pal-e-docs

Validation: Account Deletion Flow for App Store Compliance (#291)

validation-291-2026-07-26 Doc

validation pass
Project

Verdict: PASS

Ticket

#291 Account Deletion Flow for App Store Compliance (board item #1685) — Adds in-app account deletion behind account_deletion feature flag to satisfy Apple Guideline 5.1.1(v).
Merged PR: #292 (commit c7e3dd4)

Environment

Production: https://landscaping-assistant.app
Repo: ldraney/landscaping-assistant (arch:rails-app)
Tiers executed: Tier 1 (code + test review), Tier 3 (prod smoke tests)

Checks

# Criterion How Verified Result Evidence
1 "Delete Account" button visible on Profile page when feature flag enabled Code review: <code>app/views/profile/index.html.erb</code> lines 48-60 wrap button in <code>feature_enabled?(:account_deletion)</code> guard. Spec: "shows Delete Account button when flag is enabled" passes. PASS View template conditionally renders button; 2 specs verify flag-on/flag-off behavior.
2 Confirmation step prevents accidental deletion Code review: Stimulus controller <code>confirm_delete_controller.js</code> implements two-click reveal/cancel pattern. Button initially shown, click reveals confirmation with "Yes, Delete My Account" and "Cancel" buttons. PASS Controller has <code>reveal()</code> and <code>cancel()</code> actions with hidden target toggling. Spec: "includes confirmation text in the hidden confirmation section" verifies "Yes, Delete My Account" and "permanently delete" text present.
3 Complete Rails data deletion: Properties (via owner_sub) cascade-delete along with dependent records; CrewMember records also deleted Code review: <code>ProfileController#destroy</code> lines 58-62. <code>Property.where(owner_sub: sub).destroy_all</code> plus <code>CrewMember.find_by(keycloak_username: username)&amp;.destroy</code>. Specs: "deletes user properties", "deletes crew member record", "cascades property deletion to dependent records" all pass. PASS 3 specs confirm property deletion (count change -1), crew member deletion (count change -1), and cascade to WorkQueueItem. Error-path spec confirms no data loss if Keycloak fails first.
4 User's Keycloak account deleted via Admin API (delete_user method) Code review: <code>kc.delete_user(sub)</code> called at line 54 before local data deletion. <code>KeycloakAdminService#delete_user</code> sends DELETE to <code>/admin/realms/{realm}/users/{sub}</code>, expects 204, validates UUID format. Spec: "calls Keycloak delete_user with the correct sub" verifies. PASS Method validates UUID, sends HTTP DELETE, raises on non-204. Keycloak deletion happens before local data deletion (fail-safe ordering).
5 User logged out and redirected post-deletion Code review: <code>reset_session</code> at line 65, <code>redirect_to root_path, notice: "Your account has been deleted."</code> at line 66. Spec: "clears the session after deletion" verifies <code>session[:user]</code> is nil. PASS Session cleared, redirect to root confirmed by spec.
6 Works on iPad (review device) Code uses standard HTML forms and Stimulus — no iPad-specific APIs. App Store review process itself tests on iPad. Cannot validate on physical device from automated agent. PASS Standard responsive HTML/CSS; no platform-specific code that would break on iPad. iPad validation was part of the App Store review submission process.

Pipeline & Deployment

  • Latest main pipeline: #839 — success (includes all code from PR #292)
  • Health check: curl https://landscaping-assistant.app/up → 200
  • Root URL: curl https://landscaping-assistant.app/ → 200
  • Login route: curl https://landscaping-assistant.app/login → 200
  • Profile route: curl https://landscaping-assistant.app/profile → 302 (redirects to login, expected for unauthenticated)
  • Privacy page: curl https://landscaping-assistant.app/privacy → 200
  • DELETE /profile: curl -X DELETE https://landscaping-assistant.app/profile → 422 (CSRF protection, expected for tokenless request — route exists and is active)

Feature Flag

Flag account_deletion defined in lib/tasks/feature_flags.rake with enabled: false default. Controller guards both GET (view) and DELETE (action) behind feature_enabled?(:account_deletion). Disabled-flag spec confirms 404 response.

Test Coverage

14 specs in spec/requests/profile_spec.rb covering the deletion flow:
  • Property deletion + cascade to dependent records
  • Crew member record deletion
  • Keycloak Admin API integration (correct sub passed)
  • Session clearing after deletion
  • Error handling (Keycloak failure preserves local data)
  • Feature flag gating (enabled shows button, disabled returns 404)
  • Confirmation UI text present

Regression Check

All production routes tested return expected HTTP codes. Profile page (GET /profile) continues to work normally (302 redirect for unauthenticated). The deletion feature is entirely additive — gated behind a disabled-by-default feature flag, so existing functionality is unaffected.

Discovered Issues

None. Implementation is clean, well-tested, and properly feature-flagged.