Merge pull request #300 from espoo-dev/feat-users-destroyself

Adds endpoint to delete users account

Author: mattfeg

app/controllers/api/v1/users_controller.rb

@@ -11,6 +11,18 @@ def index
         render json: users, status: :ok
       end
 
+      def destroy_self
+        authorize(current_user)
+
+        result = Users::DestroySelf.result(user: current_user, password: confirmation_password)
+
+        if result.success?
+          render json: { message: "Account deleted successfully" }, status: :ok
+        else
+          render json: { error: "Unable to delete account. Error: #{result.error}" }, status: :unprocessable_entity
+        end
+      end
+
       private
 
       def page
@@ -20,6 +32,10 @@ def page
       def per_page
         params[:per_page]
       end
+
+      def confirmation_password
+        params[:password]
+      end
     end
   end
 end

app/models/health_insurance.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class HealthInsurance < ApplicationRecord
+  acts_as_paranoid
+
   belongs_to :user, optional: true
 
   has_many :event_procedures, dependent: :destroy

app/models/hospital.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Hospital < ApplicationRecord
+  acts_as_paranoid
+
   has_many :event_procedures, dependent: :destroy
 
   validates :name, presence: true

app/models/medical_shift.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class MedicalShift < ApplicationRecord
+  acts_as_paranoid
+
   has_enumeration_for :workload, with: MedicalShifts::Workloads, create_helpers: true
 
   monetize :amount

app/models/patient.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
 class Patient < ApplicationRecord
-  has_many :event_procedures, dependent: :restrict_with_exception
+  acts_as_paranoid
+
+  has_many :event_procedures, dependent: :destroy
   belongs_to :user
 
   validates :name, presence: true

app/models/procedure.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Procedure < ApplicationRecord
+  acts_as_paranoid
+
   monetize :amount
 
   belongs_to :user, optional: true

app/models/user.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class User < ApplicationRecord
+  acts_as_paranoid
+
   # Include default devise modules. Others available are:
   # :lockable, :timeoutable, :trackable and :omniauthable
   devise :database_authenticatable, :registerable,

app/operations/users/destroy_self.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Users
+  class DestroySelf < Actor
+    input :user, type: User
+    input :password, type: String
+
+    def call
+      fail!(error: "Wrong password") unless valid_password?
+
+      ActiveRecord::Base.transaction { user.destroy_fully! }
+    end
+
+    private
+
+    def valid_password?
+      user.valid_password?(password)
+    end
+  end
+end

app/policies/user_policy.rb

@@ -4,4 +4,8 @@ class UserPolicy < ApplicationPolicy
   def index?
     user.admin?
   end
+
+  def destroy_self?
+    user == record
+  end
 end

config/routes.rb

@@ -29,7 +29,11 @@
       end
       resources :patients, only: %i[index create update destroy]
       resources :procedures, only: %i[index create update destroy]
-      resources :users, only: [:index]
+      resources :users, only: [:index] do
+        collection do
+          delete :destroy_self
+        end
+      end
 
       get "/event_procedures_dashboard/amount_by_day", to: "event_procedures_dashboard#amount_by_day"
       get "/pdf_reports/generate", to: "pdf_reports#generate", defaults: { format: :pdf }