From 8c6a6516e1dc5c1b4f12740a6f7b32765b530bb7 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 31 Jul 2026 17:05:05 +0200 Subject: Replace user deletion with deactivation Deactivation adds the alumni role and leaves the others in place, so reactivation is lossless and nobody has to remember what an account held. login_from_session checks alumni? on every request, so a signed-in user is locked out on their next one without any session invalidation. Guards prevent deactivating yourself or the last active admin, and both verbs are witnessed in the action log. --- app/models/node_action.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'app/models/node_action.rb') diff --git a/app/models/node_action.rb b/app/models/node_action.rb index fec5a062..d619aac5 100644 --- a/app/models/node_action.rb +++ b/app/models/node_action.rb @@ -98,8 +98,9 @@ class NodeAction < ApplicationRecord # "detached_from" -- array of unique_names, only when any # "headline_removed_from" -- array of unique_names, only when any # - # "otp_enroll" / "otp_disable" / "otp_reset" (second-factor lifecycle; - # node column nil; participants: the affected User -- the table's first + # "otp_enroll" / "otp_disable" / "otp_reset" / "user_deactivate" / + # "user_reactivate" (second-factor lifecycle; node column nil; + # participants: the affected User # User-typed subject. otp_disable is self-service; otp_reset is an # administrator clearing someone else's factor, where actor and # participant differ): -- cgit v1.3