# "Delete my account" — mobile app contract

**Nothing changes in the app.** The endpoint and its answer are the same as before, but the account is
no longer deleted: it is *deactivated*. The customer can no longer sign in, exactly as if it were
deleted, and when the same phone number registers again the backend brings back **the same account**
(same `user.id`) with the new details. Orders, addresses, wallet and the coupons already used stay
with it, which is the point: deleting and re-registering no longer gives a fresh account with fresh
coupons.

All endpoints need the usual headers (`System-Key`, `Authorization: Bearer <sanctum token>` where
signed in). Base: `/api/v2`.

## What the app receives at each step

| Step | Request | Response |
|---|---|---|
| Delete (customer) | `GET auth/account-deletion` | `200 {"result":true,"message":"Your account deletion successfully done"}` — unchanged |
| Delete (seller, delivery boy, staff) | same | `200 {"result":false,"message":"This account type cannot be deleted from here. Please contact the administration."}` — nothing changes |
| Any call with a token of that account (any device) | — | `401 {"result":false,"message":"Unauthenticated"}`. Every token of the account is revoked. |
| OTP with the same phone | `POST verify-otp` | `200 {"result":true,"action":"register","message":"OTP verified. Proceed to register.","phone":"+963…"}` — the normal "new number" answer |
| Register | `POST auth/register` | the normal login payload; `user.id` is the **old** id |
| Register, but the account is banned | same | `422 {"result":false,"message":["User is banned"]}` |
| Password login | `POST auth/login` | `401 {"result":false,"message":"User not found"}` |
| Guest checkout account | `POST guest-user-account-create` | `200 {"result":false,"message":"This phone number belongs to an existing account. Please verify your phone number to continue."}` |

## Rules the app relies on

- `auth/register` brings the old account back **only after `verify-otp` succeeded for that number in
  the last 30 minutes**. Registration itself checks no OTP, and the old account holds orders and a
  wallet, so without the proof the answer stays the usual `422 "The phone has already been taken"`.
- Registering this way gives **no** welcome coupon, referral points or invitation: the account is not new.
- Signing in with Google/Apple to a deactivated account brings it back too (the provider proves it).
- Only `user_type = customer` can delete itself. The app should not show the button to other account
  types; if it does, they get the `result:false` answer above.

## Admin side (for reference)

Admin → Customers has a deactivate / reactivate button (permission `deactivate_customer`) and an
"Account Status" filter. Hard deletion of customers, sellers and staff is Super Admin only.