Deploy files from GitHub repository

bruno/Super Admin/Account Management/Create Account.bru

@@ -0,0 +1,40 @@
+meta {
+  name: Create Account
+  type: http
+  seq: 2
+}
+
+post {
+  url: {{base_url}}/api/v1/super-admin/accounts/
+  body: json
+  auth: inherit
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{access_token}}
+}
+
+body:json {
+  {
+    "email": "newaccount@example.com",
+    "username": "newaccount",
+    "full_name": "New Account",
+    "password": "Password123!",
+    "role": "teacher",
+    "privileges": {
+      "event_management": false,
+      "exam_management": true,
+      "academy_management": true,
+      "content_management": true
+    }
+  }
+}
+
+settings {
+  encodeUrl: true
+}
+
+docs {
+  Create a new account with role and privileges (superadmin only). Hierarchy and FR-19 gates applied.
+}

bruno/Super Admin/Account Management/Delete Account.bru

@@ -0,0 +1,28 @@
+meta {
+  name: Delete Account
+  type: http
+  seq: 4
+}
+
+delete {
+  url: {{base_url}}/api/v1/super-admin/accounts/:account_id
+  body: none
+  auth: inherit
+}
+
+params:path {
+  account_id: eab90733-58c9-4631-bf2f-82726ce3c217
+}
+
+headers {
+  Authorization: Bearer {{access_token}}
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  Soft delete an account (superadmin only). Hierarchy and last_superadmin gates applied.
+}

bruno/Super Admin/Account Management/List Accounts.bru

@@ -0,0 +1,22 @@
+meta {
+  name: List Accounts
+  type: http
+  seq: 1
+}
+
+get {
+  url: {{base_url}}/api/v1/super-admin/accounts/?page=1&limit=10&role=&search=
+  auth: inherit
+}
+
+headers {
+  Authorization: Bearer {{access_token}}
+}
+
+settings {
+  encodeUrl: true
+}
+
+docs {
+  List all accounts with pagination, optional role filter and search (superadmin only)
+}

bruno/Super Admin/Account Management/Update Account.bru

@@ -0,0 +1,44 @@
+meta {
+  name: Update Account
+  type: http
+  seq: 3
+}
+
+put {
+  url: {{base_url}}/api/v1/super-admin/accounts/:account_id
+  body: json
+  auth: inherit
+}
+
+params:path {
+  account_id: 7a731432-8107-4939-9dac-33a50356c36b
+}
+
+headers {
+  Content-Type: application/json
+  Authorization: Bearer {{access_token}}
+}
+
+body:json {
+  {
+    "email": "updated@example.com",
+    "username": "updateduser",
+    "full_name": "Updated Name",
+    "role": "admin",
+    "privileges": {
+      "event_management": true,
+      "exam_management": true,
+      "academy_management": true,
+      "content_management": true
+    }
+  }
+}
+
+settings {
+  encodeUrl: true
+  timeout: 0
+}
+
+docs {
+  Update account profile fields, role, or privileges (superadmin only). Hierarchy, FR-19, and last_superadmin gates applied.
+}

bruno/Super Admin/Account Management/folder.bru

@@ -0,0 +1,3 @@
+meta {
+  name: Account Management
+}

bruno/Super Admin/Accounts/Set User Role.bru

@@ -21,7 +21,7 @@ headers {
 
 body:json {
   {
-    "role_name": "teacher",
+    "role_name": "event_exam",
     "privileges": {
   
     }

controllers/admin_account_controller.go

@@ -0,0 +1,215 @@
+package controllers
+
+import (
+	"strconv"
+
+	"abdanhafidz.com/go-boilerplate/models/dto"
+	entity "abdanhafidz.com/go-boilerplate/models/entity"
+	http_error "abdanhafidz.com/go-boilerplate/models/error"
+	"abdanhafidz.com/go-boilerplate/services"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+type AdminAccountController interface {
+	ListAccounts(ctx *gin.Context)
+	CreateAccount(ctx *gin.Context)
+	UpdateAccount(ctx *gin.Context)
+	DeleteAccount(ctx *gin.Context)
+}
+
+type adminAccountController struct {
+	accountService services.AccountService
+}
+
+func NewAdminAccountController(accountService services.AccountService) AdminAccountController {
+	return &adminAccountController{accountService: accountService}
+}
+
+func (c *adminAccountController) ListAccounts(ctx *gin.Context) {
+	limit, _ := strconv.Atoi(ctx.DefaultQuery("limit", "10"))
+	page, _ := strconv.Atoi(ctx.DefaultQuery("page", "1"))
+	role := ctx.DefaultQuery("role", "")
+	search := ctx.DefaultQuery("search", "")
+
+	if limit < 1 {
+		limit = 10
+	} else if limit > 50 {
+		limit = 50
+	}
+
+	if page < 1 {
+		page = 1
+	}
+
+	validRoles := map[string]bool{
+		"user":        true,
+		"admin":       true,
+		"super_admin": true,
+		"teacher":     true,
+		"organizer":   true,
+	}
+
+	if role != "" && !validRoles[role] {
+		ResponseJSON(ctx, gin.H{}, []dto.AdminAccountResponse{}, http_error.BAD_REQUEST_ERROR)
+		return
+	}
+
+	offset := (page - 1) * limit
+	p := entity.Pagination{
+		Limit:  limit,
+		Offset: offset,
+		Role:   role,
+		Search: search,
+	}
+
+	callerID := ParseAccountId(ctx)
+
+	accounts, total, err := c.accountService.AdminListAccounts(ctx.Request.Context(), callerID, p)
+	if err != nil {
+		ResponseJSON(ctx, gin.H{}, []dto.AdminAccountResponse{}, err)
+		return
+	}
+
+	var users []dto.AdminAccountResponse
+	for _, acc := range accounts {
+		fullName := ""
+		if acc.AccountDetail != nil && acc.AccountDetail.FullName != nil {
+			fullName = *acc.AccountDetail.FullName
+		}
+		users = append(users, dto.AdminAccountResponse{
+			Id:                acc.Id,
+			Username:          acc.Username,
+			Email:             acc.Email,
+			FullName:          fullName,
+			Role:              acc.Role,
+			Privileges: dto.Privileges{
+				EventManagement:   acc.EventManagement,
+				ExamManagement:    acc.ExamManagement,
+				AcademyManagement: acc.AcademyManagement,
+				ContentManagement: acc.ContentManagement,
+			},
+			IsEmailVerified:   acc.IsEmailVerified,
+			IsDetailCompleted: acc.IsDetailCompleted,
+			CreatedAt:         acc.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
+		})
+	}
+
+	var totalPages int
+	if total == 0 {
+		totalPages = 1
+	} else {
+		totalPages = int((total + int64(limit) - 1) / int64(limit))
+	}
+
+	if page > totalPages {
+		page = totalPages
+	}
+
+	meta := gin.H{
+		"totalItems":  total,
+		"totalPages":  totalPages,
+		"currentPage": page,
+		"limit":       limit,
+	}
+
+	ResponseJSON(ctx, meta, users, nil)
+}
+
+func (c *adminAccountController) CreateAccount(ctx *gin.Context) {
+	req := RequestJSON[dto.AdminCreateAccountRequest](ctx)
+
+	callerID := ParseAccountId(ctx)
+
+	account, err := c.accountService.AdminCreateAccount(ctx.Request.Context(), callerID, req)
+	if err != nil {
+		ResponseJSON(ctx, req, dto.AdminAccountResponse{}, err)
+		return
+	}
+
+	fullName := ""
+	if account.AccountDetail != nil && account.AccountDetail.FullName != nil {
+		fullName = *account.AccountDetail.FullName
+	}
+
+	res := dto.AdminAccountResponse{
+		Id:                account.Id,
+		Username:          account.Username,
+		Email:             account.Email,
+		FullName:          fullName,
+		Role:              account.Role,
+		Privileges: dto.Privileges{
+			EventManagement:   account.EventManagement,
+			ExamManagement:    account.ExamManagement,
+			AcademyManagement: account.AcademyManagement,
+			ContentManagement: account.ContentManagement,
+		},
+		IsEmailVerified:   account.IsEmailVerified,
+		IsDetailCompleted: account.IsDetailCompleted,
+		CreatedAt:         account.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
+	}
+
+	ResponseJSON(ctx, req, res, nil)
+}
+
+func (c *adminAccountController) UpdateAccount(ctx *gin.Context) {
+	idParam := ctx.Param("account_id")
+	accountID, err := uuid.Parse(idParam)
+	if err != nil {
+		ResponseJSON(ctx, gin.H{"id": idParam}, dto.AdminAccountResponse{}, http_error.INVALID_TOKEN)
+		return
+	}
+
+	req := RequestJSON[dto.AdminUpdateAccountRequest](ctx)
+
+	callerID := ParseAccountId(ctx)
+
+	account, err := c.accountService.AdminUpdateAccount(ctx.Request.Context(), callerID, accountID, req)
+	if err != nil {
+		ResponseJSON(ctx, req, dto.AdminAccountResponse{}, err)
+		return
+	}
+
+	fullName := ""
+	if account.AccountDetail != nil && account.AccountDetail.FullName != nil {
+		fullName = *account.AccountDetail.FullName
+	}
+
+	res := dto.AdminAccountResponse{
+		Id:                account.Id,
+		Username:          account.Username,
+		Email:             account.Email,
+		FullName:          fullName,
+		Role:              account.Role,
+		Privileges: dto.Privileges{
+			EventManagement:   account.EventManagement,
+			ExamManagement:    account.ExamManagement,
+			AcademyManagement: account.AcademyManagement,
+			ContentManagement: account.ContentManagement,
+		},
+		IsEmailVerified:   account.IsEmailVerified,
+		IsDetailCompleted: account.IsDetailCompleted,
+		CreatedAt:         account.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
+	}
+
+	ResponseJSON(ctx, req, res, nil)
+}
+
+func (c *adminAccountController) DeleteAccount(ctx *gin.Context) {
+	idParam := ctx.Param("account_id")
+	accountID, err := uuid.Parse(idParam)
+	if err != nil {
+		ResponseJSON[any](ctx, gin.H{"id": idParam}, nil, http_error.INVALID_TOKEN)
+		return
+	}
+
+	callerID := ParseAccountId(ctx)
+
+	err = c.accountService.AdminDeleteAccount(ctx.Request.Context(), callerID, accountID)
+	if err != nil {
+		ResponseJSON[any](ctx, gin.H{"id": accountID}, nil, err)
+		return
+	}
+
+	ResponseJSON(ctx, gin.H{"id": accountID}, gin.H{"message": "Account deleted successfully"}, nil)
+}

models/dto/admin_account_dto.go

@@ -0,0 +1,32 @@
+package dto
+
+import "github.com/google/uuid"
+
+type AdminCreateAccountRequest struct {
+	Email     string     `json:"email" binding:"required,email"`
+	Username  string     `json:"username" binding:"required"`
+	FullName  string     `json:"full_name" binding:"required"`
+	Password  string     `json:"password" binding:"required"`
+	Role      string     `json:"role" binding:"required"`
+	Privileges Privileges `json:"privileges"`
+}
+
+type AdminUpdateAccountRequest struct {
+	Email     string      `json:"email"`
+	Username  string      `json:"username"`
+	FullName  *string     `json:"full_name"`
+	Role      string      `json:"role"`
+	Privileges *Privileges `json:"privileges"`
+}
+
+type AdminAccountResponse struct {
+	Id                uuid.UUID  `json:"id"`
+	Username          string     `json:"username"`
+	Email             string     `json:"email"`
+	FullName          string     `json:"full_name"`
+	Role              string     `json:"role"`
+	Privileges        Privileges `json:"privileges"`
+	IsEmailVerified   bool       `json:"is_email_verified"`
+	IsDetailCompleted bool       `json:"is_detail_completed"`
+	CreatedAt         string     `json:"created_at"`
+}

provider/controller_provider.go

@@ -3,6 +3,7 @@ package provider
 import "abdanhafidz.com/go-boilerplate/controllers"
 
 type ControllerProvider interface {
+	ProvideAdminAccountController() controllers.AdminAccountController
 	ProvideAdminAcademyController() controllers.AdminAcademyController
 	ProvideAdminEventController() controllers.AdminEventController
 	ProvideAdminExamController() controllers.AdminExamController
@@ -27,6 +28,7 @@ type ControllerProvider interface {
 }
 
 type controllerProvider struct {
+	adminAccountController        controllers.AdminAccountController
 	adminAcademyController        controllers.AdminAcademyController
 	adminEventController          controllers.AdminEventController
 	adminExamController           controllers.AdminExamController
@@ -68,6 +70,7 @@ func NewControllerProvider(servicesProvider ServicesProvider) ControllerProvider
 	emailVerificationController := controllers.NewEmailVerificationController(servicesProvider.ProvideEmailVerificationService())
 	eventController := controllers.NewEventController(servicesProvider.ProvideEventService())
 	eventExamController := controllers.NewEventExamController(servicesProvider.ProvideEventExamService())
+	adminAccountController := controllers.NewAdminAccountController(servicesProvider.ProvideAccountService())
 	eventExamProctoringController := controllers.NewEventExamProctoringController(servicesProvider.ProvideEventExamProctoringService())
 	forgotPasswordController := controllers.NewForgotPasswordController(servicesProvider.ProvideForgotPasswordService())
 	optionController := controllers.NewOptionController(servicesProvider.ProvideOptionService())
@@ -81,6 +84,7 @@ func NewControllerProvider(servicesProvider ServicesProvider) ControllerProvider
 	repairController := controllers.NewRepairController(servicesProvider.ProvideRepairService())
 	superAdminRoleController := controllers.NewSuperAdminRoleController(servicesProvider.ProvideAccountService())
 	return &controllerProvider{
+		adminAccountController:        adminAccountController,
 		adminAcademyController:        adminAcademyController,
 		adminEventController:          adminEventController,
 		adminExamController:           adminExamController,
@@ -107,6 +111,10 @@ func NewControllerProvider(servicesProvider ServicesProvider) ControllerProvider
 
 // --- Getter Methods ---
 
+func (c *controllerProvider) ProvideAdminAccountController() controllers.AdminAccountController {
+	return c.adminAccountController
+}
+
 func (c *controllerProvider) ProvideAdminAcademyController() controllers.AdminAcademyController {
 	return c.adminAcademyController
 }

router/{admin_router.go → admin__procotoring_router.go}

@@ -18,4 +18,5 @@ func AdminRouter(router *gin.Engine, middleware provider.MiddlewareProvider, con
 		proctoringAdminGroup.PUT("/events/:event_slug/exam/:exam_slug/proctoring/:log_id", proctoringController.UpdateLog)
 		proctoringAdminGroup.DELETE("/events/:event_slug/exam/:exam_slug/proctoring/:log_id", proctoringController.DeleteLog)
 	}
+
 }

router/super_admin_router.go

@@ -10,6 +10,7 @@ func SuperAdminRouter(router *gin.Engine, middleware provider.MiddlewareProvider
 	authorizationMiddleware := middleware.ProvideAuthorizationMiddleware()
 
 	userController := controller.ProvideUserController()
+	adminAccountController := controller.ProvideAdminAccountController()
 	injectController := controller.ProvideSuperAdminInjectController()
 	repairController := controller.ProvideRepairController()
 	authController := controller.ProvideAuthenticationController()
@@ -18,6 +19,10 @@ func SuperAdminRouter(router *gin.Engine, middleware provider.MiddlewareProvider
 	// Super Admin Accounts Routes
 	accountsGroup := router.Group("/api/v1/super-admin/accounts", authenticationMiddleware.VerifyAccount, authorizationMiddleware.VerifySuperAdmin)
 	{
+		accountsGroup.GET("/", adminAccountController.ListAccounts)
+		accountsGroup.POST("/", adminAccountController.CreateAccount)
+		accountsGroup.PUT("/:account_id", adminAccountController.UpdateAccount)
+		accountsGroup.DELETE("/:account_id", adminAccountController.DeleteAccount)
 		accountsGroup.PUT("/:account_id/role", authController.SetUserRole)
 	}
 
@@ -52,6 +57,7 @@ func SuperAdminRouter(router *gin.Engine, middleware provider.MiddlewareProvider
 		injectSuperAdminGroup.POST("/zip", injectController.InjectZip)
 	}
 
+	// Super Admin Repair Routes
 	repairSuperAdminGroup := router.Group("/api/v1/super-admin/repair", authenticationMiddleware.VerifyAccount, authorizationMiddleware.VerifySuperAdmin)
 	{
 		repairSuperAdminGroup.POST("/", repairController.RepairQuestionStoragePath)

services/account_service.go

@@ -49,6 +49,11 @@ type AccountService interface {
 	CountSuperAdmins(ctx context.Context) (int64, error)
 	WriteAuditLog(ctx context.Context, actorID uuid.UUID, action string, targetID *string, detail *string) error
 	GetAuditLogs(ctx context.Context, page, limit int, action, actorAccountID, from, to string) ([]entity.AuditLog, int64, error)
+
+	AdminListAccounts(ctx context.Context, callerID uuid.UUID, pagination entity.Pagination) ([]entity.Account, int64, error)
+	AdminCreateAccount(ctx context.Context, callerID uuid.UUID, req dto.AdminCreateAccountRequest) (entity.Account, error)
+	AdminUpdateAccount(ctx context.Context, callerID uuid.UUID, targetID uuid.UUID, req dto.AdminUpdateAccountRequest) (entity.Account, error)
+	AdminDeleteAccount(ctx context.Context, callerID uuid.UUID, targetID uuid.UUID) error
 }
 
 type accountService struct {
@@ -415,6 +420,205 @@ func (s *accountService) GetAllAccountsWithPagination(ctx context.Context, pagin
 	return s.accountRepo.GetAllAccountsWithPagination(ctx, pagination)
 }
 
+func (s *accountService) AdminListAccounts(ctx context.Context, callerID uuid.UUID, pagination entity.Pagination) ([]entity.Account, int64, error) {
+	caller, err := s.accountRepo.GetAccountById(ctx, callerID)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	if caller.Role != "super_admin" {
+		return nil, 0, http_error.FORBIDDEN_ERROR
+	}
+
+	return s.accountRepo.GetAllAccountsWithPagination(ctx, pagination)
+}
+
+func (s *accountService) AdminCreateAccount(ctx context.Context, callerID uuid.UUID, req dto.AdminCreateAccountRequest) (entity.Account, error) {
+	caller, err := s.accountRepo.GetAccountById(ctx, callerID)
+	if err != nil {
+		return entity.Account{}, err
+	}
+
+	targetRole := req.Role
+	if targetRole == "" {
+		targetRole = "user"
+	}
+
+	if entity.RoleHierarchy(caller.Role) <= entity.RoleHierarchy(targetRole) {
+		return entity.Account{}, http_error.HIERARCHY_VIOLATION
+	}
+
+	if caller.Role != "super_admin" {
+		callerPrivileges := dto.Privileges{
+			EventManagement:   caller.EventManagement,
+			ExamManagement:    caller.ExamManagement,
+			AcademyManagement: caller.AcademyManagement,
+			ContentManagement: caller.ContentManagement,
+		}
+		if !req.Privileges.SubsetOf(callerPrivileges) {
+			return entity.Account{}, http_error.HIERARCHY_VIOLATION
+		}
+	}
+
+	account, err := s.Create(ctx, req.FullName, req.Email, req.Username, req.Password, targetRole)
+	if err != nil {
+		return entity.Account{}, err
+	}
+
+	account.IsEmailVerified = true
+	if targetRole != "" && targetRole != "user" {
+		roleName, eventMgt, examMgt, academyMgt, contentMgt := entity.DeriveRoleSnapshot(targetRole)
+		account.RoleName = roleName
+		account.EventManagement = eventMgt
+		account.ExamManagement = examMgt
+		account.AcademyManagement = academyMgt
+		account.ContentManagement = contentMgt
+	}
+	if req.Privileges != (dto.Privileges{}) {
+		account.EventManagement = req.Privileges.EventManagement
+		account.ExamManagement = req.Privileges.ExamManagement
+		account.AcademyManagement = req.Privileges.AcademyManagement
+		account.ContentManagement = req.Privileges.ContentManagement
+	}
+	account.TokenVersion++
+	account, err = s.accountRepo.UpdateAccount(ctx, account)
+	if err != nil {
+		return entity.Account{}, err
+	}
+
+	if err := s.SetEmailVerified(ctx, account.Id, true); err != nil {
+		return entity.Account{}, err
+	}
+
+	targetIDStr := account.Id.String()
+	detailStr := fmt.Sprintf(`{"email":"%s","role":"%s"}`, account.Email, account.Role)
+	_ = s.WriteAuditLog(ctx, callerID, "user_created", &targetIDStr, &detailStr)
+
+	return account, nil
+}
+
+func (s *accountService) AdminUpdateAccount(ctx context.Context, callerID uuid.UUID, targetID uuid.UUID, req dto.AdminUpdateAccountRequest) (entity.Account, error) {
+	caller, err := s.accountRepo.GetAccountById(ctx, callerID)
+	if err != nil {
+		return entity.Account{}, err
+	}
+
+	target, err := s.accountRepo.GetAccountById(ctx, targetID)
+	if err != nil {
+		return entity.Account{}, http_error.ACCOUNT_NOT_FOUND
+	}
+
+	if entity.RoleHierarchy(caller.Role) <= entity.RoleHierarchy(target.Role) {
+		return entity.Account{}, http_error.HIERARCHY_VIOLATION
+	}
+
+	if req.Role != "" {
+		newTargetHierarchy := entity.RoleHierarchy(req.Role)
+		if entity.RoleHierarchy(caller.Role) <= newTargetHierarchy {
+			return entity.Account{}, http_error.HIERARCHY_VIOLATION
+		}
+	}
+
+	if caller.Role != "super_admin" && req.Privileges != nil {
+		callerPrivileges := dto.Privileges{
+			EventManagement:   caller.EventManagement,
+			ExamManagement:    caller.ExamManagement,
+			AcademyManagement: caller.AcademyManagement,
+			ContentManagement: caller.ContentManagement,
+		}
+		if !req.Privileges.SubsetOf(callerPrivileges) {
+			return entity.Account{}, http_error.HIERARCHY_VIOLATION
+		}
+	}
+
+	if req.Role != "" && req.Role != "super_admin" && target.Role == "super_admin" {
+		count, err := s.accountRepo.CountAccountsByRole(ctx, "super_admin")
+		if err != nil {
+			return entity.Account{}, err
+		}
+		if count <= 1 {
+			return entity.Account{}, http_error.LAST_SUPERADMIN
+		}
+	}
+
+	if req.Email != "" {
+		target.Email = req.Email
+	}
+	if req.Username != "" {
+		target.Username = req.Username
+	}
+	if req.FullName != nil && target.AccountDetail != nil {
+		target.AccountDetail.FullName = req.FullName
+		_, err = s.accountDetailRepo.UpdateAccountDetail(ctx, *target.AccountDetail)
+		if err != nil {
+			return entity.Account{}, err
+		}
+	}
+	if req.Role != "" {
+		target.Role = req.Role
+		roleName, eventMgt, examMgt, academyMgt, contentMgt := entity.DeriveRoleSnapshot(req.Role)
+		target.RoleName = roleName
+		target.EventManagement = eventMgt
+		target.ExamManagement = examMgt
+		target.AcademyManagement = academyMgt
+		target.ContentManagement = contentMgt
+	}
+	if req.Privileges != nil {
+		target.EventManagement = req.Privileges.EventManagement
+		target.ExamManagement = req.Privileges.ExamManagement
+		target.AcademyManagement = req.Privileges.AcademyManagement
+		target.ContentManagement = req.Privileges.ContentManagement
+	}
+	target.TokenVersion++
+
+	updated, err := s.accountRepo.UpdateAccount(ctx, target)
+	if err != nil {
+		return entity.Account{}, err
+	}
+
+	targetIDStr := target.Id.String()
+	detailStr := fmt.Sprintf(`{"email":"%s","role":"%s"}`, target.Email, target.Role)
+	_ = s.WriteAuditLog(ctx, callerID, "user_updated", &targetIDStr, &detailStr)
+
+	return updated, nil
+}
+
+func (s *accountService) AdminDeleteAccount(ctx context.Context, callerID uuid.UUID, targetID uuid.UUID) error {
+	caller, err := s.accountRepo.GetAccountById(ctx, callerID)
+	if err != nil {
+		return err
+	}
+
+	target, err := s.accountRepo.GetAccountById(ctx, targetID)
+	if err != nil {
+		return http_error.ACCOUNT_NOT_FOUND
+	}
+
+	if entity.RoleHierarchy(caller.Role) <= entity.RoleHierarchy(target.Role) {
+		return http_error.HIERARCHY_VIOLATION
+	}
+
+	if target.Role == "super_admin" {
+		count, err := s.accountRepo.CountAccountsByRole(ctx, "super_admin")
+		if err != nil {
+			return err
+		}
+		if count <= 1 {
+			return http_error.LAST_SUPERADMIN
+		}
+	}
+
+	if err := s.accountRepo.SoftDeleteAccount(ctx, targetID); err != nil {
+		return err
+	}
+
+	targetIDStr := targetID.String()
+	detailStr := fmt.Sprintf(`{"email":"%s"}`, target.Email)
+	_ = s.WriteAuditLog(ctx, callerID, "user_deleted", &targetIDStr, &detailStr)
+
+	return nil
+}
+
 func (s *accountService) BulkCreateAccounts(ctx context.Context, requests []dto.CreateUserRequest) (dto.BulkCreateUserResponse, error) {
 	response := dto.BulkCreateUserResponse{
 		SuccessCount: 0,