diff --git a/app/core/core_endpoints/endpoints_core.py b/app/core/core_endpoints/endpoints_core.py index cdc8db19fc..219610abc2 100644 --- a/app/core/core_endpoints/endpoints_core.py +++ b/app/core/core_endpoints/endpoints_core.py @@ -1,6 +1,6 @@ from anyio import Path from fastapi import APIRouter, Depends, Request -from fastapi.responses import FileResponse +from fastapi.responses import FileResponse, HTMLResponse from app.core.core_endpoints import schemas_core from app.core.utils.config import Settings @@ -145,15 +145,16 @@ async def read_robots_txt(settings: Settings = Depends(get_settings)): @router.get( "/account-deletion", + response_class=HTMLResponse, status_code=200, ) async def read_account_deletion(settings: Settings = Depends(get_settings)): """ - Return Hyperion account deletion information + Return Hyperion account deletion page """ return patch_identity_in_text( - await Path("assets/account-deletion.md").read_text(encoding="utf-8"), + await Path("assets/account-deletion.html").read_text(encoding="utf-8"), settings, ) diff --git a/app/core/users/endpoints_users.py b/app/core/users/endpoints_users.py index 3d86bf132d..c4cc944061 100644 --- a/app/core/users/endpoints_users.py +++ b/app/core/users/endpoints_users.py @@ -965,11 +965,41 @@ async def read_user( # await cruds_users.delete_user(db=db, user_id=user_id) +@router.post( + "/users/ask-deletion", + response_model=standard_responses.Result, + status_code=201, +) +async def ask_deletion_by_email( + email: str = Body(..., embed=True), + db: AsyncSession = Depends(get_db), +): + """ + Ask administrators to process the deletion of the account linked to the provided email. + + This endpoint does not require authentication and always returns the same response, + whether the account exists or not. + + This manual verification is needed to prevent data from being deleted for other users. + """ + db_user = await cruds_users.get_user_by_email(db=db, email=email) + if db_user is None: + hyperion_security_logger.info( + f"Account deletion requested for {email}, user does not exist", + ) + else: + hyperion_security_logger.info( + f"User {db_user.email} - {db_user.id} has requested to delete their account.", + ) + + return standard_responses.Result() + + @router.post( "/users/me/ask-deletion", status_code=204, ) -async def delete_user( +async def ask_deletion_current_user( user: models_users.CoreUser = Depends(is_user()), ): """ diff --git a/assets/account-deletion.html b/assets/account-deletion.html new file mode 100644 index 0000000000..7f50c24b6d --- /dev/null +++ b/assets/account-deletion.html @@ -0,0 +1,177 @@ + + + + + + Delete your {application_name} account + + + +
+

Delete your {application_name} account

+ +

+ Submit your account email below to request deletion. An administrator + will review and process your request manually. +

+ +

You can also request deletion from the application:

+
    +
  1. Go to settings
    2. +
  2. Press the Account deletion button
    3. +
  3. Confirm
    4. +
+ +
+ + + +
+ + +
+ + + +