graphql-devise / graphql_devise / 07841c43-ce24-4c90-9cae-529422bbf946

97%

master: 97%

push

circleci

Add opt-in destroy_account mutation

Adds a `destroy_account` mutation that lets an authenticated resource
delete its own account. It destroys `current_resource` and then calls
`remove_resource`, nil-ing the controller resource so devise_token_auth's
`update_auth_header` after_action short-circuits before reloading the
deleted record. This fixes the `ActiveRecord::RecordNotFound` raised when
deleting the signed-in resource.

The operation is opt-in so upgrades never add account deletion to an
existing schema automatically. It is registered with an `allow_destroy`
marker and gated by a new `allow_destroy` mount option: enable it with
`allow_destroy: true` (additive, also works with `skip`) or by listing
`:destroy_account` in `only`. While available but not mounted, a warning
is logged explaining how to opt in; adding `:destroy_account` to `skip`
keeps it out and silences the warning.

Fixes #162, #163

30 of 31 new or added lines in 3 files covered. (96.77%)

828 of 858 relevant lines covered (96.5%)

2089.32 hits per line