Node.js Account Shutdown: Token Revocation and Eventual Deletion in 3 Steps
In a customer-support system, the hard part of account shutdown is deciding what must stop now and what can wait. A stolen refresh token is an immediate abuse problem; an account deletion request is a data-lifecycle problem with a different recovery window. Short answer: keep a stable user ID, mark profile state before destructive work, revoke every session for a compromise, and delete only after…
When a customer's session is stolen or they need to close their account, there are important steps to follow to ensure safety and compliance. First, the system must stop the compromise. If the refresh token is stolen, all sessions for that user must be revoked to prevent further unauthorized access. This is a security measure focused on protecting the user's identity.
For a normal shutdown, the profile state should be set to "non-active" first. This action prevents new privileged actions from being taken in the application, while still maintaining the user ID for audit purposes. A key point is that these two processes, stopping the compromise and shutting down the account, should not be done simultaneously.
The order of operations is crucial. The SRE (Site Reliability Engineering) team needs clear targets to measure their performance. Revoking sessions belongs to the security SLO (Service Level Objective), which deals with the time it takes for all sessions to become unusable after a report. Deletion, on the other hand, belongs to the lifecycle SLO, which deals with the time from an approved request to removal, with an explicit hold for any legal, fraud, or support investigation.
It's important to focus on identity stability first. A user ID should be used as the primary key, as the email address can change. The transition of the user's state should be recorded in the business layer, with proper authorization checks in place. Once the profile state is set, session revocation can be performed. This operation is broad because the risk is the user's identity.
Finally, after all recovery and audit requirements are met, a worker can perform the eventual deletion. The caching of deleted or disabled profiles should not exceed the policy limits to avoid undermining the shutdown process. When implementing this process, a Go control path can be used behind an authenticated operator action. It involves calling an Infra service over a REST contract, with the bearer token read from the environment.
The state transition remains in the business service, ensuring the audit record and authorization check are in the same transaction boundary.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
