TheOdinProject / theodinproject

Main Website for The Odin Project
http://www.theodinproject.com
MIT License
3.72k stars 2.07k forks source link

Deactivate admin team members #4593

Closed KevinMulhern closed 3 months ago

KevinMulhern commented 3 months ago

When someone leaves the team, I want to be able to deactivate their admin account, so they don't have access anymore.

Acceptance criteria

  1. Log into admin v2 - admin@odin.com, password123
  2. Invite a new team member
  3. Accept the invite and log into the new team members account in an incognito window
  4. Back on first admin account, click the ellipsis menu on the new team member
  5. Click the "Deactivate" option
  6. The admin should be moved to a "Deactivated" section at the bottom of the team page

As the deactivated admin...

  1. Refresh the incognito window - you should be signed out
  2. Try to sign in again - you should be redirected back to the sign in page with a notice informing the admin they've been deactivated

Notes

We want to deactivate instead of deleting to ensure that our audit trails are kept intact. For example, when an admin handles a flag, we will set that admin as the handler. If we allow admins to be fully deleted, that association will be lost.