From 2d48393fa1845da03ed93806b4bac59e6d6441af Mon Sep 17 00:00:00 2001 From: Hendrik Belitz Date: Thu, 23 Oct 2025 13:13:27 +0200 Subject: [PATCH] Try to delete user first before deleting key shares (to make sure the transaction fails if we cannot delete the user) --- src/lib/server/services/staff-service.ts | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/lib/server/services/staff-service.ts b/src/lib/server/services/staff-service.ts index f4541a2..7883d6f 100644 --- a/src/lib/server/services/staff-service.ts +++ b/src/lib/server/services/staff-service.ts @@ -205,7 +205,11 @@ export class StaffService { throw new NotFoundError("Staff member not found in this tenant"); } - // Delete tenant-specific data (client tunnel key shares) + // Use UserService to delete central database data (user + passkeys) first + // This ensures all validation logic is applied before deleting tenant data + const userDeletionResult = await UserService.deleteUser(staffId, tx); + + // Delete tenant-specific data (client tunnel key shares) after user deletion succeeds let deletedKeySharesCount = 0; try { const tenantDb = await getTenantDb(tenantId); @@ -226,12 +230,9 @@ export class StaffService { tenantId, error: String(error), }); - // Continue with user deletion even if key share deletion fails + // Note: User deletion already succeeded, key share deletion is auxiliary } - // Use UserService to delete central database data (user + passkeys) - const userDeletionResult = await UserService.deleteUser(staffId, tx); - // Combine results for staff-specific response format const staffDeletionResult: StaffDeletionResult = { success: userDeletionResult.success,