diff --git a/service/auth.go b/service/auth.go index 622c9b2..add4e03 100644 --- a/service/auth.go +++ b/service/auth.go @@ -328,7 +328,31 @@ func HandleDeleteAccountComp(db *sql.DB) http.HandlerFunc { return } - _, err := db.Exec("DELETE FROM workout WHERE user_id = ?", user.Id) + password := r.FormValue("password") + if password == "" { + utils.TriggerToast(w, r, "error", "Password is required") + return + } + + var ( + storedHash []byte + salt []byte + ) + + err := db.QueryRow("SELECT password, salt FROM user WHERE user_uuid = ?", user.Id).Scan(&storedHash, &salt) + if err != nil { + utils.LogError("Could not get password", err) + utils.TriggerToast(w, r, "error", "Internal Server Error") + return + } + + currHash := getHashPassword(password, salt) + if subtle.ConstantTimeCompare(currHash, storedHash) == 0 { + utils.TriggerToast(w, r, "error", "Password is not correct") + return + } + + _, err = db.Exec("DELETE FROM workout WHERE user_id = ?", user.Id) if err != nil { utils.LogError("Could not delete workouts", err) utils.TriggerToast(w, r, "error", "Internal Server Error") diff --git a/template/auth/delete_account.templ b/template/auth/delete_account.templ index 8663752..220538d 100644 --- a/template/auth/delete_account.templ +++ b/template/auth/delete_account.templ @@ -1,16 +1,22 @@ package auth templ DeleteAccountComp() { -
-
-
-

Delete Account

-

Do you really want to delete all your data? This cannot be undone!

-
- Cancel - -
-
-
-
+
+

+ Delete Account +

+

+ Are you sure you want to delete your account? This action is irreversible. +

+ + +
}