From 1649bfd6dc01e8bebccab97327db2d55addb8854 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sun, 1 Mar 2026 21:09:20 -0800
Subject: delete endpoint

---
 index.ts        |  1 +
 routes/users.ts | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/index.ts b/index.ts
index 032913a3..362663bd 100644
--- a/index.ts
+++ b/index.ts
@@ -139,6 +139,7 @@ app.post("/ark/vault-send", auth, payments.arkVaultSend);
 app.post("/ark/vault-receive", auth, payments.arkVaultReceive);
 
 app.post("/account/delete", auth, users.deleteAccount);
+app.post("/user/delete", auth, users.deleteUser);
 app.get("/account/:id", auth, users.account);
 app.post("/account/:id", auth, users.updateAccount);
 app.get("/accounts", auth, users.accounts);
diff --git a/routes/users.ts b/routes/users.ts
index 6869021a..bc899ac7 100644
--- a/routes/users.ts
+++ b/routes/users.ts
@@ -1050,6 +1050,43 @@ export default {
     }
   },
 
+  async deleteUser(c) {
+    try {
+      const user = c.get("user");
+      const { id, username, pubkey } = user;
+      l("deleteUser", username, id);
+
+      // Remove app created during registration
+      const appKeys = await db.sMembers(`${id}:apps`);
+      const m = db.multi();
+      for (const key of appKeys) {
+        m.del(`app:${key}`);
+      }
+
+      // Reverse everything register() created
+      m.del(`user:${id}`)
+        .del(`user:${username}`)
+        .del(`account:${id}`)
+        .del(`${id}:accounts`)
+        .del(`${id}:apps`);
+
+      if (pubkey) {
+        m.del(`user:${pubkey}`)
+          .del(`${pubkey}:follows:n`)
+          .del(`${pubkey}:followers:n`)
+          .del(`${pubkey}:pubkeys`);
+      }
+
+      await m.exec();
+
+      l("deleted user", username);
+      return c.json({ ok: true });
+    } catch (e) {
+      err("problem deleting user", e.message);
+      return bail(c, e.message);
+    }
+  },
+
   async flash(c) {
     const body = await c.req.json();
     const { ssid, key, token } = body;
-- 
cgit v1.2.3