zoo user delete <user> deletes the authenticated account regardless of the argument

[sneg55]

zoo user delete <user> deletes the authenticated account regardless of the argument, and reports success for the wrong user

Context: API Makeathon participant. Found while reviewing the CLI's generated command surface.

zoo user delete takes a required <user> positional documented as "The user to delete. Can be an ID or name", but the command ignores it as a target: it is used only for the confirmation prompt and the success message. The actual API call is delete_self(), which deletes the authenticated account. The command then prints "Deleted user <whatever-you-typed>", claiming it deleted the named user.

Evidence

Shipped binary (v0.2.184):

$ zoo user delete --help
Delete user.

Usage: zoo user delete [OPTIONS] <user>

Arguments:
  <user>  The user to delete. Can be an ID or name

Generated command body (cli-macro-impl/tests/gen/users.rs.gen, the canonical macro expansion; the special-case is in cli-macro-impl/src/lib.rs:1129-1133, which forces the users tag to delete_self):

pub struct CmdUserDelete {
    #[clap(name = "user", required = true)]
    pub user: String,          // used only in the prompt + output below
    #[clap(long)]
    pub confirm: bool,
}

// run():
    // confirmation compares typed input against self.user ...
    client.users().delete_self().await?;      // <-- self, not self.user
    writeln!(ctx.io.out, "{} Deleted {} {}", ..., "user", self.user)?;  // <-- prints the arg

Why it is wrong

The identifier the operator supplies never selects the API target. If the Zoo API only supports self-deletion, the command should not accept a <user> argument at all; accepting one (and echoing it in both the confirm prompt "Type <user> to confirm deletion" and the success line) actively misleads the operator into believing the deletion was scoped to that user.

Concrete failure

An operator who runs zoo user delete alice --confirm, intending to remove some other account, instead deletes their own account and sees "Deleted user alice". Account deletion is about as irreversible as CLI actions get, and the output hides what actually happened.

Suggested fix

Either drop the <user> positional and rename the command to reflect that it deletes the authenticated user (e.g. zoo auth delete-account), or, if the API gains a delete-by-id endpoint, wire self.user to it. In the meantime the success message should say which account was actually deleted.

Verify

Inspect cli-macro-impl/tests/gen/users.rs.gen (the CmdUserDelete::run calls delete_self()), or mock the client and confirm the self-delete endpoint is hit regardless of the positional value.

Environment

Zoo CLI v0.2.184 (33534cd), verified in the shipped binary's --help and in the checked-in macro expansion.