delete_account: re-check the master password, delete on the server, wipe the device

VaultCore::delete_account verifies the password against the keyset (Secret Key from its sealed copy), calls DELETE /v1/account when a server is configured (needs a session; a failure deletes nothing), then wipes the local store and keeps only the device identity. Unit test plus a live test against a real server. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-22 16:12:46 +09:00
parent 86e90569f2
commit a564633ffb
4 changed files with 98 additions and 1 deletions
@@ -290,6 +290,15 @@ impl ApiClient {
        r
    }

+    /// Deletes the account and everything stored for it on the server (docs/03 "Deleting the account").
+    pub async fn delete_account(&self) -> Result<(), SyncError> {
+        let r = self.no_content(Method::DELETE, PATH_ACCOUNT, None::<&()>, true).await;
+        if r.is_ok() {
+            self.set_session(None);
+        }
+        r
+    }
+
    pub async fn account(&self) -> Result<AccountInfo, SyncError> {
        self.json(Method::GET, PATH_ACCOUNT, None::<&()>, None, true).await
    }