Let an admin delete a vault, behind their own password

The web interface could create a vault and never remove one, so the only
way to undo a mistake was the CLI. There is now a Delete link on every
vault you administer, leading to a page that says what is about to go —
owner, versions stored, grants pointing at it — and asks for your
account password before it goes.

The gate is re-authentication, not a confirmation checkbox. A session
token is enough to read and write a vault; it should not be enough to
erase every version of one, because a session is what an unlocked
laptop leaves lying around. The one-time code is required too when the
account has one enrolled.

It lives in confirmDeletion, so the rule holds wherever deletion is
reachable: DELETE /api/v1/databases/{id} now takes {password, totp?}
and answers 401 without it, and keeporg db -delete prompts. That is a
breaking change to the endpoint, which is why the server goes to 0.7.0
and the desktop clients to 0.4.0.

An account that signs in only through an identity provider has no
password to type. Rather than lock those deployments out of deleting
anything, they confirm by typing the vault's exact name — the weaker
gate, and deliberately the fallback.

Deleting takes the record, its grants, every stored version and the key
a merge vault left with the server, and tells the watchers over SSE.
Copies already in people's mirror directories stay where they are: the
server stops tracking a vault, it does not reach into anybody's home
directory.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/server/web.go

@@ -217,6 +217,76 @@ func (s *Server) handleWebChangePassword(w http.ResponseWriter, r *http.Request,
 	}
 }
 
+// webDeleteVault is what the confirmation page shows before a vault goes.
+type webDeleteVault struct {
+	ID      string
+	Name    string
+	Group   string
+	Version int64
+	Updated string
+	Grants  int
+	// NeedsName marks an account with no password of its own, which confirms
+	// by typing the vault's name instead; NeedsTOTP marks one with a second
+	// factor enrolled.
+	NeedsName bool
+	NeedsTOTP bool
+}
+
+// deleteVaultView gathers what is about to be destroyed, or nil when the
+// caller does not administer the vault.
+func (s *Server) deleteVaultView(u *store.User, id string) *webDeleteVault {
+	var out *webDeleteVault
+	s.st.Read(func(st *store.State) {
+		db := st.Databases[id]
+		if db == nil || st.DatabasePerm(u.ID, id) != store.PermAdmin {
+			return
+		}
+		v := &webDeleteVault{ID: db.ID, Name: db.Name, Version: db.Version, Updated: "never"}
+		if db.Version > 0 {
+			v.Updated = db.UpdatedAt.UTC().Format("2006-01-02 15:04 UTC")
+		}
+		if g := st.Groups[db.OwnerGroupID]; g != nil {
+			v.Group = g.Name
+		}
+		for _, gr := range st.Grants {
+			if gr.DatabaseID == id {
+				v.Grants++
+			}
+		}
+		if target := st.Users[u.ID]; target != nil {
+			v.NeedsName = target.PassHash == ""
+			v.NeedsTOTP = target.TOTPConfirmed
+		}
+		out = v
+	})
+	return out
+}
+
+func (s *Server) handleWebDeleteVaultPage(w http.ResponseWriter, r *http.Request, sess *webSession) {
+	s.renderDeleteVault(w, sess, r.PathValue("id"), "")
+}
+
+func (s *Server) handleWebDeleteVault(w http.ResponseWriter, r *http.Request, sess *webSession) {
+	id := r.PathValue("id")
+	name, err := s.deleteDatabase(sess.user, id, r.FormValue("password"),
+		r.FormValue("totp"), r.FormValue("confirm_name"))
+	switch {
+	case errors.Is(err, errTOTPRequired):
+		s.renderDeleteVault(w, sess, id, "Enter your one-time code as well.")
+	case errors.Is(err, errTOTPInvalid):
+		s.renderDeleteVault(w, sess, id, "That one-time code was rejected.")
+	case errors.Is(err, errBadCredentials):
+		s.renderDeleteVault(w, sess, id, "That is not your account password.")
+	case errors.Is(err, errConfirmName):
+		s.renderDeleteVault(w, sess, id, "Type the vault's name exactly as it is shown.")
+	case err != nil:
+		s.renderDeleteVault(w, sess, id, humanError(err))
+	default:
+		s.renderVaults(w, sess, "", "Deleted "+name+" and every version of it. "+
+			"Copies already on people's computers stay where they are.")
+	}
+}
+
 // humanError keeps internal wording out of the browser.
 func humanError(err error) string {
 	if errors.Is(err, errForbidden) {