Remove the invite and sign-in log entries when an account is deleted

Aperta
  • Qualcosa non va?
#359 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
42/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
nextjs, postgresql, supabase, typescript
Ambito
backend, databases, documentation

Direzione di ricerca

Start at deleteUserAccount in src/lib/data/account.ts (around line 222) and read it next to removeSyntheticUser in e2e/fixtures/auth.ts, which shows the manual invite cleanup to fold in. Read the public.access_invites definition in supabase/migrations/20261031090300_jobs_and_invites.sql and copy the batching pattern from the existing purges in src/lib/jobs/retention.ts for the auth.audit_log_entries sweep, which needs a service-role SQL function since auth is not exposed to PostgREST. Done means both unit cases pass, npx supabase test db covers deleted and surviving users, and the privacy page, PRIVACY_UPDATED, docs/architecture/schema.md and scripts/invite.ts agree.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area: auth enhancement impact: medium priority: P2 size: S

Summary

Deleting an account leaves two records that hold the person's email address: their row on the invite list and Supabase Auth's log of sign-in events. The privacy policy from #339 (pull request #349, review round 2) now says so and tells people to email the operator to have them removed. This issue makes deletion remove them instead, so the policy can say "deleting your account removes everything".

Found by review round 2 of #349 (inline comment https://github.com/eddiejaoude/DevMacro/pull/349#discussion_r4548534055).

Evidence

  • deleteUserAccount (src/lib/data/account.ts:222) calls auth.admin.deleteUser and nothing else.
  • public.access_invites (supabase/migrations/20261031090300_jobs_and_invites.sql:116) keys on the email with no foreign key to auth.users, so the row stays. scripts/invite.ts:9 documents removal as a separate manual step, and e2e/fixtures/auth.ts (removeSyntheticUser) deletes the invite by hand after deleting the user.
  • auth.audit_log_entries keeps every sign-up, sign-in, refresh, sign-out, and deletion event with the email in payload.actor_username. Nothing in src/lib/jobs/retention.ts, the migrations, or supabase/config.toml deletes rows from it.
  • Reproduced on the local stack with a synthetic user (legal-probe-*@example.com): after auth.admin.deleteUser, auth.sessions held 0 rows for the user, public.access_invites still held 1 row for the email, and auth.audit_log_entries held 7 rows naming the email (login, logout, token_refreshed, token_revoked, user_deleted, user_signedup), none with an ip_address.
  • Hosted: Supabase writes the audit log to its own log storage always, and to auth.audit_log_entries only while Authentication, Audit Logs, Write audit logs to the database is on (https://supabase.com/docs/guides/auth/audit-logs). The hosted project's setting has not been checked.

Scope

  • deleteUserAccount deletes the account's access_invites row (by its lowercased email, read before the user is deleted) once auth.admin.deleteUser succeeds. A failure there is logged with a reference id and does not undo the deletion. A person who deletes their account then needs a new invite to come back, which matches "deleting removes everything".
  • The daily retention job (src/lib/jobs/retention.ts) deletes auth.audit_log_entries rows whose payload->>'actor_id' no longer exists in auth.users, in batches like the other purges, through a service role database function (the auth schema is not exposed to PostgREST).
  • Update the privacy policy (src/app/privacy/page.tsx: the invite item, the retention items, and the deletion paragraph), PRIVACY_UPDATED, docs/architecture/schema.md, and scripts/invite.ts's comment to match.
  • Not in scope: Supabase's own copy of the audit log in its log storage, which the app cannot delete; the policy keeps saying Supabase holds it for the period its service sets.

Acceptance criteria

  • Deleting an account removes its invite row (unit test for the happy path and for the invite delete failing after the user is gone).
  • The retention job removes audit log entries of deleted users and keeps those of existing users (database test with npx supabase test db, both cases).
  • The privacy policy no longer lists the invite row or the database audit log among what survives deletion.
  • e2e/fixtures/auth.ts no longer deletes the invite by hand where the app now does it.

Model: anthropic/claude-opus-5-5 | Reasoning effort: unknown

Lingua principale
TypeScript
Stelle
1
Fork
1
Merge medio
6h 56m
PR unite (30g)
136

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di eddiejaoude/StackDash

Tutte le issue di eddiejaoude/StackDash

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.