Delete My Account

GDPR Article 17 — right-to-erasure, soft-delete with 24 h grace.

Round-3 hostile-review fix T0-5 — the round-2 endpoint did a synchronous hard-delete which meant a leaked key alone could cause irreversible loss in one POST. This version:

• Sets deleted_at = now() and adds the key to the Redis revocation blocklist (instant authentication failure).
• Writes an account_audit row (HMAC lookup, IP, event).
• Returns 202 with the grace_expires_at ISO timestamp so the UI can surface "you have 24 h to cancel by POST /api/account/delete/cancel".
• Per-key rate limit of 1 init/hour.

A background worker (expire_pending_account_deletes called by epwtools-monitor.timer) hard-deletes rows whose deleted_at is older than ACCOUNT_DELETE_GRACE_HOURS.

Leaked-key-alone attacker can still initiate but cannot cause irreversible loss for 24 h, which is the audit window the user now has to notice and POST /cancel.

Round-3 hostile-review T1-28 — defense-in-depth: explicit _check_csrf_origin call on top of the global middleware so this destructive endpoint stays CSRF-protected even if a future refactor accidentally adds it to _CSRF_EXEMPT_PREFIXES.