Delete self

[EduardSchwarzkopf]

Hello people,
In my current app, I've overwritten the route, so I'm allowing a user to delete his account without being a superuser. The question I'm having now is why it is necessary to be a superuser to be able to delete his own account.

[bkis]

I'd like to second this question in hope there might be an answer.

[bkis]

Just found this relevant question and answer.

[frankie567]

Delete a user might have lot of implications depending on your app (e.g. what happens to database objects linked to the user?). That's why we chose to limit it to a superuser route by default.

My advice would be that you implement a DELETE /users/me route, where you can handle all the required logic to properly remove your user from the database (removing objects, sending a confirmation email, etc.).

[bkis]

Well I was even planning to use the existing on-delete hooks by using the UserManager so I could have a centralized logic for what happens when a user gets deleted:

@router.delete("/users/me", status_code=204)
async def delete_me(
    user: UserDep,
    user_mgr: Annotated[UserManager, Depends(get_user_manager)],
    request: Request,
) -> None:
    await user_mgr.delete(user, request)
    return None

But if I try to integrate this route in FastAPI-Users' users router...

    users_router = _fastapi_users.get_users_router(
        UserRead,
        UserUpdate,
        requires_verification=not _cfg.security_closed_mode,
    )
    # ... extra endpoint for users to delete their own account
    async def _delete_me(
        user: UserDep,
        user_mgr: Annotated[UserManager, Depends(get_user_manager)],
        request: Request,
    ) -> None:
        await user_mgr.delete(user, request)
        return None

    users_router.add_api_route(
        "/me", endpoint=_delete_me, methods=["DELETE"], status_code=204
    )
    app.include_router(
        users_router,
        prefix="/users",
        tags=["users"],
    )

... calling /users/me via DELETE as a logged-in user gives me a 403 as it still routes to /users/{id}. How can I integrate my route into this router? @EduardSchwarzkopf says

It was easier than I thought in the end :)

...but how exactly did you do it? Thanks a lot!

[EduardSchwarzkopf]

I'm not using the delete user functionality from the manager, but doing it myself in my service layer. I've implemented my own UserService and handled all the stuff there. You can check it out here: https://github.com/EduardSchwarzkopf/pecuny/blob/main/app/services/users.py

The route itself is called here: https://github.com/EduardSchwarzkopf/pecuny/blob/main/app/routers/api/users.py

[bkis]

I am getting 404s - I guess this is a private repo? 😄
Whether I use UserManager doesn't really matter - I only included this info be cause @frankie567 stated that the implications of deleting a user might be complicated. But my question is: Is there any way to have (DELETE) /users/{id} (the endpoint generated by FastApi-Users and (DELETE) /users/me (custom endpoint) on the same route prefix?

[EduardSchwarzkopf]

oh, shoot, you are right. I thought this was already public. Try again.
For your question: Yes, this is possible, check the links provided.

[bkis]

Okay so you add an extra router for your custom route, right? The comment here says # override fastapi_users functionality - but it's not really overriding anything, is it? I mean that's a good thing.
I guess why this works is because you are registering this extra router before the user router from FastAPI-Users. So in the routing process, the app checks for /users/me before /users/{id}. That's actually fine for me, I'll handle it in a similar fashion. Thanks for the hint!