<.button navigate={return_path(@return_to, @user)} variant="neutral">
{gettext("Cancel")}
@@ -404,6 +437,44 @@ defmodule MvWeb.UserLive.Form do
end
end
+ @impl true
+ def handle_event("delete", %{"id" => id}, socket) do
+ user = socket.assigns.user
+ actor = current_actor(socket)
+
+ if is_nil(user) do
+ {:noreply, put_flash(socket, :error, gettext("User not found"))}
+ else
+ if to_string(id) != to_string(user.id) do
+ {:noreply, put_flash(socket, :error, gettext("User not found"))}
+ else
+ if Mv.Helpers.SystemActor.system_user?(user) do
+ {:noreply,
+ put_flash(socket, :error, gettext("System user cannot be deleted."))}
+ else
+ case Ash.destroy(user, domain: Mv.Accounts, actor: actor) do
+ :ok ->
+ {:noreply,
+ socket
+ |> put_flash(:success, gettext("User deleted successfully"))
+ |> push_navigate(to: ~p"/users")}
+
+ {:error, %Ash.Error.Forbidden{}} ->
+ {:noreply,
+ put_flash(
+ socket,
+ :error,
+ gettext("You do not have permission to delete this user")
+ )}
+
+ {:error, error} ->
+ {:noreply, put_flash(socket, :error, format_ash_error(error))}
+ end
+ end
+ end
+ end
+ end
+
@impl true
def handle_event("show_member_dropdown", _params, socket) do
{:noreply, assign(socket, show_member_dropdown: true)}
diff --git a/lib/mv_web/live/user_live/index.ex b/lib/mv_web/live/user_live/index.ex
index ba36605..d72c1fd 100644
--- a/lib/mv_web/live/user_live/index.ex
+++ b/lib/mv_web/live/user_live/index.ex
@@ -5,15 +5,14 @@ defmodule MvWeb.UserLive.Index do
## Features
- List all users with email and linked member
- Sort users by email (default)
- - Delete users
- - Navigate to user details and edit forms
+ - Navigate to user details (row click) and edit from details header
+ - Delete only via Danger zone on user show/edit
- Bulk selection for future batch operations
## Relationships
Displays linked member information when a user is connected to a member account.
## Events
- - `delete` - Remove a user from the database
- `select_user` - Toggle individual user selection
- `select_all` - Toggle selection of all visible users
@@ -26,7 +25,6 @@ defmodule MvWeb.UserLive.Index do
import MvWeb.LiveHelpers, only: [current_actor: 1]
require Ash.Query
- import MvWeb.ErrorHelpers, only: [format_ash_error: 1]
@impl true
def mount(_params, _session, socket) do
@@ -48,45 +46,6 @@ defmodule MvWeb.UserLive.Index do
|> assign(:selected_users, [])}
end
- @impl true
- def handle_event("delete", %{"id" => id}, socket) do
- actor = current_actor(socket)
-
- case Ash.get(Mv.Accounts.User, id, domain: Mv.Accounts, actor: actor) do
- {:ok, user} ->
- case Ash.destroy(user, domain: Mv.Accounts, actor: actor) do
- :ok ->
- updated_users = Enum.reject(socket.assigns.users, &(&1.id == id))
-
- {:noreply,
- socket
- |> assign(:users, updated_users)
- |> put_flash(:success, gettext("User deleted successfully"))}
-
- {:error, %Ash.Error.Forbidden{}} ->
- {:noreply,
- put_flash(
- socket,
- :error,
- gettext("You do not have permission to delete this user")
- )}
-
- {:error, error} ->
- {:noreply, put_flash(socket, :error, format_ash_error(error))}
- end
-
- {:error, %Ash.Error.Query.NotFound{}} ->
- {:noreply, put_flash(socket, :error, gettext("User not found"))}
-
- {:error, %Ash.Error.Forbidden{} = _error} ->
- {:noreply,
- put_flash(socket, :error, gettext("You do not have permission to access this user"))}
-
- {:error, error} ->
- {:noreply, put_flash(socket, :error, format_ash_error(error))}
- end
- end
-
# Selects one user in the list of users
@impl true
def handle_event("select_user", %{"id" => id}, socket) do
diff --git a/lib/mv_web/live/user_live/index.html.heex b/lib/mv_web/live/user_live/index.html.heex
index 858e784..7ffa0e3 100644
--- a/lib/mv_web/live/user_live/index.html.heex
+++ b/lib/mv_web/live/user_live/index.html.heex
@@ -84,29 +84,5 @@
—
<% end %>
-
- <:action :let={user}>
-
- <.link navigate={~p"/users/#{user}"}>{gettext("Show")}
-
-
- <%= if can?(@current_user, :update, user) do %>
- <.link navigate={~p"/users/#{user}/edit"} data-testid="user-edit">
- {gettext("Edit user")}
-
- <% end %>
-
-
- <:action :let={user}>
- <%= if can?(@current_user, :destroy, user) do %>
- <.link
- phx-click={JS.push("delete", value: %{id: user.id}) |> hide("#row-#{user.id}")}
- data-confirm={gettext("Are you sure?")}
- data-testid="user-delete"
- >
- {gettext("Delete")}
-
- <% end %>
-
diff --git a/lib/mv_web/live/user_live/show.ex b/lib/mv_web/live/user_live/show.ex
index 3530b36..a77a1c4 100644
--- a/lib/mv_web/live/user_live/show.ex
+++ b/lib/mv_web/live/user_live/show.ex
@@ -27,6 +27,7 @@ defmodule MvWeb.UserLive.Show do
use MvWeb, :live_view
import MvWeb.LiveHelpers, only: [current_actor: 1]
+ import MvWeb.ErrorHelpers, only: [format_ash_error: 1]
@impl true
def render(assigns) do
@@ -80,6 +81,37 @@ defmodule MvWeb.UserLive.Show do
<% end %>
+
+ <%!-- Danger zone: canonical pattern (same as member show) --%>
+ <%= if can?(@current_user, :destroy, @user) and not Mv.Helpers.SystemActor.system_user?(@user) do %>
+
+
+ {gettext("Danger zone")}
+
+
+
+ {gettext(
+ "Deleting this user cannot be undone. The user account and any linked member association will be affected."
+ )}
+
+ <.button
+ variant="danger"
+ phx-click="delete"
+ phx-value-id={@user.id}
+ data-confirm={
+ gettext("Are you sure you want to delete the user %{email}? This action cannot be undone.",
+ email: @user.email
+ )
+ }
+ data-testid="user-delete"
+ aria-label={gettext("Delete user %{email}", email: @user.email)}
+ >
+ <.icon name="hero-trash" class="size-4" />
+ {gettext("Delete user")}
+
+
+ <% end %>
"""
end
@@ -103,4 +135,39 @@ defmodule MvWeb.UserLive.Show do
|> assign(:user, user)}
end
end
+
+ @impl true
+ def handle_event("delete", %{"id" => id}, socket) do
+ user = socket.assigns.user
+ actor = current_actor(socket)
+
+ if to_string(id) != to_string(user.id) do
+ {:noreply, put_flash(socket, :error, gettext("User not found"))}
+ else
+ if Mv.Helpers.SystemActor.system_user?(user) do
+ {:noreply,
+ put_flash(socket, :error, gettext("System user cannot be deleted."))}
+ else
+ case Ash.destroy(user, domain: Mv.Accounts, actor: actor) do
+ :ok ->
+ {:noreply,
+ socket
+ |> put_flash(:success, gettext("User deleted successfully"))
+ |> push_navigate(to: ~p"/users")}
+
+ {:error, %Ash.Error.Forbidden{}} ->
+ {:noreply,
+ put_flash(
+ socket,
+ :error,
+ gettext("You do not have permission to delete this user")
+ )}
+
+ {:error, error} ->
+ {:noreply,
+ put_flash(socket, :error, format_ash_error(error))}
+ end
+ end
+ end
+ end
end
diff --git a/test/mv_web/member_live/form_error_handling_test.exs b/test/mv_web/member_live/form_error_handling_test.exs
index fec7df4..0ec142e 100644
--- a/test/mv_web/member_live/form_error_handling_test.exs
+++ b/test/mv_web/member_live/form_error_handling_test.exs
@@ -9,6 +9,53 @@ defmodule MvWeb.MemberLive.FormErrorHandlingTest do
require Ash.Query
+ describe "danger zone on edit" do
+ @tag :ui
+ test "edit form shows Danger zone and delete button when user can destroy member", %{
+ conn: conn
+ } do
+ system_actor = Mv.Helpers.SystemActor.get_system_actor()
+
+ {:ok, member} =
+ Mv.Membership.create_member(
+ %{first_name: "Delete", last_name: "FromEdit", email: "delete.from.edit@example.com"},
+ actor: system_actor
+ )
+
+ conn = conn_with_oidc_user(conn)
+ {:ok, view, html} = live(conn, ~p"/members/#{member}/edit")
+
+ assert html =~ gettext("Danger zone")
+ assert has_element?(view, "[data-testid='member-delete']")
+ end
+
+ test "delete event from edit form removes member and redirects to /members", %{conn: conn} do
+ system_actor = Mv.Helpers.SystemActor.get_system_actor()
+
+ {:ok, member} =
+ Mv.Membership.create_member(
+ %{
+ first_name: "ToDelete",
+ last_name: "FromForm",
+ email: "todelete.from.form.#{System.unique_integer([:positive])}@example.com"
+ },
+ actor: system_actor
+ )
+
+ conn = conn_with_oidc_user(conn)
+ {:ok, view, _html} = live(conn, ~p"/members/#{member}/edit")
+
+ view
+ |> render_click("delete", %{"id" => member.id})
+
+ assert_redirect(view, ~p"/members")
+
+ refute Mv.Membership.Member
+ |> Ash.Query.filter(id == ^member.id)
+ |> Ash.exists?()
+ end
+ end
+
describe "tab visibility" do
@tag :ui
test "Payments tab is not visible on new member form", %{conn: conn} do
diff --git a/test/mv_web/member_live/show_test.exs b/test/mv_web/member_live/show_test.exs
index 8c7a23a..54829de 100644
--- a/test/mv_web/member_live/show_test.exs
+++ b/test/mv_web/member_live/show_test.exs
@@ -135,14 +135,16 @@ defmodule MvWeb.MemberLive.ShowTest do
end
describe "delete action" do
- test "renders Delete button when user can destroy member", %{
+ test "renders Danger zone section and Delete button when user can destroy member", %{
conn: conn,
member: member
} do
conn = conn_with_oidc_user(conn)
- {:ok, view, _html} = live(conn, ~p"/members/#{member}")
+ {:ok, view, html} = live(conn, ~p"/members/#{member}")
assert has_element?(view, "[data-testid='member-delete']")
+ assert html =~ gettext("Danger zone")
+ assert has_element?(view, "section[aria-labelledby='danger-zone-heading']")
end
test "delete event removes member and redirects to index", %{