From 318ad36967af64379b63c70176228a735581197c Mon Sep 17 00:00:00 2001
From: Mauricio Siu <siumauricio@icloud.com>
Date: Mon, 14 Sep 2026 11:05:26 -0600
Subject: [PATCH] feat: restrict self-service account deletion to cloud
 organization owners

---
 .../settings/profile/delete-account.tsx       | 16 ++++--------
 apps/dokploy/server/api/routers/user.ts       | 26 +++++++++++--------
 2 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/apps/dokploy/components/dashboard/settings/profile/delete-account.tsx b/apps/dokploy/components/dashboard/settings/profile/delete-account.tsx
index 9c18831ee..18a9f1bd2 100644
--- a/apps/dokploy/components/dashboard/settings/profile/delete-account.tsx
+++ b/apps/dokploy/components/dashboard/settings/profile/delete-account.tsx
@@ -44,11 +44,7 @@ export const DeleteAccount = () => {
 	const email = data?.user?.email ?? "";
 	const isBusy = requestCode.isPending || deleteAccount.isPending;
 
-	if (
-		!data ||
-		hasPassword === undefined ||
-		(!isCloud && data.role === "owner")
-	) {
+	if (!isCloud || !data || data.role !== "owner" || hasPassword === undefined) {
 		return null;
 	}
 
@@ -96,12 +92,10 @@ export const DeleteAccount = () => {
 			</CardHeader>
 			<CardContent className="flex flex-col gap-4">
 				<ul className="text-sm text-muted-foreground list-disc pl-5 space-y-1">
-					{isCloud && (
-						<li>
-							Active subscriptions are cancelled immediately. Invoices already
-							issued are kept for accounting.
-						</li>
-					)}
+					<li>
+						Active subscriptions are cancelled immediately. Invoices already
+						issued are kept for accounting.
+					</li>
 					<li>
 						Every organization you own is deleted, including its projects,
 						services, environments, domains and server connections.
diff --git a/apps/dokploy/server/api/routers/user.ts b/apps/dokploy/server/api/routers/user.ts
index 10d55cacd..576548737 100644
--- a/apps/dokploy/server/api/routers/user.ts
+++ b/apps/dokploy/server/api/routers/user.ts
@@ -85,6 +85,13 @@ const assertCanDeleteOwnAccount = async (ctx: {
 	user: { id: string };
 	session: { impersonatedBy?: string };
 }) => {
+	if (!IS_CLOUD) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message: "This feature is only available in Dokploy Cloud",
+		});
+	}
+
 	if (ctx.session.impersonatedBy) {
 		throw new TRPCError({
 			code: "FORBIDDEN",
@@ -92,18 +99,15 @@ const assertCanDeleteOwnAccount = async (ctx: {
 		});
 	}
 
-	if (!IS_CLOUD) {
-		const ownedOrganization = await db.query.organization.findFirst({
-			where: eq(organization.ownerId, ctx.user.id),
-			columns: { id: true },
+	const ownedOrganization = await db.query.organization.findFirst({
+		where: eq(organization.ownerId, ctx.user.id),
+		columns: { id: true },
+	});
+	if (!ownedOrganization) {
+		throw new TRPCError({
+			code: "FORBIDDEN",
+			message: "Only organization owners can delete their account",
 		});
-		if (ownedOrganization) {
-			throw new TRPCError({
-				code: "FORBIDDEN",
-				message:
-					"Transfer or delete the organizations you own before deleting your account",
-			});
-		}
 	}
 };