I'm building a system using a document type database. The system has users. I was told that in production it is best to avoid making outright deletes. I understand the convention is to either mark users as deleted or to transfer them to a deleted table in a RDBMS.
For document type databases what is the convention? I can mark the users as deleted very easily, but then what happens if the user attempts to re-register with the same account info?
Since their email address is supposed to be unique, the user would be prevented from making a new account. how can this be avoided?
EDIT: I was asked to clarify my goals. I want to, allow users to 'delete'/'close' their account.
In doing so their accounts should no longer be accessible.
The user should not be allowed to sign in using it. Additionally the account should not be able to be used to perform any additional tasks in the service.
All of the database changes made as a result of the account should persist. IE, it would be detrimental to the service to remove any data posted or logs created related to the account.
We are attempting to build a HIPAA compliant service which means that access logs must be enforced. I interpret that to mean that the full data of an user who has access to sensitive user information needs to be maintained in