fix tenant account unbind flow

server/internal/tenant/app/desktop_account_service.go

@@ -79,6 +79,12 @@ type DesktopAccountView struct {
 	OldestQueuedPublishTaskAt *time.Time `json:"oldest_queued_publish_task_at"`
 }
 
+type DesktopAccountDeleteResult struct {
+	Account                      DesktopAccountView `json:"account"`
+	CancelledQueuedPublishTasks  int                `json:"cancelled_queued_publish_task_count"`
+	CompletedServerSideUnbinding bool               `json:"completed_server_side_unbinding"`
+}
+
 type UpsertDesktopAccountRequest struct {
 	Platform           string     `json:"platform" binding:"required"`
 	PlatformUID        string     `json:"platform_uid" binding:"required"`
@@ -412,6 +418,46 @@ func (s *DesktopAccountService) RequestDelete(ctx context.Context, actor auth.Ac
 	return &view, nil
 }
 
+func (s *DesktopAccountService) DeleteForActor(ctx context.Context, actor auth.Actor, desktopID uuid.UUID) (*DesktopAccountDeleteResult, error) {
+	if actor.PrimaryWorkspaceID == 0 || actor.UserID == 0 {
+		return nil, response.ErrUnauthorized(40132, "workspace_scope_missing", "workspace context is required")
+	}
+	if s.pool == nil {
+		return nil, response.ErrServiceUnavailable(50342, "desktop_publish_job_store_unavailable", "desktop publish job store is unavailable")
+	}
+
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return nil, response.ErrInternal(50086, "desktop_account_delete_begin_failed", "failed to start desktop account delete")
+	}
+	defer tx.Rollback(ctx)
+
+	accountRepo := repository.NewDesktopAccountRepository(tx)
+	account, err := accountRepo.TombstoneForActor(ctx, desktopID, actor.PrimaryWorkspaceID, actor.UserID)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, response.ErrNotFound(40481, "desktop_account_not_found", "desktop account not found")
+		}
+		return nil, response.ErrInternal(50085, "desktop_account_delete_failed", "failed to delete desktop account")
+	}
+
+	cancelled, err := cancelQueuedPublishTasksForDesktopAccountUnbind(ctx, tx, account.TenantID, account.WorkspaceID, account.DesktopID)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return nil, response.ErrInternal(50086, "desktop_account_delete_commit_failed", "failed to commit desktop account delete")
+	}
+
+	view := s.buildDesktopAccountView(account, nil, nil, nil, nil)
+	return &DesktopAccountDeleteResult{
+		Account:                      view,
+		CancelledQueuedPublishTasks:  cancelled,
+		CompletedServerSideUnbinding: true,
+	}, nil
+}
+
 func desktopAccountHealthLatestKey(workspaceID int64, accountID uuid.UUID) string {
 	return fmt.Sprintf("desktop:account-health:latest:%d:%s", workspaceID, accountID.String())
 }