graphql_devise 2.3.0 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a254ff0aef5cb9ce45ee53100dccecd33a2b0898afc1261d668be20b4cd8a739
-  data.tar.gz: d062d1b78f625585c0e613d99b5a252c76d1e16f58aa75711fb63197241d59b6
+  metadata.gz: daddc316d120f12ed4a6a781871ec676a0eb11d6d6a407a438e01460fbd5c668
+  data.tar.gz: 73f19c61b7484b7cb7801e99d5889ddffdb8a0c8bfed393bd22e669c5143ccf3
 SHA512:
-  metadata.gz: 826361a8cd110e817da03f60383513e02a06e7847543c9d183500ed86b381419fe44742607b6c5b5f4bb18afd985b80dc9f68c152ba99e10ca237f3c0442ab56
-  data.tar.gz: 49a8b2cec607525cc84682cf797d05456c6d462751ac5857dd1a157d72766b2a6654cc74ce40c8a9e34847ab66dd441d1d96d6c696ea526ac2f8c8ec7668bcca
+  metadata.gz: 1ca7946d638f1e40e2b0bfe4f427cf1c60fc63e7b947ffb716858ba5278dfbb06717a8919e276e221701729069a8b421f8bd094874b7dc729cbb69e2dbfaaa7c
+  data.tar.gz: 31a7f42e8eaa5e268c829ea9b091c8edc3e73f4c0101520eee737de55c8fab1e12d1b67246709e6cca8f7a3278906fb61a675d9f8c439d861422aac26ab17baf

data/.circleci/config.yml

@@ -1,6 +1,6 @@
 version: 2.1
 orbs:
-  coveralls: coveralls/coveralls@1.0.6
+  coveralls: coveralls/coveralls@2.2.5
 
 jobs:
   test:
@@ -12,9 +12,8 @@ jobs:
     docker:
       - image: 'ruby:<< parameters.ruby-version >>'
     environment:
-      BUNDLE_GEMFILE: << parameters.gemfile >>
+      BUNDLE_GEMFILE: gemfiles/<< parameters.gemfile >>.gemfile
       BUNDLE_JOBS: '2'
-      COVERALLS_PARALLEL: 'true'
       EAGER_LOAD: 'true'
       RUBYOPT: '-rostruct'
     steps:
@@ -27,6 +26,13 @@ jobs:
           name: Run Specs
           command:
             bundle exec rspec
+      - coveralls/upload:
+          parallel: true
+          coverage_file: ./coverage/.resultset.json
+          coverage_format: simplecov
+          # Parallel jobs must each report a unique flag_name or Coveralls
+          # collapses them into a single job. Keep it free of slashes.
+          flag_name: ruby-<< parameters.ruby-version >>-<< parameters.gemfile >>
   report-coverage:
     docker:
       - image: 'cimg/node:22.1.0'
@@ -47,63 +53,75 @@ workflows:
                 - '3.3'
                 - '3.4'
               gemfile:
-                - gemfiles/rails7.0_graphql2.0.gemfile
-                - gemfiles/rails7.0_graphql2.1.gemfile
-                - gemfiles/rails7.0_graphql2.2.gemfile
-                - gemfiles/rails7.0_graphql2.3.gemfile
-                - gemfiles/rails7.0_graphql2.4.gemfile
-                - gemfiles/rails7.1_graphql2.0.gemfile
-                - gemfiles/rails7.1_graphql2.1.gemfile
-                - gemfiles/rails7.1_graphql2.2.gemfile
-                - gemfiles/rails7.1_graphql2.3.gemfile
-                - gemfiles/rails7.1_graphql2.4.gemfile
-                - gemfiles/rails7.2_graphql2.0.gemfile
-                - gemfiles/rails7.2_graphql2.1.gemfile
-                - gemfiles/rails7.2_graphql2.2.gemfile
-                - gemfiles/rails7.2_graphql2.3.gemfile
-                - gemfiles/rails7.2_graphql2.4.gemfile
-                - gemfiles/rails7.2_graphql2.5.gemfile
-                - gemfiles/rails7.2_graphql2.6.gemfile
-                - gemfiles/rails8.0_graphql2.2.gemfile
-                - gemfiles/rails8.0_graphql2.3.gemfile
-                - gemfiles/rails8.0_graphql2.4.gemfile
-                - gemfiles/rails8.0_graphql2.5.gemfile
-                - gemfiles/rails8.0_graphql2.6.gemfile
+                - rails7.0_graphql2.3
+                - rails7.0_graphql2.4
+                - rails7.1_graphql2.0
+                - rails7.1_graphql2.1
+                - rails7.1_graphql2.2
+                - rails7.1_graphql2.3
+                - rails7.1_graphql2.4
+                - rails7.2_graphql2.0
+                - rails7.2_graphql2.1
+                - rails7.2_graphql2.2
+                - rails7.2_graphql2.3
+                - rails7.2_graphql2.4
+                - rails7.2_graphql2.5
+                - rails7.2_graphql2.6
+                - rails8.0_graphql2.2
+                - rails8.0_graphql2.3
+                - rails8.0_graphql2.4
+                - rails8.0_graphql2.5
+                - rails8.0_graphql2.6
+                - rails8.1_graphql2.4
+                - rails8.1_graphql2.5
+                - rails8.1_graphql2.6
             exclude:
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails7.2_graphql2.0.gemfile
+                gemfile: rails7.2_graphql2.0
+              - ruby-version: '3.0'
+                gemfile: rails7.2_graphql2.1
+              - ruby-version: '3.0'
+                gemfile: rails7.2_graphql2.2
+              - ruby-version: '3.0'
+                gemfile: rails7.2_graphql2.3
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails7.2_graphql2.1.gemfile
+                gemfile: rails7.2_graphql2.4
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails7.2_graphql2.2.gemfile
+                gemfile: rails7.2_graphql2.5
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails7.2_graphql2.3.gemfile
+                gemfile: rails7.2_graphql2.6
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails7.2_graphql2.4.gemfile
+                gemfile: rails8.0_graphql2.2
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails7.2_graphql2.5.gemfile
+                gemfile: rails8.0_graphql2.3
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails7.2_graphql2.6.gemfile
+                gemfile: rails8.0_graphql2.4
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails8.0_graphql2.2.gemfile
+                gemfile: rails8.0_graphql2.5
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails8.0_graphql2.3.gemfile
+                gemfile: rails8.0_graphql2.6
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails8.0_graphql2.4.gemfile
+                gemfile: rails8.1_graphql2.4
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails8.0_graphql2.5.gemfile
+                gemfile: rails8.1_graphql2.5
               - ruby-version: '3.0'
-                gemfile: gemfiles/rails8.0_graphql2.6.gemfile
+                gemfile: rails8.1_graphql2.6
+              - ruby-version: '3.1'
+                gemfile: rails8.0_graphql2.2
+              - ruby-version: '3.1'
+                gemfile: rails8.0_graphql2.3
+              - ruby-version: '3.1'
+                gemfile: rails8.0_graphql2.4
               - ruby-version: '3.1'
-                gemfile: gemfiles/rails8.0_graphql2.2.gemfile
+                gemfile: rails8.0_graphql2.5
               - ruby-version: '3.1'
-                gemfile: gemfiles/rails8.0_graphql2.3.gemfile
+                gemfile: rails8.0_graphql2.6
               - ruby-version: '3.1'
-                gemfile: gemfiles/rails8.0_graphql2.4.gemfile
+                gemfile: rails8.1_graphql2.4
               - ruby-version: '3.1'
-                gemfile: gemfiles/rails8.0_graphql2.5.gemfile
+                gemfile: rails8.1_graphql2.5
               - ruby-version: '3.1'
-                gemfile: gemfiles/rails8.0_graphql2.6.gemfile
+                gemfile: rails8.1_graphql2.6
       - report-coverage:
           requires:
             - test

data/Appraisals

@@ -1,37 +1,3 @@
-appraise 'rails6.1-graphql1.10' do
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'devise', '>= 4.7'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '6-1-stable'
-  gem 'graphql', '~> 1.10.0'
-  gem 'factory_bot', '<= 6.4.4'
-end
-
-appraise 'rails6.1-graphql1.11' do
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'public_suffix', '< 5'
-  gem 'devise', '>= 4.7'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '6-1-stable'
-  gem 'graphql', '~> 1.11.0'
-  gem 'factory_bot', '<= 6.4.4'
-end
-
-appraise 'rails6.1-graphql1.12' do
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'public_suffix', '< 5'
-  gem 'devise', '>= 4.7'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '6-1-stable'
-  gem 'graphql', '~> 1.12.0'
-  gem 'factory_bot', '<= 6.4.4'
-end
-
-appraise 'rails6.1-graphql1.13' do
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'devise', '>= 4.7'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '6-1-stable'
-  gem 'graphql', '~> 1.13.0'
-  gem 'factory_bot', '<= 6.4.4'
-end
-
 appraise 'rails6.1-graphql2.0' do
   gem 'public_suffix', '< 5'
   gem 'sqlite3', '~> 1.5.4'
@@ -41,60 +7,6 @@ appraise 'rails6.1-graphql2.0' do
   gem 'factory_bot', '<= 6.4.4'
 end
 
-appraise 'rails7.0-graphql1.11' do
-  gem 'sassc-rails'
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'devise', '>= 4.7'
-  gem 'devise_token_auth', '>= 1.2.1'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '7-0-stable'
-  gem 'graphql', '~> 1.11.0'
-end
-
-appraise 'rails7.0-graphql1.12' do
-  gem 'sassc-rails'
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'devise', '>= 4.7'
-  gem 'devise_token_auth', '>= 1.2.1'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '7-0-stable'
-  gem 'graphql', '~> 1.12.0'
-end
-
-appraise 'rails7.0-graphql1.13' do
-  gem 'sassc-rails'
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'devise', '>= 4.7'
-  gem 'devise_token_auth', '>= 1.2.1'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '7-0-stable'
-  gem 'graphql', '~> 1.13.0'
-end
-
-appraise 'rails7.0-graphql2.0' do
-  gem 'sassc-rails'
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'devise_token_auth', '>= 1.2.1'
-  gem 'devise', '>= 4.7'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '7-0-stable'
-  gem 'graphql', '>= 2.0', '< 2.1'
-end
-
-appraise 'rails7.0-graphql2.1' do
-  gem 'sassc-rails'
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'devise_token_auth', '>= 1.2.1'
-  gem 'devise', '>= 4.7'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '7-0-stable'
-  gem 'graphql', '>= 2.1', '< 2.2'
-end
-
-appraise 'rails7.0-graphql2.2' do
-  gem 'sassc-rails'
-  gem 'sqlite3', '~> 1.5.4'
-  gem 'devise_token_auth', '>= 1.2.1'
-  gem 'devise', '>= 4.7'
-  gem 'rails', git: 'https://github.com/rails/rails', branch: '7-0-stable'
-  gem 'graphql', '>= 2.2', '< 2.3'
-end
-
 appraise 'rails7.0-graphql2.3' do
   gem 'sassc-rails'
   gem 'sqlite3', '~> 1.5.4'
@@ -232,3 +144,18 @@ appraise 'rails8.0-graphql2.6' do
   gem 'rails', git: 'https://github.com/rails/rails', branch: '8-0-stable'
   gem 'graphql', '>= 2.6', '< 2.7'
 end
+
+appraise 'rails8.1-graphql2.4' do
+  gem 'rails', git: 'https://github.com/rails/rails', branch: '8-1-stable'
+  gem 'graphql', '>= 2.4', '< 2.5'
+end
+
+appraise 'rails8.1-graphql2.5' do
+  gem 'rails', git: 'https://github.com/rails/rails', branch: '8-1-stable'
+  gem 'graphql', '>= 2.5', '< 2.6'
+end
+
+appraise 'rails8.1-graphql2.6' do
+  gem 'rails', git: 'https://github.com/rails/rails', branch: '8-1-stable'
+  gem 'graphql', '>= 2.6', '< 2.7'
+end

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [v2.4.0](https://github.com/graphql-devise/graphql_devise/tree/v2.4.0) (2026-07-23)
+
+[Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v2.3.0...v2.4.0)
+
+**Implemented enhancements:**
+
+- Add Rails 8.1 support [\#297](https://github.com/graphql-devise/graphql_devise/pull/297) ([mcelicalderon](https://github.com/mcelicalderon))
+- Add opt-in destroy\_account mutation [\#296](https://github.com/graphql-devise/graphql_devise/pull/296) ([mcelicalderon](https://github.com/mcelicalderon))
+
 ## [v2.3.0](https://github.com/graphql-devise/graphql_devise/tree/v2.3.0) (2026-07-20)
 
 [Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v2.2.0...v2.3.0)

data/README.md

@@ -294,6 +294,13 @@ Please note the gem provided schema is shared by all mounted resources, so setti
 mount will disable introspection for all of them. **This option only works if you are using the mount method.**
 If you are mounting the auth operations into your own schema, use the `public_introspection` option of the
 `SchemaPlugin` instead.
+1. `allow_destroy`: Defaults to `false`. The `destroy_account` operation is opt-in: it is **not** mounted
+automatically, so upgrading the gem will never add a way to delete accounts to an existing schema. Set
+`allow_destroy: true` to mount it (works alongside `skip`, and additively when no `skip`/`only` is given), or
+list `:destroy_account` in the `only` option. While the operation is available but not mounted, a warning is
+logged on boot explaining how to opt in. If you have decided you don't want the mutation and want to silence
+the warning, add `:destroy_account` to the `skip` option (for example `skip: [:destroy_account]`, or combined
+with the flag as `allow_destroy: true, skip: [:destroy_account]`).
 
 Additional mutations and queries will be added to the schema regardless
 of other options you might have specified like `skip` or `only`.
@@ -315,6 +322,7 @@ The following is a list of the symbols you can provide to the `operations`, `ski
 :send_password_reset_with_token
 :resend_confirmation_with_token
 :confirm_registration_with_token
+:destroy_account # opt-in, see the `allow_destroy` option above
 ```
 
 ### Configuring Model
@@ -479,6 +487,7 @@ register | The parameter `confirmUrl` is optional unless you are using the `conf
 sendPasswordResetWithToken | Sends an email to the provided address with a link to reset the password of the resource. First step of the most recently implemented password reset flow. | userSendPasswordResetWithToken(email: String!, redirectUrl: String!): UserSendPasswordResetWithTokenPayload |
 updatePasswordWithToken | Uses a `resetPasswordToken` to update the password of a resource. Second and last step of the most recently implemented password reset flow. | userSendPasswordResetWithToken(resetPasswordToken: String!, password: String!, passwordConfirmation: String!): UserUpdatePasswordWithTokenPayload |
 resendConfirmationWithToken | The `UserResendConfirmationWithTokenPayload` will return a `message: String!` that can be used to notify a user what to do after the instructions were sent to them. Email will contain a link to the provided `confirmUrl` and a `confirmationToken` query param. | userResendConfirmationWithToken(email: String!, confirmUrl: String!): UserResendConfirmationWithTokenPayload |
+destroyAccount | Opt-in (see the `allow_destroy` mount option). Requires authentication headers. Destroys the current resource and clears the session so no auth headers are returned. | userDestroyAccount: UserDestroyAccountPayload |
 
 ### Reset Password Flow
 This gem supports two password recovery flows. The most recently implemented is preferred and

data/config/locales/en.yml

@@ -2,6 +2,7 @@ en:
   graphql_devise:
     redirect_url_not_allowed: "Redirect to '%{redirect_url}' not allowed."
     registration_failed: "User couldn't be registered"
+    destroy_account_failed: "Account couldn't be destroyed"
     resource_build_failed: "Resource couldn't be built, execution stopped."
     not_authenticated: "User is not logged in."
     user_not_found: "User was not found or was not logged in."

data/config/locales/pt-BR.yml

@@ -2,6 +2,7 @@ pt-BR:
   graphql_devise:
     redirect_url_not_allowed: "Redirecionamento para '%{redirect_url}' não permitido."
     registration_failed: "Usuário não pôde ser registrado"
+    destroy_account_failed: "A conta não pôde ser excluída"
     resource_build_failed: "O recurso não pôde ser construído, execução interrompida."
     not_authenticated: "Usuário não logado."
     user_not_found: "Usuário não encontrado ou não logado."

data/graphql_devise.gemspec

@@ -29,11 +29,10 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'devise_token_auth', '>= 0.1.43', '< 2.0'
   spec.add_dependency 'graphql', '>= 1.8', '< 2.7'
-  spec.add_dependency 'rails', '>= 6.0', '< 8.1'
+  spec.add_dependency 'rails', '>= 6.0', '< 8.2'
   spec.add_dependency 'zeitwerk'
 
   spec.add_development_dependency 'appraisal'
-  spec.add_development_dependency 'coveralls_reborn'
   spec.add_development_dependency 'factory_bot'
   spec.add_development_dependency 'faker'
   spec.add_development_dependency 'generator_spec'
@@ -46,5 +45,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rubocop-performance', '< 1.6.0'
   spec.add_development_dependency 'rubocop-rails', '< 2.6.0'
   spec.add_development_dependency 'rubocop-rspec', '< 1.39.0'
+  spec.add_development_dependency 'simplecov'
   spec.add_development_dependency 'sqlite3'
 end

data/lib/graphql_devise/default_operations.rb

@@ -10,7 +10,8 @@ module GraphqlDevise
       update_password_with_token:      { klass: Mutations::UpdatePasswordWithToken, authenticatable: true },
       send_password_reset_with_token:  { klass: Mutations::SendPasswordResetWithToken, authenticatable: false },
       resend_confirmation_with_token:  { klass: Mutations::ResendConfirmationWithToken, authenticatable: false },
-      confirm_registration_with_token: { klass: Mutations::ConfirmRegistrationWithToken, authenticatable: true }
+      confirm_registration_with_token: { klass: Mutations::ConfirmRegistrationWithToken, authenticatable: true },
+      destroy_account:                 { klass: Mutations::DestroyAccount, authenticatable: true, allow_destroy: true }
     }.freeze
   end
 end

data/lib/graphql_devise/mount_method/operation_preparers/default_operation_preparer.rb

@@ -17,7 +17,7 @@ module GraphqlDevise
           @selected_operations.except(*@custom_keys).each_with_object({}) do |(action, operation_info), result|
             mapped_action = "#{mapping_name}_#{action}"
             operation     = operation_info[:klass]
-            options       = operation_info.except(:klass, :deprecation_reason)
+            options       = operation_info.except(:klass, :deprecation_reason, :allow_destroy)
 
             result[mapped_action.to_sym] = [
               OperationPreparers::GqlNameSetter.new(mapped_action),

data/lib/graphql_devise/mount_method/operation_sanitizer.rb

@@ -3,29 +3,56 @@
 module GraphqlDevise
   module MountMethod
     class OperationSanitizer
-      def self.call(default:, only:, skipped:)
+      def self.call(default:, only:, skipped:, allow_destroy: false)
         new(
-          default: default,
-          only:    only,
-          skipped: skipped
+          default:       default,
+          only:          only,
+          skipped:       skipped,
+          allow_destroy: allow_destroy
         ).call
       end
 
-      def initialize(default:, only:, skipped:)
-        @default = default
-        @only    = only
-        @skipped = skipped
+      def initialize(default:, only:, skipped:, allow_destroy: false)
+        @default       = default
+        @only          = only
+        @skipped       = skipped
+        @allow_destroy = allow_destroy
       end
 
       def call
-        operations = if @only.present?
-          @default.slice(*@only)
-        elsif @skipped.present?
-          @default.except(*@skipped)
-        else
-          @default
+        # When `only` is provided the list is explicit, so `allow_destroy` operations are included
+        # (and never warned about) whenever they are named in it.
+        return @default.slice(*@only) if @only.present?
+
+        selected = @skipped.present? ? @default.except(*@skipped) : @default
+
+        reject_allow_destroy(selected)
+      end
+
+      private
+
+      def reject_allow_destroy(operations)
+        return operations if @allow_destroy
+
+        operations.reject do |name, options|
+          next false unless requires_allow_destroy?(options)
+
+          warn_excluded(name)
+          true
         end
       end
+
+      def requires_allow_destroy?(options)
+        options.is_a?(Hash) && options[:allow_destroy]
+      end
+
+      def warn_excluded(name)
+        ::Rails.logger&.warn(
+          "[graphql_devise] The `#{name}` operation is not mounted because it is opt-in. " \
+          "Pass `allow_destroy: true` (or add it to the `only:` option) to include it. " \
+          "To keep it out and silence this warning, add `#{name}` to the `skip:` option."
+        )
+      end
     end
   end
 end

data/lib/graphql_devise/mount_method/supported_options.rb

@@ -10,7 +10,8 @@ module GraphqlDevise
       additional_queries:   OptionSanitizers::HashChecker.new(GraphQL::Schema::Resolver),
       additional_mutations: OptionSanitizers::HashChecker.new(GraphQL::Schema::Mutation),
       authenticatable_type: OptionSanitizers::ClassChecker.new(GraphQL::Schema::Member),
-      public_introspection: OptionSanitizers::BooleanChecker.new(true)
+      public_introspection: OptionSanitizers::BooleanChecker.new(true),
+      allow_destroy:        OptionSanitizers::BooleanChecker.new(false)
     }.freeze
   end
 end

data/lib/graphql_devise/mutations/destroy_account.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module GraphqlDevise
+  module Mutations
+    class DestroyAccount < Base
+      def resolve
+        raise_user_error(I18n.t('graphql_devise.user_not_found')) unless current_resource
+
+        if current_resource.destroy
+          # Clear the controller resource/token so devise_token_auth's `update_auth_header`
+          # after_action doesn't try to reload the now deleted record.
+          remove_resource
+
+          yield current_resource if block_given?
+
+          { authenticatable: current_resource }
+        else
+          raise_user_error_list(
+            I18n.t('graphql_devise.destroy_account_failed'),
+            resource: current_resource
+          )
+        end
+      end
+    end
+  end
+end

data/lib/graphql_devise/resource_loader.rb

@@ -117,7 +117,10 @@ module GraphqlDevise
         additional_operations: clean_options.additional_mutations,
         preparer:              MountMethod::OperationPreparers::MutationFieldSetter.new(authenticatable_type),
         selected_operations:   MountMethod::OperationSanitizer.call(
-          default: DefaultOperations::MUTATIONS, only: clean_options.only, skipped: clean_options.skip
+          default:       DefaultOperations::MUTATIONS,
+          only:          clean_options.only,
+          skipped:       clean_options.skip,
+          allow_destroy: clean_options.allow_destroy
         )
       ).call
     end

data/lib/graphql_devise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module GraphqlDevise
-  VERSION = '2.3.0'
+  VERSION = '2.4.0'
 end

data/spec/dummy/config/routes.rb

@@ -7,13 +7,15 @@ Rails.application.routes.draw do
     base_controller: CookiesController,
     operations: { login: Mutations::Login, register: Mutations::Register },
     additional_mutations: { register_confirmed_user: Mutations::RegisterConfirmedUser },
-    additional_queries: { public_user: Resolvers::PublicUser }
+    additional_queries: { public_user: Resolvers::PublicUser },
+    allow_destroy: true
   )
 
   mount_graphql_devise_for(
     Admin,
     authenticatable_type: Types::CustomAdminType,
     skip:                 [:register],
+    allow_destroy:        true,
     operations:           {
       update_password_with_token: Mutations::ResetAdminPasswordWithToken
     },

data/spec/requests/mutations/destroy_account_spec.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Destroy Account Requests' do
+  include_context 'with graphql query request'
+
+  let(:user) { create(:user, :confirmed) }
+  let(:query) do
+    <<-GRAPHQL
+      mutation {
+        userDestroyAccount {
+          authenticatable { email }
+        }
+      }
+    GRAPHQL
+  end
+
+  before { post_request }
+
+  context 'when user is logged in' do
+    let(:headers) { user.create_new_auth_token }
+
+    it 'destroys the account and does not set auth headers' do
+      expect(response).not_to include_auth_headers
+      expect(User.exists?(user.id)).to be(false)
+      expect(json_response[:data][:userDestroyAccount]).to match(
+        authenticatable: { email: user.email }
+      )
+      expect(json_response[:errors]).to be_nil
+    end
+  end
+
+  context 'when user is not logged in' do
+    it 'returns an error and does not delete anything' do
+      expect(response).not_to include_auth_headers
+      expect(User.exists?(user.id)).to be(true)
+      expect(json_response[:data][:userDestroyAccount]).to be_nil
+      expect(json_response[:errors]).to contain_exactly(
+        hash_including(message: 'User was not found or was not logged in.', extensions: { code: 'USER_ERROR' })
+      )
+    end
+  end
+
+  context 'when using the admin model' do
+    let(:query) do
+      <<-GRAPHQL
+        mutation {
+          adminDestroyAccount {
+            authenticatable { email }
+          }
+        }
+      GRAPHQL
+    end
+    let(:admin)   { create(:admin, :confirmed) }
+    let(:headers) { admin.create_new_auth_token }
+
+    it 'destroys the admin account' do
+      expect(response).not_to include_auth_headers
+      expect(Admin.exists?(admin.id)).to be(false)
+      expect(json_response[:data][:adminDestroyAccount]).to match(
+        authenticatable: { email: admin.email }
+      )
+      expect(json_response[:errors]).to be_nil
+    end
+  end
+end

data/spec/services/mount_method/operation_sanitizer_spec.rb

@@ -4,11 +4,14 @@ require 'rails_helper'
 
 RSpec.describe GraphqlDevise::MountMethod::OperationSanitizer do
   describe '.call' do
-    subject { described_class.call(default: default, only: only, skipped: skipped) }
+    subject(:sanitized) do
+      described_class.call(default: default, only: only, skipped: skipped, allow_destroy: allow_destroy)
+    end
 
     let(:op_class1) { Class.new }
     let(:op_class2) { Class.new }
     let(:op_class3) { Class.new }
+    let(:allow_destroy) { false }
 
     context 'when the operations passed are mutations' do
       let(:skipped)  { [] }
@@ -31,5 +34,59 @@ RSpec.describe GraphqlDevise::MountMethod::OperationSanitizer do
         it { is_expected.to eq(operation1: { klass: op_class1 }) }
       end
     end
+
+    context 'when an operation requires the allow_destroy option' do
+      let(:skipped) { [] }
+      let(:only)    { [] }
+      let(:default) do
+        {
+          operation1:      { klass: op_class1 },
+          destroy_account: { klass: op_class2, allow_destroy: true }
+        }
+      end
+
+      context 'when no only/skip option and allow_destroy is off' do
+        it 'excludes the operation and logs a warning' do
+          expect(Rails.logger).to receive(:warn).with(/destroy_account/)
+          expect(sanitized).to eq(operation1: { klass: op_class1 })
+        end
+      end
+
+      context 'when using skip on other operations without allow_destroy' do
+        let(:skipped) { [:operation1] }
+
+        it 'still excludes the operation and logs a warning' do
+          expect(Rails.logger).to receive(:warn).with(/destroy_account/)
+          expect(sanitized).to eq({})
+        end
+      end
+
+      context 'when the operation itself is skipped' do
+        let(:skipped) { [:destroy_account] }
+
+        it 'excludes the operation without logging a warning' do
+          expect(Rails.logger).not_to receive(:warn)
+          expect(sanitized).to eq(operation1: { klass: op_class1 })
+        end
+      end
+
+      context 'when allow_destroy is on' do
+        let(:allow_destroy) { true }
+
+        it 'includes the operation without warning' do
+          expect(Rails.logger).not_to receive(:warn)
+          expect(sanitized).to eq(default)
+        end
+      end
+
+      context 'when named explicitly in only' do
+        let(:only) { [:destroy_account] }
+
+        it 'includes the operation without warning' do
+          expect(Rails.logger).not_to receive(:warn)
+          expect(sanitized).to eq(destroy_account: { klass: op_class2, allow_destroy: true })
+        end
+      end
+    end
   end
 end

data/spec/spec_helper.rb

@@ -2,9 +2,11 @@
 
 if ENV['CI'] && !ENV['SKIP_COVERALLS']
   require 'simplecov'
-  require 'coveralls'
 
-  SimpleCov.formatter = Coveralls::SimpleCov::Formatter
+  # SimpleCov writes coverage/.resultset.json, which the Coveralls coverage-reporter
+  # (invoked by the coveralls CircleCI orb) picks up and uploads. We no longer upload
+  # from within Ruby so that every parallel job and the parallel_finished webhook share
+  # the same service number and aggregate into a single Coveralls build.
   SimpleCov.start 'rails' do
     add_filter ['spec']
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: graphql_devise
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.4.0
 platform: ruby
 authors:
 - Mario Celi
@@ -59,7 +59,7 @@ dependencies:
         version: '6.0'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.1'
+        version: '8.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -69,7 +69,7 @@ dependencies:
         version: '6.0'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.1'
+        version: '8.2'
 - !ruby/object:Gem::Dependency
   name: zeitwerk
   requirement: !ruby/object:Gem::Requirement
@@ -98,20 +98,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: coveralls_reborn
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: factory_bot
   requirement: !ruby/object:Gem::Requirement
@@ -280,6 +266,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: 1.39.0
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -369,6 +369,7 @@ files:
 - lib/graphql_devise/mount_method/supported_options.rb
 - lib/graphql_devise/mutations/base.rb
 - lib/graphql_devise/mutations/confirm_registration_with_token.rb
+- lib/graphql_devise/mutations/destroy_account.rb
 - lib/graphql_devise/mutations/login.rb
 - lib/graphql_devise/mutations/logout.rb
 - lib/graphql_devise/mutations/register.rb
@@ -475,6 +476,7 @@ files:
 - spec/requests/mutations/additional_mutations_spec.rb
 - spec/requests/mutations/additional_queries_spec.rb
 - spec/requests/mutations/confirm_registration_with_token_spec.rb
+- spec/requests/mutations/destroy_account_spec.rb
 - spec/requests/mutations/login_spec.rb
 - spec/requests/mutations/logout_spec.rb
 - spec/requests/mutations/register_spec.rb
@@ -622,6 +624,7 @@ test_files:
 - spec/requests/mutations/additional_mutations_spec.rb
 - spec/requests/mutations/additional_queries_spec.rb
 - spec/requests/mutations/confirm_registration_with_token_spec.rb
+- spec/requests/mutations/destroy_account_spec.rb
 - spec/requests/mutations/login_spec.rb
 - spec/requests/mutations/logout_spec.rb
 - spec/requests/mutations/register_spec.rb