From d831b93934f8f5ffaa4985555d323721263403bc Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Sun, 5 Apr 2026 01:43:05 +0000 Subject: [PATCH 1/6] Allow deleting user account with active memberships Instead of blocking account deletion when the user has confirmed team memberships, handle memberships gracefully during deletion: - Sole owner + sole member: delete the team and queue project cleanup - Sole owner + other members: transfer ownership to the next member - Non-owner / multiple owners: no special handling needed (worker cleans up) Also update the Deletes worker to transfer the team's primary user reference when removing a deleted user's memberships. Co-Authored-By: Claude Opus 4.6 (1M context) --- app/controllers/api/account.php | 63 +++++++++++++-- src/Appwrite/Platform/Workers/Deletes.php | 16 +++- .../Account/AccountConsoleClientTest.php | 77 +++++++++++++------ 3 files changed, 126 insertions(+), 30 deletions(-) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index d576bbce44..6ac6373c87 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -614,18 +614,71 @@ Http::delete('/v1/account') ->inject('dbForProject') ->inject('queueForEvents') ->inject('queueForDeletes') - ->action(function (Document $user, Document $project, Response $response, Database $dbForProject, Event $queueForEvents, Delete $queueForDeletes) { + ->inject('authorization') + ->action(function (Document $user, Document $project, Response $response, Database $dbForProject, Event $queueForEvents, Delete $queueForDeletes, Authorization $authorization) { if ($user->isEmpty()) { throw new Exception(Exception::USER_NOT_FOUND); } if ($project->getId() === 'console') { - // get all memberships $memberships = $user->getAttribute('memberships', []); foreach ($memberships as $membership) { - // prevent deletion if at least one active membership - if ($membership->getAttribute('confirm', false)) { - throw new Exception(Exception::USER_DELETION_PROHIBITED); + if (!$membership->getAttribute('confirm', false)) { + continue; + } + + $team = $dbForProject->getDocument('teams', $membership->getAttribute('teamId')); + if ($team->isEmpty()) { + continue; + } + + $isSoleOwner = false; + if (in_array('owner', $membership->getAttribute('roles', []))) { + $ownersCount = $dbForProject->count( + collection: 'memberships', + queries: [ + Query::contains('roles', ['owner']), + Query::equal('teamInternalId', [$team->getSequence()]) + ], + max: 2 + ); + $isSoleOwner = ($ownersCount === 1); + } + + $totalMembers = $team->getAttribute('total', 0); + + if ($isSoleOwner && $totalMembers <= 1) { + // User is the only owner and the only member — delete the team. + // The team deletion worker will clean up associated projects and resources. + $dbForProject->deleteDocument('teams', $team->getId()); + + $queueForDeletes + ->setType(DELETE_TYPE_TEAM_PROJECTS) + ->setDocument($team) + ->trigger(); + + $queueForDeletes + ->setType(DELETE_TYPE_DOCUMENT) + ->setDocument($team) + ->trigger(); + } elseif ($isSoleOwner) { + // User is the sole owner but other members exist — transfer ownership + // to the next member before removing this user's membership. + $nextMember = $dbForProject->findOne('memberships', [ + Query::equal('teamInternalId', [$team->getSequence()]), + Query::notEqual('userInternalId', $user->getSequence()), + ]); + + if (!$nextMember->isEmpty()) { + $roles = $nextMember->getAttribute('roles', []); + if (!in_array('owner', $roles)) { + $roles[] = 'owner'; + $authorization->skip(fn () => $dbForProject->updateDocument('memberships', $nextMember->getId(), new Document([ + 'roles' => $roles, + ]))); + $dbForProject->purgeCachedDocument('users', $nextMember->getAttribute('userId')); + } + } } } } diff --git a/src/Appwrite/Platform/Workers/Deletes.php b/src/Appwrite/Platform/Workers/Deletes.php index c420444112..9508f784bd 100644 --- a/src/Appwrite/Platform/Workers/Deletes.php +++ b/src/Appwrite/Platform/Workers/Deletes.php @@ -845,12 +845,26 @@ class Deletes extends Action $this->deleteByGroup('memberships', [ Query::equal('userInternalId', [$userInternalId]), Query::orderAsc() - ], $dbForProject, function (Document $document) use ($dbForProject) { + ], $dbForProject, function (Document $document) use ($dbForProject, $userInternalId) { if ($document->getAttribute('confirm')) { // Count only confirmed members $teamId = $document->getAttribute('teamId'); $team = $dbForProject->getDocument('teams', $teamId); if (!$team->isEmpty()) { $dbForProject->decreaseDocumentAttribute('teams', $teamId, 'total', 1, 0); + + // If this user was the team's primary user, transfer to the next member + if ($team->getAttribute('userInternalId') === $userInternalId) { + $nextMembership = $dbForProject->findOne('memberships', [ + Query::equal('teamInternalId', [$team->getSequence()]), + ]); + + if ($nextMembership !== false && !$nextMembership->isEmpty()) { + $dbForProject->updateDocument('teams', $team->getId(), new Document([ + 'userId' => $nextMembership->getAttribute('userId'), + 'userInternalId' => $nextMembership->getAttribute('userInternalId'), + ])); + } + } } } }); diff --git a/tests/e2e/Services/Account/AccountConsoleClientTest.php b/tests/e2e/Services/Account/AccountConsoleClientTest.php index 78f7798193..9f825c3c89 100644 --- a/tests/e2e/Services/Account/AccountConsoleClientTest.php +++ b/tests/e2e/Services/Account/AccountConsoleClientTest.php @@ -14,7 +14,12 @@ class AccountConsoleClientTest extends Scope use ProjectConsole; use SideClient; - public function testDeleteAccount(): void + /** + * Test that account deletion succeeds even with active team memberships. + * When the user is the sole owner and only member of a team, the team + * should be cleaned up automatically. + */ + public function testDeleteAccountWithMembership(): void { $email = uniqid() . 'user@localhost.test'; $password = 'password'; @@ -46,7 +51,7 @@ class AccountConsoleClientTest extends Scope $session = $response['cookies']['a_session_' . $this->getProject()['$id']]; - // create team + // Create team — user becomes sole owner and only member $team = $this->client->call(Client::METHOD_POST, '/teams', [ 'origin' => 'http://localhost', 'content-type' => 'application/json', @@ -58,7 +63,51 @@ class AccountConsoleClientTest extends Scope ]); $this->assertEquals($team['headers']['status-code'], 201); - $teamId = $team['body']['$id']; + // Account deletion should succeed even with active membership + $response = $this->client->call(Client::METHOD_DELETE, '/account', array_merge([ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'cookie' => 'a_session_' . $this->getProject()['$id'] . '=' . $session, + ])); + + $this->assertEquals(204, $response['headers']['status-code']); + } + + /** + * Test that account deletion works when the user has no team memberships. + */ + public function testDeleteAccountWithoutMembership(): void + { + $email = uniqid() . 'user@localhost.test'; + $password = 'password'; + $name = 'User Name'; + + $response = $this->client->call(Client::METHOD_POST, '/account', array_merge([ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ]), [ + 'userId' => ID::unique(), + 'email' => $email, + 'password' => $password, + 'name' => $name, + ]); + + $this->assertEquals($response['headers']['status-code'], 201); + + $response = $this->client->call(Client::METHOD_POST, '/account/sessions/email', array_merge([ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ]), [ + 'email' => $email, + 'password' => $password, + ]); + + $this->assertEquals($response['headers']['status-code'], 201); + + $session = $response['cookies']['a_session_' . $this->getProject()['$id']]; $response = $this->client->call(Client::METHOD_DELETE, '/account', array_merge([ 'origin' => 'http://localhost', @@ -67,27 +116,7 @@ class AccountConsoleClientTest extends Scope 'cookie' => 'a_session_' . $this->getProject()['$id'] . '=' . $session, ])); - $this->assertEquals($response['headers']['status-code'], 400); - - // DELETE TEAM - $response = $this->client->call(Client::METHOD_DELETE, '/teams/' . $teamId, array_merge([ - 'origin' => 'http://localhost', - 'content-type' => 'application/json', - 'x-appwrite-project' => $this->getProject()['$id'], - 'cookie' => 'a_session_' . $this->getProject()['$id'] . '=' . $session, - ])); - $this->assertEquals($response['headers']['status-code'], 204); - - $this->assertEventually(function () use ($session) { - $response = $this->client->call(Client::METHOD_DELETE, '/account', array_merge([ - 'origin' => 'http://localhost', - 'content-type' => 'application/json', - 'x-appwrite-project' => $this->getProject()['$id'], - 'cookie' => 'a_session_' . $this->getProject()['$id'] . '=' . $session, - ])); - - $this->assertEquals(204, $response['headers']['status-code']); - }, 10_000, 500); + $this->assertEquals(204, $response['headers']['status-code']); } public function testSessionAlert(): void From 16ed60a5c358a50cb3fd9ec606752efda8765156 Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Sun, 5 Apr 2026 02:02:09 +0000 Subject: [PATCH 2/6] Filter unconfirmed members when transferring team ownership Prevent unconfirmed (pending invite) members from being promoted to owner or set as the team's primary user during membership/account deletion by adding a Query::equal('confirm', [true]) filter to the relevant findOne queries. Co-Authored-By: Claude Opus 4.6 (1M context) --- app/controllers/api/account.php | 1 + src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php | 1 + src/Appwrite/Platform/Workers/Deletes.php | 1 + 3 files changed, 3 insertions(+) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 6ac6373c87..83fc7465c9 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -667,6 +667,7 @@ Http::delete('/v1/account') $nextMember = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), Query::notEqual('userInternalId', $user->getSequence()), + Query::equal('confirm', [true]), ]); if (!$nextMember->isEmpty()) { diff --git a/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php b/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php index 3b516c2d60..d055ecb23f 100644 --- a/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php +++ b/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php @@ -126,6 +126,7 @@ class Delete extends Action if ($team->getAttribute('userInternalId') === $membership->getAttribute('userInternalId')) { $membership = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), + Query::equal('confirm', [true]), ]); if (!$membership->isEmpty()) { diff --git a/src/Appwrite/Platform/Workers/Deletes.php b/src/Appwrite/Platform/Workers/Deletes.php index 9508f784bd..a138f7c93b 100644 --- a/src/Appwrite/Platform/Workers/Deletes.php +++ b/src/Appwrite/Platform/Workers/Deletes.php @@ -856,6 +856,7 @@ class Deletes extends Action if ($team->getAttribute('userInternalId') === $userInternalId) { $nextMembership = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), + Query::equal('confirm', [true]), ]); if ($nextMembership !== false && !$nextMembership->isEmpty()) { From 4297c70f58786f63c9ace630727baccd4b60b9e7 Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Sun, 5 Apr 2026 05:22:02 +0000 Subject: [PATCH 3/6] =?UTF-8?q?fix:=20address=20review=20feedback=20?= =?UTF-8?q?=E2=80=94=20safer=20orphan=20approach,=20veteran=20ordering,=20?= =?UTF-8?q?deduplicate=20transfer?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Remove team deletion for sole owner+sole member case; let orphan teams be cleaned up by Cloud's inactive project cleanup (safer, avoids accidental data loss) - Add explicit ordering by $createdAt so the most veteran member gets ownership transfer, with limit(1) for clarity - Remove confirm filter on primary user transfer in membership deletion so all members (including unconfirmed) are considered - Remove redundant ownership transfer from Deletes worker since the API controller already handles it before queueing Co-Authored-By: Claude Opus 4.6 (1M context) --- app/controllers/api/account.php | 19 +++---------------- .../Modules/Teams/Http/Memberships/Delete.php | 1 - src/Appwrite/Platform/Workers/Deletes.php | 15 --------------- 3 files changed, 3 insertions(+), 32 deletions(-) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 83fc7465c9..db2d5d2a26 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -647,27 +647,14 @@ Http::delete('/v1/account') $totalMembers = $team->getAttribute('total', 0); - if ($isSoleOwner && $totalMembers <= 1) { - // User is the only owner and the only member — delete the team. - // The team deletion worker will clean up associated projects and resources. - $dbForProject->deleteDocument('teams', $team->getId()); - - $queueForDeletes - ->setType(DELETE_TYPE_TEAM_PROJECTS) - ->setDocument($team) - ->trigger(); - - $queueForDeletes - ->setType(DELETE_TYPE_DOCUMENT) - ->setDocument($team) - ->trigger(); - } elseif ($isSoleOwner) { + if ($isSoleOwner && $totalMembers > 1) { // User is the sole owner but other members exist — transfer ownership // to the next member before removing this user's membership. $nextMember = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), Query::notEqual('userInternalId', $user->getSequence()), - Query::equal('confirm', [true]), + Query::orderAsc('$createdAt'), + Query::limit(1), ]); if (!$nextMember->isEmpty()) { diff --git a/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php b/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php index d055ecb23f..3b516c2d60 100644 --- a/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php +++ b/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php @@ -126,7 +126,6 @@ class Delete extends Action if ($team->getAttribute('userInternalId') === $membership->getAttribute('userInternalId')) { $membership = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), - Query::equal('confirm', [true]), ]); if (!$membership->isEmpty()) { diff --git a/src/Appwrite/Platform/Workers/Deletes.php b/src/Appwrite/Platform/Workers/Deletes.php index a138f7c93b..5476aee529 100644 --- a/src/Appwrite/Platform/Workers/Deletes.php +++ b/src/Appwrite/Platform/Workers/Deletes.php @@ -851,21 +851,6 @@ class Deletes extends Action $team = $dbForProject->getDocument('teams', $teamId); if (!$team->isEmpty()) { $dbForProject->decreaseDocumentAttribute('teams', $teamId, 'total', 1, 0); - - // If this user was the team's primary user, transfer to the next member - if ($team->getAttribute('userInternalId') === $userInternalId) { - $nextMembership = $dbForProject->findOne('memberships', [ - Query::equal('teamInternalId', [$team->getSequence()]), - Query::equal('confirm', [true]), - ]); - - if ($nextMembership !== false && !$nextMembership->isEmpty()) { - $dbForProject->updateDocument('teams', $team->getId(), new Document([ - 'userId' => $nextMembership->getAttribute('userId'), - 'userInternalId' => $nextMembership->getAttribute('userInternalId'), - ])); - } - } } } }); From 8f6530d1e7a92e89092294c07f38c47560b6ef48 Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Sun, 5 Apr 2026 05:34:04 +0000 Subject: [PATCH 4/6] fix: remove unused $userInternalId from closure Co-Authored-By: Claude Opus 4.6 (1M context) --- src/Appwrite/Platform/Workers/Deletes.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Appwrite/Platform/Workers/Deletes.php b/src/Appwrite/Platform/Workers/Deletes.php index 5476aee529..c420444112 100644 --- a/src/Appwrite/Platform/Workers/Deletes.php +++ b/src/Appwrite/Platform/Workers/Deletes.php @@ -845,7 +845,7 @@ class Deletes extends Action $this->deleteByGroup('memberships', [ Query::equal('userInternalId', [$userInternalId]), Query::orderAsc() - ], $dbForProject, function (Document $document) use ($dbForProject, $userInternalId) { + ], $dbForProject, function (Document $document) use ($dbForProject) { if ($document->getAttribute('confirm')) { // Count only confirmed members $teamId = $document->getAttribute('teamId'); $team = $dbForProject->getDocument('teams', $teamId); From ba32012744108b430431ded3cb42d73bddfee486 Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Sun, 5 Apr 2026 07:11:32 +0000 Subject: [PATCH 5/6] fix: filter unconfirmed members from owner count, ownership transfer, and primary user transfer Co-Authored-By: Claude Opus 4.6 (1M context) --- app/controllers/api/account.php | 4 +++- .../Platform/Modules/Teams/Http/Memberships/Delete.php | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index db2d5d2a26..5ff21eee7c 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -638,7 +638,8 @@ Http::delete('/v1/account') collection: 'memberships', queries: [ Query::contains('roles', ['owner']), - Query::equal('teamInternalId', [$team->getSequence()]) + Query::equal('teamInternalId', [$team->getSequence()]), + Query::equal('confirm', [true]), ], max: 2 ); @@ -653,6 +654,7 @@ Http::delete('/v1/account') $nextMember = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), Query::notEqual('userInternalId', $user->getSequence()), + Query::equal('confirm', [true]), Query::orderAsc('$createdAt'), Query::limit(1), ]); diff --git a/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php b/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php index 3b516c2d60..d055ecb23f 100644 --- a/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php +++ b/src/Appwrite/Platform/Modules/Teams/Http/Memberships/Delete.php @@ -126,6 +126,7 @@ class Delete extends Action if ($team->getAttribute('userInternalId') === $membership->getAttribute('userInternalId')) { $membership = $dbForProject->findOne('memberships', [ Query::equal('teamInternalId', [$team->getSequence()]), + Query::equal('confirm', [true]), ]); if (!$membership->isEmpty()) { From cc82b1a5cf1d4e90282dd70b28e05a79be112569 Mon Sep 17 00:00:00 2001 From: Damodar Lohani Date: Sun, 5 Apr 2026 07:15:35 +0000 Subject: [PATCH 6/6] fix: don't promote non-owners on account deletion, leave team orphaned instead Co-Authored-By: Claude Opus 4.6 (1M context) --- app/controllers/api/account.php | 40 ++------------------------------- 1 file changed, 2 insertions(+), 38 deletions(-) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 5ff21eee7c..f05a49c6bb 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -632,44 +632,8 @@ Http::delete('/v1/account') continue; } - $isSoleOwner = false; - if (in_array('owner', $membership->getAttribute('roles', []))) { - $ownersCount = $dbForProject->count( - collection: 'memberships', - queries: [ - Query::contains('roles', ['owner']), - Query::equal('teamInternalId', [$team->getSequence()]), - Query::equal('confirm', [true]), - ], - max: 2 - ); - $isSoleOwner = ($ownersCount === 1); - } - - $totalMembers = $team->getAttribute('total', 0); - - if ($isSoleOwner && $totalMembers > 1) { - // User is the sole owner but other members exist — transfer ownership - // to the next member before removing this user's membership. - $nextMember = $dbForProject->findOne('memberships', [ - Query::equal('teamInternalId', [$team->getSequence()]), - Query::notEqual('userInternalId', $user->getSequence()), - Query::equal('confirm', [true]), - Query::orderAsc('$createdAt'), - Query::limit(1), - ]); - - if (!$nextMember->isEmpty()) { - $roles = $nextMember->getAttribute('roles', []); - if (!in_array('owner', $roles)) { - $roles[] = 'owner'; - $authorization->skip(fn () => $dbForProject->updateDocument('memberships', $nextMember->getId(), new Document([ - 'roles' => $roles, - ]))); - $dbForProject->purgeCachedDocument('users', $nextMember->getAttribute('userId')); - } - } - } + // Team is left as-is — we don't promote non-owner members to owner. + // Orphan teams are cleaned up later by Cloud's inactive project cleanup. } }