seperate delete from archive functions

routes/account.py

@@ -352,6 +352,42 @@ def update_password():
     return redirect(url_for("account.settings"))
 
 
+@account_bp.post("/disable")
+@login_required
+def disable_account():
+    if not db_ready():
+        flash("Account database is not available.", "error")
+        return redirect(url_for("account.settings"))
+
+    from db_models import League, User, utc_now
+
+    user = db.session.get(User, current_user_id())
+    if user is None:
+        flash("User not found.", "error")
+        return redirect(url_for("account.settings"))
+
+    confirm = request.form.get("confirm", "").strip()
+    current_password = request.form.get("current_password", "")
+
+    if confirm != "DISABLE":
+        flash("Confirmation text did not match.", "error")
+        return redirect(url_for("account.settings"))
+
+    if not verify_password(user.password_hash, current_password):
+        flash("Password is incorrect.", "error")
+        return redirect(url_for("account.settings"))
+
+    owned_leagues = League.query.filter_by(created_by_user_id=user.id, archived_at=None).all()
+    for league in owned_leagues:
+        league.archived_at = utc_now()
+
+    user.disabled_at = utc_now()
+    db.session.commit()
+    log_user_out()
+    flash("Your account has been disabled.", "success")
+    return redirect(url_for("public.home"))
+
+
 @account_bp.post("/delete")
 @login_required
 def delete_account():
@@ -359,7 +395,8 @@ def delete_account():
         flash("Account database is not available.", "error")
         return redirect(url_for("account.settings"))
 
-    from db_models import League, User, utc_now
+    from db_models import League, LeagueMembership, User, utc_now
+    from league_repositories import delete_league
 
     user = db.session.get(User, current_user_id())
     if user is None:
@@ -377,14 +414,14 @@ def delete_account():
         flash("Password is incorrect.", "error")
         return redirect(url_for("account.settings"))
 
-    owned_leagues = League.query.filter_by(created_by_user_id=user.id, archived_at=None).all()
-    for league in owned_leagues:
-        league.archived_at = utc_now()
+    for league in League.query.filter_by(created_by_user_id=user.id).all():
+        delete_league(league)
 
-    user.disabled_at = utc_now()
+    LeagueMembership.query.filter_by(user_id=user.id).delete(synchronize_session=False)
+    db.session.delete(user)
     db.session.commit()
     log_user_out()
-    flash("Your account has been deleted.", "success")
+    flash("Your account and all data have been permanently deleted.", "success")
     return redirect(url_for("public.home"))
 
 

routes/leagues.py

@@ -1603,6 +1603,29 @@ def archive_league(league_ref: str):
     return redirect(url_for("leagues.index"))
 
 
+@leagues_bp.post("/l/<league_ref>/delete")
+@login_required
+def delete_league_route(league_ref: str):
+    if not db_ready():
+        flash("League database is not available.", "error")
+        return redirect(url_for("public.home"))
+
+    from league_repositories import delete_league
+
+    league = require_league(league_ref, {"owner"})
+    confirm_name = request.form.get("confirm_name", "").strip()
+
+    if confirm_name != league.name:
+        flash("League name did not match. Deletion cancelled.", "error")
+        return redirect(url_for("leagues.league_settings", league_ref=league_ref))
+
+    league_name = league.name
+    delete_league(league)
+    db.session.commit()
+    flash(f'"{league_name}" and all its data have been permanently deleted.', "success")
+    return redirect(url_for("leagues.index"))
+
+
 @leagues_bp.get("/l/<league_ref>/ledger/export")
 @login_required
 def export_ledger_csv(league_ref: str):