From 21d6ff330ffbaf9b37de93f7a3f2fbbfe2f3760b Mon Sep 17 00:00:00 2001
From: Marcos <marcos.lapuente@gmail.com>
Date: Thu, 10 Sep 2026 22:06:52 +0200
Subject: [PATCH] Add deleteStorage method to remove user storage data and
 update routes

---
 src/controllers/authController.js | 25 ++++++++++++++++++++++++-
 src/routes/authRoutes.js          |  2 ++
 src/services/authService.js       | 15 +++++++++++++++
 3 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/src/controllers/authController.js b/src/controllers/authController.js
index c2f8c7a..6d552f5 100644
--- a/src/controllers/authController.js
+++ b/src/controllers/authController.js
@@ -108,6 +108,29 @@ const deleteAllData = async (req, res) => {
   }
 };
 
+const deleteStorage = async (req, res) => {
+  try {
+    const authorizationHeader = req.headers.authorization || '';
+    if (!authorizationHeader.startsWith('Bearer ')) {
+      return res.status(401).json({ error: 'Authorization header missing or invalid' });
+    }
+
+    const token = authorizationHeader.slice(7).trim();
+    const payload = jwt.verify(token, JWT_SECRET);
+    const userId = payload && payload.id;
+    if (!userId) return res.status(401).json({ error: 'Usuario inválido en token' });
+
+    const result = await authService.deleteStorage(userId);
+
+    res.json(result);
+  } catch (error) {
+    if (error.name === 'JsonWebTokenError' || error.name === 'TokenExpiredError') {
+      return res.status(401).json({ error: 'Token inválido o expirado' });
+    }
+    res.status(500).json({ error: error.message });
+  }
+}
+
 const getSessionsInfo = async (req, res) => {
   try {
     const authorizationHeader = req.headers.authorization || '';
@@ -156,4 +179,4 @@ const logoutDevice = async (req, res) => {
 };
 
 // Exportamos los handlers de auth.
-module.exports = { register, login, refresh, logout, deleteAllData, getSessionsInfo, logoutDevice };
\ No newline at end of file
+module.exports = { register, login, refresh, logout, deleteAllData, getSessionsInfo, logoutDevice, deleteStorage };
\ No newline at end of file
diff --git a/src/routes/authRoutes.js b/src/routes/authRoutes.js
index cd65be1..5130fae 100644
--- a/src/routes/authRoutes.js
+++ b/src/routes/authRoutes.js
@@ -17,6 +17,8 @@ router.post('/logout', authController.logout);
 // DELETE /api/auth/delete-all-data
 router.delete('/delete-all-data', authController.deleteAllData);
 
+router.delete('/delete-storage', authController.deleteStorage);
+
 router.get('/getSessionsInfo', authController.getSessionsInfo);
 
 router.post('/logout-device', authController.logoutDevice); // Nueva ruta para cerrar sesión en un dispositivo específico
diff --git a/src/services/authService.js b/src/services/authService.js
index fb7f7c3..ff54238 100644
--- a/src/services/authService.js
+++ b/src/services/authService.js
@@ -106,6 +106,21 @@ class AuthService {
     });
   }
 
+  async deleteStorage(userId) {
+    if (!userId) {
+      throw new Error('userId es obligatorio');
+    }
+
+    return sequelize.transaction(async (transaction) => {
+      await Note.destroy({ where: { userId }, transaction });
+      await Category.destroy({ where: { userId }, transaction });
+
+      return {
+        message: 'Datos de almacenamiento del usuario eliminados correctamente; los tokens permanecen intactos.'
+      };
+    });
+  }
+
   async getSessionsInfo(userId) {
     if (!userId) {
       throw new Error('userId es obligatorio');