Add delete user identity server endpoint and delete profile and forms api endpoint #442
Conversation
irinel-nistor
requested review from
bvizureanu,
RaduCStefanescu and
surdu
as code owners
|
This pull request is being automatically deployed with Vercel (learn more). 🔍 Inspect: https://vercel.com/code4romania/stam-acasa/kple4xeia |
| [HttpPost] | ||
| public async Task<IActionResult> DeleteAccountAsync([FromBody] DeleteAccountModel model) | ||
| { | ||
| var user = await _userManager.FindByNameAsync(model.Username); |
There was a problem hiding this comment.
we should not provide info to anyone if a user with specified username exists or not
There was a problem hiding this comment.
Yes I agree with this one.
Can you please make the change @irinel-nistor ?
| /// </summary> | ||
| /// <returns></returns> | ||
| [HttpDelete] | ||
| public async Task<IActionResult> DeleteProfile() |
There was a problem hiding this comment.
this endpoint should be called only by IdentityServer . If someone with valid token will call this endpoint he will delete from just from User table and will not delete from AspNetUsers
There was a problem hiding this comment.
in order to implement this we could add a claim named admin or idsrv and add a policy for this endpoint
There was a problem hiding this comment.
Very good points, Thank you!
|
Also, we will need the update on frontend. |
|
The frontend view for this issue will be handled in this issue: |
| if (sub == null) | ||
| return new UnauthorizedResult(); | ||
|
|
||
| await _userService.DeleteUserAndDependentData(sub); |
There was a problem hiding this comment.
Why don't we get the user email from the current session instead of requiring the UI to provide the email ?
There was a problem hiding this comment.
Yup, I think this is a very fair point.
|
@irinel-nistor can you please update the PR to take the email from the session? The UI will only provide the password in this situation. |
What does it fix?
Closes #418
How has it been tested?
I manually tested the changes, by creating test data and removing it using the endpoints
*** Should I add a new client in IdentiyServer configuration, that would be the only one to access the DeleteProfile endpoint from the api, using a new scope?