Extend user account deletion to users without security token

apps/api/src/app/user/user.controller.ts

@@ -71,14 +71,20 @@ export class UserController {
 
   @Delete()
   @HasPermission(permissions.deleteOwnUser)
-  @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
+  @UseGuards(AuthGuard('jwt'), HasPermissionGuard, ImpersonationGuard)
   public async deleteOwnUser(
-    @Body() data: DeleteOwnUserDto
+    @Body() data: DeleteOwnUserDto,
+    @Impersonation() { isActive }: ImpersonationContext
   ): Promise<UserModel> {
     const user = this.request.user;
 
     if (user.provider === 'ANONYMOUS') {
       await this.validateAccessToken(data.accessToken, user.id);
+    } else if (isActive) {
+      throw new HttpException(
+        getReasonPhrase(StatusCodes.FORBIDDEN),
+        StatusCodes.FORBIDDEN
+      );
     }
 
     return this.userService.deleteUser({

apps/client/src/app/components/user-account-settings/user-account-settings.component.ts

@@ -286,11 +286,11 @@ export class GfUserAccountSettingsComponent implements OnInit {
           )
           .pipe(
             catchError(() => {
-              if (this.hasPermissionToUpdateOwnAccessToken) {
-                this.notificationService.alert({
-                  title: $localize`Oops! Incorrect Security Token.`
-                });
-              }
+              this.notificationService.alert({
+                title: this.hasPermissionToUpdateOwnAccessToken
+                  ? $localize`Oops! Incorrect Security Token.`
+                  : $localize`Oops! Something went wrong.`
+              });
 
               return EMPTY;
             }),