Account deletion for Supabase and Firebase apps, mapped and built with Codex

# Pass 1: inventory only. Codex can read, search and answer, but not edit.
cd my-app
codex --sandbox read-only --ask-for-approval on-request

# Paste this into the session:
#   Read AGENTS.md. Find every place this codebase stores or sends data about a
#   user: auth providers, Firestore collections and subcollections (and the field
#   that links each document to the user), Cloud Storage paths, server logs,
#   third parties that receive user data (RevenueCat, Stripe, OneSignal, email,
#   analytics, error tracking) and what the web app keeps on the device
#   (cookies, localStorage, IndexedDB, values written with writevalue://).
#   Output one Markdown table: location | link to the user | delete or retain | reason.
#   Mark anything you are unsure about. Do not propose code yet.

# When the table is right, switch to write access inside the session with
# /permissions and ask Codex to save it as docs/user-data-map.md. Commit it.

// server/routes/account.js (Express + firebase-admin)
import express from "express";
import { getAuth } from "firebase-admin/auth";
import { getFirestore } from "firebase-admin/firestore";
import { getStorage } from "firebase-admin/storage";

export const accountRouter = express.Router();
const OWNED = [["projects", "ownerId"], ["comments", "authorId"], ["pushDevices", "uid"]]; // from docs/user-data-map.md

accountRouter.delete("/api/account", async (req, res) => {
  const idToken = (req.get("Authorization") || "").replace(/^Bearer /, "");
  let user;
  try {
    user = await getAuth().verifyIdToken(idToken, true); // true = reject revoked tokens
  } catch {
    return res.status(401).json({ error: "unauthenticated" });
  }
  if (Date.now() / 1000 - user.auth_time > 300) {
    return res.status(403).json({ error: "recent-login-required" });
  }
  const uid = user.uid;
  const db = getFirestore();

  await getStorage().bucket().deleteFiles({ prefix: "users/" + uid + "/" });
  for (const [name, field] of OWNED) {
    const owned = await db.collection(name).where(field, "==", uid).get();
    for (const doc of owned.docs) await db.recursiveDelete(doc.ref);
  }
  await db.recursiveDelete(db.collection("users").doc(uid));
  await getAuth().deleteUser(uid); // last: everything above is safe to re-run
  res.status(204).end();
});

// src/lib/deleteAccount.js (client, Firebase JS SDK)
import { OAuthProvider, reauthenticateWithPopup, revokeAccessToken } from "firebase/auth";
import { isNativeApp } from "./platform";

export async function deleteAccount(auth) {
  const user = auth.currentUser;
  if (user.providerData.some((p) => p.providerId === "apple.com")) {
    const result = await reauthenticateWithPopup(user, new OAuthProvider("apple.com"));
    const credential = OAuthProvider.credentialFromResult(result);
    await revokeAccessToken(auth, credential.accessToken); // Apple 5.1.1(v)
  }
  const res = await fetch("/api/account", {
    method: "DELETE",
    headers: { Authorization: "Bearer " + (await user.getIdToken(true)) }
  });
  if (res.status === 403) throw new Error("recent-login-required");
  if (!res.ok) throw new Error("delete-failed");
  await auth.signOut();
  if (isNativeApp()) window.location.href = "reset://"; // WebViewGold clears cookies and cache
}