# Non-Prod User Hard Delete

This runbook describes the admin hard-delete behavior for local development at
`http://localhost:3000`.

## Scope

- Enabled only in `local`.
- Blocked in `prod`.
- Requires Stripe test keys.

## What Gets Deleted

- Clerk user record.
- Local PostgreSQL user-owned StratoFusion state.
  - service accounts and tokens.
  - preferences.
  - quota tables and history.
  - activity and audit logs tied to the deleted user.
  - backup and sync jobs plus job items and bisync state.
  - transfer operations and related event rows.
  - upload-folder cache rows for the deleted user's connected accounts.
  - persisted `user_subscriptions` billing projection rows.
  - active operation tracking rows tied to the user's known operation IDs.
- Stripe test data.
  - active test subscriptions are cancelled.
  - canceled subscriptions remain historical but the customer is deleted.
  - the Stripe customer is deleted after subscription cleanup.

## Provider Revocation

StratoFusion removes provider tokens from the local database for all connected accounts. It also attempts provider-side grant revocation where the app can do so safely:

- Google: revoke token.
- Dropbox: revoke token.
- OneDrive: local token removal only.
- Other providers: local token removal only unless explicit revocation support is added.

## Ordering

1. Cancel running or scheduled jobs
2. Clear token-refresh schedules
3. Revoke provider grants where supported
4. Delete Stripe test customer state
5. Delete local PostgreSQL user state
6. Delete Clerk user
7. Run a final billing-projection cleanup pass to catch late non-prod webhook writes

## Notes

- This is intended for disposable non-production users.
- Role assignments still come from `ADMIN_USER_IDS` and `DEV_USER_IDS`. If a deleted user ID is still present in env vars, update the env and redeploy.
- Production should use a different lifecycle than this hard-delete flow.