diff --git a/review/routes.py b/review/routes.py
index 7c2d778..eab0686 100644
--- a/review/routes.py
+++ b/review/routes.py
@@ -1894,9 +1894,16 @@ def accountdeletionrequests(current_user):
@reviewer_bp.route('/approveaccountdeletion', methods=['POST'])
@admin_required
def approveaccountdeletion(current_user):
- """Approve an account deletion request and delete the account (admin only)."""
+ """Preview and approve an account deletion request (admin only).
+
+ Approval is a two-step flow that mirrors the manual delete-user tool: the
+ first POST resolves the target account and shows a full preview of what
+ deletion would remove; a second POST (``action=confirm_delete``) performs
+ the irreversible deletion.
+ """
validate_csrf_token()
req_hexid = request.form.get('uuid')
+ action = request.form.get('action', 'preview')
try:
del_request = account_deletion_request_by_hexid(req_hexid)
@@ -1924,6 +1931,21 @@ def approveaccountdeletion(current_user):
message="Request has no email on file; cannot delete"
))
+ if action != 'confirm_delete':
+ # Step 1: show the same deletion impact preview the manual delete-user
+ # tool shows, so the admin sees exactly what approval will remove.
+ preview_data, error = preview_user_deletion(delete_email)
+ if error:
+ return redirect(url_for('reviewer.accountdeletionrequests', message=error))
+ return render_template(
+ 'reviewer/approveaccountdeletion.html',
+ user=current_user['username'],
+ is_admin=current_user['is_admin'],
+ req=del_request,
+ preview=preview_data,
+ )
+
+ # Step 2: admin confirmed the preview -- perform the irreversible deletion.
result = delete_user_account(delete_email, admin_username=current_user['username'])
success = "successful" in result.lower()
diff --git a/review/templates/reviewer/_deletion_preview.html b/review/templates/reviewer/_deletion_preview.html
new file mode 100644
index 0000000..8e4e67c
--- /dev/null
+++ b/review/templates/reviewer/_deletion_preview.html
@@ -0,0 +1,105 @@
+{# Shared account-deletion impact preview.
+
+ Renders the breakdown produced by ``preview_user_deletion`` so both the
+ manual delete-user tool and the deletion-request approval flow show the
+ exact same "what will be removed" summary before a reviewer confirms.
+ Expects a ``preview`` dict in context. #}
+
+
+
+
DELETION PREVIEW for {{ preview.username }} ({{ preview.email }})
+ {{ req.requester }} requested deletion of their account on
+ {{ req.created_at }}.
+ {% if req.note %} Reason: {{ req.note }}{% endif %}
+
+
WARNING: Approving runs the same irreversible account
+ deletion as the manual delete-user tool. Review the impact below before
+ confirming.
+
+
+
+
+ {% include 'reviewer/_deletion_preview.html' %}
+
+
+
FINAL CONFIRMATION REQUIRED
+
This action is IRREVERSIBLE! Once you click the button below, all the data listed above will be permanently deleted and the requester will be emailed a confirmation.