Implement API for deleting accounts

[dmitrizagidulin]

See solid/solid#14 for discussion / specs.

[RubenVerborgh]

We need account management in general.

[kjetilk]

This is a big issue now, post-announce.

[justinwb]

Note that this should also have a corresponding action in the current UI for a logged-in user that allows them to do this (with confirmation).

[dmitrizagidulin]

Here's some notes about the relevant components in the code, to get developers started.

Deleting an account is similar to a password reset - it's a high-potential-consequence account management action, that needs an extra confirmation step. It may be helpful to look at the various existing password reset components, to get an idea of what this will look like.

The rough components will involve:

1. The UI (the actual 'Delete Account' button, the confirmation screen asking for a user's WebID (from which you can derive the email and send them a delete link), and the final "Your account has been deleted." confirmation page)
2. The API - you'll need an API endpoint to send the 'Click here to delete your account if you're sure' email, and another endpoint to submit the delete token from the email link.
3. Backend - you'll need to generate a temporary delete token (similar to the password reset token) for the email, you'll need to rm -rf the user account directory, and delete the corresponding user object in .db/.

In the next comment, I'll point to specific places in the code that you'd want to edit.

[dmitrizagidulin]

So here's one way you could implement the Delete Account feature.

The 'Delete Account' button

[ ] Find a place to actually put the 'Delete Account' button. The first place that comes to mind, though may not be optimal, is somewhere on the user account homepage / index.html app. Alternatively, you can put it in whatever profile editor app we're currently using.

The button/link should point people to the "Delete Account Confirmation" url, for example /account/delete/send (the existing reset password url is currently /account/password/reset, fwiw). This will be a GET request, but it'll be just to a confirmation page, so it's safe.

DeleteAccountEmailRequest class

[ ] Create the DeleteAccountEmailRequest class

This is a request that will display the Delete Account Confirmation page, and send the email with the delete link.

It'll go into /lib/requests/, feel free to model it on https://github.com/solid/node-solid-server/blob/develop/lib/requests/password-reset-email-request.js (it'll have essentially the same instance methods, since the steps are so similar).

It will become clearer what should actually go into this class soon; we'll come back to this.

Delete Account Confirmation routes

[ ] Add a GET route for /account/delete/send to the user accounts middleware() at https://github.com/solid/node-solid-server/blob/develop/lib/api/accounts/user-accounts.js#L61 - this will display the confirmation page
[ ] Add a POST route for /account/delete/send in the same place - this will actually handle the user input, and send the email.

This will look like:

router.get('/account/delete/send', DeleteAccountEmailRequest.get)
router.post('/account/delete/send', DeleteAccountEmailRequest.post)

Delete Account Confirmation page

[ ] Create a page (Handlebars template) for Delete Account Confirmation

For an idea of what this is going to look like, go to https://solid.community/login, then hit [Reset Password] button, on the bottom right. So this is what you're aiming for, except the page will be asking the user "Please enter your account name. A link to delete the account will be emailed to the address you provided during account registration."

Model it on the reset-password.hbs Handlebars view.

This page requires the user to input their account name (so that we can look up their email, which gets stored in the user's Root ACL file). Side note: I think storing the recovery email in the root ACL instead of the user profile is going to be confusing to people. Especially since our profile editors aren't editing that file currently. I'm not sure how this convention came to be.

Delete Account Email template

[ ] Create a template for the email that gets sent (with the delete account link)

Model it on the 'reset password' email: https://github.com/solid/node-solid-server/blob/master/default-templates/emails/reset-password.js

Delete Account Email Sent page

[ ] Create a "Your delete link has been sent" page

Model it on https://github.com/solid/node-solid-server/blob/master/default-views/auth/reset-link-sent.hbs

(TO BE CONTINUED...)