feat: delete-account page and an app store review login

src/env.js

@@ -54,6 +54,11 @@ export const env = createEnv({
     APPLE_TEAM_ID: z.string().optional(),
     APPLE_KEY_ID: z.string().optional(),
     APPLE_PRIVATE_KEY: z.string().optional(),
+    // A login for App Store and Play reviewers, who can't receive our emails: requesting a code for
+    // REVIEW_LOGIN_EMAIL sends nothing and the code is always REVIEW_LOGIN_CODE (6 characters from
+    // the sign-in code alphabet). Normal code expiry and attempt limits still apply.
+    REVIEW_LOGIN_EMAIL: z.string().email().optional(),
+    REVIEW_LOGIN_CODE: z.string().optional(),
     R2_ACCESS_KEY: z.string().optional(),
     R2_SECRET_KEY: z.string().optional(),
     R2_BUCKET: z.string().optional(),
@@ -118,6 +123,8 @@ export const env = createEnv({
     APPLE_TEAM_ID: process.env.APPLE_TEAM_ID,
     APPLE_KEY_ID: process.env.APPLE_KEY_ID,
     APPLE_PRIVATE_KEY: process.env.APPLE_PRIVATE_KEY,
+    REVIEW_LOGIN_EMAIL: process.env.REVIEW_LOGIN_EMAIL,
+    REVIEW_LOGIN_CODE: process.env.REVIEW_LOGIN_CODE,
     R2_ACCESS_KEY: process.env.R2_ACCESS_KEY,
     R2_SECRET_KEY: process.env.R2_SECRET_KEY,
     R2_BUCKET: process.env.R2_BUCKET,

src/pages/delete-account.tsx

@@ -0,0 +1,75 @@
+import { type NextPage } from 'next';
+import Link from 'next/link';
+
+import { Seo } from '~/components/Site/Seo';
+import { SiteLayout } from '~/components/Site/SiteLayout';
+import { env } from '~/env';
+
+/** Public page the app stores link to: how to delete a SplitPro account and what happens. */
+const DeleteAccount: NextPage<{ feedbackEmail: string }> = ({ feedbackEmail }) => (
+  <SiteLayout>
+    <Seo
+      title="Delete your SplitPro account"
+      description="How to delete your SplitPro account and what happens to your data."
+      path="/delete-account"
+    />
+    <div className="mx-auto max-w-3xl px-5 pb-20 lg:px-8">
+      <h1 className="mt-14 text-3xl font-semibold tracking-tight text-white sm:text-4xl">
+        Delete your SplitPro account
+      </h1>
+      <p className="mt-4 text-lg text-gray-400">
+        You can delete your SplitPro account yourself, at any time, from the app or the website.
+      </p>
+
+      <h2 className="mt-12 text-xl font-semibold text-white">In the SplitPro app</h2>
+      <ol className="mt-3 list-decimal space-y-1 pl-6 text-lg text-gray-400">
+        <li>Open the Account tab.</li>
+        <li>Tap Delete account.</li>
+        <li>Enter the code we email you to confirm.</li>
+      </ol>
+
+      <h2 className="mt-10 text-xl font-semibold text-white">On the website</h2>
+      <ol className="mt-3 list-decimal space-y-1 pl-6 text-lg text-gray-400">
+        <li>
+          Sign in at{' '}
+          <Link href="/account" className="text-primary hover:underline">
+            splitpro.app/account
+          </Link>
+          .
+        </li>
+        <li>Choose Delete account.</li>
+        <li>Enter the code we email you to confirm.</li>
+      </ol>
+
+      <h2 className="mt-12 text-xl font-semibold text-white">What gets deleted</h2>
+      <p className="mt-3 text-lg text-gray-400">
+        Your name, email address, profile photo, sign-in methods (Google, Apple, email), sessions,
+        notification settings and your friends list are deleted straight away.
+      </p>
+
+      <h2 className="mt-10 text-xl font-semibold text-white">What is kept</h2>
+      <p className="mt-3 text-lg text-gray-400">
+        Expenses you shared with other people stay, so their balances remain correct. They show you
+        as &quot;Deleted user&quot;, with no name or email. Groups you created pass to another
+        member, or are deleted if nobody else is in them. Deleted data can stay in our encrypted
+        backups for a limited time until those backups expire.
+      </p>
+
+      {feedbackEmail ? (
+        <p className="mt-12 text-lg text-gray-400">
+          Can&apos;t sign in any more? Email{' '}
+          <a className="text-primary hover:underline" href={'mailto:' + feedbackEmail}>
+            {feedbackEmail}
+          </a>{' '}
+          from the address on your account and we&apos;ll delete it for you.
+        </p>
+      ) : null}
+    </div>
+  </SiteLayout>
+);
+
+export default DeleteAccount;
+
+export const getServerSideProps = () => ({
+  props: { feedbackEmail: env.FEEDBACK_EMAIL ?? '' },
+});

src/server/mobileAuth.ts

@@ -241,6 +241,11 @@ export const deleteMobileSession = async (sessionToken: string, pushToken?: stri
 /**
  * Sends the same sign-in code as the web email provider, stored the way next-auth stores it.
  */
+const isReviewLoginEmail = (email: string) =>
+  !!env.REVIEW_LOGIN_EMAIL &&
+  !!env.REVIEW_LOGIN_CODE &&
+  email === tryNormalizeEmail(env.REVIEW_LOGIN_EMAIL);
+
 export const sendEmailCode = async (rawEmail: string, ip: string) => {
   const email = tryNormalizeEmail(rawEmail);
 
@@ -268,13 +273,19 @@ export const sendEmailCode = async (rawEmail: string, ip: string) => {
     );
   }
 
-  const token = generateEmailToken();
+  // App store reviewers can't receive our emails: one configured address gets a fixed code instead
+  const isReviewLogin = isReviewLoginEmail(email);
+  const token = isReviewLogin ? env.REVIEW_LOGIN_CODE!.trim().toUpperCase() : generateEmailToken();
   await adapter.createVerificationToken({
     identifier: email,
     token: hashVerificationToken(token, getAuthSecret()),
     expires: fromNow(EMAIL_TOKEN_MAX_AGE_SECONDS),
   });
 
+  if (isReviewLogin) {
+    return;
+  }
+
   // The same link the web sends, so it still works when opened in a browser
   const url = new URL('/api/auth/callback/email', env.NEXTAUTH_URL);
   url.searchParams.set('callbackUrl', new URL('/balances', env.NEXTAUTH_URL).toString());

src/tests/reviewLogin.integration.test.ts

@@ -0,0 +1,54 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+const databaseUrl = process.env.TEST_DATABASE_URL;
+
+void test(
+  'Review login: the configured email signs in with its fixed code and nothing else changes',
+  { skip: !databaseUrl },
+  async () => {
+    assert.match(new URL(databaseUrl!).pathname, /test/i, 'Refusing to use a non-test database');
+    process.env.DATABASE_URL = databaseUrl;
+    process.env.SKIP_ENV_VALIDATION = '1';
+    process.env.NEXTAUTH_SECRET ??= 'review-login-test-secret';
+    process.env.NEXTAUTH_URL ??= 'http://localhost:3000';
+
+    const [{ db }, { env }, { sendEmailCode, verifyEmailCode }] = await Promise.all([
+      import('~/server/db'),
+      import('~/env'),
+      import('~/server/mobileAuth'),
+    ]);
+    const mutableEnv = env as { -readonly [Key in keyof typeof env]: (typeof env)[Key] };
+    const originalEnv = { ...env };
+    const suffix = `${Date.now()}-${Math.round(Math.random() * 1e9)}`;
+    const reviewEmail = `review-${suffix}@example.com`;
+    const otherEmail = `other-${suffix}@example.com`;
+    mutableEnv.REVIEW_LOGIN_EMAIL = reviewEmail.toUpperCase();
+    mutableEnv.REVIEW_LOGIN_CODE = 'rv7k2m';
+    mutableEnv.NODE_ENV = 'production';
+
+    try {
+      await sendEmailCode(reviewEmail, `ip-${suffix}`);
+      const signedIn = await verifyEmailCode(reviewEmail, 'RV7K2M', `ip-${suffix}`);
+      assert.ok(signedIn.token);
+      assert.equal(signedIn.user.email, reviewEmail);
+
+      // Single use like any code
+      await assert.rejects(verifyEmailCode(reviewEmail, 'RV7K2M', `ip-${suffix}`), /Invalid/);
+
+      // Without a requested code, the fixed code doesn't work
+      await assert.rejects(verifyEmailCode(reviewEmail, 'RV7K2M', `ip-${suffix}`), /Invalid/);
+
+      // Other addresses never accept it
+      await db.verificationToken.deleteMany({ where: { identifier: otherEmail } });
+      await assert.rejects(verifyEmailCode(otherEmail, 'RV7K2M', `ip-${suffix}`), /Invalid/);
+    } finally {
+      Object.assign(mutableEnv, originalEnv);
+      await db.verificationToken.deleteMany({
+        where: { identifier: { in: [reviewEmail, otherEmail] } },
+      });
+      await db.user.deleteMany({ where: { email: { in: [reviewEmail, otherEmail] } } });
+      await db.$disconnect();
+    }
+  },
+);