Files
accounted/components/settings/AccountDangerZone.tsx
T
Mattsson a1a816b4a5 Delete features (#218)
* Implement company and account deletion features

- Add event types for company and account deletion to CoreEvent.
- Enhance Supabase middleware to handle company context resolution and cookie management for archived companies.
- Create API routes for deleting accounts and companies, including necessary validations and event emissions.
- Implement tests for account and company deletion endpoints to ensure proper functionality and error handling.
- Add retention notice component to inform users about bookkeeping data retention during destructive actions.
- Create database migrations to support soft deletion of companies and anonymization of user accounts, ensuring compliance with retention laws.

* feat: enhance account deletion process and update user notifications

* Add service client for onboarding completion check and update escape hatch visibility

* Enhance invite flow and email handling for company members

* Refactor company context and RLS policies for active company isolation

- Update `switchCompany` to remove unnecessary revalidation as client handles navigation.
- Revise `getActiveCompanyId` to prioritize `user_preferences` and validate against non-archived memberships.
- Modify `setActiveCompany` to ensure `user_preferences` is the authoritative source while maintaining cookie compatibility.
- Enhance middleware to resolve active company using `user_preferences` and fallback to first non-archived membership.
- Introduce new API route `/api/company/current` to fetch the active company ID for cross-tab synchronization.
- Implement `CompanyTabSync` component for real-time active company enforcement across tabs.
- Create migration for RLS policies to enforce single-active-company isolation using `current_active_company_id()`.

* feat: implement viewer role enforcement for write permissions

- Added `useCanWrite` hook to determine if the current user has write permissions based on their role in the active company.
- Updated various components (JournalEntryForm, CustomerForm, DeadlineForm, etc.) to disable write actions and show a lock icon with a tooltip for users without write permissions.
- Introduced `requireWritePermission` function to enforce write permissions at the API level, returning a 403 response for viewers.
- Created tests to verify the behavior of the viewer role and write permissions.
- Added database migration to enforce read-only access for viewers at the database level.
2026-04-11 17:06:32 +02:00

229 lines
7.0 KiB
TypeScript

'use client'
import { useState, useEffect } from 'react'
import { useRouter } from 'next/navigation'
import Link from 'next/link'
import { createClient } from '@/lib/supabase/client'
import { Button } from '@/components/ui/button'
import { Input } from '@/components/ui/input'
import { Label } from '@/components/ui/label'
import {
Dialog,
DialogContent,
DialogDescription,
DialogFooter,
DialogHeader,
DialogTitle,
} from '@/components/ui/dialog'
import { RetentionNotice } from '@/components/ui/retention-notice'
import { ExternalLink, Loader2 } from 'lucide-react'
import { SupportLink } from '@/components/ui/support-link'
interface Blocker {
id: string
name: string
}
export function AccountDangerZone() {
const router = useRouter()
const [email, setEmail] = useState<string | null>(null)
const [blockers, setBlockers] = useState<Blocker[]>([])
const [blockersLoading, setBlockersLoading] = useState(true)
const [showDialog, setShowDialog] = useState(false)
const [confirmText, setConfirmText] = useState('')
const [isDeleting, setIsDeleting] = useState(false)
const [error, setError] = useState<string | null>(null)
useEffect(() => {
let cancelled = false
async function load() {
const supabase = createClient()
const { data: { user } } = await supabase.auth.getUser()
if (!cancelled) setEmail(user?.email ?? null)
try {
const res = await fetch('/api/company?owned=true&archived=false')
if (res.ok) {
const body = await res.json()
if (!cancelled) setBlockers(body.data ?? [])
}
} finally {
if (!cancelled) setBlockersLoading(false)
}
}
load()
return () => {
cancelled = true
}
}, [])
async function handleDelete() {
if (!email) return
if (confirmText.trim().toLowerCase() !== email.toLowerCase()) return
setIsDeleting(true)
setError(null)
try {
const response = await fetch('/api/account/delete', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ confirm_email: email }),
})
if (response.status === 409) {
const body = await response.json()
// Precondition tripped mid-flow — refresh the list and show inline.
setBlockers(body.blockers ?? [])
setError(body.error || 'Du måste radera eller överlåta dina företag först.')
setIsDeleting(false)
setShowDialog(false)
return
}
if (!response.ok) {
const body = await response.json().catch(() => ({}))
throw new Error(body.error || 'Kunde inte radera kontot')
}
router.push('/login')
} catch (err) {
setError(err instanceof Error ? err.message : 'Kunde inte radera kontot')
setIsDeleting(false)
}
}
const hasBlockers = blockers.length > 0
const canDelete = !hasBlockers && !blockersLoading
return (
<>
<section className="space-y-4 border-t border-border/8 pt-8">
<h2 className="text-sm font-medium uppercase tracking-wider text-destructive/80">
Radera konto
</h2>
{hasBlockers && (
<div className="rounded-lg border border-border/60 bg-muted/30 p-4 space-y-3">
<p className="text-sm font-medium">Företag du äger</p>
<p className="text-sm text-muted-foreground">
Radera eller överlåt alla företag innan du raderar kontot.
</p>
<ul className="space-y-2">
{blockers.map((b) => (
<li
key={b.id}
className="flex items-center justify-between rounded-md border border-border/40 bg-background px-3 py-2"
>
<span className="text-sm font-medium">{b.name}</span>
<Button variant="ghost" size="sm" asChild>
<Link href="/settings/company">Hantera</Link>
</Button>
</li>
))}
</ul>
</div>
)}
<RetentionNotice variant="account" />
<p className="text-sm text-muted-foreground">
Har du frågor?{' '}
<SupportLink variant="inline" subject="Fråga om kontoradering" />
</p>
{error && !showDialog && (
<p className="text-sm text-destructive">{error}</p>
)}
<div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
<Button variant="outline" className="w-full sm:w-auto" asChild>
<Link href="/reports?type=sie">
<ExternalLink className="mr-2 h-4 w-4" />
Exportera bokföringsdata (SIE)
</Link>
</Button>
<Button
variant="destructive"
className="w-full sm:w-auto"
onClick={() => setShowDialog(true)}
disabled={!canDelete}
>
Radera mitt konto
</Button>
</div>
</section>
<Dialog
open={showDialog}
onOpenChange={(open) => {
if (isDeleting) return
setShowDialog(open)
if (!open) {
setConfirmText('')
setError(null)
}
}}
>
<DialogContent>
<DialogHeader>
<DialogTitle>Radera konto permanent</DialogTitle>
<DialogDescription>
Ditt konto avidentifieras och du loggas ut från alla enheter.
Du kan inte skapa ett nytt konto med samma e-postadress — kontakta support
om du vill återaktivera kontot i framtiden.
</DialogDescription>
</DialogHeader>
<div className="space-y-2">
<Label htmlFor="delete-confirm">
Skriv din e-postadress (<strong>{email}</strong>) för att bekräfta
</Label>
<Input
id="delete-confirm"
type="email"
value={confirmText}
onChange={(e) => setConfirmText(e.target.value)}
placeholder={email ?? ''}
autoComplete="off"
/>
{error && <p className="text-sm text-destructive">{error}</p>}
</div>
<DialogFooter>
<Button
variant="outline"
onClick={() => {
setShowDialog(false)
setConfirmText('')
setError(null)
}}
disabled={isDeleting}
>
Avbryt
</Button>
<Button
variant="destructive"
onClick={handleDelete}
disabled={
!email ||
confirmText.trim().toLowerCase() !== email.toLowerCase() ||
isDeleting
}
>
{isDeleting ? (
<>
<Loader2 className="mr-2 h-4 w-4 animate-spin" />
Raderar...
</>
) : (
'Radera konto'
)}
</Button>
</DialogFooter>
</DialogContent>
</Dialog>
</>
)
}