From fabd11e9e05314598323ad163577f8225b85e405 Mon Sep 17 00:00:00 2001
From: Chneemann <andre-kempf@mailbox.org>
Date: Sun, 27 Sep 2026 12:33:17 +0200
Subject: [PATCH] feat(api): add account deletion endpoint with guest user
 protection

---
 app/api/users/profile/route.ts | 42 +++++++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/app/api/users/profile/route.ts b/app/api/users/profile/route.ts
index fdb99c8..76c6562 100644
--- a/app/api/users/profile/route.ts
+++ b/app/api/users/profile/route.ts
@@ -1,6 +1,6 @@
 /**
  * @file app/api/users/profile/route.ts
- * @description API route handler for updating user profile settings (status, color).
+ * @description API route handlers for updating user profile settings and deleting user accounts.
  */
 
 import { auth } from "@/auth";
@@ -10,6 +10,7 @@ import { MEMBER_COLOR_OPTIONS } from "@/lib/constants/member.styles";
 import { eq } from "drizzle-orm";
 import { NextResponse } from "next/server";
 
+/** List of valid user status values. */
 const VALID_STATUSES: UserStatus[] = ["ONLINE", "OFFLINE", "AFK", "DND"];
 
 /** Handles PATCH requests to update the logged-in user's profile settings. */
@@ -75,3 +76,42 @@ export async function PATCH(req: Request) {
     );
   }
 }
+
+/** Handles DELETE requests to remove the logged-in user's account. */
+export async function DELETE() {
+  try {
+    const session = await auth();
+
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const existingUser = await db.query.users.findFirst({
+      where: eq(users.id, session.user.id),
+    });
+
+    if (!existingUser) {
+      return NextResponse.json({ error: "User not found" }, { status: 404 });
+    }
+
+    // Check if the email matches the GUEST_EMAIL from the .env file
+    const guestEmail = process.env.GUEST_EMAIL;
+    if (guestEmail && existingUser.email === guestEmail) {
+      return NextResponse.json(
+        { error: "Guest accounts cannot be deleted" },
+        { status: 403 },
+      );
+    }
+
+    // Perform deletion
+    await db.delete(users).where(eq(users.id, session.user.id));
+
+    return NextResponse.json({ message: "Account deleted successfully" });
+  } catch (error) {
+    console.error("API User Settings DELETE error:", error);
+    return NextResponse.json(
+      { error: "Internal Server Error" },
+      { status: 500 },
+    );
+  }
+}