fix(keys): remove stale user update on delete

src/app/api/keys/delete/route.js

@@ -7,7 +7,7 @@ import { NextResponse } from 'next/server';
 import { createSupabaseServerClient } from '@/lib/supabase.js';
 import { createClient } from '@supabase/supabase-js';
 
-export async function POST(request, { params } = {}) {
+export async function POST() {
 	try {
 		// Create Supabase client using the server client helper (handles auth automatically)
 		const supabase = await createSupabaseServerClient();
@@ -35,15 +35,6 @@ export async function POST(request, { params } = {}) {
 			.delete()
 			.eq('user_id', user.id);
 
-		// Also clear from users table if needed
-		const { error: updateError } = await serviceSupabase
-			.from('users')
-			.update({
-				ml_kem_public_key: null,
-				updated_at: new Date().toISOString()
-			})
-			.eq('user_id', user.id);
-
 		if (deleteError) {
 			console.error('Database deletion failed:', deleteError);
 			return NextResponse.json({ error: `Database deletion failed: ${deleteError.message}` }, { status: 500 });
@@ -56,4 +47,4 @@ export async function POST(request, { params } = {}) {
 		console.error('Key deletion API error:', error);
 		return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
 	}
-}
+}

src/app/api/keys/delete/route.test.js

@@ -0,0 +1,74 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+	authGetUser: vi.fn(),
+	from: vi.fn()
+}));
+
+vi.mock('@/lib/supabase.js', () => ({
+	createSupabaseServerClient: vi.fn(async () => ({
+		auth: {
+			getUser: mocks.authGetUser
+		}
+	}))
+}));
+
+vi.mock('@supabase/supabase-js', () => ({
+	createClient: vi.fn(() => ({
+		from: mocks.from
+	}))
+}));
+
+function createDeleteQuery(result) {
+	const query = {
+		delete: vi.fn(() => query),
+		eq: vi.fn().mockResolvedValue(result)
+	};
+	return query;
+}
+
+describe('POST /api/keys/delete', () => {
+	beforeEach(() => {
+		vi.resetModules();
+		vi.clearAllMocks();
+
+		mocks.authGetUser.mockResolvedValue({
+			data: { user: { id: 'auth-user-id' } },
+			error: null
+		});
+	});
+
+	it('deletes the authenticated public key without touching the users profile table', async () => {
+		const deleteQuery = createDeleteQuery({ error: null });
+		mocks.from.mockImplementation((table) => {
+			if (table === 'user_public_keys') return deleteQuery;
+			throw new Error(`Unexpected table: ${table}`);
+		});
+
+		const { POST } = await import('./route.js');
+		const response = await POST();
+		const body = await response.json();
+
+		expect(response.status).toBe(200);
+		expect(body).toEqual({ success: true, message: 'Public key deleted successfully' });
+		expect(mocks.from).toHaveBeenCalledWith('user_public_keys');
+		expect(mocks.from).not.toHaveBeenCalledWith('users');
+		expect(deleteQuery.eq).toHaveBeenCalledWith('user_id', 'auth-user-id');
+	});
+
+	it('returns a database error when public key deletion fails', async () => {
+		const deleteQuery = createDeleteQuery({ error: { message: 'delete failed' } });
+		mocks.from.mockImplementation((table) => {
+			if (table === 'user_public_keys') return deleteQuery;
+			throw new Error(`Unexpected table: ${table}`);
+		});
+
+		const { POST } = await import('./route.js');
+		const response = await POST();
+		const body = await response.json();
+
+		expect(response.status).toBe(500);
+		expect(body).toEqual({ error: 'Database deletion failed: delete failed' });
+		expect(mocks.from).not.toHaveBeenCalledWith('users');
+	});
+});