From cba6981fdf4dad6ee5537065b637246fae987230 Mon Sep 17 00:00:00 2001 From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com> Date: Thu, 8 Oct 2026 12:09:10 +0200 Subject: [PATCH] Extend user account deletion to users without security token --- apps/api/src/app/user/user.controller.ts | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/apps/api/src/app/user/user.controller.ts b/apps/api/src/app/user/user.controller.ts index aec79e4e21..4ec1e61499 100644 --- a/apps/api/src/app/user/user.controller.ts +++ b/apps/api/src/app/user/user.controller.ts @@ -75,10 +75,11 @@ export class UserController { public async deleteOwnUser( @Body() data: DeleteOwnUserDto ): Promise { - const user = - this.request.user.provider === 'ANONYMOUS' - ? await this.validateAccessToken(data.accessToken, this.request.user.id) - : this.request.user; + const user = this.request.user; + + if (user.provider === 'ANONYMOUS') { + await this.validateAccessToken(data.accessToken, user.id); + } return this.userService.deleteUser({ id: user.id