feat: basic admin interface

server/api/account/index.delete.ts

@@ -1,26 +1,12 @@
 import { and, eq, ne } from 'drizzle-orm';
 import * as z from 'zod';
-import {
-    agents,
-    files,
-    models,
-    providers,
-    settings,
-    toolCalls,
-    topics,
-    users,
-} from '~~/drizzle/schema';
+import { users } from '~~/drizzle/schema';
 import { auth } from '~~/lib/auth';
 import { db } from '~~/server/lib/db';
 
 /**
- * Deletes the signed in user's account and everything that belongs to it.
- *
- * The app tables only store a plain user id, nothing cascades from the users
- * table, so every one of them is cleared here. It all happens in one
- * transaction: either the whole account is gone or nothing changed.
- *
- * Objects in file storage are left alone on purpose.
+ * Deletes the signed in user's account and everything that belongs to it,
+ * after they proved it is really them.
  */
 export default defineEventHandler(async (event) => {
     await protectRoute(event);
@@ -125,21 +111,7 @@ export default defineEventHandler(async (event) => {
         });
     }
 
-    await db.transaction(async (tx) => {
-        // messages, their parts, generations and attachments cascade from topics
-        await tx.delete(topics).where(eq(topics.userId, userId));
-        await tx.delete(agents).where(eq(agents.userId, userId));
-        await tx.delete(models).where(eq(models.userId, userId));
-        await tx.delete(providers).where(eq(providers.userId, userId));
-        // nothing points a tool call back at its message, so these never cascade
-        await tx.delete(toolCalls).where(eq(toolCalls.userId, userId));
-        // embeddings go with their file
-        await tx.delete(files).where(eq(files.userId, userId));
-        await tx.delete(settings).where(eq(settings.userId, userId));
-
-        // sessions, accounts and two-factor rows cascade from the user
-        await tx.delete(users).where(eq(users.id, userId));
-    });
+    await deleteAccount(userId);
 
     // the session is gone, but the browser would keep trusting its cached
     // copy for a few minutes unless the cookies go too