Improve the reliability and safety of user account lifecycle operations across the platform. Currently, deleting or modifying auth accounts can have unintended cascading effects on workspace data. This item covers making account operations more predictable and recoverable.
Why this matters
Account deletion today is destructive: removing an auth account cascades into the workspace tables and wipes associated rows (team membership, viewer preferences, editor assignments). Admins need to be able to revoke access or clean up accounts without accidentally destroying the work history tied to those users.
How it works
Account lifecycle shifts from hard deletion to a soft-delete model with explicit restore paths:
- Graceful deactivation: Removing a user disables login but preserves the workspace rows and audit history tied to that account.
- Soft-delete with retention: Deleted accounts move into a retention window. During that window the account can be restored with all data intact. After expiry, cleanup runs as a controlled background job, not as an immediate cascade.
- Re-provisioning: If a deactivated user is re-added, their previous workspace data (role, assignments, preferences) is reattached rather than recreated from scratch.
- Unified lifecycle hooks: A single account lifecycle path handles create / deactivate / restore / purge consistently across admins, editors, members, and viewers — no more table-specific logic that silently drifts.
Scope
- Schema: soft-delete columns (`deleted_at`, retention policy) on all user-type tables
- Backend: lifecycle service that replaces direct CASCADE deletes
- Admin UI: separate "deactivate" vs "delete permanently" actions with clear warnings
- Background job: scheduled purge after retention window expires
- Audit log coverage for every lifecycle transition