Self-service account deletion

async function deleteMyAccount() {
  // Step 1: ensure AAL2
  const session = await fetch("/api/me").then(r => r.json());
  if (session.aal !== "aal2") {
    window.location.href = "/api/auth/stepup?return_to=" + window.location.pathname;
    return;
  }

  // Step 2: confirm
  const typed = prompt("Type your email to confirm:");
  if (typed !== session.email) return;

  // Step 3: delete
  const res = await fetch("/api/me", { method: "DELETE" });
  if (res.ok) window.location.href = "/account-deleted";
}

export async function DELETE(request: Request) {
  const session = await getSessionFromCookie(request);
  if (!session) return Response.json({ error: "unauth" }, { status: 401 });
  if (session.aal !== "aal2") return Response.json({ error: "aal2_required" }, { status: 403 });

  // Optional: export their data first
  const exportData = await gatherDsrExport(session.identity_id);
  await emailToUser(session.email, exportData);

  // Delete in Kratos
  await fetch(
    `${kratosAdmin}/admin/identities/${session.identity_id}`,
    { method: "DELETE" }
  );

  // Clean up your app-side data
  await db`DELETE FROM user_data WHERE identity_id = ${session.identity_id}`;

  // Anonymize audit log (don't fully delete, retain for compliance)
  await db`UPDATE security_audit SET identity_id = NULL WHERE identity_id = ${session.identity_id}`;

  // Clear cookies on response
  return Response.json({ ok: true }, {
    headers: { "Set-Cookie": "athena-session=; Max-Age=0" }
  });
}

await fetch(`${kratosAdmin}/admin/identities/${id}`, {
  method: "PATCH",
  body: JSON.stringify([
    { op: "replace", path: "/state", value: "inactive" }
  ])
});