users: delete more data when user deactivates their account.

* Don't delete the user's favorites unless private favorites are enabled. The general rule is that
  public account activity is kept and private account activity is deleted.
* Delete the user's API keys, forum topics visits, private favgroups, downvotes, and upvotes (if
  privacy is enabled).
* Reset all of the user's account settings to default. This means custom CSS is deleted, where it
  wasn't before.
* Delete everything but the user's name and password asynchronously.
* Don't log the current user out if it's the owner deleting another user's account.
* Fix #5067 (Mod actions sometimes not created for user deletions) by wrapping the deletion process
  in a transaction.

app/logical/session_loader.rb

@@ -46,11 +46,11 @@ class SessionLoader
   end
 
   # Logs the current user out. Deletes their session cookie and records a logout event.
-  def logout
+  def logout(user = CurrentUser.user)
     session.delete(:user_id)
     session.delete(:last_authenticated_at)
-    return if CurrentUser.user.is_anonymous?
-    UserEvent.create_from_request!(CurrentUser.user, :logout, request)
+    return if user.is_anonymous?
+    UserEvent.create_from_request!(user, :logout, request)
   end
 
   # Sets the current user. Runs on each HTTP request. The user is set based on

app/logical/user_deletion.rb

@@ -12,8 +12,9 @@ class UserDeletion
   validate :validate_deletion
 
   # Initialize a user deletion.
+  #
   # @param user [User] the user to delete
-  # @param user [User] the user performing the deletion
+  # @param deleter [User] the user performing the deletion
   # @param password [String] the user's password (for confirmation)
   # @param request the HTTP request (for logging the deletion in the user event log)
   def initialize(user:, deleter: user, password: nil, request: nil)
@@ -24,43 +25,64 @@ class UserDeletion
   end
 
   # Delete the account, if the deletion is allowed.
-  # @return [Boolean] if the deletion failed
-  # @return [User] if the deletion succeeded
+  #
+  # @return [Boolean] True if the deletion was successful, false otherwise.
   def delete!
     return false if invalid?
 
-    clear_user_settings
-    remove_favorites
-    clear_saved_searches
-    rename
-    reset_password
-    create_mod_action
-    create_user_event
-    user
+    user.with_lock do
+      rename
+      reset_password
+      async_delete_user
+      ModAction.log("deleted user ##{user.id}", :user_delete, subject: user, user: deleter)
+      UserEvent.create_from_request!(user, :user_deletion, request) if request.present?
+      SessionLoader.new(request).logout(user) if user == deleter
+    end
+
+    true
   end
 
-  private
-
-  def create_mod_action
-    ModAction.log("deleted user ##{user.id}", :user_delete, subject: user, user: deleter)
+  # Calls `delete_user`.
+  def async_delete_user
+    DeleteUserJob.perform_later(user)
   end
 
-  def create_user_event
-    UserEvent.create_from_request!(user, :user_deletion, request) if request.present?
+  def delete_user
+    delete_user_data
+    delete_user_settings
   end
 
-  def clear_saved_searches
-    SavedSearch.where(user_id: user.id).destroy_all
+  def delete_user_data
+    user.api_keys.destroy_all
+    user.forum_topic_visits.destroy_all
+    user.saved_searches.destroy_all
+    user.favorite_groups.is_private.destroy_all
+
+    user.post_votes.active.negative.find_each do |vote|
+      vote.soft_delete!(updater: user)
+    end
+
+    if user.enable_private_favorites
+      user.favorites.destroy_all
+      user.post_votes.active.positive.find_each do |vote|
+        vote.soft_delete!(updater: user)
+      end
+    end
   end
 
-  def clear_user_settings
+  def delete_user_settings
     user.email_address = nil
     user.last_logged_in_at = nil
     user.last_forum_read_at = nil
-    user.favorite_tags = ""
-    user.blacklisted_tags = ""
-    user.show_deleted_children = false
-    user.time_zone = "Eastern Time (US & Canada)"
+
+    User::USER_PREFERENCE_BOOLEAN_ATTRIBUTES.each do |attribute|
+      user.send("#{attribute}=", false)
+    end
+
+    %w[time_zone comment_threshold default_image_size favorite_tags blacklisted_tags custom_style per_page theme].each do |attribute|
+      user[attribute] = User.column_defaults[attribute]
+    end
+
     user.save!
   end
 
@@ -68,10 +90,6 @@ class UserDeletion
     user.update!(password: SecureRandom.hex(16))
   end
 
-  def remove_favorites
-    DeleteFavoritesJob.perform_later(user)
-  end
-
   def rename
     name = "user_#{user.id}"
     name += "~" while User.exists?(name: name)