feat: Add account deletion

[yugalkaushik]

Closes #1840

What's changed

Users can now permanently delete their account from the Account Settings page.

Changes

Server

• Added a protected DELETE /account route using the isAuthenticated middleware.
• Implemented deleteAccount controller in authManagement.ts.
  • Requires password confirmation for password-based accounts.
  • Deletes the user's projects and collections from MongoDB.
  • Removes any associated S3 assets.
  • Logs the user out and destroys the session before responding.
• Added DeleteAccountRequestBody type in server/types/user.ts and re-exported it through common/types.

Client

• Added a new DangerZone component under client/modules/User/components/.
  • Initially shows a Delete Account button.
  • Clicking it reveals a confirmation form with a password field.
  • Cancel restores the original view.
  • Confirm is disabled until a password is entered.
  • Server errors (e.g. incorrect password) are displayed inline.
• Added deleteAccount thunk in User/actions.ts:
  • Calls DELETE /account
  • Dispatches UNAUTH_USER and RESET_PROJECT on success
  • Redirects the user to /

Translations

• Added a DangerZone namespace to en-US/translations.json for labels, buttons, and error messages.

How to test

1. Create a new account at /signup.
2. Go to /account and scroll to Danger Zone.
3. Click Delete Account, enter your password, and confirm.
4. You should be logged out and redirected to /.
5. Logging in again with the same credentials should fail.

I have verified that this pull request:

• has no linting errors (npm run lint)
• has no test errors (npm run test)
• has no typecheck errors (npm run typecheck)
• is from a uniquely-named feature branch and is up to date with the develop branch.
• is descriptively named and links to an issue number, i.e. Fixes #123
• meets the standards outlined in the accessibility guidelines

[clairep94]

niceee @yugalkaushik !
Could you add a screen recording when you get a chance?

[yugalkaushik]

Hi @clairep94, although I think everything is working as I expected but I haven't tested it for sign in using google/github. Is there a way you know I can test it?
https://github.com/user-attachments/assets/3e70cdd0-95f9-49a6-8a63-da991e58684c

[clairep94]

Hi @clairep94, although I think everything is working as I expected but I haven't tested it for sign in using google/github. Is there a way you know I can test it?

preview-p5.mp4

Not sure the best way to test the google/github account association locally but great that you thought of that! Potentially you would look at the methods for deleting GitHub and Google and either call those routes first or fork the inner code to after where you delete the users projects

[yugalkaushik]

Not sure the best way to test the google/github account association locally but great that you thought of that! Potentially you would look at the methods for deleting GitHub and Google and either call those routes first or fork the inner code to after where you delete the users projects

I implemented your suggestion but testing these approach is the issue. Maybe creating some tests to check it out is the only solution.

[Iron-56]

I have tested your code but it seems that the assets still remain the same. The account is getting deleted from the mongodb

[yugalkaushik]

@Iron-56 Thank you for pointing that out. I’m actually still working on it and the PR isn’t ready yet. There are several tests that still need to be completed and I’m gradually progressing through them. I’ll write in comments once everything is properly tested and ready for review.