From 8c6a6516e1dc5c1b4f12740a6f7b32765b530bb7 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 31 Jul 2026 17:05:05 +0200 Subject: Replace user deletion with deactivation Deactivation adds the alumni role and leaves the others in place, so reactivation is lossless and nobody has to remember what an account held. login_from_session checks alumni? on every request, so a signed-in user is locked out on their next one without any session invalidation. Guards prevent deactivating yourself or the last active admin, and both verbs are witnessed in the action log. --- app/views/users/_user.html.erb | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) (limited to 'app/views/users/_user.html.erb') diff --git a/app/views/users/_user.html.erb b/app/views/users/_user.html.erb index 04884be8..ff9d4e37 100644 --- a/app/views/users/_user.html.erb +++ b/app/views/users/_user.html.erb @@ -9,14 +9,22 @@ <% end %> <%= link_to t("admin.common.show"), user_path(user) %> - <% if current_user.admin? || current_user == user %> - <%= link_to t("admin.common.edit"), edit_user_path(user) %> - <%= button_to user_path(user), method: :delete, - form: { data: { confirm: t(".confirm_destroy", :login => user.login) }, class: 'button_to destructive' } do %> - <%= icon("trash", library: "tabler", "aria-hidden": true) %> <%= t("admin.common.destroy") %> - <% end %> + <% if current_user.admin? || current_user == user %> + <%= link_to t("admin.common.edit"), edit_user_path(user) %> + <% end %> + + + <% if current_user.admin? && current_user != user %> + <% if user.alumni? %> + <%= button_to t(".reactivate"), reactivate_user_path(user), method: :put, + form: { class: 'button_to state_changing' } %> + <% else %> + <%= button_to t(".deactivate"), deactivate_user_path(user), method: :put, + form: { data: { confirm: t(".confirm_deactivate", :login => user.login) }, + class: 'button_to destructive' } %> + <% end %> + <% end %> - <% end %> <% end %> -- cgit v1.3