codalware-auth/src/lib/softDelete.ts

Complete authentication system with enterprise security, attack protection, team workspaces, waitlist, billing, UI components, 2FA, and account recovery - production-ready in 5 minutes. Enhanced CLI with verification, rollback, and App Router scaffolding.

import { prisma } from './db';

type Actor = { id?: string } | undefined;

export async function softDeleteUser(userId: string, actor?: Actor, reason?: string) {
  const now = new Date();
  const updated = await prisma.user.update({
    where: { id: userId },
    data: { isDeleted: true, deletedAt: now },
  });

  // Write audit log (best-effort)
  try {
    await prisma.auditLog.create({
      data: {
        userId: actor?.id || userId,
        tenantId: updated.tenantId,
        action: 'user_soft_deleted',
        resource: 'user',
        resourceId: userId,
        details: { reason: reason || null },
      },
    });
  } catch (e) {
    // Do not fail the soft-delete if audit logging fails
    console.warn('softDeleteUser: failed to write audit log', e);
  }

  return updated;
}

export async function restoreUser(userId: string, actor?: Actor, reason?: string) {
  const updated = await prisma.user.update({
    where: { id: userId },
    data: { isDeleted: false, deletedAt: null },
  });

  try {
    await prisma.auditLog.create({
      data: {
        userId: actor?.id || userId,
        tenantId: updated.tenantId,
        action: 'user_restored',
        resource: 'user',
        resourceId: userId,
        details: { reason: reason || null },
      },
    });
  } catch (e) {
    console.warn('restoreUser: failed to write audit log', e);
  }

  return updated;
}

export async function isUserSoftDeleted(userId: string) {
  const u = await prisma.user.findUnique({ where: { id: userId }, select: { isDeleted: true } });
  return !!u?.isDeleted;
}

export async function hardDeleteUser(userId: string) {
  // Use with extreme caution - permanent removal
  const deleted = await prisma.user.delete({ where: { id: userId } });
  try {
    await prisma.auditLog.create({
      data: {
        userId: deleted.id,
        tenantId: deleted.tenantId,
        action: 'user_hard_deleted',
        resource: 'user',
        resourceId: deleted.id,
      },
    });
  } catch (e) {
    console.warn('hardDeleteUser: failed to write audit log', e);
  }
  return deleted;
}

const SoftDelete = {
  softDeleteUser,
  restoreUser,
  isUserSoftDeleted,
  hardDeleteUser,
};

export default SoftDelete;