phatworx/devise_security_extension — Issue #20: Deactivate account after x days inactivity
Author: alexdreher
Created: 2011-12-09 10:32:50+00:00
State: open
Labels: feature request

Lock the account after a configurable amount of time.

Default deactivate_after time: 90.days

## Option 1 (soft)
We can do it via devise's `lockable` module (and the corresponding fields).

Check status on login (to be performant) with the help of `last_sign_in_at` or `created_at` if blank (devise module `trackable` required).

*To be checked:* is `last_sign_in_at` updated when "remember me" function is enabled an a user is logged in remembered?

## Option 2
Create an expirable module with something like `last_action_at` an `expired_at` fields. Accounts are checked for activitiy with a cron job and locked if not used anymore. Step 2 could be a cron, which deletes (or "blanks out") the user after an amount of time the user is set to expired state.

**Option 2 should be the "thing"**