From 2548f7578ab879bc7eb292462b13f41e7f3112e5 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sat, 13 Jun 2026 14:21:49 -0700
Subject: users: add authenticated self-delete endpoint

POST /delete (auth) wipes every key tied to the calling user, mirroring
scripts/delall-legacy.ts: user records, payments/invoices, sub-accounts,
NWC apps, nostr follow graph + nip5. Gated by typing the username and
refuses while balance+pending > 10k sats so funds can't be destroyed by
accident.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 index.ts | 1 +
 1 file changed, 1 insertion(+)

(limited to 'index.ts')

diff --git a/index.ts b/index.ts
index 3b90d32b..0a3bfd89 100644
--- a/index.ts
+++ b/index.ts
@@ -123,6 +123,7 @@ app.post("/register", users.create);
 app.post("/disable2fa", auth, users.disable2fa);
 app.post("/2fa", auth, users.enable2fa);
 app.post("/user", auth, users.update);
+app.post("/delete", auth, users.deleteSelf);
 app.post("/reset", optional, users.reset);
 app.post("/upload/:type", users.upload);
 app.get("/users/delete/:username", users.del);
-- 
cgit v1.2.3