Deleting an account

Closing, the 30-day restore, the purge, and backups.

• Delete (request_account_deletion()): the account closes at once. The user can still sign in but sees no book data, only “Your account will be deleted on 6 Nov. Restore?” (my_account_status()). Their username stays reserved, so restoring always works.
• Restore (restore_account()): within 30 days, everything is back as it was.
• During the 30 days the household keeps adding and editing. If the closed account was a book’s only owner, nobody can manage its members or settings until the purge hands ownership over.
• Purge: the daily job (backend/app/jobs/account_deletion.py), logged in as account_purger, handles accounts closed more than 30 days ago:
  • Books only they used are deleted with everything in them, including edit history and the audit log.
  • Shared books stay, because the money in them is the other members’ too. If no other owner with an open account is left, the longest-standing editor (or else viewer) whose account is open becomes owner. If nobody like that is left, the book is deleted like a private one. Books they created move to an owner who stays (books.created_by).
  • Their user row is reduced to a bare id, its sign-up time and a purge date. Their username, name, memberships, password, two-factor secret, recovery codes and sessions are deleted. Transactions and history in shared books keep pointing at that id and show “Deleted user”, so members can still tell one person’s changes from another’s.
  • Their username is free for someone new, who gets a new id.
  • The job writes the purged ids to PURGE_LOG before the purge commits, and refuses to run without it.
• The admin’s account: if the only admin is purged, the server is back in setup: the next start prints a setup code. python -m app.admin make-admin <username> names another admin instead.
• Backups: a purged account still exists in backups taken before the purge, until they expire (about 6 days).
  1. Never put a restored backup into service without re-running the purges done since: python -m app.admin repurge reads PURGE_LOG, kept outside the database so the restore didn’t roll it back. Keep the log at least as long as the backups.
  2. Account closures and restores made after the backup was taken are rolled back too. The server’s log has an account_event line for each (backend/app/core/events.py); re-apply them by hand if it matters.
• Offer the data export before someone deletes their account.