Delete user edge function (#2829)

* feat: create oauth client utilities for mining-sources edge function

* fix: address code review issues - pin deps, add guards, fix types

* feat: create mining-sources edge function with OAuth routes

* fix: address code review issues - add onError handler, fix credentials JSON, add getRequiredEnv

* test: add tests for mining-sources utility functions and route schemas

* test: extract schemas to shared module, strengthen test assertions, add edge cases

* feat: update frontend to call mining-sources edge function

* chore: remove deprecated Express OAuth routes and methods

* chore: remove deprecated add-mining-source edge function (replaced by mining-sources)

* test: remove deprecated OAuth helper tests (functionality moved to edge function)

* fix: resolve CI lint and DeepSource issues

* feat: make oauth_callback_base_url a required env var with no fallbacks

* docs: mark oauth_callback_base_url as required in env template

* feat: add mining-sources config and document oauth_callback_base_url env var

* fix: hmac-sign oauth state to prevent userId forgery

* feat: add callbackQuerySchema for oauth callback route validation

* test: add callbackQuerySchema tests

* feat: use zod validation for oauth callback route params

* chore: remove orphaned validator schemas and stale add-mining-source directory

* fix: remove dead OAuth code from mining controller (post-merge cleanup)

* feat: add create_smtp_sender_for_oauth rpc for smtp twin creation

* feat: add smtp twin creation to mining-sources edge function callback

* test: add smtp twin creation tests for mining-sources edge function

* chore: remove plan docs from remote

* chore: remove workmux config from remote

* fix: use const instead of let for accessToken/refreshToken (deepsource)

* feat: create delete-user edge function

Move user account deletion from Express backend to a new Supabase
edge function. The edge function verifies the user via JWT, calls the
delete_user_data RPC, then deletes the auth user via admin API.

Closes #2810

* feat(frontend): call delete-user edge function from settings

Replace direct Express API call ($api) with the new delete-user
edge function ($saasEdgeFunctions) for account deletion.

* refactor(backend): remove Express delete-user code

The auth controller, user resolver interface and implementation, and
related wiring (auth routes, app, server) are no longer needed since
the delete-user edge function handles account deletion.

* fix(delete-user): pass JWT explicitly to auth.getUser()

The default auth.getUser() call has a known issue where it may
return null user data when called from an Edge Function with no
Supabase session. Pass the JWT explicitly to avoid silently 401ing
real users.

Also drop the unused getRequiredEnv import.

* fix(delete-user): explicit return on authMiddleware to satisfy DeepSource JS-0045

Author: malek10xdev

backend/src/app.ts

@@ -8,7 +8,7 @@ import ENV from './config';
 import { Contacts } from './db/interfaces/Contacts';
 import { MiningSources } from './db/interfaces/MiningSources';
 import { SmtpSenders } from './db/interfaces/SmtpSenders';
-import { Users } from './db/interfaces/Users';
+
 import corsMiddleware from './middleware/cors';
 import errorHandler from './middleware/errorHandler';
 import errorLogger from './middleware/errorLogger';
@@ -32,7 +32,7 @@ export default function initializeApp(
   miningEngine: MiningEngine,
   miningSources: MiningSources,
   contacts: Contacts,
-  userResolver: Users,
+
   logger: Logger,
   miningControllerDeps: MiningControllerDeps,
   smtpSenders: SmtpSenders
@@ -62,7 +62,7 @@ export default function initializeApp(
     res.json({ message: 'Welcome to leadminer application.' })
   );
 
-  app.use('/api/auth', initializeAuthRoutes(authResolver, userResolver));
+  app.use('/api/auth', initializeAuthRoutes());
   app.use('/api/imap', initializeImapRoutes(authResolver, miningSourceService));
   app.use('/api/imap', initializeStreamRouter(miningEngine, authResolver));
   app.use(

backend/src/controllers/auth.controller.ts

@@ -1,18 +1,7 @@
 import { Router } from 'express';
-import { Users } from '../db/interfaces/Users';
-import initializeAuthController from '../controllers/auth.controller';
-import initializeAuthMiddleware from '../middleware/auth';
-import AuthResolver from '../services/auth/AuthResolver';
 
-export default function initializeAuthRoutes(
-  authResolver: AuthResolver,
-  userResolver: Users
-) {
+export default function initializeAuthRoutes() {
   const router = Router();
-  const middleware = initializeAuthMiddleware(authResolver);
-  const { deleteUserAccount } = initializeAuthController(userResolver);
-
-  router.delete('/users', middleware, deleteUserAccount);
 
   return router;
 }

backend/src/db/interfaces/Users.ts

@@ -7,7 +7,7 @@ import PgContacts from './db/pg/PgContacts';
 import PgMiningSources from './db/pg/PgMiningSources';
 import PgSmtpSenders from './db/pg/PgSmtpSenders';
 import SupabaseTasks from './db/supabase/tasks';
-import SupabaseUsers from './db/supabase/users';
+
 import SupabaseAuthResolver from './services/auth/SupabaseAuthResolver';
 import EmailFetcherClient from './services/email-fetching';
 import PSTFetcherClient from './services/email-fetching/pst';
@@ -47,7 +47,7 @@ console.log(
   );
   const authResolver = new SupabaseAuthResolver(supabaseClient, logger);
   const contactsResolver = new PgContacts(pool, logger);
-  const userResolver = new SupabaseUsers(supabaseClient, logger);
+
   const tasksResolver = new SupabaseTasks(supabaseClient, logger);
   const miningEngine = new MiningEngine({
     redisSubscriber: redis.getSubscriberClient()
@@ -80,7 +80,6 @@ console.log(
     miningEngine,
     miningSources,
     contactsResolver,
-    userResolver,
     logger,
     miningControllerDeps,
     smtpSenders

backend/src/db/supabase/users.ts

@@ -171,7 +171,7 @@ const { t: $t } = useI18n({
 });
 
 const $toast = useToast();
-const { $api } = useNuxtApp();
+const { $saasEdgeFunctions } = useNuxtApp();
 const $profile = useSupabaseUserProfile();
 
 const {
@@ -316,7 +316,7 @@ async function updateUserDetailsButton() {
 async function deleteAccount() {
   isLoading.value = true;
   try {
-    await $api('/auth/users', {
+    await $saasEdgeFunctions('delete-user', {
       method: 'DELETE',
     });
     signOutManually({

backend/src/routes/auth.routes.ts

@@ -0,0 +1,5 @@
+{
+  "imports": {
+    "hono": "https://esm.sh/hono@4.7.4"
+  }
+}