Summary
The delete-account endpoint has its real logic commented out and just returns `NotFound()`.
Details
`src/Inshapardaz.Api/Controllers/AccountsController.cs:282-292`:
```csharp
[HttpDelete("{id:int}", Name = nameof(AccountsController.Delete))]
public IActionResult Delete(int id)
{
// users can delete their own account and admins can delete any account
//if (id != Account.Id && Account.Role != Role.Admin)
// return Unauthorized(new { message = "Unauthorized" });
//_accountService.Delete(id);
//return Ok(new { message = "Account deleted successfully" });
return NotFound();
}
```
Impact
There's currently no way for a user to delete their own account, which matters for GDPR-style data-erasure requests.
Suggested fix
Implement account deletion (self or admin-initiated) via the command/query pipeline, matching the pattern used by other write operations, with the appropriate `[LibraryAuthorize]`/self-or-admin check.
Summary
The delete-account endpoint has its real logic commented out and just returns `NotFound()`.
Details
`src/Inshapardaz.Api/Controllers/AccountsController.cs:282-292`:
```csharp
[HttpDelete("{id:int}", Name = nameof(AccountsController.Delete))]
public IActionResult Delete(int id)
{
// users can delete their own account and admins can delete any account
//if (id != Account.Id && Account.Role != Role.Admin)
// return Unauthorized(new { message = "Unauthorized" });
//_accountService.Delete(id);
//return Ok(new { message = "Account deleted successfully" });
return NotFound();
}
```
Impact
There's currently no way for a user to delete their own account, which matters for GDPR-style data-erasure requests.
Suggested fix
Implement account deletion (self or admin-initiated) via the command/query pipeline, matching the pattern used by other write operations, with the appropriate `[LibraryAuthorize]`/self-or-admin check.