Delete users

administration/src/components/users/DeleteUserDialog.tsx

@@ -0,0 +1,76 @@
+import { Button, Callout, Checkbox, Classes, Dialog } from '@blueprintjs/core'
+import { useContext } from 'react'
+import { Administrator, useDeleteAdministratorMutation } from '../../generated/graphql'
+import { useAppToaster } from '../AppToaster'
+import { ProjectConfigContext } from '../../project-configs/ProjectConfigContext'
+import { AuthContext } from '../../AuthProvider'
+import getMessageFromApolloError from '../getMessageFromApolloError'
+
+const DeleteUserDialog = ({
+  selectedUser,
+  onClose,
+  onSuccess,
+}: {
+  onClose: () => void
+  selectedUser: Administrator | null
+  onSuccess: () => void
+}) => {
+  const appToaster = useAppToaster()
+  const authContext = useContext(AuthContext)
+  const actingAdminId = authContext.data?.administrator.id
+  const { projectId: project } = useContext(ProjectConfigContext)
+
+  const [deleteAdministrator, { loading }] = useDeleteAdministratorMutation({
+    onError: error => {
+      console.error(error)
+      appToaster?.show({ intent: 'danger', message: 'Fehler: ' + getMessageFromApolloError(error) })
+    },
+    onCompleted: () => {
+      appToaster?.show({ intent: 'success', message: 'Benutzer erfolgreich gelöscht.' })
+      if (selectedUser?.id === actingAdminId) {
+        authContext.signOut()
+      } else {
+        onClose()
+        onSuccess()
+      }
+    },
+  })
+
+  return (
+    <Dialog title={`Benutzer '${selectedUser?.email}' löschen?`} isOpen={selectedUser !== null} onClose={onClose}>
+      <form
+        onSubmit={e => {
+          e.preventDefault()
+
+          if (selectedUser === null) {
+            console.error('Form submitted in an unexpected state.')
+            return
+          }
+
+          deleteAdministrator({
+            variables: {
+              project,
+              adminId: selectedUser.id,
+            },
+          })
+        }}>
+        <div className={Classes.DIALOG_BODY}>
+          Möchten Sie den Benutzer '{selectedUser?.email}' unwiderruflich löschen?
+          {selectedUser?.id !== actingAdminId ? null : (
+            <Callout intent='danger' style={{ marginTop: '16px' }}>
+              <b>Sie löschen Ihr eigenes Konto.</b> Sie werden ausgeloggt und können sich nicht mehr einloggen.
+              <Checkbox required>Ich bestätige, dass ich diesen Warnhinweis gelesen habe.</Checkbox>
+            </Callout>
+          )}
+        </div>
+        <div className={Classes.DIALOG_FOOTER}>
+          <div className={Classes.DIALOG_FOOTER_ACTIONS}>
+            <Button type='submit' intent='danger' text='Benutzer löschen' icon='trash' loading={loading} />
+          </div>
+        </div>
+      </form>
+    </Dialog>
+  )
+}
+
+export default DeleteUserDialog

administration/src/components/users/UsersTable.tsx

@@ -2,10 +2,10 @@ import { Button } from '@blueprintjs/core'
 import { useState } from 'react'
 import styled from 'styled-components'
 import { Administrator, Region, Role } from '../../generated/graphql'
-import { useAppToaster } from '../AppToaster'
 import CreateUserDialog from './CreateUserDialog'
 import RoleHelpButton from './RoleHelpButton'
 import EditUserDialog from './EditUserDialog'
+import DeleteUserDialog from './DeleteUserDialog'
 
 const StyledTable = styled.table`
   border-spacing: 0;
@@ -42,15 +42,9 @@ const UsersTable = ({
   selectedRegionId?: number | null
   refetch: () => void
 }) => {
-  const appToaster = useAppToaster()
   const [createUserDialogOpen, setCreateUserDialogOpen] = useState(false)
   const [userInEditDialog, setUserInEditDialog] = useState<Administrator | null>(null)
-
-  const showNotImplementedToast = () =>
-    appToaster?.show({
-      message: 'Diese Funktion ist noch nicht verfügbar!',
-      intent: 'danger',
-    })
+  const [userInDeleteDialog, setUserInDeleteDialog] = useState<Administrator | null>(null)
 
   return (
     <>
@@ -82,7 +76,13 @@ const UsersTable = ({
                     minimal
                     onClick={() => setUserInEditDialog(user)}
                   />
-                  <Button icon='trash' intent='danger' text='Entfernen' minimal onClick={showNotImplementedToast} />
+                  <Button
+                    icon='trash'
+                    intent='danger'
+                    text='Entfernen'
+                    minimal
+                    onClick={() => setUserInDeleteDialog(user)}
+                  />
                 </td>
               </tr>
             )
@@ -104,6 +104,11 @@ const UsersTable = ({
         onSuccess={refetch}
         regionIdOverride={selectedRegionId}
       />
+      <DeleteUserDialog
+        selectedUser={userInDeleteDialog}
+        onClose={() => setUserInDeleteDialog(null)}
+        onSuccess={refetch}
+      />
     </>
   )
 }

administration/src/graphql/users/deleteAdministrator.graphql

@@ -0,0 +1,3 @@
+mutation deleteAdministrator($project: String!, $adminId: Int!) {
+  result: deleteAdministrator(project: $project, adminId: $adminId)
+}

backend/src/main/kotlin/app/ehrenamtskarte/backend/auth/database/Schema.kt

@@ -7,6 +7,7 @@ import org.jetbrains.exposed.dao.IntEntity
 import org.jetbrains.exposed.dao.IntEntityClass
 import org.jetbrains.exposed.dao.id.EntityID
 import org.jetbrains.exposed.dao.id.IntIdTable
+import org.jetbrains.exposed.sql.Op
 import org.jetbrains.exposed.sql.and
 import org.jetbrains.exposed.sql.javatime.datetime
 import org.jetbrains.exposed.sql.or
@@ -19,6 +20,7 @@ object Administrators : IntIdTable() {
     val passwordHash = binary("passwordHash").nullable()
     val passwordResetKey = varchar("passwordResetKey", 100).nullable()
     val passwordResetKeyExpiry = datetime("passwordResetKeyExpiry").nullable()
+    val deleted = bool("deleted")
 
     init {
         val noRegionCompatibleRoles = listOf(Role.PROJECT_ADMIN, Role.NO_RIGHTS)
@@ -27,6 +29,10 @@ object Administrators : IntIdTable() {
             regionId.isNull().and(role.inList(noRegionCompatibleRoles.map { it.db_value })) or
                 regionId.isNotNull().and(role.inList(regionCompatibleRoles.map { it.db_value }))
         }
+        check("deletedIffNoRights") {
+            (deleted eq Op.TRUE and (role eq Role.NO_RIGHTS.db_value)) or
+                (deleted eq Op.FALSE and (role neq Role.NO_RIGHTS.db_value))
+        }
     }
 }
 
@@ -40,4 +46,5 @@ class AdministratorEntity(id: EntityID<Int>) : IntEntity(id) {
     var passwordHash by Administrators.passwordHash
     var passwordResetKey by Administrators.passwordResetKey
     var passwordResetKeyExpiry by Administrators.passwordResetKeyExpiry
+    var deleted by Administrators.deleted
 }

backend/src/main/kotlin/app/ehrenamtskarte/backend/auth/database/repos/AdministratorsRepository.kt

@@ -17,6 +17,7 @@ import org.jetbrains.exposed.sql.select
 import java.security.SecureRandom
 import java.time.LocalDateTime
 import java.util.Base64
+import java.util.UUID
 
 object AdministratorsRepository {
 
@@ -77,6 +78,7 @@ object AdministratorsRepository {
             this.regionId = region?.id
             this.passwordHash = passwordHash
             this.role = role.db_value
+            this.deleted = false
         }
     }
 
@@ -91,6 +93,12 @@ object AdministratorsRepository {
         administrator.passwordResetKeyExpiry = null
     }
 
+    fun deleteAdministrator(administrator: AdministratorEntity) {
+        administrator.deleted = true
+        administrator.email = UUID.randomUUID().toString()
+        administrator.role = Role.NO_RIGHTS.db_value
+    }
+
     fun setNewPasswordResetKey(administrator: AdministratorEntity): String {
         val byteArray = ByteArray(64)
         SecureRandom.getInstanceStrong().nextBytes(byteArray)

backend/src/main/kotlin/app/ehrenamtskarte/backend/auth/service/Authorizer.kt

@@ -89,4 +89,20 @@ object Authorizer {
         }
         return false
     }
+
+    fun mayDeleteUser(
+        actingAdmin: AdministratorEntity,
+        existingAdmin: AdministratorEntity
+    ): Boolean {
+        if (actingAdmin.projectId.value != existingAdmin.projectId.value && existingAdmin.role != Role.NO_RIGHTS.db_value) {
+            return false
+        }
+
+        if (actingAdmin.role == Role.PROJECT_ADMIN.db_value) {
+            return true
+        } else if (actingAdmin.role == Role.REGION_ADMIN.db_value && existingAdmin.regionId == actingAdmin.regionId) {
+            return true
+        }
+        return false
+    }
 }

backend/src/main/kotlin/app/ehrenamtskarte/backend/auth/webservice/schema/ManageUsersMutationService.kt

@@ -109,6 +109,31 @@ class ManageUsersMutationService {
         return true
     }
 
+    @GraphQLDescription("Deletes an existing administrator")
+    fun deleteAdministrator(
+        project: String,
+        adminId: Int,
+        dfe: DataFetchingEnvironment
+    ): Boolean {
+        val context = dfe.getContext<GraphQLContext>()
+        val jwtPayload = context.enforceSignedIn()
+
+        transaction {
+            val actingAdmin = AdministratorEntity.findById(jwtPayload.userId) ?: throw UnauthorizedException()
+            val existingAdmin = AdministratorEntity.findById(adminId) ?: throw UnauthorizedException()
+            val projectEntity = ProjectEntity.find { Projects.project eq project }.first()
+
+            if (existingAdmin.projectId != projectEntity.id) throw UnauthorizedException()
+
+            if (!Authorizer.mayDeleteUser(actingAdmin, existingAdmin)) {
+                throw UnauthorizedException()
+            }
+
+            AdministratorsRepository.deleteAdministrator(existingAdmin)
+        }
+        return true
+    }
+
     private fun generateWelcomeMailMessage(
         key: String,
         administrationName: String,

backend/src/main/kotlin/app/ehrenamtskarte/backend/auth/webservice/schema/ViewAdministratorsQueryService.kt

@@ -11,6 +11,8 @@ import app.ehrenamtskarte.backend.projects.database.Projects
 import app.ehrenamtskarte.backend.regions.database.RegionEntity
 import com.expediagroup.graphql.generator.annotations.GraphQLDescription
 import graphql.schema.DataFetchingEnvironment
+import org.jetbrains.exposed.sql.and
+import org.jetbrains.exposed.sql.not
 import org.jetbrains.exposed.sql.transactions.transaction
 
 @Suppress("unused")
@@ -30,7 +32,8 @@ class ViewAdministratorsQueryService {
             if (!Authorizer.mayViewUsersInProject(admin, projectId)) {
                 throw UnauthorizedException()
             }
-            val administrators = AdministratorEntity.find { Administrators.projectId eq projectId }
+            val administrators =
+                AdministratorEntity.find { Administrators.projectId eq projectId and not(Administrators.deleted) }
 
             administrators.map { Administrator.fromDbEntity(it) }
         }
@@ -50,7 +53,8 @@ class ViewAdministratorsQueryService {
             if (!Authorizer.mayViewUsersInRegion(admin, region)) {
                 throw UnauthorizedException()
             }
-            val administrators = AdministratorEntity.find { Administrators.regionId eq regionId }
+            val administrators =
+                AdministratorEntity.find { Administrators.regionId eq regionId and not(Administrators.deleted) }
 
             administrators.map { Administrator.fromDbEntity(it) }
         }

backend/src/main/kotlin/app/ehrenamtskarte/backend/common/database/Database.kt

@@ -10,7 +10,6 @@ import org.jetbrains.exposed.sql.transactions.TransactionManager
 import org.jetbrains.exposed.sql.transactions.transaction
 import java.io.BufferedReader
 import java.io.InputStreamReader
-import java.lang.IllegalArgumentException
 import java.util.stream.Collectors
 import app.ehrenamtskarte.backend.application.database.setupDatabase as setupDatabaseForApplication
 import app.ehrenamtskarte.backend.auth.database.setupDatabase as setupDatabaseForAuth
@@ -41,7 +40,7 @@ class Database {
             roleDbValue: String,
             projectId: Int? = null
         ) {
-            val role = Role.fromDbValue(roleDbValue) ?: throw IllegalArgumentException("Invalid role '$roleDbValue'.")
+            val role = Role.fromDbValue(roleDbValue)
             transaction {
                 AdministratorsRepository.insert(project, email, password, role, projectId)
             }

specs/backend-api.graphql

@@ -86,6 +86,8 @@ type Mutation {
   changePassword(currentPassword: String!, email: String!, newPassword: String!, project: String!): Boolean!
   "Creates a new administrator"
   createAdministrator(email: String!, project: String!, regionId: Int, role: Role!, sendWelcomeMail: Boolean!): Boolean!
+  "Deletes an existing administrator"
+  deleteAdministrator(adminId: Int!, project: String!): Boolean!
   "Deletes the application with specified id"
   deleteApplication(applicationId: Int!): Boolean!
   "Edits an existing administrator"