Re: Should web (html, xmlrpc, rest) and email intefaces refuse retired users?

Hi Ralf:

In message <[email protected]>,
Ralf Schlatterbeck writes:
>On Sun, Apr 04, 2021 at 04:42:44PM -0400, John P. Rouillard wrote:
>> Hi All:
>> 
>> Just had a discussion with a new roundup user. He wanted to delete a
>> user rather than retire. In discussion I looked to see if retiring a
>> user had any effect on their ability to login, send email, use
>> xmlrpc/rest interfaces.
>> 
>> None of the above code paths require that the user is un-retired to
>> work.
>> 
>> Should retiring a user block all interaction with roundup (same as if
>> no role are defined for the user)? Also if the user's email address is
>> found should emails be bounced in the mail gateway?
>
>Yes, probably.
>I have added a 'user_status' field in my trackers. And there is a
>reactor that sets the roles of the user to empty when the status goes
>from 'valid' to 'obsolete'. Modelling this with a status makes it easier
>to resurrect a user :-)

Given this was sent a day after Easter, resurrection seems an
appropriate word 8-).

Should a retired user behave the same as any other login failure: bad
username, bad password etc.

For email I expect it would behave the same as though the anonymous
user didn't have 'Email Access' rights.

Should there be a message logged (at warning or info level) for the
login? I think there should be some indication somewhere that the
failure is due to the retired account.

Have a great day.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.