Displaying the required page when trying to login if the account was deleted by the admin

[Halvanhelv]

Hi!

I am in the process of implementing deleting user accounts, so that the admin on the panel can close any account, I used the

RodauthApp.rodauth.close_account(account_login: resource_account.email)

and it works, but I want the deleted users to get html code that their account was closed by the administrator when they try to log in, so that the user can understand at once what is going on and why he can't log in.

but the problem is that when trying to login a closed account rodauth just tries to find an active account with the desired login and writes that the account does not exist, this behavior does not suit me, is there a theoretical possibility in this situation to change the behavior to what I need, it is difficult to understand where to start?

At the same time such a user can register a new account with the same mail but without the status of deleted by the admin user

[janko]

You could use the before_login_route hook, which gets executed before Rodauth tries to find the account, and then render your HTML page there. I don't know how you're differentiating between users closing their own accounts vs admins closing their accounts, but it could look something like:

before_login_route do
  unless Account.closed.where(email: param(login_param)).empty?
    return_response view("account_closed", "Account closed by admin")
  end
end

This relies on there being a app/views/rodauth/account_closed.html template, the 2nd argument is just the page title.

You can also create a custom controller action that renders this page and redirect to it, e.g. redirect "/account-closed".

[janko]

Yes, if you didn't create the Rails view template that I mentioned, then it will try to find the template inside the gem. This is the internal fallback mechanism rodauth-rails implements.

[Halvanhelv]

got it, I also noticed that you can’t give status 200, otherwise a get request will be made to /login which will not return param(login_param)

fixed with response.status = no_matching_login_error_status

[janko]

Why can't you give status 200? Turbo will not accept this status on form submission, but if you disable Turbo it should work, right? I agree setting an an error response status seems more appropriate here.

[Halvanhelv]

Why can't you give status 200? Turbo will not accept this status on form submission, but if you disable Turbo it should work, right? I agree setting an an error response status seems more appropriate here.

What do you mean, maybe I misunderstood you.

Are you saying that because the status 200 turbo does not work the way I need? As I wrote above, if I put the code 200, then the server immediately after POST /login sends a GET /login request and the page change occurs.

Unfortunately I can't disable turbo because my login form is part of the page (sidebar) not a separate layout and I need turbo stream for that.

[janko]

Yeah, Turbo requires form submissions to either redirect or return an error response status. I wasn't aware you were using Turbo here, in that case using an error status is necessary.

[Halvanhelv]

This construction seems to work, but I would like to additionally check that the user has entered the correct password to be sure that the author himself is trying to log in, can this be done in the current code implementation?

[janko]

That's not going to automatically work, because you'd have to use password_match?, which relies on @account being loaded into the Rodauth instance. That's normally done by account_from_login, but we were skipping it here.

Maybe try the following approach:

before_login_route do
  if request.post?
    @account = account_table_ds.first(email: param(login_param), status: account_closed_status_value)
    if @account && password_match?(param(password_param))
      response.status = no_matching_login_error_status
      return_response view("account_closed", "Account closed by admin")
    end
  end
end

[Halvanhelv]

I think that's what I need, but I'd like to pass variables to the template to show the username.

I looked at the view source code and apparently this functionality is not supported, do you have any thoughts on how this can be done?

[janko]

You should be able to access the Rodauth object normally, and thus current_account should be available in that template, through which you can retrieve the username.

[Halvanhelv]

wow, this must be from the @account hack.

I've completely solved my problem, thanks a lot for your help!

The question can be closed