mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 21:32:18 +00:00
Marc-André Bombeck
be78517500
A handover link stayed claimable after its profile was deleted: the claim gave the profile credentials that every sign-in then refused, and the purge erased the account someone had just taken over. Locking an account for deletion now revokes the open links for that profile and the links that account minted, and creating, previewing and claiming a link refuse a profile pending deletion, the claim under the record lock. The last-Guardian rule counted Guardians pending deletion and profiles pending deletion. A Guardian who had deleted their only profile could not delete their own account; two Guardians sharing a profile could both leave, and the second one's erasure was then refused on every run. The rule now counts only Guardians whose account is not pending deletion, ignores profiles pending deletion, and is decided under the record lock for account deletion, data wipe, revoking and renouncing a Guardian. An admin's undo of a managed profile with no such Guardian left is refused (409 account.deletion.no_guardian).