Customer deletion with unsubscribe notice

CRM · Customer deletion with unsubscribe notice

Deletes a customer record and, unless the operator opts out, posts to users_unsubscribe_send so the person receives an unsubscribe/erasure notification.

Area	CRM
Routes	crm.users.index
Centre modules	crm
Staff levels	root · admin · manager
Models	user
UI label	delete
Coverage	2 use cases · 1 happy · 3 failure

Known issues (1)

• 🔴 High — Unsubscribe notice is fire-and-forget on customer deletion

How it works

sendRemoveEmail defaults to true and is reset to true in finally, so the opt-out is per-deletion rather than sticky. The notification is a raw fetch to /api/v4/users_unsubscribe_send with the bearer token — fire-and-forget, with no .then/.catch, so its outcome is invisible to the operator. Deletion itself goes through destroyRecord().

Use cases

Why someone opens this (2)

• Honouring a GDPR erasure request and confirming it to the customer by email.
• Removing a duplicate or test registration without emailing anyone (opt-out ticked).

Path map

flowchart LR
    F(["Customer deletion with unsubscribe notice"]):::feat
    F --> H1["Delete and notify"]:::ok
    F -.-> X1["Invalid model"]:::bad
    F -.-> X2["Delete rejected by the API"]:::bad
    F -.-> X3["Unsubscribe email never sent"]:::bad
    classDef feat fill:#157068,stroke:#157068,color:#ffffff,font-weight:bold
    classDef ok fill:#e3f1ea,stroke:#0d6b42,color:#0d4a2e
    classDef bad fill:#f7e6e2,stroke:#9a2d1c,color:#6e1f13

Happy paths

Delete and notify

1. Operator clicks delete on a row and confirms in the deletion modal.
2. destroyRecord() removes the customer.
3. Because sendRemoveEmail is true, an unsubscribe notification is posted for that user id.
4. The flag resets to true for the next deletion.

Failure paths

Invalid model

Cause — delete called without a model or id.

What happens — Throws TypeError('model' is not a valid user).

Delete rejected by the API

Cause — Referential constraints or permissions.

What happens — destroyRecord() rejects; the .then that sends the email is skipped, but the finally still resets the flag. There is no explicit user-facing error for this branch.

Unsubscribe email never sent

Cause — The fire-and-forget fetch fails (network, 4xx/5xx).

What happens — Unhandled and unreported — the customer is deleted but never notified. A compliance-relevant blind spot.

QA checklist

Tick these off while regression-testing this feature. The boxes are plain Markdown, so progress is visible in git diffs.

• ✅ Delete and notify
• ⛔ Invalid model
• ⛔ Delete rejected by the API
• ⛔ Unsubscribe email never sent

Implementation

• app/controllers/crm/users/index.js
• app/routes/crm/users/index.js

Translation keys (1)

Key	English
delete	Delete

Related

• Same area — Customer list & filtering · Customer create & edit · Customer CSV export with column picker · Customer CSV import · Children CSV import · AI natural-language customer filter · Save current filters as a segment · Segment list, refresh & export · Segment builder with automatic tag actions · Segment categories · User tags (user types) · Customer receipts tab & ticket-stamp generation · Customer loyalty — raffle tickets · Customer loyalty — cards & stamps · Customer loyalty — rewards · Customer loyalty — coupon exchanges · Customer children (dependants) · Receipt verification queue · Store list, filters & exports · Store create & edit · Store CSV import · Store labels (store types) · Customer action log (dormant)
• Shares data with — Data-quality dashboard · Play centre stays (check-in - check-out) · Realtime updates (Pusher)

---

Generated from doc/feature-inventory.json · id crm-customer-delete · commit 276788ca6