Method Delete

server-source-code/internal/handler/users.go:410–464

Delete deletes a user.

(w http.ResponseWriter, r *http.Request)

// Delete deletes a user.
func (h *UsersHandler) Delete(w http.ResponseWriter, r *http.Request) {
	userID := chi.URLParam(r, "userId")
	currentUserID, _ := r.Context().Value(middleware.UserIDKey).(string)
	if currentUserID != "" && userID == currentUserID {
		Error(w, http.StatusBadRequest, "Cannot delete your own account")
		return
	}

	existing, err := h.users.GetByID(r.Context(), userID)
	if err != nil || existing == nil {
		Error(w, http.StatusNotFound, "User not found")
		return
	}

	// Prevent deleting users with a higher-privilege role.
	callerRole, _ := r.Context().Value(middleware.UserRoleKey).(string)
	if roleRank(existing.Role) > roleRank(callerRole) {
		Error(w, http.StatusForbidden, "Cannot delete a user with a higher-privilege role")
		return
	}
	// Deleting a superadmin requires being superadmin or having can_manage_superusers.
	if existing.Role == "superadmin" && callerRole != "superadmin" {
		perm, permErr := h.permissions.GetByRole(r.Context(), callerRole)
		if permErr != nil || perm == nil || !perm.CanManageSuperusers {
			Error(w, http.StatusForbidden, "You do not have permission to delete superadmin users")
			return
		}
	}

	var superCount, adminCount int
	if existing.Role == "superadmin" {
		superCount, _ = h.users.CountSuperadmins(r.Context())
		if superCount <= 1 {
			Error(w, http.StatusBadRequest, "Cannot delete the last superadmin user")
			return
		}
	}
	if existing.Role == "admin" {
		superCount, _ = h.users.CountSuperadmins(r.Context())
		if superCount == 0 {
			adminCount, _ = h.users.CountActiveAdmins(r.Context())
			if adminCount <= 1 {
				Error(w, http.StatusBadRequest, "Cannot delete the last admin user")
				return
			}
		}
	}

	if err := h.users.Delete(r.Context(), userID); err != nil {
		Error(w, http.StatusInternalServerError, "Failed to delete user")
		return
	}

	JSON(w, http.StatusOK, map[string]string{"message": "User deleted successfully"})
}

// ResetPassword resets a user's password.
func (h *UsersHandler) ResetPassword(w http.ResponseWriter, r *http.Request) {