feat(users): add ability to disable users without deleting them

- Add disabled boolean field to user schema (PostgreSQL, MySQL, SQLite)
- Block disabled users from logging in via any auth provider (credentials, LDAP, OIDC)
- Check disabled status in session callback to prevent session replay
- Add changeDisabled API endpoint (admin-only)
- Include disabled field in getById and getAll user endpoints
- Add disable/enable user toggle in admin UI with status badge in user list

apps/nextjs/src/app/[locale]/manage/users/[userId]/general/_components/_disable-user-button.tsx

@@ -0,0 +1,62 @@
+"use client";
+
+import { useTransition } from "react";
+import { Button, Tooltip } from "@mantine/core";
+
+import type { RouterOutputs } from "@homarr/api";
+import { clientApi } from "@homarr/api/client";
+import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
+import { useI18n } from "@homarr/translation/client";
+
+interface DisableUserButtonProps {
+  user: RouterOutputs["user"]["getById"];
+}
+
+export const DisableUserButton = ({ user }: DisableUserButtonProps) => {
+  const t = useI18n();
+  const [isPending, startTransition] = useTransition();
+  const changeDisabledMutation = clientApi.user.changeDisabled.useMutation();
+
+  const handleToggle = () => {
+    startTransition(async () => {
+      try {
+        await changeDisabledMutation.mutateAsync({
+          userId: user.id,
+          disabled: !user.disabled,
+        });
+        showSuccessNotification({
+          title: user.disabled
+            ? t("user.action.enable.success", { defaultValue: "User enabled" })
+            : t("user.action.disable.success", { defaultValue: "User disabled" }),
+          message: user.disabled
+            ? t("user.action.enable.successDescription", { defaultValue: "User has been enabled" })
+            : t("user.action.disable.successDescription", { defaultValue: "User has been disabled" }),
+        });
+      } catch {
+        showErrorNotification({
+          title: t("common.notification.update.error"),
+          message: t("common.notification.update.error"),
+        });
+      }
+    });
+  };
+
+  const tooltipLabel = user.disabled
+    ? t("user.action.enable.description", { defaultValue: "Enable this user" })
+    : t("user.action.disable.description", { defaultValue: "Disable this user" });
+
+  return (
+    <Tooltip label={tooltipLabel} position="top">
+      <Button
+        onClick={handleToggle}
+        loading={isPending || changeDisabledMutation.isPending}
+        color={user.disabled ? "green" : "yellow"}
+        variant="light"
+      >
+        {user.disabled
+          ? t("user.action.enable.label", { defaultValue: "Enable user" })
+          : t("user.action.disable.label", { defaultValue: "Disable user" })}
+      </Button>
+    </Tooltip>
+  );
+};

apps/nextjs/src/app/[locale]/manage/users/[userId]/general/page.tsx

@@ -11,6 +11,7 @@ import { catchTrpcNotFound } from "~/errors/trpc-catch-error";
 import { createMetaTitle } from "~/metadata";
 import { canAccessUserEditPage } from "../access";
 import { DeleteUserButton } from "./_components/_delete-user-button";
+import { DisableUserButton } from "./_components/_disable-user-button";
 import { UserGeneralSettingsForm } from "./_components/_general-settings-form";
 import { UserProfileAvatarForm } from "./_components/_profile-avatar-form";
 import { ResetTours } from "./_components/_reset-tours";
@@ -96,6 +97,15 @@ export default async function EditUserPage(props: Props) {
       )}
 
       <DangerZoneRoot>
+        <DangerZoneItem
+          label={user.disabled ? t("user.action.enable.label") : t("user.action.disable.label")}
+          description={
+            user.disabled
+              ? t("management.page.user.action.enable.description", { defaultValue: "Re-enable access for this user" })
+              : t("management.page.user.action.disable.description", { defaultValue: "Prevent this user from logging in" })
+          }
+          action={<DisableUserButton user={user} />}
+        />
         <DangerZoneItem
           label={t("user.action.delete.label")}
           description={t("user.action.delete.description")}

apps/nextjs/src/app/[locale]/manage/users/_components/user-list.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useMemo } from "react";
-import { Anchor, Group, Text, Tooltip } from "@mantine/core";
+import { Anchor, Badge, Group, Text, Tooltip } from "@mantine/core";
 import { IconCheck } from "@tabler/icons-react";
 import type { MRT_ColumnDef } from "mantine-react-table";
 import { MantineReactTable } from "mantine-react-table";
@@ -52,6 +52,15 @@ export const UserListComponent = ({ initialUserList }: UserListComponentProps) =
           </Group>
         ),
       },
+      {
+        accessorKey: "disabled",
+        header: t("user.field.status.label", { defaultValue: "Status" }),
+        size: 100,
+        Cell: ({ row }) =>
+          row.original.disabled ? (
+            <Badge color="red">{t("user.field.status.disabled", { defaultValue: "Disabled" })}</Badge>
+          ) : null,
+      },
     ],
     [t],
   );

packages/api/src/router/user.ts

@@ -232,6 +232,7 @@ export const userRouter = createTRPCRouter({
           email: true,
           emailVerified: true,
           image: true,
+          disabled: true,
         }),
       ),
     )
@@ -252,6 +253,7 @@ export const userRouter = createTRPCRouter({
           email: true,
           emailVerified: true,
           image: true,
+          disabled: true,
         },
       });
     }),
@@ -341,6 +343,7 @@ export const userRouter = createTRPCRouter({
         emailVerified: true,
         image: true,
         provider: true,
+        disabled: true,
         homeBoardId: true,
         mobileHomeBoardId: true,
         firstDayOfWeek: true,
@@ -377,6 +380,7 @@ export const userRouter = createTRPCRouter({
           emailVerified: true,
           image: true,
           provider: true,
+          disabled: true,
           homeBoardId: true,
           mobileHomeBoardId: true,
           firstDayOfWeek: true,
@@ -777,6 +781,23 @@ export const userRouter = createTRPCRouter({
       completedBoardTour: user?.completedBoardTour ?? false,
     };
   }),
+  changeDisabled: permissionRequiredProcedure
+    .requiresPermission("admin")
+    .input(
+      z.object({
+        userId: z.string(),
+        disabled: z.boolean(),
+      }),
+    )
+    .output(z.void())
+    .mutation(async ({ input, ctx }) => {
+      await ctx.db
+        .update(users)
+        .set({
+          disabled: input.disabled,
+        })
+        .where(eq(users.id, input.userId));
+    }),
 });
 
 const createUserAsync = async (db: Database, input: Omit<z.infer<typeof userBaseCreateSchema>, "groupIds">) => {

packages/auth/callbacks.ts

@@ -47,9 +47,14 @@ export const createSessionCallback = (db: Database): NextAuthCallbackOf<"session
       where: eq(users.id, user.id),
       columns: {
         colorScheme: true,
+        disabled: true,
       },
     });
 
+    if (additionalProperties?.disabled) {
+      return null;
+    }
+
     return {
       ...session,
       user: {

packages/auth/providers/credentials/authorization/basic-authorization.ts

@@ -23,6 +23,11 @@ export const authorizeWithBasicCredentialsAsync = async (
     return null;
   }
 
+  if (user.disabled) {
+    logger.warn("User is disabled", { userName: user.name });
+    return null;
+  }
+
   logger.info("User is trying to log in. Checking password...", { userName: user.name });
   const isValidPassword = await comparePasswordsAsync(credentials.password, user.password);
 

packages/auth/providers/credentials/authorization/ldap-authorization.ts

@@ -107,6 +107,7 @@ export const authorizeWithLdapCredentialsAsync = async (
       email: true,
       emailVerified: true,
       provider: true,
+      disabled: true,
     },
     where: and(eq(users.email, mailResult.data), eq(users.provider, "ldap")),
   });
@@ -130,6 +131,11 @@ export const authorizeWithLdapCredentialsAsync = async (
     logger.info("User created successfully", { userName: credentials.name });
   }
 
+  if (user.disabled) {
+    logger.warn("User is disabled", { userName: credentials.name });
+    throw new CredentialsSignin("User is disabled");
+  }
+
   return {
     id: user.id,
     name: credentials.name,

packages/db/migrations/mysql/0009_add_user_disabled.sql

@@ -0,0 +1 @@
+ALTER TABLE `user` ADD `disabled` boolean DEFAULT false NOT NULL;

packages/db/migrations/postgresql/0009_add_user_disabled.sql

@@ -0,0 +1 @@
+ALTER TABLE "user" ADD COLUMN "disabled" boolean DEFAULT false NOT NULL;

packages/db/migrations/sqlite/0009_add_user_disabled.sql

@@ -0,0 +1 @@
+ALTER TABLE "user" ADD COLUMN "disabled" integer DEFAULT 0 NOT NULL;

packages/db/schema/mysql.ts

@@ -72,6 +72,7 @@ export const users = mysqlTable("user", {
   image: text(),
   password: text(),
   provider: varchar({ length: 64 }).$type<SupportedAuthProvider>().default("credentials").notNull(),
+  disabled: boolean().default(false).notNull(),
   homeBoardId: varchar({ length: 64 }).references((): AnyMySqlColumn => boards.id, {
     onDelete: "set null",
   }),

packages/db/schema/postgresql.ts

@@ -71,6 +71,7 @@ export const users = pgTable("user", {
   image: text(),
   password: text(),
   provider: varchar({ length: 64 }).$type<SupportedAuthProvider>().default("credentials").notNull(),
+  disabled: boolean().default(false).notNull(),
   homeBoardId: varchar({ length: 64 }).references((): AnyPgColumn => boards.id, {
     onDelete: "set null",
   }),

packages/db/schema/sqlite.ts

@@ -54,6 +54,7 @@ export const users = sqliteTable("user", {
   image: text(),
   password: text(),
   provider: text().$type<SupportedAuthProvider>().default("credentials").notNull(),
+  disabled: int({ mode: "boolean" }).default(false).notNull(),
   homeBoardId: text().references((): AnySQLiteColumn => boards.id, {
     onDelete: "set null",
   }),