Repository: fossasia/open-event-server

Issue:
The ability to delete my account.
**Is your feature request related to a problem? Please describe.**
<!-- A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] -->I had this app mistaken for something else, and I would like to delete my account. However, there doesn't seem to be an easy way to do that, and the only way to contact you according to your website (aside from social media, which I don't have) is Github.

**Describe the solution you'd like**
<!-- A clear and concise description of what you want to happen. -->
Allow somebody to erase their account via a button on their Profile. Or better yet, just delete my account so I can forget about this already.

**Describe alternatives you've considered**
<!-- A clear and concise description of any alternative solutions or features you've considered. -->I don't know what else to do, this seems like a very basic function for an app to have.

**Additional context**
<!-- Add any other context or screenshots about the feature request here. -->
Thank you.


Discussion:
I'll take a look to it. @iamareebjamal @CosmicCoder96 I think this should be implemented. Your views?
If this is to be implemented, I would like to work in collaboration with
you. I could implement the front-end part of this @shreyanshdwivedi.

On Tue, 16 Apr 2019 at 1:39 PM, Shreyansh Dwivedi <notifications@github.com>
wrote:

> I'll take a look to it. @iamareebjamal <https://github.com/iamareebjamal>
> @CosmicCoder96 <https://github.com/CosmicCoder96> I think this should be
> implemented. Your views?
>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/fossasia/open-event-server/issues/5805#issuecomment-483557071>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AYB6WzWvbFwqiH_Z0Sp68i-krZiQ_Dfjks5vhYVJgaJpZM4cxjc7>
> .
>

Due to the nature of the application, it is not very simple to do so.

Consider this - 

I publish an event, add paid tickets, people buy them.
I get 1000s of dollars in my account, and then just delete my account. No event happens, people have encountered a fraud and it has been done through our system. 

It is definitely possible to add this feature, but it has several aspects of security and real life, and hence needs to be discussed and planned thoroughly before implementing.

Similarly, deleting of an event should be prevent by an API if any order has been placed for the event, and so on
@iamareebjamal I think we can implement this feature to the users who have not created any event. I don't think there is any other possibility of fraud other that the one you stated, which can be eliminated if we apply a check on which I stated above.
Also, currently any event can be deleted easily. Shoul I open an issue to apply a check which prevents deleting an event which has any order associated with it?
Yes, that's what I meant
@shreyanshdwivedi , Implementing the feature on user who have not created any event should also be considered , If a user has bought some amount of Free Tickets for spamming and user deletes his account , It can be a loss to event organiser . So this needs a proper discussion .
@iamareebjamal @mrsaicharan1 @kushthedude  I think it's time that we should finalize what needs to be done for this issue. I'm suggesting that for initials we can allow someone who have not created any event or is not associated with any order to delete his/her account. Your views?
Yeah, go ahead

Resolving patch:
diff --git a/app/api/users.py b/app/api/users.py
--- a/app/api/users.py
+++ b/app/api/users.py
@@ -214,6 +214,14 @@ def before_update_object(self, user, data, view_kwargs):
         if has_access('is_admin') and data.get('deleted_at') != user.deleted_at:
             user.deleted_at = data.get('deleted_at')
 
+        if has_access('is_user_itself', user_id=user.id) and data.get('deleted_at') != user.deleted_at:
+            if len(user.events) != 0:
+                raise ForbiddenException({'source': ''}, "Users associated with events cannot be deleted")
+            elif len(user.orders) != 0:
+                raise ForbiddenException({'source': ''}, "Users associated with orders cannot be deleted")
+            else:
+                user.deleted_at = data.get('deleted_at')
+
         if users_email is not None and users_email != user.email:
             try:
                 db.session.query(User).filter_by(email=users_email).one()


Test patch: