Replace user deletion with deactivation

Deactivation adds the alumni role and leaves the others in place, so
reactivation is lossless and nobody has to remember what an account held.
login_from_session checks alumni? on every request, so a signed-in user is
locked out on their next one without any session invalidation. Guards
prevent deactivating yourself or the last active admin, and both verbs are
witnessed in the action log.

3 files changed, 19 insertions, 1 deletions

diff --git a/config/locales/de.yml b/config/locales/de.yml
index e15a08d2..8aae7ca5 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -219,6 +219,8 @@ de:
     otp_enroll: "%{actor} hat einen zweiten Faktor eingerichtet"
     otp_disable: "%{actor} hat den zweiten Faktor entfernt"
     otp_reset: "%{actor} hat den zweiten Faktor von %{target} zurückgesetzt"
+    user_deactivate: "%{actor} hat %{target} deaktiviert"
+    user_reactivate: "%{actor} hat %{target} reaktiviert"
 
   open_gallery: "Gallerie anzeigen"
   asset_licenses:
@@ -281,6 +283,9 @@ de:
     user:
       confirm_destroy: "Benutzer %{login} wirklich löschen?"
       no_roles: "—"
+      deactivate: "Deaktivieren"
+      reactivate: "Reaktivieren"
+      confirm_deactivate: "%{login} deaktivieren? Die Anmeldung wird sofort verweigert, Zuschreibungen bleiben erhalten."
     index:
       title: "Benutzerkonten"
       create_editor: "Editor-Konto anlegen"
@@ -578,6 +583,9 @@ de:
       created: "Benutzer %{login} angelegt"
       updated: "Benutzer %{login} aktualisiert"
       otp_reset: "Zweiter Faktor von %{login} zurückgesetzt"
+      deactivated: "%{login} ist jetzt alumni und kann sich nicht mehr anmelden."
+      reactivated: "%{login} kann sich wieder anmelden."
+      cannot_deactivate_self: "Das eigene Konto kann nicht deaktiviert werden."
     assets:
       created: "Asset wurde angelegt."
       updated: "Asset wurde aktualisiert."
diff --git a/config/locales/en.yml b/config/locales/en.yml
index f8b94a00..e434538f 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -167,6 +167,8 @@ en:
     otp_enroll: "%{actor} set up a second factor"
     otp_disable: "%{actor} removed their second factor"
     otp_reset: "%{actor} reset the second factor of %{target}"
+    user_deactivate: "%{actor} deactivated %{target}"
+    user_reactivate: "%{actor} reactivated %{target}"
 
   open_gallery: "Open gallery"
   asset_licenses:
@@ -229,6 +231,9 @@ en:
     user:
       confirm_destroy: "Do you really want to destroy user %{login}?"
       no_roles: "—"
+      deactivate: "Deactivate"
+      reactivate: "Reactivate"
+      confirm_deactivate: "Deactivate %{login}? Sign-in is refused immediately; attributions are preserved."
     index:
       title: "User accounts"
       create_editor: "Create editor account"
@@ -541,6 +546,9 @@ en:
       created: "User created %{login}"
       updated: "Updated user %{login}"
       otp_reset: "Second factor reset for %{login}"
+      deactivated: "%{login} is now an alumnus and can no longer sign in."
+      reactivated: "%{login} can sign in again."
+      cannot_deactivate_self: "You cannot deactivate your own account."
     assets:
       created: "Asset was successfully created."
       updated: "Asset was successfully updated."
diff --git a/config/routes.rb b/config/routes.rb
index 4b5d15c9..1898dbbb 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -97,9 +97,11 @@ Cccms::Application.routes.draw do
     match '/login'       => 'sessions#new',     :as => :login,        :via => :get
     match 'search'       => 'search#index',     :as => :search,       :via => :get
 
-    resources :users do
+    resources :users, :except => :destroy do
       member do
         put :reset_otp
+        put :deactivate
+        put :reactivate
       end
     end
     resource :otp_enrollment, :only => [:show, :create, :update, :destroy]