mws.backend.dotnet/application/Users/Commands/DeleteUser.cs

using MediatR;
using mws.backend.dotnet.application.Audit;
using mws.backend.dotnet.application.Common;
using mws.backend.dotnet.application.Permissions;

namespace mws.backend.dotnet.application.Users;

public record DeleteUserCommand(Guid ActorUserId, Guid Id) : IRequest, IAuditableRequest
{
    public string Action => "User.Delete";
    public string EntityType => "User";
    public Guid? EntityId => Id;
}

public class DeleteUserHandler(IUnitOfWork uow, IPermissionService permissions, IAuditContext auditContext) : IRequestHandler<DeleteUserCommand>
{
    private const string Screen = "users";

    public async Task Handle(DeleteUserCommand command, CancellationToken ct)
    {
        await permissions.EnsureAsync(command.ActorUserId, Screen, PermissionAction.Delete, ct);

        var user = await uow.Users.GetByIdAsync(command.Id, ct)
            ?? throw new NotFoundException("User not found");

        var soleOwnerProjectIds = await uow.Projects.GetOwnedProjectIdsAsync(command.Id, ct);

        foreach (var projectId in soleOwnerProjectIds)
        {
            var ownerCount = await uow.Projects.CountOwnersAsync(projectId, ct);
            if (ownerCount <= 1)
            {
                throw new BadRequestException("Cannot delete a user that is the sole owner of a project");
            }
        }

        uow.Users.Remove(user);
        await uow.SaveChangesAsync(ct);

        auditContext.EntityName = user.Username;
    }
}