Confusing behavior if attempting to sign up using a social login associated with a recently deleted account
- Dominant language
- Python
- Stars
- 3.2k
- Forks
- 459
- Avg merge
- 27d 1h
- Merged PRs (30d)
- 1
Description
**Steps to reproduce:**
1. Create an account using social login
2. Add a password to the account
3. Delete the account
4. Immediately attempt to create a new account using the same social login
**Expected:**
Ideally, I should be able to create a new account at step 4. If that is not possible, there should be a message explaining why I can't.
**Actual:**
After clicking with "Continue with {provider}" at the login or signup screen, you get redirected back to the login screen if that social login is associated with a recently deleted user account, which still exists in the `user` table with `deleted=true`.
**Notes:**
See [Slack thread](https://hypothes-is.slack.com/archives/C1MA4E9B9/p1754647078987219) for discussion of why this happens. Briefly, deleting a user account does not remove the account immediately but sets `deleted=true`. The user details and identities persist in the system until a task runs, on a 5-minute schedule, to clean up old accounts.
One possible solution would be to clear out identity information immediately when the account is deleted, allowing an immediate new sign up with the same login.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the steps through the login or signup screen, then trace how a social identity linked to a user with deleted=true is handled. Inspect the user table state and the scheduled cleanup task; done means the behavior is either an immediate new signup or a clear explanation to the user.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100