fixes and new options

src/auth/mod.rs

@@ -38,6 +38,7 @@ pub struct User {
     pub email: String,
     pub password_hash: String,
     pub confirmed_at: Option<String>,
+    pub is_active: i64,
 }
 
 #[derive(Deserialize)]
@@ -123,6 +124,7 @@ impl<'r> sqlx::FromRow<'r, AnyRow> for User {
             email: crate::row_decode::text(row, "email")?,
             password_hash: crate::row_decode::text(row, "password_hash")?,
             confirmed_at: crate::row_decode::optional_text(row, "confirmed_at")?,
+            is_active: row.try_get("is_active")?,
         })
     }
 }
@@ -827,12 +829,51 @@ pub async fn confirm_account_action(
             .map_err(AuthError::database)?;
         "E-mail address changed."
     } else if action == "delete" {
-        sqlx::query(queries::get(state.db.kind(), queries::AUTH_DELETE_USER))
-            .bind(user_id)
+        let original_nickname: Option<String> = sqlx::query_scalar(queries::get(
+            state.db.kind(),
+            queries::AUTH_NICKNAME_BY_ID,
+        ))
+        .bind(user_id)
+        .fetch_optional(&mut *tx)
+        .await
+        .map_err(AuthError::database)?;
+        let deleted_nickname = format!("Deleted user #{user_id}");
+        if let Some(original_nickname) = original_nickname {
+            sqlx::query(queries::get(
+                state.db.kind(),
+                queries::AUTH_ANONYMIZE_NOTE_CREATORS,
+            ))
+            .bind(&deleted_nickname)
+            .bind(original_nickname)
             .execute(&mut *tx)
             .await
             .map_err(AuthError::database)?;
-        "Account deleted."
+        }
+        let deleted_email = format!("deleted-user-{user_id}@invalid.local");
+        let deleted_password = hash_password(&random_token())?;
+        sqlx::query(queries::get(
+            state.db.kind(),
+            queries::AUTH_DELETE_SESSIONS_BY_USER,
+        ))
+        .bind(user_id)
+        .execute(&mut *tx)
+        .await
+        .map_err(AuthError::database)?;
+        sqlx::query(queries::get(
+            state.db.kind(),
+            queries::AUTH_ANONYMIZE_USER,
+        ))
+        .bind(&deleted_nickname)
+        .bind(normalize(&deleted_nickname))
+        .bind(&deleted_email)
+        .bind(normalize(&deleted_email))
+        .bind(deleted_password)
+        .bind(now.to_rfc3339())
+        .bind(user_id)
+        .execute(&mut *tx)
+        .await
+        .map_err(AuthError::database)?;
+        "Account deleted. Content has been preserved under an anonymized owner."
     } else {
         return Err(AuthError::bad_request("Unknown account action."));
     };