feat: redo the dashboard page to support data deletion

.gitignore

···
 .env
 bun.lockb
 data/
+*.db
+*.db-shm
+*.db-wal

src/client/index.ts

···
 const welcome = document.getElementById('welcome') as HTMLElement;
 const subtitle = document.getElementById('subtitle') as HTMLElement;
 const recentApps = document.getElementById('recentApps') as HTMLElement;
+const message = document.getElementById('message') as HTMLElement;
+
+// Profile form elements
 const profileForm = document.getElementById('profileForm') as HTMLFormElement;
-const saveBtn = document.getElementById('saveBtn') as HTMLButtonElement;
-const message = document.getElementById('message') as HTMLDivElement;
-const profileName = document.getElementById('profileName') as HTMLElement;
-const profileUsername = document.getElementById('profileUsername') as HTMLElement;
-const profileAvatar = document.getElementById('profileAvatar') as HTMLElement;
-const avatarInitials = document.getElementById('avatarInitials') as HTMLElement;
-const publicProfileLink = document.getElementById('publicProfileLink') as HTMLAnchorElement;
-const profileLinks = document.getElementById('profileLinks') as HTMLElement;
-
+const avatarPreview = document.getElementById('avatarPreview') as HTMLElement;
+const usernameInput = document.getElementById('username') as HTMLInputElement;
 const nameInput = document.getElementById('name') as HTMLInputElement;
 const emailInput = document.getElementById('email') as HTMLInputElement;
 const photoInput = document.getElementById('photo') as HTMLInputElement;
 const urlInput = document.getElementById('url') as HTMLInputElement;
+const saveBtn = document.getElementById('saveBtn') as HTMLButtonElement;
+const deleteAccountBtn = document.getElementById('deleteAccountBtn') as HTMLButtonElement;
+const dangerZone = document.getElementById('dangerZone') as HTMLElement;
 
-let currentUsername = '';
+let isAdmin = false;
 
 if (!token) {
 	window.location.href = '/login';
···
 	email: string | null;
 	photo: string | null;
 	url: string | null;
+	isAdmin?: boolean;
 }
 
-
-
-function showMessage(text: string, type: 'success' | 'error') {
+function showMessage(text: string, type: 'error' | 'success' = 'error') {
 	message.textContent = text;
 	message.className = `message show ${type}`;
 	setTimeout(() => message.classList.remove('show'), 5000);
+}
+
+function updateAvatarPreview(photo: string | null, username: string) {
+	if (photo) {
+		avatarPreview.innerHTML = `<img src="${photo}" alt="${username}" style="width: 100%; height: 100%; object-fit: cover; border-radius: 50%;" />`;
+	} else {
+		const initials = username.substring(0, 2).toUpperCase();
+		avatarPreview.textContent = initials;
+	}
 }
 
 // Check auth and display user
···
 		}
 
 		const profile = await response.json() as Profile;
-		currentUsername = profile.username;
+
+		// Track admin status to hide delete button for admins
+		isAdmin = profile.isAdmin || false;
+		if (!isAdmin) {
+			dangerZone.style.display = 'block';
+		}
 
 		// Populate form
-		nameInput.value = profile.name;
+		usernameInput.value = profile.username;
+		nameInput.value = profile.name || '';
 		emailInput.value = profile.email || '';
 		photoInput.value = profile.photo || '';
 		urlInput.value = profile.url || '';
 
-		// Initial preview update
-		updatePreview();
-	} catch (error) {
-		console.error('Failed to load profile:', error);
-		showMessage('Failed to load profile', 'error');
-	}
-}
+		updateAvatarPreview(profile.photo, profile.username);
 
-// Handle profile form submission
-profileForm.addEventListener('submit', async (e) => {
-	e.preventDefault();
-
-	const name = nameInput.value.trim();
-	const email = emailInput.value.trim();
-	const photo = photoInput.value.trim();
-	const url = urlInput.value.trim();
-
-	if (!name) {
-		showMessage('Name is required', 'error');
-		return;
-	}
-
-	saveBtn.disabled = true;
-	saveBtn.textContent = 'saving...';
-
-	try {
-		const response = await fetch('/api/profile', {
-			method: 'PUT',
-			headers: {
-				'Authorization': `Bearer ${token}`,
-				'Content-Type': 'application/json',
-			},
-			body: JSON.stringify({
-				name,
-				email: email || null,
-				photo: photo || null,
-				url: url || null,
-			}),
+		// Update avatar preview when photo URL changes
+		photoInput.addEventListener('input', () => {
+			updateAvatarPreview(photoInput.value || null, profile.username);
 		});
-
-		if (!response.ok) {
-			throw new Error('Failed to update profile');
-		}
-
-		showMessage('Profile updated successfully!', 'success');
 	} catch (error) {
-		console.error('Failed to update profile:', error);
-		showMessage('Failed to update profile', 'error');
-	} finally {
-		saveBtn.disabled = false;
-		saveBtn.textContent = 'save profile';
-	}
-});
-
-function updatePreview() {
-	const name = nameInput.value.trim() || 'Your Name';
-	const photo = photoInput.value.trim();
-	const email = emailInput.value.trim();
-	const url = urlInput.value.trim();
-
-	// Update name
-	profileName.textContent = name;
-	profileUsername.textContent = `@${currentUsername}`;
-	avatarInitials.textContent = currentUsername.slice(0, 2).toUpperCase();
-	publicProfileLink.href = `/u/${currentUsername}`;
-
-	// Update photo
-	const existingImg = profileAvatar.querySelector('img');
-	if (photo) {
-		if (existingImg) {
-			existingImg.src = photo;
-			existingImg.alt = name;
-		} else {
-			const img = document.createElement('img');
-			img.src = photo;
-			img.alt = name;
-			profileAvatar.insertBefore(img, avatarInitials);
-		}
-		avatarInitials.style.display = 'none';
-	} else {
-		if (existingImg) {
-			existingImg.remove();
-		}
-		avatarInitials.style.display = '';
+		console.error('Failed to load profile:', error);
+		showMessage('Failed to load profile');
 	}
-
-	// Update links
-	let links = `<a href="/u/${currentUsername}" id="publicProfileLink">view public profile</a>`;
-	if (email) {
-		links += ` • <a href="mailto:${email}">email</a>`;
-	}
-	if (url) {
-		links += ` • <a href="${url}" target="_blank" rel="noopener noreferrer">website</a>`;
-	}
-	profileLinks.innerHTML = links;
 }
-
-// Live update listeners
-nameInput.addEventListener('input', updatePreview);
-emailInput.addEventListener('input', updatePreview);
-photoInput.addEventListener('input', updatePreview);
-urlInput.addEventListener('input', updatePreview);
 
 async function loadRecentApps() {
 	try {
···
 		recentApps.innerHTML = '<div class="empty">Failed to load apps</div>';
 	}
 }
+
+// Profile form submission
+profileForm.addEventListener('submit', async (e) => {
+	e.preventDefault();
+
+	saveBtn.disabled = true;
+	saveBtn.textContent = 'saving...';
+
+	try {
+		const response = await fetch('/api/profile', {
+			method: 'PUT',
+			headers: {
+				'Authorization': `Bearer ${token}`,
+				'Content-Type': 'application/json',
+			},
+			body: JSON.stringify({
+				name: nameInput.value,
+				email: emailInput.value || null,
+				photo: photoInput.value || null,
+				url: urlInput.value || null,
+			}),
+		});
+
+		if (!response.ok) {
+			const error = await response.json();
+			throw new Error(error.error || 'Failed to update profile');
+		}
+
+		showMessage('Profile updated successfully!', 'success');
+	} catch (error) {
+		showMessage((error as Error).message || 'Failed to update profile');
+	} finally {
+		saveBtn.disabled = false;
+		saveBtn.textContent = 'save changes';
+	}
+});
+
+// Delete account handler
+deleteAccountBtn.addEventListener('click', async () => {
+	const confirmMessage = 'Are you absolutely sure you want to delete your account?\n\n' +
+		'This will permanently delete:\n' +
+		'• Your profile and credentials\n' +
+		'• All authorized apps\n' +
+		'• All active sessions\n\n' +
+		'This action CANNOT be undone.\n\n' +
+		'Type "DELETE" to confirm:';
+	
+	const confirmation = prompt(confirmMessage);
+	
+	if (confirmation !== 'DELETE') {
+		if (confirmation !== null) {
+			showMessage('Account deletion cancelled. You must type "DELETE" exactly.');
+		}
+		return;
+	}
+
+	deleteAccountBtn.disabled = true;
+	deleteAccountBtn.textContent = 'deleting...';
+
+	try {
+		const response = await fetch('/api/profile', {
+			method: 'DELETE',
+			headers: {
+				'Authorization': `Bearer ${token}`,
+			},
+		});
+
+		if (!response.ok) {
+			const error = await response.json();
+			throw new Error(error.error || 'Failed to delete account');
+		}
+
+		// Clear session and redirect
+		localStorage.removeItem('indiko_session');
+		showMessage('Account deleted successfully. Redirecting...', 'success');
+		setTimeout(() => {
+			window.location.href = '/login';
+		}, 2000);
+	} catch (error) {
+		showMessage((error as Error).message || 'Failed to delete account');
+		deleteAccountBtn.disabled = false;
+		deleteAccountBtn.textContent = 'delete my account';
+	}
+});
 
 checkAuth();

src/client/profile.ts

···
-const token = localStorage.getItem('indiko_session');
-const profileForm = document.getElementById('profileForm') as HTMLFormElement;
-const avatarPreview = document.getElementById('avatarPreview') as HTMLElement;
-const message = document.getElementById('message') as HTMLElement;
-
-const usernameInput = document.getElementById('username') as HTMLInputElement;
-const nameInput = document.getElementById('name') as HTMLInputElement;
-const emailInput = document.getElementById('email') as HTMLInputElement;
-const photoInput = document.getElementById('photo') as HTMLInputElement;
-const urlInput = document.getElementById('url') as HTMLInputElement;
-
-function showMessage(text: string, type: 'error' | 'success' = 'error') {
-	message.textContent = text;
-	message.className = `message show ${type}`;
-	setTimeout(() => message.classList.remove('show'), 5000);
-}
-
-function updateAvatarPreview(photo: string | null, username: string) {
-	if (photo) {
-		avatarPreview.innerHTML = `<img src="${photo}" alt="${username}" />`;
-	} else {
-		const initials = username.substring(0, 2).toUpperCase();
-		avatarPreview.textContent = initials;
-	}
-}
-
-async function loadProfile() {
-	if (!token) {
-		window.location.href = '/login';
-		return;
-	}
-
-	try {
-		const response = await fetch('/api/profile', {
-			headers: {
-				'Authorization': `Bearer ${token}`,
-			},
-		});
-
-		if (response.status === 401 || response.status === 403) {
-			localStorage.removeItem('indiko_session');
-			window.location.href = '/login';
-			return;
-		}
-
-		if (!response.ok) {
-			throw new Error('Failed to load profile');
-		}
-
-		const profile = await response.json();
-
-		usernameInput.value = profile.username;
-		nameInput.value = profile.name || '';
-		emailInput.value = profile.email || '';
-		photoInput.value = profile.photo || '';
-		urlInput.value = profile.url || '';
-
-		updateAvatarPreview(profile.photo, profile.username);
-
-		// Update avatar preview when photo URL changes
-		photoInput.addEventListener('input', () => {
-			updateAvatarPreview(photoInput.value || null, profile.username);
-		});
-	} catch (error) {
-		console.error('Failed to load profile:', error);
-		showMessage('Failed to load profile');
-	}
-}
-
-profileForm.addEventListener('submit', async (e) => {
-	e.preventDefault();
-
-	const saveBtn = document.getElementById('saveBtn') as HTMLButtonElement;
-	saveBtn.disabled = true;
-	saveBtn.textContent = 'saving...';
-
-	try {
-		const response = await fetch('/api/profile', {
-			method: 'PUT',
-			headers: {
-				'Authorization': `Bearer ${token}`,
-				'Content-Type': 'application/json',
-			},
-			body: JSON.stringify({
-				name: nameInput.value,
-				email: emailInput.value || null,
-				photo: photoInput.value || null,
-				url: urlInput.value || null,
-			}),
-		});
-
-		if (!response.ok) {
-			const error = await response.json();
-			throw new Error(error.error || 'Failed to update profile');
-		}
-
-		showMessage('Profile updated successfully!', 'success');
-		const redirectTimer = setTimeout(() => {
-			window.location.href = '/';
-		}, 1500);
-		(redirectTimer as unknown as number);
-	} catch (error) {
-		showMessage((error as Error).message || 'Failed to update profile');
-		saveBtn.disabled = false;
-		saveBtn.textContent = 'save changes';
-	}
-});
-
-loadProfile();

src/html/index.html

···
   <title>dashboard • indiko</title>
   <meta name="description" content="Your Indiko dashboard - manage your profile, apps, and passkeys" />
   <link rel="icon" href="../../public/favicon.svg" type="image/svg+xml" />
-  
+
   <!-- Open Graph / Facebook -->
   <meta property="og:type" content="website" />
   <meta property="og:title" content="Dashboard • Indiko" />
   <meta property="og:description" content="Your Indiko dashboard - manage your profile, apps, and passkeys" />
-  
+
   <!-- Twitter -->
   <meta name="twitter:card" content="summary" />
   <meta name="twitter:title" content="Dashboard • Indiko" />
···
   <link rel="stylesheet" href="../styles.css">
   <style>
     /* Dashboard-specific styles */
-    .profile-preview {
+    .profile-section {
+      background: rgba(188, 141, 160, 0.05);
+      border: 1px solid var(--old-rose);
+      padding: 2rem;
+      margin-bottom: 2rem;
+    }
+
+    .section-title {
+      font-size: 1.25rem;
+      font-weight: 600;
+      color: var(--lavender);
+      margin-bottom: 1.5rem;
+    }
+
+    .avatar-upload {
       display: flex;
       align-items: center;
       gap: 1.5rem;
-      background: rgba(188, 141, 160, 0.05);
-      border: 1px solid var(--old-rose);
-      padding: 1.5rem;
       margin-bottom: 2rem;
     }
 
···
       width: 80px;
       height: 80px;
       border: 3px solid var(--berry-crush);
+      font-size: 2rem;
+    }
+
+    .avatar-controls {
+      display: flex;
+      flex-direction: column;
+      gap: 0.5rem;
     }
 
     .profile-info {
···
     input[type="text"],
     input[type="email"],
     input[type="url"] {
-      padding: 0.75rem;
-    }
-
-    .save-btn {
-      width: 100%;
-      padding: 0.75rem 1rem;
-      background: var(--berry-crush);
-      border: 2px solid var(--rosewood);
-      color: var(--lavender);
-      font-family: "Space Grotesk", sans-serif;
-      font-size: 1rem;
-      font-weight: 600;
-      text-transform: uppercase;
-      letter-spacing: 0.05rem;
-      cursor: pointer;
-      transition: all 0.2s;
-      box-shadow: none;
-    }
-
-    .save-btn::before {
-      display: none;
+      margin-bottom: 1.5rem;
     }
 
-    .save-btn:hover:not(:disabled) {
-      background: var(--rosewood);
-      transform: none;
+    .button-group {
+      display: flex;
+      gap: 1rem;
+      margin-top: 1.5rem;
     }
 
-    .save-btn:disabled {
-      opacity: 0.5;
-      cursor: not-allowed;
+    .button-group button {
+      flex: 1;
     }
 
     .message {
···
   </header>
 
   <main>
-    <div class="profile-preview">
-      <div class="profile-avatar" id="profileAvatar">
-        <span id="avatarInitials"></span>
-      </div>
-      <div class="profile-info">
-        <div class="profile-name" id="profileName">Loading...</div>
-        <div class="profile-username" id="profileUsername">@username</div>
-        <div class="profile-links" id="profileLinks">
-          <a href="/u/" id="publicProfileLink">view public profile</a>
-        </div>
+    <div id="message" class="message"></div>
+
+    <div class="profile-section">
+      <h2 class="section-title">recent apps</h2>
+      <div id="recentApps" class="apps-preview">
+        <div class="loading">loading...</div>
       </div>
     </div>
 
-    <div class="dashboard-grid">
-      <div class="card">
-        <h2 class="card-title">profile</h2>
-        <form id="profileForm">
-          <div class="form-group">
-            <label for="name">name</label>
-            <input type="text" id="name" name="name" required />
-          </div>
+    <div class="profile-section">
+      <h2 class="section-title">profile settings</h2>
 
-          <div class="form-group">
-            <label for="email">email (optional)</label>
-            <input type="email" id="email" name="email" />
+      <form id="profileForm">
+        <div class="avatar-upload">
+          <div class="profile-avatar" id="avatarPreview">
+            <!-- Avatar will be rendered here -->
           </div>
-
-          <div class="form-group">
-            <label for="photo">photo url (optional)</label>
-            <input type="url" id="photo" name="photo" placeholder="https://example.com/photo.jpg" />
+          <div class="avatar-controls">
+            <label for="photo">avatar url</label>
+            <input type="url" id="photo" name="photo" placeholder="https://example.com/avatar.jpg" />
+            <small style="color: var(--old-rose); font-size: 0.75rem;">Enter a URL to an image</small>
           </div>
+        </div>
 
-          <div class="form-group">
-            <label for="url">website url (optional)</label>
-            <input type="url" id="url" name="url" placeholder="https://example.com" />
-          </div>
+        <label for="username">username</label>
+        <input type="text" id="username" name="username" required disabled />
 
-          <button type="submit" class="save-btn" id="saveBtn">save profile</button>
-          <div id="message" class="message"></div>
-        </form>
-      </div>
+        <label for="name">display name</label>
+        <input type="text" id="name" name="name" required />
 
-      <div class="card">
-        <h2 class="card-title">recent apps</h2>
-        <div id="recentApps" class="apps-preview">
-          <div class="loading">loading...</div>
-        </div>
-      </div>
+        <label for="email">email</label>
+        <input type="email" id="email" name="email" />
+
+        <label for="url">website</label>
+        <input type="url" id="url" name="url" placeholder="https://example.com" />
+
+        <button type="submit" id="saveBtn">save changes</button>
+      </form>
+    </div>
+
+    <div class="profile-section" id="dangerZone" style="border-color: var(--rosewood); display: none;">
+      <h2 class="section-title" style="color: var(--rosewood);">danger zone</h2>
+      <p style="color: var(--old-rose); margin-bottom: 1.5rem; line-height: 1.6;">
+        Permanently delete your account and all associated data. This action cannot be undone.
+      </p>
+      <button type="button" id="deleteAccountBtn" style="width: 100%;">
+        delete my account
+      </button>
     </div>
   </main>
 
···
   <script type="module" src="../client/index.ts"></script>
 </body>
 
-</html>
+</html>

src/html/profile.html

···
-<!doctype html>
-<html lang="en">
-
-<head>
-  <meta charset="UTF-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>profile • indiko</title>
-  <meta name="description" content="Edit your Indiko profile information" />
-  <link rel="icon" href="../../public/favicon.svg" type="image/svg+xml" />
-  
-  <!-- Open Graph / Facebook -->
-  <meta property="og:type" content="website" />
-  <meta property="og:title" content="Edit Profile • Indiko" />
-  <meta property="og:description" content="Edit your Indiko profile information" />
-  
-  <!-- Twitter -->
-  <meta name="twitter:card" content="summary" />
-  <meta name="twitter:title" content="Edit Profile • Indiko" />
-  <meta name="twitter:description" content="Edit your Indiko profile information" />
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@300..700&display=swap" rel="stylesheet">
-  <link rel="stylesheet" href="../styles.css">
-  <style>
-    /* Profile-specific styles */
-    header {
-      align-self: flex-start;
-      margin-left: auto;
-      margin-right: auto;
-    }
-
-    main {
-      display: flex;
-      justify-content: center;
-    }
-
-    .profile-container {
-      width: 100%;
-      max-width: 56.25rem;
-    }
-
-    .profile-section {
-      background: rgba(188, 141, 160, 0.05);
-      border: 1px solid var(--old-rose);
-      padding: 2rem;
-      margin-bottom: 1.5rem;
-    }
-
-    .section-title {
-      font-size: 1.25rem;
-      font-weight: 600;
-      color: var(--lavender);
-      margin-bottom: 1.5rem;
-    }
-
-    .avatar-upload {
-      display: flex;
-      align-items: center;
-      gap: 1.5rem;
-      margin-bottom: 2rem;
-    }
-
-    .avatar-preview {
-      width: 6rem;
-      height: 6rem;
-      font-size: 2rem;
-    }
-
-    .avatar-controls {
-      display: flex;
-      flex-direction: column;
-      gap: 0.5rem;
-    }
-
-    input[type="text"],
-    input[type="email"],
-    input[type="url"] {
-      margin-bottom: 1.5rem;
-    }
-
-    footer {
-      margin-top: 2rem;
-    }
-  </style>
-</head>
-
-<body>
-  <header>
-    <img src="../../public/logo.svg" alt="indiko" style="height: 2rem; margin-bottom: 0.5rem;" />
-  </header>
-
-  <main>
-    <div class="profile-container">
-      <div id="message" class="message"></div>
-
-      <div class="profile-section">
-        <h2 class="section-title">profile settings</h2>
-
-        <form id="profileForm">
-          <div class="avatar-upload">
-            <div class="avatar-preview" id="avatarPreview">
-              <!-- Avatar will be rendered here -->
-            </div>
-            <div class="avatar-controls">
-              <label for="photo">avatar url</label>
-              <input type="url" id="photo" name="photo" placeholder="https://example.com/avatar.jpg" />
-              <small style="color: var(--old-rose); font-size: 0.75rem;">Enter a URL to an image</small>
-            </div>
-          </div>
-
-          <label for="username">username</label>
-          <input type="text" id="username" name="username" required disabled />
-
-          <label for="name">display name</label>
-          <input type="text" id="name" name="name" required />
-
-          <label for="email">email</label>
-          <input type="email" id="email" name="email" />
-
-          <label for="url">website</label>
-          <input type="url" id="url" name="url" placeholder="https://example.com" />
-
-          <div class="button-group">
-            <button type="submit" id="saveBtn">save changes</button>
-            <button type="button" class="button-secondary" onclick="window.location.href='/'">cancel</button>
-          </div>
-        </form>
-      </div>
-    </div>
-  </main>
-
-  <footer>
-    <a href="/">← back to dashboard</a>
-  </footer>
-
-  <script type="module" src="../client/profile.ts"></script>
-</body>
-
-</html>

src/index.ts

···
 import adminInvitesHTML from "./html/admin-invites.html";
 import adminClientsHTML from "./html/admin-clients.html";
 import loginHTML from "./html/login.html";
-import profileHTML from "./html/profile.html";
 import docsHTML from "./html/docs.html";
 import appsHTML from "./html/apps.html";
 import {
···
 	disableUser,
 	enableUser,
 	deleteUser,
+	deleteSelfAccount,
 } from "./routes/api";
 import {
 	authorizeGet,
···
 		"/admin/apps": () => Response.redirect("/admin/clients", 302),
 		"/admin/clients": adminClientsHTML,
 		"/login": loginHTML,
-		"/profile": profileHTML,
 		"/docs": docsHTML,
 		"/apps": appsHTML,
 		// Well-known endpoints
···
 		"/api/profile": (req: Request) => {
 			if (req.method === "GET") return getProfile(req);
 			if (req.method === "PUT") return updateProfile(req);
+			if (req.method === "DELETE") return deleteSelfAccount(req);
 			return new Response("Method not allowed", { status: 405 });
 		},
 		"/api/apps": (req: Request) => {

src/routes/api.ts

···
 	}>;
 
 	return Response.json({
-		apps: apps.map((app) => ({
-			clientId: app.client_id,
-			name: app.name || new URL(app.client_id).hostname,
-			scopes: JSON.parse(app.scopes) as string[],
-			grantedAt: app.granted_at,
-			lastUsed: app.last_used,
-		})),
+		apps: apps.map((app) => {
+			let displayName = app.name || app.client_id;
+			// Try to extract hostname if client_id is a URL
+			if (!app.name) {
+				try {
+					displayName = new URL(app.client_id).hostname;
+				} catch {
+					// Not a URL, use client_id as-is
+					displayName = app.client_id;
+				}
+			}
+			return {
+				clientId: app.client_id,
+				name: displayName,
+				scopes: JSON.parse(app.scopes) as string[],
+				grantedAt: app.granted_at,
+				lastUsed: app.last_used,
+			};
+		}),
 	});
 }
 
···
 	}
 
 	const targetUser = db
-		.query("SELECT id FROM users WHERE id = ?")
-		.get(targetUserId) as { id: number } | undefined;
+		.query("SELECT id, is_admin FROM users WHERE id = ?")
+		.get(targetUserId) as { id: number; is_admin: number } | undefined;
 
 	if (!targetUser) {
 		return Response.json({ error: "User not found" }, { status: 404 });
 	}
 
+	// Prevent admins from deleting other admin accounts
+	if (targetUser.is_admin === 1) {
+		return Response.json({ error: "Cannot delete admin accounts" }, { status: 403 });
+	}
+
 	db.query("DELETE FROM sessions WHERE user_id = ?").run(targetUserId);
 	db.query("DELETE FROM credentials WHERE user_id = ?").run(targetUserId);
 	db.query("DELETE FROM permissions WHERE user_id = ?").run(targetUserId);
···
 
 	return Response.json({ success: true });
 }
+
+export function deleteSelfAccount(req: Request): Response {
+	const user = getSessionUser(req);
+	if (user instanceof Response) {
+		return user;
+	}
+
+	// Prevent admins from deleting their own accounts
+	if (user.is_admin) {
+		return Response.json({ 
+			error: "Admin accounts cannot be self-deleted. Contact another admin for account deletion." 
+		}, { status: 403 });
+	}
+
+	// Delete all user data
+	db.query("DELETE FROM sessions WHERE user_id = ?").run(user.userId);
+	db.query("DELETE FROM credentials WHERE user_id = ?").run(user.userId);
+	db.query("DELETE FROM permissions WHERE user_id = ?").run(user.userId);
+	db.query("DELETE FROM authcodes WHERE user_id = ?").run(user.userId);
+	db.query("DELETE FROM users WHERE id = ?").run(user.userId);
+
+	return Response.json({ success: true });
+}