feat(account): add deletion lifecycle

JobTrackerApi.Tests/AuthSessionRevocationTests.cs

@@ -21,6 +21,9 @@ public sealed class AuthSessionRevocationTests
     public async Task Logout_revokes_the_exact_session_and_a_copied_principal_stops_working()
     {
         using var db = TestHostFactory.CreateInMemoryDb(null);
+        db.Users.AddRange(
+            new ApplicationUser { Id = "user-1", UserName = "one@example.test", Email = "one@example.test" },
+            new ApplicationUser { Id = "user-2", UserName = "two@example.test", Email = "two@example.test" });
         db.UserSessions.Add(Session("sid-current", "user-1"));
         db.UserSessions.Add(Session("sid-other", "user-2"));
         await db.SaveChangesAsync();
@@ -130,6 +133,17 @@ public sealed class AuthSessionRevocationTests
         Assert.True(await LocalSessionValidator.IsValidAsync(db, Principal("user-1", "sid-pending"), DateTimeOffset.UtcNow));
     }
 
+    [Fact]
+    public async Task Session_validator_rejects_an_account_pending_deletion()
+    {
+        using var db = TestHostFactory.CreateInMemoryDb(null);
+        db.Users.Add(new ApplicationUser { Id = "user-1", Email = "pending-delete@example.test", UserName = "pending-delete@example.test", DeletionStatus = AccountDeletionStatuses.Pending });
+        db.UserSessions.Add(Session("sid-delete", "user-1"));
+        await db.SaveChangesAsync();
+
+        Assert.False(await LocalSessionValidator.IsValidAsync(db, Principal("user-1", "sid-delete"), DateTimeOffset.UtcNow));
+    }
+
     [Fact]
     public async Task Password_security_stamp_change_invalidates_a_pending_two_factor_challenge()
     {