feat: added requested changes from review

Author: raphael-goetz

app/models/user.rb

@@ -3,11 +3,15 @@
 class User < ApplicationRecord
   include NamespaceParent
 
-  GHOST_USERNAME = 'ghost'
-  GHOST_EMAIL = 'ghost@code0.tech'
+  USER_TYPES = {
+    regular: 0,
+    ghost: 1,
+  }.freeze
 
   has_secure_password
 
+  enum :user_type, USER_TYPES
+
   validates :username, length: { maximum: 50 },
                        presence: true,
                        allow_blank: false,
@@ -34,15 +38,8 @@ class User < ApplicationRecord
 
   has_one_attached :avatar
 
-  before_destroy :prevent_destroy_ghost_user, prepend: true
-  before_destroy :reassign_authored_audit_events_to_ghost_user
-
   def self.ghost
-    find_by!(username: GHOST_USERNAME)
-  end
-
-  def ghost?
-    username == GHOST_USERNAME
+    find_by!(user_type: :ghost)
   end
 
   def mfa_enabled?
@@ -82,23 +79,6 @@ def validate_mfa!(mfa)
   generates_token_for :password_reset, expires_in: 15.minutes do
     password_digest&.last(20)
   end
-
-  private
-
-  def prevent_destroy_ghost_user
-    return unless ghost?
-
-    errors.add(:base, :invalid, message: 'Cannot delete ghost user')
-    throw :abort
-  end
-
-  def reassign_authored_audit_events_to_ghost_user
-    ghost_user = self.class.ghost
-
-    authored_audit_events.find_each do |audit_event|
-      audit_event.update!(author: ghost_user)
-    end
-  end
 end
 
 User.prepend_extensions

app/policies/user_policy.rb

@@ -3,6 +3,7 @@
 class UserPolicy < BasePolicy
   condition(:user_is_self) { subject.id == user&.id }
   condition(:user_is_admin) { user&.admin? || false }
+  condition(:user_is_regular) { subject.regular? }
   condition(:admin_status_visible) { ApplicationSetting.current[:admin_status_visible] }
 
   rule { ~anonymous }.enable :read_user
@@ -12,11 +13,12 @@ class UserPolicy < BasePolicy
     enable :read_user_identity
     enable :update_attachment_avatar
     enable :read_email
-    enable :delete_user
     enable :read_admin_status
     enable :read_mfa_status
   end
 
+  rule { user_is_admin & user_is_regular }.enable :delete_user
+
   rule { admin_status_visible & ~anonymous }.enable :read_admin_status
 
   rule { user_is_self }.policy do

app/services/users/delete_service.rb

@@ -18,8 +18,10 @@ def execute
 
       transactional do |t|
         namespace = user.namespace
-        audit_author_id = user == current_authentication.user ? User.ghost.id : current_authentication.user.id
+        ghost_user = User.ghost
+        audit_author_id = user == current_authentication.user ? ghost_user.id : current_authentication.user.id
 
+        user.authored_audit_events.update_all(author_id: ghost_user.id) # rubocop:disable Rails/SkipsModelValidations
         user.destroy
 
         if user.persisted?

db/fixtures/01_application_settings.rb

@@ -1,12 +1,5 @@
 # frozen_string_literal: true
 
-User.seed_once :username do |u|
-  u.username = User::GHOST_USERNAME
-  u.email = User::GHOST_EMAIL
-  u.password = SecureRandom.hex
-  u.admin = false
-end
-
 ApplicationSetting.seed_once :setting do |s|
   s.setting = :user_registration_enabled
   s.value = false

db/fixtures/02_users.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+User.seed_once :user_type do |u|
+  u.username = 'ghost'
+  u.email = 'ghost@code0.tech'
+  u.password = SecureRandom.hex
+  u.admin = false
+  u.user_type = :ghost
+end

db/fixtures/production/01_users.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-return unless User.where.not(username: User::GHOST_USERNAME).none?
+return unless User.regular.none?
 
 initial_root_email = ENV.fetch('INITIAL_ROOT_MAIL', nil)
 initial_root_password = ENV.fetch('INITIAL_ROOT_PASSWORD', SecureRandom.hex)

db/migrate/20260629120000_add_user_type_to_users.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddUserTypeToUsers < Code0::ZeroTrack::Database::Migration[1.0]
+  def change
+    add_column :users, :user_type, :integer, default: 0, null: false
+  end
+end

db/schema_migrations/20260629120000

@@ -0,0 +1 @@
+68074a1fb7f8bdf3087c3b6823eaef35175c480f05d4bc73c190ef7b2811cf68

db/structure.sql

@@ -1165,6 +1165,7 @@ CREATE TABLE users (
     email_verified_at timestamp with time zone,
     readme text,
     blocked_at timestamp with time zone,
+    user_type integer DEFAULT 0 NOT NULL,
     CONSTRAINT check_11461c37fb CHECK ((char_length(readme) <= 5000)),
     CONSTRAINT check_3bedaaa612 CHECK ((char_length(email) <= 255)),
     CONSTRAINT check_56606ce552 CHECK ((char_length(username) <= 50)),

spec/factories/users.rb

@@ -22,6 +22,10 @@
       blocked_at { Time.zone.now }
     end
 
+    trait :ghost do
+      user_type { :ghost }
+    end
+
     trait :with_namespace do
       after :build, &:ensure_namespace
     end