From a8fa33f98dabcac4e6e2b3e621fa3c83b83abde5 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Thu, 8 Oct 2026 11:48:15 +0200
Subject: [PATCH] Extend user account deletion to users without security token

---
 apps/api/src/app/user/user.controller.ts       |  1 -
 apps/api/src/app/user/user.service.ts          |  3 +--
 .../user-account-settings.component.ts         | 18 ++++++++++++------
 .../user-account-settings.html                 |  2 +-
 4 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/apps/api/src/app/user/user.controller.ts b/apps/api/src/app/user/user.controller.ts
index 31a79eff43..aec79e4e21 100644
--- a/apps/api/src/app/user/user.controller.ts
+++ b/apps/api/src/app/user/user.controller.ts
@@ -75,7 +75,6 @@ export class UserController {
   public async deleteOwnUser(
     @Body() data: DeleteOwnUserDto
   ): Promise<UserModel> {
-    // Only users of the anonymous provider have a security token
     const user =
       this.request.user.provider === 'ANONYMOUS'
         ? await this.validateAccessToken(data.accessToken, this.request.user.id)
diff --git a/apps/api/src/app/user/user.service.ts b/apps/api/src/app/user/user.service.ts
index e3b8651831..227d04da80 100644
--- a/apps/api/src/app/user/user.service.ts
+++ b/apps/api/src/app/user/user.service.ts
@@ -439,9 +439,8 @@ export class UserService {
           currentPermissions.push(permissions.enableSubscriptionInterstitial);
         }
 
-        // Users without a security token (e.g. Google) can close their user
-        // account themselves only within a period after the registration
         if (
+          !hasRole(user, Role.DEMO) &&
           user.provider !== 'ANONYMOUS' &&
           isBefore(
             new Date(),
diff --git a/apps/client/src/app/components/user-account-settings/user-account-settings.component.ts b/apps/client/src/app/components/user-account-settings/user-account-settings.component.ts
index 39696e7708..adc51e1744 100644
--- a/apps/client/src/app/components/user-account-settings/user-account-settings.component.ts
+++ b/apps/client/src/app/components/user-account-settings/user-account-settings.component.ts
@@ -277,14 +277,20 @@ export class GfUserAccountSettingsComponent implements OnInit {
     this.notificationService.confirm({
       confirmFn: () => {
         this.dataService
-          .deleteOwnUser({
-            accessToken: this.deleteOwnUserForm.controls.accessToken.value
-          })
+          .deleteOwnUser(
+            this.hasPermissionToUpdateOwnAccessToken
+              ? {
+                  accessToken: this.deleteOwnUserForm.controls.accessToken.value
+                }
+              : {}
+          )
           .pipe(
             catchError(() => {
-              this.notificationService.alert({
-                title: $localize`Oops! Incorrect Security Token.`
-              });
+              if (this.hasPermissionToUpdateOwnAccessToken) {
+                this.notificationService.alert({
+                  title: $localize`Oops! Incorrect Security Token.`
+                });
+              }
 
               return EMPTY;
             }),
diff --git a/apps/client/src/app/components/user-account-settings/user-account-settings.html b/apps/client/src/app/components/user-account-settings/user-account-settings.html
index b1dbfdd415..bf18373447 100644
--- a/apps/client/src/app/components/user-account-settings/user-account-settings.html
+++ b/apps/client/src/app/components/user-account-settings/user-account-settings.html
@@ -366,7 +366,7 @@
                   Close Account
                 </button>
               </form>
-            } @else if (hasPermissionToDeleteOwnUser) {
+            } @else if (hasPermissionToDeleteOwnUser && !hasImpersonationId) {
               <button
                 color="warn"
                 i18n