Repository navigation
Let superadmins suspend accounts from the admin panel - #1444
Merged
Merged
Conversation
Suspending an account moves its live and pending-review events and live organizer pages to draft, blocks password and SSO sign-in for its members, and rejects its sessions and API keys with 403 ACCOUNT_SUSPENDED. Public routes treat a suspended session as anonymous. Superadmins can optionally email the account owner, with the reason included. Unsuspending restores access but leaves everything in draft. Impersonation still works on a suspended account, and accounts with a superadmin member can't be suspended.
Contributor
|
| Mode | Result | ✅ Passed | ❌ Failed | ⏭️ Skipped | ⏱️ Duration | |
|---|---|---|---|---|---|---|
| Self-hosted | 110 | 0 | 1 | 0 | 3m 57s |
⚠️ Flaky tests: failed first, then passed on retry (1)
- Self-hosted ·
box-office/box-office-reconciliation.spec.ts:6· box office reconciliation › the sales summary totals door sales by payment type and operator
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Suspend account option to each account page in the super admin section.
Suspending an account:
ACCOUNT_SUSPENDEDerror the login page shows as a clear message; members of other accounts are signed in to one that isn't suspendedACCOUNT_SUSPENDED(the frontend sends them to the login page with the same message); public routes treat a suspended session as anonymous, so its draft previews aren't reachableUnsuspending restores access but leaves events and organizer pages in draft for the owner to republish.
Other decisions:
Changes
accounts.suspended_at,accounts.suspension_reasonAccountSuspensionServiceplusPOST/DELETE /admin/accounts/{account_id}/suspensionEnsureAccountIsNotSuspendedmiddleware in theapigroup (status cached for 60s, cleared on suspend/unsuspend)LoginServiceexcludes suspended accounts;LoginActionreturns the code of anyCodedAccessExceptiontreatRequestAsAnonymousmoved fromEnsureTokenNotRevokedtoAuthUserServiceso both middlewares share itTeamInviteTestmember-listing query ceiling raised from 11 to 12 for the one extra (cached) lookup per requestTesting
AccountSuspensionTest(13 tests) plus full Unit and Feature suites passing locallytests/admin/account-suspension.spec.tspassing against the dev stack