Add Reject button for new registrations (#295)

* Add reject functionality

* Update templates/mails/user_rejected.txt

Co-authored-by: Rien <rien.maertens@posteo.be>

* remove sending mail when rejected

---------

Co-authored-by: Rien <rien.maertens@posteo.be>

src/controllers/users_controller.rs

@@ -308,6 +308,28 @@ pub async fn set_approved<'r>(
 	})
 }
 
+#[post("/users/<username>/reject")]
+pub async fn reject<'r>(
+	username: String,
+	_session: AdminSession,
+	db: DbConn,
+) -> Result<impl Responder<'r, 'static>> {
+	let user = User::find_by_username(username, &db).await?;
+
+	if user.state != UserState::PendingApproval {
+		return Err(ZauthError::Unprocessable(String::from(
+			"user is not in the pending approval state",
+		)));
+	}
+
+	user.delete(&db).await?;
+
+	Ok(Accepter {
+		html: Redirect::to(uri!(list_users())),
+		json: Custom(Status::NoContent, ()),
+	})
+}
+
 #[get("/users/forgot_password")]
 pub fn forgot_password_get<'r>() -> impl Responder<'r, 'static> {
 	template! { "users/forgot_password.html" }

src/lib.rs

@@ -129,6 +129,7 @@ fn assemble(rocket: Rocket<Build>) -> Rocket<Build> {
 				users_controller::change_state,
 				users_controller::set_admin,
 				users_controller::set_approved,
+				users_controller::reject,
 				users_controller::forgot_password_get,
 				users_controller::forgot_password_post,
 				users_controller::reset_password_get,

templates/users/index.html

@@ -33,6 +33,7 @@
 					<th>Email</th>
 					<th>Created at</th>
 					<th>Approve</th>
+					<th>Reject</th>
 				</tr>
 			</thead>
 
@@ -59,6 +60,13 @@
 								<button class="button is-success is-small" type="submit">Approve</button>
 							</form>
 						</td>
+
+						<!-- Reject -->
+						<td>
+							<form action="/users/{{ user.username }}/reject" method="post">
+								<button class="button is-danger is-small" type="submit">Reject</button>
+							</form>
+						</td>
 					</tr>
 				{% endfor %}
 

tests/users.rs

@@ -788,6 +788,76 @@ async fn user_approval_flow() {
 	.await;
 }
 
+#[rocket::async_test]
+async fn user_rejectal_flow() {
+	common::as_admin(async move |http_client: HttpClient, db, _admin| {
+		let email = String::from("test@example.com");
+		let user = User::create_pending(
+			NewUser {
+				username:    String::from("user"),
+				password:    String::from("password"),
+				full_name:   String::from("name"),
+				email:       email.clone(),
+				ssh_key:     None,
+				not_a_robot: true,
+			},
+			&common::config(),
+			&db,
+		)
+		.await
+		.unwrap();
+
+		let token = user
+			.pending_email_token
+			.as_ref()
+			.expect("email token")
+			.clone();
+
+		let response = http_client
+			.get(format!("/users/confirm/{}", token))
+			.header(Accept::HTML)
+			.header(ContentType::Form)
+			.dispatch()
+			.await;
+
+		assert_eq!(response.status(), Status::Ok);
+
+		let response =
+			common::expect_mail_to(vec!["admin@localhost"], async || {
+				http_client
+					.post("/users/confirm")
+					.header(Accept::HTML)
+					.header(ContentType::Form)
+					.body(format!("token={}", token))
+					.dispatch()
+					.await
+			})
+			.await;
+
+		assert_eq!(response.status(), Status::Ok);
+
+		let user = user.reload(&db).await.expect("reload user");
+
+		assert_eq!(
+			user.state,
+			UserState::PendingApproval,
+			"after email is confirmed, user should be pending for approval"
+		);
+
+		let response = http_client
+			.post(format!("/users/{}/reject/", user.username))
+			.header(Accept::HTML)
+			.header(ContentType::Form)
+			.dispatch()
+			.await;
+
+		assert_eq!(response.status(), Status::SeeOther);
+
+		user.reload(&db).await.expect_err("user should be removed");
+	})
+	.await;
+}
+
 #[rocket::async_test]
 async fn refuse_robots() {
 	common::as_visitor(async move |http_client: HttpClient, db| {