remove cert fingerprints for disabled users, so that they cannot send email anymore. closes #7690

1 files changed, 11 insertions, 0 deletions

diff --git a/app/models/account.rb b/app/models/account.rb
index a5cd833..46e5446 100644
--- a/app/models/account.rb
+++ b/app/models/account.rb
@@ -69,6 +69,17 @@ class Account
     @user.destroy
   end
 
+  # when a user is disable, all their data and associations remain
+  # in place, but the user should not be able to send email or
+  # create new authentication certificates.
+  def disable
+    if @user && !@user.tmp?
+      @user.enabled = false
+      @user.save
+      Identity.remove_cert_fingerprints_for(@user)
+    end
+  end
+
   protected
 
   def update_login(login)