Method adminUserDelete

internal/api/admin.go:512–576

adminUserDelete deletes a user

(w http.ResponseWriter, r *http.Request)

// adminUserDelete deletes a user
func (a *API) adminUserDelete(w http.ResponseWriter, r *http.Request) error {
	ctx := r.Context()
	user := getUser(ctx)
	config := a.config
	adminUser := getAdminUser(ctx)
	db := a.db.WithContext(ctx)

	// ShouldSoftDelete defaults to false
	params := &adminUserDeleteParams{}
	if body, _ := utilities.GetBodyBytes(r); len(body) != 0 {
		// we only want to parse the body if it's not empty
		// retrieveRequestParams will handle any errors with stream
		if err := retrieveRequestParams(r, params); err != nil {
			return err
		}
	}

	err := db.Transaction(func(tx *storage.Connection) error {
		if terr := models.NewAuditLogEntry(config.AuditLog, r, tx, adminUser, models.UserDeletedAction, "", map[string]interface{}{
			"user_id":    user.ID,
			"user_email": user.Email,
			"user_phone": user.Phone,
		}); terr != nil {
			return apierrors.NewInternalServerError("Error recording audit log entry").WithInternalError(terr)
		}

		if params.ShouldSoftDelete {
			if user.DeletedAt != nil {
				// user has been soft deleted already
				return nil
			}
			if terr := user.SoftDeleteUser(tx); terr != nil {
				return apierrors.NewInternalServerError("Error soft deleting user").WithInternalError(terr)
			}

			if terr := user.SoftDeleteUserIdentities(tx); terr != nil {
				return apierrors.NewInternalServerError("Error soft deleting user identities").WithInternalError(terr)
			}

			// hard delete all associated factors
			if terr := models.DeleteFactorsByUserId(tx, user.ID); terr != nil {
				return apierrors.NewInternalServerError("Error deleting user's factors").WithInternalError(terr)
			}
			// hard delete all associated WebAuthn credentials
			if terr := models.DeleteWebAuthnCredentialsByUserID(tx, user.ID); terr != nil {
				return apierrors.NewInternalServerError("Error deleting user's WebAuthn credentials").WithInternalError(terr)
			}
			// hard delete all associated sessions
			if terr := models.Logout(tx, user.ID); terr != nil {
				return apierrors.NewInternalServerError("Error deleting user's sessions").WithInternalError(terr)
			}
		} else {
			if terr := tx.Destroy(user); terr != nil {
				return apierrors.NewInternalServerError("Database error deleting user").WithInternalError(terr)
			}
		}

		return nil