feat(account): self-service deletion with a 7-day cooling-off period

Request signs out everywhere and freezes paid routes (423 + DB triggers);
signing in within 7 days shows the pending gate with 撤销注销. A periodic
idempotent worker purges personal content afterwards and keeps finance
rows against a tombstoned identity. Read-only admin list.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N4f2nya58RoRu4yEmJgRGE

frontend/src/app/(app)/layout.tsx

@@ -2,6 +2,7 @@
 
 import type { ReactNode } from "react";
 
+import { AccountDeletionGate } from "@/components/account-deletion-gate";
 import { AppSidebar } from "@/components/app-sidebar";
 import { LegalConsentGate } from "@/components/legal/legal-consent-gate";
 import { SidebarInset, SidebarProvider } from "@/components/ui/sidebar";
@@ -35,6 +36,7 @@ function AppShell({ children }: { children: ReactNode }) {
         </SidebarInset>
         <LegalConsentGate signedIn={Boolean(account) && !list.signedOut} />
       </main>
+      <AccountDeletionGate signedIn={Boolean(account)} />
     </SidebarProvider>
   );
 }

frontend/src/app/(app)/page.tsx

@@ -7,6 +7,7 @@ import { useEffect, useMemo, useRef, useState } from "react";
 import type { FormEvent, KeyboardEvent } from "react";
 import { AccountDialogOverlay, type AccountOverlayModel } from "@/components/account-dialog-overlay";
 import { ProfilePanel } from "@/components/profile-panel";
+import { AccountDeletionSection } from "@/components/account-deletion-section";
 import { ThemePreferencePanel } from "@/components/theme-preference-menu";
 import type { BirthTimeAssessmentPhase } from "@/components/birth-time-assessment-overlay";
 import { AppLoadingIndicator } from "@/components/app-loading-indicator";
@@ -1138,7 +1139,7 @@ export default function Home() {
     ),
 
     renderGeneral() {
-      return <ThemePreferencePanel />;
+      return <><ThemePreferencePanel /><AccountDeletionSection /></>;
     },
     renderLogout() {
       return (

frontend/src/app/admin/account-deletions/page.tsx

@@ -0,0 +1,2 @@
+import AccountDeletionsResource from "@/components/admin/account-deletions-resource";
+export default function Page() { return <AccountDeletionsResource />; }

frontend/src/app/api/account/deletion/route.ts

@@ -0,0 +1,90 @@
+import { NextResponse } from "next/server";
+
+import {
+  accountDeletionRequestErrorCode,
+  isAccountDeletionConfirmation,
+  parseAccountDeletionStatus,
+} from "@/lib/account-deletion";
+import { readPendingAccountDeletion } from "@/lib/account-deletion-server";
+import { checkSameOrigin, resolveAllowedReportOrigins } from "@/lib/personal-report-entitlement";
+import { createAdminSupabaseClient } from "@/lib/supabase/admin";
+import { createServerSupabaseClient } from "@/lib/supabase/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+/**
+ * Self-service account deletion (2026-09-30).
+ * GET    → { status: "none" } | { status: "pending", scheduledFor }
+ * POST   { confirm: "注销" } → request; every session of the account is ended.
+ * DELETE → cancel while still within the 7 days.
+ */
+
+async function currentUserId(): Promise<string | null> {
+  const supabase = await createServerSupabaseClient();
+  const { data: { user }, error } = await supabase.auth.getUser();
+  return error || !user ? null : user.id;
+}
+
+function crossOrigin(request: Request): NextResponse | null {
+  const decision = checkSameOrigin(
+    request.url,
+    request.headers.get("origin"),
+    resolveAllowedReportOrigins(process.env),
+    request.headers,
+  );
+  return decision.ok ? null : NextResponse.json({ error: "跨域请求被拒绝", code: decision.code }, { status: 403 });
+}
+
+export async function GET() {
+  const userId = await currentUserId();
+  if (!userId) return NextResponse.json({ error: "请先登录" }, { status: 401 });
+  const scheduledFor = await readPendingAccountDeletion(userId);
+  return NextResponse.json(scheduledFor ? { status: "pending", scheduledFor } : { status: "none" });
+}
+
+export async function POST(request: Request) {
+  const refused = crossOrigin(request);
+  if (refused) return refused;
+  const userId = await currentUserId();
+  if (!userId) return NextResponse.json({ error: "请先登录" }, { status: 401 });
+
+  let body: { confirm?: unknown } = {};
+  try {
+    body = (await request.json()) as { confirm?: unknown };
+  } catch {
+    body = {};
+  }
+  if (!isAccountDeletionConfirmation(body.confirm)) {
+    return NextResponse.json({ error: "请输入「注销」确认。", code: "confirmation_required" }, { status: 400 });
+  }
+
+  const admin = createAdminSupabaseClient();
+  const { data, error } = await admin.rpc("request_account_deletion", { p_user_id: userId });
+  if (error) {
+    const code = accountDeletionRequestErrorCode(error.message);
+    if (code === "admin_account") {
+      return NextResponse.json({ error: "管理员账号不能自助注销，请联系负责人移除权限。", code: "admin_account" }, { status: 403 });
+    }
+    return NextResponse.json({ error: "注销申请暂时没能提交，请稍后再试。", code: "deletion_unavailable" }, { status: 503 });
+  }
+  const status = parseAccountDeletionStatus(data);
+  return NextResponse.json(status.status === "pending" ? status : { status: "pending" });
+}
+
+export async function DELETE(request: Request) {
+  const refused = crossOrigin(request);
+  if (refused) return refused;
+  const userId = await currentUserId();
+  if (!userId) return NextResponse.json({ error: "请先登录" }, { status: 401 });
+
+  const admin = createAdminSupabaseClient();
+  const { data, error } = await admin.rpc("cancel_account_deletion", { p_user_id: userId });
+  if (error) {
+    return NextResponse.json({ error: "撤销暂时没能完成，请稍后再试。", code: "deletion_unavailable" }, { status: 503 });
+  }
+  if (data !== true) {
+    return NextResponse.json({ error: "没有可以撤销的注销申请。", code: "no_pending_deletion" }, { status: 409 });
+  }
+  return NextResponse.json({ status: "none" });
+}

frontend/src/app/api/admin/account-deletions/route.ts

@@ -0,0 +1,82 @@
+import { NextResponse } from "next/server";
+
+import { requirePermission } from "@/lib/admin/auth";
+import { pageOffset, queryAdminRows } from "@/lib/admin/database";
+import {
+  adminErrorResponse,
+  invalidQueryResponse,
+  parseListQuery,
+  readonlyAdminMutation,
+} from "@/lib/admin/http";
+
+export const runtime = "nodejs";
+
+type DeletionRow = {
+  id: string;
+  user_id: string;
+  status: string;
+  requested_at: Date;
+  scheduled_for: Date;
+  cancelled_at: Date | null;
+  completed_at: Date | null;
+  attempt_count: number;
+  error_code: string | null;
+  total_count: string;
+};
+
+const sortColumns = new Map([
+  ["requestedAt", "requested_at"],
+  ["scheduledFor", "scheduled_for"],
+  ["status", "status"],
+]);
+
+export const POST = readonlyAdminMutation;
+export const PUT = readonlyAdminMutation;
+export const PATCH = readonlyAdminMutation;
+export const DELETE = readonlyAdminMutation;
+
+/**
+ * GET /api/admin/account-deletions — read-only (2026-09-30). Status and dates
+ * of self-service deletion requests; no email or name is stored or shown.
+ * After completion the user id belongs to an anonymous tombstone identity.
+ */
+export async function GET(request: Request) {
+  try {
+    await requirePermission("admin.customers.read");
+    const parsed = parseListQuery(request);
+    if (!parsed.success) return invalidQueryResponse(parsed.error.flatten());
+    const { page, pageSize, sort, order, status } = parsed.data;
+    const values: unknown[] = [];
+    const conditions: string[] = [];
+    if (status) {
+      values.push(status);
+      conditions.push(`status = $${values.length}`);
+    }
+    values.push(pageSize, pageOffset(page, pageSize));
+    const sortColumn = sortColumns.get(sort ?? "requestedAt") ?? "requested_at";
+    const rows = await queryAdminRows<DeletionRow>(`
+      select id, user_id, status, requested_at, scheduled_for, cancelled_at, completed_at,
+             attempt_count, error_code, count(*) over()::text as total_count
+      from public.account_deletion_requests
+      ${conditions.length ? `where ${conditions.join(" and ")}` : ""}
+      order by ${sortColumn} ${order === "asc" ? "asc" : "desc"}, id asc
+      limit $${values.length - 1} offset $${values.length}
+    `, values);
+    return NextResponse.json({
+      data: rows.map((row) => ({
+        id: row.id,
+        userId: row.user_id,
+        status: row.status,
+        requestedAt: row.requested_at.toISOString(),
+        scheduledFor: row.scheduled_for.toISOString(),
+        cancelledAt: row.cancelled_at?.toISOString() ?? null,
+        completedAt: row.completed_at?.toISOString() ?? null,
+        attemptCount: row.attempt_count,
+        errorCode: row.error_code,
+      })),
+      total: Number(rows[0]?.total_count ?? 0),
+    });
+  } catch (error) {
+    return adminErrorResponse(error);
+  }
+}

frontend/src/app/api/consult/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { refuseWhenAccountDeletionPending } from "@/lib/account-deletion-server";
 import {
   consultationInputSchema,
   consultationWorkflowReceipt,
@@ -304,6 +305,9 @@ export async function POST(request: Request) {
       { status: 401 },
     );
   }
+  // A pending account deletion freezes the account: nothing new is charged.
+  const frozen = await refuseWhenAccountDeletionPending(user.id);
+  if (frozen) return frozen;
 
   const parsed = chatRequestSchema.safeParse(
     await request.json().catch(() => null),

frontend/src/app/api/rectification/agent/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { refuseWhenAccountDeletionPending } from "@/lib/account-deletion-server";
 import { createAdoptNarrationWriter } from "@/lib/rectification-agentic/v9/adopt-narration-agent";
 import { resolveSessionLanguageModel } from "@/lib/model-catalog";
 import { jsonForSupabaseSetupFailure } from "@/lib/api/service-unavailable";
@@ -61,6 +62,9 @@ export async function POST(request: Request) {
     isStructuredChoice,
     chatSession,
   } = context;
+  // A pending account deletion freezes the account: no rectification turn runs.
+  const frozen = await refuseWhenAccountDeletionPending(userId);
+  if (frozen) return frozen;
 
   const declaredWindowReply = await replyToDeclaredBirthWindow(context);
   if (declaredWindowReply) return declaredWindowReply;

frontend/src/app/api/rectification/cases/open/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { refuseWhenAccountDeletionPending } from "@/lib/account-deletion-server";
 import { jsonForSupabaseSetupFailure } from "@/lib/api/service-unavailable";
 import { createAdminSupabaseClient } from "@/lib/supabase/admin";
 import { isProductEnabled } from "@/lib/product-access";
@@ -48,6 +49,8 @@ export async function POST(request: Request) {
   if (authError || !user) {
     return NextResponse.json({ error: "请先登录" }, { status: 401 });
   }
+  const frozen = await refuseWhenAccountDeletionPending(user.id);
+  if (frozen) return frozen;
 
   if (!await isProductEnabled("rectification")) {
     return NextResponse.json(

frontend/src/app/api/reports/route.ts

@@ -1,4 +1,5 @@
 import { normalizeReportSubjectRequest } from "@/lib/report-subject-request";
+import { refuseWhenAccountDeletionPending } from "@/lib/account-deletion-server";
 import { NextResponse } from "next/server";
 import { LONGFORM_SNAPSHOT_SECTION_ID } from "@/lib/personal-report-longform-snapshot";
 import { resolveMissingBirthTimezoneOffset } from "@/lib/birth-profile-timezone";
@@ -175,6 +176,9 @@ export async function POST(request: Request) {
     const supabase = await createServerSupabaseClient();
     const { data: { user }, error: authError } = await supabase.auth.getUser();
     const userId = authError || !user ? null : user.id;
+    // A pending account deletion freezes the account: no new report is charged.
+    const frozen = userId ? await refuseWhenAccountDeletionPending(userId) : null;
+    if (frozen) return frozen;
     const reportProductEnabled = userId
       ? await isProductEnabled("report_center")
       : false;

frontend/src/app/api/synastry/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { refuseWhenAccountDeletionPending } from "@/lib/account-deletion-server";
 import { z } from "zod";
 import { isProductEnabled } from "@/lib/product-access";
 import { consumeUserRequestRateLimit } from "@/lib/request-rate-limit";
@@ -127,6 +128,8 @@ export async function POST(request: Request) {
     if (authError || !user) {
       return NextResponse.json({ error: "请先登录" }, { status: 401 });
     }
+    const frozen = await refuseWhenAccountDeletionPending(user.id);
+    if (frozen) return frozen;
     if (!await isProductEnabled("compatibility")) {
       return NextResponse.json(
         { error: "合盘服务暂未开放", code: "compatibility_product_disabled" },

frontend/src/app/globals.css

@@ -1904,6 +1904,23 @@ button:disabled:where(:not([data-slot="button"])) { cursor: default; opacity: .4
 .account-info-list dd { min-width: 0; margin: 0; color: var(--color-ink); font-size: var(--type-body-sm); }
 .account-info-list dd small { display: block; margin-top: var(--space-1); color: var(--color-ink-tertiary); font-size: var(--type-caption); }
 .theme-preference-panel { display: grid; gap: var(--space-4); margin-top: var(--space-2); }
+/* 注销账号 (2026-09-30): the last section of 通用设置, set apart by a rule. The
+   confirmation opens in place, not as a second dialog over the settings one. */
+.account-deletion-section { display: grid; gap: var(--space-3); margin-top: var(--space-8); padding-top: var(--space-6); border-top: 1px solid var(--color-border); }
+.account-deletion-open { justify-self: start; min-height: 44px; padding: 0 var(--space-3); border: 1px solid color-mix(in srgb, var(--color-danger) 45%, var(--color-border)); border-radius: var(--radius-md); background: transparent; color: var(--color-danger); font: inherit; font-size: var(--type-body-sm); cursor: pointer; }
+.account-deletion-open:hover { background: var(--color-danger-muted); }
+.account-deletion-confirm { display: grid; gap: var(--space-3); padding: var(--space-4); border: 1px solid color-mix(in srgb, var(--color-danger) 35%, var(--color-border)); border-radius: var(--radius-md); background: var(--color-danger-muted); color: var(--color-ink); font-size: var(--type-body-sm); line-height: 1.6; }
+.account-deletion-confirm p, .account-deletion-confirm ul { margin: 0; }
+.account-deletion-confirm ul { padding-left: 1.2em; }
+.account-deletion-contact { color: var(--color-ink-secondary); }
+.account-deletion-input { display: grid; gap: var(--space-1); }
+.account-deletion-input input { min-height: 44px; padding: 0 var(--space-3); border: 1px solid var(--color-border-strong); border-radius: var(--radius-md); background: var(--color-canvas); color: var(--color-ink); font: inherit; }
+/* 账号注销中: covers the whole app for an account with a pending deletion. */
+.account-deletion-gate { position: fixed; inset: 0; z-index: 90; display: grid; place-items: center; padding: var(--space-6); background: var(--color-canvas-soft); }
+.account-deletion-gate section { width: min(440px, 100%); display: grid; gap: var(--space-4); padding: var(--space-8) var(--space-6); border: 1px solid var(--color-border); border-radius: var(--radius-lg); background: var(--color-canvas); text-align: center; }
+.account-deletion-gate h2 { margin: 0; font-family: var(--font-display); font-size: var(--type-title-lg); font-weight: 500; }
+.account-deletion-gate p { margin: 0; color: var(--color-ink-secondary); line-height: 1.6; }
+.account-deletion-gate .dialog-actions { justify-content: center; }
 .theme-preference-options { display: grid; gap: var(--space-2); }
 .theme-preference-option { min-height: 44px; display: grid; grid-template-columns: 20px minmax(0, 1fr) 18px; align-items: center; gap: var(--space-3); padding: 0 var(--space-3); border: 1px solid var(--color-border); border-radius: var(--radius-md); background: var(--color-canvas); color: var(--color-ink); cursor: pointer; text-align: left; }
 .theme-preference-option:hover, .theme-preference-option[aria-pressed="true"] { border-color: var(--color-action); background: var(--color-action-soft); }