Merge branch 'main' into email-blocking

bookwyrm/views/__init__.py

@@ -34,7 +34,15 @@ from .reading import edit_readthrough, create_readthrough
 from .reading import delete_readthrough, delete_progressupdate
 from .reading import ReadingStatus
 from .register import Register, ConfirmEmail, ConfirmEmailCode, resend_link
-from .reports import Report, Reports, make_report, resolve_report, suspend_user
+from .reports import (
+    Report,
+    Reports,
+    make_report,
+    resolve_report,
+    suspend_user,
+    unsuspend_user,
+    moderator_delete_user,
+)
 from .rss_feed import RssFeed
 from .password import PasswordResetRequest, PasswordReset, ChangePassword
 from .search import Search

bookwyrm/views/edit_user.py

@@ -55,7 +55,6 @@ class DeleteUser(View):
     def post(self, request):
         """les get fancy with images"""
         form = forms.DeleteUserForm(request.POST, instance=request.user)
-        form.is_valid()
         # idk why but I couldn't get check_password to work on request.user
         user = models.User.objects.get(id=request.user.id)
         if form.is_valid() and user.check_password(form.cleaned_data["password"]):

bookwyrm/views/reports.py

@@ -1,5 +1,6 @@
 """ moderation via flagged posts and users """
 from django.contrib.auth.decorators import login_required, permission_required
+from django.core.exceptions import PermissionDenied
 from django.shortcuts import get_object_or_404, redirect
 from django.template.response import TemplateResponse
 from django.utils.decorators import method_decorator
@@ -77,12 +78,50 @@ class Report(View):
 def suspend_user(_, user_id):
     """mark an account as inactive"""
     user = get_object_or_404(models.User, id=user_id)
-    user.is_active = not user.is_active
+    user.is_active = False
+    user.deactivation_reason = "moderator_suspension"
     # this isn't a full deletion, so we don't want to tell the world
     user.save(broadcast=False)
     return redirect("settings-user", user.id)
 
 
+@login_required
+@permission_required("bookwyrm_moderate_user")
+def unsuspend_user(_, user_id):
+    """mark an account as inactive"""
+    user = get_object_or_404(models.User, id=user_id)
+    user.is_active = True
+    user.deactivation_reason = None
+    # this isn't a full deletion, so we don't want to tell the world
+    user.save(broadcast=False)
+    return redirect("settings-user", user.id)
+
+
+@login_required
+@permission_required("bookwyrm_moderate_user")
+def moderator_delete_user(request, user_id):
+    """permanently delete a user"""
+    user = get_object_or_404(models.User, id=user_id)
+
+    # we can't delete users on other instances
+    if not user.local:
+        raise PermissionDenied
+
+    form = forms.DeleteUserForm(request.POST, instance=user)
+
+    moderator = models.User.objects.get(id=request.user.id)
+    # check the moderator's password
+    if form.is_valid() and moderator.check_password(form.cleaned_data["password"]):
+        user.deactivation_reason = "moderator_deletion"
+        user.delete()
+        return redirect("settings-user", user.id)
+
+    form.errors["password"] = ["Invalid password"]
+
+    data = {"user": user, "group_form": forms.UserGroupForm(), "form": form}
+    return TemplateResponse(request, "user_admin/user.html", data)
+
+
 @login_required
 @permission_required("bookwyrm_moderate_post")
 def resolve_report(_, report_id):