Deleted account content removed or attributed to anonymized placeholder

Deleting a user record while leaving their posts and comments attributed to the original user ID or username is a partial erasure that violates GDPR Art. 17. The username on a comment thread is PII — it identifies the person even after account deletion. CWE-212 (improper cross-boundary removal of sensitive data) captures this exact failure mode. Inconsistent handling across content types — posts anonymized but comments not, or media files left with original paths — compounds the exposure.

Maintain a system-level DELETED_USER placeholder account and reassign all content to it atomically in the same transaction as the user row deletion. Handle every content type — posts, comments, likes, media, social graph edges — in a single function.

// src/lib/users/deleteContent.ts
async function deleteUserContent(userId: string) {
  const ghost = await db.user.findUniqueOrThrow({ where: { username: 'DELETED_USER' } });

  await db.$transaction([
    db.post.updateMany({ where: { authorId: userId }, data: { authorId: ghost.id } }),
    db.comment.updateMany({ where: { authorId: userId }, data: { authorId: ghost.id } }),
    db.like.deleteMany({ where: { userId } }),
    db.follow.deleteMany({ where: { OR: [{ followerId: userId }, { followingId: userId }] } }),
  ]);
}

If posts should be removed rather than preserved (forum vs. social context), swap updateMany for deleteMany, but choose one strategy and apply it consistently across all content types.