bnbalsamo / ipseity / 69

89%

Pull #6

travis-ci

I made it so that account 'deletion' is actually account deactivation, which retains the user record in order to prevent a new user from creating a recently deleted user name and having someone with a stale access token for the same username access the account. This means that the worst case scenario, rather than an unauthorized login, is external services recognizing a user account until stale access tokens expire, and that username being unavailable until an administrator manually deletes the database record, which should only occur _after_ the maximum possible amount of time a previously generated access_token can be valid for. I made no assumptions about the validity time of previously generated access_tokens, because it can be dynamically configured.

36 of 36 new or added lines in 2 files covered. (100.0%)

220 of 251 relevant lines covered (87.65%)

0.88 hits per line