From 6c1d73a509a1ac2216a704f3dc5534d573e5d7ae Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Thu, 9 Dec 2021 16:12:42 +0000 Subject: [PATCH 1/1] Allow users to delete their own accounts This PR allows users to delete their own accounts. The logic implemented matches that currently used by the admins when they manually close accounts, although there is room to be more complex in future e.g. completely removing accounts with no content. The error handling has been slightly adapted for namespaced controllers, by anchoring the controller name with a leading forward slash. --- app/abilities/ability.rb | 3 +- .../account/deletions_controller.rb | 12 +++++ app/controllers/accounts_controller.rb | 10 +++++ app/controllers/application_controller.rb | 2 +- app/views/account/deletions/show.html.erb | 38 ++++++++++++++++ app/views/accounts/edit.html.erb | 9 +++- app/views/application/_settings_menu.html.erb | 2 +- config/locales/en.yml | 21 +++++++++ config/routes.rb | 6 ++- test/system/account_deletion_test.rb | 44 +++++++++++++++++++ 10 files changed, 142 insertions(+), 5 deletions(-) create mode 100644 app/controllers/account/deletions_controller.rb create mode 100644 app/views/account/deletions/show.html.erb create mode 100644 test/system/account_deletion_test.rb diff --git a/app/abilities/ability.rb b/app/abilities/ability.rb index b8e21b486..e9fd6f7bb 100644 --- a/app/abilities/ability.rb +++ b/app/abilities/ability.rb @@ -36,13 +36,14 @@ class Ability if user can :welcome, :site can [:revoke, :authorize], :oauth + can [:show], :deletion if Settings.status != "database_offline" can [:index, :new, :create, :show, :edit, :update, :destroy], ClientApplication can [:index, :new, :create, :show, :edit, :update, :destroy], :oauth2_application can [:index, :destroy], :oauth2_authorized_application can [:new, :show, :create, :destroy], :oauth2_authorization - can [:edit, :update], :account + can [:edit, :update, :destroy], :account can [:show], :dashboard can [:new, :create, :edit, :update, :comment, :subscribe, :unsubscribe], DiaryEntry can [:make_friend, :remove_friend], Friendship diff --git a/app/controllers/account/deletions_controller.rb b/app/controllers/account/deletions_controller.rb new file mode 100644 index 000000000..2e3c777fa --- /dev/null +++ b/app/controllers/account/deletions_controller.rb @@ -0,0 +1,12 @@ +module Account + class DeletionsController < ApplicationController + layout "site" + + before_action :authorize_web + before_action :set_locale + + authorize_resource :class => false + + def show; end + end +end diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb index 06eb031c4..63da1293f 100644 --- a/app/controllers/accounts_controller.rb +++ b/app/controllers/accounts_controller.rb @@ -51,4 +51,14 @@ class AccountsController < ApplicationController redirect_to auth_url(params[:user][:auth_provider], params[:user][:auth_uid]), :status => :temporary_redirect end end + + def destroy + current_user.soft_destroy! + + session.delete(:user) + session_expires_automatically + + flash[:notice] = t ".success" + redirect_to root_path + end end diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 07b23ce21..bb32e7e6e 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -349,7 +349,7 @@ class ApplicationController < ActionController::Base elsif current_user set_locale respond_to do |format| - format.html { redirect_to :controller => "errors", :action => "forbidden" } + format.html { redirect_to :controller => "/errors", :action => "forbidden" } format.any { report_error t("application.permission_denied"), :forbidden } end elsif request.get? diff --git a/app/views/account/deletions/show.html.erb b/app/views/account/deletions/show.html.erb new file mode 100644 index 000000000..99c1686d8 --- /dev/null +++ b/app/views/account/deletions/show.html.erb @@ -0,0 +1,38 @@ +<% content_for :heading do %> +

<%= t ".title" %>

+<% end %> + +<%= render :partial => "settings_menu" %> + +
+
+ + " type="image/svg+xml"> + <%= image_tag("notice.png", :srcset => image_path("notice.svg")) %> + +
+
+

<%= t ".warning" %>

+
+
+ +

<%= t ".delete_introduction" %>

+ + + +

<%= t ".retain_caveats" %>

+ + + +<%= link_to t(".delete_account"), account_path, { :method => :delete, :class => "btn btn-danger", :data => { :confirm => t(".confirm_delete") } } %> +<%= link_to t(".cancel"), edit_account_path, :class => "btn btn-link" %> diff --git a/app/views/accounts/edit.html.erb b/app/views/accounts/edit.html.erb index 0dcab17b0..eb977d094 100644 --- a/app/views/accounts/edit.html.erb +++ b/app/views/accounts/edit.html.erb @@ -54,7 +54,14 @@ - <%= f.primary t(".save changes button") %> +
+
+ <%= f.primary t(".save changes button") %> +
+
+ <%= link_to t(".delete_account"), account_deletion_path, :class => "btn btn-outline-danger" %> +
+
<% end %> <% unless current_user.data_public? %> diff --git a/app/views/application/_settings_menu.html.erb b/app/views/application/_settings_menu.html.erb index 05cee9185..9ce9755a2 100644 --- a/app/views/application/_settings_menu.html.erb +++ b/app/views/application/_settings_menu.html.erb @@ -3,7 +3,7 @@ <% content_for :heading do %>