deleting user accounts works

ordr2/resources/admin.py

@@ -11,6 +11,7 @@ class UserAccount(BaseResource):
         return [
             (Allow, 'role:admin', 'view'),
             (Allow, 'role:admin', 'edit'),
+            (Allow, 'role:admin', 'delete'),
             DENY_ALL
             ]
 
@@ -24,6 +25,8 @@ class UserList(BaseResource, PaginationResourceMixin):
     def __acl__(self):
         return [
             (Allow, 'role:admin', 'view'),
+            (Allow, 'role:admin', 'edit'),
+            (Allow, 'role:admin', 'delete'),
             DENY_ALL
             ]
 

ordr2/templates/admin/user_list.jinja2

@@ -58,7 +58,7 @@
                                 {% for user in users %}
                                     <tr>
                                         <td class="center">
-                                            <input type="checkbox" name="marked" value="{{ user.model.user_name }}">
+                                            <input type="checkbox" name="marked" value="{{ user.model.id }}">
                                         </td>
                                         <td class="column-user">
                                             <a href="{{ request.resource_url(request.root, 'orders', query={'user': user.model.user_name}) }}" title="click to view all orders from user">{{ user.model.user_name }}</a>

ordr2/templates/admin/users_delete.jinja2

@@ -0,0 +1,66 @@
+{% extends "ordr2:templates/layout.jinja2" %}
+{% import 'ordr2:templates/macros.jinja2' as macros with context %}
+
+{% block subtitle %} Account | Admin | Users | Confirm Delete {% endblock subtitle %}
+
+{% block content %}
+<div class="content controls">
+
+    <div class="container-fluid">
+        <div class="row-fluid">
+            <div class="page-controls">
+                <h1>Delete User{{ 's' if accounts|length > 1 }}</h1>
+            </div>
+        </div>
+
+		<div class="row">
+			<div class="span10">
+
+				<div class="action-header">
+					<h3>The following user{{ 's' if accounts|length > 1 }} will be deleted:</h3>
+				</div>
+
+				<form action="{{ request.resource_url(context, 'delete') }}" method="POST" class="action">
+                    <input type="hidden" name="csrf_token" value="{{get_csrf_token()}}">
+
+                    <table class="table">
+                        <thead>
+                            <th>Username</th>
+                            <th>First Name</th>
+                            <th>Last Name</th>
+                            <th>Email</th>
+                            <th>Role</th>
+                        </thead>
+
+                        <tbody>
+                            {% for account in accounts %}
+                                <tr>
+                                    <td class="column-user">
+                                        <input type="hidden" name="account" value="{{ account.id }}">
+                                        {{ account.user_name }}
+                                    </td>
+                                    <td>{{ account.first_name }} </td>
+                                    <td>{{ account.last_name }} </td>
+                                    <td>{{ account.email }} </td>
+                                    <td>{{ account.role.value.capitalize() }} </td>
+                                </tr>
+                            {% endfor %}
+                        </tbody>
+                    </table>
+
+					<fieldset class="form-actions">
+						<div class="right">
+				    		<button name="delete" type="submit" value="submit" class="btn btn-large btn-danger">Delete User{{ 's' if accounts|length > 1 }}</button>
+				    		<button name="cancel" type="submit" value="cancel" class="btn btn-large">Cancel</button>
+						</div>
+					</fieldset>
+
+				</form>
+
+			</div>
+		</div>
+
+    </div>
+
+</div>
+{% endblock content %}

ordr2/views/admin.py

@@ -60,6 +60,29 @@ def change_column_view(context, request):
     return HTTPFound(context.url())
 
 
+
+@view_config(
+    context='ordr2:resources.UserList',
+    name='actions',
+    request_param='action=delete',
+    permission='delete',
+    request_method='POST',
+    renderer='ordr2:templates/admin/users_delete.jinja2'
+    )
+def delete_multiple_accounts_form(context, request):
+    print(list(request.POST.items()))
+    account_ids = [v for k, v in request.POST.items() if k == 'marked']
+    accounts = request.dbsession.\
+                       query(User).\
+                       filter(User.id.in_(account_ids)).\
+                       order_by(User.user_name).\
+                       all()
+    if len(accounts) == 0:
+        return HTTPFound(context.url())
+    return {'accounts': accounts}
+
+
+
 @view_config(
     context='ordr2:resources.UserAccount',
     permission='edit',
@@ -133,3 +156,46 @@ def user_account_form_processing(context, request):
         return HTTPFound(context, 'delete')
 
     return HTTPFound(context.__parent__.url())
+
+
+@view_config(
+    context='ordr2:resources.UserAccount',
+    name='delete',
+    permission='delete',
+    request_method='GET',
+    renderer='ordr2:templates/admin/users_delete.jinja2'
+    )
+def user_delete_form(context, request):
+    return {'accounts': [context.model]}
+
+
+@view_config(
+    context='ordr2:resources.UserList',
+    name='delete',
+    permission='delete',
+    request_method='POST'
+    )
+@view_config(
+    context='ordr2:resources.UserAccount',
+    name='delete',
+    permission='delete',
+    request_method='POST'
+    )
+def user_delete_form_processing(context, request):
+    if 'delete' in request.POST:
+        account_ids = [v for k, v in request.POST.items() if k == 'account']
+        accounts = request.dbsession.\
+                        query(User).\
+                        filter(User.id.in_(account_ids)).\
+                        all()
+        for account in accounts:
+            request.dbsession.delete(account)
+
+        if len(accounts) == 1:
+            request.flash('success', 'One user account was deleted')
+        elif len(accounts) > 1:
+            msg = '{} user accounts were deleted.'.format(len(accounts))
+            request.flash('success', msg)
+
+    return HTTPFound(request.resource_url(request.root, 'admin', 'users'))
+