Allow users to unlink cards

Author: soundstorm

app/api/v1/users.py

@@ -49,6 +49,18 @@ def get_me(
     return _me_user(user, db)
 
 
+@router.delete("/me/oidc", response_model=MessageResponse)
+def unlink_me_oidc(
+    user: dict = Depends(require_session_user),
+    db: Session = Depends(get_db),
+):
+    """Unlink the current OIDC account from its NFC card. The card record is kept."""
+    db_user = _me_user(user, db)
+    db_user.oidc_sub = None
+    db.commit()
+    return {"message": "Card unlinked successfully"}
+
+
 @router.get("/me/transactions", response_model=list[MeTransactionResponse])
 def get_me_transactions(
     limit: int = Query(default=50, ge=1, le=200),

app/web/locales/de.json

@@ -262,6 +262,8 @@
   "me.sessions_title":     "Maschinensitzungen",
   "me.sessions_empty":     "Noch keine Maschinensitzungen.",
   "me.sessions_machine":   "Maschine",
+  "me.btn_unlink_card":    "Karte trennen",
+  "me.unlink_confirm":     "NFC-Karte von diesem Konto trennen? Du musst danach eine neue Karte verknüpfen, um wieder auf dein Guthaben zuzugreifen.",
 
   "connect.title_success":      "Karte verknüpft",
   "connect.title_failure":      "Verknüpfung fehlgeschlagen",

app/web/locales/en.json

@@ -262,6 +262,8 @@
   "me.sessions_title":     "Machine Sessions",
   "me.sessions_empty":     "No machine sessions yet.",
   "me.sessions_machine":   "Machine",
+  "me.btn_unlink_card":    "Unlink card",
+  "me.unlink_confirm":     "Unlink your NFC card from this account? You will need to re-link a card to access your balance again.",
 
   "connect.title_success":      "Card Linked",
   "connect.title_failure":      "Link Failed",

app/web/static/css/tailwind.css

@@ -19,6 +19,10 @@
         <div>
           <h1 class="text-2xl font-bold mb-1" x-text="profile.name || '—'"></h1>
           <p class="text-xs text-gray-400 font-mono">{{ _('me.card_id') }}: <span x-text="profile.id"></span></p>
+          <button @click="unlinkCard()"
+                  class="mt-2 text-xs text-red-500 hover:underline">
+            {{ _('me.btn_unlink_card') }}
+          </button>
         </div>
         <div class="text-right">
           <div class="text-3xl font-bold tabular-nums"
@@ -303,6 +307,14 @@ <h2 class="font-semibold">{{ _('me.transactions_title') }}</h2>
     txLabel(type) {
       return _TX_LABELS[type] || type;
     },
+
+    async unlinkCard() {
+      if (!confirm({{ _('me.unlink_confirm') | tojson }})) return;
+      const r = await apiFetch('/api/v1/users/me/oidc', { method: 'DELETE' });
+      if (r.ok) {
+        this.profile = null;
+      }
+    },
   }
 }
 </script>