From c55d1144a730e71e8435b0571678a27bebf493e9 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Fri, 7 Aug 2026 17:48:20 +0530 Subject: [PATCH] fix!: deleteUser takes id, not email MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors authorizerdev/authorizer#753. Email is not an identifier every account has — a phone-only signup has none — so an email-keyed delete could not reach those accounts at all, and there was no second way in. BREAKING CHANGE: DeleteUserRequest.email is replaced by DeleteUserRequest.id. Requires server 2.4.0+; the server removed the email field rather than accepting both. --- src/admin.ts | 2 +- src/types.ts | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/admin.ts b/src/admin.ts index 381484d..8d22421 100644 --- a/src/admin.ts +++ b/src/admin.ts @@ -358,7 +358,7 @@ export class AuthorizerAdmin { params as unknown as Record, ); - // deleteUser deletes a user (and associated OTP/verification data) by email. + // deleteUser deletes a user (and associated OTP/verification data) by id. // DESTRUCTIVE: the user and their auth artifacts are permanently removed. deleteUser = ( params: Types.DeleteUserRequest, diff --git a/src/types.ts b/src/types.ts index 04d3173..888cb3e 100644 --- a/src/types.ts +++ b/src/types.ts @@ -372,8 +372,12 @@ export interface ResetPasswordRequest { export type ResetPasswordInput = ResetPasswordRequest; // DeleteUserRequest (admin only) +// +// BREAKING (server 2.4.0): this took `email` and now takes `id`. Email is not +// an identifier every account has — a phone-only signup has none — so an +// email-keyed delete could not reach those accounts at all. export interface DeleteUserRequest { - email: string; + id: string; } // Fine-grained authorization (FGA) types — the client-facing surface of