleteCommand")).toBe(false); }); - it("returns empty key lists and issues no delete when the user has no emails", async () => { + it("returns empty lists and issues no delete when the user has no emails", async () => { const { client, commands } = createPaginatedClient([{ rows: [] }]); const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); - expect(await store.deleteAllEmailsByUserId(USER)).toEqual({ + expect(await store.listDeletionReferencesByUserId(USER)).toEqual({ receivedAtMessageIds: [], rawEmailS3Keys: [], bodyS3Keys: [], @@ -349,4 +346,65 @@ describe("initDynamoDbInboxEmail", () => { expect(commands.some((c) => c.name === "DeleteCommand")).toBe(false); }); }); + + describe("deleteAllEmailsByUserId", () => { + it("deletes every row the user owns", async () => { + const { client, commands } = createPaginatedClient([ + { + rows: [ + emailRow({ receivedAtMessageId: "2026-06-23T09:00:00.000Z#" }), + emailRow({ receivedAtMessageId: "2026-06-23T08:00:00.000Z#" }), + ], + }, + ]); + const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); + + await store.deleteAllEmailsByUserId(USER); + + const query = commands.find((c) => c.name === "QueryCommand"); + expect(query?.input.KeyConditionExpression).toBe("userId = :uid"); + expect(query?.input.ExpressionAttributeValues).toEqual({ ":uid": USER }); + const deletes = commands.filter((c) => c.name === "DeleteCommand"); + expect(deletes.map((c) => c.input.Key)).toEqual([ + { userId: USER, receivedAtMessageId: "2026-06-23T09:00:00.000Z#" }, + { userId: USER, receivedAtMessageId: "2026-06-23T08:00:00.000Z#" }, + ]); + }); + + it("paginates, deleting each page's rows and feeding its key back as ExclusiveStartKey", async () => { + const { client, commands } = createPaginatedClient([ + { + rows: [emailRow({ receivedAtMessageId: "r1" })], + lastEvaluatedKey: { userId: "user-1", receivedAtMessageId: "r1" }, + }, + { + rows: [emailRow({ receivedAtMessageId: "r2" })], + }, + ]); + const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); + + await store.deleteAllEmailsByUserId(USER); + + const queries = commands.filter((c) => c.name === "QueryCommand"); + expect(queries).toHaveLength(2); + expect(queries[1]?.input.ExclusiveStartKey).toEqual({ + userId: "user-1", + receivedAtMessageId: "r1", + }); + const deletes = commands.filter((c) => c.name === "DeleteCommand"); + expect(deletes.map((c) => c.input.Key)).toEqual([ + { userId: USER, receivedAtMessageId: "r1" }, + { userId: USER, receivedAtMessageId: "r2" }, + ]); + }); + + it("issues no delete when the user has no emails", async () => { + const { client, commands } = createPaginatedClient([{ rows: [] }]); + const store = initDynamoDbInboxEmail({ client, tableName: TABLE }); + + await store.deleteAllEmailsByUserId(USER); + + expect(commands.some((c) => c.name === "DeleteCommand")).toBe(false); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.ts b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.ts index de8efb675..a321c9851 100644 --- a/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.ts +++ b/projects/hutch/src/runtime/providers/inbox-email/dynamodb-inbox-email.ts @@ -65,7 +65,7 @@ export function initDynamoDbInboxEmail(deps: { }, getEmail: async ({ userId, receivedAtMessageId }) => table.get({ userId, receivedAtMessageId }), - deleteAllEmailsByUserId: async (userId) => { + listDeletionReferencesByUserId: async (userId) => { const receivedAtMessageIds: string[] = []; const rawEmailS3Keys: string[] = []; const bodyS3Keys: string[] = []; @@ -81,6 +81,18 @@ export function initDynamoDbInboxEmail(deps: { rawEmailS3Keys.push(row.rawEmailS3Key); if (row.bodyS3Key !== undefined) bodyS3Keys.push(row.bodyS3Key); } + }, + ); + return { receivedAtMessageIds, rawEmailS3Keys, bodyS3Keys }; + }, + deleteAllEmailsByUserId: async (userId) => { + await forEachQueryPage( + table, + { + KeyConditionExpression: "userId = :uid", + ExpressionAttributeValues: { ":uid": userId }, + }, + async (rows) => { await Promise.all( rows.map((row) => table.delete({ @@ -90,7 +102,6 @@ export function initDynamoDbInboxEmail(deps: { ); }, ); - return { receivedAtMessageIds, rawEmailS3Keys, bodyS3Keys }; }, }; } diff --git a/src/packages/domain/src/inbox/inbox-email.types.ts b/src/packages/domain/src/inbox/inbox-email.types.ts index e52ed109b..2d0114d15 100644 --- a/src/packages/domain/src/inbox/inbox-email.types.ts +++ b/src/packages/domain/src/inbox/inbox-email.types.ts @@ -35,15 +35,21 @@ export interface InboxEmailStore { userId: UserId; receivedAtMessageId: string; }) => Promise; - /** Account-deletion primitive: drains every email the user owns, deleting each - * row and returning the S3 keys so the caller drives object deletion. The raw - * `.eml` keys (always present) and the rendered-body keys (only on `received` - * rows) are returned separately because they live in different buckets. - * `receivedAtMessageIds` are returned so the caller can purge the matching - * link rows, whose table has no `userId` index to enumerate on its own. */ - deleteAllEmailsByUserId: (userId: UserId) => Promise<{ + /** Account-deletion read pass: enumerate every email the user owns WITHOUT + * deleting, returning the pointers those rows hold — the raw `.eml` and + * rendered-body S3 keys (different buckets, so returned apart; the body only on + * `received` rows) and the link message-ids (the links table has no `userId` + * index to enumerate on its own). The email rows are the sole index for all of + * these, so the scrub deletes the S3 objects and link rows first and the email + * rows last: an at-least-once redrive then re-derives the pointers from the + * still-present rows instead of orphaning the raw `.eml`/body objects in S3. */ + listDeletionReferencesByUserId: (userId: UserId) => Promise<{ receivedAtMessageIds: string[]; rawEmailS3Keys: string[]; bodyS3Keys: string[]; }>; + /** Account-deletion write pass: delete every email row the user owns, run after + * the S3 objects and link rows those rows point at are gone. Idempotent — + * already-absent rows are a no-op — so a redrive converges, never throws. */ + deleteAllEmailsByUserId: (userId: UserId) => Promise; } diff --git a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.test.ts b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.test.ts index 40385a19b..f0e1ddee8 100644 --- a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.test.ts +++ b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.test.ts @@ -94,8 +94,8 @@ describe("initInMemoryInboxEmail", () => { ).toBeUndefined(); }); - describe("deleteAllEmailsByUserId", () => { - it("deletes the owner's emails and returns their raw and body S3 keys", async () => { + describe("listDeletionReferencesByUserId", () => { + it("returns the owner's raw and body S3 keys and message ids without deleting", async () => { const store = initInMemoryInboxEmail(); await store.putEmail( makeEntry({ @@ -113,14 +113,19 @@ describe("initInMemoryInboxEmail", () => { }), ); - const { rawEmailS3Keys, bodyS3Keys } = await store.deleteAllEmailsByUserId(owner); + const refs = await store.listDeletionReferencesByUserId(owner); - expect(rawEmailS3Keys).toEqual(["inbound/a", "inbound/b"]); - expect(bodyS3Keys).toEqual(["content/a/content.html"]); - expect(await store.listEmailsByUserId(owner)).toHaveLength(0); + expect(refs.receivedAtMessageIds).toEqual([ + "2026-06-23T09:00:00.000Z#", + "2026-06-23T08:00:00.000Z#", + ]); + expect(refs.rawEmailS3Keys).toEqual(["inbound/a", "inbound/b"]); + expect(refs.bodyS3Keys).toEqual(["content/a/content.html"]); + // The read pass leaves every row in place so a redrive re-derives the keys. + expect(await store.listEmailsByUserId(owner)).toHaveLength(2); }); - it("leaves another user's emails intact", async () => { + it("scopes the references to the owner, ignoring another user's emails", async () => { const store = initInMemoryInboxEmail(); await store.putEmail(makeEntry({ rawEmailS3Key: "inbound/owner" })); await store.putEmail( @@ -131,20 +136,59 @@ describe("initInMemoryInboxEmail", () => { }), ); - const { rawEmailS3Keys } = await store.deleteAllEmailsByUserId(owner); + const refs = await store.listDeletionReferencesByUserId(owner); - expect(rawEmailS3Keys).toEqual(["inbound/owner"]); - expect(await store.listEmailsByUserId(otherUser)).toHaveLength(1); + expect(refs.rawEmailS3Keys).toEqual(["inbound/owner"]); }); - it("returns empty key lists for a user with no emails", async () => { + it("returns empty lists for a user with no emails", async () => { const store = initInMemoryInboxEmail(); - expect(await store.deleteAllEmailsByUserId(owner)).toEqual({ + expect(await store.listDeletionReferencesByUserId(owner)).toEqual({ receivedAtMessageIds: [], rawEmailS3Keys: [], bodyS3Keys: [], }); }); }); + + describe("deleteAllEmailsByUserId", () => { + it("deletes every email the owner owns", async () => { + const store = initInMemoryInboxEmail(); + await store.putEmail( + makeEntry({ receivedAtMessageId: "2026-06-23T09:00:00.000Z#" }), + ); + await store.putEmail( + makeEntry({ receivedAtMessageId: "2026-06-23T08:00:00.000Z#" }), + ); + + await store.deleteAllEmailsByUserId(owner); + + expect(await store.listEmailsByUserId(owner)).toHaveLength(0); + }); + + it("leaves another user's emails intact", async () => { + const store = initInMemoryInboxEmail(); + await store.putEmail(makeEntry()); + await store.putEmail( + makeEntry({ + userId: otherUser, + receivedAtMessageId: "2026-06-23T10:00:00.000Z#", + }), + ); + + await store.deleteAllEmailsByUserId(owner); + + expect(await store.listEmailsByUserId(owner)).toHaveLength(0); + expect(await store.listEmailsByUserId(otherUser)).toHaveLength(1); + }); + + it("is a no-op for a user with no emails", async () => { + const store = initInMemoryInboxEmail(); + + await store.deleteAllEmailsByUserId(owner); + + expect(await store.listEmailsByUserId(owner)).toHaveLength(0); + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.ts b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.ts index 76ef03670..16447fffe 100644 --- a/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.ts +++ b/src/packages/test-fixtures/src/providers/inbox-email/in-memory-inbox-email.ts @@ -21,18 +21,23 @@ export function initInMemoryInboxEmail(): InboxEmailStore { ), getEmail: async ({ userId, receivedAtMessageId }) => rows.get(keyOf(userId, receivedAtMessageId)), - deleteAllEmailsByUserId: async (userId) => { + listDeletionReferencesByUserId: async (userId) => { const receivedAtMessageIds: string[] = []; const rawEmailS3Keys: string[] = []; const bodyS3Keys: string[] = []; - for (const [key, row] of rows) { + for (const row of rows.values()) { if (row.userId !== userId) continue; receivedAtMessageIds.push(row.receivedAtMessageId); rawEmailS3Keys.push(row.rawEmailS3Key); if (row.bodyS3Key !== undefined) bodyS3Keys.push(row.bodyS3Key); - rows.delete(key); } return { receivedAtMessageIds, rawEmailS3Keys, bodyS3Keys }; }, + deleteAllEmailsByUserId: async (userId) => { + for (const [key, row] of rows) { + if (row.userId !== userId) continue; + rows.delete(key); + } + }, }; } From 10b7e0806cbad6d17b347421df7ae2ec13c7475f Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Mon, 6 Jul 2026 07:51:19 +0000 Subject: [PATCH 4/9] fix(hutch): close deletion PII-erasure gaps and guard SIWA revocation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address the App Store 5.1.1(v) compliance-completeness review: - Password-reset scrub missed mixed-case emails. Rows were stored with the raw address (bare z.email()) but the deletion scrub filters the normalized users-table PK, and that table has no TTL — so a `John@Example.com` reset survived forever. Normalize on write and in the delete filter. - Verification tokens were never scrubbed on deletion. Add deleteTokensByUserId, wire it into the delete-account worker (+ IAM grant + env), mirror the fixture. - Pending-signup rows (no TTL) kept a deleted user's {email,userId} forever. Add deleteByUserId, wire it into the worker (+ IAM grant + env), mirror the fixture. - Add a fail-closed guard coupling "Sign in with Apple reachable by a normal user" to "Apple refresh_token persisted", so CI turns red the day SIWA is un-gated without wiring the real Apple /auth/revoke the worker's IdP seam still no-ops. Strengthen the seam comment and correct the false "server already revoked everything" Swift comment. - Soften the /account/delete "immediately unusable" comment to match the async identity-row erasure. The iOS/native scope items (dead delete-account apparatus, post-webview logout) are left for an iOS-side change: they need Swift compiled/tested (this CI can't) and the dead-vs-web-path resolution is a product decision. Co-authored-by: Fayner Brack Co-Authored-By: Claude Opus 4.8 (1M context) --- projects/hutch/src/infra/index.ts | 4 ++ .../hutch/src/runtime/delete-account.main.ts | 15 ++++++ .../delete-account-handler.test.ts | 15 ++++++ .../delete-account/delete-account-handler.ts | 12 +++++ .../revoke-external-idp-tokens.ts | 7 ++- .../providers/apple-auth/apple-token.ts | 9 +++- .../dynamodb-email-verification.test.ts | 37 ++++++++++++++ .../dynamodb-email-verification.ts | 32 +++++++++++- .../dynamodb-password-reset.test.ts | 20 ++++++++ .../password-reset/dynamodb-password-reset.ts | 9 +++- .../dynamodb-pending-signup.test.ts | 51 +++++++++++++++++++ .../pending-signup/dynamodb-pending-signup.ts | 31 +++++++++++ .../src/runtime/web/auth/auth.route.test.ts | 33 ++++++++++++ .../runtime/web/pages/account/account.page.ts | 17 ++++--- .../App/AffordancePresentation.swift | 7 ++- .../src/email-verification.ts | 6 +++ .../provider-contracts/src/pending-signup.ts | 5 ++ .../in-memory-email-verification.test.ts | 18 +++++++ .../in-memory-email-verification.ts | 10 +++- .../in-memory-password-reset.test.ts | 15 ++++++ .../in-memory-password-reset.ts | 8 ++- .../in-memory-pending-signup.test.ts | 25 +++++++++ .../in-memory-pending-signup.ts | 9 ++++ 23 files changed, 377 insertions(+), 18 deletions(-) diff --git a/projects/hutch/src/infra/index.ts b/projects/hutch/src/infra/index.ts index 3e183b36a..18a034374 100644 --- a/projects/hutch/src/infra/index.ts +++ b/projects/hutch/src/infra/index.ts @@ -544,6 +544,8 @@ const deleteAccountDynamodb = new HutchDynamoDBAccess("delete-account-dynamodb", { arn: storage.inboxEmailLinksTable.arn, includeIndexes: false }, { arn: storage.inboxAddressesTable.arn, includeIndexes: true }, { arn: storage.passwordResetTokensTable.arn, includeIndexes: false }, + { arn: storage.verificationTokensTable.arn, includeIndexes: false }, + { arn: storage.pendingSignupsTable.arn, includeIndexes: false }, ], actions: [ "dynamodb:GetItem", @@ -611,6 +613,8 @@ const deleteAccountLambda = new HutchLambda("delete-account", { DYNAMODB_INBOX_EMAIL_LINKS_TABLE: storage.inboxEmailLinksTable.name, DYNAMODB_INBOX_ADDRESSES_TABLE: storage.inboxAddressesTable.name, DYNAMODB_PASSWORD_RESET_TOKENS_TABLE: storage.passwordResetTokensTable.name, + DYNAMODB_VERIFICATION_TOKENS_TABLE: storage.verificationTokensTable.name, + DYNAMODB_PENDING_SIGNUPS_TABLE: storage.pendingSignupsTable.name, RAW_EMAIL_BUCKET_NAME: rawEmailBucketName, CONTENT_BUCKET_NAME: contentBucketName, USER_EXPORT_BUCKET_NAME: userExportBucketName, diff --git a/projects/hutch/src/runtime/delete-account.main.ts b/projects/hutch/src/runtime/delete-account.main.ts index 60b7eea82..7401ad74c 100644 --- a/projects/hutch/src/runtime/delete-account.main.ts +++ b/projects/hutch/src/runtime/delete-account.main.ts @@ -19,6 +19,8 @@ import { initS3DeleteObjects } from "./providers/inbox-email/s3-delete-objects"; import { initDynamoDbInboxAddress } from "./providers/inbox-address/dynamodb-inbox-address"; import { initS3UserDataExport } from "./providers/user-data-export/s3-user-data-export"; import { initDynamoDbPasswordReset } from "./providers/password-reset/dynamodb-password-reset"; +import { initDynamoDbEmailVerification } from "./providers/email-verification/dynamodb-email-verification"; +import { initDynamoDbPendingSignup } from "./providers/pending-signup/dynamodb-pending-signup"; import { initNoopRevokeExternalIdpTokens } from "./delete-account/revoke-external-idp-tokens"; import { initDeleteAccountHandler } from "./delete-account/delete-account-handler"; @@ -116,6 +118,17 @@ const passwordReset = initDynamoDbPasswordReset({ tableName: requireEnv("DYNAMODB_PASSWORD_RESET_TOKENS_TABLE"), }); +const emailVerification = initDynamoDbEmailVerification({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_VERIFICATION_TOKENS_TABLE"), +}); + +const pendingSignup = initDynamoDbPendingSignup({ + client: dynamoClient, + tableName: requireEnv("DYNAMODB_PENDING_SIGNUPS_TABLE"), + logger, +}); + const revokeExternalIdpTokens = initNoopRevokeExternalIdpTokens({ logger }); export const handler = initDeleteAccountHandler({ @@ -138,6 +151,8 @@ export const handler = initDeleteAccountHandler({ deleteOnboarding: onboarding.deleteOnboarding, deleteUserExports, deletePasswordResetTokensByEmail: passwordReset.deleteTokensByEmail, + deleteVerificationTokensByUserId: emailVerification.deleteTokensByUserId, + deletePendingSignupsByUserId: pendingSignup.deleteByUserId, revokeExternalIdpTokens, revokeAllUserOAuthTokens, destroyUserSessions: auth.destroyUserSessions, diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts index 911c0fc1a..8a6f7cba6 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts @@ -70,6 +70,8 @@ function buildSubject() { const bodyEmailDeleteArgs: string[][] = []; const deleteExportsCalls: UserId[] = []; const passwordResetCalls: string[] = []; + const verificationTokenDeleteCalls: UserId[] = []; + const pendingSignupDeleteCalls: UserId[] = []; const revokeIdpCalls: UserId[] = []; // The noop is exercised through this wrapper so its own logging line stays @@ -137,6 +139,12 @@ function buildSubject() { deletePasswordResetTokensByEmail: async (email: string) => { passwordResetCalls.push(email); }, + deleteVerificationTokensByUserId: async (userId: UserId) => { + verificationTokenDeleteCalls.push(userId); + }, + deletePendingSignupsByUserId: async (userId: UserId) => { + pendingSignupDeleteCalls.push(userId); + }, revokeExternalIdpTokens: async (userId: UserId) => { revokeIdpCalls.push(userId); await noopRevoke(userId); @@ -168,6 +176,8 @@ function buildSubject() { bodyEmailDeleteArgs, deleteExportsCalls, passwordResetCalls, + verificationTokenDeleteCalls, + pendingSignupDeleteCalls, revokeIdpCalls, failArticleDeleteFor: (userId: UserId): void => { articleDeleteThrowIds.add(userId); @@ -386,6 +396,11 @@ describe("delete-account handler", () => { // Password-reset tokens purged by the email captured before deletion. assert.deepEqual(s.passwordResetCalls, [victim.email]); + // Verification tokens and abandoned-checkout pending-signup rows scrubbed by + // userId — the remnant stores this PR closes. + assert.deepEqual(s.verificationTokenDeleteCalls, [victim.userId]); + assert.deepEqual(s.pendingSignupDeleteCalls, [victim.userId]); + // Billing side effects fired for the active subscription: deleting the // Stripe customer cancels the subscription and detaches the cards. assert.deepEqual(s.deleteCustomerCalls, [{ customerId: "cus_u1" }]); diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts index a5e402d47..5d050ce78 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts @@ -19,6 +19,8 @@ import type { DeleteDigestByUser } from "@packages/provider-contracts/digest-que import type { DeleteReaderReadyState } from "@packages/provider-contracts/reader-ready-state"; import type { DeleteOnboarding } from "@packages/provider-contracts/ios-onboarding-signal"; import type { DeletePasswordResetTokensByEmail } from "@packages/provider-contracts/password-reset"; +import type { DeleteVerificationTokensByUserId } from "@packages/provider-contracts/email-verification"; +import type { DeletePendingSignupsByUserId } from "@packages/provider-contracts/pending-signup"; import type { DeleteSubscription, FindSubscriptionByUserId, @@ -57,6 +59,8 @@ export interface DeleteAccountHandlerDependencies { deleteOnboarding: DeleteOnboarding; deleteUserExports: DeleteUserExports; deletePasswordResetTokensByEmail: DeletePasswordResetTokensByEmail; + deleteVerificationTokensByUserId: DeleteVerificationTokensByUserId; + deletePendingSignupsByUserId: DeletePendingSignupsByUserId; revokeExternalIdpTokens: RevokeExternalIdpTokens; revokeAllUserOAuthTokens: RevokeAllUserOAuthTokens; destroyUserSessions: DestroyUserSessions; @@ -128,6 +132,14 @@ async function processCommand( await deps.deletePasswordResetTokensByEmail(email); } + // Signup/verification remnants keyed by userId (both scanned, both no-op when + // absent): the email-verification token (a `{userId, email}` row the TTL would + // otherwise keep for the verification window) and any abandoned-checkout + // pending-signup rows (that table has no TTL, so they'd keep `{email, userId}` + // forever). + await deps.deleteVerificationTokensByUserId(userId); + await deps.deletePendingSignupsByUserId(userId); + // Credentials last: revoke external IdP tokens, kill OAuth grants and every // session, then delete the identity row (and its Gmail uniqueness claim). await deps.revokeExternalIdpTokens(userId); diff --git a/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts index 84a1ce9ce..88da2b7d3 100644 --- a/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts +++ b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts @@ -11,8 +11,11 @@ export type RevokeExternalIdpTokens = (userId: UserId) => Promise; * is nothing to revoke yet. This no-op is the injectable seam: when SIWA is * extended to persist the refresh token, its runtime implementation replaces * this at the composition root and the worker is unchanged. Apple *requires* - * revocation once both SIWA and account deletion ship, so this must be swapped - * for the real call in the same change that persists the token. */ + * revocation once both SIWA and account deletion ship (App Store 5.1.1(v)), so + * this must be swapped for the real POST https://appleid.apple.com/auth/revoke in + * the same change that persists the token. The "locks Sign in with Apple to Apple + * account-deletion revocation" guard in auth.route.test.ts fails CI if SIWA is + * ever un-gated without that wiring. */ export function initNoopRevokeExternalIdpTokens(deps: { logger: HutchLogger; }): RevokeExternalIdpTokens { diff --git a/projects/hutch/src/runtime/providers/apple-auth/apple-token.ts b/projects/hutch/src/runtime/providers/apple-auth/apple-token.ts index 5f9ee6ea1..6fbc33b2a 100644 --- a/projects/hutch/src/runtime/providers/apple-auth/apple-token.ts +++ b/projects/hutch/src/runtime/providers/apple-auth/apple-token.ts @@ -2,7 +2,14 @@ import { z } from "zod"; import { AppleIdSchema } from "@packages/provider-contracts/apple-auth"; import type { ExchangeAppleCode } from "@packages/provider-contracts/apple-auth"; -const AppleTokenResponse = z.object({ +/** Apple's token-exchange response. Today only `id_token` is parsed — Apple's + * `refresh_token` is deliberately discarded because nothing consumes it yet. When + * Sign in with Apple ships to real users, account deletion MUST revoke the Apple + * grant, which means persisting `refresh_token` here (see the + * `siwa-deletion-compliance` guard in auth.route.test.ts and + * revoke-external-idp-tokens.ts). Exported so that guard can detect when this + * schema starts persisting the token. */ +export const AppleTokenResponse = z.object({ id_token: z.string(), }); diff --git a/projects/hutch/src/runtime/providers/email-verification/dynamodb-email-verification.test.ts b/projects/hutch/src/runtime/providers/email-verification/dynamodb-email-verification.test.ts index f191cbcc5..f20fa241c 100644 --- a/projects/hutch/src/runtime/providers/email-verification/dynamodb-email-verification.test.ts +++ b/projects/hutch/src/runtime/providers/email-verification/dynamodb-email-verification.test.ts @@ -121,4 +121,41 @@ describe("initDynamoDbEmailVerification", () => { await expect(initVerification(client).verifyEmailToken(TOKEN)).rejects.toThrow(failure); }); }); + + describe("deleteTokensByUserId", () => { + it("scans by userId across pages and deletes each token by its primary key", async () => { + const pages = [ + { Items: [{ token: "t1" }, { token: "t2" }], LastEvaluatedKey: { token: "t2" } }, + { Items: [{ token: "t3" }] }, + ]; + let call = 0; + const { client, commands } = createFakeClient({ ScanCommand: () => pages[call++] }); + + await initVerification(client).deleteTokensByUserId(USER); + + const scans = commands.filter((c) => c.name === "ScanCommand"); + expect(scans).toHaveLength(2); + expect(scans[0]?.input.FilterExpression).toBe("userId = :u"); + expect(scans[0]?.input.ExpressionAttributeValues).toEqual({ ":u": USER }); + expect(scans[0]?.input.ProjectionExpression).toBe("#tk"); + expect(scans[0]?.input.ExpressionAttributeNames).toEqual({ "#tk": "token" }); + expect(scans[1]?.input.ExclusiveStartKey).toEqual({ token: "t2" }); + + const deletes = commands.filter((c) => c.name === "DeleteCommand"); + expect(deletes.map((d) => d.input.Key)).toEqual([ + { token: "t1" }, + { token: "t2" }, + { token: "t3" }, + ]); + }); + + it("issues no deletes when the user has no verification tokens", async () => { + const { client, commands } = createFakeClient({ ScanCommand: { Items: [] } }); + + await initVerification(client).deleteTokensByUserId(USER); + + expect(commands.filter((c) => c.name === "ScanCommand")).toHaveLength(1); + expect(commands.filter((c) => c.name === "DeleteCommand")).toHaveLength(0); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/email-verification/dynamodb-email-verification.ts b/projects/hutch/src/runtime/providers/email-verification/dynamodb-email-verification.ts index e789a2a4b..6ca1fc693 100644 --- a/projects/hutch/src/runtime/providers/email-verification/dynamodb-email-verification.ts +++ b/projects/hutch/src/runtime/providers/email-verification/dynamodb-email-verification.ts @@ -8,6 +8,7 @@ import { z } from "zod"; import { UserIdSchema } from "@packages/domain/user"; import type { CreateVerificationToken, + DeleteVerificationTokensByUserId, VerifyEmailToken, } from "@packages/provider-contracts/email-verification"; import { VerificationTokenSchema } from "@packages/provider-contracts/email-verification"; @@ -24,12 +25,17 @@ const VerificationRow = z.object({ expiresAt: z.number(), }); +const TokenKeyRow = z.object({ + token: z.string(), +}); + export function initDynamoDbEmailVerification(deps: { client: DynamoDBDocumentClient; tableName: string; }): { createVerificationToken: CreateVerificationToken; verifyEmailToken: VerifyEmailToken; + deleteTokensByUserId: DeleteVerificationTokensByUserId; } { const table = defineDynamoTable({ client: deps.client, @@ -37,6 +43,12 @@ export function initDynamoDbEmailVerification(deps: { schema: VerificationRow, }); + const tokenKeyTable = defineDynamoTable({ + client: deps.client, + tableName: deps.tableName, + schema: TokenKeyRow, + }); + const createVerificationToken: CreateVerificationToken = async ({ userId, email }) => { const token = VerificationTokenSchema.parse(randomBytes(32).toString("hex")); const expiresAt = Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS; @@ -76,5 +88,23 @@ export function initDynamoDbEmailVerification(deps: { } }; - return { createVerificationToken, verifyEmailToken }; + const deleteTokensByUserId: DeleteVerificationTokensByUserId = async (userId) => { + // Scan-and-delete by userId. The table's TTL eventually evicts an abandoned + // token, but deletion must erase the {userId, email} remnant now rather than + // leave it readable for the remainder of the verification window. + let ExclusiveStartKey: Record | undefined; + do { + const { items, lastEvaluatedKey } = await tokenKeyTable.scan({ + FilterExpression: "userId = :u", + ExpressionAttributeValues: { ":u": userId }, + ProjectionExpression: "#tk", + ExpressionAttributeNames: { "#tk": "token" }, + ExclusiveStartKey, + }); + for (const { token } of items) await table.delete({ Key: { token } }); + ExclusiveStartKey = lastEvaluatedKey; + } while (ExclusiveStartKey); + }; + + return { createVerificationToken, verifyEmailToken, deleteTokensByUserId }; } diff --git a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.test.ts b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.test.ts index 1323e4dc2..4f9da4e57 100644 --- a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.test.ts +++ b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.test.ts @@ -80,6 +80,16 @@ describe("initDynamoDbPasswordReset", () => { expect(item.expiresAt).toBeGreaterThanOrEqual(before + 60 * 60); expect(item.expiresAt).toBeLessThanOrEqual(after + 60 * 60); }); + + it("normalizes the email on write so a mixed-case reset stays scrubbable at deletion", async () => { + const { client, commands } = createFakeClient({}); + + await initStore(client).createPasswordResetToken({ email: "John@Example.com" }); + + const put = commands.find((c) => c.name === "PutCommand"); + const item = put?.input.Item as { email: string }; + expect(item.email).toBe("john@example.com"); + }); }); describe("verifyPasswordResetToken", () => { @@ -180,5 +190,15 @@ describe("initDynamoDbPasswordReset", () => { expect(commands.filter((c) => c.name === "ScanCommand")).toHaveLength(1); expect(commands.filter((c) => c.name === "DeleteCommand")).toHaveLength(0); }); + + it("normalizes a mixed-case filter email so it matches the normalized stored rows", async () => { + const { client, commands } = createScanClient([{ Items: [{ token: "aaa" }] }]); + + await initStore(client).deleteTokensByEmail("John@Example.com"); + + const scan = commands.find((c) => c.name === "ScanCommand"); + expect(scan?.input.ExpressionAttributeValues).toEqual({ ":e": "john@example.com" }); + expect(commands.filter((c) => c.name === "DeleteCommand")).toHaveLength(1); + }); }); }); diff --git a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts index 78c83b36f..e2287856e 100644 --- a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts +++ b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts @@ -6,6 +6,7 @@ import { defineDynamoTable, } from "@packages/hutch-storage-client"; import { z } from "zod"; +import { normalizeEmail } from "@packages/domain/user"; import type { CreatePasswordResetToken, DeletePasswordResetTokensByEmail, @@ -49,7 +50,11 @@ export function initDynamoDbPasswordReset(deps: { const token = PasswordResetTokenSchema.parse(randomBytes(32).toString("hex")); const expiresAt = Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS; - await table.put({ Item: { token, email, expiresAt } }); + // Store the normalized (lowercased) email so a mixed-case reset request + // (`John@Example.com`) is still matched by the deletion scrub, which filters + // on the normalized users-table PK. Without this the row would never match + // and — since this table has no TTL — the address would outlive the account. + await table.put({ Item: { token, email: normalizeEmail(email), expiresAt } }); return token; }; @@ -85,7 +90,7 @@ export function initDynamoDbPasswordReset(deps: { do { const { items, lastEvaluatedKey } = await tokenKeyTable.scan({ FilterExpression: "email = :e", - ExpressionAttributeValues: { ":e": email }, + ExpressionAttributeValues: { ":e": normalizeEmail(email) }, ProjectionExpression: "#tk", ExpressionAttributeNames: { "#tk": "token" }, ExclusiveStartKey, diff --git a/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.test.ts b/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.test.ts index 168060421..a8a140937 100644 --- a/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.test.ts +++ b/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.test.ts @@ -268,4 +268,55 @@ describe("initDynamoDbPendingSignup", () => { expect(inputs[0]?.ExpressionAttributeValues?.[":sentAt"]).toBe(999); }); }); + + describe("deleteByUserId", () => { + it("scans by userId across pages and deletes each abandoned row by its checkoutSessionId", async () => { + const pages = [ + { + Items: [{ checkoutSessionId: "cs_1" }, { checkoutSessionId: "cs_2" }], + LastEvaluatedKey: { checkoutSessionId: "cs_2" }, + }, + { Items: [{ checkoutSessionId: "cs_3" }] }, + ]; + let scanCall = 0; + // The impl is invoked for every command; a DeleteCommand carries a Key, + // a ScanCommand does not — so return {} for deletes and the next page otherwise. + const { client, inputs } = createClient((input) => + input.Key ? {} : pages[scanCall++], + ); + const { deleteByUserId } = initDynamoDbPendingSignup({ + client, + tableName: TABLE, + logger: noopLogger, + }); + + await deleteByUserId(USER_ID); + + const scans = inputs.filter((i) => i.ProjectionExpression === "checkoutSessionId"); + expect(scans).toHaveLength(2); + expect(scans[0]?.ExpressionAttributeValues).toEqual({ ":u": USER_ID }); + expect(scans[1]?.ExclusiveStartKey).toEqual({ checkoutSessionId: "cs_2" }); + + const deletes = inputs.filter((i) => i.Key); + expect(deletes.map((d) => d.Key)).toEqual([ + { checkoutSessionId: "cs_1" }, + { checkoutSessionId: "cs_2" }, + { checkoutSessionId: "cs_3" }, + ]); + }); + + it("issues no deletes when the user has no pending signups", async () => { + const { client, inputs } = createClient(() => ({ Items: [] })); + const { deleteByUserId } = initDynamoDbPendingSignup({ + client, + tableName: TABLE, + logger: noopLogger, + }); + + await deleteByUserId(USER_ID); + + expect(inputs.filter((i) => i.ProjectionExpression === "checkoutSessionId")).toHaveLength(1); + expect(inputs.filter((i) => i.Key)).toHaveLength(0); + }); + }); }); diff --git a/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.ts b/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.ts index 437b19487..073b33d57 100644 --- a/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.ts +++ b/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.ts @@ -9,6 +9,7 @@ import { UserIdSchema } from "@packages/domain/user"; import { CheckoutSessionIdSchema } from "@packages/provider-contracts/stripe-checkout"; import type { ConsumePendingSignup, + DeletePendingSignupsByUserId, ListAllPendingSignups, MarkCheckoutRecoveryEmailSent, PendingSignup, @@ -37,6 +38,10 @@ const PendingSignupSummaryRow = z.object({ checkoutRecoveryEmailSentAt: dynamoField(z.number()), }); +const CheckoutKeyRow = z.object({ + checkoutSessionId: CheckoutSessionIdSchema, +}); + export function initDynamoDbPendingSignup(deps: { client: DynamoDBDocumentClient; tableName: string; @@ -46,6 +51,7 @@ export function initDynamoDbPendingSignup(deps: { consumePendingSignup: ConsumePendingSignup; listAllPendingSignups: ListAllPendingSignups; markCheckoutRecoveryEmailSent: MarkCheckoutRecoveryEmailSent; + deleteByUserId: DeletePendingSignupsByUserId; } { const table = defineDynamoTable({ client: deps.client, @@ -59,6 +65,12 @@ export function initDynamoDbPendingSignup(deps: { schema: PendingSignupSummaryRow, }); + const keyTable = defineDynamoTable({ + client: deps.client, + tableName: deps.tableName, + schema: CheckoutKeyRow, + }); + const storePendingSignup: StorePendingSignup = async ({ checkoutSessionId, signup, createdAt }) => { await table.put({ Item: { @@ -133,10 +145,29 @@ export function initDynamoDbPendingSignup(deps: { }); }; + const deleteByUserId: DeletePendingSignupsByUserId = async (userId) => { + // No TTL on this table, so an abandoned-checkout row keeps the deleted user's + // email + userId forever unless purged. Scan by userId and delete each by PK. + let ExclusiveStartKey: Record | undefined; + do { + const { items, lastEvaluatedKey } = await keyTable.scan({ + FilterExpression: "userId = :u", + ExpressionAttributeValues: { ":u": userId }, + ProjectionExpression: "checkoutSessionId", + ExclusiveStartKey, + }); + for (const { checkoutSessionId } of items) { + await table.delete({ Key: { checkoutSessionId } }); + } + ExclusiveStartKey = lastEvaluatedKey; + } while (ExclusiveStartKey); + }; + return { storePendingSignup, consumePendingSignup, listAllPendingSignups, markCheckoutRecoveryEmailSent, + deleteByUserId, }; } diff --git a/projects/hutch/src/runtime/web/auth/auth.route.test.ts b/projects/hutch/src/runtime/web/auth/auth.route.test.ts index 91fdc6046..0230135e3 100644 --- a/projects/hutch/src/runtime/web/auth/auth.route.test.ts +++ b/projects/hutch/src/runtime/web/auth/auth.route.test.ts @@ -11,6 +11,7 @@ import { import { initInMemoryRateLimit } from "@packages/test-fixtures/providers/rate-limit"; import { completeStripeSignup } from "./test-helpers/complete-stripe-signup"; import { createAccessToken, saveAccessTokenForUser } from "../test-helpers/oauth-token"; +import { AppleTokenResponse } from "../../providers/apple-auth/apple-token"; import { DISPOSABLE_EMAIL_MESSAGE } from "./disposable-email"; import { SESSION_COOKIE_NAME, SESSION_TTL_SECONDS } from "@packages/web-session"; @@ -1276,6 +1277,38 @@ describe("Auth routes", () => { expect(link.querySelector(".auth-apple-button__label")?.textContent).toBe("Sign up with Apple"); assert(link.querySelector("svg.auth-apple-button__logo"), "apple logo must be rendered"); }); + + // Fail-closed guard for App Store 5.1.1(v): Sign in with Apple and the + // delete-account worker's Apple-token revocation MUST ship together. + // While SIWA is dark-launched (button gated behind ?feature=apple, never set + // in production), `revoke-external-idp-tokens.ts` is a safe no-op and + // `apple-token.ts` discards Apple's refresh_token — there is nothing to revoke. + // The day a normal user can reach SIWA, in-app deletion must also revoke the + // Apple grant (persist refresh_token + POST https://appleid.apple.com/auth/revoke), + // or Apple leaves the app in the user's "Sign in with Apple" list and rejects + // under the exact guideline this PR targets. This test pins BOTH facts so + // moving either without the other turns CI red and points here; the only + // accepted states are {reachable:false, persisted:false} (today) and + // {reachable:true, persisted:true} (SIWA live + revocation wired). + it("locks Sign in with Apple to Apple account-deletion revocation (App Store 5.1.1(v))", async () => { + const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); + const loginNoFlag = (await request(harness.server).get("/login")).text; + const signupNoFlag = (await request(harness.server).get("/signup")).text; + const siwaReachableByDefault = [loginNoFlag, signupNoFlag].some( + (html) => appleSection(html) !== null, + ); + + // Proxy for "the code exchange persists Apple's refresh_token": the schema + // keeps a `refresh_token` field only once someone wires revocation. + const appleExchange = AppleTokenResponse.safeParse({ id_token: "x", refresh_token: "y" }); + assert(appleExchange.success, "a well-formed Apple token response must parse"); + const appleRefreshTokenPersisted = "refresh_token" in appleExchange.data; + + expect({ siwaReachableByDefault, appleRefreshTokenPersisted }).toEqual({ + siwaReachableByDefault: false, + appleRefreshTokenPersisted: false, + }); + }); }); describe("Founding members progress", () => { diff --git a/projects/hutch/src/runtime/web/pages/account/account.page.ts b/projects/hutch/src/runtime/web/pages/account/account.page.ts index 820e4b87d..b08c710cf 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.page.ts +++ b/projects/hutch/src/runtime/web/pages/account/account.page.ts @@ -327,13 +327,16 @@ export function initAccountRoutes(deps: AccountDependencies): Router { res.redirect(303, buildAccountUrl({ cancelling: true })); }); - /** Irreversible account deletion. The synchronous work here is the - * security-critical teardown that must take effect the instant the user - * confirms — every session and bearer token dies at once — after which the - * durable, at-least-once scrub of every user-owned store runs asynchronously - * via DeleteAccountCommand. Sessions are destroyed before tokens are revoked - * (mirroring /oauth/revoke) so a failed step leaves the account still usable - * for a safe retry rather than half-torn-down. */ + /** Irreversible account deletion. The synchronous work here revokes every + * *existing* credential the instant the user confirms — all sessions and bearer + * tokens die at once — after which the durable, at-least-once scrub of every + * user-owned store runs asynchronously via DeleteAccountCommand. So existing + * access is cut synchronously, but full erasure is eventual: until the worker + * removes the identity row a brief window remains where the raw credentials + * could still mint a fresh session (self-healing once the row is gone). Sessions + * are destroyed before tokens are revoked (mirroring /oauth/revoke) so a failed + * step leaves the account still usable for a safe retry rather than + * half-torn-down. */ router.post("/delete", async (req: Request, res: Response) => { assert(req.userId, "userId required - route must be protected by requireAuth"); const userId = req.userId; diff --git a/projects/ios-readplace/App/AffordancePresentation.swift b/projects/ios-readplace/App/AffordancePresentation.swift index f57ede44f..7ced8b43d 100644 --- a/projects/ios-readplace/App/AffordancePresentation.swift +++ b/projects/ios-readplace/App/AffordancePresentation.swift @@ -117,8 +117,11 @@ extension Affordance { /// tear down local auth (session cookie, tokens, WebKit store) once it succeeds. /// This is inherently specific to account deletion — a purge is also destructive /// yet keeps the session — so unlike the generic `isDestructive` routing it keys - /// on the token. The server has already revoked everything server-side; this only - /// clears the now-dead local traces so the app returns to the login screen. + /// on the token. The server kills every session and OAuth token server-side (and + /// scrubs the remaining stores asynchronously); this clears the now-dead local + /// traces so the app returns to the login screen. It does NOT unlink Sign in with + /// Apple — Apple IdP-token revocation is still a pending no-op server-side (see + /// revoke-external-idp-tokens.ts), which matters once SIWA ships to real users. var endsSession: Bool { token == "delete-account" } /// Whether the client can invoke this affordance from a bare toolbar control. diff --git a/src/packages/provider-contracts/src/email-verification.ts b/src/packages/provider-contracts/src/email-verification.ts index 423dd15d1..dbbd6b0b8 100644 --- a/src/packages/provider-contracts/src/email-verification.ts +++ b/src/packages/provider-contracts/src/email-verification.ts @@ -10,3 +10,9 @@ export type VerifyEmailToken = (token: VerificationToken) => Promise< | { ok: true; userId: UserId; email: string } | { ok: false; reason: "invalid-token" } >; + +/** Erase every verification token a user holds, as part of account deletion. + * Keyed by userId (not email) so it sidesteps email-casing entirely. The table + * has a TTL, but deletion must remove the `{userId, email}` remnant immediately + * rather than let it linger for the verification window. */ +export type DeleteVerificationTokensByUserId = (userId: UserId) => Promise; diff --git a/src/packages/provider-contracts/src/pending-signup.ts b/src/packages/provider-contracts/src/pending-signup.ts index c8b09cd76..cea208c3b 100644 --- a/src/packages/provider-contracts/src/pending-signup.ts +++ b/src/packages/provider-contracts/src/pending-signup.ts @@ -34,3 +34,8 @@ export type MarkCheckoutRecoveryEmailSent = (params: { checkoutSessionId: CheckoutSessionId; sentAt: number; }) => Promise; + +/** Erase every abandoned-checkout row a user left behind, as part of account + * deletion. This table has no TTL, so an un-consumed pending-signup row keeps the + * deleted user's `{email, userId}` forever unless scrubbed. */ +export type DeletePendingSignupsByUserId = (userId: UserId) => Promise; diff --git a/src/packages/test-fixtures/src/providers/email-verification/in-memory-email-verification.test.ts b/src/packages/test-fixtures/src/providers/email-verification/in-memory-email-verification.test.ts index becfee594..0a503328b 100644 --- a/src/packages/test-fixtures/src/providers/email-verification/in-memory-email-verification.test.ts +++ b/src/packages/test-fixtures/src/providers/email-verification/in-memory-email-verification.test.ts @@ -30,4 +30,22 @@ describe("initInMemoryEmailVerification", () => { expect(secondAttempt).toEqual({ ok: false, reason: "invalid-token" }); }); + + it("deletes every token for a user and leaves other users' tokens intact", async () => { + const { createVerificationToken, verifyEmailToken, deleteTokensByUserId } = + initInMemoryEmailVerification(); + const target = "user-1" as UserId; + const other = "user-2" as UserId; + const targetToken = await createVerificationToken({ userId: target, email: "t@example.com" }); + const otherToken = await createVerificationToken({ userId: other, email: "o@example.com" }); + + await deleteTokensByUserId(target); + + expect(await verifyEmailToken(targetToken)).toEqual({ ok: false, reason: "invalid-token" }); + expect(await verifyEmailToken(otherToken)).toEqual({ + ok: true, + userId: other, + email: "o@example.com", + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/email-verification/in-memory-email-verification.ts b/src/packages/test-fixtures/src/providers/email-verification/in-memory-email-verification.ts index 4e74a7d16..74d26d97d 100644 --- a/src/packages/test-fixtures/src/providers/email-verification/in-memory-email-verification.ts +++ b/src/packages/test-fixtures/src/providers/email-verification/in-memory-email-verification.ts @@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto"; import type { UserId } from "@packages/domain/user"; import type { CreateVerificationToken, + DeleteVerificationTokensByUserId, VerificationToken, VerifyEmailToken, } from "@packages/provider-contracts/email-verification"; @@ -10,6 +11,7 @@ import { VerificationTokenSchema } from "@packages/provider-contracts/email-veri export function initInMemoryEmailVerification(): { createVerificationToken: CreateVerificationToken; verifyEmailToken: VerifyEmailToken; + deleteTokensByUserId: DeleteVerificationTokensByUserId; } { const tokens = new Map(); @@ -28,5 +30,11 @@ export function initInMemoryEmailVerification(): { return { ok: true, userId: entry.userId, email: entry.email }; }; - return { createVerificationToken, verifyEmailToken }; + const deleteTokensByUserId: DeleteVerificationTokensByUserId = async (userId) => { + for (const [token, entry] of tokens) { + if (entry.userId === userId) tokens.delete(token); + } + }; + + return { createVerificationToken, verifyEmailToken, deleteTokensByUserId }; } diff --git a/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.test.ts b/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.test.ts index a1e84e498..b2d36ac9c 100644 --- a/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.test.ts +++ b/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.test.ts @@ -56,4 +56,19 @@ describe("initInMemoryPasswordReset", () => { email: "other@example.com", }); }); + + it("normalizes email casing on write and delete so a mixed-case reset is still scrubbed", async () => { + const { createPasswordResetToken, verifyPasswordResetToken, deleteTokensByEmail } = + initInMemoryPasswordReset(); + const token = await createPasswordResetToken({ email: "John@Example.com" }); + + // The deletion scrub passes the normalized users-table PK; it must match the + // row written from the mixed-case request. + await deleteTokensByEmail("john@example.com"); + + expect(await verifyPasswordResetToken(token)).toEqual({ + ok: false, + reason: "invalid-token", + }); + }); }); diff --git a/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.ts b/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.ts index 25432a9bd..3b0df9320 100644 --- a/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.ts +++ b/src/packages/test-fixtures/src/providers/password-reset/in-memory-password-reset.ts @@ -1,4 +1,5 @@ import { randomBytes } from "node:crypto"; +import { normalizeEmail } from "@packages/domain/user"; import type { CreatePasswordResetToken, DeletePasswordResetTokensByEmail, @@ -16,7 +17,9 @@ export function initInMemoryPasswordReset(): { const createPasswordResetToken: CreatePasswordResetToken = async ({ email }) => { const token = PasswordResetTokenSchema.parse(randomBytes(32).toString("hex")); - tokens.set(token, { email }); + // Mirror the DynamoDB provider: store the normalized email so the deletion + // scrub (which filters on the normalized users-table PK) matches it. + tokens.set(token, { email: normalizeEmail(email) }); return token; }; @@ -30,8 +33,9 @@ export function initInMemoryPasswordReset(): { }; const deleteTokensByEmail: DeletePasswordResetTokensByEmail = async (email) => { + const normalized = normalizeEmail(email); for (const [token, entry] of tokens) { - if (entry.email === email) tokens.delete(token); + if (entry.email === normalized) tokens.delete(token); } }; diff --git a/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.test.ts b/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.test.ts index bac33d313..6c0659934 100644 --- a/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.test.ts +++ b/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.test.ts @@ -87,4 +87,29 @@ describe("initInMemoryPendingSignup", () => { }), ).rejects.toThrow(/No pending signup/); }); + + it("deletes every abandoned-checkout row for a user and leaves other users' rows intact", async () => { + const { storePendingSignup, consumePendingSignup, deleteByUserId } = initInMemoryPendingSignup(); + const targetUser = UserIdSchema.parse("u-del-target"); + const otherUser = UserIdSchema.parse("u-del-other"); + const targetSession = CheckoutSessionIdSchema.parse("cs_test_del_target"); + const otherSession = CheckoutSessionIdSchema.parse("cs_test_del_other"); + await storePendingSignup({ + checkoutSessionId: targetSession, + signup: { method: "existing-user-subscribe", email: "t@example.com", userId: targetUser }, + createdAt: 1, + }); + await storePendingSignup({ + checkoutSessionId: otherSession, + signup: { method: "existing-user-subscribe", email: "o@example.com", userId: otherUser }, + createdAt: 2, + }); + + await deleteByUserId(targetUser); + + expect(await consumePendingSignup(targetSession)).toBeNull(); + const survivor = await consumePendingSignup(otherSession); + assert(survivor, "other user's pending signup must survive"); + expect(survivor.userId).toBe(otherUser); + }); }); diff --git a/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.ts b/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.ts index 02e3b0325..7a0faf18f 100644 --- a/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.ts +++ b/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.ts @@ -1,6 +1,7 @@ import type { CheckoutSessionId } from "@packages/provider-contracts/stripe-checkout"; import type { ConsumePendingSignup, + DeletePendingSignupsByUserId, ListAllPendingSignups, MarkCheckoutRecoveryEmailSent, PendingSignup, @@ -18,6 +19,7 @@ export function initInMemoryPendingSignup(): { consumePendingSignup: ConsumePendingSignup; listAllPendingSignups: ListAllPendingSignups; markCheckoutRecoveryEmailSent: MarkCheckoutRecoveryEmailSent; + deleteByUserId: DeletePendingSignupsByUserId; } { const store = new Map(); @@ -51,10 +53,17 @@ export function initInMemoryPendingSignup(): { entry.checkoutRecoveryEmailSentAt = sentAt; }; + const deleteByUserId: DeletePendingSignupsByUserId = async (userId) => { + for (const [checkoutSessionId, entry] of store) { + if (entry.signup.userId === userId) store.delete(checkoutSessionId); + } + }; + return { storePendingSignup, consumePendingSignup, listAllPendingSignups, markCheckoutRecoveryEmailSent, + deleteByUserId, }; } From e26ea17aa3b53bf8dbe88610ca1e2ff4ff4c8c5f Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Mon, 6 Jul 2026 10:41:56 +0000 Subject: [PATCH 5/9] fix(hutch): address low-priority review issues in account deletion - SIWA fail-closed guard (Low #1): couple "SIWA reachable" and "Apple refresh_token persisted" as an equality (toBe) so {false,false} (today) and {true,true} (SIWA live + revocation wired) both pass while the dangerous {true,false} still fails; the comment now matches the assertion. - Password-reset PII (Low #2): enable DynamoDB TTL on the table's existing expiresAt (mirrors its sibling token tables). Pre-normalization mixed-case reset rows the normalized scrub can't match are now erased within ~48h with no one-off backfill; the synchronous scrub still erases new rows at once. - Remove the dead native delete-account apparatus (Low #3, the review's preferred compliance-only direction): delete account-siren.ts (+test) and the unreached /account Siren branch; drop the Swift delete-account presentation case, endsSession, and the two iOS tests. Keep the live web Danger Zone, the account link, the generic isDestructive confirm infra, and SirenAction.class (per "do NOT change"). iOS Swift changes here are deletions only, verified by re-reading; they still need an iOS-side `make test` run (this Linux CI cannot compile Swift). Low #4 (deterministic logout after in-webview deletion) is a documented follow-up: it needs a coordinated iOS+server change (webview marker + a new WKWebView close-and-logout navigation decision) that can't be compiled/tested here, and the current path self-heals via the next-API-call 401. Co-authored-by: Fayner Brack Co-Authored-By: Claude Opus 4.8 (1M context) --- projects/hutch/src/infra/hutch-storage.ts | 14 +++++++- .../src/runtime/web/api/account-siren.test.ts | 19 ----------- .../src/runtime/web/api/account-siren.ts | 23 ------------- .../src/runtime/web/auth/auth.route.test.ts | 15 ++++----- .../runtime/web/pages/account/account.page.ts | 7 ---- .../web/pages/account/account.route.test.ts | 21 ------------ .../App/AffordancePresentation.swift | 20 ------------ .../ios-readplace/App/ReadingListView.swift | 32 +++++++------------ .../Tests/AffordancePresentationTests.swift | 22 ------------- 9 files changed, 31 insertions(+), 142 deletions(-) delete mode 100644 projects/hutch/src/runtime/web/api/account-siren.test.ts delete mode 100644 projects/hutch/src/runtime/web/api/account-siren.ts diff --git a/projects/hutch/src/infra/hutch-storage.ts b/projects/hutch/src/infra/hutch-storage.ts index c97551808..44b96f07e 100644 --- a/projects/hutch/src/infra/hutch-storage.ts +++ b/projects/hutch/src/infra/hutch-storage.ts @@ -191,7 +191,19 @@ export class HutchStorage extends pulumi.ComponentResource { name: args.tableNames.passwordResetTokens, billingMode: "PAY_PER_REQUEST", hashKey: "token", - attributes: [{ name: "token", type: "S" }] + attributes: [{ name: "token", type: "S" }], + /* Expire reset tokens on the same `expiresAt` (epoch seconds) the row + * already carries, like every sibling token table. Beyond token hygiene + * this is the compliance backstop for account deletion: the delete-account + * scrub matches rows by the *normalized* email, so a token written before + * the write-path normalization (a raw `John@Example.com`) can't be matched + * and — without this TTL — would outlive the deleted account forever. TTL + * erases those pre-normalization stragglers within ~48h with no one-off + * backfill; the synchronous scrub still erases every new row immediately. */ + ttl: { + attributeName: "expiresAt", + enabled: true, + }, }, { parent: this, aliases: [{ parent: pulumi.rootStackResource }] }); this.pendingSignupsTable = new aws.dynamodb.Table(`hutch-pending-signups`, { diff --git a/projects/hutch/src/runtime/web/api/account-siren.test.ts b/projects/hutch/src/runtime/web/api/account-siren.test.ts deleted file mode 100644 index cbecef292..000000000 --- a/projects/hutch/src/runtime/web/api/account-siren.test.ts +++ /dev/null @@ -1,19 +0,0 @@ -import { toAccountEntity } from "./account-siren"; - -describe("toAccountEntity", () => { - it("advertises a self link and a bare destructive delete-account action", () => { - expect(toAccountEntity()).toEqual({ - class: ["account"], - links: [{ rel: ["self"], href: "/account" }], - actions: [ - { - name: "delete-account", - title: "Delete account", - href: "/account/delete", - method: "POST", - class: ["destructive"], - }, - ], - }); - }); -}); diff --git a/projects/hutch/src/runtime/web/api/account-siren.ts b/projects/hutch/src/runtime/web/api/account-siren.ts deleted file mode 100644 index 09769f0ed..000000000 --- a/projects/hutch/src/runtime/web/api/account-siren.ts +++ /dev/null @@ -1,23 +0,0 @@ -import type { SirenEntity, SirenLink } from "./siren"; - -/** The account resource as Siren. Carries the account-scoped affordances a - * client can act on — today just irreversible deletion, advertised as a bare - * no-body POST tagged with the reserved "destructive" role token so the client - * gates it behind its own confirmation. */ -export function toAccountEntity(): SirenEntity { - const links: SirenLink[] = [{ rel: ["self"], href: "/account" }]; - - return { - class: ["account"], - links, - actions: [ - { - name: "delete-account", - title: "Delete account", - href: "/account/delete", - method: "POST", - class: ["destructive"], - }, - ], - }; -} diff --git a/projects/hutch/src/runtime/web/auth/auth.route.test.ts b/projects/hutch/src/runtime/web/auth/auth.route.test.ts index 0230135e3..9e119e938 100644 --- a/projects/hutch/src/runtime/web/auth/auth.route.test.ts +++ b/projects/hutch/src/runtime/web/auth/auth.route.test.ts @@ -1286,10 +1286,12 @@ describe("Auth routes", () => { // The day a normal user can reach SIWA, in-app deletion must also revoke the // Apple grant (persist refresh_token + POST https://appleid.apple.com/auth/revoke), // or Apple leaves the app in the user's "Sign in with Apple" list and rejects - // under the exact guideline this PR targets. This test pins BOTH facts so - // moving either without the other turns CI red and points here; the only - // accepted states are {reachable:false, persisted:false} (today) and - // {reachable:true, persisted:true} (SIWA live + revocation wired). + // under the exact guideline this PR targets. This test couples the two facts + // as an equality — they must move together — so the only accepted states are + // {reachable:false, persisted:false} (today) and {reachable:true, persisted:true} + // (SIWA live + revocation wired). Un-gating SIWA without wiring revocation + // (the dangerous {true, false}) — or, symmetrically, drifting either alone — + // turns CI red and points here. it("locks Sign in with Apple to Apple account-deletion revocation (App Store 5.1.1(v))", async () => { const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); const loginNoFlag = (await request(harness.server).get("/login")).text; @@ -1304,10 +1306,7 @@ describe("Auth routes", () => { assert(appleExchange.success, "a well-formed Apple token response must parse"); const appleRefreshTokenPersisted = "refresh_token" in appleExchange.data; - expect({ siwaReachableByDefault, appleRefreshTokenPersisted }).toEqual({ - siwaReachableByDefault: false, - appleRefreshTokenPersisted: false, - }); + expect(siwaReachableByDefault).toBe(appleRefreshTokenPersisted); }); }); diff --git a/projects/hutch/src/runtime/web/pages/account/account.page.ts b/projects/hutch/src/runtime/web/pages/account/account.page.ts index b08c710cf..f377f5ab2 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.page.ts +++ b/projects/hutch/src/runtime/web/pages/account/account.page.ts @@ -37,9 +37,6 @@ import type { } from "@packages/provider-contracts/trial-scheduler"; import type { StorePendingSignup } from "@packages/provider-contracts/pending-signup"; import { Base } from "../../base.component"; -import { wantsSiren } from "../../content-negotiation"; -import { SIREN_MEDIA_TYPE } from "../../api/siren"; -import { toAccountEntity } from "../../api/account-siren"; import type { BuildBannerState } from "../../banner-state"; import { HxRedirectPage } from "../../hx-redirect-page"; import { sendComponent } from "@packages/web-shell"; @@ -144,10 +141,6 @@ export function initAccountRoutes(deps: AccountDependencies): Router { router.get("/", async (req: Request, res: Response) => { assert(req.userId, "userId required - route must be protected by requireAuth"); - if (wantsSiren(req)) { - res.type(SIREN_MEDIA_TYPE).json(toAccountEntity()); - return; - } const access = await deps.getEffectiveAccess(req.userId); const row = await deps.findSubscriptionByUserId(req.userId); const cardSection = await loadCardSection({ diff --git a/projects/hutch/src/runtime/web/pages/account/account.route.test.ts b/projects/hutch/src/runtime/web/pages/account/account.route.test.ts index cc2323754..1fbba20d2 100644 --- a/projects/hutch/src/runtime/web/pages/account/account.route.test.ts +++ b/projects/hutch/src/runtime/web/pages/account/account.route.test.ts @@ -1240,27 +1240,6 @@ describe("POST /account/cards/confirm — post-attach cap reconciliation", () => }); }); -describe("GET /account (Siren)", () => { - it("emits the account entity with a destructive delete-account action for a Siren client", async () => { - const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); - const { agent } = await loginUser(harness, "siren@example.com"); - - const response = await agent - .get("/account") - .set("Accept", "application/vnd.siren+json"); - - expect(response.status).toBe(200); - expect(response.headers["content-type"]).toContain("application/vnd.siren+json"); - const deleteAction = response.body.actions.find( - (a: { name: string }) => a.name === "delete-account", - ); - assert(deleteAction, "delete-account action must be present"); - expect(deleteAction.href).toBe("/account/delete"); - expect(deleteAction.method).toBe("POST"); - expect(deleteAction.class).toEqual(["destructive"]); - }); -}); - describe("POST /account/delete", () => { it("destroys the session, clears the cookie, and redirects to the logged-out home", async () => { const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); diff --git a/projects/ios-readplace/App/AffordancePresentation.swift b/projects/ios-readplace/App/AffordancePresentation.swift index 7ced8b43d..e5e0ed211 100644 --- a/projects/ios-readplace/App/AffordancePresentation.swift +++ b/projects/ios-readplace/App/AffordancePresentation.swift @@ -56,15 +56,6 @@ struct AffordancePresentation { isDestructive = true removesItem = true isToolbarControl = true - case "delete-account": - // Account-level, irreversible: destructive so the View confirms before - // invoking, but `removesItem = false` — there is no reading-list row to - // drop; it tears down the whole account. - systemImage = "person.crop.circle.badge.xmark" - tint = .red - isDestructive = true - removesItem = false - isToolbarControl = true case "search": systemImage = "magnifyingglass" tint = nil @@ -113,17 +104,6 @@ extension Affordance { rel == "add-links-help" } - /// Whether invoking this affordance ends the user's session, so the client must - /// tear down local auth (session cookie, tokens, WebKit store) once it succeeds. - /// This is inherently specific to account deletion — a purge is also destructive - /// yet keeps the session — so unlike the generic `isDestructive` routing it keys - /// on the token. The server kills every session and OAuth token server-side (and - /// scrubs the remaining stores asynchronously); this clears the now-dead local - /// traces so the app returns to the login screen. It does NOT unlink Sign in with - /// Apple — Apple IdP-token revocation is still a pending no-op server-side (see - /// revoke-external-idp-tokens.ts), which matters once SIWA ships to real users. - var endsSession: Bool { token == "delete-account" } - /// Whether the client can invoke this affordance from a bare toolbar control. /// Per the contract, a field-requiring action whose fields carry no /// server-provided `value` is not invokable by a bare control: the value must diff --git a/projects/ios-readplace/App/ReadingListView.swift b/projects/ios-readplace/App/ReadingListView.swift index 26da0dfe3..55d7231f0 100644 --- a/projects/ios-readplace/App/ReadingListView.swift +++ b/projects/ios-readplace/App/ReadingListView.swift @@ -13,10 +13,9 @@ struct ReadingListView: View { /// permission banner); those must not trigger a re-read. @State private var didEnterBackground = false /// A destructive affordance awaiting confirmation. A destructive control (e.g. - /// `delete`, `delete-account`) is irreversible, so it routes here for an explicit - /// confirm before the invoke fires, rather than acting on the tap. `article` is - /// nil for a collection-level control (e.g. account deletion), which acts on no - /// row. + /// `delete`) is irreversible, so it routes here for an explicit confirm before + /// the invoke fires, rather than acting on the tap. `article` is nil for a + /// collection-level control, which acts on no row. @State private var pendingDestructive: PendingDestructive? private struct PendingDestructive: Identifiable { @@ -98,10 +97,8 @@ struct ReadingListView: View { confirmDestructive(pending) } Button("Cancel", role: .cancel) { pendingDestructive = nil } - } message: { pending in - Text(pending.affordance.endsSession - ? "This permanently deletes your account, every saved article, and your reading history. It can't be undone." - : "This can't be undone.") + } message: { _ in + Text("This can't be undone.") } } } @@ -117,11 +114,11 @@ struct ReadingListView: View { case let .open(link): viewModel.open(link: link) case let .invoke(action): - // A destructive collection control (e.g. account deletion) is - // irreversible, so route it through the same confirmation the row - // controls use — keyed on `isDestructive`, never on the action name — and - // only invoke once the user confirms. The confirm gate lives here rather - // than in `ToolbarRoute.route` so routing stays name-agnostic. + // A destructive collection control is irreversible, so route it through + // the same confirmation the row controls use — keyed on `isDestructive`, + // never on the action name — and only invoke once the user confirms. The + // confirm gate lives here rather than in `ToolbarRoute.route` so routing + // stays name-agnostic. if affordance.presentation.isDestructive { pendingDestructive = PendingDestructive(affordance: affordance, article: nil) } else { @@ -131,19 +128,12 @@ struct ReadingListView: View { } /// Performs a confirmed destructive affordance. A row control invokes on its - /// article; a collection control invokes on the collection and, when it ends the - /// session (account deletion), tears down local auth so the app returns to the - /// login screen with no residual traces. + /// article; a collection control invokes on the collection. private func confirmDestructive(_ pending: PendingDestructive) { defer { pendingDestructive = nil } guard let action = pending.affordance.action else { return } if let article = pending.article { Task { await viewModel.invoke(action, on: article) } - } else if pending.affordance.endsSession { - Task { - await viewModel.invokeCollection(action) - session.forceLogout() - } } else { Task { await viewModel.invokeCollection(action) } } diff --git a/projects/ios-readplace/Tests/AffordancePresentationTests.swift b/projects/ios-readplace/Tests/AffordancePresentationTests.swift index 3d178eeb3..77c139e2c 100644 --- a/projects/ios-readplace/Tests/AffordancePresentationTests.swift +++ b/projects/ios-readplace/Tests/AffordancePresentationTests.swift @@ -48,28 +48,6 @@ final class AffordancePresentationTests: XCTestCase { XCTAssertTrue(presentation.removesItem) } - func testDeleteAccountMapsToADestructiveToolbarControlThatRemovesNoRow() { - // Account deletion is irreversible (destructive, so the View confirms) and a - // toolbar control, but it acts on the whole account, not a reading-list row — - // so removesItem is false, unlike `delete`. - let presentation = AffordancePresentation(token: "delete-account") - XCTAssertEqual(presentation.systemImage, "person.crop.circle.badge.xmark") - XCTAssertEqual(presentation.tint, .red) - XCTAssertTrue(presentation.isDestructive) - XCTAssertFalse(presentation.removesItem, "there is no reading-list row to drop") - XCTAssertTrue(presentation.isToolbarControl) - } - - func testEndsSessionIsTrueOnlyForAccountDeletion() throws { - // The client tears down local auth after a successful invoke only for account - // deletion — a purge is destructive too but keeps the session — so this keys - // on the token, not on `isDestructive`. - let deleteAccount = try XCTUnwrap(Affordance(action: action(name: "delete-account", href: "/account/delete"))) - XCTAssertTrue(deleteAccount.endsSession) - let delete = try XCTUnwrap(Affordance(action: action(name: "delete", href: "/queue/a1/delete"))) - XCTAssertFalse(delete.endsSession, "a row delete is destructive but keeps the session") - } - func testSearchMapsToANeutralMagnifierControl() { let presentation = AffordancePresentation(token: "search") XCTAssertEqual(presentation.systemImage, "magnifyingglass") From f204198c4372cb785ef897b3ce25615b9f50820b Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Mon, 6 Jul 2026 11:11:40 +0000 Subject: [PATCH 6/9] fix(hutch): correct stale no-TTL comments in password-reset scrub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The e26ea17a commit added a DynamoDB TTL on the password-reset-tokens table's `expiresAt`, but two comments in dynamodb-password-reset.ts still asserted the table has no TTL — a self-contradiction on the exact PII-erasure mechanism this compliance PR is about, and a trap for a maintainer reasoning about which path erases the data. Reword both to state the truth: the synchronous scrub is the immediate erasure path (matching on the normalized email), and the `expiresAt` TTL is the backstop that reaps pre-normalization mixed-case stragglers. Comment-only change; behaviour is unchanged. Addresses the sole medium-priority issue from the e26ea17a review. Co-authored-by: Fayner Brack Co-Authored-By: Claude Opus 4.8 (1M context) --- .../password-reset/dynamodb-password-reset.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts index e2287856e..83a94b912 100644 --- a/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts +++ b/projects/hutch/src/runtime/providers/password-reset/dynamodb-password-reset.ts @@ -51,9 +51,9 @@ export function initDynamoDbPasswordReset(deps: { const expiresAt = Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS; // Store the normalized (lowercased) email so a mixed-case reset request - // (`John@Example.com`) is still matched by the deletion scrub, which filters - // on the normalized users-table PK. Without this the row would never match - // and — since this table has no TTL — the address would outlive the account. + // (`John@Example.com`) is matched — and erased immediately — by the deletion + // scrub, which filters on the normalized users-table PK. An un-normalized row + // escapes the synchronous scrub and lingers until the `expiresAt` TTL reaps it. await table.put({ Item: { token, email: normalizeEmail(email), expiresAt } }); return token; @@ -84,8 +84,8 @@ export function initDynamoDbPasswordReset(deps: { }; const deleteTokensByEmail: DeletePasswordResetTokensByEmail = async (email) => { - // This table carries no TTL attribute, so an unexpired reset token would - // outlive the deleted account unless every row for the email is purged now. + // Purge every row for this email now so deletion erases the token immediately; + // the `expiresAt` TTL only reaps an unexpired token later, after it lapses. let ExclusiveStartKey: Record | undefined; do { const { items, lastEvaluatedKey } = await tokenKeyTable.scan({ From 8423c4de69e1cd3701c9ae2bac093e3965a18546 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Mon, 6 Jul 2026 11:48:02 +0000 Subject: [PATCH 7/9] fix(hutch): scrub legacy pending-signups by email; drop dead SirenAction.class Address the remaining 5.1.1(v) review items on the account-deletion PR. 1. Legacy email-only pending-signup rows leaked (bounded, permanent). The scrub is renamed deleteByUser and now matches on userId OR the normalized email, so pre-userId rows ({checkoutSessionId, method, email} with no userId, on a no-TTL table) are reachable by the email captured before closeUserAccount. It scans the full table and compares client-side because a server-side FilterExpression can neither reach the userId-less rows nor normalize the raw-cased email they stored. Mirrored in the in-memory fixture; provider + fixture tests cover the mixed-case legacy row and the email-null redrive path. 2. Removed the orphaned SirenAction.class field. Its only emitter was the already-deleted account-siren.ts; no client decodes it and no test pins it. Entity-level class stays (widely used). 3. Recorded the import-sessions accept-via-TTL decision in the delete worker's scrub-inventory comment (their {userId, urls} rows self-expire via the table's 24h TTL, so no scan is spent on them). Item 4 (post-webview logout deferral record) is documentation-only and carried into the follow-up spec per the review. Co-authored-by: Fayner Brack Co-Authored-By: Claude Opus 4.8 (1M context) --- .../hutch/src/runtime/delete-account.main.ts | 2 +- .../delete-account-handler.test.ts | 15 ++-- .../delete-account/delete-account-handler.ts | 19 ++--- .../dynamodb-pending-signup.test.ts | 72 ++++++++++++++----- .../pending-signup/dynamodb-pending-signup.ts | 42 +++++++---- projects/hutch/src/runtime/web/api/siren.ts | 4 -- .../provider-contracts/src/pending-signup.ts | 11 ++- .../in-memory-pending-signup.test.ts | 30 +++++++- .../in-memory-pending-signup.ts | 15 ++-- 9 files changed, 150 insertions(+), 60 deletions(-) diff --git a/projects/hutch/src/runtime/delete-account.main.ts b/projects/hutch/src/runtime/delete-account.main.ts index 7401ad74c..9e7d106d8 100644 --- a/projects/hutch/src/runtime/delete-account.main.ts +++ b/projects/hutch/src/runtime/delete-account.main.ts @@ -152,7 +152,7 @@ export const handler = initDeleteAccountHandler({ deleteUserExports, deletePasswordResetTokensByEmail: passwordReset.deleteTokensByEmail, deleteVerificationTokensByUserId: emailVerification.deleteTokensByUserId, - deletePendingSignupsByUserId: pendingSignup.deleteByUserId, + deletePendingSignupsByUser: pendingSignup.deleteByUser, revokeExternalIdpTokens, revokeAllUserOAuthTokens, destroyUserSessions: auth.destroyUserSessions, diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts index 8a6f7cba6..b339649ff 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts @@ -71,7 +71,7 @@ function buildSubject() { const deleteExportsCalls: UserId[] = []; const passwordResetCalls: string[] = []; const verificationTokenDeleteCalls: UserId[] = []; - const pendingSignupDeleteCalls: UserId[] = []; + const pendingSignupDeleteCalls: Array<{ userId: UserId; email: string | null }> = []; const revokeIdpCalls: UserId[] = []; // The noop is exercised through this wrapper so its own logging line stays @@ -142,8 +142,8 @@ function buildSubject() { deleteVerificationTokensByUserId: async (userId: UserId) => { verificationTokenDeleteCalls.push(userId); }, - deletePendingSignupsByUserId: async (userId: UserId) => { - pendingSignupDeleteCalls.push(userId); + deletePendingSignupsByUser: async ({ userId, email }: { userId: UserId; email: string | null }) => { + pendingSignupDeleteCalls.push({ userId, email }); }, revokeExternalIdpTokens: async (userId: UserId) => { revokeIdpCalls.push(userId); @@ -396,10 +396,13 @@ describe("delete-account handler", () => { // Password-reset tokens purged by the email captured before deletion. assert.deepEqual(s.passwordResetCalls, [victim.email]); - // Verification tokens and abandoned-checkout pending-signup rows scrubbed by - // userId — the remnant stores this PR closes. + // Verification tokens and abandoned-checkout pending-signup rows scrubbed — + // the remnant stores this PR closes. Pending-signups receive the captured + // email too, so legacy pre-userId rows are reachable by email. assert.deepEqual(s.verificationTokenDeleteCalls, [victim.userId]); - assert.deepEqual(s.pendingSignupDeleteCalls, [victim.userId]); + assert.deepEqual(s.pendingSignupDeleteCalls, [ + { userId: victim.userId, email: victim.email }, + ]); // Billing side effects fired for the active subscription: deleting the // Stripe customer cancels the subscription and detaches the cards. diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts index 5d050ce78..e396fb86d 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts @@ -20,7 +20,7 @@ import type { DeleteReaderReadyState } from "@packages/provider-contracts/reader import type { DeleteOnboarding } from "@packages/provider-contracts/ios-onboarding-signal"; import type { DeletePasswordResetTokensByEmail } from "@packages/provider-contracts/password-reset"; import type { DeleteVerificationTokensByUserId } from "@packages/provider-contracts/email-verification"; -import type { DeletePendingSignupsByUserId } from "@packages/provider-contracts/pending-signup"; +import type { DeletePendingSignupsByUser } from "@packages/provider-contracts/pending-signup"; import type { DeleteSubscription, FindSubscriptionByUserId, @@ -60,7 +60,7 @@ export interface DeleteAccountHandlerDependencies { deleteUserExports: DeleteUserExports; deletePasswordResetTokensByEmail: DeletePasswordResetTokensByEmail; deleteVerificationTokensByUserId: DeleteVerificationTokensByUserId; - deletePendingSignupsByUserId: DeletePendingSignupsByUserId; + deletePendingSignupsByUser: DeletePendingSignupsByUser; revokeExternalIdpTokens: RevokeExternalIdpTokens; revokeAllUserOAuthTokens: RevokeAllUserOAuthTokens; destroyUserSessions: DestroyUserSessions; @@ -132,13 +132,16 @@ async function processCommand( await deps.deletePasswordResetTokensByEmail(email); } - // Signup/verification remnants keyed by userId (both scanned, both no-op when - // absent): the email-verification token (a `{userId, email}` row the TTL would - // otherwise keep for the verification window) and any abandoned-checkout - // pending-signup rows (that table has no TTL, so they'd keep `{email, userId}` - // forever). + // Signup/verification remnants (all scanned, all no-op when absent): the + // email-verification token (a `{userId, email}` row the TTL would otherwise + // keep for the verification window, scrubbed by userId) and any abandoned- + // checkout pending-signup rows (that table has no TTL, so they'd keep + // `{email, userId}` forever — scrubbed by userId OR the captured email, since + // legacy pre-userId rows carry only the email). Import sessions are + // deliberately NOT scrubbed: their `{userId, urls}` rows self-expire via that + // table's 24h TTL, so no scan is spent on them. await deps.deleteVerificationTokensByUserId(userId); - await deps.deletePendingSignupsByUserId(userId); + await deps.deletePendingSignupsByUser({ userId, email }); // Credentials last: revoke external IdP tokens, kill OAuth grants and every // session, then delete the identity row (and its Gmail uniqueness claim). diff --git a/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.test.ts b/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.test.ts index a8a140937..54026d502 100644 --- a/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.test.ts +++ b/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.test.ts @@ -12,6 +12,7 @@ type CommandInput = { ReturnValues?: string; UpdateExpression?: string; ProjectionExpression?: string; + FilterExpression?: string; ExclusiveStartKey?: Record; ExpressionAttributeValues?: Record; }; @@ -269,14 +270,23 @@ describe("initDynamoDbPendingSignup", () => { }); }); - describe("deleteByUserId", () => { - it("scans by userId across pages and deletes each abandoned row by its checkoutSessionId", async () => { + describe("deleteByUser", () => { + const SCRUB_PROJECTION = "checkoutSessionId, email, userId"; + + it("scans every page and deletes rows matching the userId or the normalized email", async () => { const pages = [ { - Items: [{ checkoutSessionId: "cs_1" }, { checkoutSessionId: "cs_2" }], - LastEvaluatedKey: { checkoutSessionId: "cs_2" }, + Items: [ + { checkoutSessionId: "cs_by_user", email: "someone@b.com", userId: USER_ID }, + { checkoutSessionId: "cs_other", email: "keep@b.com", userId: "user-other" }, + ], + LastEvaluatedKey: { checkoutSessionId: "cs_other" }, + }, + { + // Legacy pre-userId row: no userId, raw mixed-case email that + // normalizes to the target — reachable only by the email match. + Items: [{ checkoutSessionId: "cs_legacy", email: "Target@B.com" }], }, - { Items: [{ checkoutSessionId: "cs_3" }] }, ]; let scanCall = 0; // The impl is invoked for every command; a DeleteCommand carries a Key, @@ -284,38 +294,66 @@ describe("initDynamoDbPendingSignup", () => { const { client, inputs } = createClient((input) => input.Key ? {} : pages[scanCall++], ); - const { deleteByUserId } = initDynamoDbPendingSignup({ + const { deleteByUser } = initDynamoDbPendingSignup({ client, tableName: TABLE, logger: noopLogger, }); - await deleteByUserId(USER_ID); + await deleteByUser({ userId: USER_ID, email: "target@b.com" }); - const scans = inputs.filter((i) => i.ProjectionExpression === "checkoutSessionId"); + const scans = inputs.filter((i) => i.ProjectionExpression === SCRUB_PROJECTION); expect(scans).toHaveLength(2); - expect(scans[0]?.ExpressionAttributeValues).toEqual({ ":u": USER_ID }); - expect(scans[1]?.ExclusiveStartKey).toEqual({ checkoutSessionId: "cs_2" }); + // No server-side FilterExpression: the full table is scanned and matched + // client-side, so legacy rows and raw-cased emails are both reached. + expect(scans[0]?.FilterExpression).toBeUndefined(); + expect(scans[1]?.ExclusiveStartKey).toEqual({ checkoutSessionId: "cs_other" }); const deletes = inputs.filter((i) => i.Key); expect(deletes.map((d) => d.Key)).toEqual([ - { checkoutSessionId: "cs_1" }, - { checkoutSessionId: "cs_2" }, - { checkoutSessionId: "cs_3" }, + { checkoutSessionId: "cs_by_user" }, + { checkoutSessionId: "cs_legacy" }, ]); }); - it("issues no deletes when the user has no pending signups", async () => { + it("matches only by userId when the email is already gone (null)", async () => { + const pages = [ + { + Items: [ + { checkoutSessionId: "cs_by_user", email: "a@b.com", userId: USER_ID }, + // Legacy row with the same email but no userId is NOT deleted when + // there is no email to match on. + { checkoutSessionId: "cs_legacy", email: "a@b.com" }, + ], + }, + ]; + let scanCall = 0; + const { client, inputs } = createClient((input) => + input.Key ? {} : pages[scanCall++], + ); + const { deleteByUser } = initDynamoDbPendingSignup({ + client, + tableName: TABLE, + logger: noopLogger, + }); + + await deleteByUser({ userId: USER_ID, email: null }); + + const deletes = inputs.filter((i) => i.Key); + expect(deletes.map((d) => d.Key)).toEqual([{ checkoutSessionId: "cs_by_user" }]); + }); + + it("issues no deletes when nothing matches the user", async () => { const { client, inputs } = createClient(() => ({ Items: [] })); - const { deleteByUserId } = initDynamoDbPendingSignup({ + const { deleteByUser } = initDynamoDbPendingSignup({ client, tableName: TABLE, logger: noopLogger, }); - await deleteByUserId(USER_ID); + await deleteByUser({ userId: USER_ID, email: "nobody@b.com" }); - expect(inputs.filter((i) => i.ProjectionExpression === "checkoutSessionId")).toHaveLength(1); + expect(inputs.filter((i) => i.ProjectionExpression === SCRUB_PROJECTION)).toHaveLength(1); expect(inputs.filter((i) => i.Key)).toHaveLength(0); }); }); diff --git a/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.ts b/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.ts index 073b33d57..783a3f69a 100644 --- a/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.ts +++ b/projects/hutch/src/runtime/providers/pending-signup/dynamodb-pending-signup.ts @@ -5,11 +5,11 @@ import { } from "@packages/hutch-storage-client"; import type { HutchLogger } from "@packages/hutch-logger"; import { z } from "zod"; -import { UserIdSchema } from "@packages/domain/user"; +import { UserIdSchema, normalizeEmail } from "@packages/domain/user"; import { CheckoutSessionIdSchema } from "@packages/provider-contracts/stripe-checkout"; import type { ConsumePendingSignup, - DeletePendingSignupsByUserId, + DeletePendingSignupsByUser, ListAllPendingSignups, MarkCheckoutRecoveryEmailSent, PendingSignup, @@ -38,8 +38,13 @@ const PendingSignupSummaryRow = z.object({ checkoutRecoveryEmailSentAt: dynamoField(z.number()), }); -const CheckoutKeyRow = z.object({ +/** Projection for the deletion scrub: the key to delete by, plus the two handles + * a deleted user can be matched on. `userId` is optional because legacy + * pre-userId rows carry only `{checkoutSessionId, method, email}`. */ +const ScrubScanRow = z.object({ checkoutSessionId: CheckoutSessionIdSchema, + email: z.string(), + userId: dynamoField(UserIdSchema), }); export function initDynamoDbPendingSignup(deps: { @@ -51,7 +56,7 @@ export function initDynamoDbPendingSignup(deps: { consumePendingSignup: ConsumePendingSignup; listAllPendingSignups: ListAllPendingSignups; markCheckoutRecoveryEmailSent: MarkCheckoutRecoveryEmailSent; - deleteByUserId: DeletePendingSignupsByUserId; + deleteByUser: DeletePendingSignupsByUser; } { const table = defineDynamoTable({ client: deps.client, @@ -65,10 +70,10 @@ export function initDynamoDbPendingSignup(deps: { schema: PendingSignupSummaryRow, }); - const keyTable = defineDynamoTable({ + const scrubTable = defineDynamoTable({ client: deps.client, tableName: deps.tableName, - schema: CheckoutKeyRow, + schema: ScrubScanRow, }); const storePendingSignup: StorePendingSignup = async ({ checkoutSessionId, signup, createdAt }) => { @@ -145,19 +150,26 @@ export function initDynamoDbPendingSignup(deps: { }); }; - const deleteByUserId: DeletePendingSignupsByUserId = async (userId) => { + const deleteByUser: DeletePendingSignupsByUser = async ({ userId, email }) => { // No TTL on this table, so an abandoned-checkout row keeps the deleted user's - // email + userId forever unless purged. Scan by userId and delete each by PK. + // email + userId forever unless purged. Match on userId OR the normalized + // email — a server-side FilterExpression can't reach legacy pre-userId rows + // (no userId) nor normalize the raw-cased email they stored, so scan the + // full table and compare client-side, deleting each match by its PK. + const normalizedEmail = email === null ? null : normalizeEmail(email); let ExclusiveStartKey: Record | undefined; do { - const { items, lastEvaluatedKey } = await keyTable.scan({ - FilterExpression: "userId = :u", - ExpressionAttributeValues: { ":u": userId }, - ProjectionExpression: "checkoutSessionId", + const { items, lastEvaluatedKey } = await scrubTable.scan({ + ProjectionExpression: "checkoutSessionId, email, userId", ExclusiveStartKey, }); - for (const { checkoutSessionId } of items) { - await table.delete({ Key: { checkoutSessionId } }); + for (const row of items) { + const matchesUser = row.userId === userId; + const matchesEmail = + normalizedEmail !== null && normalizeEmail(row.email) === normalizedEmail; + if (matchesUser || matchesEmail) { + await table.delete({ Key: { checkoutSessionId: row.checkoutSessionId } }); + } } ExclusiveStartKey = lastEvaluatedKey; } while (ExclusiveStartKey); @@ -168,6 +180,6 @@ export function initDynamoDbPendingSignup(deps: { consumePendingSignup, listAllPendingSignups, markCheckoutRecoveryEmailSent, - deleteByUserId, + deleteByUser, }; } diff --git a/projects/hutch/src/runtime/web/api/siren.ts b/projects/hutch/src/runtime/web/api/siren.ts index f6c05d0fe..29309ee35 100644 --- a/projects/hutch/src/runtime/web/api/siren.ts +++ b/projects/hutch/src/runtime/web/api/siren.ts @@ -11,10 +11,6 @@ export interface SirenAction { title?: string; type?: string; fields?: SirenField[]; - /* A reserved semantic-role token the client maps to its own presentation - * (e.g. ["destructive"] → a red, confirm-gated control). The server never - * sends a CSS class; presentation stays entirely client-side. */ - class?: string[]; } export interface SirenLink { diff --git a/src/packages/provider-contracts/src/pending-signup.ts b/src/packages/provider-contracts/src/pending-signup.ts index cea208c3b..ff4b3baa5 100644 --- a/src/packages/provider-contracts/src/pending-signup.ts +++ b/src/packages/provider-contracts/src/pending-signup.ts @@ -37,5 +37,12 @@ export type MarkCheckoutRecoveryEmailSent = (params: { /** Erase every abandoned-checkout row a user left behind, as part of account * deletion. This table has no TTL, so an un-consumed pending-signup row keeps the - * deleted user's `{email, userId}` forever unless scrubbed. */ -export type DeletePendingSignupsByUserId = (userId: UserId) => Promise; + * deleted user's `{email, userId}` forever unless scrubbed. Matched on `userId` + * OR the normalized `email`: legacy pre-userId rows carry `{checkoutSessionId, + * method, email}` with no `userId`, so the email is the only handle on them. + * `email` is `null` only when the identity row is already gone (a redrive after + * closeUserAccount), in which case the userId match still converges. */ +export type DeletePendingSignupsByUser = (params: { + userId: UserId; + email: string | null; +}) => Promise; diff --git a/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.test.ts b/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.test.ts index 6c0659934..bbe587643 100644 --- a/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.test.ts +++ b/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.test.ts @@ -89,7 +89,7 @@ describe("initInMemoryPendingSignup", () => { }); it("deletes every abandoned-checkout row for a user and leaves other users' rows intact", async () => { - const { storePendingSignup, consumePendingSignup, deleteByUserId } = initInMemoryPendingSignup(); + const { storePendingSignup, consumePendingSignup, deleteByUser } = initInMemoryPendingSignup(); const targetUser = UserIdSchema.parse("u-del-target"); const otherUser = UserIdSchema.parse("u-del-other"); const targetSession = CheckoutSessionIdSchema.parse("cs_test_del_target"); @@ -105,11 +105,37 @@ describe("initInMemoryPendingSignup", () => { createdAt: 2, }); - await deleteByUserId(targetUser); + await deleteByUser({ userId: targetUser, email: null }); expect(await consumePendingSignup(targetSession)).toBeNull(); const survivor = await consumePendingSignup(otherSession); assert(survivor, "other user's pending signup must survive"); expect(survivor.userId).toBe(otherUser); }); + + it("deletes a row whose userId differs but whose email matches, ignoring casing", async () => { + const { storePendingSignup, consumePendingSignup, deleteByUser } = initInMemoryPendingSignup(); + // A pre-userId row is reachable only by email: it was written under a + // throwaway id (or none), so the userId scrub alone would miss it. + const staleUser = UserIdSchema.parse("u-stale-checkout-id"); + const targetSession = CheckoutSessionIdSchema.parse("cs_test_del_by_email"); + const otherSession = CheckoutSessionIdSchema.parse("cs_test_del_keep"); + await storePendingSignup({ + checkoutSessionId: targetSession, + signup: { method: "existing-user-subscribe", email: "Deleted@Example.com", userId: staleUser }, + createdAt: 1, + }); + await storePendingSignup({ + checkoutSessionId: otherSession, + signup: { method: "existing-user-subscribe", email: "someone-else@example.com", userId: staleUser }, + createdAt: 2, + }); + + await deleteByUser({ userId: UserIdSchema.parse("u-real-deleted"), email: "deleted@example.com" }); + + expect(await consumePendingSignup(targetSession)).toBeNull(); + const survivor = await consumePendingSignup(otherSession); + assert(survivor, "an unrelated email must survive"); + expect(survivor.email).toBe("someone-else@example.com"); + }); }); diff --git a/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.ts b/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.ts index 7a0faf18f..536fc5848 100644 --- a/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.ts +++ b/src/packages/test-fixtures/src/providers/pending-signup/in-memory-pending-signup.ts @@ -1,7 +1,8 @@ +import { normalizeEmail } from "@packages/domain/user"; import type { CheckoutSessionId } from "@packages/provider-contracts/stripe-checkout"; import type { ConsumePendingSignup, - DeletePendingSignupsByUserId, + DeletePendingSignupsByUser, ListAllPendingSignups, MarkCheckoutRecoveryEmailSent, PendingSignup, @@ -19,7 +20,7 @@ export function initInMemoryPendingSignup(): { consumePendingSignup: ConsumePendingSignup; listAllPendingSignups: ListAllPendingSignups; markCheckoutRecoveryEmailSent: MarkCheckoutRecoveryEmailSent; - deleteByUserId: DeletePendingSignupsByUserId; + deleteByUser: DeletePendingSignupsByUser; } { const store = new Map(); @@ -53,9 +54,13 @@ export function initInMemoryPendingSignup(): { entry.checkoutRecoveryEmailSentAt = sentAt; }; - const deleteByUserId: DeletePendingSignupsByUserId = async (userId) => { + const deleteByUser: DeletePendingSignupsByUser = async ({ userId, email }) => { + const normalizedEmail = email === null ? null : normalizeEmail(email); for (const [checkoutSessionId, entry] of store) { - if (entry.signup.userId === userId) store.delete(checkoutSessionId); + const matchesUser = entry.signup.userId === userId; + const matchesEmail = + normalizedEmail !== null && normalizeEmail(entry.signup.email) === normalizedEmail; + if (matchesUser || matchesEmail) store.delete(checkoutSessionId); } }; @@ -64,6 +69,6 @@ export function initInMemoryPendingSignup(): { consumePendingSignup, listAllPendingSignups, markCheckoutRecoveryEmailSent, - deleteByUserId, + deleteByUser, }; } From c2a53a79ab74ec81c4184bf977d6104e109c571b Mon Sep 17 00:00:00 2001 From: Fayner Brack Date: Mon, 6 Jul 2026 23:37:52 +1000 Subject: [PATCH 8/9] feat: revoke the Sign in with Apple grant at account deletion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sign in with Apple shipped to all users (#933) while this branch's Apple-revocation seam was still a no-op, tripping the fail-closed deletion-compliance lock in auth.route.test.ts ({reachable:true, persisted:false}). This wires the revocation the lock demands: 1. The code exchange now requires Apple's refresh_token — an exchange without one fails the login instead of minting an unrevokable account — and returns it as AppleTokenResult.appleRefreshToken. 2. Every Apple login persists the token on the users row (the passwordHash precedent): createAppleUser stores it at signup, and the new saveAppleRefreshToken conditional update stores the freshest grant on each returning login, which also backfills accounts minted during the gap between #933 and this change. Read back via findAppleRefreshTokenByUserId over the userId-index; deleted with the row by closeUserAccount. Mirrored in the in-memory fixture. 3. The delete worker's no-op seam is replaced by a real initRevokeExternalIdpTokens: look up the stored token (absent for password/Google accounts → log-and-return), POST it with a freshly minted ES256 client secret to https://appleid.apple.com/auth/revoke, and throw on non-2xx so the SQS record redrives while the token is still readable (revocation precedes closeUserAccount). Apple returns 200 for already-revoked tokens (RFC 7009), so redrives converge. 4. The worker Lambda gets the four APPLE_LOGIN_* env vars, and the delete-account queue's maxReceiveCount rises 3 → 12 (~3h of retries at the 900s visibility timeout) so an Apple outage rides out in-queue instead of falling to the 14-day DLQ after 45 minutes. The handler-level test now runs the real revoker against the in-memory auth store and a fake Apple endpoint, proving deletion revokes the stored grant end-to-end; route tests pin token persistence on the signup, returning-login, and race-fallback paths. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- projects/hutch/src/infra/index.ts | 9 ++ .../hutch/src/runtime/delete-account.main.ts | 22 ++++- .../delete-account-handler.test.ts | 45 ++++++++-- .../revoke-external-idp-tokens.test.ts | 62 ++++++++++++-- .../revoke-external-idp-tokens.ts | 53 ++++++++---- .../providers/apple-auth/apple-token.test.ts | 45 +++++++++- .../providers/apple-auth/apple-token.ts | 14 ++-- .../providers/auth/dynamodb-auth.test.ts | 84 +++++++++++++++++++ .../runtime/providers/auth/dynamodb-auth.ts | 55 ++++++++++-- projects/hutch/src/runtime/server.ts | 3 + projects/hutch/src/runtime/test-app.ts | 1 + .../src/runtime/web/auth/apple-auth.page.ts | 19 +++++ .../runtime/web/auth/apple-auth.route.test.ts | 37 ++++++++ .../src/runtime/web/auth/auth.route.test.ts | 24 +++--- .../provider-contracts/src/apple-auth.ts | 3 + src/packages/provider-contracts/src/auth.ts | 12 +++ src/packages/test-fixtures/src/fixture.ts | 1 + .../src/providers/auth/in-memory-auth.test.ts | 65 +++++++++++++- .../src/providers/auth/in-memory-auth.ts | 44 ++++++++-- .../web-test-harness/src/bundle.types.ts | 4 + 20 files changed, 536 insertions(+), 66 deletions(-) diff --git a/projects/hutch/src/infra/index.ts b/projects/hutch/src/infra/index.ts index 18a034374..7a92596cb 100644 --- a/projects/hutch/src/infra/index.ts +++ b/projects/hutch/src/infra/index.ts @@ -590,6 +590,11 @@ const deleteAccountQueue = new HutchSQS("delete-account", { // Matches the worker Lambda timeout so a single in-flight scrub cannot be // redelivered while still running. visibilityTimeoutSeconds: 900, + // The scrub converges on partial state by design, and its Apple-revocation + // step fails closed on an Apple outage — 12 receives ≈ 3 hours of retries + // so a losable deletion only falls to the DLQ (email-alarmed) after riding + // out a real outage, not after the default 3 attempts. + dlqMaxReceiveCount: 12, }); const deleteAccountLambda = new HutchLambda("delete-account", { @@ -619,6 +624,10 @@ const deleteAccountLambda = new HutchLambda("delete-account", { CONTENT_BUCKET_NAME: contentBucketName, USER_EXPORT_BUCKET_NAME: userExportBucketName, STRIPE_SECRET_KEY: requireEnv("STRIPE_SECRET_KEY"), + APPLE_LOGIN_CLIENT_ID: requireEnv("APPLE_LOGIN_CLIENT_ID"), + APPLE_LOGIN_TEAM_ID: requireEnv("APPLE_LOGIN_TEAM_ID"), + APPLE_LOGIN_KEY_ID: requireEnv("APPLE_LOGIN_KEY_ID"), + APPLE_LOGIN_PRIVATE_KEY_BASE64: requireEnv("APPLE_LOGIN_PRIVATE_KEY_BASE64"), EVENT_BUS_ARN: eventBus.eventBusArn, TRIAL_SCHEDULER_GROUP_NAME: trialSchedulerGroupName, TRIAL_SCHEDULER_ROLE_ARN: trialSchedulerRole.arn, diff --git a/projects/hutch/src/runtime/delete-account.main.ts b/projects/hutch/src/runtime/delete-account.main.ts index 9e7d106d8..5a4e1074d 100644 --- a/projects/hutch/src/runtime/delete-account.main.ts +++ b/projects/hutch/src/runtime/delete-account.main.ts @@ -1,9 +1,11 @@ /* c8 ignore start -- composition root, no logic to test */ +import assert from "node:assert"; import { S3Client } from "@aws-sdk/client-s3"; import { SchedulerClient } from "@aws-sdk/client-scheduler"; import { createDynamoDocumentClient } from "@packages/hutch-storage-client"; import { HutchLogger, consoleLogger } from "@packages/hutch-logger"; import { requireEnv } from "@packages/require-env"; +import { initCreateAppleClientSecret } from "./providers/apple-auth/apple-client-secret"; import { initDynamoDbAuth } from "./providers/auth/dynamodb-auth"; import { initRevokeAllUserOAuthTokens } from "./providers/oauth/dynamodb-oauth-model"; import { initDynamoDbArticleStore } from "./providers/article-store/dynamodb-article-store"; @@ -21,7 +23,7 @@ import { initS3UserDataExport } from "./providers/user-data-export/s3-user-data- import { initDynamoDbPasswordReset } from "./providers/password-reset/dynamodb-password-reset"; import { initDynamoDbEmailVerification } from "./providers/email-verification/dynamodb-email-verification"; import { initDynamoDbPendingSignup } from "./providers/pending-signup/dynamodb-pending-signup"; -import { initNoopRevokeExternalIdpTokens } from "./delete-account/revoke-external-idp-tokens"; +import { initRevokeExternalIdpTokens } from "./delete-account/revoke-external-idp-tokens"; import { initDeleteAccountHandler } from "./delete-account/delete-account-handler"; const logger = HutchLogger.from(consoleLogger); @@ -129,7 +131,23 @@ const pendingSignup = initDynamoDbPendingSignup({ logger, }); -const revokeExternalIdpTokens = initNoopRevokeExternalIdpTokens({ logger }); +const appleClientId = requireEnv("APPLE_LOGIN_CLIENT_ID"); +const applePrivateKeyPem = Buffer.from(requireEnv("APPLE_LOGIN_PRIVATE_KEY_BASE64"), "base64").toString("utf8"); +assert(applePrivateKeyPem.includes("BEGIN PRIVATE KEY"), "APPLE_LOGIN_PRIVATE_KEY_BASE64 must decode to a PKCS#8 PEM"); + +const revokeExternalIdpTokens = initRevokeExternalIdpTokens({ + findAppleRefreshTokenByUserId: auth.findAppleRefreshTokenByUserId, + appleClientId, + createAppleClientSecret: initCreateAppleClientSecret({ + teamId: requireEnv("APPLE_LOGIN_TEAM_ID"), + clientId: appleClientId, + keyId: requireEnv("APPLE_LOGIN_KEY_ID"), + privateKeyPem: applePrivateKeyPem, + now, + }), + fetch: globalThis.fetch, + logger, +}); export const handler = initDeleteAccountHandler({ findEmailByUserId: auth.findEmailByUserId, diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts index b339649ff..e5da155fc 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts @@ -7,7 +7,7 @@ import { InboxAddressSchema, MessageIdSchema, } from "@packages/domain/inbox"; -import type { UserId } from "@packages/domain/user"; +import { UserIdSchema, type UserId } from "@packages/domain/user"; import { HutchLogger, noopLogger } from "@packages/hutch-logger"; import { initInMemoryArticleStore } from "@packages/test-fixtures/providers/article-store"; import { initInMemoryAuth } from "@packages/test-fixtures/providers/auth"; @@ -29,7 +29,7 @@ import { initInMemorySubscriptionProviders } from "@packages/test-fixtures/provi import { buildLambdaContext } from "@packages/test-fixtures/lambda-context"; import { buildSqsEvent } from "@packages/test-fixtures/sqs"; import { initDeleteAccountHandler } from "./delete-account-handler"; -import { initNoopRevokeExternalIdpTokens } from "./revoke-external-idp-tokens"; +import { initRevokeExternalIdpTokens } from "./revoke-external-idp-tokens"; const SEED_NOW = new Date("2026-07-05T00:00:00.000Z"); const COOLDOWN_MS = 1000 * 60 * 60 * 24 * 365; @@ -74,9 +74,22 @@ function buildSubject() { const pendingSignupDeleteCalls: Array<{ userId: UserId; email: string | null }> = []; const revokeIdpCalls: UserId[] = []; - // The noop is exercised through this wrapper so its own logging line stays - // covered while the spy still records each invocation. - const noopRevoke = initNoopRevokeExternalIdpTokens({ logger: HutchLogger.from(noopLogger) }); + // The real revoker runs against the in-memory auth store and a fake Apple + // endpoint, so the scrub tests prove revocation happens while the auth row + // (and its stored refresh token) still exists. + const appleRevokeCalls: string[] = []; + const revokeIdpTokens = initRevokeExternalIdpTokens({ + findAppleRefreshTokenByUserId: auth.findAppleRefreshTokenByUserId, + appleClientId: "com.readplace.web", + createAppleClientSecret: () => "minted-client-secret-jwt", + fetch: async (_input, init) => { + const body = init?.body; + assert(typeof body === "string", "Apple revocation must send a form-encoded body"); + appleRevokeCalls.push(new URLSearchParams(body).get("token") ?? ""); + return new Response(null, { status: 200 }); + }, + logger: HutchLogger.from(noopLogger), + }); // Test-only failure injection: the article-store fake throws for any user id // added here, so a batch can carry one poisoned record beside a healthy one. @@ -147,7 +160,7 @@ function buildSubject() { }, revokeExternalIdpTokens: async (userId: UserId) => { revokeIdpCalls.push(userId); - await noopRevoke(userId); + await revokeIdpTokens(userId); }, revokeAllUserOAuthTokens: createRevokeAllUserOAuthTokens(oauthDeps), destroyUserSessions: auth.destroyUserSessions, @@ -179,6 +192,7 @@ function buildSubject() { verificationTokenDeleteCalls, pendingSignupDeleteCalls, revokeIdpCalls, + appleRevokeCalls, failArticleDeleteFor: (userId: UserId): void => { articleDeleteThrowIds.add(userId); }, @@ -542,7 +556,7 @@ describe("delete-account handler", () => { assert.equal(await s.auth.findEmailByUserId(healthy.userId), null); }); - it("invokes revokeExternalIdpTokens exactly once per deletion", async () => { + it("invokes revokeExternalIdpTokens exactly once per deletion, without an Apple call for a password account", async () => { const s = buildSubject(); const account = await seedAccount(s, { label: "idp", @@ -553,6 +567,23 @@ describe("delete-account handler", () => { await run(s, [{ messageId: "msg", body: bodyFor(account.userId) }]); assert.deepEqual(s.revokeIdpCalls, [account.userId]); + assert.deepEqual(s.appleRevokeCalls, []); + }); + + it("revokes the Sign in with Apple grant using the refresh token stored on the auth row", async () => { + const s = buildSubject(); + const created = await s.auth.createAppleUser({ + email: "siwa@example.com", + userId: UserIdSchema.parse("siwa-user-1"), + appleRefreshToken: "stored-apple-refresh-token", + }); + assert(created.ok, "expected the Apple user to be created"); + + const result = await run(s, [{ messageId: "msg-siwa", body: bodyFor(created.userId) }]); + + assert.deepEqual(result.batchItemFailures, []); + assert.deepEqual(s.appleRevokeCalls, ["stored-apple-refresh-token"]); + assert.equal(await s.auth.findUserByEmail("siwa@example.com"), null); }); it("redrive after a failed local subscription delete re-runs the Stripe customer delete idempotently and converges", async () => { diff --git a/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.test.ts b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.test.ts index de375e7d0..466d73da1 100644 --- a/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.test.ts +++ b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.test.ts @@ -1,14 +1,62 @@ import assert from "node:assert/strict"; import { HutchLogger, noopLogger } from "@packages/hutch-logger"; import { UserIdSchema } from "@packages/domain/user"; -import { initNoopRevokeExternalIdpTokens } from "./revoke-external-idp-tokens"; +import { initRevokeExternalIdpTokens } from "./revoke-external-idp-tokens"; -describe("initNoopRevokeExternalIdpTokens", () => { - it("resolves without throwing — no external IdP refresh token is persisted yet", async () => { - const revokeExternalIdpTokens = initNoopRevokeExternalIdpTokens({ - logger: HutchLogger.from(noopLogger), - }); +const USER_ID = UserIdSchema.parse("user-1"); - await assert.doesNotReject(revokeExternalIdpTokens(UserIdSchema.parse("user-1"))); +function buildRevoker(opts: { + storedToken: string | null; + responseStatus?: number; +}) { + const fetchCalls: { url: string; init: RequestInit | undefined }[] = []; + const fakeFetch: typeof globalThis.fetch = async (input, init) => { + fetchCalls.push({ url: typeof input === "string" ? input : input.toString(), init }); + return new Response(null, { status: opts.responseStatus ?? 200 }); + }; + const revokeExternalIdpTokens = initRevokeExternalIdpTokens({ + findAppleRefreshTokenByUserId: async () => opts.storedToken, + appleClientId: "com.readplace.web", + createAppleClientSecret: () => "minted-client-secret-jwt", + fetch: fakeFetch, + logger: HutchLogger.from(noopLogger), + }); + return { revokeExternalIdpTokens, fetchCalls }; +} + +describe("initRevokeExternalIdpTokens", () => { + it("resolves without calling Apple when the user has no stored refresh token (password/Google accounts)", async () => { + const s = buildRevoker({ storedToken: null }); + + await assert.doesNotReject(s.revokeExternalIdpTokens(USER_ID)); + + assert.equal(s.fetchCalls.length, 0); + }); + + it("POSTs the stored refresh token to Apple's revocation endpoint with a freshly minted client secret", async () => { + const s = buildRevoker({ storedToken: "stored-apple-refresh-token" }); + + await s.revokeExternalIdpTokens(USER_ID); + + assert.equal(s.fetchCalls.length, 1); + const call = s.fetchCalls[0]; + assert(call, "revocation must issue exactly one request"); + assert.equal(call.url, "https://appleid.apple.com/auth/revoke"); + assert.equal(call.init?.method, "POST"); + const headers = new Headers(call.init?.headers); + assert.equal(headers.get("Content-Type"), "application/x-www-form-urlencoded"); + const body = call.init?.body; + assert(typeof body === "string"); + const params = new URLSearchParams(body); + assert.equal(params.get("client_id"), "com.readplace.web"); + assert.equal(params.get("client_secret"), "minted-client-secret-jwt"); + assert.equal(params.get("token"), "stored-apple-refresh-token"); + assert.equal(params.get("token_type_hint"), "refresh_token"); + }); + + it("rejects on a non-2xx Apple response so the SQS record redrives and revocation is retried", async () => { + const s = buildRevoker({ storedToken: "stored-apple-refresh-token", responseStatus: 400 }); + + await assert.rejects(s.revokeExternalIdpTokens(USER_ID), /Apple token revocation failed with status 400/); }); }); diff --git a/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts index 88da2b7d3..4a8594717 100644 --- a/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts +++ b/projects/hutch/src/runtime/delete-account/revoke-external-idp-tokens.ts @@ -1,28 +1,47 @@ +import assert from "node:assert"; import type { UserId } from "@packages/domain/user"; +import type { FindAppleRefreshTokenByUserId } from "@packages/provider-contracts/auth"; import type { HutchLogger } from "@packages/hutch-logger"; /** Revoke a user's tokens at any external identity provider they signed in - * through, as part of account deletion. Injected into the delete worker so the - * real Apple `/auth/revoke` call can be added without touching the teardown. */ + * through, as part of account deletion. Apple requires this for App Store + * 5.1.1(v): without it a deleted account lingers in the user's "Sign in with + * Apple" list. The only IdPs today are Google (which persists no token) and + * Sign in with Apple. A user without a stored token is either a password or + * Google account (nothing to revoke) or an Apple account from before token + * persistence — indistinguishable, because the provider `sub` is never stored. + * That legacy grant cannot be revoked here; each Apple login stores the newest + * token, shrinking the cohort until every deletion can revoke. */ export type RevokeExternalIdpTokens = (userId: UserId) => Promise; -/** The only IdPs today are Google (which persists no token) and Sign in with - * Apple — whose merged sign-in flow discards Apple's `refresh_token`, so there - * is nothing to revoke yet. This no-op is the injectable seam: when SIWA is - * extended to persist the refresh token, its runtime implementation replaces - * this at the composition root and the worker is unchanged. Apple *requires* - * revocation once both SIWA and account deletion ship (App Store 5.1.1(v)), so - * this must be swapped for the real POST https://appleid.apple.com/auth/revoke in - * the same change that persists the token. The "locks Sign in with Apple to Apple - * account-deletion revocation" guard in auth.route.test.ts fails CI if SIWA is - * ever un-gated without that wiring. */ -export function initNoopRevokeExternalIdpTokens(deps: { +export function initRevokeExternalIdpTokens(deps: { + findAppleRefreshTokenByUserId: FindAppleRefreshTokenByUserId; + appleClientId: string; + createAppleClientSecret: () => string; + fetch: typeof globalThis.fetch; logger: HutchLogger; }): RevokeExternalIdpTokens { return async (userId) => { - deps.logger.info( - "[delete-account] no external IdP token to revoke — Apple revocation pending SIWA refresh-token persistence", - { userId }, - ); + const appleRefreshToken = await deps.findAppleRefreshTokenByUserId(userId); + if (appleRefreshToken === null) { + deps.logger.info("[delete-account] no external IdP token to revoke", { userId }); + return; + } + + const response = await deps.fetch("https://appleid.apple.com/auth/revoke", { + method: "POST", + headers: { "Content-Type": "application/x-www-form-urlencoded" }, + body: new URLSearchParams({ + client_id: deps.appleClientId, + client_secret: deps.createAppleClientSecret(), + token: appleRefreshToken, + token_type_hint: "refresh_token", + }).toString(), + }); + /* Throwing redrives the SQS record: the user row (and its token) is only + * deleted later in the scrub, so the retry can revoke again. Apple returns + * 200 for already-revoked tokens (RFC 7009), so redrives converge. */ + assert(response.ok, `Apple token revocation failed with status ${response.status}`); + deps.logger.info("[delete-account] revoked Sign in with Apple grant", { userId }); }; } diff --git a/projects/hutch/src/runtime/providers/apple-auth/apple-token.test.ts b/projects/hutch/src/runtime/providers/apple-auth/apple-token.test.ts index b2f5fb748..49de70404 100644 --- a/projects/hutch/src/runtime/providers/apple-auth/apple-token.test.ts +++ b/projects/hutch/src/runtime/providers/apple-auth/apple-token.test.ts @@ -23,6 +23,7 @@ describe("initExchangeAppleCode", () => { receivedInit = init; return jsonResponse({ id_token: idToken({ sub: "apple-sub-1", email: "user@example.com", email_verified: true }), + refresh_token: "apple-refresh-1", }); }; @@ -53,6 +54,7 @@ describe("initExchangeAppleCode", () => { const fakeFetch: typeof globalThis.fetch = async () => jsonResponse({ id_token: idToken({ sub: "apple-sub-42", email: "person@example.com", email_verified: true }), + refresh_token: "apple-refresh-42", }); const exchange = initExchangeAppleCode({ @@ -69,10 +71,46 @@ describe("initExchangeAppleCode", () => { assert.equal(result.emailVerified, true); }); + it("returns Apple's refresh_token so the login flow can persist it for deletion-time revocation", async () => { + const fakeFetch: typeof globalThis.fetch = async () => + jsonResponse({ + id_token: idToken({ sub: "apple-sub-42", email: "person@example.com", email_verified: true }), + refresh_token: "apple-refresh-42", + }); + + const exchange = initExchangeAppleCode({ + clientId: "id", + createClientSecret: () => "secret", + redirectUri: "https://app.test/cb", + fetch: fakeFetch, + }); + + const result = await exchange("code"); + + assert.equal(result.appleRefreshToken, "apple-refresh-42"); + }); + + it("rejects a token response that is missing the refresh_token — the grant would be unrevokable at account deletion", async () => { + const fakeFetch: typeof globalThis.fetch = async () => + jsonResponse({ + id_token: idToken({ sub: "apple-sub", email: "e@example.com", email_verified: true }), + }); + + const exchange = initExchangeAppleCode({ + clientId: "id", + createClientSecret: () => "secret", + redirectUri: "https://app.test/cb", + fetch: fakeFetch, + }); + + await assert.rejects(exchange("code")); + }); + it("coerces the documented string email_verified 'true' to boolean true", async () => { const fakeFetch: typeof globalThis.fetch = async () => jsonResponse({ id_token: idToken({ sub: "apple-sub", email: "e@example.com", email_verified: "true" }), + refresh_token: "apple-refresh", }); const exchange = initExchangeAppleCode({ @@ -91,6 +129,7 @@ describe("initExchangeAppleCode", () => { const fakeFetch: typeof globalThis.fetch = async () => jsonResponse({ id_token: idToken({ sub: "apple-sub", email: "e@example.com", email_verified: "false" }), + refresh_token: "apple-refresh", }); const exchange = initExchangeAppleCode({ @@ -109,6 +148,7 @@ describe("initExchangeAppleCode", () => { const fakeFetch: typeof globalThis.fetch = async () => jsonResponse({ id_token: idToken({ sub: "apple-sub", email: "unverified@example.com", email_verified: false }), + refresh_token: "apple-refresh", }); const exchange = initExchangeAppleCode({ @@ -138,7 +178,10 @@ describe("initExchangeAppleCode", () => { it("rejects an id_token whose claims are missing email_verified", async () => { const fakeFetch: typeof globalThis.fetch = async () => - jsonResponse({ id_token: idToken({ sub: "apple-sub", email: "x@example.com" }) }); + jsonResponse({ + id_token: idToken({ sub: "apple-sub", email: "x@example.com" }), + refresh_token: "apple-refresh", + }); const exchange = initExchangeAppleCode({ clientId: "id", diff --git a/projects/hutch/src/runtime/providers/apple-auth/apple-token.ts b/projects/hutch/src/runtime/providers/apple-auth/apple-token.ts index 6fbc33b2a..f056b8a55 100644 --- a/projects/hutch/src/runtime/providers/apple-auth/apple-token.ts +++ b/projects/hutch/src/runtime/providers/apple-auth/apple-token.ts @@ -2,15 +2,14 @@ import { z } from "zod"; import { AppleIdSchema } from "@packages/provider-contracts/apple-auth"; import type { ExchangeAppleCode } from "@packages/provider-contracts/apple-auth"; -/** Apple's token-exchange response. Today only `id_token` is parsed — Apple's - * `refresh_token` is deliberately discarded because nothing consumes it yet. When - * Sign in with Apple ships to real users, account deletion MUST revoke the Apple - * grant, which means persisting `refresh_token` here (see the - * `siwa-deletion-compliance` guard in auth.route.test.ts and - * revoke-external-idp-tokens.ts). Exported so that guard can detect when this - * schema starts persisting the token. */ +/** Apple's token-exchange response. `refresh_token` is required, not optional: + * account deletion revokes the Sign in with Apple grant through it (App Store + * 5.1.1(v)), so an exchange that fails to return one must fail the login rather + * than mint an unrevokable account. Exported so the deletion-compliance guard in + * auth.route.test.ts can detect if this schema ever stops persisting the token. */ export const AppleTokenResponse = z.object({ id_token: z.string(), + refresh_token: z.string(), }); const AppleIdTokenClaims = z.object({ @@ -52,6 +51,7 @@ export function initExchangeAppleCode(deps: { appleId: claims.sub, email: claims.email, emailVerified: claims.email_verified, + appleRefreshToken: tokenData.refresh_token, }; }; } diff --git a/projects/hutch/src/runtime/providers/auth/dynamodb-auth.test.ts b/projects/hutch/src/runtime/providers/auth/dynamodb-auth.test.ts index 5a394859c..228eb3e6d 100644 --- a/projects/hutch/src/runtime/providers/auth/dynamodb-auth.test.ts +++ b/projects/hutch/src/runtime/providers/auth/dynamodb-auth.test.ts @@ -299,6 +299,90 @@ describe("initDynamoDbAuth", () => { }); }); + describe("createAppleUser", () => { + it("stores the Apple refresh token on the verified user row", async () => { + const { client, commands } = createWriteFakeClient(); + + const result = await initAuth(client).createAppleUser({ + email: "User@Example.com", + userId: USER, + appleRefreshToken: "apple-refresh-1", + }); + + assert(result.ok, "create should succeed"); + const put = commands.find((c) => c.name === "PutCommand"); + expect(put?.input).toMatchObject({ + Item: { + email: "user@example.com", + userId: USER, + emailVerified: true, + appleRefreshToken: "apple-refresh-1", + }, + }); + }); + + it("keeps Google rows free of the appleRefreshToken attribute", async () => { + const { client, commands } = createWriteFakeClient(); + + const result = await initAuth(client).createGoogleUser({ + email: "user@example.com", + userId: USER, + }); + + assert(result.ok, "create should succeed"); + const put = commands.find((c) => c.name === "PutCommand"); + assert(put, "expected a PutCommand"); + expect(put.input.Item).not.toHaveProperty("appleRefreshToken"); + }); + }); + + describe("saveAppleRefreshToken", () => { + it("updates the normalized row conditionally so a deleted account cannot be resurrected", async () => { + const { client, commands } = createWriteFakeClient(); + + await initAuth(client).saveAppleRefreshToken({ + email: "User@Example.com", + appleRefreshToken: "apple-refresh-2", + }); + + const update = commands.find((c) => c.name === "UpdateCommand"); + expect(update?.input).toMatchObject({ + Key: { email: "user@example.com" }, + UpdateExpression: "SET appleRefreshToken = :token", + ConditionExpression: "attribute_exists(email)", + ExpressionAttributeValues: { ":token": "apple-refresh-2" }, + }); + }); + }); + + describe("findAppleRefreshTokenByUserId", () => { + it("returns the stored token via the userId-index", async () => { + const { client, commands } = createQueryFakeClient({ + row: { email: "u@example.com", userId: "abc123", appleRefreshToken: "apple-refresh-3" }, + }); + + const token = await initAuth(client).findAppleRefreshTokenByUserId(USER); + + expect(token).toBe("apple-refresh-3"); + const query = commands.find((c) => c.name === "QueryCommand"); + expect(query?.input).toMatchObject({ IndexName: "userId-index" }); + }); + + it("returns null when the user row has no stored token", async () => { + const { client } = createQueryFakeClient({ + row: { email: "u@example.com", userId: "abc123" }, + }); + + expect(await initAuth(client).findAppleRefreshTokenByUserId(USER)).toBe(null); + }); + + it("returns null when no row exists for the id", async () => { + const { client } = createQueryFakeClient({}); + + expect(await initAuth(client).findAppleRefreshTokenByUserId(USER)).toBe(null); + }); + }); + describe("destroyUserSessions", () => { it("queries the sessions userId-index and deletes each session by id", async () => { const { client, commands } = createQueryFakeClient({ diff --git a/projects/hutch/src/runtime/providers/auth/dynamodb-auth.ts b/projects/hutch/src/runtime/providers/auth/dynamodb-auth.ts index 07c5b0a1b..d8e461a39 100644 --- a/projects/hutch/src/runtime/providers/auth/dynamodb-auth.ts +++ b/projects/hutch/src/runtime/providers/auth/dynamodb-auth.ts @@ -34,6 +34,7 @@ import type { DestroySession, DestroyUserSessions, ExistsUserByIdPrefix, + FindAppleRefreshTokenByUserId, FindEmailByUserId, FindUserById, FindUserByEmail, @@ -41,7 +42,9 @@ import type { GetSessionUserId, MarkEmailVerified, MarkSessionEmailVerified, + SaveAppleRefreshToken, UpdatePassword, + UserAcquisitionAttribution, UserExistsByEmail, VerifyCredentials, } from "@packages/provider-contracts/auth"; @@ -50,6 +53,9 @@ const UserRow = z.object({ email: z.string(), userId: UserIdSchema, passwordHash: dynamoField(z.string()), + /* Only on rows that signed in with Apple; revoked and deleted with the + * account (App Store 5.1.1(v)). */ + appleRefreshToken: dynamoField(z.string()), emailVerified: dynamoField(z.boolean()), /* Optional in the schema so reads of pre-backfill rows don't throw; new writes always set it. */ registeredAt: dynamoField(z.string()), @@ -84,6 +90,8 @@ export function initDynamoDbAuth(deps: { createUserWithPasswordHash: CreateUserWithPasswordHash; createGoogleUser: CreateGoogleUser; createAppleUser: CreateAppleUser; + saveAppleRefreshToken: SaveAppleRefreshToken; + findAppleRefreshTokenByUserId: FindAppleRefreshTokenByUserId; findUserByEmail: FindUserByEmail; verifyCredentials: VerifyCredentials; createSession: CreateSession; @@ -224,11 +232,22 @@ export function initDynamoDbAuth(deps: { }; /** A user created from a federated identity provider (Google/Apple): verified - * email, no password hash. Both providers share this body because they persist - * an identical row — the provider's `sub` is deliberately never stored, users - * are keyed by normalized email. The Gmail canonical claim still applies, so an - * Apple ID backed by a Gmail address contends for the same uniqueness claim. */ - const createFederatedUser: CreateGoogleUser = async ({ email, userId, attribution }) => { + * email, no password hash. The provider's `sub` is deliberately never stored, + * users are keyed by normalized email. The Gmail canonical claim still applies, + * so an Apple ID backed by a Gmail address contends for the same uniqueness + * claim. Apple rows additionally carry the refresh token that account deletion + * revokes; Google persists no token. */ + const createFederatedUser = async ({ + email, + userId, + attribution, + appleRefreshToken, + }: { + email: string; + userId: UserId; + attribution?: UserAcquisitionAttribution; + appleRefreshToken?: string; + }) => { const normalizedEmail = normalizeEmail(email); assert(!normalizedEmail.startsWith(CLAIM_PK_PREFIX), `Email collides with the claim namespace: ${email}`); @@ -240,16 +259,38 @@ export function initDynamoDbAuth(deps: { registeredAt: new Date().toISOString(), userIdPrefix: userIdPrefixFrom(userId), canonicalEmail: canonicalizeEmail(email), + ...(appleRefreshToken === undefined ? {} : { appleRefreshToken }), ...(attribution ?? {}), }, userId, gmailClaimKey: gmailIdentityKey(email), }); - return result.ok ? { ok: true, userId } : result; + return result.ok ? { ok: true as const, userId } : result; }; const createGoogleUser: CreateGoogleUser = createFederatedUser; const createAppleUser: CreateAppleUser = createFederatedUser; + const saveAppleRefreshToken: SaveAppleRefreshToken = async ({ email, appleRefreshToken }) => { + const normalizedEmail = normalizeEmail(email); + await users.update({ + Key: { email: normalizedEmail }, + UpdateExpression: "SET appleRefreshToken = :token", + ConditionExpression: "attribute_exists(email)", + ExpressionAttributeValues: { ":token": appleRefreshToken }, + }); + }; + + const findAppleRefreshTokenByUserId: FindAppleRefreshTokenByUserId = async (userId) => { + const { items } = await users.query({ + IndexName: "userId-index", + KeyConditionExpression: "userId = :userId", + ExpressionAttributeValues: { ":userId": userId }, + Limit: 1, + }); + const row = items[0]; + return row?.appleRefreshToken ?? null; + }; + const findUserByEmail: FindUserByEmail = async (email) => { const normalizedEmail = normalizeEmail(email); const row = await users.get( @@ -444,6 +485,8 @@ export function initDynamoDbAuth(deps: { createUserWithPasswordHash, createGoogleUser, createAppleUser, + saveAppleRefreshToken, + findAppleRefreshTokenByUserId, findUserByEmail, verifyCredentials, createSession, diff --git a/projects/hutch/src/runtime/server.ts b/projects/hutch/src/runtime/server.ts index bc286a94d..a549a29b9 100644 --- a/projects/hutch/src/runtime/server.ts +++ b/projects/hutch/src/runtime/server.ts @@ -23,6 +23,7 @@ import type { GetSessionUserId, MarkEmailVerified, MarkSessionEmailVerified, + SaveAppleRefreshToken, UpdatePassword, UserExistsByEmail, VerifyCredentials, @@ -210,6 +211,7 @@ interface AppDependencies { createUserWithPasswordHash: CreateUserWithPasswordHash; createGoogleUser: CreateGoogleUser; createAppleUser: CreateAppleUser; + saveAppleRefreshToken: SaveAppleRefreshToken; findUserByEmail: FindUserByEmail; verifyCredentials: VerifyCredentials; createSession: CreateSession; @@ -929,6 +931,7 @@ export function createApp(dependencies: AppDependencies): Express { secureCookies, createSession: deps.createSession, createAppleUser, + saveAppleRefreshToken: deps.saveAppleRefreshToken, findUserByEmail: deps.findUserByEmail, countUsers, markEmailVerified: deps.markEmailVerified, diff --git a/projects/hutch/src/runtime/test-app.ts b/projects/hutch/src/runtime/test-app.ts index 6a08acc10..1a59b7f09 100644 --- a/projects/hutch/src/runtime/test-app.ts +++ b/projects/hutch/src/runtime/test-app.ts @@ -103,6 +103,7 @@ function flattenFixtureToAppDependencies( createUserWithPasswordHash: fixture.auth.createUserWithPasswordHash, createGoogleUser: fixture.auth.createGoogleUser, createAppleUser: fixture.auth.createAppleUser, + saveAppleRefreshToken: fixture.auth.saveAppleRefreshToken, findUserByEmail: fixture.auth.findUserByEmail, verifyCredentials: fixture.auth.verifyCredentials, createSession: fixture.auth.createSession, diff --git a/projects/hutch/src/runtime/web/auth/apple-auth.page.ts b/projects/hutch/src/runtime/web/auth/apple-auth.page.ts index 72e6cfb65..007b3bb1b 100644 --- a/projects/hutch/src/runtime/web/auth/apple-auth.page.ts +++ b/projects/hutch/src/runtime/web/auth/apple-auth.page.ts @@ -10,6 +10,7 @@ import type { CreateSession, FindUserByEmail, MarkEmailVerified, + SaveAppleRefreshToken, } from "@packages/provider-contracts/auth"; import type { SendEmail } from "@packages/provider-contracts/email"; import type { ExchangeAppleCode } from "@packages/provider-contracts/apple-auth"; @@ -66,6 +67,7 @@ interface AppleAuthDependencies { secureCookies: boolean; createSession: CreateSession; createAppleUser: CreateAppleUser; + saveAppleRefreshToken: SaveAppleRefreshToken; findUserByEmail: FindUserByEmail; countUsers: CountUsers; markEmailVerified: MarkEmailVerified; @@ -196,6 +198,13 @@ export const initAppleAuthRoutes = (deps: AppleAuthDependencies): Router => { const existing = await deps.findUserByEmail(tokenResult.email); if (existing) { + /* Every code exchange mints a fresh grant, and a returning user may + * predate token persistence — store it on login too, or account + * deletion could not revoke their Sign in with Apple grant. */ + await deps.saveAppleRefreshToken({ + email: tokenResult.email, + appleRefreshToken: tokenResult.appleRefreshToken, + }); if (!existing.emailVerified) { await deps.markEmailVerified(tokenResult.email); } @@ -227,11 +236,16 @@ export const initAppleAuthRoutes = (deps: AppleAuthDependencies): Router => { const created = await deps.createAppleUser({ email: tokenResult.email, userId: newUserId, + appleRefreshToken: tokenResult.appleRefreshToken, attribution, }); if (!created.ok) { const lookup = await deps.findUserByEmail(tokenResult.email); if (lookup) { + await deps.saveAppleRefreshToken({ + email: tokenResult.email, + appleRefreshToken: tokenResult.appleRefreshToken, + }); if (!lookup.emailVerified) { await deps.markEmailVerified(tokenResult.email); } @@ -265,11 +279,16 @@ export const initAppleAuthRoutes = (deps: AppleAuthDependencies): Router => { const created = await deps.createAppleUser({ email: tokenResult.email, userId: newUserId, + appleRefreshToken: tokenResult.appleRefreshToken, attribution, }); if (!created.ok) { const lookup = await deps.findUserByEmail(tokenResult.email); if (lookup) { + await deps.saveAppleRefreshToken({ + email: tokenResult.email, + appleRefreshToken: tokenResult.appleRefreshToken, + }); if (!lookup.emailVerified) { await deps.markEmailVerified(tokenResult.email); } diff --git a/projects/hutch/src/runtime/web/auth/apple-auth.route.test.ts b/projects/hutch/src/runtime/web/auth/apple-auth.route.test.ts index 5b0eac9f8..0f9b88cdf 100644 --- a/projects/hutch/src/runtime/web/auth/apple-auth.route.test.ts +++ b/projects/hutch/src/runtime/web/auth/apple-auth.route.test.ts @@ -45,6 +45,7 @@ function stubExchange(overrides?: Partial> appleId: AppleIdSchema.parse("apple-sub-123"), email: "apple@example.com", emailVerified: true, + appleRefreshToken: "apple-refresh-123", ...overrides, }); } @@ -461,6 +462,42 @@ describe("Apple auth routes", () => { expect(passwordCheck.ok).toBe(true); }); + it("persists Apple's refresh token at signup so account deletion can revoke the grant", async () => { + const fixture = createDefaultTestAppFixture(TEST_APP_ORIGIN); + const harness = useApp({ ...fixture, apple: appleWith(stubExchange({ email: "revocable@example.com" })) }); + const { auth } = harness; + const state = signState(freshState()); + + const response = await postCallback(harness.server, { + state, + cookie: `hutch_astate=${encodeURIComponent(state)}`, + }); + + expect(response.status).toBe(303); + const lookup = await auth.findUserByEmail("revocable@example.com"); + assert(lookup, "Apple signup must create the user"); + expect(await auth.findAppleRefreshTokenByUserId(lookup.userId)).toBe("apple-refresh-123"); + }); + + it("stores the fresh refresh token when an existing account signs in with Apple", async () => { + const fixture = createDefaultTestAppFixture(TEST_APP_ORIGIN); + const harness = useApp({ ...fixture, apple: appleWith(stubExchange({ email: "existing@example.com" })) }); + const { auth } = harness; + const createResult = await auth.createUser({ email: "existing@example.com", password: "password123" }); + assert(createResult.ok, "setup failed"); + await auth.markEmailVerified("existing@example.com"); + expect(await auth.findAppleRefreshTokenByUserId(createResult.userId)).toBe(null); + const state = signState(freshState()); + + const response = await postCallback(harness.server, { + state, + cookie: `hutch_astate=${encodeURIComponent(state)}`, + }); + + expect(response.status).toBe(303); + expect(await auth.findAppleRefreshTokenByUserId(createResult.userId)).toBe("apple-refresh-123"); + }); + it("should upgrade an unverified email/password account to verified", async () => { const fixture = createDefaultTestAppFixture(TEST_APP_ORIGIN); const harness = useApp({ ...fixture, apple: appleWith(stubExchange({ email: "unverified@example.com" })) }); diff --git a/projects/hutch/src/runtime/web/auth/auth.route.test.ts b/projects/hutch/src/runtime/web/auth/auth.route.test.ts index 9255311af..9b2f5cc7e 100644 --- a/projects/hutch/src/runtime/web/auth/auth.route.test.ts +++ b/projects/hutch/src/runtime/web/auth/auth.route.test.ts @@ -1257,19 +1257,17 @@ describe("Auth routes", () => { }); // Fail-closed guard for App Store 5.1.1(v): Sign in with Apple and the - // delete-account worker's Apple-token revocation MUST ship together. - // While SIWA is dark-launched (button gated behind ?feature=apple, never set - // in production), `revoke-external-idp-tokens.ts` is a safe no-op and - // `apple-token.ts` discards Apple's refresh_token — there is nothing to revoke. - // The day a normal user can reach SIWA, in-app deletion must also revoke the - // Apple grant (persist refresh_token + POST https://appleid.apple.com/auth/revoke), - // or Apple leaves the app in the user's "Sign in with Apple" list and rejects - // under the exact guideline this PR targets. This test couples the two facts - // as an equality — they must move together — so the only accepted states are - // {reachable:false, persisted:false} (today) and {reachable:true, persisted:true} - // (SIWA live + revocation wired). Un-gating SIWA without wiring revocation - // (the dangerous {true, false}) — or, symmetrically, drifting either alone — - // turns CI red and points here. + // delete-account worker's Apple-token revocation MUST ship together. While + // SIWA is reachable, in-app deletion must also revoke the Apple grant + // (persist refresh_token + POST https://appleid.apple.com/auth/revoke), or + // Apple leaves the app in the user's "Sign in with Apple" list and rejects + // under the exact guideline this feature targets. This test couples the two + // facts as an equality — they must move together — so the only accepted + // states are {reachable:true, persisted:true} (today: SIWA live + revocation + // wired) and {reachable:false, persisted:false} (a re-dark-launch that also + // retires the token). Dropping refresh_token from the exchange schema while + // SIWA stays reachable (the dangerous {true, false}) — or, symmetrically, + // drifting either alone — turns CI red and points here. it("locks Sign in with Apple to Apple account-deletion revocation (App Store 5.1.1(v))", async () => { const harness = useApp(createDefaultTestAppFixture(TEST_APP_ORIGIN)); const loginNoFlag = (await request(harness.server).get("/login")).text; diff --git a/src/packages/provider-contracts/src/apple-auth.ts b/src/packages/provider-contracts/src/apple-auth.ts index 444f5f0ca..62e2c9ff0 100644 --- a/src/packages/provider-contracts/src/apple-auth.ts +++ b/src/packages/provider-contracts/src/apple-auth.ts @@ -8,6 +8,9 @@ export interface AppleTokenResult { appleId: AppleId; email: string; emailVerified: boolean; + /** Apple's refresh_token from the code exchange. Persisted so account + * deletion can revoke the Sign in with Apple grant (App Store 5.1.1(v)). */ + appleRefreshToken: string; } export type ExchangeAppleCode = (code: string) => Promise; diff --git a/src/packages/provider-contracts/src/auth.ts b/src/packages/provider-contracts/src/auth.ts index 1163318e2..e5799e447 100644 --- a/src/packages/provider-contracts/src/auth.ts +++ b/src/packages/provider-contracts/src/auth.ts @@ -100,9 +100,21 @@ export type CreateGoogleUser = (user: { export type CreateAppleUser = (user: { email: string; userId: UserId; + appleRefreshToken: string; attribution?: UserAcquisitionAttribution; }) => Promise; +/** Upserts the Apple refresh_token onto an existing user's row. Apple mints a + * fresh refresh_token on every code exchange, and a returning user may predate + * token persistence — so every Apple login stores the newest grant, keeping + * account-deletion revocation possible for all Sign in with Apple users. */ +export type SaveAppleRefreshToken = (params: { + email: string; + appleRefreshToken: string; +}) => Promise; + +export type FindAppleRefreshTokenByUserId = (userId: UserId) => Promise; + export type BotDefenseRejectReason = | "honeypot" | "submit_too_fast" diff --git a/src/packages/test-fixtures/src/fixture.ts b/src/packages/test-fixtures/src/fixture.ts index 994e597b4..89872f6f4 100644 --- a/src/packages/test-fixtures/src/fixture.ts +++ b/src/packages/test-fixtures/src/fixture.ts @@ -403,6 +403,7 @@ export function createDefaultTestAppFixture(appOrigin: string): TestAppFixture { appleId: AppleIdSchema.parse("apple-sub-default"), email: "apple-default@example.com", emailVerified: true, + appleRefreshToken: "apple-refresh-default", }), clientId: "com.readplace.web", stateSigningSecret: "test-apple-state-secret", diff --git a/src/packages/test-fixtures/src/providers/auth/in-memory-auth.test.ts b/src/packages/test-fixtures/src/providers/auth/in-memory-auth.test.ts index 8a951b954..19f61dd40 100644 --- a/src/packages/test-fixtures/src/providers/auth/in-memory-auth.test.ts +++ b/src/packages/test-fixtures/src/providers/auth/in-memory-auth.test.ts @@ -465,7 +465,11 @@ describe("initInMemoryAuth", () => { const auth = makeAuth(); const userId = UserIdSchema.parse("apple-user-123"); - const result = await auth.createAppleUser({ email: "apple@example.com", userId }); + const result = await auth.createAppleUser({ + email: "apple@example.com", + userId, + appleRefreshToken: "apple-refresh-123", + }); expect(result).toEqual({ ok: true, userId }); const lookup = await auth.findUserByEmail("apple@example.com"); @@ -483,6 +487,7 @@ describe("initInMemoryAuth", () => { const result = await auth.createAppleUser({ email: "test@example.com", userId: UserIdSchema.parse("other-id"), + appleRefreshToken: "apple-refresh-dup", }); expect(result).toEqual({ ok: false, reason: "email-already-exists" }); @@ -493,17 +498,75 @@ describe("initInMemoryAuth", () => { await auth.createAppleUser({ email: "Apple@Example.COM", userId: UserIdSchema.parse("apple-user-1"), + appleRefreshToken: "apple-refresh-1", }); const result = await auth.createAppleUser({ email: "apple@example.com", userId: UserIdSchema.parse("apple-user-2"), + appleRefreshToken: "apple-refresh-2", }); expect(result).toEqual({ ok: false, reason: "email-already-exists" }); }); }); + describe("Apple refresh token storage", () => { + it("stores the token at Apple signup and resolves it by userId", async () => { + const auth = makeAuth(); + const userId = UserIdSchema.parse("apple-user-123"); + await auth.createAppleUser({ + email: "apple@example.com", + userId, + appleRefreshToken: "apple-refresh-123", + }); + + expect(await auth.findAppleRefreshTokenByUserId(userId)).toBe("apple-refresh-123"); + }); + + it("returns null for users who never signed in with Apple", async () => { + const auth = makeAuth(); + const created = await auth.createUser({ email: "password@example.com", password: "password123" }); + assert(created.ok, "User creation failed"); + + expect(await auth.findAppleRefreshTokenByUserId(created.userId)).toBe(null); + }); + + it("returns null for an unknown userId", async () => { + const auth = makeAuth(); + + expect(await auth.findAppleRefreshTokenByUserId(UserIdSchema.parse("ghost"))).toBe(null); + }); + + it("saveAppleRefreshToken overwrites the stored token for an existing user", async () => { + const auth = makeAuth(); + const userId = UserIdSchema.parse("apple-user-123"); + await auth.createAppleUser({ + email: "apple@example.com", + userId, + appleRefreshToken: "apple-refresh-old", + }); + + await auth.saveAppleRefreshToken({ + email: "Apple@Example.com", + appleRefreshToken: "apple-refresh-new", + }); + + expect(await auth.findAppleRefreshTokenByUserId(userId)).toBe("apple-refresh-new"); + }); + + it("saveAppleRefreshToken rejects for an unknown email, mirroring the conditional Dynamo update", async () => { + const auth = makeAuth(); + + await expect( + auth.saveAppleRefreshToken({ + email: "ghost@example.com", + appleRefreshToken: "apple-refresh-x", + }), + ).rejects.toThrow(/no user found/); + }); + }); + describe("findUserContactByUserId", () => { it("returns email and unverified flag for a known userId", async () => { const auth = makeAuth(); diff --git a/src/packages/test-fixtures/src/providers/auth/in-memory-auth.ts b/src/packages/test-fixtures/src/providers/auth/in-memory-auth.ts index e7bb16e50..c5e50193c 100644 --- a/src/packages/test-fixtures/src/providers/auth/in-memory-auth.ts +++ b/src/packages/test-fixtures/src/providers/auth/in-memory-auth.ts @@ -19,6 +19,7 @@ import type { DestroySession, DestroyUserSessions, ExistsUserByIdPrefix, + FindAppleRefreshTokenByUserId, FindEmailByUserId, FindUserById, FindUserByEmail, @@ -26,6 +27,7 @@ import type { GetSessionUserId, MarkEmailVerified, MarkSessionEmailVerified, + SaveAppleRefreshToken, UpdatePassword, UserAcquisitionAttribution, UserExistsByEmail, @@ -36,6 +38,7 @@ interface StoredUser { id: UserId; email: string; passwordHash: string | undefined; + appleRefreshToken: string | undefined; emailVerified: boolean; registeredAt: string; attribution?: UserAcquisitionAttribution; @@ -54,6 +57,8 @@ export function initInMemoryAuth(opts: { createUserWithPasswordHash: CreateUserWithPasswordHash; createGoogleUser: CreateGoogleUser; createAppleUser: CreateAppleUser; + saveAppleRefreshToken: SaveAppleRefreshToken; + findAppleRefreshTokenByUserId: FindAppleRefreshTokenByUserId; findUserByEmail: FindUserByEmail; verifyCredentials: VerifyCredentials; createSession: CreateSession; @@ -109,6 +114,7 @@ export function initInMemoryAuth(opts: { id: userId, email: normalizedEmail, passwordHash, + appleRefreshToken: undefined, emailVerified: false, registeredAt: new Date().toISOString(), attribution, @@ -129,6 +135,7 @@ export function initInMemoryAuth(opts: { id: userId, email: normalizedEmail, passwordHash, + appleRefreshToken: undefined, emailVerified: false, registeredAt: new Date().toISOString(), attribution, @@ -139,29 +146,54 @@ export function initInMemoryAuth(opts: { }; /** A user created from a federated identity provider (Google/Apple): verified - * email, no password. Both providers share this body because they differ only - * in which contract type names the seam, not in what is persisted. */ - const createFederatedUser: CreateGoogleUser = async ({ email, userId, attribution }) => { + * email, no password. Apple rows additionally carry the refresh token that + * account deletion revokes; Google persists no token. */ + const createFederatedUser = async ({ + email, + userId, + attribution, + appleRefreshToken, + }: { + email: string; + userId: UserId; + attribution?: UserAcquisitionAttribution; + appleRefreshToken?: string; + }) => { const normalizedEmail = reserveIdentity(email, userId); if (normalizedEmail === null) { - return { ok: false, reason: "email-already-exists" }; + return { ok: false as const, reason: "email-already-exists" as const }; } users.set(normalizedEmail, { id: userId, email: normalizedEmail, passwordHash: undefined, + appleRefreshToken, emailVerified: true, registeredAt: new Date().toISOString(), attribution, }); userIdPrefixes.add(userIdPrefixFrom(userId)); - return { ok: true, userId }; + return { ok: true as const, userId }; }; const createGoogleUser: CreateGoogleUser = createFederatedUser; const createAppleUser: CreateAppleUser = createFederatedUser; + const saveAppleRefreshToken: SaveAppleRefreshToken = async ({ email, appleRefreshToken }) => { + const normalizedEmail = normalizeEmail(email); + const user = users.get(normalizedEmail); + assert(user, `Cannot save Apple refresh token: no user found for ${normalizedEmail}`); + user.appleRefreshToken = appleRefreshToken; + }; + + const findAppleRefreshTokenByUserId: FindAppleRefreshTokenByUserId = async (userId) => { + for (const user of users.values()) { + if (user.id === userId) return user.appleRefreshToken ?? null; + } + return null; + }; + const findUserByEmail: FindUserByEmail = async (email) => { const normalizedEmail = normalizeEmail(email); const user = users.get(normalizedEmail); @@ -306,6 +338,8 @@ export function initInMemoryAuth(opts: { createUserWithPasswordHash, createGoogleUser, createAppleUser, + saveAppleRefreshToken, + findAppleRefreshTokenByUserId, findUserByEmail, verifyCredentials, createSession, diff --git a/src/packages/web-test-harness/src/bundle.types.ts b/src/packages/web-test-harness/src/bundle.types.ts index 194a5fc27..dafdce265 100644 --- a/src/packages/web-test-harness/src/bundle.types.ts +++ b/src/packages/web-test-harness/src/bundle.types.ts @@ -41,6 +41,7 @@ import type { FindArticleByUrl, FindArticleCrawlStatus, FindArticleFreshness, + FindAppleRefreshTokenByUserId, FindArticleUrlById, FindArticlesByUser, FindEmailByUserId, @@ -99,6 +100,7 @@ import type { RefreshArticleIfStale, RetrieveCheckoutSession, ReverseScheduledCancellation, + SaveAppleRefreshToken, SaveArticle, SaveArticleGlobally, ScheduleCancellationAtPeriodEnd, @@ -130,6 +132,8 @@ export interface AuthBundle { createUserWithPasswordHash: CreateUserWithPasswordHash; createGoogleUser: CreateGoogleUser; createAppleUser: CreateAppleUser; + saveAppleRefreshToken: SaveAppleRefreshToken; + findAppleRefreshTokenByUserId: FindAppleRefreshTokenByUserId; findUserByEmail: FindUserByEmail; verifyCredentials: VerifyCredentials; createSession: CreateSession; From fb3d8bb77450a72aa481fbde86948e0d73a7dc53 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Tue, 7 Jul 2026 00:33:17 +0000 Subject: [PATCH 9/9] fix(delete-account): scrub the trial-reminder schedule on deletion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The #939 merge added a fourth per-user EventBridge schedule (trial-reminder-), created for every trialing user at signup/trial-start, but the delete-account worker still deleted only three (trial-end, deferred-cancellation, trial-feedback). An account deleted mid-trial therefore left an orphaned, user-keyed reminder schedule live at AWS until its natural fire time — the exact kind of user-owned remnant this compliance feature exists to erase — and the handler's own "all three" comment misstated the count. Wire deleteTrialReminderSchedule into the worker alongside the other three deletes (it is ResourceNotFound-idempotent, so a redrive converges), correct the comment to "all four", and cover it in the trialing and founding-member branch tests plus the raw-email redrive test (which exercises the schedule delete on both the failed first delivery and the retry). No IAM change: the worker's scheduler:DeleteSchedule grant is a group-level wildcard that already permits the reminder schedule name. The sibling cancel-subscription worker already deletes this same schedule for a trialing cancel. Co-authored-by: Fayner Brack --- .../hutch/src/runtime/delete-account.main.ts | 1 + .../delete-account-handler.test.ts | 16 +++++++++++++++- .../delete-account/delete-account-handler.ts | 5 ++++- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/projects/hutch/src/runtime/delete-account.main.ts b/projects/hutch/src/runtime/delete-account.main.ts index 5a4e1074d..f50646ced 100644 --- a/projects/hutch/src/runtime/delete-account.main.ts +++ b/projects/hutch/src/runtime/delete-account.main.ts @@ -157,6 +157,7 @@ export const handler = initDeleteAccountHandler({ deleteTrialEndSchedule: trialScheduler.deleteTrialEndSchedule, deleteDeferredCancellationSchedule: trialScheduler.deleteDeferredCancellationSchedule, deleteTrialFeedbackEmailSchedule: trialScheduler.deleteTrialFeedbackEmailSchedule, + deleteTrialReminderSchedule: trialScheduler.deleteTrialReminderSchedule, listInboxDeletionReferences: inboxEmail.listDeletionReferencesByUserId, deleteAllInboxEmails: inboxEmail.deleteAllEmailsByUserId, deleteAllInboxLinks: inboxEmailLink.deleteAllLinksByUserId, diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts index e5da155fc..60c52a7e3 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.test.ts @@ -66,6 +66,7 @@ function buildSubject() { const trialEndCalls: UserId[] = []; const deferredCancelCalls: UserId[] = []; const trialFeedbackCalls: UserId[] = []; + const trialReminderCalls: UserId[] = []; const rawEmailDeleteArgs: string[][] = []; const bodyEmailDeleteArgs: string[][] = []; const deleteExportsCalls: UserId[] = []; @@ -123,6 +124,9 @@ function buildSubject() { deleteTrialFeedbackEmailSchedule: async ({ userId }: { userId: UserId }) => { trialFeedbackCalls.push(userId); }, + deleteTrialReminderSchedule: async ({ userId }: { userId: UserId }) => { + trialReminderCalls.push(userId); + }, listInboxDeletionReferences: inboxEmail.listDeletionReferencesByUserId, deleteAllInboxEmails: inboxEmail.deleteAllEmailsByUserId, deleteAllInboxLinks: inboxLink.deleteAllLinksByUserId, @@ -185,6 +189,7 @@ function buildSubject() { trialEndCalls, deferredCancelCalls, trialFeedbackCalls, + trialReminderCalls, rawEmailDeleteArgs, bodyEmailDeleteArgs, deleteExportsCalls, @@ -473,7 +478,7 @@ describe("delete-account handler", () => { assert.equal(await s.subs.findByUserId(account.userId), undefined); }); - it("trialing branch — no Stripe calls, but the row is dropped and all three schedules deleted", async () => { + it("trialing branch — no Stripe calls, but the row is dropped and all four schedules deleted", async () => { const s = buildSubject(); const account = await seedAccount(s, { label: "trial", @@ -489,6 +494,7 @@ describe("delete-account handler", () => { assert.deepEqual(s.trialEndCalls, [account.userId]); assert.deepEqual(s.deferredCancelCalls, [account.userId]); assert.deepEqual(s.trialFeedbackCalls, [account.userId]); + assert.deepEqual(s.trialReminderCalls, [account.userId]); }); it("founding-member branch — no subscription row, so no billing calls, but the schedules are still deleted", async () => { @@ -507,6 +513,7 @@ describe("delete-account handler", () => { assert.deepEqual(s.trialEndCalls, [account.userId]); assert.deepEqual(s.deferredCancelCalls, [account.userId]); assert.deepEqual(s.trialFeedbackCalls, [account.userId]); + assert.deepEqual(s.trialReminderCalls, [account.userId]); }); it("is idempotent — a second run against the now-empty account does not throw and reports no failures", async () => { @@ -641,5 +648,12 @@ describe("delete-account handler", () => { assert.equal(s.rawEmailDeleteArgs.length, 1); assert.deepEqual(sorted(s.rawEmailDeleteArgs[0]), sorted(account.rawKeys)); assert.equal((await s.inboxEmail.listEmailsByUserId(account.userId)).length, 0); + + // The per-user schedule deletes run before the injected S3 failure, so the + // pre-expiry trial-reminder schedule delete fired on both the failed first + // delivery and the redrive. Being ResourceNotFound-idempotent, the repeat is + // a no-op — a trialing account that deletes mid-trial leaves no orphaned + // reminder schedule live at AWS after a redrive. + assert.deepEqual(s.trialReminderCalls, [account.userId, account.userId]); }); }); diff --git a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts index e396fb86d..7e1fb866c 100644 --- a/projects/hutch/src/runtime/delete-account/delete-account-handler.ts +++ b/projects/hutch/src/runtime/delete-account/delete-account-handler.ts @@ -30,6 +30,7 @@ import type { DeleteDeferredCancellationSchedule, DeleteTrialEndSchedule, DeleteTrialFeedbackEmailSchedule, + DeleteTrialReminderSchedule, } from "@packages/provider-contracts/trial-scheduler"; import type { InboxAddressStore, @@ -47,6 +48,7 @@ export interface DeleteAccountHandlerDependencies { deleteTrialEndSchedule: DeleteTrialEndSchedule; deleteDeferredCancellationSchedule: DeleteDeferredCancellationSchedule; deleteTrialFeedbackEmailSchedule: DeleteTrialFeedbackEmailSchedule; + deleteTrialReminderSchedule: DeleteTrialReminderSchedule; listInboxDeletionReferences: InboxEmailStore["listDeletionReferencesByUserId"]; deleteAllInboxEmails: InboxEmailStore["deleteAllEmailsByUserId"]; deleteAllInboxLinks: InboxEmailLinkStore["deleteAllLinksByUserId"]; @@ -100,10 +102,11 @@ async function processCommand( } // Delete every per-user schedule so a later fire can't dispatch a command at - // a deleted account. All three are ResourceNotFound-idempotent. + // a deleted account. All four are ResourceNotFound-idempotent. await deps.deleteTrialEndSchedule({ userId }); await deps.deleteDeferredCancellationSchedule({ userId }); await deps.deleteTrialFeedbackEmailSchedule({ userId }); + await deps.deleteTrialReminderSchedule({ userId }); // Inbox: read the pointers the email rows hold (S3 keys + link message-ids) // while the rows still exist, then delete the S3 objects and link rows, and