From 2ad7a55e34da8a452d2d5ce58a6f5b3737a72ee8 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 21 Sep 2026 16:15:31 +0100
Subject: [PATCH] Add missing Account/Delete confirmation page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The POST Delete(UnregisterViewModel) action and the GET Delete() action
both existed in AccountController, but Views/Account/Delete.cshtml was
missing — so GET /Account/Delete had no page to render. Add the
confirmation view (posts back to Delete with the user's UserId, with a
"Confirmer la suppression" button and an "Annuler" cancel link).

Add a smoke test: an authenticated GET /Account/Delete returns 200 and
the confirmation page body.

Co-Authored-By: Claude Code <noreply@anthropic.com>
---
 .../Smoke/AccountSmokeTests.cs                | 23 +++++++++++++++++++
 .../Accounting/AccountController.cs           |  1 +
 src/Yavsc.Org/Views/Account/Delete.cshtml     | 21 +++++++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 src/Yavsc.Org/Views/Account/Delete.cshtml

diff --git a/src/Yavsc.Org.Tests/Smoke/AccountSmokeTests.cs b/src/Yavsc.Org.Tests/Smoke/AccountSmokeTests.cs
index 5e7ab7776..4a7600596 100644
--- a/src/Yavsc.Org.Tests/Smoke/AccountSmokeTests.cs
+++ b/src/Yavsc.Org.Tests/Smoke/AccountSmokeTests.cs
@@ -3,6 +3,7 @@ using System.Net.Http;
 using IdentityServer8.Stores;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.Extensions.DependencyInjection;
+using Yavsc.Tests.Shared;
 using Xunit;
 
 namespace Yavsc.Org.Tests.Smoke;
@@ -65,4 +66,26 @@ public class AccountSmokeTests : IClassFixture<TestWebApplicationFactory>
         Assert.Equal("/signin", location.AbsolutePath);
         Assert.Contains("ReturnUrl=%2FEstimate", location.Query);
     }
+
+    // Regression: the POST Delete action existed, but neither the GET
+    // Delete view nor a rendered confirmation page was reachable —
+    // Views/Account/Delete.cshtml was missing. An authenticated GET
+    // must now return the confirmation page (200).
+    [Fact]
+    public async Task Authenticated_get_account_delete_returns_confirmation_page()
+    {
+        var client = _factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false,
+        });
+        client.DefaultRequestHeaders.Add(
+            TestAuthPolicyProvider.HeaderName, TestAuthPolicyProvider.AdminRole);
+
+        var response = await client.GetAsync("/Account/Delete", TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        var body = await response.Content.ReadAsStringAsync(
+            TestContext.Current.CancellationToken);
+        Assert.Contains("Supprimer mon compte", body);
+    }
 }
diff --git a/src/Yavsc.Org/Controllers/Accounting/AccountController.cs b/src/Yavsc.Org/Controllers/Accounting/AccountController.cs
index 04f60aa1d..f8fa7f0d2 100644
--- a/src/Yavsc.Org/Controllers/Accounting/AccountController.cs
+++ b/src/Yavsc.Org/Controllers/Accounting/AccountController.cs
@@ -1061,6 +1061,7 @@ IHtmlLocalizerFactory htmlLocalizerFactory,
             }
             return View();
         }
+
         [HttpPost, Authorize]
         public async Task<IActionResult> Delete(UnregisterViewModel model)
         {
diff --git a/src/Yavsc.Org/Views/Account/Delete.cshtml b/src/Yavsc.Org/Views/Account/Delete.cshtml
new file mode 100644
index 000000000..7443d3d2a
--- /dev/null
+++ b/src/Yavsc.Org/Views/Account/Delete.cshtml
@@ -0,0 +1,21 @@
+@model UnregisterViewModel
+@{
+    ViewBag.Title = "Supprimer mon compte";
+}
+
+<h2>@ViewBag.Title</h2>
+
+<div class="row">
+    <div class="col-md-8">
+        <p>
+            Cette action est <strong>immédiate et irréversible</strong>. Toutes les données
+            associées à votre compte seront supprimées, et vous serez déconnecté.
+        </p>
+
+        <form asp-controller="Account" asp-action="Delete" method="post" class="form-horizontal" role="form">
+            @Html.Hidden("UserId")
+            <button type="submit" class="btn btn-danger">Confirmer la suppression</button>
+            <a asp-controller="Home" asp-action="Index" class="btn btn-default">Annuler</a>
+        </form>
+    </div>
+</div>
\ No newline at end of file