From 8a22b04842febdcf7bd4eed234419686c85aaea5 Mon Sep 17 00:00:00 2001
From: Mike Johnston <mike@nervesocket.com>
Date: Fri, 20 Mar 2026 15:38:39 -0400
Subject: [PATCH] feat: enhance hard delete functionality to reassign
 user-related hunts

---
 src/models/index.js | 5 ++++-
 src/routes/admin.js | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/models/index.js b/src/models/index.js
index 02437a9..8c2af6c 100644
--- a/src/models/index.js
+++ b/src/models/index.js
@@ -162,8 +162,11 @@ const Users = {
     db.prepare("DELETE FROM sessions WHERE sess LIKE ?").run('%"userId":' + userId + '%');
   },
 
-  hardDeleteUser(userId) {
+  hardDeleteUser(userId, reassignTo) {
     this._scrubUserContent(userId);
+    if (reassignTo) {
+      db.prepare('UPDATE hunts SET created_by = ? WHERE created_by = ?').run(reassignTo, userId);
+    }
     db.prepare('DELETE FROM scans WHERE user_id = ?').run(userId);
     db.prepare('UPDATE packages SET first_scanned_by = NULL WHERE first_scanned_by = ?').run(userId);
     db.prepare('UPDATE packages SET last_scanned_by = NULL WHERE last_scanned_by = ?').run(userId);
diff --git a/src/routes/admin.js b/src/routes/admin.js
index abfd3ef..331f5d7 100644
--- a/src/routes/admin.js
+++ b/src/routes/admin.js
@@ -203,7 +203,7 @@ router.post('/users/:id/hard-delete', requireAdmin, (req, res) => {
     return res.redirect('/admin');
   }
 
-  Users.hardDeleteUser(userId);
+  Users.hardDeleteUser(userId, req.session.userId);
   req.session.flash = { type: 'success', message: `Account "${user.display_name || user.username}" has been permanently removed.` };
   res.redirect('/admin');
 });