implement logic behind user flags

[simonLeary42]

Closes #392

Changes:

• reimplemented the "disband PI" feature, marking PI group as "defunct" and removing that mark if the PI later gets approved for another group
  • updated LDAP schema for PI groups to add the optional attribute isDefunct
  • updated logic to treat defunct PI groups as though they don't exist
• added logic to set the qualified user flag correctly in every place whenever a user is added or removed from a PI group
  • admin approve member request
  • PI approve member request
  • admin remove user from group
  • PI remove user from group
  • user remove themself from group
  • owner disband PI group (disqualify owner)
  • admin disband PI group (disqualify owner)
  • owner disband PI group (disqualify any member)
  • admin disband PI group (disqualify any member)
  • admin manually removes uid from memberuid attribute in PI group LDAP entry
• added logic to deny access to anyone with the locked flag
• added logic to remove the idlelocked flag whenever a user logs in and send them a message that they have unlocked
• added logic to support the re-registration of a user who previously became a ghost

TODO:

• documentation
• tests:
  • ghost account is not redirected from new_account.php to account.php
  • ghost account is resurrected when they register again, message is sent
  • defunct PI group does not make a user a PI
  • reinstating defunct PI group
  • idle unlock works, message is sent
  • qualify works
    • admin approve
    • PI approve
  • dequalify works
    • admin remove user
    • PI remove user
    • user leave group
  • viewAsUser does not reset idlelock
  • locked works
  • disband PI group
    • by admin
    • by owner
  • getIsDefunct, setIsDefunct
  • isDefunct unset is treated as false
  • isDefunct unset groups and isDefunct=FALSE groups are both shown in pi-mgmt.php
  • disband PI group become unqualified
    • by owner
    • by admin

Future Work:

• replace "request account deletion" with instant conversion to ghost

[simonLeary42]

TODO: UserFlag is defined in UnityLDAP.php, setFlag is defined in UnityUser.php, and the calls to setFlag are in init.php, UnityGroup.php, and new_account.php. Can this be more unified?

[Copilot]

Pull request overview

This pull request implements user flag logic and PI group lifecycle management for the Unity HPC account portal. It introduces functionality for handling ghost accounts (soft-deleted users), locked/idle-locked accounts, and the ability to disband PI groups while preserving data ownership.

Key changes:

• Adds LDAP schema for tracking defunct PI groups with the isDefunct attribute
• Implements ghost account resurrection flow when deleted users re-register
• Adds disband functionality for PI groups (accessible by both PI owners and admins)
• Implements automatic idle-unlock and locked account checks on login
• Adds comprehensive test coverage for all new user flag scenarios

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
webroot/panel/pi.php	Adds disband button and handler for PI owners to disband their own groups
webroot/panel/new_account.php	Implements ghost account detection and resurrection with welcome message
webroot/admin/pi-mgmt.php	Adds admin interface for disbanding PI groups, filters defunct groups from listings
tools/docker-dev/identity/unity-cluster-schema.ldif	Defines new LDAP schema with isDefunct attribute and unityClusterPIGroup object class
tools/docker-dev/identity/bootstrap.ldif	Updates test data with ghost users, locked users, and defunct PI groups for testing
tools/docker-dev/identity/Dockerfile	Adds LDAP schema installation step to Docker build
resources/lib/UnityUser.php	Modifies init() to skip LDAP creation for ghosts, updates isPI() to check defunct status, makes setFlag() return boolean
resources/lib/UnityGroup.php	Adds disband() and reinstate() methods, implements getIsDefunct()/setIsDefunct(), updates qualification logic
resources/lib/UnityLDAP.php	Adds getAllNonDefunctPIGroupOwnerUIDs() to filter out defunct groups from admin interfaces
resources/lib/UnityOrg.php	Fixes objectclass format to use array instead of constant
resources/init.php	Adds locked account check and automatic idle-unlock on login
resources/mail/group_reinstate.php	New email template sent when defunct PI group is reinstated
test/*	Comprehensive test coverage for ghost resurrection, defunct groups, user removal, idle unlock, and disband functionality
README.md	Documents LDAP schema upgrade requirement for version 1.7
LDAP.md	Updates terminology to define ghost users and defunct groups
phpstan.neon	Excludes test template file from analysis

Comments suppressed due to low confidence (1)

resources/lib/UnityGroup.php:55

• When a defunct group exists and a user requests to become PI again, the logic allows creating a new request (line 43 returns early only if exists AND not defunct). However, there's no check to prevent duplicate requests for reinstating a defunct group. This could allow multiple pending requests for the same defunct group to be created in the SQL database.

        if ($this->exists() && !$this->getIsDefunct()) {
            return;
        }
        if ($this->SQL->accDeletionRequestExists($this->getOwner()->uid)) {
            return;
        }
        $context = [
            "user" => $this->getOwner()->uid,
            "org" => $this->getOwner()->getOrg(),
            "name" => $this->getOwner()->getFullName(),
            "email" => $this->getOwner()->getMail(),
        ];
        $this->SQL->addRequest($this->getOwner()->uid, UnitySQL::REQUEST_BECOME_PI);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[simonLeary42]

these changes have been fragmented into #519 #520 #521