From 8c6a6516e1dc5c1b4f12740a6f7b32765b530bb7 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 31 Jul 2026 17:05:05 +0200 Subject: Replace user deletion with deactivation Deactivation adds the alumni role and leaves the others in place, so reactivation is lossless and nobody has to remember what an account held. login_from_session checks alumni? on every request, so a signed-in user is locked out on their next one without any session invalidation. Guards prevent deactivating yourself or the last active admin, and both verbs are witnessed in the action log. --- app/controllers/users_controller.rb | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) (limited to 'app/controllers') diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 95dff220..7bf23f17 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -4,7 +4,7 @@ class UsersController < ApplicationController # Private before_action :login_required - before_action :find_user, :only => [:show, :edit, :update, :destroy, :reset_otp] + before_action :find_user, :only => [:show, :edit, :update, :reset_otp, :deactivate, :reactivate] before_action :verify_status, :except => [:index, :show] layout 'admin' @@ -53,8 +53,25 @@ class UsersController < ApplicationController def show end - def destroy - @user.destroy if @user + def deactivate + return deny_user_access unless current_user.is_admin? + + if @user == current_user + flash[:error] = t("flash.users.cannot_deactivate_self") + elsif @user.deactivate!(:actor => current_user) + flash[:notice] = t("flash.users.deactivated", :login => @user.login) + end + + redirect_to users_path + end + + def reactivate + return deny_user_access unless current_user.is_admin? + + if @user.reactivate!(:actor => current_user) + flash[:notice] = t("flash.users.reactivated", :login => @user.login) + end + redirect_to users_path end -- cgit v1.3