Andras/BoundlessFlowCampus2K
4
7
Fork 0
Code Issues 90 Pull requests 7 Projects Releases Packages Wiki Activity Actions

#922-Implement-a-fucntion-to-delete-a-account #1096

Merged
a22erigr merged 9 commits from #922-Implement-a-fucntion-to-delete-a-account- into team_2_week_7 2026-05-25 09:14:32 +00:00
Conversation 3 Commits 9 Files changed 20 +613 -479
c24elipe commented 2026-05-21 14:17:07 +00:00
Collaborator
Copy link

Implement a function to delete a user using the login service.

Environment

This was developed on an Arch-based Linux distribution.

What has been done?

  • service/loginService/loginService/DatabaseLogic/DatabaseQueries.cs
    • I added the functionality/function to delete a user
  • service/loginService/loginService/DatabaseLogic/IDatabaseQueries.cs
    • Added the delete function in the interface
  • service/loginService/loginService/Endpoints/AuthEndpoints.cs
    • Added delete endpoint (now based on JWT authentication to work)
    • Updated the structure to be more testable
  • service/loginService/loginService/Models/Requests/DeleteUserDto.cs
    • To contain the request data
  • service/loginService/loginService/Services/AuthService.cs
    • Added the delete logic

Issue:

#922

# Implement a function to delete a user using the login service. ## Environment This was developed on an Arch-based Linux distribution. ## What has been done? * **service/loginService/loginService/DatabaseLogic/DatabaseQueries.cs** * I added the functionality/function to delete a user * **service/loginService/loginService/DatabaseLogic/IDatabaseQueries.cs** * Added the delete function in the interface * **service/loginService/loginService/Endpoints/AuthEndpoints.cs** * Added delete endpoint (now based on JWT authentication to work) * Updated the structure to be more testable * **service/loginService/loginService/Models/Requests/DeleteUserDto.cs** * To contain the request data * **service/loginService/loginService/Services/AuthService.cs** * Added the delete logic ## Issue: #922
c24elipe changed title from #922-Implement-a-fucntion-to-delete-a-account- to #922-Implement-a-fucntion-to-delete-a-account 2026-05-21 14:17:24 +00:00
c24elipe changed title from #922-Implement-a-fucntion-to-delete-a-account- to #922-Implement-a-fucntion-to-delete-a-account 2026-05-21 14:17:33 +00:00
c24elipe changed title from #922-Implement-a-fucntion-to-delete-a-account- to #922-Implement-a-fucntion-to-delete-a-account 2026-05-21 14:17:44 +00:00
c24elipe changed title from #922-Implement-a-fucntion-to-delete-a-account- to #922-Implement-a-fucntion-to-delete-a-account 2026-05-21 14:17:48 +00:00
b23albst requested changes 2026-05-22 09:36:30 +00:00
Dismissed
b23albst left a comment
Collaborator
Copy link

Review on #1096

Whats done

Reviewed the code and tested the endpoint using RESTer

Tested on ubuntu using firefox

  • App starts
    • After creating an account and logging in, delete user endpoint successfully deleted the user
    • However, as the access token cookie is still left, the user is still logged in even after deleting the account.

Inspected following files

  • Indentation/code styling ok
  • Naming convention ok
  • Comments ok
  • General code quality
    • I think the code is really clear and purposeful

What needs to be done

Even though I love that the solution uses the JWT, I does not follow the issue description in some aspects. These are:

  • The user needing to verify their password before account deletion.
    • I think this is a valid point, since right now, a malicious actor only needs to acquire a users JWT (which is supposed to be difficult, but there are probably crafty people out there). Requiring the password as well would be a second layer of security.
  • When an account is deleted, the user should be logged out.
    • Since the cookie persists, the user stays logged in

Another possible issue is that currently you have to be logged in to an account to delete it. In the future, there will probably be a need to delete accounts that you are not logged in to, e.g. for admins. This could however be solved by a different endpoint, so I do not think this is a requirement

Conclusion

  • Even though every thing worked and seeing the JWT being used is like my child graduating from high school, I think the requirements of the issue should be met before merging.
# Review on #1096 ## Whats done Reviewed the code and tested the endpoint using RESTer ### Tested on ubuntu using firefox + App starts + After creating an account and logging in, delete user endpoint successfully deleted the user + However, as the access token cookie is still left, the user is still logged in even after deleting the account. ### Inspected following files + Indentation/code styling ok + Naming convention ok + Comments ok + General code quality + I think the code is really clear and purposeful ## What needs to be done Even though I love that the solution uses the JWT, I does not follow the issue description in some aspects. These are: + The user needing to verify their password before account deletion. + I think this is a valid point, since right now, a malicious actor only needs to acquire a users JWT (which is supposed to be difficult, but there are probably crafty people out there). Requiring the password as well would be a second layer of security. + When an account is deleted, the user should be logged out. + Since the cookie persists, the user stays logged in Another possible issue is that currently you have to be logged in to an account to delete it. In the future, there will probably be a need to delete accounts that you are not logged in to, e.g. for admins. This could however be solved by a different endpoint, so I do not think this is a requirement ## Conclusion + Even though every thing worked and seeing the JWT being used is like my child graduating from high school, I think the requirements of the issue should be met before merging.
c24elipe commented 2026-05-22 13:49:04 +00:00
Author
Collaborator
Copy link

I have now implemented the missing features

I have now implemented the missing features
b23albst approved these changes 2026-05-25 09:05:23 +00:00
b23albst left a comment
Collaborator
Copy link

Review on #1096 after changes

Whats done

Tested the added functionality and reviewed the code

Tested on ubuntu using firefox

  • App starts
    • Accessing delete user while not logged in returned 401, correct.
    • When logged in and trying to delete a user with incorrect username or password it was not deleted
    • When logged in and trying to delete a user with correct credentials, user was deleted and cookie containing access token was removed (success)

Inspected following files

  • Indentation/code styling ok
  • Naming convention ok
  • Comments ok
  • General code quality
    • One possible issue i noticed was in service/loginService/loginService/Endpoints/AuthEndpoints.cs, where one could argue that separation of business logic and endpoints are mixed up, similar to issue #1089. If the code that, eg. checks if the username and password was passed, does not have to be here, I would suggest moving it to DeleteAccountAsync in AuthService.cs. However, this is not a major deal.

What needs to be done

  • Move business logic part from AuthEndpoints.cs to AuthService.cs (if possible), though since everything works, I think this is optional.

Conclusion

  • I think this can be merged
# Review on #1096 after changes ## Whats done Tested the added functionality and reviewed the code ### Tested on ubuntu using firefox + App starts + Accessing delete user while not logged in returned 401, correct. + When logged in and trying to delete a user with incorrect username or password it was not deleted + When logged in and trying to delete a user with correct credentials, user was deleted and cookie containing access token was removed (success) ### Inspected following files + Indentation/code styling ok + Naming convention ok + Comments ok + General code quality + One possible issue i noticed was in service/loginService/loginService/Endpoints/AuthEndpoints.cs, where one could argue that separation of business logic and endpoints are mixed up, similar to issue #1089. If the code that, eg. checks if the username and password was passed, does not have to be here, I would suggest moving it to DeleteAccountAsync in AuthService.cs. However, this is not a major deal. ## What needs to be done + Move business logic part from AuthEndpoints.cs to AuthService.cs (if possible), though since everything works, I think this is optional. ## Conclusion + I think this can be merged
a22erigr merged commit 77769904fc into team_2_week_7 2026-05-25 09:14:32 +00:00
a22erigr deleted branch #922-Implement-a-fucntion-to-delete-a-account- 2026-05-25 09:14:32 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
b23albst
Labels
Clear labels   
_CRITICAL_

Only use this label for critical tasks that are project-scope,and must be addressed ASAP.

  
API

   
app

   
backEnd

   
Blocked, waiting for further changes

   
bug

Something is not working

  
cleanup

Issues to cleanup the codebase (restructure folders, remove deprecated or smelly code)

  
close

Issue to close

  
design

   
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
feature request

   
frontEnd

   
help wanted

Need some help

  
invalid

Something is wrong

  
low priority

   
needs input

Issue needs input from product owner or customer

  
needs review

issue is in need of review

  
project documentation

   
question

More information is needed

  
research

   
reviewed

This Issue has been reviewed

  
script

   
security

use this for security-related issues

  
SQL

  
style

   
testing

   
topLevel

Reserved for top-level, project-wide issues.

  
wontfix

This won't be fixed

No labels
_CRITICAL_
API
app
backEnd
Blocked, waiting for further changes
bug
cleanup
close
design
duplicate
enhancement
feature request
frontEnd
help wanted
invalid
low priority
needs input
needs review
project documentation
question
research
reviewed
script
security
SQL
style
testing
topLevel
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Andras/BoundlessFlowCampus2K!1096
No description provided.