Replace user deletion with deactivation

Deactivation adds the alumni role and leaves the others in place, so
reactivation is lossless and nobody has to remember what an account held.
login_from_session checks alumni? on every request, so a signed-in user is
locked out on their next one without any session invalidation. Guards
prevent deactivating yourself or the last active admin, and both verbs are
witnessed in the action log.

1 files changed, 20 insertions, 0 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index 2e9da86c..1728521a 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -105,6 +105,26 @@ class User < ApplicationRecord
     roles.map { |r| I18n.t("users.roles.#{r}", :default => r) }
   end
 
+  def deactivate!(actor:)
+    return false if alumni?
+    transaction do
+      update_column(:roles, (roles | ["alumni"]).sort)
+      NodeAction.record!(:participants => [self], :user => actor,
+                          :action => "user_deactivate", :target_login => login)
+    end
+    true
+  end
+
+  def reactivate!(actor:)
+    return false unless alumni?
+    transaction do
+      update_column(:roles, (roles - ["alumni"]).sort)
+      NodeAction.record!(:participants => [self], :user => actor,
+                          :action => "user_reactivate", :target_login => login)
+    end
+    true
+  end
+
   # otp_secret present == enrolled. otp_pending_secret holds the secret
   # between QR display and first-code confirmation. otp_consumed_timestep
   # makes every accepted code single-use (replay guard within the drift