Katello/katello — pull request #1358 by lzap (2013-01-05 11:26:05+00:00)
Title: User org deletion 882311

I prepared patch that removes default-scoped hiding of the organization beeing deleted and introduce new /nondefault/ scope without_deleting which is used in particular places:

UI:
- list of organizations in the organization edit pane
- list of organizations in the org selector
- user edit page (default organization)

CLI/API:
- list of orgs (api/organization_controller)
- any action that accepts --org (api_controller#find_organization)

Once organization is deleted, all users who are working under this organization are automatically logged off (our permission layer redirect to the login page). They are no longer able to log in, even if the organization is still in the deletion process (but they can pick another organization from the list).

Although they is still (small) possibility logged user could submit a form using that organization. It would likely fail, but the plan is immediately log off all users with default or selected organization which is being deleted. We can't do this in this errata because this will need the change of how we store sessions in Katello.

Currently we are using cookie store which does not allow explicit deletion, I made two tasks for the next sprint to change this and add explicit sign-off for these users before org deletion is started (currently there is a TODO comment in the controller). This should prevent all possible errors.