kempo 4.9.4 → 4.9.5

package/README.md

@@ -376,7 +376,7 @@ Extensions can declare `jobs` in `kempo-config.json` and kempo runs them on a ti
 
 ## Email
 
-Kempo does not send email itself. It renders the email, saves it in a log (**Admin > Emails** shows every one, with whether it was sent and why not), and hands it to an **email extension**: `kempo-resend` sends through Resend, `kempo-smtp` through any SMTP server (a Hostinger or Google mailbox, Amazon SES, a Postfix of your own). Install one from Admin > Extensions and enter its settings on the Settings screen; with none installed, emails are logged and fail with "No email extension is installed".
+Kempo does not send email itself. It renders the email, saves it in a log (**Admin > Emails** shows every one, with whether it was sent and why not), and hands it to an **email extension**: `kempo-resend` sends through Resend, `kempo-smtp` through any SMTP server (a Hostinger or Google mailbox, Amazon SES, a Postfix of your own). Install one from Admin > Extensions and enter its settings on the Settings screen; with none installed, emails are logged and fail with "No email extension is installed". **Admin > Emails > Templates** previews and edits the emails kempo sends and any templates the site has added in `templates/emails/` (put a `<name>.sample.json` beside one to give its preview made-up values).
 
 The address emails are sent from is the **Email from** setting (`system:email_from`); until it is set, `EMAIL_FROM` from `.env` is used, and it must be on a domain your email service allows. A failed email is tried again (`email_max_retries`, 1 by default) and the log is kept for `email_retention_days` (30 by default; `email_retention_by_type` sets it per kind of email). See [docs/extensions/creating-extensions.md](docs/extensions/creating-extensions.md) to write an email extension.
 

package/app-public/account/index.page.html

@@ -36,6 +36,7 @@
 				<location name="account-links" label="Account Links" />
 				<button id="changePasswordBtn" class="btn">Change Password</button>
 				<k-logout-btn redirect="{{pathToRoot}}login" button-class="btn danger">Logout</k-logout-btn>
+				<a href="{{pathToRoot}}delete-account/" class="btn danger">Delete my account</a>
 			</div>
 		</div>
 	</main>

package/app-public/delete-account/index.page.html

@@ -0,0 +1,95 @@
+<!--
+  owner: system
+  title: Delete your account
+  description: Delete your account and the data this site keeps about you
+-->
+<page title="Delete your account">
+<content>
+	<main class="p">
+		<div style="max-width: 600px; margin: 0 auto;">
+			<h2>Delete your account</h2>
+
+			<div id="done" class="card mb" hidden>
+				<h4>Your account has been deleted</h4>
+				<p>Your name, email address, password and sign-in details are gone, and so is everything else this site kept about you. Thank you for having been here.</p>
+				<a href="{{pathToRoot}}">Back to the home page</a>
+			</div>
+
+			<div id="form">
+				<p>This removes your account and everything this site keeps about you: your name, your email address, your password, your sign-in links to other providers, and your sessions. Other parts of this site that keep information about you are told, so they remove theirs too. It cannot be undone.</p>
+				<p class="tc-muted">We send a six-digit code to the email address on your account. Entering it proves that you control that address before anything is deleted.</p>
+
+				<label class="d-b mbq" for="email">Email address on your account</label>
+				<input id="email" type="email" autocomplete="email" class="full mb" />
+				<button id="send" class="primary" type="button">Send me a code</button>
+
+				<div id="codeStep" hidden class="mt">
+					<label class="d-b mbq" for="code">Code<small class="d-b tc-muted">Six digits. It works for 30 minutes.</small></label>
+					<input id="code" type="text" inputmode="numeric" autocomplete="one-time-code" maxlength="6" class="full mb" />
+					<div class="d-f">
+						<button id="delete" class="danger mr" type="button" disabled>Delete my account</button>
+						<button id="resend" class="link" type="button">Send a new code</button>
+					</div>
+				</div>
+			</div>
+		</div>
+	</main>
+</content>
+<content location="scripts">
+<script type="module">
+	import Toast from '{{pathToRoot}}kempo-ui/components/Toast.js';
+
+	const email = document.getElementById('email');
+	const code = document.getElementById('code');
+	const send = document.getElementById('send');
+	const resend = document.getElementById('resend');
+	const remove = document.getElementById('delete');
+	const post = async (path, body) => {
+		const response = await fetch(`{{pathToRoot}}kempo/api/auth/account-deletion/${path}`, {
+			method: 'POST',
+			headers: { 'content-type': 'application/json' },
+			body: JSON.stringify(body)
+		});
+		return { ok: response.ok, body: await response.json().catch(() => ({})) };
+	};
+
+	const askForCode = async () => {
+		const result = await post('request', { email: email.value.trim() });
+		if(!result.ok){
+			Toast.error(result.body.error || 'The code could not be sent');
+			return;
+		}
+		document.getElementById('codeStep').hidden = false;
+		Toast.success('If an account uses that address, a code is on its way');
+		code.focus();
+	};
+
+	send.addEventListener('click', askForCode);
+	resend.addEventListener('click', askForCode);
+	code.addEventListener('input', () => {
+		code.value = code.value.replace(/\D/g, '');
+		remove.disabled = code.value.length !== 6;
+	});
+
+	remove.addEventListener('click', async () => {
+		remove.disabled = true;
+		const result = await post('confirm', { email: email.value.trim(), code: code.value });
+		if(!result.ok){
+			Toast.error(result.body.error || 'That did not work');
+			remove.disabled = code.value.length !== 6;
+			return;
+		}
+		document.getElementById('form').hidden = true;
+		document.getElementById('done').hidden = false;
+	});
+
+	try {
+		const response = await fetch('{{pathToRoot}}kempo/api/auth/session');
+		const data = await response.json();
+		if(data.user?.email) email.value = data.user.email;
+	} catch {
+		/* not signed in, or no session to read: the person types the address */
+	}
+</script>
+</content>
+</page>

package/app-templates/emails/account-deletion-code.page.html

@@ -0,0 +1,13 @@
+<!--
+	owner: system
+-->
+<page template="email" title="Your code to delete your account">
+<content>
+<h2>Delete your account</h2>
+<if condition="name"><p>Hi {{name}},</p></if>
+<if condition="!name"><p>Hello,</p></if>
+<p>Enter this code to delete your account. Deleting it removes your name, email address, password and everything else this site keeps about you.</p>
+<h1 class="ta-center mb">{{code}}</h1>
+<p class="tc-muted">The code works for {{minutes}} minutes and only once. If you did not ask for it, ignore this email: nothing will be deleted.</p>
+</content>
+</page>

package/dist/admin/emails/index.page.html

@@ -4,11 +4,24 @@
 <page title="Emails - Admin">
 <content>
 <script type="module" src="/admin/components/Emails.js"></script>
+<script type="module" src="/admin/components/EmailTemplates.js"></script>
+<script type="module" src="/kempo-ui/components/Tabs.js"></script>
 
 		<h1>Emails</h1>
-		<p class="tc-muted mb">Every email the site was asked to send, and what happened to it. Kempo does not send email itself: an email extension (such as kempo-resend or kempo-smtp) does. How long this log is kept, and how many times a failed email is tried again, are on the System tab of <a href="/admin/settings">Settings</a>.</p>
+		<p class="tc-muted mb">Kempo does not send email itself: an email extension (such as kempo-resend or kempo-smtp) does. How long the log is kept, and how many times a failed email is tried again, are on the System tab of <a href="/admin/settings">Settings</a>.</p>
 
-		<k-admin-emails></k-admin-emails>
+		<k-tabs persistent-id="admin-emails">
+			<k-tab for="log">Log</k-tab>
+			<k-tab for="templates">Templates</k-tab>
+			<k-tab-content name="log">
+				<p class="tc-muted mb">Every email the site was asked to send, and what happened to it.</p>
+				<k-admin-emails></k-admin-emails>
+			</k-tab-content>
+			<k-tab-content name="templates">
+				<p class="tc-muted mb">The emails this site sends: kempo's own and any the site has added. Preview draws one the way it would be sent, with made-up values when the template has a <code>.sample.json</code> beside it. Edit one to reword it; your copy is used from the next email on and Reset to default brings the packaged one back.</p>
+				<k-email-templates></k-email-templates>
+			</k-tab-content>
+		</k-tabs>
 
 </content>
 </page>

package/dist/kempo/api/auth/account-deletion/confirm/POST.js

@@ -0,0 +1,2 @@
+import{confirmAccountDeletion as o}from"../../../../../../server/utils/auth/accountDeletion.js";export default async(e,t)=>{const[r,s]=await o({email:e.body?.email,code:e.body?.code});if(r)return t.status(r.code).json({error:r.msg});t.json(s)};
+//# sourceMappingURL=C:\Users\dusti\dev\kempo\dist\kempo\api\auth\account-deletion\confirm\POST.js.map

package/dist/kempo/api/auth/account-deletion/confirm/POST.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"src\\kempo\\api\\auth\\account-deletion\\confirm\\POST.js","names":["confirmAccountDeletion","async","request","response","error","result","email","body","code","status","json","msg"],"sources":["0"],"sourcesContent":["import { confirmAccountDeletion } from '../../../../../../server/utils/auth/accountDeletion.js';\n\n/* POST /kempo/api/auth/account-deletion/confirm  { email, code } — deletes the account when the code is right. */\nexport default async (request, response) => {\n  const [error, result] = await confirmAccountDeletion({ email: request.body?.email, code: request.body?.code });\n  if(error) return response.status(error.code).json({ error: error.msg });\n  response.json(result);\n};\n"],"mappings":"iCAASA,MAA8B,wEAGxBC,MAAOC,EAASC,KAC7B,MAAOC,EAAOC,SAAgBL,EAAuB,CAAEM,MAAOJ,EAAQK,MAAMD,MAAOE,KAAMN,EAAQK,MAAMC,OACvG,GAAGJ,EAAO,OAAOD,EAASM,OAAOL,EAAMI,MAAME,KAAK,CAAEN,MAAOA,EAAMO,MACjER,EAASO,KAAKL","ignoreList":[]}

package/dist/kempo/api/auth/account-deletion/request/POST.js

@@ -0,0 +1,2 @@
+import{requestAccountDeletion as t}from"../../../../../../server/utils/auth/accountDeletion.js";export default async(e,o)=>{const[r,s]=await t({email:e.body?.email});if(r)return o.status(r.code).json({error:r.msg});o.json(s)};
+//# sourceMappingURL=C:\Users\dusti\dev\kempo\dist\kempo\api\auth\account-deletion\request\POST.js.map

package/dist/kempo/api/auth/account-deletion/request/POST.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"src\\kempo\\api\\auth\\account-deletion\\request\\POST.js","names":["requestAccountDeletion","async","request","response","error","result","email","body","status","code","json","msg"],"sources":["0"],"sourcesContent":["import { requestAccountDeletion } from '../../../../../../server/utils/auth/accountDeletion.js';\n\n/* POST /kempo/api/auth/account-deletion/request  { email } — emails a code to the account, if there is one. */\nexport default async (request, response) => {\n  const [error, result] = await requestAccountDeletion({ email: request.body?.email });\n  if(error) return response.status(error.code).json({ error: error.msg });\n  response.json(result);\n};\n"],"mappings":"iCAASA,MAA8B,wEAGxBC,MAAOC,EAASC,KAC7B,MAAOC,EAAOC,SAAgBL,EAAuB,CAAEM,MAAOJ,EAAQK,MAAMD,QAC5E,GAAGF,EAAO,OAAOD,EAASK,OAAOJ,EAAMK,MAAMC,KAAK,CAAEN,MAAOA,EAAMO,MACjER,EAASO,KAAKL","ignoreList":[]}

package/dist/kempo/api/email-templates/preview/GET.js

@@ -1,2 +1,2 @@
-import s from"../../../../../server/utils/permissions/currentUserHasPermission.js";import e from"../../../../../server/utils/email/renderEmailTemplate.js";export default async(r,t)=>{const[o,i]=await s(r.cookies.session_token,"system:pages:read");if(o)return t.status(o.code).json({error:o.msg});if(!i)return t.status(403).json({error:"Insufficient permissions"});const[a,n]=await e({template:r.query.template,data:{}});if(a)return t.status(a.code).json({error:a.msg});t.type("html").send(n)};
+import e from"../../../../../server/utils/permissions/currentUserHasPermission.js";import s from"../../../../../server/utils/email/renderEmailTemplate.js";import r from"../../../../../server/utils/email/readEmailSample.js";export default async(t,a)=>{const[i,o]=await e(t.cookies.session_token,"system:pages:read");if(i)return a.status(i.code).json({error:i.msg});if(!o)return a.status(403).json({error:"Insufficient permissions"});const[m,n]=await s({template:t.query.template,data:await r({template:t.query.template})});if(m)return a.status(m.code).json({error:m.msg});a.type("html").send(n)};
 //# sourceMappingURL=C:\Users\dusti\dev\kempo\dist\kempo\api\email-templates\preview\GET.js.map

package/dist/kempo/api/email-templates/preview/GET.js.map

@@ -1 +1 @@
-{"version":3,"file":"src\\kempo\\api\\email-templates\\preview\\GET.js","names":["currentUserHasPermission","renderEmailTemplate","async","request","response","permError","hasPermission","cookies","session_token","status","code","json","error","msg","page","template","query","data","type","send"],"sources":["0"],"sourcesContent":["import currentUserHasPermission from '../../../../../server/utils/permissions/currentUserHasPermission.js';\nimport renderEmailTemplate from '../../../../../server/utils/email/renderEmailTemplate.js';\n\n/*\n  An email template drawn with no data, to open in a tab: what the site would send, with the parts that need data left blank. An\n  extension that can do better (real or sample data) serves its own preview and gives it to <k-email-templates> as `preview-url`.\n*/\nexport default async (request, response) => {\n\tconst [permError, hasPermission] = await currentUserHasPermission(request.cookies.session_token, 'system:pages:read');\n\tif(permError) return response.status(permError.code).json({ error: permError.msg });\n\tif(!hasPermission) return response.status(403).json({ error: 'Insufficient permissions' });\n\n\tconst [error, page] = await renderEmailTemplate({ template: request.query.template, data: {} });\n\tif(error) return response.status(error.code).json({ error: error.msg });\n\n\tresponse.type('html').send(page);\n};\n"],"mappings":"OAAOA,MAA8B,6EAC9BC,MAAyB,0EAMjBC,MAAOC,EAASC,KAC9B,MAAOC,EAAWC,SAAuBN,EAAyBG,EAAQI,QAAQC,cAAe,qBACjG,GAAGH,EAAW,OAAOD,EAASK,OAAOJ,EAAUK,MAAMC,KAAK,CAAEC,MAAOP,EAAUQ,MAC7E,IAAIP,EAAe,OAAOF,EAASK,OAAO,KAAKE,KAAK,CAAEC,MAAO,6BAE7D,MAAOA,EAAOE,SAAcb,EAAoB,CAAEc,SAAUZ,EAAQa,MAAMD,SAAUE,KAAM,CAAC,IAC3F,GAAGL,EAAO,OAAOR,EAASK,OAAOG,EAAMF,MAAMC,KAAK,CAAEC,MAAOA,EAAMC,MAEjET,EAASc,KAAK,QAAQC,KAAKL","ignoreList":[]}
+{"version":3,"file":"src\\kempo\\api\\email-templates\\preview\\GET.js","names":["currentUserHasPermission","renderEmailTemplate","readEmailSample","async","request","response","permError","hasPermission","cookies","session_token","status","code","json","error","msg","page","template","query","data","type","send"],"sources":["0"],"sourcesContent":["import currentUserHasPermission from '../../../../../server/utils/permissions/currentUserHasPermission.js';\r\nimport renderEmailTemplate from '../../../../../server/utils/email/renderEmailTemplate.js';\r\nimport readEmailSample from '../../../../../server/utils/email/readEmailSample.js';\r\n\r\n/*\r\n  An email template drawn to open in a tab: what the site would send. It is filled in with the template's `<name>.sample.json` when\r\n  it has one (made-up values, kept beside the template), and the parts that need data are left blank when it has none. An extension\r\n  that can do better (its own real data) serves its own preview and gives it to <k-email-templates> as `preview-url`.\r\n*/\r\nexport default async (request, response) => {\r\n\tconst [permError, hasPermission] = await currentUserHasPermission(request.cookies.session_token, 'system:pages:read');\r\n\tif(permError) return response.status(permError.code).json({ error: permError.msg });\r\n\tif(!hasPermission) return response.status(403).json({ error: 'Insufficient permissions' });\r\n\r\n\tconst [error, page] = await renderEmailTemplate({ template: request.query.template, data: await readEmailSample({ template: request.query.template }) });\r\n\tif(error) return response.status(error.code).json({ error: error.msg });\r\n\r\n\tresponse.type('html').send(page);\r\n};\r\n"],"mappings":"OAAOA,MAA8B,6EAC9BC,MAAyB,kEACzBC,MAAqB,sEAObC,MAAOC,EAASC,KAC9B,MAAOC,EAAWC,SAAuBP,EAAyBI,EAAQI,QAAQC,cAAe,qBACjG,GAAGH,EAAW,OAAOD,EAASK,OAAOJ,EAAUK,MAAMC,KAAK,CAAEC,MAAOP,EAAUQ,MAC7E,IAAIP,EAAe,OAAOF,EAASK,OAAO,KAAKE,KAAK,CAAEC,MAAO,6BAE7D,MAAOA,EAAOE,SAAcd,EAAoB,CAAEe,SAAUZ,EAAQa,MAAMD,SAAUE,WAAYhB,EAAgB,CAAEc,SAAUZ,EAAQa,MAAMD,aAC1I,GAAGH,EAAO,OAAOR,EAASK,OAAOG,EAAMF,MAAMC,KAAK,CAAEC,MAAOA,EAAMC,MAEjET,EAASc,KAAK,QAAQC,KAAKL","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo",
-  "version": "4.9.4",
+  "version": "4.9.5",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {

package/server/db/schema.js

@@ -33,6 +33,7 @@ export const verificationToken = pgTable('verificationToken', {
     .references(() => user.id),
   type: text('type').notNull(),
   expiresAt: timestamp('expiresAt').notNull(),
+  attempts: integer('attempts').notNull().default(0),
   createdAt: timestamp('createdAt').notNull(),
 });
 

package/server/utils/auth/accountDeletion.js

@@ -0,0 +1,120 @@
+import crypto from 'crypto';
+import { and, count, eq, gt, sql } from 'drizzle-orm';
+import db from '../../db/index.js';
+import { user, userGroup, verificationToken } from '../../db/schema.js';
+import sendEmailFromTemplate from '../email/sendEmailFromTemplate.js';
+import deleteUser from '../users/deleteUser.js';
+
+/*
+  A person deletes their own account. No login is needed: they give the email address on the account,
+  and a six-digit code is sent there. Typing the code back proves they control that mailbox, and only then
+  is the account deleted. Someone who does not hold the mailbox can request codes for it but cannot use them.
+
+  Nothing in the answer tells a stranger whether an account exists for an address: the same reply comes back
+  either way, and the email is sent only when there is an account to delete.
+*/
+
+const CODE_MINUTES = 30;
+const MAX_ATTEMPTS = 5;
+const COOLDOWN_MS = 60 * 1000;
+const TYPE = 'account_deletion';
+const EMAIL_PATTERN = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+
+const tokenFor = (userId, code) => `${TYPE}:${crypto.createHash('sha256').update(`${userId}:${code}`).digest('hex')}`;
+
+const normalised = email => String(email ?? '').trim().toLowerCase();
+
+const accountFor = async email => {
+  const [found] = await db.select({ id: user.id, email: user.email, name: user.name })
+    .from(user)
+    .where(sql`lower(${user.email}) = ${email}`)
+    .limit(1);
+  return found ?? null;
+};
+
+/*
+  Sends a code to the account for `email`, if there is one. Always answers the same way.
+*/
+export const requestAccountDeletion = async ({ email, now = new Date() }) => {
+  const address = normalised(email);
+  if(!EMAIL_PATTERN.test(address)){
+    return [{ code: 400, msg: 'Enter the email address on your account' }, null];
+  }
+
+  const found = await accountFor(address);
+  if(!found) return [null, { sent: true }];
+
+  const [recent] = await db.select({ createdAt: verificationToken.createdAt }).from(verificationToken)
+    .where(and(eq(verificationToken.userId, found.id), eq(verificationToken.type, TYPE)))
+    .limit(1);
+  if(recent && now - recent.createdAt < COOLDOWN_MS) return [null, { sent: true }];
+
+  await db.delete(verificationToken).where(and(eq(verificationToken.userId, found.id), eq(verificationToken.type, TYPE)));
+
+  const code = String(crypto.randomInt(0, 1000000)).padStart(6, '0');
+  await db.insert(verificationToken).values({
+    token: tokenFor(found.id, code),
+    userId: found.id,
+    type: TYPE,
+    expiresAt: new Date(now.getTime() + CODE_MINUTES * 60 * 1000),
+    attempts: 0,
+    createdAt: now,
+  });
+
+  const [mailError] = await sendEmailFromTemplate({
+    to: found.email,
+    subject: 'Your code to delete your account',
+    template: 'account-deletion-code',
+    data: { name: found.name || '', code, minutes: CODE_MINUTES },
+  });
+  // Saved in the email log and sent when a sender is ready, so that still counts as sent.
+  if(mailError && !mailError.emailId){
+    await db.delete(verificationToken).where(eq(verificationToken.token, tokenFor(found.id, code)));
+    return [{ code: 502, msg: 'The email could not be sent right now. Try again in a minute' }, null];
+  }
+
+  return [null, { sent: true }];
+};
+
+/*
+  Checks the code and, if it is right, deletes the account. A wrong code counts as an attempt; after
+  MAX_ATTEMPTS the code is dead and a new one has to be asked for.
+*/
+export const confirmAccountDeletion = async ({ email, code, now = new Date() }) => {
+  const address = normalised(email);
+  const given = String(code ?? '').replace(/\s/g, '');
+  const wrong = [{ code: 400, msg: 'That code is not right' }, null];
+
+  const found = await accountFor(address);
+  if(!found || !/^\d{6}$/.test(given)) return wrong;
+
+  const [row] = await db.select().from(verificationToken)
+    .where(and(eq(verificationToken.userId, found.id), eq(verificationToken.type, TYPE)))
+    .limit(1);
+  if(!row) return [{ code: 400, msg: 'No code has been sent for this account. Ask for a new one' }, null];
+  if(row.expiresAt < now) return [{ code: 400, msg: 'That code has expired. Ask for a new one' }, null];
+  if(row.attempts >= MAX_ATTEMPTS) return [{ code: 429, msg: 'Too many wrong tries. Ask for a new code' }, null];
+
+  if(row.token !== tokenFor(found.id, given)){
+    await db.update(verificationToken).set({ attempts: row.attempts + 1 }).where(eq(verificationToken.token, row.token));
+    return wrong;
+  }
+
+  /*
+    The last administrator cannot delete themselves: the site would be left with nobody who can run it.
+  */
+  const [admin] = await db.select({ userId: userGroup.userId }).from(userGroup)
+    .where(eq(userGroup.groupName, 'system:Administrators'))
+    .limit(1);
+  if(admin?.userId === found.id){
+    const [{ total }] = await db.select({ total: count() }).from(userGroup).where(eq(userGroup.groupName, 'system:Administrators'));
+    if(Number(total) <= 1){
+      return [{ code: 409, msg: 'You are the only administrator, so this account cannot be deleted. Make someone else an administrator first' }, null];
+    }
+  }
+
+  const [deleteError] = await deleteUser(found.id);
+  if(deleteError) return [deleteError, null];
+
+  return [null, { deleted: true }];
+};

package/server/utils/email/readEmailSample.js

@@ -0,0 +1,23 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { defaultEmailsDir, locateTemplate, siteEmailsDir } from './emailTemplatePaths.js';
+
+/*
+  The made-up values a template is previewed with: `<name>.sample.json` beside the template, in the site's
+  `templates/emails` (which wins) or the packaged one. A template with none, or one whose file is not a JSON
+  object, previews with no data, which is what it did before. Always resolves to an object.
+*/
+export default async ({ template } = {}) => {
+  const located = locateTemplate(template);
+  if(!located) return {};
+
+  for(const dir of [siteEmailsDir(located.owner), defaultEmailsDir(located.owner)]){
+    try {
+      const sample = JSON.parse(await readFile(join(dir, `${located.name}.sample.json`), 'utf8'));
+      if(sample && typeof sample === 'object' && !Array.isArray(sample)) return sample;
+    } catch {
+      /* no file here, or not JSON: try the next place */
+    }
+  }
+  return {};
+};

package/server/utils/users/deleteUser.js

@@ -1,19 +1,37 @@
 import db from '../../db/index.js';
 import { user, session, verificationToken, userGroup } from '../../db/schema.js';
 import { eq } from 'drizzle-orm';
+import triggerHook from '../hooks/triggerHook.js';
 
+/*
+  Deletes a user and everything kempo keeps for them: their sessions, codes, group memberships and the
+  account itself. Then fires `user:deleted` with `{ id, email, name }` so every extension can remove what it
+  keeps about that person. Those extensions own their own data; kempo only tells them.
+
+  The hook runs after the user has gone, and a handler that fails does not undo the deletion: the
+  notification contract keeps going and records the failure.
+*/
 export default async (id) => {
   if(!id){
     return [{ code: 400, msg: 'User ID is required' }, null];
   }
-  
+
+  let removed = null;
   try {
+    const [existing] = await db.select({ id: user.id, email: user.email, name: user.name }).from(user).where(eq(user.id, id)).limit(1);
+    removed = existing ?? null;
+
     await db.delete(session).where(eq(session.userId, id));
     await db.delete(verificationToken).where(eq(verificationToken.userId, id));
     await db.delete(userGroup).where(eq(userGroup.userId, id));
     await db.delete(user).where(eq(user.id, id));
-    return [null, { id }];
   } catch(error){
     return [{ code: 500, msg: 'Failed to delete user' }, null];
   }
+
+  if(removed){
+    await triggerHook('user:deleted', { id: removed.id, email: removed.email, name: removed.name });
+  }
+
+  return [null, { id }];
 };