feat: change email, export my data, delete account (with data anonymization)

test/get_current_user_http_test.go

@@ -92,6 +92,27 @@ func TestGetCurrentUserHttp(t *testing.T) {
 		}
 	})
 
+	t.Run("The profile carries pending_email, null when nothing is pending", func(t *testing.T) {
+		token := authtoken.New([]byte("test-secret"))
+		userRepo := newMockUserRepo()
+		userRepo.users[7] = user.User{ID: 7, Username: "marta", Email: "marta@renew.example", IsVerified: true, RoleID: ownerRoleID}
+		userRepo.users[8] = user.User{ID: 8, Username: "ines", Email: "ines@renew.example", IsVerified: true, RoleID: ownerRoleID, PendingEmail: "new@renew.example"}
+		router := newGetCurrentUserRouter(userRepo, &stubHasher{}, token)
+
+		none := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/auth/me", mintGetCurrentUserCookie(t, token, 7, 0))
+		pending := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/auth/me", mintGetCurrentUserCookie(t, token, 8, 0))
+
+		var noneBody, pendingBody map[string]any
+		_ = json.Unmarshal(none.Body.Bytes(), &noneBody)
+		_ = json.Unmarshal(pending.Body.Bytes(), &pendingBody)
+		if value, present := noneBody["pending_email"]; !present || value != nil {
+			t.Errorf("expected pending_email null, got %v (present %v)", value, present)
+		}
+		if pendingBody["pending_email"] != "new@renew.example" {
+			t.Errorf("expected the pending address, got %v", pendingBody["pending_email"])
+		}
+	})
+
 	t.Run("An unverified user still fetches their own profile, with is_verified false, not a 403", func(t *testing.T) {
 		token := authtoken.New([]byte("test-secret"))
 		userRepo := newMockUserRepo()