GRN2-247: Added Active Pending Banned Deleted tabs to manage users (#816)

* Added Active Pending Banned Deleted tabs to manage users

* Removed hard coded strings

* Fixed issues with sign in flow

* Fixed issues with rooms not deleting

app/controllers/admins_controller.rb

@@ -24,10 +24,11 @@ class AdminsController < ApplicationController
   include Rolify
 
   manage_users = [:edit_user, :promote, :demote, :ban_user, :unban_user, :approve, :reset]
-
+  manage_deleted_users = [:undelete]
   authorize_resource class: false
   before_action :find_user, only: manage_users
-  before_action :verify_admin_of_user, only: manage_users
+  before_action :find_deleted_user, only: manage_deleted_users
+  before_action :verify_admin_of_user, only: [manage_users, manage_deleted_users]
 
   # GET /admins
   def index
@@ -37,6 +38,7 @@ class AdminsController < ApplicationController
     @order_direction = params[:direction] && params[:direction] != "none" ? params[:direction] : "DESC"
 
     @role = params[:role] ? Role.find_by(name: params[:role], provider: @user_domain) : nil
+    @tab = params[:tab] || "active"
 
     @pagy, @users = pagy(user_list)
   end
@@ -88,6 +90,15 @@ class AdminsController < ApplicationController
     redirect_to admins_path, flash: { success: I18n.t("administrator.flash.approved") }
   end
 
+  # POST /admins/approve/:user_uid
+  def undelete
+    # Undelete the user and all of his rooms
+    @user.undelete!
+    @user.rooms.deleted.each(&:undelete!)
+
+    redirect_to admins_path, flash: { success: I18n.t("administrator.flash.restored") }
+  end
+
   # POST /admins/invite
   def invite
     emails = params[:invite_user][:email].split(",")
@@ -208,6 +219,10 @@ class AdminsController < ApplicationController
     @user = User.where(uid: params[:user_uid]).includes(:roles).first
   end
 
+  def find_deleted_user
+    @user = User.deleted.where(uid: params[:user_uid]).includes(:roles).first
+  end
+
   # Verifies that admin is an administrator of the user in the action
   def verify_admin_of_user
     redirect_to admins_path,
@@ -216,18 +231,31 @@ class AdminsController < ApplicationController
 
   # Gets the list of users based on your configuration
   def user_list
+    current_role = @role
+
+    initial_user = case @tab
+      when "active"
+        User.without_role(:pending).without_role(:denied)
+      when "deleted"
+        User.deleted
+      else
+        User
+    end
+
+    current_role = Role.find_by(name: @tab, provider: @user_domain) if @tab == "pending" || @tab == "denied"
+
     initial_list = if current_user.has_role? :super_admin
-      User.where.not(id: current_user.id)
+      initial_user.where.not(id: current_user.id)
     else
-      User.without_role(:super_admin).where.not(id: current_user.id)
+      initial_user.without_role(:super_admin).where.not(id: current_user.id)
     end
 
     if Rails.configuration.loadbalanced_configuration
       initial_list.where(provider: @user_domain)
-                  .admins_search(@search, @role)
+                  .admins_search(@search, current_role)
                   .admins_order(@order_column, @order_direction)
     else
-      initial_list.admins_search(@search, @role)
+      initial_list.admins_search(@search, current_role)
                   .admins_order(@order_column, @order_direction)
     end
   end

app/controllers/sessions_controller.rb

@@ -63,17 +63,22 @@ class SessionsController < ApplicationController
   def create
     logger.info "Support: #{session_params[:email]} is attempting to login."
 
-    admin = User.find_by(email: session_params[:email])
-    if admin&.has_role? :super_admin
-      user = admin
-    else
-      user = User.find_by(email: session_params[:email], provider: @user_domain)
-      redirect_to(signin_path, alert: I18n.t("invalid_credentials")) && return unless user
-      redirect_to(root_path, alert: I18n.t("invalid_login_method")) && return unless user.greenlight_account?
-      redirect_to(account_activation_path(email: user.email)) && return unless user.activated?
-    end
-    redirect_to(signin_path, alert: I18n.t("invalid_credentials")) && return unless user.try(:authenticate,
+    user = User.include_deleted.find_by(email: session_params[:email], provider: @user_domain)
+
+    # Check user with that email exists
+    return redirect_to(signin_path, alert: I18n.t("invalid_credentials")) unless user
+    # Check correct password was entered
+    return redirect_to(signin_path, alert: I18n.t("invalid_credentials")) unless user.try(:authenticate,
       session_params[:password])
+    # Check that the user is not deleted
+    return redirect_to root_path, flash: { alert: I18n.t("registration.banned.fail") } if user.deleted?
+
+    unless user.has_role? :super_admin
+      # Check that the user is a Greenlight account
+      return redirect_to(root_path, alert: I18n.t("invalid_login_method")) unless user.greenlight_account?
+      # Check that the user has verified their account
+      return redirect_to(account_activation_path(email: user.email)) unless user.activated?
+    end
 
     login(user)
   end
@@ -153,8 +158,19 @@ class SessionsController < ApplicationController
   end
 
   def check_user_exists
-    provider = @auth['provider'] == "bn_launcher" ? @auth['info']['customer'] : @auth['provider']
-    User.exists?(social_uid: @auth['uid'], provider: provider)
+    User.exists?(social_uid: @auth['uid'], provider: current_provider)
+  end
+
+  def check_user_deleted(email)
+    User.deleted.exists?(email: email, provider: @user_domain)
+  end
+
+  def check_auth_deleted
+    User.deleted.exists?(social_uid: @auth['uid'], provider: current_provider)
+  end
+
+  def current_provider
+    @auth['provider'] == "bn_launcher" ? @auth['info']['customer'] : @auth['provider']
   end
 
   # Check if the user already exists, if not then check for invitation
@@ -172,6 +188,9 @@ class SessionsController < ApplicationController
       return redirect_to root_path, flash: { alert: I18n.t("registration.deprecated.twitter_signup") }
     end
 
+    # Check if user is deleted
+    return redirect_to root_path, flash: { alert: I18n.t("registration.banned.fail") } if check_auth_deleted
+
     # If using invitation registration method, make sure user is invited
     return redirect_to root_path, flash: { alert: I18n.t("registration.invite.no_invite") } unless passes_invite_reqs
 

app/controllers/users_controller.rb

@@ -24,7 +24,7 @@ class UsersController < ApplicationController
   include Recorder
   include Rolify
 
-  before_action :find_user, only: [:edit, :change_password, :delete_account, :update, :destroy]
+  before_action :find_user, only: [:edit, :change_password, :delete_account, :update]
   before_action :ensure_unauthenticated_except_twitter, only: [:create]
   before_action :check_user_signup_allowed, only: [:create]
   before_action :check_admin_of, only: [:edit, :change_password, :delete_account]
@@ -122,22 +122,41 @@ class UsersController < ApplicationController
 
   # DELETE /u/:user_uid
   def destroy
+    # Include deleted users in the check
+    @user = User.include_deleted.find_by(uid: params[:user_uid])
+
     logger.info "Support: #{current_user.email} is deleting #{@user.email}."
 
     self_delete = current_user == @user
+    redirect_url = self_delete ? root_path : admins_path
+
     begin
       if current_user && (self_delete || current_user.admin_of?(@user))
-        @user.destroy
+        # Permanently delete if the user is deleting themself
+        perm_delete = self_delete || (params[:permanent].present? && params[:permanent] == "true")
+
+        # Permanently delete the rooms under the user if they have not been reassigned
+        if perm_delete
+          @user.rooms.include_deleted.each do |room|
+            room.destroy(true)
+          end
+        end
+
+        @user.destroy(perm_delete)
+
+        # Log the user out if they are deleting themself
         session.delete(:user_id) if self_delete
 
-        return redirect_to admins_path, flash: { success: I18n.t("administrator.flash.delete") } unless self_delete
+        return redirect_to redirect_url, flash: { success: I18n.t("administrator.flash.delete") } unless self_delete
+      else
+        flash[:alert] = I18n.t("administrator.flash.delete_fail")
       end
     rescue => e
       logger.error "Support: Error in user deletion: #{e}"
       flash[:alert] = I18n.t(params[:message], default: I18n.t("administrator.flash.delete_fail"))
     end
 
-    redirect_to root_path
+    redirect_to redirect_url
   end
 
   # GET /u/:user_uid/recordings