Merge pull request #46 from devondragon/issue-33-Build-User-Delete/Disable-Feature

Issue 33 build user delete/disable feature

Author: devondragon

README.md

@@ -77,6 +77,10 @@ Additionally, a docker-compose file is included, which launches a stack with the
 
 
 
+## Overriding Spring Security Messages
+
+You may want to override the default Spring Security user facing messages.  You can do this in your messages.properties file, by adding any of the message keys from Spring Security (found here: [Spring Security Messages](https://github.com/spring-projects/spring-security/blob/main/core/src/main/resources/org/springframework/security/messages.properties)) and providing your own values.
+
 
 ## Dev Tools
 

src/main/java/com/digitalsanctuary/spring/user/api/UserAPI.java

@@ -10,6 +10,7 @@
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -25,6 +26,7 @@
 import com.digitalsanctuary.spring.user.service.UserService.TokenValidationResult;
 import com.digitalsanctuary.spring.user.util.JSONResponse;
 import com.digitalsanctuary.spring.user.util.UserUtils;
+import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -64,6 +66,10 @@ public class UserAPI {
 	@Value("${user.security.forgotPasswordChangeURI}")
 	private String forgotPasswordChangeURI;
 
+	@Value("${user.actuallyDeleteAccount:false}")
+	private boolean actuallyDeleteAccount;
+
+
 	/**
 	 * Register a new user account.
 	 *
@@ -293,4 +299,40 @@ public ResponseEntity<JSONResponse> changeUserPassword(@AuthenticationPrincipal
 				HttpStatus.OK);
 	}
 
+	/**
+	 * Deletes the current user's account.
+	 *
+	 * @param locale the locale
+	 * @param request the request
+	 * @return the generic response
+	 */
+	@DeleteMapping("/deleteAccount")
+	public ResponseEntity<JSONResponse> deleteAccount(@AuthenticationPrincipal DSUserDetails userDetails, final Locale locale,
+			final HttpServletRequest request) {
+
+		if (userDetails == null || userDetails.getUser() == null) {
+			log.error("UserAPI.deleteAccount:" + "deleteAccount called with null userDetails or user.");
+			return new ResponseEntity<JSONResponse>(
+					JSONResponse.builder().success(false).code(2).message(messages.getMessage("message.error", null, locale)).build(),
+					HttpStatus.INTERNAL_SERVER_ERROR);
+		}
+		final User user = userDetails.getUser();
+
+		if (actuallyDeleteAccount) {
+			userService.deleteUser(user);
+		} else {
+			user.setEnabled(false);
+			userService.saveRegisteredUser(user);
+		}
+		try {
+			SecurityContextHolder.clearContext();
+			request.logout();
+		} catch (ServletException e) {
+			log.warn("UserAPI.deleteAccount:" + "Exception on logout!", e);
+		}
+
+		return new ResponseEntity<JSONResponse>(JSONResponse.builder().success(true).message("Account Deleted").build(), HttpStatus.OK);
+	}
+
+
 }

src/main/java/com/digitalsanctuary/spring/user/controller/UserPageController.java

@@ -142,4 +142,9 @@ public String updatePassword() {
 		return "user/update-password";
 	}
 
+	@GetMapping("/user/delete-account.html")
+	public String deleteAccount() {
+		return "user/delete-account";
+	}
+
 }

src/main/resources/META-INF/additional-spring-configuration-metadata.json

@@ -164,6 +164,11 @@
       "name": "spring.devtools.livereload.https",
       "type": "java.lang.String",
       "description": "A description for 'spring.devtools.livereload.https'"
+    },
+    {
+      "name": "user.actuallyDeleteAccount",
+      "type": "java.lang.String",
+      "description": "A description for 'user.actuallyDeleteAccount'"
     }
   ]
 }

src/main/resources/application.yml

@@ -70,6 +70,7 @@ spring:
   messages:
     basename: messages/messages
 user:
+  actuallyDeleteAccount: false
   registration:
     sendVerificationEmail: true
     googleEnabled: false

src/main/resources/messages/messages.properties

@@ -11,6 +11,7 @@ page.title.forgotPassword=Forgot Your Password?
 page.title.forgotPasswordPending=Forgot Password Pending Verification
 page.title.updateUser=Update Your Profile
 page.title.updatePassword=Change Your Password
+page.title.deleteAccount=Delete Your Account
 
 
 
@@ -25,6 +26,7 @@ action.register=Register Here
 action.forgotPassword=Forgot Your Password?
 action.updateUser=Update Profile
 action.updatePassword=Change Password
+action.deleteAccount=Delete Account
 
 email.forgotPassword.introPara=A forgot password email has been requested for your account. If this was you, please click the link below and reset your password. If this wasn't you, it is safe to ignore this, no changes have been made to your account or password. If you belive someone is trying to gain access to your account, please contact support!
 email.forgotPassword.linkExpPara=Please note that this link will only be valid for 24 hours. Click if you need to <a href="{0}/user/forgot-password.html">request another forgot password link</a>.
@@ -44,6 +46,7 @@ message.userNotFound=User Not Found
 message.resetPasswordSuccess=Password reset successfully
 message.resetYourPassword=Reset your password
 message.resetPasswordEmail=You should receive a password reset email shortly
+message.deleteAccount=Delete Your Account
 
 message.updateUserSuccess=Your Profile Was Successfully Updated.
 

src/main/resources/static/js/register.js

@@ -24,10 +24,11 @@ function register(event) {
         $("#globalError").show().html(/*[[#{PasswordMatches.user}]]*/);
         return;
     }
-    var token = $('input[name="_csrf"]').attr('value')
     $.ajaxSetup({
         beforeSend: function (xhr) {
-            xhr.setRequestHeader('Csrf-Token', token);
+            var token = $("meta[name='_csrf']").attr("content");
+            var header = $("meta[name='_csrf_header']").attr("content");
+            xhr.setRequestHeader(header, token);
         }
     });
     var formData = $('form').serialize();

src/main/resources/templates/index.html

@@ -1,8 +1,7 @@
 <!DOCTYPE HTML>
-<html lang="en" xmlns:th="http://www.thymeleaf.org" layout:decorate="~{layout}">
+<html xmlns:th="http://www.thymeleaf.org" layout:decorate="~{layout}">
 
 <head>
-	<meta charset="utf-8">
 	<title th:utext="#{page.title.home}">Home Page</title>
 </head>
 

src/main/resources/templates/layout.html

@@ -1,12 +1,15 @@
 <!DOCTYPE html>
-<html>
+<html xmlns:th="http://www.thymeleaf.org" th:lang="${#locale.language}">
 
 <head>
 	<meta charset="utf-8">
 	<meta name="viewport" content="width=device-width, initial-scale=1">
 	<meta th:if="${@environment.acceptsProfiles('dev','local')}" http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
 
-	<sec:csrfMetaTags />
+	<meta name="_csrf" th:content="${_csrf.token}" />
+	<!-- default header name is X-CSRF-TOKEN -->
+	<meta name="_csrf_header" th:content="${_csrf.headerName}" />
+
 	<!--/*  Each token will be replaced by their respective titles in the resulting page. */-->
 	<title layout:title-pattern="$LAYOUT_TITLE - $CONTENT_TITLE">Spring User Framework</title>
 

src/main/resources/templates/protected.html

@@ -1,5 +1,5 @@
 <!DOCTYPE HTML>
-<html lang="en" xmlns:th="http://www.thymeleaf.org" layout:decorate="~{layout}">
+<html xmlns:th="http://www.thymeleaf.org" layout:decorate="~{layout}">
 
 <head>
 	<title>Protected Page</title>
@@ -17,4 +17,4 @@
 	</div>
 </body>
 
-</html>
+</html>