nolo-cli 0.1.26 → 0.1.29

package/auth/server/delete.ts

@@ -0,0 +1,887 @@
+// 文件: auth/deleteUser.ts
+
+import serverDb from "../../database/server/db";
+import { authRoutes } from "../routes";
+import { NOLO_CLUSTER_SERVERS } from "../../database/config";
+
+import {
+  DB_PREFIX,
+  SEPARATOR,
+  createKey,
+  createUserKey,
+  createUserPreferenceKey,
+  createTokenKey,
+  createTokenStatsKey,
+  createTransactionKey,
+  createFavoriteKey,
+  createDialogKey,
+  createPageKey,
+  createCybotKey,
+  createAgentKey,
+  jobKey,
+  fileKey,
+  getFileIdFromKey,
+  fileIdIndexKey,
+  fileStatKey,
+  rowKey,
+  idxKey,
+  metaKey,
+  viewKey,
+  shareKey,
+} from "../../database/keys";
+import { createSpaceKey } from "../../create/space/spaceKeys";
+import { DataType } from "../../create/types";
+
+import {
+  createErrorResponse,
+  createSuccessResponse,
+  handleOptionsRequest,
+  checkAdminPermission,
+} from "./shared";
+
+/* --------------------------------------------------------------------------
+ * 分段删除：尽量只删除「完全属于该用户」的数据
+ *
+ * 删号覆盖的 key family 清单：
+ * - user:{userId}
+ * - {userId}-profile / {userId}-settings / user-pref-{userId}-*
+ * - dialog-{userId}-* / dialog-{dialogId}-msg-*
+ * - token-{userId}-* / token-stats-day-user-{userId}-*
+ * - tx-{userId}-* / 对应 tx-index-*
+ * - fav-agent-* / fav-page-* 中该用户自己的关系与反向索引
+ * - cybot-{userId}-* / agent-{userId}-* / page-{userId}-*
+ * - meta/row/idx/view 中 tenant={userId} 的全部表数据
+ * - job-{userId}-*
+ * - file-{userId}-* / file-id-* / file-stat-tenant-{userId}-*
+ * - share 主记录及索引（author/owner 为该用户）
+ * - email:* 与 security:* 中能确定归属该用户/该邮箱的记录
+ * - app-code/app-script/app-domain/domain-host/app-route 中属于该用户的记录
+ * - space-member-{userId}-{spaceId} / space-setting-{userId}-{spaceId}
+ * - space-{spaceId}:
+ *   - 若删除用户后无存活成员，则删整个空间
+ *   - 若还有其他成员，则移除该用户、必要时转 owner、并裁掉该用户内容引用
+ *
+ * 新增用户级数据时，优先把对应 key family 加到这里，再决定是否接入删号链路。
+ * ------------------------------------------------------------------------*/
+
+async function deleteDialogsAndMessages(db: any, userId: string, batch: any) {
+  // 对话主记录：DIALOG-{userId}-{dialogId}
+  const dialogRange = createDialogKey.rangeOfUser(userId);
+
+  for await (const [rawKey] of db.iterator({
+    gte: dialogRange.start,
+    lte: dialogRange.end,
+  })) {
+    const dialogKey = String(rawKey);
+    const parts = dialogKey.split(SEPARATOR);
+
+    // 预期结构: [DIALOG, userId, dialogId]
+    const dialogId = parts[2];
+    if (!dialogId) {
+      // 结构不符合预期，直接删主记录，防止残留
+      batch.del(dialogKey);
+      continue;
+    }
+
+    // 消息记录：DIALOG-{dialogId}-msg-{messageId}
+    const msgRange = {
+      gte: createKey(DataType.DIALOG, dialogId, "msg"),
+      lte: createKey(DataType.DIALOG, dialogId, "msg", "\xFF"),
+    };
+
+    for await (const [msgKey] of db.iterator(msgRange)) {
+      batch.del(String(msgKey));
+    }
+
+    // 删 dialog 主记录
+    batch.del(dialogKey);
+  }
+}
+
+async function deleteTokenData(db: any, userId: string, batch: any) {
+  const deleteRange = async (range: { start: string; end: string }) => {
+    for await (const [key] of db.iterator({
+      gte: range.start,
+      lte: range.end,
+    })) {
+      batch.del(String(key));
+    }
+  };
+
+  // Token 统计：token-stats-day-user-{userId}-{dateKey}
+  await deleteRange(createTokenStatsKey.rangeOfUser(userId));
+
+  // Token 明细：token-{userId}-{timestamp}
+  await deleteRange(createTokenKey.rangeOfUser(userId));
+}
+
+async function deleteUserProfileSettingsAndPreferences(
+  db: any,
+  userId: string,
+  batch: any
+) {
+  // {userId}-profile / {userId}-settings
+  batch.del(createUserKey.profile(userId));
+  batch.del(createUserKey.settings(userId));
+
+  const preferenceRange = createUserPreferenceKey.rangeOfUser(userId);
+  for await (const [key] of db.iterator({
+    gte: preferenceRange.start,
+    lte: preferenceRange.end,
+  })) {
+    batch.del(String(key));
+  }
+}
+
+async function deleteTransactions(db: any, userId: string, batch: any) {
+  // 交易主记录：tx-{userId}-{txId}
+  const txRange = createTransactionKey.range(userId);
+
+  for await (const [rawKey] of db.iterator({
+    gte: txRange.start,
+    lte: txRange.end,
+  })) {
+    const txKey = String(rawKey);
+    const parts = txKey.split(SEPARATOR);
+    const txId = parts[2];
+
+    // 删主记录
+    batch.del(txKey);
+
+    // 同时删掉对应索引：tx-index-{txId}
+    if (txId) {
+      const indexKey = createKey("tx", "index", txId);
+      batch.del(indexKey);
+    }
+  }
+}
+
+async function deleteFavorites(db: any, userId: string, batch: any) {
+  // 1) Agent 收藏（按 key 存）: fav-agent-key-{userId}-{agentKey}
+  const agentKeyRange = createFavoriteKey.agentKeyRangeOfUser(userId);
+  for await (const [key] of db.iterator({ gte: agentKeyRange.start, lte: agentKeyRange.end })) {
+    const keyStr = String(key);
+    batch.del(keyStr);
+    // 同时删除反查记录，这里的 id 获取逻辑交由 keys.ts 统一处理
+    const targetId = createFavoriteKey.getIdentifierFromKey(keyStr);
+    if (targetId) batch.del(createFavoriteKey.agentByKeyReverse(targetId, userId));
+  }
+
+  // 2) Agent 收藏（按 id 存，预留）
+  const agentIdRange = createFavoriteKey.agentIdRangeOfUser(userId);
+  for await (const [key] of db.iterator({ gte: agentIdRange.start, lte: agentIdRange.end })) {
+    const keyStr = String(key);
+    batch.del(keyStr);
+    const targetId = createFavoriteKey.getIdentifierFromKey(keyStr);
+    if (targetId) batch.del(createFavoriteKey.agentByIdReverse(targetId, userId));
+  }
+
+  // 3) Page 收藏（按 key 存）
+  const pageKeyRange = createFavoriteKey.pageKeyRangeOfUser(userId);
+  for await (const [key] of db.iterator({ gte: pageKeyRange.start, lte: pageKeyRange.end })) {
+    const keyStr = String(key);
+    batch.del(keyStr);
+    const targetId = createFavoriteKey.getIdentifierFromKey(keyStr);
+    if (targetId) batch.del(createFavoriteKey.pageByKeyReverse(targetId, userId));
+  }
+
+  // 4) Page 收藏（按 id 存，预留）
+  const pageIdRange = createFavoriteKey.pageIdRangeOfUser(userId);
+  for await (const [key] of db.iterator({ gte: pageIdRange.start, lte: pageIdRange.end })) {
+    const keyStr = String(key);
+    batch.del(keyStr);
+    const targetId = createFavoriteKey.getIdentifierFromKey(keyStr);
+    if (targetId) batch.del(createFavoriteKey.pageByIdReverse(targetId, userId));
+  }
+
+  // 说明：收藏统计（fav-agent-count-*/fav-page-count-*）是跨用户的聚合数据，
+  // 不在这里直接修改，避免影响其他用户；如需一致性，可在后台做离线重建。
+}
+
+async function deleteCybotAndPages(db: any, userId: string, batch: any) {
+  const deleteRange = async (range: { start: string; end: string }) => {
+    for await (const [key] of db.iterator({
+      gte: range.start,
+      lte: range.end,
+    })) {
+      batch.del(String(key));
+    }
+  };
+
+  // 私有 Agent (旧版)：CYBOT-{userId}-{cybotId}
+  await deleteRange(createCybotKey.rangeOfUser(userId));
+
+  // 私有 Agent (新版)：AGENT-{userId}-{agentId}
+  await deleteRange(createAgentKey.rangeOfUser(userId));
+
+  // Page：PAGE-{userId}-{pageId}
+  await deleteRange(createPageKey.rangeOfUser(userId));
+}
+
+async function deleteJobs(db: any, userId: string, batch: any) {
+  const range = jobKey.rangeOfTenant(userId);
+  for await (const [key] of db.iterator({
+    gte: range.start,
+    lte: range.end,
+  })) {
+    batch.del(String(key));
+  }
+}
+
+async function deleteFiles(db: any, userId: string, batch: any) {
+  /**
+   * 注意：在此逻辑中，我们仅删除用户的“文件引用元数据”(File Metadata)，
+   * 即 file-{userId}-{fileId} 及其全局 ID 索引。
+   * 
+   * 文件的实际内容 (Blob) 是由多用户共享的（内容寻址），
+   * 即使本用户的引用被删除，只要其他用户还在引用该 Blob (refCount > 0)，内容就不会被物理删除。
+   * 物理内容的清理由专门的垃圾回收任务处理。
+   */
+
+  // 1) 删租户文件引用：file-{userId}-{fileId}
+  const fileRange = fileKey.rangeOfTenant(userId);
+  for await (const [key] of db.iterator({
+    gte: fileRange.start,
+    lte: fileRange.end,
+  })) {
+    const keyStr = String(key);
+    batch.del(keyStr);
+
+    // 删反查索引：file-id-{fileId}
+    const fileId = getFileIdFromKey(keyStr);
+    if (fileId) {
+      batch.del(fileIdIndexKey(fileId));
+    }
+  }
+
+  // 2) 删文件统计：file-stat-tenant-{userId}-{dateKey}
+  const statPrefix = createKey("file", "stat", "tenant", userId);
+  for await (const [key] of db.iterator({
+    gte: statPrefix,
+    lte: statPrefix + SEPARATOR + "\uffff",
+  })) {
+    batch.del(String(key));
+  }
+}
+
+const EMAIL_DELIVERY_RECORD_PREFIX = "email:delivery:record:";
+const EMAIL_DELIVERY_RETRY_PREFIX = "email:delivery:retry:";
+const EMAIL_DELIVERY_IDEMPOTENCY_PREFIX = "email:delivery:idempotency:";
+const EMAIL_DELIVERY_MARKETING_SEGMENT_MEMBERS_PREFIX =
+  "email:delivery:marketing:segment-members:";
+const EMAIL_INVITE_REWARD_STATE_PREFIX = "email:invite-reward:state:";
+const SECURITY_LOGIN_FAIL_COUNT_PREFIX = "security:login-fail-count:";
+const SECURITY_LOGIN_FAIL_ALERT_PREFIX = "security:login-fail-alert:";
+
+interface DeleteUserContext {
+  authHeader?: string | null;
+  userLookupServers?: string[];
+}
+
+const normalizeUserId = (value: unknown): string => {
+  const text = String(value || "").trim();
+  return text.startsWith("user:") ? text.slice(5) : text;
+};
+
+const normalizeEmail = (value: unknown): string =>
+  String(value || "").trim().toLowerCase();
+
+const getUserLookupServersFromRequest = (req: Request): string[] => {
+  let requestOrigin = "";
+
+  try {
+    requestOrigin = new URL(req.url).origin;
+  } catch {
+    requestOrigin = "";
+  }
+
+  return Array.from(
+    new Set(
+      [requestOrigin, ...NOLO_CLUSTER_SERVERS]
+        .map((server) => String(server || "").trim().replace(/\/+$/, ""))
+        .filter(Boolean)
+    )
+  );
+};
+
+const isOwnedContentKey = (contentKey: string, userId: string): boolean => {
+  const prefixes = [
+    `${DataType.DIALOG}-${userId}-`,
+    `${DataType.DOC}-${userId}-`,
+    `${DataType.AGENT}-${userId}-`,
+    `${DataType.CYBOT}-${userId}-`,
+    `${DataType.FILE}-${userId}-`,
+    `${DataType.IMAGE}-${userId}-`,
+    `meta-${userId}-`,
+    `row-${userId}-`,
+    `idx-${userId}-`,
+    `view-${userId}-`,
+    `job-${userId}-`,
+    `app-${userId}-`,
+  ];
+
+  return prefixes.some((prefix) => contentKey.startsWith(prefix));
+};
+
+const pruneDeletedUserSpaceContents = (spaceData: any, userId: string) => {
+  const contents = spaceData?.contents;
+  if (!contents || typeof contents !== "object") {
+    return { contents, changed: false };
+  }
+
+  let changed = false;
+  const nextContents: Record<string, any> = {};
+
+  for (const [entryKey, entryValue] of Object.entries(contents)) {
+    if (!entryValue || typeof entryValue !== "object") {
+      nextContents[entryKey] = entryValue;
+      continue;
+    }
+
+    const contentKey = String((entryValue as any)?.contentKey || entryKey || "");
+    if (contentKey && isOwnedContentKey(contentKey, userId)) {
+      changed = true;
+      continue;
+    }
+
+    nextContents[entryKey] = entryValue;
+  }
+
+  return {
+    contents: changed ? nextContents : contents,
+    changed,
+  };
+};
+
+const fetchUserFromServer = async (
+  server: string,
+  userId: string,
+  authHeader?: string | null
+): Promise<"exists" | "missing" | "unknown"> => {
+  const path = authRoutes.users.detail.createPath({ userId });
+
+  try {
+    const response = await fetch(`${server}${path}`, {
+      method: authRoutes.users.detail.method,
+      headers: {
+        ...(authHeader ? { Authorization: authHeader } : {}),
+      },
+    });
+
+    if (response.status === 404) return "missing";
+    if (response.ok) return "exists";
+    return "unknown";
+  } catch {
+    return "unknown";
+  }
+};
+
+async function userExistsAcrossServers(
+  db: any,
+  userId: string,
+  cache: Map<string, boolean>,
+  context?: DeleteUserContext
+): Promise<boolean> {
+  if (cache.has(userId)) {
+    return cache.get(userId)!;
+  }
+
+  const localUser = await db.get(`${DB_PREFIX.USER}${userId}`).catch(() => null);
+  if (localUser) {
+    cache.set(userId, true);
+    return true;
+  }
+
+  const servers = context?.userLookupServers ?? [];
+  if (!servers.length || !context?.authHeader) {
+    // 没有跨服务器校验上下文时，保守处理为“存在/未知”，避免误删其他成员的数据。
+    cache.set(userId, true);
+    return true;
+  }
+
+  const results = await Promise.all(
+    servers.map((server) => fetchUserFromServer(server, userId, context.authHeader))
+  );
+
+  if (results.includes("exists")) {
+    cache.set(userId, true);
+    return true;
+  }
+
+  if (results.includes("unknown")) {
+    cache.set(userId, true);
+    return true;
+  }
+
+  cache.set(userId, false);
+  return false;
+}
+
+async function deleteUserSpaces(
+  db: any,
+  userId: string,
+  batch: any,
+  context?: DeleteUserContext
+) {
+  const membershipRange = createSpaceKey.memberRange(userId);
+  const userExistsCache = new Map<string, boolean>();
+  const processedSpaceIds = new Set<string>();
+
+  for await (const [rawKey] of db.iterator({
+    gte: membershipRange.start,
+    lte: membershipRange.end,
+  })) {
+    const membershipKey = String(rawKey);
+    const spaceId = createSpaceKey.spaceIdFromMember(membershipKey);
+
+    batch.del(membershipKey);
+    batch.del(createSpaceKey.setting(userId, spaceId));
+
+    if (!spaceId || processedSpaceIds.has(spaceId)) {
+      continue;
+    }
+
+    processedSpaceIds.add(spaceId);
+
+    const spaceKey = createSpaceKey.space(spaceId);
+    const spaceData = await db.get(spaceKey).catch(() => null);
+
+    if (!spaceData) {
+      continue;
+    }
+
+    const rawMembers = Array.isArray(spaceData.members) ? spaceData.members : [];
+    const candidateMembers = Array.from(
+      new Set(
+        rawMembers
+          .map((memberId: unknown) => String(memberId || "").trim())
+          .filter(Boolean)
+      )
+    );
+
+    const survivingMembers: string[] = [];
+    const prunedMembers = new Set<string>();
+
+    for (const memberId of candidateMembers) {
+      if (memberId === userId) {
+        prunedMembers.add(memberId);
+        continue;
+      }
+
+      const exists = await userExistsAcrossServers(db, memberId, userExistsCache, context);
+      if (exists) {
+        survivingMembers.push(memberId);
+      } else {
+        prunedMembers.add(memberId);
+      }
+    }
+
+    for (const memberId of prunedMembers) {
+      batch.del(createSpaceKey.member(memberId, spaceId));
+      batch.del(createSpaceKey.setting(memberId, spaceId));
+    }
+
+    if (survivingMembers.length === 0) {
+      batch.del(spaceKey);
+      continue;
+    }
+
+    const nextOwnerId = survivingMembers.includes(spaceData.ownerId)
+      ? spaceData.ownerId
+      : survivingMembers[0];
+    // TODO(space): owner 选择策略后续细化为更稳定规则，例如优先 admin，再按 joinedAt。
+    const { contents, changed: contentsChanged } = pruneDeletedUserSpaceContents(
+      spaceData,
+      userId
+    );
+
+    batch.put(spaceKey, {
+      ...spaceData,
+      ownerId: nextOwnerId,
+      members: survivingMembers,
+      contents,
+      updatedAt: Date.now(),
+    });
+
+    for (const memberId of survivingMembers) {
+      const memberKey = createSpaceKey.member(memberId, spaceId);
+      const memberData = await db.get(memberKey).catch(() => null);
+      if (!memberData) {
+        continue;
+      }
+
+      const nextRole = memberId === nextOwnerId ? "owner" : memberData.role;
+      const needsUpdate =
+        memberData.ownerId !== nextOwnerId ||
+        memberData.role !== nextRole ||
+        memberData.spaceName !== spaceData.name ||
+        memberData.visibility !== spaceData.visibility ||
+        memberData.spaceUpdatedAt !== spaceData.updatedAt ||
+        contentsChanged;
+
+      if (!needsUpdate) {
+        continue;
+      }
+
+      batch.put(memberKey, {
+        ...memberData,
+        ownerId: nextOwnerId,
+        role: nextRole,
+        spaceName: spaceData.name,
+        visibility: spaceData.visibility,
+        spaceUpdatedAt: Date.now(),
+        updatedAt: new Date().toISOString(),
+      });
+    }
+  }
+
+  const spaceSettingRange = createSpaceKey.settingRange(userId);
+  for await (const [rawKey] of db.iterator({
+    gte: spaceSettingRange.start,
+    lte: spaceSettingRange.end,
+  })) {
+    batch.del(String(rawKey));
+  }
+}
+
+async function deleteShareData(db: any, userId: string, batch: any) {
+  const range = shareKey.ownerRange(userId);
+  if (!range.start) return;
+
+  const tokens = new Set<string>();
+  for await (const [rawKey] of db.iterator({
+    gte: range.start,
+    lte: range.end,
+  })) {
+    const ownerIndexKey = String(rawKey);
+    batch.del(ownerIndexKey);
+
+    const parts = ownerIndexKey.split(SEPARATOR);
+    const token = parts.slice(4).join(SEPARATOR);
+    if (token) tokens.add(token);
+  }
+
+  for (const token of tokens) {
+    const dbKey = shareKey.create(token);
+    const data = await db.get(dbKey).catch(() => null);
+    if (data) {
+      const indexKeys = shareKey.allIndexKeysFromShare(dbKey, data);
+      for (const indexKey of indexKeys) batch.del(indexKey);
+    }
+    batch.del(dbKey);
+  }
+}
+
+async function deleteEmailData(
+  db: any,
+  userId: string,
+  userEmail: string,
+  batch: any
+) {
+  const normalizedEmail = normalizeEmail(userEmail);
+
+  const deleteByValueMatch = async (
+    prefix: string,
+    matcher: (value: any) => boolean
+  ) => {
+    for await (const [rawKey, rawValue] of db.iterator({
+      gte: prefix,
+      lte: `${prefix}\xFF`,
+    })) {
+      if (matcher(rawValue)) {
+        batch.del(String(rawKey));
+      }
+    }
+  };
+
+  await deleteByValueMatch(
+    EMAIL_DELIVERY_RECORD_PREFIX,
+    (value) =>
+      normalizeUserId(value?.userId) === userId ||
+      (normalizedEmail && normalizeEmail(value?.to) === normalizedEmail)
+  );
+
+  await deleteByValueMatch(
+    EMAIL_DELIVERY_RETRY_PREFIX,
+    (value) =>
+      normalizeUserId(value?.payload?.userId) === userId ||
+      (normalizedEmail && normalizeEmail(value?.payload?.to) === normalizedEmail)
+  );
+
+  for await (const [rawKey] of db.iterator({
+    gte: EMAIL_DELIVERY_IDEMPOTENCY_PREFIX,
+    lte: `${EMAIL_DELIVERY_IDEMPOTENCY_PREFIX}\xFF`,
+  })) {
+    const key = String(rawKey);
+    if (
+      key.includes(`uid:${userId}:`) ||
+      (normalizedEmail && key.includes(`to:${normalizedEmail}:`))
+    ) {
+      batch.del(key);
+    }
+  }
+
+  for await (const [rawKey] of db.iterator({
+    gte: EMAIL_INVITE_REWARD_STATE_PREFIX,
+    lte: `${EMAIL_INVITE_REWARD_STATE_PREFIX}\xFF`,
+  })) {
+    const key = String(rawKey);
+    const suffix = key.slice(EMAIL_INVITE_REWARD_STATE_PREFIX.length);
+    const [inviterId, inviteeUserId] = suffix.split(":");
+    if (normalizeUserId(inviterId) === userId || normalizeUserId(inviteeUserId) === userId) {
+      batch.del(key);
+    }
+  }
+
+  if (!normalizedEmail) return;
+
+  for await (const [rawKey, rawValue] of db.iterator({
+    gte: EMAIL_DELIVERY_MARKETING_SEGMENT_MEMBERS_PREFIX,
+    lte: `${EMAIL_DELIVERY_MARKETING_SEGMENT_MEMBERS_PREFIX}\xFF`,
+  })) {
+    const key = String(rawKey);
+    const emails = Array.isArray(rawValue?.emails)
+      ? rawValue.emails.map((email: unknown) => normalizeEmail(email)).filter(Boolean)
+      : [];
+    if (emails.length === 0 || !emails.includes(normalizedEmail)) continue;
+
+    const nextEmails = Array.from(new Set(emails.filter((email: string) => email !== normalizedEmail)));
+    batch.put(key, {
+      ...rawValue,
+      emails: nextEmails,
+      updatedAt: Date.now(),
+    });
+  }
+}
+
+const matchesSecurityKeyUser = (key: string, prefix: string, userId: string) => {
+  if (!key.startsWith(prefix)) return false;
+  const suffix = key.slice(prefix.length);
+  const keyUserId = suffix.split(":")[0];
+  return normalizeUserId(keyUserId) === userId;
+};
+
+async function deleteSecurityLoginData(db: any, userId: string, batch: any) {
+  for await (const [rawKey] of db.iterator({
+    gte: SECURITY_LOGIN_FAIL_COUNT_PREFIX,
+    lte: `${SECURITY_LOGIN_FAIL_COUNT_PREFIX}\xFF`,
+  })) {
+    const key = String(rawKey);
+    if (matchesSecurityKeyUser(key, SECURITY_LOGIN_FAIL_COUNT_PREFIX, userId)) {
+      batch.del(key);
+    }
+  }
+
+  for await (const [rawKey] of db.iterator({
+    gte: SECURITY_LOGIN_FAIL_ALERT_PREFIX,
+    lte: `${SECURITY_LOGIN_FAIL_ALERT_PREFIX}\xFF`,
+  })) {
+    const key = String(rawKey);
+    if (matchesSecurityKeyUser(key, SECURITY_LOGIN_FAIL_ALERT_PREFIX, userId)) {
+      batch.del(key);
+    }
+  }
+}
+
+/**
+ * 删除用户作为 tenantId 时创建的所有表数据：
+ * - meta-{userId}-{tableId}
+ * - row-{userId}-{tableId}-{rowId}
+ * - idx-{userId}-{tableId}-{indexName}-{indexKey}-{rowId}
+ * - view-{userId}-{tableId}-{viewId}
+ */
+async function deleteUserTables(db: any, userId: string, batch: any) {
+  // 所有 meta-{userId}-* 的表定义
+  const metaRange = metaKey.rangeOfTenant(userId);
+
+  for await (const [rawMetaKey] of db.iterator({
+    gte: metaRange.start,
+    lte: metaRange.end,
+  })) {
+    const metaKeyStr = String(rawMetaKey);
+    const parts = metaKeyStr.split(SEPARATOR);
+    // 预期结构: [meta, tenantId, tableId]
+    const tenantId = parts[1];
+    const tableId = parts[2];
+
+    if (tenantId !== userId || !tableId) {
+      // 结构异常，直接删 meta 记录，避免残留
+      batch.del(metaKeyStr);
+      continue;
+    }
+
+    // 1) 删表行：row-{tenantId}-{tableId}-{rowId}
+    const rowRange = rowKey.range(tenantId, tableId);
+    for await (const [rawRowKey] of db.iterator({
+      gte: rowRange.gte,
+      lte: rowRange.lte,
+    })) {
+      batch.del(String(rawRowKey));
+    }
+
+    // 2) 删二级索引：idx-{tenantId}-{tableId}-{indexName}-{indexKey}-{rowId}
+    const indexRange = idxKey.prefix(tenantId, tableId);
+    for await (const [rawIdxKey] of db.iterator({
+      gte: indexRange.gte,
+      lte: indexRange.lte,
+    })) {
+      batch.del(String(rawIdxKey));
+    }
+
+    // 3) 删视图：view-{tenantId}-{tableId}-{viewId}
+    const viewRange = viewKey.rangeOfTable(tenantId, tableId);
+    for await (const [rawViewKey] of db.iterator({
+      gte: viewRange.start,
+      lte: viewRange.end,
+    })) {
+      batch.del(String(rawViewKey));
+    }
+
+    // 5) 删 meta 记录
+    batch.del(metaKeyStr);
+  }
+}
+
+/**
+ * 删除与用户强关联、且不与其他用户共享的数据：
+ * - Dialog + Messages
+ * - Token 明细 & 统计
+ * - User profile / settings
+ * - Transaction 记录 + 索引
+ * - Favorites（Agent / Page，按 key/id）
+ * - 私有 Cybot & Page
+ * - 以 userId 作为 tenantId 的所有表数据（meta / rows / idx / views / 
+ */
+/**
+ * 删除用户的所有 App 数据（app-code-*、app-script-*、app-route-*）。
+ * 这些 key 由 appSandboxHandler / appDeployHandler 写入，不在 auth 包的 batch 范围内，
+ * 故直接用字符串前缀扫描删除，无需跨包 import。
+ */
+async function deleteUserAppData(db: any, userId: string): Promise<void> {
+  const APP_CODE_PREFIX = "app-code-";
+  // Legacy cleanup only: app-script-* is no longer written by current deploy flows.
+  // Keep deleting these historical keys during account removal until a one-off sweep
+  // confirms the old index family can be dropped entirely.
+  const APP_SCRIPT_PREFIX = "app-script-";
+  const APP_DOMAIN_PREFIX = "app-domain-";
+  const DOMAIN_HOST_PREFIX = "domain-host-";
+  const APP_ROUTE_PREFIX = "app-route-";
+
+  for await (const [key, value] of db.iterator({
+    gte: APP_CODE_PREFIX,
+    lte: APP_CODE_PREFIX + "\xff",
+  })) {
+    const record = value as any;
+    if (record?.userId !== userId) continue;
+    const appId = (key as string).slice(APP_CODE_PREFIX.length);
+    const scriptName: string | undefined = record?.scriptName;
+
+    // 收集并清理该 app 的所有域名记录和反向索引（含 CF 远端）
+    const domainPrefix = `${APP_DOMAIN_PREFIX}${appId}-`;
+    for await (const [domainKey, domainValue] of db.iterator({
+      gte: domainPrefix,
+      lte: domainPrefix + "\xff",
+    })) {
+      const domainRecord = domainValue as any;
+
+      // 反向索引：只删指向当前 appId 的，防止误删
+      const hostKey = `${DOMAIN_HOST_PREFIX}${domainRecord?.hostname}`;
+      try {
+        const owner = await db.get(hostKey);
+        if (owner === appId) await db.del(hostKey).catch(() => {});
+      } catch {}
+      await db.del(domainKey).catch(() => {});
+    }
+
+    await Promise.all([
+      db.del(key).catch(() => {}),
+      scriptName ? db.del(`${APP_SCRIPT_PREFIX}${scriptName}`).catch(() => {}) : Promise.resolve(),
+      db.del(`${APP_ROUTE_PREFIX}${appId}`).catch(() => {}),
+    ]);
+  }
+}
+
+async function deleteUserRelatedData(
+  db: any,
+  userId: string,
+  context?: DeleteUserContext
+) {
+  const batch = db.batch();
+  const user = await db.get(`${DB_PREFIX.USER}${userId}`).catch(() => null);
+  const userEmail = normalizeEmail(user?.email);
+
+  try {
+    await deleteDialogsAndMessages(db, userId, batch);
+    await deleteTokenData(db, userId, batch);
+  await deleteUserProfileSettingsAndPreferences(db, userId, batch);
+    await deleteTransactions(db, userId, batch);
+    await deleteFavorites(db, userId, batch);
+    await deleteCybotAndPages(db, userId, batch);
+    await deleteUserTables(db, userId, batch);
+    await deleteUserSpaces(db, userId, batch, context);
+    await deleteJobs(db, userId, batch);
+    await deleteFiles(db, userId, batch);
+    await deleteShareData(db, userId, batch);
+    await deleteEmailData(db, userId, userEmail, batch);
+    await deleteSecurityLoginData(db, userId, batch);
+
+    await batch.write();
+    // app 数据用异步迭代器扫描，不适合放入 batch，在 batch.write() 之后单独清理
+    await deleteUserAppData(db, userId);
+  } catch (error) {
+    throw error;
+  }
+}
+
+export async function deleteUser(
+  db: any,
+  userId: string,
+  context?: DeleteUserContext
+) {
+  const userKey = `${DB_PREFIX.USER}${userId}`;
+  const exists = await db.get(userKey).catch(() => null);
+
+  if (!exists) {
+    throw new Error("User not found");
+  }
+
+  try {
+    await deleteUserRelatedData(db, userId, context);
+    await db.del(userKey);
+  } catch (error) {
+    throw error;
+  }
+}
+
+export async function handleDeleteUser(
+  req: Request,
+  userId: string,
+  db: any = serverDb
+) {
+  if (req.method === "OPTIONS") {
+    return handleOptionsRequest();
+  }
+
+  const { userId: actionUserId } = (req as any).user || {};
+
+  const permissionError =
+    actionUserId === userId ? null : checkAdminPermission(actionUserId);
+  if (permissionError) return permissionError;
+
+  try {
+    if (!userId) {
+      return createErrorResponse("User ID is required", 400);
+    }
+
+    await deleteUser(db, userId, {
+      authHeader: req.headers.get("authorization"),
+      userLookupServers: getUserLookupServersFromRequest(req),
+    });
+    return createSuccessResponse({ success: true });
+  } catch (error: any) {
+    if (error?.message === "User not found") {
+      return createErrorResponse("User not found", 404);
+    }
+    return createErrorResponse("Failed to delete user");
+  }
+}