Add field to user model that allows you to disable the user

[Frewacom]

Disabling a user should be like deleting it, without actually deleting it. I.e., the disabled user can not login or make any authenticated requests. The user can at any time be re-enabled and will then be able to login again, etc.

I think this is a good feature to have, since it allows you to temporarily disable users that might no longer be working at the nation. It is much easier than to create a new account.

Solution

• Add a new field to the user model, e.g. disabled
• Set the default value of the disabled field to false
• Allow updating of this value via some route
• Disallow all login attempts and authenticated requests where the user is disabled