Locking users mechanism

server/api/admin.js

@@ -313,6 +313,25 @@ const API = {
 
     await Models.Ban.query().insert(banAdd)
     return {}
+  },
+  lockAccount: async function (userId) {
+    let user = await Users.User.get(userId)
+    if (user.id === 1 || user.nw_privilege > 2) {
+      throw new Error('Cannot lock this user.')
+    }
+
+    let lockId = Users.Hash(4)
+    let userObf = {
+      username: lockId,
+      display_name: user.username,
+      email: `${lockId}@icynet.eu`,
+      password: null,
+      activated: false,
+      locked: true,
+      avatar_file: null
+    }
+
+    return Users.User.update(user, userObf)
   }
 }
 

server/routes/admin.js

@@ -156,6 +156,15 @@ apiRouter.post('/user/reset_password', csrfVerify, wrap(async (req, res) => {
   res.jsonp(await API.sendPasswordEmail(id))
 }))
 
+apiRouter.post('/user/lock', csrfVerify, wrap(async (req, res) => {
+  let id = parseInt(req.body.user_id)
+  if (isNaN(id)) {
+    throw new Error('Invalid or missing user ID')
+  }
+
+  res.jsonp(await API.lockAccount(id))
+}))
+
 const availableScopes = ['uuid', 'email', 'username', 'display_name']
 apiRouter.get('/search/users', wrap(async (req, res) => {
   if (!req.query.terms) throw new Error('Please specify search terms!')