From a2cb037410d812853c902a18406c2a081370a503 Mon Sep 17 00:00:00 2001
From: "gpt-engineer-app[bot]"
 <159125892+gpt-engineer-app[bot]@users.noreply.github.com>
Date: Wed, 29 Oct 2025 22:46:49 +0000
Subject: [PATCH] Fix account deletion flow

---
 .../settings/AccountDeletionDialog.tsx        |  6 ++-
 src/components/settings/AccountProfileTab.tsx |  9 ++--
 .../settings/DeletionStatusBanner.tsx         | 47 +++++++++++------
 src/integrations/supabase/types.ts            |  4 ++
 .../cancel-account-deletion/index.ts          | 18 +++++--
 .../confirm-account-deletion/index.ts         | 17 ++++++-
 .../request-account-deletion/index.ts         | 20 ++++++--
 ...8_b228b992-fe01-477d-b8a7-5dc27a84dcf9.sql | 50 +++++++++++++++++++
 8 files changed, 143 insertions(+), 28 deletions(-)
 create mode 100644 supabase/migrations/20251029224508_b228b992-fe01-477d-b8a7-5dc27a84dcf9.sql

diff --git a/src/components/settings/AccountDeletionDialog.tsx b/src/components/settings/AccountDeletionDialog.tsx
index 9951d2e2..160942b4 100644
--- a/src/components/settings/AccountDeletionDialog.tsx
+++ b/src/components/settings/AccountDeletionDialog.tsx
@@ -48,7 +48,7 @@ export function AccountDeletionDialog({ open, onOpenChange, userEmail, onDeletio
             { action: 'Request account deletion' }
           );
           sessionStorage.setItem('mfa_step_up_required', 'true');
-          sessionStorage.setItem('mfa_intended_path', '/settings?tab=privacy');
+          sessionStorage.setItem('mfa_intended_path', '/settings');
           window.location.href = '/auth';
           return;
         }
@@ -66,6 +66,10 @@ export function AccountDeletionDialog({ open, onOpenChange, userEmail, onDeletio
 
       if (error) throw error;
 
+      // Clear MFA session storage
+      sessionStorage.removeItem('mfa_step_up_required');
+      sessionStorage.removeItem('mfa_intended_path');
+
       dispatch({
         type: 'REQUEST_DELETION',
         payload: { scheduledDate: data.scheduled_deletion_at }
diff --git a/src/components/settings/AccountProfileTab.tsx b/src/components/settings/AccountProfileTab.tsx
index 30a028b6..91bfa0cd 100644
--- a/src/components/settings/AccountProfileTab.tsx
+++ b/src/components/settings/AccountProfileTab.tsx
@@ -84,7 +84,7 @@ export function AccountProfileTab() {
     isValid: usernameValidation.isAvailable !== false
   });
 
-  // Check for existing deletion request on mount
+  // Check for existing deletion request on mount (both pending and confirmed)
   useEffect(() => {
     const checkDeletionRequest = async () => {
       if (!user?.id) return;
@@ -93,7 +93,7 @@ export function AccountProfileTab() {
         .from('account_deletion_requests')
         .select('*')
         .eq('user_id', user.id)
-        .eq('status', 'pending')
+        .in('status', ['pending', 'confirmed'])
         .maybeSingle();
 
       if (!error && data) {
@@ -210,12 +210,12 @@ export function AccountProfileTab() {
   };
 
   const handleDeletionRequested = async () => {
-    // Refresh deletion request data
+    // Refresh deletion request data (check for both pending and confirmed)
     const { data, error } = await supabase
       .from('account_deletion_requests')
       .select('*')
       .eq('user_id', user!.id)
-      .eq('status', 'pending')
+      .in('status', ['pending', 'confirmed'])
       .maybeSingle();
 
     if (!error && data) {
@@ -235,6 +235,7 @@ export function AccountProfileTab() {
       {deletionRequest && (
         <DeletionStatusBanner
           scheduledDate={deletionRequest.scheduled_deletion_at}
+          status={deletionRequest.status as 'pending' | 'confirmed'}
           onCancelled={handleDeletionCancelled}
         />
       )}
diff --git a/src/components/settings/DeletionStatusBanner.tsx b/src/components/settings/DeletionStatusBanner.tsx
index ecc9db5b..74f06b11 100644
--- a/src/components/settings/DeletionStatusBanner.tsx
+++ b/src/components/settings/DeletionStatusBanner.tsx
@@ -9,10 +9,11 @@ import { getErrorMessage } from '@/lib/errorHandler';
 
 interface DeletionStatusBannerProps {
   scheduledDate: string;
+  status: 'pending' | 'confirmed';
   onCancelled: () => void;
 }
 
-export function DeletionStatusBanner({ scheduledDate, onCancelled }: DeletionStatusBannerProps) {
+export function DeletionStatusBanner({ scheduledDate, status, onCancelled }: DeletionStatusBannerProps) {
   const [loading, setLoading] = useState(false);
   const { toast } = useToast();
 
@@ -64,20 +65,38 @@ export function DeletionStatusBanner({ scheduledDate, onCancelled }: DeletionSta
   return (
     <Alert variant="destructive" className="mb-6">
       <AlertTriangle className="w-4 h-4" />
-      <AlertTitle>Account Deactivated - Deletion Scheduled</AlertTitle>
+      <AlertTitle>
+        {status === 'pending' ? 'Deletion Requested' : 'Account Deactivated - Deletion Scheduled'}
+      </AlertTitle>
       <AlertDescription className="space-y-2">
-        <p>
-          Your account is <strong>deactivated</strong> and scheduled for permanent deletion on <strong>{formattedDate}</strong>.
-        </p>
-        <p className="text-sm">
-          {daysRemaining > 0 ? (
-            <>
-              <strong>{daysRemaining}</strong> day{daysRemaining !== 1 ? 's' : ''} remaining to cancel.
-            </>
-          ) : (
-            'You can now confirm deletion with your confirmation code.'
-          )}
-        </p>
+        {status === 'pending' ? (
+          <>
+            <p>
+              You have requested account deletion. Please check your email for a confirmation code. 
+              You must enter the code within 24 hours to proceed.
+            </p>
+            <p className="text-sm text-muted-foreground">
+              After confirming with the code, your account will be deactivated and scheduled for deletion on{' '}
+              <strong>{formattedDate}</strong>.
+            </p>
+          </>
+        ) : (
+          <>
+            <p>
+              Your account is <strong>deactivated</strong> and scheduled for permanent deletion on{' '}
+              <strong>{formattedDate}</strong>.
+            </p>
+            <p className="text-sm">
+              {daysRemaining > 0 ? (
+                <>
+                  <strong>{daysRemaining}</strong> day{daysRemaining !== 1 ? 's' : ''} remaining to cancel.
+                </>
+              ) : (
+                'Your account will be deleted within 24 hours.'
+              )}
+            </p>
+          </>
+        )}
         <div className="flex gap-2 mt-3">
           <Button
             variant="outline"
diff --git a/src/integrations/supabase/types.ts b/src/integrations/supabase/types.ts
index cf129f4a..a474f3ba 100644
--- a/src/integrations/supabase/types.ts
+++ b/src/integrations/supabase/types.ts
@@ -3976,6 +3976,10 @@ export type Database = {
         Args: { item_id: string }
         Returns: boolean
       }
+      can_manage_deletion: {
+        Args: { _deletion_id: string; _user_id: string }
+        Returns: boolean
+      }
       can_manage_user: {
         Args: { _manager_id: string; _target_user_id: string }
         Returns: boolean
diff --git a/supabase/functions/cancel-account-deletion/index.ts b/supabase/functions/cancel-account-deletion/index.ts
index 39296501..b8739c75 100644
--- a/supabase/functions/cancel-account-deletion/index.ts
+++ b/supabase/functions/cancel-account-deletion/index.ts
@@ -39,16 +39,27 @@ serve(async (req) => {
 
     edgeLogger.info('Cancelling deletion request', { action: 'cancel_deletion', userId: user.id, requestId: tracking.requestId });
 
-    // Find pending deletion request
+    // Find pending or confirmed deletion request
     const { data: deletionRequest, error: requestError } = await supabaseClient
       .from('account_deletion_requests')
       .select('*')
       .eq('user_id', user.id)
-      .eq('status', 'pending')
+      .in('status', ['pending', 'confirmed'])
       .maybeSingle();
 
     if (requestError || !deletionRequest) {
-      throw new Error('No pending deletion request found');
+      throw new Error('No active deletion request found');
+    }
+
+    // Validate that deletion hasn't already been processed
+    if (deletionRequest.status === 'completed') {
+      throw new Error('This deletion request has already been completed');
+    }
+
+    // Validate scheduled deletion hasn't passed
+    const scheduledDate = new Date(deletionRequest.scheduled_deletion_at);
+    if (scheduledDate < new Date()) {
+      throw new Error('Cannot cancel - deletion has already been processed');
     }
 
     // Cancel deletion request
@@ -99,6 +110,7 @@ serve(async (req) => {
               <h2>Account Deletion Cancelled</h2>
               <p>Your account deletion request has been cancelled on ${new Date().toLocaleDateString()}.</p>
               <p>Your account has been reactivated and you can continue using all features.</p>
+              <p>If you did not cancel this request, please contact support immediately.</p>
               <p>Welcome back!</p>
             `,
           }),
diff --git a/supabase/functions/confirm-account-deletion/index.ts b/supabase/functions/confirm-account-deletion/index.ts
index 7af1e17b..fd2eb7b3 100644
--- a/supabase/functions/confirm-account-deletion/index.ts
+++ b/supabase/functions/confirm-account-deletion/index.ts
@@ -70,6 +70,18 @@ serve(async (req) => {
       throw new Error('No pending deletion request found');
     }
 
+    // Check if there's already a confirmed request
+    const { data: confirmedRequest } = await supabaseClient
+      .from('account_deletion_requests')
+      .select('*')
+      .eq('user_id', user.id)
+      .eq('status', 'confirmed')
+      .maybeSingle();
+
+    if (confirmedRequest) {
+      throw new Error('You already have a confirmed deletion request. Your account is scheduled for deletion.');
+    }
+
     // Verify confirmation code
     if (deletionRequest.confirmation_code !== confirmation_code) {
       throw new Error('Invalid confirmation code');
@@ -141,7 +153,10 @@ serve(async (req) => {
                 <li>✓ To cancel, log in and visit your account settings</li>
               </ul>
               
-              <p>If you take no action, your account will be automatically deleted after the 14-day waiting period.</p>
+              <h3>Changed Your Mind?</h3>
+              <p>You can cancel at any time during the 14-day waiting period by logging in and clicking "Cancel Deletion" in your account settings.</p>
+              
+              <p><strong>If you take no action</strong>, your account will be automatically deleted after the 14-day waiting period.</p>
             `,
           }),
         });
diff --git a/supabase/functions/request-account-deletion/index.ts b/supabase/functions/request-account-deletion/index.ts
index d795e45a..c0a465cf 100644
--- a/supabase/functions/request-account-deletion/index.ts
+++ b/supabase/functions/request-account-deletion/index.ts
@@ -52,23 +52,31 @@ serve(async (req) => {
       userId: user.id 
     });
 
-    // Check for existing pending deletion request
+    // Check for existing active deletion request (pending or confirmed)
     const { data: existingRequest } = await supabaseClient
       .from('account_deletion_requests')
       .select('*')
       .eq('user_id', user.id)
-      .eq('status', 'pending')
+      .in('status', ['pending', 'confirmed'])
       .maybeSingle();
 
     if (existingRequest) {
+      const errorMsg = existingRequest.status === 'confirmed' 
+        ? 'Your account is already scheduled for deletion. You can cancel it from your account settings.'
+        : 'You already have a pending deletion request. Check your email for the confirmation code.';
+      
       return new Response(
         JSON.stringify({
-          error: 'You already have a pending deletion request',
+          error: errorMsg,
           request: existingRequest,
         }),
         {
           status: 400,
-          headers: { ...corsHeaders, 'Content-Type': 'application/json' },
+          headers: { 
+            ...corsHeaders, 
+            'Content-Type': 'application/json',
+            'X-Request-ID': tracking.requestId 
+          },
         }
       );
     }
@@ -131,7 +139,9 @@ serve(async (req) => {
         <h3>CONFIRMATION CODE: <strong>${confirmationCode}</strong></h3>
         <p><strong>IMPORTANT:</strong> You have 24 hours to enter this code to confirm the deletion. After entering the code, your account will be deactivated and you'll have 14 days to cancel before permanent deletion.</p>
         
-        <p><strong>Need to cancel?</strong> You can cancel at any time during the 14-day period after confirming.</p>
+        <p><strong>Need to cancel?</strong> You can cancel at any time - before OR after confirming - during the 14-day period.</p>
+        
+        <p><strong>Changed your mind?</strong> Simply log in to your account settings and click "Cancel Deletion".</p>
       `,
     };
 
diff --git a/supabase/migrations/20251029224508_b228b992-fe01-477d-b8a7-5dc27a84dcf9.sql b/supabase/migrations/20251029224508_b228b992-fe01-477d-b8a7-5dc27a84dcf9.sql
new file mode 100644
index 00000000..55fd3424
--- /dev/null
+++ b/supabase/migrations/20251029224508_b228b992-fe01-477d-b8a7-5dc27a84dcf9.sql
@@ -0,0 +1,50 @@
+-- Fix account deletion flow: Critical schema improvements
+
+-- 1. Drop old unique constraint and create new one that covers both pending and confirmed
+DROP INDEX IF EXISTS unique_active_deletion_per_user;
+CREATE UNIQUE INDEX unique_active_deletion_per_user 
+ON account_deletion_requests(user_id) 
+WHERE status IN ('pending', 'confirmed');
+
+-- 2. Add indexes for efficient deletion processing
+CREATE INDEX IF NOT EXISTS idx_account_deletions_confirmed 
+ON account_deletion_requests(scheduled_deletion_at) 
+WHERE status = 'confirmed';
+
+CREATE INDEX IF NOT EXISTS idx_profiles_pending_deletion
+ON profiles(user_id, deactivated) 
+WHERE deactivated = true;
+
+-- 3. Create security definer function for deletion checks (prevents infinite recursion in RLS)
+CREATE OR REPLACE FUNCTION can_manage_deletion(
+  _user_id uuid,
+  _deletion_id uuid
+)
+RETURNS boolean
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT EXISTS (
+    SELECT 1 FROM account_deletion_requests
+    WHERE id = _deletion_id 
+    AND user_id = _user_id
+    AND status IN ('pending', 'confirmed')
+  )
+$$;
+
+-- 4. Update RLS policies to use security definer function
+DROP POLICY IF EXISTS "Users can update their own deletion requests" ON account_deletion_requests;
+DROP POLICY IF EXISTS "Users can view their own deletion requests" ON account_deletion_requests;
+
+CREATE POLICY "Users can view their own deletion requests"
+ON account_deletion_requests FOR SELECT
+TO authenticated
+USING (user_id = auth.uid());
+
+CREATE POLICY "Users can update their own deletion requests"
+ON account_deletion_requests FOR UPDATE
+TO authenticated
+USING (can_manage_deletion(auth.uid(), id))
+WITH CHECK (can_manage_deletion(auth.uid(), id));
\ No newline at end of file