e.xyehr.cn
[READ-ONLY] One Calendar is a privacy-first calendar web app built with Next.js. It has modern security features, including e2ee, password-protected sharing, and self-destructing share links 馃搮
calendar.xyehr.cn
nextjs
1import { NextResponse } from 'next/server'
2import { withEvlog, useLogger, getAuditActor } from '@/lib/evlog'
3import { getServerSession } from '@/lib/auth/server'
4import { db } from '@/lib/drizzle/client'
5import { shares, calendarBackups } from '@/lib/drizzle/schema'
6import { eq, sql } from 'drizzle-orm'
7
8export const runtime = 'nodejs'
9
10export const DELETE = withEvlog(async function DELETE(_request: Request) {
11 try {
12 const log = useLogger()
13 const session = await getServerSession()
14 const user = session?.user
15 if (!user) {
16 log.audit?.({
17 action: 'account.delete',
18 actor: getAuditActor(log),
19 target: { type: 'account', id: 'unknown' },
20 outcome: 'denied',
21 reason: 'Authentication required',
22 })
23 return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
24 }
25
26 await db.transaction(async (tx) => {
27 const hasCalendarEventsTable = await tx.execute(sql`
28 SELECT 1 as ok FROM information_schema.tables WHERE table_schema = 'public' AND table_name = 'calendar_events' LIMIT 1
29 `)
30
31 if (hasCalendarEventsTable.length > 0) {
32 await tx.execute(
33 sql`DELETE FROM calendar_events WHERE user_id = ${user.id}`,
34 )
35 }
36
37 await tx.delete(shares).where(eq(shares.userId, user.id))
38 await tx
39 .delete(calendarBackups)
40 .where(eq(calendarBackups.userId, user.id))
41 })
42
43 log.audit?.({
44 action: 'account.delete',
45 actor: getAuditActor(log, {
46 type: 'user',
47 id: user.id,
48 email: user.email,
49 }),
50 target: { type: 'account', id: user.id },
51 outcome: 'success',
52 reason: 'User requested account data deletion',
53 })
54
55 return NextResponse.json({ success: true })
56 } catch (e: any) {
57 return NextResponse.json(
58 { error: e?.message || 'Internal error' },
59 { status: 500 },
60 )
61 }
62})