Extend user account deletion to users without security token

apps/api/src/app/user/user.controller.ts

@@ -75,10 +75,11 @@ export class UserController {
   public async deleteOwnUser(
     @Body() data: DeleteOwnUserDto
   ): Promise<UserModel> {
-    const user = await this.validateAccessToken(
-      data.accessToken,
-      this.request.user.id
-    );
+    // Only users of the anonymous provider have a security token
+    const user =
+      this.request.user.provider === 'ANONYMOUS'
+        ? await this.validateAccessToken(data.accessToken, this.request.user.id)
+        : this.request.user;
 
     return this.userService.deleteUser({
       id: user.id
@@ -260,6 +261,13 @@ export class UserController {
     accessToken: string,
     userId: string
   ): Promise<UserModel> {
+    if (!accessToken) {
+      throw new HttpException(
+        getReasonPhrase(StatusCodes.FORBIDDEN),
+        StatusCodes.FORBIDDEN
+      );
+    }
+
     const hashedAccessToken = this.userService.createAccessToken({
       password: accessToken,
       salt: this.configurationService.get('ACCESS_TOKEN_SALT')

apps/api/src/app/user/user.service.ts

@@ -14,6 +14,7 @@ import {
   DEFAULT_CURRENCY,
   DEFAULT_DATE_RANGE,
   DEFAULT_LOCALE,
+  DELETE_OWN_USER_PERIOD,
   PROPERTY_API_KEY_GHOSTFOLIO,
   PROPERTY_IS_READ_ONLY_MODE,
   PROPERTY_MAX_DAILY_REQUESTS,
@@ -45,7 +46,7 @@ import { Injectable, Logger } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { InjectThrottlerStorage, ThrottlerStorage } from '@nestjs/throttler';
 import { Prisma, Role, User } from '@prisma/client';
-import { differenceInDays, subDays } from 'date-fns';
+import { addMilliseconds, differenceInDays, isBefore, subDays } from 'date-fns';
 import { isNil, without } from 'lodash-es';
 import { createHmac } from 'node:crypto';
 
@@ -438,6 +439,18 @@ export class UserService {
           currentPermissions.push(permissions.enableSubscriptionInterstitial);
         }
 
+        // Users without a security token (e.g. Google) can close their user
+        // account themselves only within a period after the registration
+        if (
+          user.provider !== 'ANONYMOUS' &&
+          isBefore(
+            new Date(),
+            addMilliseconds(user.createdAt, DELETE_OWN_USER_PERIOD)
+          )
+        ) {
+          currentPermissions.push(permissions.deleteOwnUser);
+        }
+
         currentPermissions = without(
           currentPermissions,
           permissions.accessHoldingsChart,

apps/client/src/app/components/user-account-settings/user-account-settings.component.ts

@@ -94,6 +94,7 @@ export class GfUserAccountSettingsComponent implements OnInit {
   protected hasImpersonationId: boolean;
   protected hasPermissionToDeleteOwnUser: boolean;
   protected hasPermissionToRequestOwnUserDeletion: boolean;
+  protected hasPermissionToUpdateOwnAccessToken: boolean;
   protected hasPermissionToUpdateViewMode: boolean;
   protected hasPermissionToUpdateUserSettings: boolean;
   protected isAccessTokenHidden = true;
@@ -194,6 +195,11 @@ export class GfUserAccountSettingsComponent implements OnInit {
             permissions.requestOwnUserDeletion
           );
 
+          this.hasPermissionToUpdateOwnAccessToken = hasPermission(
+            this.user.permissions,
+            permissions.updateOwnAccessToken
+          );
+
           this.hasPermissionToUpdateUserSettings = hasPermission(
             this.user.permissions,
             permissions.updateUserSettings

apps/client/src/app/components/user-account-settings/user-account-settings.html

@@ -318,7 +318,10 @@
         <div class="d-flex py-1">
           <div class="pr-1 text-danger w-50" i18n>Danger Zone</div>
           <div class="pl-1 w-50">
-            @if (hasPermissionToDeleteOwnUser) {
+            @if (
+              hasPermissionToDeleteOwnUser &&
+              hasPermissionToUpdateOwnAccessToken
+            ) {
               <form
                 class="w-100"
                 [formGroup]="deleteOwnUserForm"
@@ -363,6 +366,15 @@
                   Close Account
                 </button>
               </form>
+            } @else if (hasPermissionToDeleteOwnUser) {
+              <button
+                color="warn"
+                i18n
+                mat-flat-button
+                (click)="onCloseAccount()"
+              >
+                Close Account
+              </button>
             } @else if (
               hasPermissionToRequestOwnUserDeletion &&
               (user?.accounts?.length > 0 || user?.activitiesCount > 0)

libs/common/src/lib/config.ts

@@ -198,6 +198,8 @@ export const DEFAULT_REDACTED_PATHS = [
   'valueInBaseCurrency'
 ];
 
+export const DELETE_OWN_USER_PERIOD = ms('2 weeks');
+
 // USX is handled separately
 export const DERIVED_CURRENCIES = [
   {

libs/common/src/lib/dtos/delete-own-user.dto.ts

@@ -1,6 +1,7 @@
-import { IsString } from 'class-validator';
+import { IsOptional, IsString } from 'class-validator';
 
 export class DeleteOwnUserDto {
+  @IsOptional()
   @IsString()
-  accessToken: string;
+  accessToken?: string;
 }