Aktueller Stand

app/api/users/route.ts

@@ -266,6 +266,7 @@ export async function DELETE(request: Request) {
 
   const { searchParams } = new URL(request.url);
   const userId = searchParams.get("id");
+  const hardDelete = searchParams.get("hard") === "true";
 
   if (!userId) {
     return NextResponse.json({ error: "Ungültige Anfrage." }, { status: 400 });
@@ -291,6 +292,71 @@ export async function DELETE(request: Request) {
     return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   }
 
+  if (hardDelete) {
+    if (!isSuperAdminSession(session)) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const user = await prisma.user.findUnique({
+      where: { id: userId },
+      select: { email: true }
+    });
+
+    if (!user) {
+      return NextResponse.json({ error: "Benutzer nicht gefunden." }, { status: 404 });
+    }
+
+    const events = await prisma.event.findMany({
+      where: { createdById: userId },
+      select: { id: true }
+    });
+    const eventIds = events.map((event) => event.id);
+
+    const views = await prisma.userView.findMany({
+      where: { userId },
+      select: { id: true }
+    });
+    const viewIds = views.map((view) => view.id);
+
+    await prisma.$transaction(async (tx) => {
+      if (eventIds.length > 0) {
+        await tx.userViewItem.deleteMany({
+          where: { eventId: { in: eventIds } }
+        });
+        await tx.userViewExclusion.deleteMany({
+          where: { eventId: { in: eventIds } }
+        });
+        await tx.event.deleteMany({
+          where: { id: { in: eventIds } }
+        });
+      }
+
+      if (viewIds.length > 0) {
+        await tx.userViewItem.deleteMany({
+          where: { viewId: { in: viewIds } }
+        });
+        await tx.userViewCategory.deleteMany({
+          where: { viewId: { in: viewIds } }
+        });
+        await tx.userViewExclusion.deleteMany({
+          where: { viewId: { in: viewIds } }
+        });
+        await tx.userView.deleteMany({
+          where: { id: { in: viewIds } }
+        });
+      }
+
+      await tx.session.deleteMany({ where: { userId } });
+      await tx.account.deleteMany({ where: { userId } });
+      await tx.passwordResetToken.deleteMany({ where: { userId } });
+      await tx.loginAttempt.deleteMany({ where: { email: user.email } });
+      await tx.verificationToken.deleteMany({ where: { identifier: user.email } });
+      await tx.user.delete({ where: { id: userId } });
+    });
+
+    return NextResponse.json({ ok: true, deleted: true });
+  }
+
   await prisma.session.deleteMany({ where: { userId } });
   await prisma.account.deleteMany({ where: { userId } });