Compliance

.github/workflows/ci.yml

@@ -242,6 +242,7 @@ jobs:
           DATABASE_URL: "sqlite::memory:"
           JWT_SECRET: ci-test-secret
           FRONTEND_URL: http://localhost:4173
+          IDENTITY_HASH_PEPPER: ci-test-pepper
 
       - name: Upload blob report
         uses: actions/upload-artifact@v6

src/backend/Cargo.toml

@@ -33,3 +33,5 @@ utoipa = { version = "5.4.0", features = ["axum_extras", "uuid", "chrono"] }
 utoipa-scalar = { version = "0.3.0", features = ["axum"] }
 utoipa-swagger-ui = { version = "9.0.2", features = ["axum"] }
 bcrypt = "0.18.0"
+sha2 = "0.10.8"
+hex = "0.4.3"

src/backend/migrations/06_add_identity_hashes.sql

@@ -0,0 +1,8 @@
+-- Table to store hashed identifiers of deleted accounts to prevent circumvention
+CREATE TABLE IF NOT EXISTS identity_hashes (
+    hash TEXT PRIMARY KEY,
+    type TEXT NOT NULL, -- 'DISCORD' or 'WALLET'
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_hashes_type ON identity_hashes(type);

src/backend/src/audit.rs

@@ -23,6 +23,7 @@ pub enum AuditAction {
     SuperAdminCreateTribe,
     SuperAdminUpdateTribe,
     SuperAdminDeleteWallet,
+    DeleteUser,
 }
 
 impl AuditAction {
@@ -45,6 +46,7 @@ impl AuditAction {
             AuditAction::SuperAdminCreateTribe => "SUPER_ADMIN_CREATE_TRIBE",
             AuditAction::SuperAdminUpdateTribe => "SUPER_ADMIN_UPDATE_TRIBE",
             AuditAction::SuperAdminDeleteWallet => "SUPER_ADMIN_DELETE_WALLET",
+            AuditAction::DeleteUser => "DELETE_USER",
         }
     }
 }