Cannot delete / deactivate users

[victor-nitu]

There's no way to delete or deactivate users but altering the db directly. This is bad and might mess up db's integrity, so we need to fix it.

• add appropriate controls in users management page
• only allow admins to do this
• (optional) allow users to deactivate their own account
  • this might be a bigger thing, but anyway, let's start the discussion around it if needed; scenario here is that a user deactivates his own account, then reactivates by attempted login + resend activation (confirmation) email

[victor-nitu]

This needs more debate, since it's kinda sensitive: how do we approach the privacy vs. data integrity issue?

We could just delete a user, but then we would have to also delete all their content, or "reparent" everything to a surrogate user. On the other hand, we could just disable them, thus leading to a potentially unexpected behaviour for our users and the inability to disappear from the platform.

Or we could support a hybrid scenario, where users would have the possibility to deactivate or remove themselves, with an extra option have all their content removed upon their own user deletion.

TL;DR: what happens to user's content once the user is gone, and who decides this? Also, should we allow users to delete themselves, or maybe deactivate would fit better?

[Luthieneye]

Admin should be able to delete users. Regular users should not be able to delete other users but should be given the option to delete himself. @judelove what do you think?

[Luthieneye]

Maybe
Phase 1 - admin deletes users; regular users can't delete themselves
Phased 2 - users can delete themselves

[victor-nitu]

Blocked by rootio/project#8