Documentation

DeleteAccountController extends AuthenticatedController
in package

Delete Account Controller - User Account Deletion

Handles user account deletion with CSRF protection. Only accessible to authenticated users who can delete their own account.

Features:

  • Display account deletion confirmation form
  • CSRF token validation
  • Permanent account deletion
  • Automatic logout after deletion
  • Success/error feedback with flash messages
Tags
version
1.0.0
author

BdeLive Team

see
AuthenticatedController

For authentication requirements

see
UserManager

For database operations

Table of Contents

Properties

$app  : Application
$auth  : AuthManager
$csrf  : CsrfProtection
$request  : Request
$response  : Response
$session  : SessionManager
$userManager  : UserManager
User manager instance for database operations

Methods

__construct()  : void
Constructor - Handle account deletion form and submission
getCsrfTokenForJs()  : string
Get the CSRF token for JavaScript usage
redirect()  : never
Redirect to a URL
redirectWithError()  : never
Redirect with an error message
redirectWithSuccess()  : never
Redirect with a success message
render()  : void
Render a view with automatic variable injection
setError()  : void
Set an error flash message
setFlash()  : void
Set a flash message
setInfo()  : void
Set an info flash message
setSuccess()  : void
Set a success flash message
setWarning()  : void
Set a warning flash message
validateCsrf()  : bool
Validate the CSRF token from the request
handleDelete()  : void
Process account deletion

Properties

Methods

__construct()

Constructor - Handle account deletion form and submission

public __construct() : void

GET request: Displays the account deletion confirmation page POST request: Processes the account deletion

getCsrfTokenForJs()

Get the CSRF token for JavaScript usage

protected getCsrfTokenForJs() : string

This method is useful for embedding the token in JavaScript or as a meta tag for automatic AJAX injection.

Return values
string —

The current CSRF token

redirect()

Redirect to a URL

protected redirect(string $url) : never
Parameters
$url : string

Destination URL

Return values
never —

Terminates execution

redirectWithError()

Redirect with an error message

protected redirectWithError(string $url, string $message) : never
Parameters
$url : string

Destination URL

$message : string

Error message

Return values
never —

Terminates execution

redirectWithSuccess()

Redirect with a success message

protected redirectWithSuccess(string $url, string $message) : never
Parameters
$url : string

Destination URL

$message : string

Success message

Return values
never —

Terminates execution

render()

Render a view with automatic variable injection

protected render(string $viewPath[, array<string, mixed> $data = [] ]) : void

This method automatically injects services and data that all views need, eliminating the need to directly access $_SESSION or global functions.

Automatically injected variables:

  • $csrf: CsrfProtection service
  • $auth: AuthManager service
  • $request: Request object
  • $flash: Flash messages array (success, error, warning, info)
  • $user: Current user data (null if not logged in)
Parameters
$viewPath : string

View path (e.g., 'users/loginPageView')

$data : array<string, mixed> = []

View-specific data

setError()

Set an error flash message

protected setError(string $message) : void
Parameters
$message : string

Error message

setFlash()

Set a flash message

protected setFlash(string $type, string $message) : void
Parameters
$type : string

Message type (success, error, warning, info)

$message : string

Message to display

setInfo()

Set an info flash message

protected setInfo(string $message) : void
Parameters
$message : string

Info message

setSuccess()

Set a success flash message

protected setSuccess(string $message) : void
Parameters
$message : string

Success message

setWarning()

Set a warning flash message

protected setWarning(string $message) : void
Parameters
$message : string

Warning message

validateCsrf()

Validate the CSRF token from the request

protected validateCsrf([string|null $token = null ]) : bool

Supports both traditional POST body tokens and modern AJAX header tokens. Checks in order:

  1. Provided token parameter
  2. POST body 'csrf_token' field
  3. X-CSRF-Token HTTP header (for AJAX requests)
Parameters
$token : string|null = null

Token to validate (if null, retrieves from POST or header)

Return values
bool —

True if valid, false otherwise

handleDelete()

Process account deletion

private handleDelete() : void

Validates CSRF token, validates email confirmation, deletes the user account from database, logs out the user, and redirects to home page with success message.

Return values
void —

Redirects to home page or delete_account page on error


        

        
    




    

    

                                

                

                                
    

        On this page

        
    


                

                            

            

    

        

            
Search results