Files

Siavash Sameni dceaf82934 audit: 2026-05-30 full-codebase audit — report, issues, docs, runbooks

Full-codebase-audit 2026-05-30 outputs:
- Audit report: 09 - Audits/Full Codebase Audit - 2026-05-30.md
- 81 issue files ISSUE-055..135 (decisions + 1 skipped no-brainer).
- Scanner docs from scratch (was zero): architecture, data model, API ref, payment
  flow, operations runbook + repo README.
- Doc-sync updates across API reference, data models, flows, design system.
- Secret Rotation Runbook (08 - Operations) for the exposed credentials.
- Reusable workflow guide (07 - Development) + .claude/workflows/full-codebase-audit.js.

Issues remain status:open intentionally — the code fixes are uncommitted-then-committed
working-tree changes per repo and aren't "resolved" until merged/deployed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-30 18:48:04 +04:00

1.5 KiB

Raw Permalink Blame History

issue, title, severity, domain, status, resolved, fix, labels, status, created, source

issue

title

severity

domain

status

resolved

fix

labels

status

created

source

007

Frontend deleteAccount action calls DELETE /user/profile which has no backend route — account deletion is broken

critical

Authentication

resolved

2026-05-29

Updated deleteAccount in account.ts to call DELETE /auth/account (endpoints.auth.deleteAccount) — the route that exists in authRoutes.ts. Added deleteAccount entry to endpoints.auth in axios.ts.

bug

frontend

critical

broken-feature

open

2026-05-29

Doc vs Code Audit 2026-05-29

🔴 Frontend deleteAccount action calls DELETE /user/profile which has no backend route — account deletion is broken

Severity: critical Domain: Authentication Labels: bug, frontend, critical, broken-feature

Description

The frontend deleteAccount action in src/actions/account.ts (line 144) calls axiosInstance.delete(endpoints.users.profile) which resolves to DELETE /user/profile. The actual soft-delete route is DELETE /api/auth/account (requires password in body, runs deleteAccountValidation). Account deletion silently returns 404 from every UI path.

Current Behavior

DELETE /user/profile returns 404. Users cannot delete their accounts from the UI.

Expected Behavior

deleteAccount action should call DELETE /api/auth/account with the user's password in the request body.

Affected Files

frontend/src/actions/account.ts
frontend/src/lib/axios.ts

References

Doc vs Code Audit Report

1.5 KiB Raw Permalink Blame History