authd/src/requests/delete.cr

class AuthD::Request
	IPC::JSON.message Delete, 17 do
		# Deletion can be triggered by either an admin or the related user.
		property user : UserID

		def initialize(@user)
		end

		def handle(authd : AuthD::Service, fd : Int32)
			logged_user = authd.get_logged_user? fd
			return Response::Error.new "you must be logged" if logged_user.nil?

			# Get the full AuthD::User instance, not just the public view.
			user_to_delete = authd.user? logged_user.uid
			return Response::Error.new "unknown user" if user_to_delete.nil?

			unless logged_user.admin
				# Is the logged user the target?
				return Response::Error.new "invalid credentials" if logged_user.uid != user_to_delete.uid
			end

			# User or admin is now verified: let's proceed with the user deletion.
			authd.users_per_login.delete user_to_delete.login

			# If the current user is deleted, unlog!
			if logged_user.uid == user_to_delete.uid
				authd.close fd
				authd.logged_users.delete fd
			end

			# TODO: better response
			Response::User.new user_to_delete.to_public
		end
	end
	AuthD.requests << Delete
end