resolve/refinerycms — Issue #1221: No logout UI for user with all roles Un-checked
Author: leadbaxter
Created: 2012-01-13 22:20:29+00:00
State: open

Steps to reproduce:
1. Login using my superuser account.
2. Edit another user's account (a test user I've set up for this purpose)
3. UNCHECK all user roles (Refinery/Superuser) for the user.
4. Logout
5. Login as the test user referenced in step #3.
6. You are now logged in, but there isn't a "user bar" at the top and thus, no way to log out.

Ok, I can logout by browsing to the URL: /users/logout

So what I mean is, there is no UI for logout at this point.

My Two Cents:

I've titled this bug "No logout UI for user with all roles un-checked" however there are two possible ways to address the problem, in my opinion.

Solution 1: Do not allow to un-check ALL roles... i.e. users must have at least 1 role
Solution 2: Do not allow a user with no roles to login. (Thus, there would be no need for a UI to logout for this user.)

The second solution seems to make the most sense. While it could be argued that a user MUST have at least 1 role (as solution #1 would prefer) the second option would allow an administrator to "disable" an account without deleting the user.

The second option also makes sense from the standpoint that logically speaking, logging in encompasses both authenticating the user, and authorizing them to perform certain actions, based on their role(s). If they have no roles, then they have to authorization to carry out any actions, so by default cannot login.