Disabling a user should be like deleting it, without actually deleting it. I.e., the disabled user can not login or make any authenticated requests. The user can at any time be re-enabled and will then be able to login again, etc.
I think this is a good feature to have, since it allows you to temporarily disable users that might no longer be working at the nation. It is much easier than to create a new account.
Solution
- Add a new field to the user model, e.g.
disabled
- Set the default value of the
disabled field to false
- Allow updating of this value via some route
- Disallow all login attempts and authenticated requests where the user is disabled
Disabling a user should be like deleting it, without actually deleting it. I.e., the disabled user can not login or make any authenticated requests. The user can at any time be re-enabled and will then be able to login again, etc.
I think this is a good feature to have, since it allows you to temporarily disable users that might no longer be working at the nation. It is much easier than to create a new account.
Solution
disableddisabledfield tofalse