bcea450e98
Three new POST endpoints on the existing admin blueprint, all guarded
by @require_admin and CSRF (per the global before_request hook):
/admin/users/<id>/deactivate flips active=False (refuses self)
/admin/users/<id>/activate flips active=True
/admin/users/<id>/delete hard delete with safeties:
- refuses self-delete
- refuses delete-of-the-last-admin
- refuses if the user owns Servers, Blueprints, or custom
Overlays (operator deletes those first via existing UIs)
- nulls out Job.user_id (jobs stay as audit trail; FK is nullable)
admin_users.html grows an Active column + an Actions column with the
appropriate button per row (none for self, Deactivate/Activate
toggle, Delete-with-confirmation modal). Modal pattern mirrors
blueprint_detail.html (same modal-close/modal-open data attrs,
csrf_token hidden field).
Refusal responses are 409 with a plain-text body (matches the
blueprint-in-use refusal at blueprint_routes.py:182). No flash
infrastructure introduced; consistent with the rest of the codebase.
All 367 existing tests still pass.
75 lines
2.7 KiB
HTML
75 lines
2.7 KiB
HTML
{% extends "base.html" %}
|
|
|
|
{% block title %}Admin Users | left4me{% endblock %}
|
|
|
|
{% block content %}
|
|
<section class="panel">
|
|
<h1>Users</h1>
|
|
<table class="table">
|
|
<thead>
|
|
<tr>
|
|
<th>Username</th>
|
|
<th>Admin</th>
|
|
<th>Active</th>
|
|
<th>Created</th>
|
|
<th>Updated</th>
|
|
<th>Actions</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for user in users %}
|
|
<tr>
|
|
<td>{{ user.username }}</td>
|
|
<td>{{ "yes" if user.admin else "no" }}</td>
|
|
<td>{{ "yes" if user.active else "no" }}</td>
|
|
<td>{{ user.created_at }}</td>
|
|
<td>{{ user.updated_at }}</td>
|
|
<td>
|
|
{% if user.id == g.user.id %}
|
|
<span class="muted">you</span>
|
|
{% else %}
|
|
{% if user.active %}
|
|
<form method="post" action="/admin/users/{{ user.id }}/deactivate" class="inline-form">
|
|
<input type="hidden" name="csrf_token" value="{{ session.get('csrf_token', '') }}">
|
|
<button type="submit" class="button-secondary">Deactivate</button>
|
|
</form>
|
|
{% else %}
|
|
<form method="post" action="/admin/users/{{ user.id }}/activate" class="inline-form">
|
|
<input type="hidden" name="csrf_token" value="{{ session.get('csrf_token', '') }}">
|
|
<button type="submit" class="button-secondary">Activate</button>
|
|
</form>
|
|
{% endif %}
|
|
<button type="button" class="danger-outline" data-modal-open="delete-user-{{ user.id }}-modal">Delete</button>
|
|
{% endif %}
|
|
</td>
|
|
</tr>
|
|
{% else %}
|
|
<tr><td colspan="6" class="muted">No users found.</td></tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
|
|
{% for user in users %}
|
|
{% if user.id != g.user.id %}
|
|
<dialog id="delete-user-{{ user.id }}-modal" class="modal" aria-labelledby="delete-user-{{ user.id }}-title">
|
|
<div class="modal-header">
|
|
<h2 id="delete-user-{{ user.id }}-title">Delete user "{{ user.username }}"?</h2>
|
|
<button type="button" class="modal-close" data-modal-close aria-label="Close">×</button>
|
|
</div>
|
|
<div class="modal-body">
|
|
<p>This cannot be undone. Refused if the user owns servers, blueprints,
|
|
or custom overlays — delete those first.</p>
|
|
<p>For a reversible block, prefer Deactivate.</p>
|
|
</div>
|
|
<div class="modal-footer">
|
|
<button type="button" class="button-secondary" data-modal-close>Cancel</button>
|
|
<form method="post" action="/admin/users/{{ user.id }}/delete" class="inline-form">
|
|
<input type="hidden" name="csrf_token" value="{{ session.get('csrf_token', '') }}">
|
|
<button class="danger" type="submit">Delete</button>
|
|
</form>
|
|
</div>
|
|
</dialog>
|
|
{% endif %}
|
|
{% endfor %}
|
|
{% endblock %}
|