Add soft account deletion safeguards

src/routes/account/+page.server.ts

@@ -1,4 +1,5 @@
 import { createSession, getSessionUser } from '$lib/server/auth/session';
+import { softDeleteAccount } from '$lib/server/auth/account-deletion';
 import { hashPassword, verifyPassword } from '$lib/server/auth/password';
 import { getDatabase } from '$lib/server/database';
 import { fail, redirect } from '@sveltejs/kit';
@@ -14,7 +15,28 @@ export const load: PageServerLoad = async ({ cookies, url }) => {
 		(await database.prepare('SELECT builds.id, builds.title, builds.slug, users.username AS author FROM favorites JOIN builds ON builds.id = favorites.build_id JOIN users ON users.id = builds.owner_id WHERE favorites.user_id = ? ORDER BY favorites.created_at DESC')).all(user.id),
 		(await database.prepare('SELECT builds.id, builds.title, builds.slug, users.username AS author, ratings.value FROM ratings JOIN builds ON builds.id = ratings.build_id JOIN users ON users.id = builds.owner_id WHERE ratings.user_id = ? ORDER BY builds.updated_at DESC')).all(user.id)
 	]);
-	return { account: { builds, guides, favorites, ratings }, chooseUsername: url.searchParams.has('choose_username'), discordLinked: url.searchParams.has('discord_linked'), oauthError: url.searchParams.has('oauth_error') };
+	const oauthErrorCode = url.searchParams.get('oauth_error');
+	const oauthErrors: Record<string, { title: string; message: string }> = {
+		discord_in_use: {
+			title: 'DISCORD ACCOUNT ALREADY LINKED',
+			message: 'That Discord account belongs to another SHD.build agent. No accounts were changed. Sign out, then use Continue with Discord to access the existing account.'
+		},
+		link_session_changed: {
+			title: 'SESSION CHANGED',
+			message: 'Your SHD.build session changed while Discord was connecting. Sign in to the intended account and try linking again.'
+		},
+		discord_denied: {
+			title: 'DISCORD AUTHORIZATION CANCELLED',
+			message: 'Discord did not authorize the connection. Your SHD.build account was not changed.'
+		}
+	};
+	const oauthError = oauthErrorCode
+		? oauthErrors[oauthErrorCode] ?? {
+			title: 'DISCORD LINK FAILED',
+			message: 'Discord linking could not be completed. Your existing sign-in methods and account data were not changed.'
+		}
+		: null;
+	return { account: { builds, guides, favorites, ratings }, chooseUsername: url.searchParams.has('choose_username'), discordLinked: url.searchParams.has('discord_linked'), oauthError };
 };
 
 export const actions: Actions = {
@@ -43,5 +65,23 @@ export const actions: Actions = {
 		await (await database.prepare('DELETE FROM sessions WHERE user_id = ?')).run(user.id);
 		await createSession(cookies, user.id);
 		return { passwordChanged: true };
+	},
+	deleteAccount: async ({ request, cookies }) => {
+		const user = await getSessionUser(cookies);
+		if (!user) redirect(303, '/sign-in');
+		const form = await request.formData();
+		const confirmation = String(form.get('confirmation') ?? '').normalize('NFKC').trim();
+		const password = String(form.get('password') ?? '');
+		if (confirmation !== user.username) return fail(400, { deleteError: `Enter ${user.username} exactly to confirm deletion.` });
+		const database = await getDatabase();
+		const credential = await (await database.prepare('SELECT password_hash FROM users WHERE id=?')).get(user.id);
+		if (typeof credential?.password_hash === 'string' && !(await verifyPassword(credential.password_hash, password))) {
+			return fail(400, { deleteError: 'Your password is incorrect.' });
+		}
+		if (!(await softDeleteAccount(database, user.id, user.id, 'Deleted by account owner'))) {
+			return fail(409, { deleteError: 'This account has already been deleted.' });
+		}
+		cookies.delete('shd_session', { path: '/' });
+		redirect(303, '/?account_deleted=1');
 	}
 };