From 15344b6a8e8245880a20b818fe5e08c43ed17364 Mon Sep 17 00:00:00 2001
From: Mouse Reeve <mousereeve@riseup.net>
Date: Wed, 8 Sep 2021 17:21:45 -0700
Subject: [PATCH] Let moderators delete users

---
 .../user_admin/user_moderation_actions.html   | 22 +++++++++++++------
 bookwyrm/urls.py                              |  5 +++++
 bookwyrm/views/__init__.py                    |  1 +
 bookwyrm/views/reports.py                     |  6 +++++
 4 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/bookwyrm/templates/user_admin/user_moderation_actions.html b/bookwyrm/templates/user_admin/user_moderation_actions.html
index 3a82d92c..12b70d3c 100644
--- a/bookwyrm/templates/user_admin/user_moderation_actions.html
+++ b/bookwyrm/templates/user_admin/user_moderation_actions.html
@@ -1,6 +1,6 @@
 {% load i18n %}
 <div class="block content">
-    {% if not user.is_active and user.deactivation_reason == "self_deletion" %}
+    {% if not user.is_active and user.deactivation_reason == "self_deletion" or user.deactivation_reason == "moderator_deletion" %}
     <div class="notification is-danger">
         {% trans "Permanently deleted" %}
     </div>
@@ -15,23 +15,31 @@
         {% endif %}
 
         {% if user.is_active or user.deactivation_reason == "pending" %}
-
-        <form name="suspend" method="post" action="{% url 'settings-report-suspend' user.id  %}">
+        <form name="suspend" method="post" action="{% url 'settings-report-suspend' user.id  %}" class="mr-1">
             {% csrf_token %}
             <button type="submit" class="button is-danger is-light">{% trans "Suspend user" %}</button>
         </form>
-
         {% else %}
-
-        <form name="unsuspend" method="post" action="{% url 'settings-report-unsuspend' user.id  %}">
+        <form name="unsuspend" method="post" action="{% url 'settings-report-unsuspend' user.id  %}" class="mr-1">
             {% csrf_token %}
             <button class="button">{% trans "Un-suspend user" %}</button>
         </form>
-
         {% endif %}
 
+        {% if user.local %}
+        <div>
+            {% trans "Permanently delete user" as button_text %}
+            {% include "snippets/toggle/open_button.html" with controls_text="delete_user" text=button_text class="is-danger is-light" %}
+        </div>
+        {% endif %}
     </div>
 
+    {% if user.local %}
+    <div>
+        {% include "user_admin/delete_user_form.html" with controls_text="delete_user" class="mt-2 mb-2" %}
+    </div>
+    {% endif %}
+
     {% if user.local %}
     <div>
         <form name="permission" method="post" action="{% url 'settings-user' user.id %}">
diff --git a/bookwyrm/urls.py b/bookwyrm/urls.py
index b2b7723b..460f5df9 100644
--- a/bookwyrm/urls.py
+++ b/bookwyrm/urls.py
@@ -158,6 +158,11 @@ urlpatterns = [
         views.unsuspend_user,
         name="settings-report-unsuspend",
     ),
+    re_path(
+        r"^settings/reports/(?P<user_id>\d+)/delete/?$",
+        views.moderator_delete_user,
+        name="settings-delete-user",
+    ),
     re_path(
         r"^settings/reports/(?P<report_id>\d+)/resolve/?$",
         views.resolve_report,
diff --git a/bookwyrm/views/__init__.py b/bookwyrm/views/__init__.py
index 6d283b94..6c88bd9e 100644
--- a/bookwyrm/views/__init__.py
+++ b/bookwyrm/views/__init__.py
@@ -40,6 +40,7 @@ from .reports import (
     resolve_report,
     suspend_user,
     unsuspend_user,
+    moderator_delete_user,
 )
 from .rss_feed import RssFeed
 from .password import PasswordResetRequest, PasswordReset, ChangePassword
diff --git a/bookwyrm/views/reports.py b/bookwyrm/views/reports.py
index 8246ae15..72b7f4db 100644
--- a/bookwyrm/views/reports.py
+++ b/bookwyrm/views/reports.py
@@ -1,5 +1,6 @@
 """ moderation via flagged posts and users """
 from django.contrib.auth.decorators import login_required, permission_required
+from django.core.exceptions import PermissionDenied
 from django.shortcuts import get_object_or_404, redirect
 from django.template.response import TemplateResponse
 from django.utils.decorators import method_decorator
@@ -101,6 +102,11 @@ def unsuspend_user(_, user_id):
 def moderator_delete_user(request, user_id):
     """permanently delete a user"""
     user = get_object_or_404(models.User, id=user_id)
+
+    # we can't delete users on other instances
+    if not user.local:
+        raise PermissionDenied
+
     form = forms.DeleteUserForm(request.POST, instance=user)
 
     moderator = models.User.objects.get(id=request.user.id)