Replace user deletion with deactivation

Deactivation adds the alumni role and leaves the others in place, so
reactivation is lossless and nobody has to remember what an account held.
login_from_session checks alumni? on every request, so a signed-in user is
locked out on their next one without any session invalidation. Guards
prevent deactivating yourself or the last active admin, and both verbs are
witnessed in the action log.

1 files changed, 3 insertions, 1 deletions

diff --git a/config/routes.rb b/config/routes.rb
index 4b5d15c9..1898dbbb 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -97,9 +97,11 @@ Cccms::Application.routes.draw do
     match '/login'       => 'sessions#new',     :as => :login,        :via => :get
     match 'search'       => 'search#index',     :as => :search,       :via => :get
 
-    resources :users do
+    resources :users, :except => :destroy do
       member do
         put :reset_otp
+        put :deactivate
+        put :reactivate
       end
     end
     resource :otp_enrollment, :only => [:show, :create, :update, :destroy]