Implement account deletion handling and improve user feedback

- Added checks for accounts marked for deletion in signup, verification, and password reset processes.
- Updated reward and task listing to sort user-created items first.
- Enhanced user API to clear verification and reset tokens when marking accounts for deletion.
- Introduced tests for marked accounts to ensure proper handling in various scenarios.
- Updated profile and reward edit components to reflect changes in validation and data handling.

backend/api/auth_api.py

@@ -39,7 +39,11 @@ def signup():
     email = data.get('email', '')
     norm_email = normalize_email(email)    
 
-    if users_db.search(UserQuery.email == norm_email):
+    existing = users_db.get(UserQuery.email == norm_email)
+    if existing:
+        user = User.from_dict(existing)
+        if user.marked_for_deletion:
+            return jsonify({'error': 'Account marked for deletion', 'code': ACCOUNT_MARKED_FOR_DELETION}), 403
         return jsonify({'error': 'Email already exists', 'code': EMAIL_EXISTS}), 400
 
     token = secrets.token_urlsafe(32)
@@ -78,6 +82,10 @@ def verify():
             status = 'error'
             reason = 'Invalid token'
             code = INVALID_TOKEN
+        elif user.marked_for_deletion:
+            status = 'error'
+            reason = 'Account marked for deletion'
+            code = ACCOUNT_MARKED_FOR_DELETION
         else:
             created_str = user.verify_token_created
             if not created_str:
@@ -175,6 +183,8 @@ def me():
         user = User.from_dict(user_dict) if user_dict else None
         if not user:
             return jsonify({'error': 'User not found', 'code': USER_NOT_FOUND}), 404
+        if user.marked_for_deletion:
+            return jsonify({'error': 'Account marked for deletion', 'code': ACCOUNT_MARKED_FOR_DELETION}), 403
         return jsonify({
             'email': user.email,
             'id': user_id,
@@ -201,14 +211,14 @@ def request_password_reset():
     user_dict = users_db.get(UserQuery.email == norm_email)
     user = User.from_dict(user_dict) if user_dict else None
     if user:
-        # Silently ignore reset requests for marked accounts (don't leak account status)
-        if not user.marked_for_deletion:
-            token = secrets.token_urlsafe(32)
-            now_iso = datetime.utcnow().isoformat()
-            user.reset_token = token
-            user.reset_token_created = now_iso
-            users_db.update(user.to_dict(), UserQuery.email == norm_email)
-            send_reset_password_email(norm_email, token)
+        if user.marked_for_deletion:
+            return jsonify({'error': 'Account marked for deletion', 'code': ACCOUNT_MARKED_FOR_DELETION}), 403
+        token = secrets.token_urlsafe(32)
+        now_iso = datetime.utcnow().isoformat()
+        user.reset_token = token
+        user.reset_token_created = now_iso
+        users_db.update(user.to_dict(), UserQuery.email == norm_email)
+        send_reset_password_email(norm_email, token)
 
     return jsonify({'message': success_msg}), 200
 

backend/api/reward_api.py

@@ -65,7 +65,13 @@ def list_rewards():
         if r.get('user_id') is None and r['name'].strip().lower() in user_rewards:
             continue  # Skip default if user version exists
         filtered_rewards.append(r)
-    return jsonify({'rewards': filtered_rewards}), 200
+    
+    # Sort: user-created items first (by name), then default items (by name)
+    user_created = sorted([r for r in filtered_rewards if r.get('user_id') == user_id], key=lambda x: x['name'].lower())
+    default_items = sorted([r for r in filtered_rewards if r.get('user_id') is None], key=lambda x: x['name'].lower())
+    sorted_rewards = user_created + default_items
+    
+    return jsonify({'rewards': sorted_rewards}), 200
 
 @reward_api.route('/reward/<id>', methods=['DELETE'])
 def delete_reward(id):

backend/api/task_api.py

@@ -63,7 +63,13 @@ def list_tasks():
         if t.get('user_id') is None and t['name'].strip().lower() in user_tasks:
             continue  # Skip default if user version exists
         filtered_tasks.append(t)
-    return jsonify({'tasks': filtered_tasks}), 200
+    
+    # Sort: user-created items first (by name), then default items (by name)
+    user_created = sorted([t for t in filtered_tasks if t.get('user_id') == user_id], key=lambda x: x['name'].lower())
+    default_items = sorted([t for t in filtered_tasks if t.get('user_id') is None], key=lambda x: x['name'].lower())
+    sorted_tasks = user_created + default_items
+    
+    return jsonify({'tasks': sorted_tasks}), 200
 
 @task_api.route('/task/<id>', methods=['DELETE'])
 def delete_task(id):

backend/api/user_api.py

@@ -231,6 +231,13 @@ def mark_for_deletion():
     # Mark for deletion
     user.marked_for_deletion = True
     user.marked_for_deletion_at = datetime.now(timezone.utc).isoformat()
+
+    # Invalidate any outstanding verification/reset tokens so they cannot be used after marking
+    user.verify_token = None
+    user.verify_token_created = None
+    user.reset_token = None
+    user.reset_token_created = None
+
     users_db.update(user.to_dict(), UserQuery.id == user.id)
     
     # Trigger SSE event