Replace user deletion with deactivation

Deactivation adds the alumni role and leaves the others in place, so
reactivation is lossless and nobody has to remember what an account held.
login_from_session checks alumni? on every request, so a signed-in user is
locked out on their next one without any session invalidation. Guards
prevent deactivating yourself or the last active admin, and both verbs are
witnessed in the action log.

1 files changed, 13 insertions, 1 deletions

diff --git a/app/helpers/node_actions_helper.rb b/app/helpers/node_actions_helper.rb
index 4cbe741c..f57ef84f 100644
--- a/app/helpers/node_actions_helper.rb
+++ b/app/helpers/node_actions_helper.rb
@@ -18,7 +18,9 @@ module NodeActionsHelper
     "asset_destroy"      => "file-x",
     "otp_enroll"         => "shield-lock",
     "otp_disable"        => "shield-off",
-    "otp_reset"          => "shield-x"
+    "otp_reset"          => "shield-x",
+    "user_deactivate"    => "user-off",
+    "user_reactivate"    => "user-check"
   }.freeze
 
   def verb_icon action
@@ -271,4 +273,14 @@ module NodeActionsHelper
     t("node_actions.otp_reset", :actor => actor_ref(action),
        :target => user_participant_ref(action)).html_safe
   end
+
+  def summarize_user_deactivate action
+    t("node_actions.user_deactivate", :actor => actor_ref(action),
+       :target => user_participant_ref(action)).html_safe
+  end
+
+  def summarize_user_reactivate action
+    t("node_actions.user_reactivate", :actor => actor_ref(action),
+       :target => user_participant_ref(action)).html_safe
+  end
 end