From 821843088dbf8908e592b013d6a1a9bd199210cd Mon Sep 17 00:00:00 2001
From: SowinskiBraeden <braeden@sowinski.dev>
Date: Wed, 7 May 2025 15:04:11 -0700
Subject: [PATCH 1/2] update/delete user account

---
 src/auth/authentication.js |  1 +
 src/router/user.js         | 41 ++++++++++++++++++++++++-----
 src/views/profile.ejs      | 53 +++++++++++++++++++++++++++++++++++++-
 3 files changed, 88 insertions(+), 7 deletions(-)

diff --git a/src/auth/authentication.js b/src/auth/authentication.js
index 21ba26a..a540751 100644
--- a/src/auth/authentication.js
+++ b/src/auth/authentication.js
@@ -1,4 +1,5 @@
 const status = require("../util/statuses");
+const session = require("express-session");
 const bcrypt = require('bcrypt');
 const joi = require("joi");
 const salt = 12;
diff --git a/src/router/user.js b/src/router/user.js
index 9948402..1fdc6ff 100644
--- a/src/router/user.js
+++ b/src/router/user.js
@@ -1,5 +1,6 @@
 const status = require("../util/statuses");
 const ObjectId = require('mongodb').ObjectId;
+const session = require("express-session");
 const bcrypt = require("bcrypt");
 const joi = require("joi");
 const salt = 12;
@@ -411,14 +412,14 @@ module.exports = (middleware, users, plans, assets) => {
             { "_id": id }
         ).then((result) => { 
             if (result.deletedCount === 0) {
-                console.log(`Asset not found: ${req.body.id}`);
-                req.session.errMessage = "Unable to delete asset";
+                console.error(`Asset not found: ${req.body.id}`);
+                req.session.errMessage = "Unable to delete asset. Please try again.";
                 return res.status(status.NotFound).redirect("/assets");
             }
 
             if (!result.acknowledged) {
-                console.error("Error updating asset: ", err);
-                req.session.errMessage = "An error occurred while saving your information. Please try again.";
+                console.error("Error deleting asset: ", err);
+                req.session.errMessage = "An error occurred while deleting an asset. Please try again.";
                 return res.status(status.InternalServerError).redirect("/assets");
             }
         
@@ -426,11 +427,39 @@ module.exports = (middleware, users, plans, assets) => {
             return res.status(status.Ok).redirect("/assets"); 
     
         }).catch((err) => { 
-            console.error("Error updating asset: ", err);
-            req.session.errMessage = "An error occurred while saving your information. Please try again.";
+            console.error("Error deleting asset: ", err);
+            req.session.errMessage = "An error occurred while deleting an asset. Please try again.";
             return res.status(status.InternalServerError).redirect("/assets");
         });
     });
 
+    router.post("/deleteUser", (req, res) => {
+        const id = new ObjectId(req.body.id);
+        
+        users.deleteOne(
+            { "_id": id },
+        ).then((result) => {
+            if (result.deletedCount === 0) {
+                console.error(`User not found: ${req.body.id}`);
+                req.session.errMessage = "Unabled to delete account. Please try again.";
+                return res.status(status.NotFound).redirect("/profile");
+            }
+
+            if (!result.acknowledged) {
+                console.error("Error deleting user: ", err);
+                req.session.errMessage = "An error occured while deleting your account. Please try again.";
+                return res.status(status.InternalServerError).redirect("/profile");
+            }
+
+            // Direct to logout to destroy session
+            req.session.destroy();
+            return res.status(status.Ok).redirect("/signup");
+        }).catch((err) => {
+            console.error("Error deleting user: ", err);
+            req.session.errMessage = "An error occured while deleting your account. Please try again.";
+            return res.status(status.InternalServerError).redirect("/profile");
+        });
+    });
+
     return router;
 };
diff --git a/src/views/profile.ejs b/src/views/profile.ejs
index 34f0bc2..b1a45f3 100644
--- a/src/views/profile.ejs
+++ b/src/views/profile.ejs
@@ -2,6 +2,46 @@
 <%- include("./partials/header") %>
 
 <main>
+    <!-- Confirm delete account modal -->
+    <dialog id="delete-warning-modal" class="w-lg mx-auto bg-transparent p-8 mt-10 rounded-lg shadow-md">
+        <div class="relative p-4 w-full max-w-md h-full md:h-auto">
+            <!-- Modal content -->
+            <div class="relative p-4 text-center bg-white rounded-lg shadow dark:bg-gray-800 sm:p-5">
+                <form method="dialog">
+                    <button type="submit" class="text-gray-400 absolute top-2.5 right-2.5 bg-transparent hover:bg-gray-200 hover:text-gray-900 rounded-lg text-sm p-1.5 ml-auto inline-flex items-center dark:hover:bg-gray-600 dark:hover:text-white">
+                        <svg aria-hidden="true" class="w-5 h-5" fill="currentColor" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M4.293 4.293a1 1 0 011.414 0L10 8.586l4.293-4.293a1 1 0 111.414 1.414L11.414 10l4.293 4.293a1 1 0 01-1.414 1.414L10 11.414l-4.293 4.293a1 1 0 01-1.414-1.414L8.586 10 4.293 5.707a1 1 0 010-1.414z" clip-rule="evenodd"></path></svg>
+                        <span class="sr-only">Close modal</span>
+                    </button>
+                </form>
+                <svg class="text-gray-400 dark:text-gray-500 w-11 h-11 mb-3.5 mx-auto" aria-hidden="true" fill="currentColor" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9 2a1 1 0 00-.894.553L7.382 4H4a1 1 0 000 2v10a2 2 0 002 2h8a2 2 0 002-2V6a1 1 0 100-2h-3.382l-.724-1.447A1 1 0 0011 2H9zM7 8a1 1 0 012 0v6a1 1 0 11-2 0V8zm5-1a1 1 0 00-1 1v6a1 1 0 102 0V8a1 1 0 00-1-1z" clip-rule="evenodd"></path></svg>
+                <p class="mb-4 text-gray-500 dark:text-gray-300">Are you sure you want to delete you account? This process cannot be undone.</p>
+                <div class="flex justify-center items-center space-x-4">
+                    <div style="width: 100%;">
+                        <form method="dialog" style="width: 100%;">
+                            <button
+                                type="submit" 
+                                class="py-2 px-3 text-sm font-medium text-gray-500 bg-white rounded-lg border border-gray-200 hover:bg-gray-100 focus:ring-4 focus:outline-none focus:ring-primary-300 hover:text-gray-900 focus:z-10 dark:bg-gray-700 dark:text-gray-300 dark:border-gray-500 dark:hover:text-white dark:hover:bg-gray-600 dark:focus:ring-gray-600"
+                            >
+                                No, cancel
+                            </button>
+                        </form>
+                    </div>
+                    <div style="width: 100%;">
+                        <form method="POST" action="/deleteUser">
+                            <input id="id" name="id" type="text" hidden value="<%= user._id %>">
+                            <button 
+                                type="submit" 
+                                class="py-2 px-3 text-sm font-medium text-center text-white bg-red-600 rounded-lg hover:bg-red-700 focus:ring-4 focus:outline-none focus:ring-red-300 dark:bg-red-500 dark:hover:bg-red-600 dark:focus:ring-red-900"
+                            >
+                                Yes, I'm sure
+                            </button>
+                        </form>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </dialog>
+
     <h2 class="ml-11 mt-5 mb-6 text-xl font-semibold mb-4 text-white">Welcome <%= user.name %></h2>
 
     <% if (errMessage != "") { %>
@@ -32,7 +72,18 @@
             </div>
         </form>
     </div>
-<!--     
+
+    <div class="flex flex-row justify-center mx-auto p8">
+        <button
+            type="submit"
+            class="w-xs p-3 border border-transparent rounded-md shadow-sm text-sm font-medium text-white bg-red-600 hover:bg-red-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-red-500 cursor-pointer"
+            onclick="document.getElementById('delete-warning-modal').showModal()"
+        >
+            Delete Account
+        </button>
+    </div>
+
+<!--
     <div class="mb-10 max-w-md mx-auto bg-white p-8 rounded-lg shadow-md">
         <div class="flex flex-row justify-between">
             <h3 class="pt-2 pr-2 pb-2">Personal information</h3>

From 54024bd7a2033aee7427f7f0a0a315b7c6cd4b3d Mon Sep 17 00:00:00 2001
From: SowinskiBraeden <braeden@sowinski.dev>
Date: Wed, 7 May 2025 15:33:07 -0700
Subject: [PATCH 2/2] fix/delete assets + plans on account delete

---
 src/router/user.js   | 25 +++++++++++++++++--------
 src/views/assets.ejs |  5 +----
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/src/router/user.js b/src/router/user.js
index 1fdc6ff..43cfe56 100644
--- a/src/router/user.js
+++ b/src/router/user.js
@@ -17,7 +17,6 @@ const getAssetSchema = (type) => {
     switch (type) {
         case "other":
             assetSchema = joi.object({
-                ownerId: joi.string().alphanum().required(),
                 type: joi.string().valid("other", "stock", "saving").required(),
                 name: joi.string().alphanum().min(3).max(30).required(),
                 value: joi.number().min(0).required(),
@@ -28,7 +27,6 @@ const getAssetSchema = (type) => {
             break;
         case "saving":
             assetSchema = joi.object({
-                ownerId: joi.string().alphanum().required(),
                 type: joi.string().valid("other", "stock", "saving").required(),
                 name: joi.string().alphanum().min(3).max(30).required(),
                 value: joi.number().min(0).required(),
@@ -37,7 +35,6 @@ const getAssetSchema = (type) => {
             break;
         case "stock":
             assetSchema = joi.object({
-                ownerId: joi.string().alphanum().required(),
                 type: joi.string().valid("other", "stock", "saving").required(),
                 ticker: joi.string().alphanum().min(3).max(5).required(),
                 price: joi.number().min(0).required(),
@@ -70,7 +67,7 @@ module.exports = (middleware, users, plans, assets) => {
     });
 
     router.get('/assets', async (req, res) => {
-        let userAssets = await assets.find({ "ownerId": req.session.user._id }).toArray();
+        let userAssets = await assets.find({ userId: new ObjectId(req.session.user._id) }).toArray();
         res.render('assets', { user: req.session.user, errMessage: req.session.errMessage, assets: userAssets });
         return res.status(status.Ok);
     });
@@ -324,6 +321,7 @@ module.exports = (middleware, users, plans, assets) => {
         }
 
         let newAsset = {
+            userId: new ObjectId(req.session.user._id),
             ...req.body,
             updatedAt: new Date(),
         };
@@ -366,7 +364,7 @@ module.exports = (middleware, users, plans, assets) => {
             return res.redirect("/assets");
         }
 
-        if (req.body.ownerId != req.session.user._id) {
+        if (req.body.userId != req.session.user._id) {
             req.session.errMessage = "Cannot change asset owner",
             res.status(status.BadRequest);
             return res.redirect("/assets");
@@ -434,10 +432,21 @@ module.exports = (middleware, users, plans, assets) => {
     });
 
     router.post("/deleteUser", (req, res) => {
-        const id = new ObjectId(req.body.id);
-        
+        // not as critical if results aren't as expected only if crashing
+        assets.deleteMany({ userId: new ObjectId(req.session.user._id) }).catch((err) => {
+            console.error("Error deleting user assets: ", err);
+            req.session.errMessage = "An error occured while deleting your account. Please try again.";
+            return res.status(status.InternalServerError).redirect("/profile");
+        });
+
+        plans.deleteMany({ userId: new ObjectId(req.session.user._id) }).catch((err) => {
+            console.error("Error deleting user assets: ", err);
+            req.session.errMessage = "An error occured while deleting your account. Please try again.";
+            return res.status(status.InternalServerError).redirect("/profile");
+        });
+
         users.deleteOne(
-            { "_id": id },
+            { _id: new ObjectId(req.session.user._id) },
         ).then((result) => {
             if (result.deletedCount === 0) {
                 console.error(`User not found: ${req.body.id}`);
diff --git a/src/views/assets.ejs b/src/views/assets.ejs
index 630cab2..cec34b0 100644
--- a/src/views/assets.ejs
+++ b/src/views/assets.ejs
@@ -38,7 +38,6 @@
 
         <!-- Create other asset form -->
         <form method="POST" action="/createAsset" id="create-other-asset-form">
-            <input style="display: none;" value="<%= user._id %>" name="ownerId" type="text">
             <input style="display: none;" value="other" name="type" type="text">
 
             <label for="name" class="block text-sm font-medium text-gray-700 mt-2">Asset Name</label>
@@ -72,7 +71,6 @@
 
         <!-- Create savings asset form -->
         <form style="display: none;" method="POST" action="/createAsset" id="create-saving-asset-form">
-            <input style="display: none;" value="<%= user._id %>" name="ownerId" type="text">
             <input style="display: none;" value="saving" name="type" type="text">
 
             <label for="name" class="block text-sm font-medium text-gray-700 mt-2">Savings Name</label>
@@ -100,7 +98,6 @@
 
         <!-- Create stock asset form -->
         <form style="display: none;" method="POST" action="/createAsset" id="create-stock-asset-form">
-            <input style="display: none;" value="<%= user._id %>" name="ownerId" type="text">
             <input style="display: none;" value="stock" name="type" type="text">
 
             <label for="ticker" class="block text-sm font-medium text-gray-700 mt-2">Stock Ticker</label>
@@ -279,7 +276,7 @@
                 <form id="<%= asset._id %>-form" method="POST" action="/updateAsset">
                     <input id="type-<%= asset._id %>" name="type" type="text" hidden value="<%= asset.type %>">
                     <input id="id-<%= asset._id %>" name="id" type="text" hidden value="<%= asset._id %>">
-                    <input id="ownerId-<%= asset.ownerId %>" name="ownerId" type="text" hidden value="<%= asset.ownerId %>">
+                    <input id="userId-<%= asset.userId %>" name="userId" type="text" hidden value="<%= asset.userId %>">
 
                     <% if (asset.type != "stock") { %>
                         <label for="name" class="block text-sm font-medium text-gray-700 mt-6">Name</label>