Skip to content

Commit

Permalink
fix: user could not delete their own account
Browse files Browse the repository at this point in the history
* This was due to a the `DELETE /auth/me/` should be `DELETE /auth/me`. This worked in dev, but not in APIG.
* When failing it also still logged the user out making this a bit confusing as it appeared to delete the user. Now the user is only logged out if that API request suceeds.
  • Loading branch information
activescott committed Mar 4, 2021
1 parent d27729b commit 7fb76e1
Show file tree
Hide file tree
Showing 3 changed files with 18 additions and 3 deletions.
5 changes: 3 additions & 2 deletions client/src/components/auth/UserProvider.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@ export const UserProvider = (props: Props): JSX.Element => {
},
deleteUser: async (): Promise<void> => {
const response = await fetchWithCsrf(
`${process.env.PUBLIC_URL}/auth/me/`,
`${process.env.PUBLIC_URL}/auth/me`,
{
method: "DELETE",
}
Expand All @@ -127,8 +127,9 @@ export const UserProvider = (props: Props): JSX.Element => {
response.status,
response.statusText
)
} else {
DefaultUserContext.logout()
}
DefaultUserContext.logout()
},
}}
>
Expand Down
7 changes: 6 additions & 1 deletion client/src/lib/useApiHooks.ts
Original file line number Diff line number Diff line change
Expand Up @@ -194,6 +194,11 @@ const useCsrfToken = (requestRealToken = true): Promise<string> => {
}
}
getToken()
}, [tokenState.rejectToken, tokenState.resolveToken, requestRealToken])
}, [
tokenState,
tokenState.rejectToken,
tokenState.resolveToken,
requestRealToken,
])
return tokenState.promisedToken
}
9 changes: 9 additions & 0 deletions server/src/shared/lambda/oauth/handlers/me.ts
Original file line number Diff line number Diff line change
Expand Up @@ -39,15 +39,24 @@ export default function meHandlerFactory(
}
}

// eslint-disable-next-line no-console
const logInfo = console.log

async function handleDelete(
req: AuthenticatedLambdaHttpRequest
): Promise<LambdaHttpResponse> {
const user = req.authenticUser
logInfo(`Deleting identities for user '${user.id}'...`)
const identities = await identityRepository.listForUser(user.id)
for (const ident of identities) {
logInfo(
`Deleting identity '${ident.subject}@${ident.provider}' for user '${user.id}'...`
)
await identityRepository.delete(ident.id)
}
logInfo(`Deleting user '${user.id}'...`)
await userRepository.delete(user.id)
logInfo(`Deleting user '${user.id}' complete.`)
return jsonResponse(STATUS.OK)
}

Expand Down

0 comments on commit 7fb76e1

Please sign in to comment.