appview/settings: add account management UI for tngl.sh users

Signed-off-by: Lewis <[e-mail]>

appview/config/config.go

···
 	"context"
 	"fmt"
 	"net/url"
+	"strings"
 	"time"
 
 	"github.com/sethvargo/go-envconfig"
···
 type PdsConfig struct {
 	Host        string `env:"HOST, default=https://tngl.sh"`
 	AdminSecret string `env:"ADMIN_SECRET"`
+}
+
+func (p *PdsConfig) IsTnglShUser(pdsHost string) bool {
+	return strings.TrimRight(pdsHost, "/") == strings.TrimRight(p.Host, "/")
 }
 
 type R2Config struct {

appview/oauth/handler.go

···
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/atproto/auth/oauth"
 	lexutil "github.com/bluesky-social/indigo/lex/util"
+	xrpc "github.com/bluesky-social/indigo/xrpc"
 	"github.com/go-chi/chi/v5"
 	"github.com/posthog/posthog-go"
 	"tangled.org/core/api/tangled"
···
 	doc.JWKSURI = &o.JwksUri
 	doc.ClientName = &o.ClientName
 	doc.ClientURI = &o.ClientUri
+	doc.Scope = doc.Scope + " identity:handle"
 
 	w.Header().Set("Content-Type", "application/json")
 	if err := json.NewEncoder(w).Encode(doc); err != nil {
···
 		redirectURL = authReturn.ReturnURL
 	}
 
+	if o.isAccountDeactivated(sessData) {
+		redirectURL = "/settings/profile"
+	}
+
 	http.Redirect(w, r, redirectURL, http.StatusFound)
+}
+
+func (o *OAuth) isAccountDeactivated(sessData *oauth.ClientSessionData) bool {
+	pdsClient := &xrpc.Client{
+		Host:   sessData.HostURL,
+		Client: &http.Client{Timeout: 5 * time.Second},
+	}
+
+	_, err := comatproto.RepoDescribeRepo(
+		context.Background(),
+		pdsClient,
+		sessData.AccountDID.String(),
+	)
+	if err == nil {
+		return false
+	}
+
+	var xrpcErr *xrpc.Error
+	var xrpcBody *xrpc.XRPCError
+	return errors.As(err, &xrpcErr) &&
+		errors.As(xrpcErr.Wrapped, &xrpcBody) &&
+		xrpcBody.ErrStr == "RepoDeactivated"
 }
 
 func (o *OAuth) addToDefaultSpindle(did string) {

appview/oauth/oauth.go

···
 package oauth
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"sync"
 	"time"
 
···
 		},
 	}, nil
 }
+
+func (o *OAuth) StartElevatedAuthFlow(ctx context.Context, w http.ResponseWriter, r *http.Request, did string, extraScopes []string, returnURL string) (string, error) {
+	parsedDid, err := syntax.ParseDID(did)
+	if err != nil {
+		return "", fmt.Errorf("invalid DID: %w", err)
+	}
+
+	ident, err := o.ClientApp.Dir.Lookup(ctx, parsedDid.AtIdentifier())
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve DID (%s): %w", did, err)
+	}
+
+	host := ident.PDSEndpoint()
+	if host == "" {
+		return "", fmt.Errorf("identity does not link to an atproto host (PDS)")
+	}
+
+	authserverURL, err := o.ClientApp.Resolver.ResolveAuthServerURL(ctx, host)
+	if err != nil {
+		return "", fmt.Errorf("resolving auth server: %w", err)
+	}
+
+	authserverMeta, err := o.ClientApp.Resolver.ResolveAuthServerMetadata(ctx, authserverURL)
+	if err != nil {
+		return "", fmt.Errorf("fetching auth server metadata: %w", err)
+	}
+
+	scopes := make([]string, 0, len(TangledScopes)+len(extraScopes))
+	scopes = append(scopes, TangledScopes...)
+	scopes = append(scopes, extraScopes...)
+
+	loginHint := did
+	if ident.Handle != "" && !ident.Handle.IsInvalidHandle() {
+		loginHint = ident.Handle.String()
+	}
+
+	info, err := o.ClientApp.SendAuthRequest(ctx, authserverMeta, scopes, loginHint)
+	if err != nil {
+		return "", fmt.Errorf("auth request failed: %w", err)
+	}
+
+	info.AccountDID = &parsedDid
+	o.ClientApp.Store.SaveAuthRequestInfo(ctx, *info)
+
+	if err := o.SetAuthReturn(w, r, returnURL, false); err != nil {
+		return "", fmt.Errorf("failed to set auth return: %w", err)
+	}
+
+	redirectURL := fmt.Sprintf("%s?client_id=%s&request_uri=%s",
+		authserverMeta.AuthorizationEndpoint,
+		url.QueryEscape(o.ClientApp.Config.ClientID),
+		url.QueryEscape(info.RequestURI),
+	)
+
+	return redirectURL, nil
+}

appview/pages/htmx.go

···
 
 import (
 	"fmt"
+	"html"
 	"net/http"
 )
 
 // Notice performs a hx-oob-swap to replace the content of an element with a message.
 // Pass the id of the element and the message to display.
 func (s *Pages) Notice(w http.ResponseWriter, id, msg string) {
-	html := fmt.Sprintf(`<span id="%s" hx-swap-oob="innerHTML">%s</span>`, id, msg)
+	escaped := html.EscapeString(msg)
+	markup := fmt.Sprintf(`<span id="%s" hx-swap-oob="innerHTML">%s</span>`, id, escaped)
 
 	w.Header().Set("Content-Type", "text/html")
 	w.WriteHeader(http.StatusOK)
-	w.Write([]byte(html))
+	w.Write([]byte(markup))
+}
+
+func (s *Pages) NoticeHTML(w http.ResponseWriter, id string, trustedHTML string) {
+	markup := fmt.Sprintf(`<span id="%s" hx-swap-oob="innerHTML">%s</span>`, id, trustedHTML)
+
+	w.Header().Set("Content-Type", "text/html")
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(markup))
 }
 
 // HxRefresh is a client-side full refresh of the page.

appview/pages/pages.go

···
 	LoggedInUser        *oauth.MultiAccountUser
 	Tab                 string
 	PunchcardPreference models.PunchcardPreference
+	IsTnglSh            bool
+	IsDeactivated       bool
+	PdsDomain           string
+	HandleOpen          bool
 }
 
 func (p *Pages) UserProfileSettings(w io.Writer, params UserProfileSettingsParams) error {
···
 	}
 
 	return hex.EncodeToString(hasher.Sum(nil))[:8] // Use first 8 chars of hash
+}
+
+func (p *Pages) DangerPasswordTokenStep(w io.Writer) error {
+	return p.executePlain("user/settings/fragments/dangerPasswordToken", w, nil)
+}
+
+func (p *Pages) DangerPasswordSuccess(w io.Writer) error {
+	return p.executePlain("user/settings/fragments/dangerPasswordSuccess", w, nil)
+}
+
+func (p *Pages) DangerDeleteTokenStep(w io.Writer) error {
+	return p.executePlain("user/settings/fragments/dangerDeleteToken", w, nil)
 }
 
 func (p *Pages) Error500(w io.Writer) error {

appview/pages/templates/user/settings/fragments/dangerDeleteToken.html

···
+{{ define "user/settings/fragments/dangerDeleteToken" }}
+<div id="delete-form-container" hx-swap-oob="innerHTML">
+  <label class="uppercase text-sm font-bold p-0 text-red-600 dark:text-red-400">Delete account</label>
+  <p class="text-sm text-gray-500 dark:text-gray-400 pt-1">Check your email for an account deletion code.</p>
+  <form hx-post="/settings/delete/confirm" hx-swap="none" hx-confirm="This will permanently delete your account. This cannot be undone. Continue?" hx-disabled-elt="find button[type='submit']" class="flex flex-col gap-3 pt-2">
+    <div class="flex flex-col">
+      <label for="delete-token">deletion code</label>
+      <input type="text" id="delete-token" name="token" required autocomplete="off" placeholder="xxxx-xxxx" />
+    </div>
+    <div class="flex flex-col">
+      <label for="delete-password-confirm">password</label>
+      <input type="password" id="delete-password-confirm" name="password" required autocomplete="current-password" />
+    </div>
+    <div class="flex flex-col">
+      <label for="delete-confirmation">confirmation</label>
+      <input type="text" id="delete-confirmation" name="confirmation" required autocomplete="off" placeholder="delete my account" />
+      <span class="text-sm text-gray-500 mt-1">Type <strong>delete my account</strong> to confirm.</span>
+    </div>
+    <div class="flex gap-2 pt-2">
+      <button type="button" popovertarget="delete-modal" popovertargetaction="hide" class="btn w-1/2 flex items-center gap-2 text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-300">cancel</button>
+      <button type="submit" class="btn w-1/2 flex items-center justify-center gap-2 text-red-600 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300">delete account</button>
+    </div>
+    <div id="delete-error" class="text-red-500 dark:text-red-400 text-sm empty:hidden"></div>
+  </form>
+</div>
+{{ end }}

appview/pages/templates/user/settings/fragments/dangerPasswordSuccess.html

···
+{{ define "user/settings/fragments/dangerPasswordSuccess" }}
+<div id="password-form-container" hx-swap-oob="innerHTML">
+  <label class="uppercase text-sm font-bold p-0">Change password</label>
+  <p class="text-green-500 dark:text-green-400 pt-2">Password changed.</p>
+</div>
+{{ end }}

appview/pages/templates/user/settings/fragments/dangerPasswordToken.html

···
+{{ define "user/settings/fragments/dangerPasswordToken" }}
+<div id="password-form-container" hx-swap-oob="innerHTML">
+  <label class="uppercase text-sm font-bold p-0">Change password</label>
+  <p class="text-sm text-gray-500 dark:text-gray-400 pt-1">Check your email for a password reset code.</p>
+  <form hx-post="/settings/password/reset" hx-swap="none" hx-disabled-elt="find button[type='submit']" class="flex flex-col gap-3 pt-2">
+    <div class="flex flex-col">
+      <label for="token">reset code</label>
+      <input type="text" id="token" name="token" required autocomplete="off" placeholder="xxxx-xxxx" />
+    </div>
+    <div class="flex flex-col">
+      <label for="new-password">new password</label>
+      <input type="password" id="new-password" name="new_password" required autocomplete="new-password" />
+    </div>
+    <div class="flex flex-col">
+      <label for="confirm-password">confirm new password</label>
+      <input type="password" id="confirm-password" name="confirm_password" required autocomplete="new-password" />
+    </div>
+    <div class="flex gap-2 pt-2">
+      <button type="button" popovertarget="change-password-modal" popovertargetaction="hide" class="btn w-1/2 flex items-center gap-2 text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300">cancel</button>
+      <button type="submit" class="btn w-1/2 flex items-center justify-center gap-2">set new password</button>
+    </div>
+    <div id="password-error" class="text-red-500 dark:text-red-400 text-sm empty:hidden"></div>
+  </form>
+</div>
+{{ end }}

appview/pages/templates/user/settings/profile.html

···
       </div>
       <div class="col-span-1 md:col-span-3 flex flex-col gap-6">
         {{ template "profile" . }}
+        {{ if .IsTnglSh }}
+          {{ template "accountActions" . }}
+        {{ end }}
         {{ template "punchcard" . }}
       </div>
     </section>
···
     <div class="flex flex-col rounded border border-gray-200 dark:border-gray-700 divide-y divide-gray-200 dark:divide-gray-700">
       <div class="flex flex-col gap-1 p-4">
         <span class="text-sm text-gray-500 dark:text-gray-400">Handle</span>
-        <span class="font-bold">{{ resolve .LoggedInUser.Did }}</span>
+        <div class="flex items-center gap-2">
+          <span class="font-bold">{{ resolve .LoggedInUser.Did }}</span>
+          {{ if .IsTnglSh }}
+            {{ if .HandleOpen }}
+              <button
+                popovertarget="change-handle-modal"
+                popovertargetaction="toggle"
+                class="text-xs text-gray-400 hover:text-gray-600 dark:hover:text-gray-300 cursor-pointer">change</button>
+            {{ else }}
+              <a href="/settings/handle" class="text-xs text-gray-400 hover:text-gray-600 dark:hover:text-gray-300">change</a>
+            {{ end }}
+          {{ end }}
+        </div>
       </div>
       <div class="flex flex-col gap-1 p-4">
         <span class="text-sm text-gray-500 dark:text-gray-400">Decentralized Identifier (DID)</span>
···
         <span class="font-bold">{{ .LoggedInUser.Pds }}</span>
       </div>
     </div>
+    {{ if and .IsTnglSh .HandleOpen }}
+      <div
+        id="change-handle-modal"
+        popover
+        class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-gray-200 dark:border-gray-700 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50">
+        <div id="handle-subdomain" class="flex flex-col gap-3">
+          <label class="uppercase text-sm font-bold p-0">Change handle</label>
+          <form hx-post="/settings/handle" hx-swap="none" class="flex flex-col gap-3">
+            <input type="hidden" name="type" value="subdomain">
+            <div class="flex items-stretch rounded border border-gray-200 dark:border-gray-600 overflow-hidden focus-within:ring-1 focus-within:ring-blue-500 dark:bg-gray-700">
+              <input type="text" name="handle" placeholder="username" class="flex-1 px-2 py-1.5 bg-transparent dark:text-white border-0 focus:outline-none focus:ring-0 min-w-0" required>
+              <span class="px-2 py-1.5 bg-gray-100 dark:bg-gray-600 text-gray-500 dark:text-gray-300 select-none whitespace-nowrap border-l border-gray-200 dark:border-gray-600 content-center">.{{ .PdsDomain }}</span>
+            </div>
+            <div class="flex gap-2 pt-2">
+              <button type="button" popovertarget="change-handle-modal" popovertargetaction="hide" class="btn w-1/2 flex items-center gap-2 text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300">
+                {{ i "x" "size-4" }} cancel
+              </button>
+              <button type="submit" class="btn w-1/2 flex items-center justify-center gap-2">
+                {{ i "check" "size-4" }} save
+              </button>
+            </div>
+          </form>
+          <a href="#" id="switch-to-custom" class="text-sm text-gray-400 underline hover:text-gray-600 dark:hover:text-gray-300">I have my own domain</a>
+        </div>
+        <div id="handle-custom" style="display: none;" class="flex flex-col gap-3">
+          <label class="uppercase text-sm font-bold p-0">Change handle</label>
+          <form hx-post="/settings/handle" hx-swap="none" class="flex flex-col gap-3">
+            <input type="hidden" name="type" value="custom">
+            <input id="custom-domain-input" type="text" name="handle" placeholder="mycoolhandle.com" class="w-full dark:bg-gray-700 dark:text-white dark:border-gray-600 dark:placeholder-gray-400 px-2 py-1.5 border border-gray-200 dark:border-gray-600 rounded outline-none focus:ring-1 focus:ring-blue-500" required>
+            <div class="bg-gray-50 dark:bg-gray-900 rounded p-3 text-gray-500 dark:text-gray-400 flex flex-col gap-2 text-xs">
+              <p>Set up one of the following on your domain:</p>
+              <div>
+                <p class="font-medium text-gray-700 dark:text-gray-300">DNS TXT record</p>
+                <p>Add a TXT record for <code class="bg-gray-200 dark:bg-gray-700 px-1 rounded">_atproto.<span id="dns-domain">mycoolhandle.com</span></code></p>
+                <code class="inline-block bg-gray-200 dark:bg-gray-700 px-1 py-0.5 rounded mt-1.5 break-all">did={{ .LoggedInUser.Did }}</code>
+              </div>
+              <div>
+                <p class="font-medium text-gray-700 dark:text-gray-300">HTTP well-known</p>
+                <p>Serve your DID at:</p>
+                <code class="inline-block bg-gray-200 dark:bg-gray-700 px-1 py-0.5 rounded mt-1 break-all">https://<span id="wk-domain">mycoolhandle.com</span>/.well-known/atproto-did</code>
+                <code class="inline-block bg-gray-200 dark:bg-gray-700 px-1 py-0.5 rounded mt-1.5 break-all">{{ .LoggedInUser.Did }}</code>
+              </div>
+            </div>
+            <div class="flex gap-2 pt-2">
+              <button type="button" popovertarget="change-handle-modal" popovertargetaction="hide" class="btn w-1/2 flex items-center gap-2 text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300">
+                {{ i "x" "size-4" }} cancel
+              </button>
+              <button type="submit" class="btn w-1/2 flex items-center justify-center gap-2">
+                {{ i "check" "size-4" }} verify & save
+              </button>
+            </div>
+          </form>
+          <a href="#" id="switch-to-subdomain" class="text-sm text-gray-400 underline hover:text-gray-600 dark:hover:text-gray-300">use a {{ .PdsDomain }} subdomain instead</a>
+        </div>
+        <div id="handle-error" class="text-red-500 dark:text-red-400 text-sm empty:hidden"></div>
+        <div id="handle-success" class="text-green-500 dark:text-green-400 text-sm empty:hidden"></div>
+      </div>
+      <script>
+        document.getElementById('switch-to-custom').addEventListener('click', function(e) {
+          e.preventDefault();
+          document.getElementById('handle-subdomain').style.display = 'none';
+          document.getElementById('handle-custom').style.display = '';
+        });
+        document.getElementById('switch-to-subdomain').addEventListener('click', function(e) {
+          e.preventDefault();
+          document.getElementById('handle-custom').style.display = 'none';
+          document.getElementById('handle-subdomain').style.display = '';
+        });
+        document.getElementById('custom-domain-input').addEventListener('input', function(e) {
+          var d = e.target.value.trim() || 'mycoolhandle.com';
+          document.getElementById('dns-domain').textContent = d;
+          document.getElementById('wk-domain').textContent = d;
+        });
+        document.getElementById('change-handle-modal').showPopover();
+      </script>
+    {{ end }}
+  </div>
+{{ end }}
+
+{{ define "accountActions" }}
+  <div>
+    <h2 class="text-sm uppercase font-bold">Account</h2>
+    {{ if .IsDeactivated }}
+      <div class="mt-2 p-3 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-700 rounded text-sm text-amber-700 dark:text-amber-300">
+        Your account is deactivated. Your profile and repositories are currently inaccessible. Reactivate to restore access.
+      </div>
+    {{ end }}
+    <div class="flex flex-wrap gap-2 pt-2">
+      <button
+        popovertarget="change-password-modal"
+        popovertargetaction="toggle"
+        class="btn flex items-center gap-2 text-sm cursor-pointer">
+        {{ i "key" "size-4" }}
+        change password
+      </button>
+      {{ if .IsDeactivated }}
+        <button
+          popovertarget="reactivate-modal"
+          popovertargetaction="toggle"
+          class="btn flex items-center gap-2 text-sm text-green-600 hover:text-green-700 dark:text-green-400 dark:hover:text-green-300 border-green-300 dark:border-green-600 cursor-pointer">
+          {{ i "play" "size-4" }}
+          reactivate account
+        </button>
+      {{ else }}
+        <button
+          popovertarget="deactivate-modal"
+          popovertargetaction="toggle"
+          class="btn flex items-center gap-2 text-sm text-amber-600 hover:text-amber-700 dark:text-amber-400 dark:hover:text-amber-300 border-amber-300 dark:border-amber-600 cursor-pointer">
+          {{ i "pause" "size-4" }}
+          deactivate account
+        </button>
+      {{ end }}
+      <button
+        popovertarget="delete-modal"
+        popovertargetaction="toggle"
+        class="btn flex items-center gap-2 text-sm text-red-600 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300 border-red-300 dark:border-red-600 cursor-pointer">
+        {{ i "trash-2" "size-4" }}
+        delete account
+      </button>
+    </div>
+  </div>
+
+  <div
+    id="change-password-modal"
+    popover
+    class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-gray-200 dark:border-gray-700 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50">
+    <div id="password-form-container" class="flex flex-col gap-3">
+      <label class="uppercase text-sm font-bold p-0">Change password</label>
+      <form hx-post="/settings/password/request" hx-swap="none" hx-disabled-elt="find button[type='submit']" class="flex flex-col gap-3">
+        <div class="flex flex-col">
+          <label for="current-password">current password</label>
+          <input type="password" id="current-password" name="current_password" required autocomplete="current-password" />
+          <span class="text-sm text-gray-500 mt-1">Confirm your identity to proceed.</span>
+        </div>
+        <div class="flex gap-2 pt-2">
+          <button type="button" popovertarget="change-password-modal" popovertargetaction="hide" class="btn w-1/2 flex items-center gap-2 text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300">
+            {{ i "x" "size-4" }} cancel
+          </button>
+          <button type="submit" class="btn w-1/2 flex items-center justify-center gap-2">
+            {{ i "key" "size-4" }} send reset code
+          </button>
+        </div>
+      </form>
+      <div id="password-error" class="text-red-500 dark:text-red-400 text-sm empty:hidden"></div>
+    </div>
+  </div>
+
+  {{ if .IsDeactivated }}
+    <div
+      id="reactivate-modal"
+      popover
+      class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-green-300 dark:border-green-600 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50">
+      <div class="flex flex-col gap-3">
+        <label class="uppercase text-sm font-bold p-0 text-green-600 dark:text-green-400">Reactivate account</label>
+        <p class="text-sm text-gray-500 dark:text-gray-400">This will restore your profile and repositories, making them accessible again.</p>
+        <form hx-post="/settings/reactivate" hx-swap="none" hx-disabled-elt="find button[type='submit']" class="flex flex-col gap-3">
+          <div class="flex flex-col">
+            <label for="reactivate-password">password</label>
+            <input type="password" id="reactivate-password" name="password" required autocomplete="current-password" />
+            <span class="text-sm text-gray-500 mt-1">Confirm your identity to proceed.</span>
+          </div>
+          <div class="flex gap-2 pt-2">
+            <button type="button" popovertarget="reactivate-modal" popovertargetaction="hide" class="btn w-1/2 flex items-center gap-2 text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300">
+              {{ i "x" "size-4" }} cancel
+            </button>
+            <button type="submit" class="btn w-1/2 flex items-center justify-center gap-2 text-green-600 hover:text-green-700 dark:text-green-400 dark:hover:text-green-300">
+              {{ i "play" "size-4" }} reactivate
+            </button>
+          </div>
+        </form>
+        <div id="reactivate-error" class="text-red-500 dark:text-red-400 text-sm empty:hidden"></div>
+      </div>
+    </div>
+  {{ else }}
+    <div
+      id="deactivate-modal"
+      popover
+      class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-amber-300 dark:border-amber-600 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50">
+      <div class="flex flex-col gap-3">
+        <label class="uppercase text-sm font-bold p-0 text-amber-600 dark:text-amber-400">Deactivate account</label>
+        <p class="text-sm text-gray-500 dark:text-gray-400">Your profile and repositories will become inaccessible. You can reactivate by logging in again.</p>
+        <form hx-post="/settings/deactivate" hx-swap="none" hx-confirm="Are you sure you want to deactivate your account?" hx-disabled-elt="find button[type='submit']" class="flex flex-col gap-3">
+          <div class="flex flex-col">
+            <label for="deactivate-password">password</label>
+            <input type="password" id="deactivate-password" name="password" required autocomplete="current-password" />
+            <span class="text-sm text-gray-500 mt-1">Confirm your identity to proceed.</span>
+          </div>
+          <div class="flex gap-2 pt-2">
+            <button type="button" popovertarget="deactivate-modal" popovertargetaction="hide" class="btn w-1/2 flex items-center gap-2 text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300">
+              {{ i "x" "size-4" }} cancel
+            </button>
+            <button type="submit" class="btn w-1/2 flex items-center justify-center gap-2 text-amber-600 hover:text-amber-700 dark:text-amber-400 dark:hover:text-amber-300">
+              {{ i "pause" "size-4" }} deactivate
+            </button>
+          </div>
+        </form>
+        <div id="deactivate-error" class="text-red-500 dark:text-red-400 text-sm empty:hidden"></div>
+      </div>
+    </div>
+  {{ end }}
+
+  <div
+    id="delete-modal"
+    popover
+    class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-red-300 dark:border-red-600 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50">
+    <div id="delete-form-container" class="flex flex-col gap-3">
+      <label class="uppercase text-sm font-bold p-0 text-red-600 dark:text-red-400">Delete account</label>
+      <p class="text-sm text-gray-500 dark:text-gray-400">This permanently deletes your account and all associated data. This cannot be undone.</p>
+      <form hx-post="/settings/delete/request" hx-swap="none" hx-disabled-elt="find button[type='submit']" class="flex flex-col gap-3">
+        <div class="flex flex-col">
+          <label for="delete-password">password</label>
+          <input type="password" id="delete-password" name="password" required autocomplete="current-password" />
+          <span class="text-sm text-gray-500 mt-1">Confirm your identity to proceed.</span>
+        </div>
+        <div class="flex gap-2 pt-2">
+          <button type="button" popovertarget="delete-modal" popovertargetaction="hide" class="btn w-1/2 flex items-center gap-2 text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-300">
+            {{ i "x" "size-4" }} cancel
+          </button>
+          <button type="submit" class="btn w-1/2 flex items-center justify-center gap-2 text-red-600 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300">
+            {{ i "trash-2" "size-4" }} send deletion code
+          </button>
+        </div>
+      </form>
+      <div id="delete-error" class="text-red-500 dark:text-red-400 text-sm empty:hidden"></div>
+    </div>
   </div>
 {{ end }}
 
···
     <p class="text-gray-500 dark:text-gray-400 pb-2 ">
       Configure punchcard visibility and preferences.
     </p>
-    <form hx-post="/profile/punchcard" hx-trigger="change" hx-swap="none" class="flex flex-col gap-2">
+    <form hx-post="/profile/punchcard" hx-trigger="change" hx-swap="none" class="flex flex-col gap-3">
       <div class="flex items-center gap-2">
         <input type="checkbox" id="hideMine" name="hideMine" value="on" {{ if eq true $.PunchcardPreference.HideMine }}checked{{ end }}>
         <label for="hideMine" class="my-0 py-0 normal-case font-normal">Hide mine</label>

appview/settings/danger.go

···
+package settings
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	comatproto "github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/xrpc"
+)
+
+type pdsSession struct {
+	Client    *xrpc.Client
+	Did       string
+	Email     string
+	AccessJwt string
+}
+
+func (s *Settings) pdsClient() *xrpc.Client {
+	return &xrpc.Client{
+		Host:   s.Config.Pds.Host,
+		Client: &http.Client{Timeout: 15 * time.Second},
+	}
+}
+
+func (s *Settings) verifyPdsPassword(did, password string) (*pdsSession, error) {
+	client := s.pdsClient()
+	resp, err := comatproto.ServerCreateSession(context.Background(), client, &comatproto.ServerCreateSession_Input{
+		Identifier: did,
+		Password:   password,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	client.Auth = &xrpc.AuthInfo{AccessJwt: resp.AccessJwt}
+
+	var email string
+	if resp.Email != nil {
+		email = *resp.Email
+	}
+
+	return &pdsSession{
+		Client:    client,
+		Did:       resp.Did,
+		Email:     email,
+		AccessJwt: resp.AccessJwt,
+	}, nil
+}
+
+func (s *Settings) revokePdsSession(session *pdsSession) {
+	if err := comatproto.ServerDeleteSession(context.Background(), session.Client); err != nil {
+		s.Logger.Warn("failed to revoke session", "err", err)
+	}
+}
+
+func (s *Settings) requestPasswordReset(w http.ResponseWriter, r *http.Request) {
+	user := s.OAuth.GetMultiAccountUser(r)
+	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+		s.Pages.Notice(w, "password-error", "Only available for tngl.sh accounts.")
+		return
+	}
+
+	did := s.OAuth.GetDid(r)
+	password := r.FormValue("current_password")
+	if password == "" {
+		s.Pages.Notice(w, "password-error", "Password is required.")
+		return
+	}
+
+	session, err := s.verifyPdsPassword(did, password)
+	if err != nil {
+		s.Pages.Notice(w, "password-error", "Current password is incorrect.")
+		return
+	}
+
+	if session.Email == "" {
+		s.revokePdsSession(session)
+		s.Logger.Error("requesting password reset: no email on account", "did", did)
+		s.Pages.Notice(w, "password-error", "No email associated with your account.")
+		return
+	}
+
+	s.revokePdsSession(session)
+
+	err = comatproto.ServerRequestPasswordReset(context.Background(), s.pdsClient(), &comatproto.ServerRequestPasswordReset_Input{
+		Email: session.Email,
+	})
+	if err != nil {
+		s.Logger.Error("requesting password reset", "err", err)
+		s.Pages.Notice(w, "password-error", "Failed to request password reset. Try again later.")
+		return
+	}
+
+	s.Pages.DangerPasswordTokenStep(w)
+}
+
+func (s *Settings) resetPassword(w http.ResponseWriter, r *http.Request) {
+	user := s.OAuth.GetMultiAccountUser(r)
+	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+		s.Pages.Notice(w, "password-error", "Only available for tngl.sh accounts.")
+		return
+	}
+
+	token := strings.TrimSpace(r.FormValue("token"))
+	newPassword := r.FormValue("new_password")
+	confirmPassword := r.FormValue("confirm_password")
+
+	if token == "" || newPassword == "" || confirmPassword == "" {
+		s.Pages.Notice(w, "password-error", "All fields are required.")
+		return
+	}
+
+	if newPassword != confirmPassword {
+		s.Pages.Notice(w, "password-error", "Passwords do not match.")
+		return
+	}
+
+	err := comatproto.ServerResetPassword(context.Background(), s.pdsClient(), &comatproto.ServerResetPassword_Input{
+		Token:    token,
+		Password: newPassword,
+	})
+	if err != nil {
+		s.Logger.Error("resetting password", "err", err)
+		s.Pages.Notice(w, "password-error", "Failed to reset password. The token may have expired.")
+		return
+	}
+
+	s.Pages.DangerPasswordSuccess(w)
+}
+
+func (s *Settings) deactivateAccount(w http.ResponseWriter, r *http.Request) {
+	user := s.OAuth.GetMultiAccountUser(r)
+	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+		s.Pages.Notice(w, "deactivate-error", "Only available for tngl.sh accounts.")
+		return
+	}
+
+	did := s.OAuth.GetDid(r)
+	password := r.FormValue("password")
+
+	if password == "" {
+		s.Pages.Notice(w, "deactivate-error", "Password is required.")
+		return
+	}
+
+	session, err := s.verifyPdsPassword(did, password)
+	if err != nil {
+		s.Pages.Notice(w, "deactivate-error", "Password is incorrect.")
+		return
+	}
+
+	err = comatproto.ServerDeactivateAccount(context.Background(), session.Client, &comatproto.ServerDeactivateAccount_Input{})
+	s.revokePdsSession(session)
+	if err != nil {
+		s.Logger.Error("deactivating account", "err", err)
+		s.Pages.Notice(w, "deactivate-error", "Failed to deactivate account. Try again later.")
+		return
+	}
+
+	if err := s.OAuth.DeleteSession(w, r); err != nil {
+		s.Logger.Error("clearing session after deactivation", "did", did, "err", err)
+	}
+	if err := s.OAuth.RemoveAccount(w, r, did); err != nil {
+		s.Logger.Error("removing account after deactivation", "did", did, "err", err)
+	}
+	s.Pages.HxRedirect(w, "/")
+}
+
+func (s *Settings) requestAccountDelete(w http.ResponseWriter, r *http.Request) {
+	user := s.OAuth.GetMultiAccountUser(r)
+	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+		s.Pages.Notice(w, "delete-error", "Only available for tngl.sh accounts.")
+		return
+	}
+
+	did := s.OAuth.GetDid(r)
+	password := r.FormValue("password")
+
+	if password == "" {
+		s.Pages.Notice(w, "delete-error", "Password is required.")
+		return
+	}
+
+	session, err := s.verifyPdsPassword(did, password)
+	if err != nil {
+		s.Pages.Notice(w, "delete-error", "Password is incorrect.")
+		return
+	}
+
+	err = comatproto.ServerRequestAccountDelete(context.Background(), session.Client)
+	s.revokePdsSession(session)
+	if err != nil {
+		s.Logger.Error("requesting account deletion", "err", err)
+		s.Pages.Notice(w, "delete-error", "Failed to request account deletion. Try again later.")
+		return
+	}
+
+	s.Pages.DangerDeleteTokenStep(w)
+}
+
+func (s *Settings) deleteAccount(w http.ResponseWriter, r *http.Request) {
+	user := s.OAuth.GetMultiAccountUser(r)
+	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+		s.Pages.Notice(w, "delete-error", "Only available for tngl.sh accounts.")
+		return
+	}
+
+	did := s.OAuth.GetDid(r)
+	password := r.FormValue("password")
+	token := strings.TrimSpace(r.FormValue("token"))
+	confirmation := r.FormValue("confirmation")
+
+	if password == "" || token == "" {
+		s.Pages.Notice(w, "delete-error", "All fields are required.")
+		return
+	}
+
+	if confirmation != "delete my account" {
+		s.Pages.Notice(w, "delete-error", "You must type \"delete my account\" to confirm.")
+		return
+	}
+
+	err := comatproto.ServerDeleteAccount(context.Background(), s.pdsClient(), &comatproto.ServerDeleteAccount_Input{
+		Did:      did,
+		Password: password,
+		Token:    token,
+	})
+	if err != nil {
+		s.Logger.Error("deleting account", "err", err)
+		s.Pages.Notice(w, "delete-error", "Failed to delete account. Try again later.")
+		return
+	}
+
+	if err := s.OAuth.DeleteSession(w, r); err != nil {
+		s.Logger.Error("clearing session after account deletion", "did", did, "err", err)
+	}
+	if err := s.OAuth.RemoveAccount(w, r, did); err != nil {
+		s.Logger.Error("removing account after deletion", "did", did, "err", err)
+	}
+	s.Pages.HxRedirect(w, "/")
+}
+
+func (s *Settings) isAccountDeactivated(ctx context.Context, did, pdsHost string) bool {
+	client := &xrpc.Client{
+		Host:   pdsHost,
+		Client: &http.Client{Timeout: 5 * time.Second},
+	}
+
+	_, err := comatproto.RepoDescribeRepo(ctx, client, did)
+	if err == nil {
+		return false
+	}
+
+	var xrpcErr *xrpc.Error
+	var xrpcBody *xrpc.XRPCError
+	return errors.As(err, &xrpcErr) &&
+		errors.As(xrpcErr.Wrapped, &xrpcBody) &&
+		xrpcBody.ErrStr == "RepoDeactivated"
+}
+
+func (s *Settings) reactivateAccount(w http.ResponseWriter, r *http.Request) {
+	user := s.OAuth.GetMultiAccountUser(r)
+	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+		s.Pages.Notice(w, "reactivate-error", "Only available for tngl.sh accounts.")
+		return
+	}
+
+	did := s.OAuth.GetDid(r)
+	password := r.FormValue("password")
+
+	if password == "" {
+		s.Pages.Notice(w, "reactivate-error", "Password is required.")
+		return
+	}
+
+	session, err := s.verifyPdsPassword(did, password)
+	if err != nil {
+		s.Pages.Notice(w, "reactivate-error", "Password is incorrect.")
+		return
+	}
+
+	err = comatproto.ServerActivateAccount(context.Background(), session.Client)
+	s.revokePdsSession(session)
+	if err != nil {
+		s.Logger.Error("reactivating account", "err", err)
+		s.Pages.Notice(w, "reactivate-error", "Failed to reactivate account. Try again later.")
+		return
+	}
+
+	s.Pages.HxRefresh(w)
+}

appview/settings/settings.go

···
 	"database/sql"
 	"errors"
 	"fmt"
+	"html"
 	"log"
 	"log/slog"
 	"net/http"
 	"net/url"
+	"slices"
 	"strings"
 	"time"
 
···
 	"tangled.org/core/tid"
 
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
+	atpclient "github.com/bluesky-social/indigo/atproto/client"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	lexutil "github.com/bluesky-social/indigo/lex/util"
 	"github.com/gliderlabs/ssh"
···
 		r.Put("/", s.claimSitesDomain)
 		r.Delete("/", s.releaseSitesDomain)
 	})
+
+	r.Post("/password/request", s.requestPasswordReset)
+	r.Post("/password/reset", s.resetPassword)
+	r.Post("/deactivate", s.deactivateAccount)
+	r.Post("/reactivate", s.reactivateAccount)
+	r.Post("/delete/request", s.requestAccountDelete)
+	r.Post("/delete/confirm", s.deleteAccount)
+
+	r.Get("/handle", s.elevateForHandle)
+	r.Post("/handle", s.updateHandle)
 
 	return r
 }
···
 		log.Printf("failed to get users punchcard preferences: %s", err)
 	}
 
+	isDeactivated := s.Config.Pds.IsTnglShUser(user.Pds()) && s.isAccountDeactivated(r.Context(), user.Did(), user.Pds())
+
 	s.Pages.UserProfileSettings(w, pages.UserProfileSettingsParams{
 		LoggedInUser:        user,
 		PunchcardPreference: punchcardPreferences,
+		IsTnglSh:            s.Config.Pds.IsTnglShUser(user.Pds()),
+		IsDeactivated:       isDeactivated,
+		PdsDomain:           s.pdsDomain(),
+		HandleOpen:          r.URL.Query().Get("handle") == "1",
 	})
 }
 
···
 		_, _, _, _, err = ssh.ParseAuthorizedKey([]byte(key))
 		if err != nil {
 			s.Logger.Error("parsing public key", "err", err)
-			s.Pages.Notice(w, "settings-keys", "That doesn't look like a valid public key. Make sure it's a <strong>public</strong> key.")
+			s.Pages.NoticeHTML(w, "settings-keys", "That doesn't look like a valid public key. Make sure it's a <strong>public</strong> key.")
 			return
 		}
 
···
 
 			// invalid record
 			if err != nil {
-				s.Logger.Error("failed to delete record from PDS", "err", err)
-				s.Pages.Notice(w, "settings-keys", "Failed to remove key from PDS.")
+				s.Logger.Error("failed to delete record", "err", err)
+				s.Pages.Notice(w, "settings-keys", "Failed to remove key.")
 				return
 			}
 		}
···
 		return
 	}
 }
+
+func (s *Settings) pdsDomain() string {
+	parsed, err := url.Parse(s.Config.Pds.Host)
+	if err != nil {
+		return s.Config.Pds.Host
+	}
+	return parsed.Hostname()
+}
+
+func (s *Settings) elevateForHandle(w http.ResponseWriter, r *http.Request) {
+	user := s.OAuth.GetMultiAccountUser(r)
+	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+		http.Redirect(w, r, "/settings/profile", http.StatusSeeOther)
+		return
+	}
+
+	sess, err := s.OAuth.ResumeSession(r)
+	if err == nil && slices.Contains(sess.Data.Scopes, "identity:handle") {
+		http.Redirect(w, r, "/settings/profile?handle=1", http.StatusSeeOther)
+		return
+	}
+
+	redirectURL, err := s.OAuth.StartElevatedAuthFlow(
+		r.Context(), w, r,
+		user.Did(),
+		[]string{"identity:handle"},
+		"/settings/profile?handle=1",
+	)
+	if err != nil {
+		log.Printf("failed to start elevated auth flow: %s", err)
+		http.Redirect(w, r, "/settings/profile", http.StatusSeeOther)
+		return
+	}
+
+	http.Redirect(w, r, redirectURL, http.StatusFound)
+}
+
+func (s *Settings) updateHandle(w http.ResponseWriter, r *http.Request) {
+	user := s.OAuth.GetMultiAccountUser(r)
+	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+		s.Pages.Notice(w, "handle-error", "Handle changes are only available for tngl.sh accounts.")
+		return
+	}
+
+	handleType := r.FormValue("type")
+	handleInput := strings.TrimSpace(r.FormValue("handle"))
+
+	if handleInput == "" {
+		s.Pages.Notice(w, "handle-error", "Handle cannot be empty.")
+		return
+	}
+
+	var newHandle string
+	switch handleType {
+	case "subdomain":
+		if !isValidSubdomain(handleInput) {
+			s.Pages.Notice(w, "handle-error", "Invalid handle. Use only lowercase letters, digits, and hyphens.")
+			return
+		}
+		newHandle = handleInput + "." + s.pdsDomain()
+	case "custom":
+		newHandle = handleInput
+	default:
+		s.Pages.Notice(w, "handle-error", "Invalid handle type.")
+		return
+	}
+
+	client, err := s.OAuth.AuthorizedClient(r)
+	if err != nil {
+		log.Printf("failed to get authorized client: %s", err)
+		s.Pages.Notice(w, "handle-error", "Failed to authorize. Try logging in again.")
+		return
+	}
+
+	err = comatproto.IdentityUpdateHandle(r.Context(), client, &comatproto.IdentityUpdateHandle_Input{
+		Handle: newHandle,
+	})
+	if err != nil {
+		if strings.Contains(err.Error(), "ScopeMissing") || strings.Contains(err.Error(), "insufficient_scope") {
+			redirectURL, elevErr := s.OAuth.StartElevatedAuthFlow(
+				r.Context(), w, r,
+				user.Did(),
+				[]string{"identity:handle"},
+				"/settings/profile?handle=1",
+			)
+			if elevErr != nil {
+				log.Printf("failed to start elevated auth flow: %s", elevErr)
+				s.Pages.Notice(w, "handle-error", "Failed to start re-authorization. Try again later.")
+				return
+			}
+
+			s.Pages.HxRedirect(w, redirectURL)
+			return
+		}
+
+		log.Printf("failed to update handle: %s", err)
+		msg := err.Error()
+		var apiErr *atpclient.APIError
+		if errors.As(err, &apiErr) && apiErr.Message != "" {
+			msg = apiErr.Message
+		}
+		s.Pages.Notice(w, "handle-error", fmt.Sprintf("Failed to update handle: %s", msg))
+		return
+	}
+
+	s.Pages.NoticeHTML(w, "handle-success", fmt.Sprintf("Handle updated to <strong>%s</strong>.", html.EscapeString(newHandle)))
+}

appview/state/login.go

···
 package state
 
 import (
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
+	"time"
 
+	comatproto "github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/xrpc"
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 )
···
 				fmt.Sprintf("\"%s\" is an invalid handle. Did you mean %s.bsky.social or %s.tngl.sh?", handle, handle, handle),
 			)
 			return
+		}
+
+		ident, err := s.idResolver.ResolveIdent(r.Context(), handle)
+		if err != nil {
+			l.Warn("handle resolution failed", "handle", handle, "err", err)
+			s.pages.Notice(w, "login-msg", fmt.Sprintf("Could not resolve handle \"%s\". The account may not exist.", handle))
+			return
+		}
+
+		pdsEndpoint := ident.PDSEndpoint()
+		if pdsEndpoint == "" {
+			s.pages.Notice(w, "login-msg", fmt.Sprintf("No PDS found for \"%s\".", handle))
+			return
+		}
+
+		pdsClient := &xrpc.Client{Host: pdsEndpoint, Client: &http.Client{Timeout: 5 * time.Second}}
+		_, err = comatproto.RepoDescribeRepo(r.Context(), pdsClient, ident.DID.String())
+		if err != nil {
+			var xrpcErr *xrpc.Error
+			var xrpcBody *xrpc.XRPCError
+			isDeactivated := errors.As(err, &xrpcErr) &&
+				errors.As(xrpcErr.Wrapped, &xrpcBody) &&
+				xrpcBody.ErrStr == "RepoDeactivated"
+
+			if !isDeactivated {
+				l.Warn("describeRepo failed", "handle", handle, "did", ident.DID, "pds", pdsEndpoint, "err", err)
+				s.pages.Notice(w, "login-msg", fmt.Sprintf("Account \"%s\" is no longer available.", handle))
+				return
+			}
 		}
 
 		if err := s.oauth.SetAuthReturn(w, r, returnURL, addAccount); err != nil {