🐛 Bug Description
The account deletion flow deletes the user before invalidating sessions and clearing OTPs. Since invalidateUserSessions() depends on the user record, it fails after prisma.user.delete(), leaving active JWT sessions valid until they expire. Likewise, calling clearOtp() after deletion may prevent proper OTP cleanup.
🔁 Steps to Reproduce
1.Log in to create an active user session.
2.Delete the account.
3.Observe that prisma.user.delete() executes before invalidateUserSessions() and clearOtp().
4.Verify that session invalidation fails because the user no longer exists.
5.Notice that the existing JWT session may continue to remain valid until expiration.
✅ Expected Behavior
1.Active sessions should be invalidated before deleting the user.
2.OTP records should be cleared before user deletion.
3.The user should only be deleted after all cleanup operations complete successfully.
4.No active sessions should remain after an account is deleted.
❌ Actual Behavior
1.The user record is deleted before session invalidation and OTP cleanup are performed.
invalidateUserSessions() runs after the user has been removed, causing the operation to fail due to the missing user record and foreign key constraint.
2.Session invalidation is not completed successfully.
3.Existing JWT sessions may remain active until they naturally expire.
4.OTP cleanup may also fail or be skipped after the user has been deleted.
🏷️ Labels
bug, backend,database,ECSoC'26
🐛 Bug Description
The account deletion flow deletes the user before invalidating sessions and clearing OTPs. Since invalidateUserSessions() depends on the user record, it fails after prisma.user.delete(), leaving active JWT sessions valid until they expire. Likewise, calling clearOtp() after deletion may prevent proper OTP cleanup.
🔁 Steps to Reproduce
1.Log in to create an active user session.
2.Delete the account.
3.Observe that prisma.user.delete() executes before invalidateUserSessions() and clearOtp().
4.Verify that session invalidation fails because the user no longer exists.
5.Notice that the existing JWT session may continue to remain valid until expiration.
✅ Expected Behavior
1.Active sessions should be invalidated before deleting the user.
2.OTP records should be cleared before user deletion.
3.The user should only be deleted after all cleanup operations complete successfully.
4.No active sessions should remain after an account is deleted.
❌ Actual Behavior
1.The user record is deleted before session invalidation and OTP cleanup are performed.
invalidateUserSessions() runs after the user has been removed, causing the operation to fail due to the missing user record and foreign key constraint.
2.Session invalidation is not completed successfully.
3.Existing JWT sessions may remain active until they naturally expire.
4.OTP cleanup may also fail or be skipped after the user has been deleted.
🏷️ Labels
bug, backend,database,ECSoC'26