From 2449202b5d0dee2808797d8152ae70834ead0dd9 Mon Sep 17 00:00:00 2001
From: Cory McWilliams <cory@unprompted.com>
Date: Tue, 9 Dec 2025 18:02:47 -0500
Subject: [PATCH] core: Move core.deleteUser() to C.

---
 core/core.js | 17 -------------
 src/api.js.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+), 17 deletions(-)

diff --git a/core/core.js b/core/core.js
index ec584644..6b79f930 100644
--- a/core/core.js
+++ b/core/core.js
@@ -391,23 +391,6 @@ exports.getProcessBlob = async function getProcessBlob(blobId, key, options) {
 					throw new Error('Must be signed-in to create an account.');
 				}
 			};
-			if (process.credentials?.permissions?.administration) {
-				imports.core.deleteUser = async function (user) {
-					await imports.core.permissionTest('delete_user');
-					let db = new Database('auth');
-					db.remove('user:' + user);
-					let users = new Set();
-					let users_original = await db.get('users');
-					try {
-						users = new Set(JSON.parse(users_original));
-					} catch {}
-					users.delete(user);
-					users = JSON.stringify([...users].sort());
-					if (users !== users_original) {
-						await db.set('users', users);
-					}
-				};
-			}
 			if (options.api) {
 				imports.app = {};
 				for (let i in options.api) {
diff --git a/src/api.js.c b/src/api.js.c
index a51ec352..b2a2b1c6 100644
--- a/src/api.js.c
+++ b/src/api.js.c
@@ -9,6 +9,12 @@
 
 #include <quickjs.h>
 
+#include <stdlib.h>
+
+#if !defined(__APPLE__) && !defined(__OpenBSD__) && !defined(_WIN32)
+#include <alloca.h>
+#endif
+
 typedef struct _app_path_pair_t
 {
 	const char* app;
@@ -1088,6 +1094,68 @@ static JSValue _tf_ssb_globalSettingsSet(JSContext* context, JSValueConst this_v
 	return result;
 }
 
+typedef struct _delete_user_t
+{
+	const char* user;
+	bool completed;
+	JSValue result;
+	JSValue promise[2];
+} delete_user_t;
+
+static void _tf_ssb_delete_user_work(tf_ssb_t* ssb, void* user_data)
+{
+	delete_user_t* work = user_data;
+	size_t length = strlen("user:") + strlen(work->user) + 1;
+	char* buffer = alloca(length);
+	snprintf(buffer, length, "user:%s", work->user);
+	tf_ssb_db_remove_property(ssb, "auth", buffer);
+	tf_ssb_db_remove_value_from_array_property(ssb, "auth", "users", work->user);
+	work->completed = true;
+}
+
+static void _tf_ssb_delete_user_after_work(tf_ssb_t* ssb, int status, void* user_data)
+{
+	delete_user_t* work = user_data;
+	JSContext* context = tf_ssb_get_context(ssb);
+	JSValue error = JS_Call(context, work->promise[0], JS_UNDEFINED, 1, &work->result);
+	JS_FreeValue(context, work->result);
+	tf_util_report_error(context, error);
+	JS_FreeValue(context, error);
+	JS_FreeValue(context, work->promise[0]);
+	JS_FreeValue(context, work->promise[1]);
+	JS_FreeCString(context, work->user);
+	tf_free(work);
+}
+
+static void _tf_ssb_delete_user_permission_callback(JSContext* context, bool granted, JSValue value, void* user_data)
+{
+	delete_user_t* work = user_data;
+	tf_task_t* task = tf_task_get(context);
+	tf_ssb_t* ssb = tf_task_get_ssb(task);
+	if (granted)
+	{
+		tf_ssb_run_work(ssb, _tf_ssb_delete_user_work, _tf_ssb_delete_user_after_work, work);
+	}
+	else
+	{
+		_tf_ssb_delete_user_after_work(ssb, -1, work);
+	}
+}
+
+static JSValue _tf_ssb_delete_user(JSContext* context, JSValueConst this_val, int argc, JSValueConst* argv, int magic, JSValue* data)
+{
+	delete_user_t* work = tf_malloc(sizeof(delete_user_t));
+	*work = (delete_user_t) {
+		.user = JS_ToCString(context, argv[0]),
+	};
+	JSValue result = JS_NewPromiseCapability(context, work->promise);
+
+	char description[256] = "";
+	snprintf(description, sizeof(description), "Delete user '%s'.", work->user);
+	_tf_ssb_permission_test(context, data[0], "delete_user", description, _tf_ssb_delete_user_permission_callback, work);
+	return result;
+}
+
 static JSValue _tf_api_register_imports(JSContext* context, JSValueConst this_val, int argc, JSValueConst* argv)
 {
 	JSValue imports = argv[0];
@@ -1125,6 +1193,8 @@ static JSValue _tf_api_register_imports(JSContext* context, JSValueConst this_va
 		JS_SetPropertyStr(context, core, "globalSettingsGet", JS_NewCFunction(context, _tf_ssb_globalSettingsGet, "globalSettingsGet", 1));
 		JS_SetPropertyStr(context, core, "globalSettingsSet", JS_NewCFunctionData(context, _tf_ssb_globalSettingsSet, 2, 0, 1, &process));
 
+		JS_SetPropertyStr(context, core, "deleteUser", JS_NewCFunctionData(context, _tf_ssb_delete_user, 0, 0, 1, &process));
+
 		JS_SetPropertyStr(context, ssb, "addBlock", JS_NewCFunctionData(context, _tf_ssb_add_block, 1, 0, 1, &process));
 		JS_SetPropertyStr(context, ssb, "removeBlock", JS_NewCFunctionData(context, _tf_ssb_remove_block, 1, 0, 1, &process));
 		JS_SetPropertyStr(context, ssb, "getBlocks", JS_NewCFunctionData(context, _tf_ssb_get_blocks, 0, 0, 1, &process));