mastodon/app/controllers/settings/deletes_controller.rb

# frozen_string_literal: true

class Settings::DeletesController < Settings::BaseController
  skip_before_action :require_functional!

  before_action :require_not_suspended!

  def show
    @confirmation = Form::DeleteConfirmation.new
  end

  def destroy
    if challenge_passed?
      destroy_account!
      redirect_to new_user_session_path, notice: I18n.t('deletes.success_msg')
    else
      redirect_to settings_delete_path, alert: I18n.t('deletes.challenge_not_passed')
    end
  end

  private

  def resource_params
    params.expect(form_delete_confirmation: [:password, :username])
  end

  def require_not_suspended!
    forbidden if current_account.unavailable?
  end

  def challenge_passed?
    username = resource_params[:username].strip.delete_prefix('@')
    return false unless current_account.username.casecmp(username).zero? || current_account.local_username_and_domain.casecmp(username).zero?

    current_user.encrypted_password.blank? || current_user.valid_password?(resource_params[:password])
  end

  def destroy_account!
    current_account.mark_deleted!
    AccountDeletionWorker.perform_async(current_user.account_id)
    sign_out
  end
end