create-nevela 0.6.0 → 0.7.1

package/template/laravel/src/Http/Access/RolesController.php

@@ -9,6 +9,7 @@ use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Validation\Rule;
 use Nevela\Laravel\Access\Access;
+use Nevela\Laravel\Access\ClosedAccounts;
 use Nevela\Laravel\Access\Permissions;
 use Nevela\Laravel\Http\Auth\Answers;
 use Nevela\Laravel\Models\Role;
@@ -41,7 +42,7 @@ final class RolesController
         if (! $user->can('roles.view') && ! $user->can('users.view')) {
             throw new AccessDeniedHttpException("You don't have access to this.");
         }
-        $counts = DB::table('nevela_role_user')->groupBy('role_id')->selectRaw('role_id, count(*) as users')->pluck('users', 'role_id');
+        $counts = self::holders();
         $held = Access::grantsFor($user);
         $roles = Role::query()->orderByDesc('is_system')->orderBy('name')->get();
 
@@ -128,7 +129,30 @@ final class RolesController
 
     private function users(Role $role): int
     {
-        return DB::table('nevela_role_user')->where('role_id', $role->id)->count();
+        return self::holders($role->id)[$role->id] ?? 0;
+    }
+
+    /**
+     * How many people hold each role, or the one role asked about. Closed accounts keep
+     * their roles, for when they are restored, and aren't counted.
+     *
+     * @return array<string, int>
+     */
+    private static function holders(?string $role = null): array
+    {
+        $links = fn () => DB::table('nevela_role_user')->when($role !== null, fn ($query) => $query->where('role_id', $role));
+        $perRole = fn ($query) => $query->groupBy('role_id')->selectRaw('role_id, count(*) as users')->pluck('users', 'role_id');
+
+        $counts = $perRole($links())->map(fn ($users) => (int) $users)->all();
+        // Taken off in batches. A list of ids is bound one value at a time, a database takes
+        // only so many, and the list of closed accounts only grows.
+        foreach (array_chunk(ClosedAccounts::ids(), 500) as $closed) {
+            foreach ($perRole($links()->whereIn('user_id', $closed)) as $id => $users) {
+                $counts[$id] = ($counts[$id] ?? 0) - (int) $users;
+            }
+        }
+
+        return $counts;
     }
 
     /** @return array{name?: string, description?: string|null, grants?: list<string>} */

package/template/laravel/src/Http/Access/UsersController.php

@@ -12,6 +12,7 @@ use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Validation\Rule;
 use Nevela\Laravel\Access\Access;
+use Nevela\Laravel\Access\ClosedAccounts;
 use Nevela\Laravel\Access\Permissions;
 use Nevela\Laravel\Auth\Account;
 use Nevela\Laravel\Auth\AuthMail;
@@ -31,10 +32,14 @@ use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
  *     password, or their email and then asking for a reset, would be a way to sign in as
  *     them and have what they have;
  *   - the last administrator can't be removed, switched off or demoted, by anyone.
+ *
+ * A closed account is not among the users here: it is under Deleted accounts until it is
+ * restored. Deleting a user is what puts it there.
  */
 final class UsersController
 {
     use Answers;
+    use Ceiling;
 
     /** GET _nevela/users?q=&role=&status=&page=&perPage= */
     public function index(Request $request): JsonResponse
@@ -49,7 +54,7 @@ final class UsersController
         ]);
         $model = Account::model();
         $instance = new $model;
-        $query = $model::query();
+        $query = ClosedAccounts::open();
 
         if (($search = trim((string) ($input['q'] ?? ''))) !== '') {
             $pattern = '%'.str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], mb_strtolower($search)).'%';
@@ -70,7 +75,8 @@ final class UsersController
 
         return response()->json([
             'data' => self::present($users, $request->user()),
-            'meta' => ['page' => $page, 'perPage' => $perPage, 'total' => $total, 'totalPages' => max(1, (int) ceil($total / $perPage))],
+            // keepsDeleted: whether deleting a user here closes the account, to be restored, or removes it.
+            'meta' => ['page' => $page, 'perPage' => $perPage, 'total' => $total, 'totalPages' => max(1, (int) ceil($total / $perPage)), 'keepsDeleted' => ClosedAccounts::ready()],
         ]);
     }
 
@@ -96,8 +102,8 @@ final class UsersController
             'roles.*' => ['string', 'max:64'],
             'active' => ['nullable', 'boolean'],
         ]);
-        if (Account::findByEmail($input['email'])) {
-            return response()->json(['error' => 'Validation failed.', 'issues' => [['path' => 'email', 'message' => 'Someone already has this email.']]], 422);
+        if ($taken = $this->emailTaken($input['email'])) {
+            return $taken;
         }
         $roles = $this->roles($input['roles']);
         if ($roles instanceof JsonResponse) {
@@ -111,10 +117,8 @@ final class UsersController
         if (Schema::hasColumn($user->getTable(), 'active')) {
             $attributes['active'] = (bool) ($input['active'] ?? true);
         }
-        if (Schema::hasColumn($user->getTable(), 'email_verified_at')) {
-            // Someone allowed to create users vouches for the address.
-            $attributes['email_verified_at'] = now();
-        }
+        // The address is as typed by whoever is adding them. It becomes "verified" when its
+        // owner proves it: from their Account page, or by signing in with an emailed link or code.
         $user->forceFill($attributes)->save();
         Access::assign($user, $roles->pluck('id')->all());
 
@@ -141,11 +145,8 @@ final class UsersController
         if (! $self && ($refused = $this->aboveCaller($caller, $user, 'change'))) {
             return $refused;
         }
-        if (isset($input['email'])) {
-            $taken = Account::findByEmail($input['email']);
-            if ($taken && (string) $taken->getAuthIdentifier() !== (string) $user->getAuthIdentifier()) {
-                return response()->json(['error' => 'Validation failed.', 'issues' => [['path' => 'email', 'message' => 'Someone already has this email.']]], 422);
-            }
+        if (isset($input['email']) && ($taken = $this->emailTaken($input['email'], $user))) {
+            return $taken;
         }
 
         $roles = null;
@@ -203,7 +204,11 @@ final class UsersController
         return response()->json(self::present(collect([$user->refresh()]), $caller)[0]);
     }
 
-    /** DELETE _nevela/users/{id} */
+    /**
+     * DELETE _nevela/users/{id}: close the account. It is signed out everywhere and kept
+     * under Deleted accounts, to be restored or removed for good. In an app that hasn't
+     * run the migration for that yet, it is removed, as it always was.
+     */
     public function destroy(Request $request, string $id): JsonResponse|Response
     {
         Gate::authorize('users.delete');
@@ -219,18 +224,11 @@ final class UsersController
             return $this->refuse('LAST_ADMIN', 'This is the only administrator. Make someone else an administrator first.', 409);
         }
 
-        $key = (string) $user->getAuthIdentifier();
-        DB::transaction(function () use ($user, $key) {
-            Account::revokeTokens($user);
-            DB::table('nevela_role_user')->where('user_id', $key)->delete();
-            foreach (['nevela_two_factor', 'nevela_passkeys'] as $table) {
-                if (Schema::hasTable($table)) {
-                    DB::table($table)->where('user_id', $key)->delete();
-                }
-            }
-            $user->delete();
-        });
-        Access::forget();
+        if (ClosedAccounts::ready()) {
+            ClosedAccounts::close($user, $caller);
+        } else {
+            ClosedAccounts::remove($user);
+        }
 
         return response()->noContent();
     }
@@ -250,47 +248,31 @@ final class UsersController
 
     private function find(string $id): mixed
     {
-        return Account::model()::query()->find($id) ?? throw new NotFoundHttpException('No such user.');
+        return ClosedAccounts::open()->find($id) ?? throw new NotFoundHttpException('No such user.');
     }
 
     /**
-     * A refusal when the account may do something the caller may not, and null otherwise.
+     * A 422 when an email can't be given to an account: someone has it, a deleted account
+     * has it, or its account was removed for good and the address is blocked.
      *
-     * What the account may do is read from its roles, not from whether it is switched on:
-     * a switched-off administrator is still not for a lesser manager to give a new
-     * password and switch back on.
+     * @param  mixed  $except  The account being changed, whose own email it may be
      */
-    private function aboveCaller(mixed $caller, mixed $user, string $verb): ?JsonResponse
+    private function emailTaken(string $email, mixed $except = null): ?JsonResponse
     {
-        if (self::within(Access::grantsFor($caller), $user)) {
+        $issue = fn (string $message) => response()->json(['error' => 'Validation failed.', 'issues' => [['path' => 'email', 'message' => $message]]], 422);
+        $holder = Account::findByEmail($email);
+        if ($holder && $except !== null && (string) $holder->getAuthIdentifier() === (string) $except->getAuthIdentifier()) {
             return null;
         }
-
-        return $this->holdsEverything($user)
-            ? $this->refuse('ADMIN_ONLY', "Only an administrator can {$verb} an administrator's account.", 403)
-            : $this->refuse('ABOVE_YOUR_OWN', "You can't {$verb} this account: it may do things your own roles don't allow.", 403);
-    }
-
-    /**
-     * Whether everything an account's roles allow is covered by `$held`.
-     *
-     * @param  list<string>  $held
-     * @param  iterable<Role>|null  $roles  The account's roles, when they are already at hand
-     */
-    private static function within(array $held, mixed $user, ?iterable $roles = null): bool
-    {
-        $theirs = [];
-        foreach ($roles ?? Access::rolesOf($user) as $role) {
-            array_push($theirs, ...$role->grants);
+        if ($holder && ! ClosedAccounts::isClosed($holder)) {
+            return $issue('Someone already has this email.');
         }
 
-        return Permissions::beyond($held, $theirs) === [];
-    }
-
-    /** Whether this account holds a role that comes to everything. */
-    private function holdsEverything(mixed $user): bool
-    {
-        return Access::rolesOf($user)->contains(fn (Role $role) => Permissions::hasAll($role->grants));
+        return match ($holder ? 'closed' : ClosedAccounts::standing($email, $except)) {
+            'closed' => $issue('A deleted account has this email. Restore it from Deleted accounts.'),
+            'blocked' => $issue('This email is blocked: its account was removed for good. Allow it again under Deleted accounts first.'),
+            default => null,
+        };
     }
 
     /**

package/template/laravel/src/Http/Auth/AccountController.php

@@ -9,11 +9,14 @@ use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Schema;
 use Nevela\Laravel\Access\Access;
+use Nevela\Laravel\Access\ClosedAccounts;
+use Nevela\Laravel\Access\Permissions;
 use Nevela\Laravel\Auth\Account;
 use Nevela\Laravel\Auth\AuthMail;
 use Nevela\Laravel\Auth\Challenges;
 use Nevela\Laravel\Auth\Web;
 use Nevela\Laravel\Http\UploadController;
+use Nevela\Laravel\Models\Role;
 use Nevela\Laravel\Models\Upload;
 use Nevela\Laravel\Rules\UploadKey;
 use Nevela\Laravel\Support\Descriptor;
@@ -21,7 +24,8 @@ use Nevela\Laravel\Support\Field;
 
 /**
  * An account and what its owner can do with it: create it, prove the email address,
- * change the name, the picture and the password, and see and sign out its devices.
+ * change the name, the picture and the password, see and sign out its devices, and
+ * close it.
  */
 final class AccountController
 {
@@ -41,7 +45,17 @@ final class AccountController
             'email' => ['required', 'email', 'max:255'],
             'password' => Account::passwordRules(),
         ]);
-        if (Account::findByEmail($input['email'])) {
+        // An email that had an account here doesn't get a second one by signing up again:
+        // not the address itself, and not another spelling of the same mailbox.
+        $holder = Account::findByEmail($input['email']);
+        $standing = $holder && ClosedAccounts::isClosed($holder) ? 'closed' : ClosedAccounts::standing($input['email']);
+        if ($standing === 'closed') {
+            return $this->refuse('ACCOUNT_CLOSED', 'An account with this email was closed. Ask an administrator to restore it.', 422);
+        }
+        if ($standing === 'blocked') {
+            return $this->refuse('EMAIL_BLOCKED', "This email can't be used for a new account. Ask an administrator.", 422);
+        }
+        if ($holder) {
             return $this->refuse('USER_ALREADY_EXISTS', 'An account with this email already exists. Sign in instead.', 422);
         }
 
@@ -185,7 +199,7 @@ final class AccountController
     public function forgotPassword(Request $request): JsonResponse
     {
         $input = $request->validate(['email' => ['required', 'email']]);
-        if ($user = Account::findByEmail($input['email'])) {
+        if (($user = Account::findByEmail($input['email'])) && ! ClosedAccounts::isClosed($user)) {
             $token = Challenges::start('reset-password', ['user' => (string) $user->getAuthIdentifier()], self::RESET_SECONDS);
             $url = Web::url('/reset-password', ['token' => $token], $request);
             AuthMail::send($user->email, 'Reset your '.AuthMail::app().' password', ['Use this link to choose a new password. It works once and expires in an hour.'], ['Choose a new password', $url], $url);
@@ -211,6 +225,34 @@ final class AccountController
         return response()->json(['reset' => true]);
     }
 
+    /**
+     * POST auth/close: close your own account. It takes the password again.
+     *
+     * The account is signed out everywhere and kept: an administrator can restore it, with
+     * everything it had, or remove it for good. Its email can't sign up again meanwhile.
+     */
+    public function close(Request $request): JsonResponse
+    {
+        $this->enabled('close_account');
+        if (! ClosedAccounts::ready()) {
+            return $this->refuse('MIGRATION_NEEDED', 'Closing an account needs a migration that has not been run: php nevela migrate', 409);
+        }
+        $user = $request->user();
+        if (! $this->passwordConfirmed($request)) {
+            return $this->refuse('INVALID_PASSWORD', "That isn't your password.", 422);
+        }
+        // Nobody would be left who could restore it, or run the app.
+        $administrator = Access::ready() && Access::rolesOf($user)->contains(fn (Role $role) => Permissions::hasAll($role->grants));
+        if ($administrator && Access::active($user) && Access::otherAdmins($user) === 0) {
+            return $this->refuse('LAST_ADMIN', 'You are the only administrator. Make someone else an administrator before closing your account.', 409);
+        }
+
+        ClosedAccounts::close($user, $user);
+        AuthMail::send($user->email, 'Your '.AuthMail::app().' account was closed', ['You closed your account, and have been signed out everywhere.', 'To have it back, ask an administrator: it can be restored with everything it had.']);
+
+        return response()->json(['closed' => true]);
+    }
+
     /** GET auth/sessions: the devices signed in to this account. */
     public function sessions(Request $request): JsonResponse
     {

package/template/laravel/src/Http/Auth/SignInController.php

@@ -6,6 +6,7 @@ use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
+use Nevela\Laravel\Access\ClosedAccounts;
 use Nevela\Laravel\Auth\Account;
 use Nevela\Laravel\Auth\AuthMail;
 use Nevela\Laravel\Auth\Challenges;
@@ -49,6 +50,7 @@ final class SignInController
                 'email' => (bool) config('nevela.auth.two_factor.email', true),
             ],
             'requireEmailVerification' => (bool) config('nevela.auth.require_email_verification', false),
+            'closeAccount' => (bool) config('nevela.auth.close_account', true),
         ];
     }
 
@@ -205,8 +207,8 @@ final class SignInController
         $this->enabled('magic_link');
         $input = $request->validate(['email' => ['required', 'email'], 'next' => ['nullable', 'string', 'max:2000']]);
 
-        // The answer is the same whether or not the address has an account.
-        if ($user = Account::findByEmail($input['email'])) {
+        // The answer is the same whether or not the address has an account. A closed one gets no link.
+        if (($user = Account::findByEmail($input['email'])) && ! ClosedAccounts::isClosed($user)) {
             $token = Challenges::start('magic-link', ['user' => (string) $user->getAuthIdentifier()], self::EMAILED);
             $url = Web::url('/api/auth/magic-link', ['token' => $token, 'next' => Web::path($input['next'] ?? null)], $request);
             AuthMail::send($user->email, 'Sign in to '.AuthMail::app(), ['Use this link to sign in. It works once and expires in 5 minutes.'], ['Sign in', $url], $url);
@@ -238,7 +240,7 @@ final class SignInController
         $this->enabled('email_code');
         $input = $request->validate(['email' => ['required', 'email']]);
 
-        if (($user = Account::findByEmail($input['email'])) && Challenges::mayIssue('email-code', mb_strtolower($user->email))) {
+        if (($user = Account::findByEmail($input['email'])) && ! ClosedAccounts::isClosed($user) && Challenges::mayIssue('email-code', mb_strtolower($user->email))) {
             [$code, $hash] = Challenges::code();
             Challenges::put('email-code', mb_strtolower($user->email), ['user' => (string) $user->getAuthIdentifier(), 'code' => $hash], self::EMAILED);
             AuthMail::send($user->email, 'Your '.AuthMail::app().' sign-in code', ["Your sign-in code is {$code}.", 'It expires in 5 minutes.'], null, $code);

package/template/laravel/src/Nevela.php

@@ -21,7 +21,7 @@ use Nevela\Laravel\Support\Naming;
 final class Nevela
 {
     /** Written by `pnpm release`; the same number as the repository's git tag. */
-    public const VERSION = '0.6.0';
+    public const VERSION = '0.7.1';
 
     /** @var array<string, Descriptor> */
     private static array $descriptors = [];

package/template/laravel/src/NevelaServiceProvider.php

@@ -23,6 +23,7 @@ use Nevela\Laravel\Console\TrashCommand;
 use Nevela\Laravel\Console\UpdateCommand;
 use Nevela\Laravel\Console\UserCommand;
 use Nevela\Laravel\Console\VersionCommand;
+use Nevela\Laravel\Http\Access\DeletedAccountsController;
 use Nevela\Laravel\Http\Access\RolesAreSetUp;
 use Nevela\Laravel\Http\Access\RolesController;
 use Nevela\Laravel\Http\Access\UsersController;
@@ -142,6 +143,7 @@ final class NevelaServiceProvider extends ServiceProvider
                     Route::put('avatar', [AccountController::class, 'avatar'])->name('avatar');
                     Route::delete('token', [TokenController::class, 'destroy'])->name('destroy');
                     Route::post('password', [AccountController::class, 'changePassword'])->middleware('throttle:nevela-auth')->name('password.change');
+                    Route::post('close', [AccountController::class, 'close'])->middleware('throttle:nevela-auth')->name('close');
 
                     Route::get('sessions', [AccountController::class, 'sessions'])->name('sessions');
                     Route::delete('sessions', [AccountController::class, 'revokeOtherSessions'])->name('sessions.revoke-others');
@@ -199,6 +201,13 @@ final class NevelaServiceProvider extends ServiceProvider
                 Route::delete('_nevela/users/{id}', [UsersController::class, 'destroy'])->name('users.destroy');
                 Route::delete('_nevela/users/{id}/sessions', [UsersController::class, 'revokeSessions'])->name('users.sessions.revoke');
 
+                // Accounts that were closed, and the emails that can't have a new one.
+                Route::get('_nevela/deleted-accounts', [DeletedAccountsController::class, 'index'])->name('deleted-accounts.index');
+                Route::post('_nevela/deleted-accounts/{id}/restore', [DeletedAccountsController::class, 'restore'])->name('deleted-accounts.restore');
+                Route::delete('_nevela/deleted-accounts/{id}', [DeletedAccountsController::class, 'destroy'])->name('deleted-accounts.destroy');
+                Route::get('_nevela/blocked-emails', [DeletedAccountsController::class, 'blocked'])->name('blocked-emails.index');
+                Route::delete('_nevela/blocked-emails/{id}', [DeletedAccountsController::class, 'allow'])->name('blocked-emails.allow');
+
                 Route::get('_nevela/permissions', [RolesController::class, 'catalog'])->name('permissions');
                 Route::get('_nevela/roles', [RolesController::class, 'index'])->name('roles.index');
                 Route::post('_nevela/roles', [RolesController::class, 'store'])->name('roles.store');

package/template/web/app/auth-actions.ts

@@ -1,8 +1,25 @@
 "use server";
 
 import { cookies } from "next/headers";
+import { redirect } from "next/navigation";
 import { laravel, TOKEN_COOKIE } from "@/lib/laravel";
 
+/**
+ * Close the signed-in person's own account (`POST /auth/close`). Laravel checks the
+ * password, signs every device out and keeps the account for an administrator to restore.
+ * What is left here is a cookie for a token that no longer exists, so it goes too.
+ */
+export async function closeAccountAction(password: string): Promise<{ ok: false; error: string }> {
+  const response = await laravel("auth/close", { method: "POST", body: { password } });
+  if (!response.ok) {
+    const body = (response.body ?? {}) as { error?: string };
+    return { ok: false, error: body.error ?? `Something went wrong (${response.status}).` };
+  }
+  (await cookies()).set(TOKEN_COOKIE, "", { httpOnly: true, sameSite: "lax", secure: process.env.NODE_ENV === "production", path: "/", maxAge: 0 });
+  // Closed, it doesn't come back here: the sign-in page says what happened.
+  redirect("/sign-in?closed=1");
+}
+
 /** Revoke the token in Laravel (`DELETE /auth/token`) and forget it here. */
 export async function signOutAction(): Promise<void> {
   try {

package/template/web/app/dashboard/access/actions.ts

@@ -46,6 +46,21 @@ export async function deleteUserAction(id: string): Promise<AccessResult<null>>
   return send(`_nevela/users/${encodeURIComponent(id)}`, "DELETE");
 }
 
+/** Open a closed account again, as it was. */
+export async function restoreAccountAction(id: string): Promise<AccessResult<ManagedUser>> {
+  return send(`_nevela/deleted-accounts/${encodeURIComponent(id)}/restore`, "POST");
+}
+
+/** Remove a closed account for good. Its email stays blocked. */
+export async function removeAccountAction(id: string): Promise<AccessResult<null>> {
+  return send(`_nevela/deleted-accounts/${encodeURIComponent(id)}`, "DELETE");
+}
+
+/** Let an email whose account was removed for good sign up again. */
+export async function allowEmailAction(id: string): Promise<AccessResult<null>> {
+  return send(`_nevela/blocked-emails/${encodeURIComponent(id)}`, "DELETE");
+}
+
 /** Sign someone out of every device. */
 export async function signOutUserAction(id: string): Promise<AccessResult<{ revoked: number }>> {
   return send(`_nevela/users/${encodeURIComponent(id)}/sessions`, "DELETE");

package/template/web/app/dashboard/access/deleted/page.tsx

@@ -0,0 +1,201 @@
+import Link from "next/link";
+import { SearchIcon } from "lucide-react";
+import { AllowEmailButton, DeletedAccountActions } from "@/components/access/deleted-account-actions";
+import { LocalTime } from "@/components/dashboard/local-time";
+import { PageHeader } from "@/components/dashboard/page-header";
+import { UserAvatar } from "@/components/dashboard/user-menu";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
+import { Input } from "@/components/ui/input";
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
+import { listBlockedEmails, listDeletedAccounts } from "@/lib/access";
+import { requirePermission } from "@/lib/dashboard";
+
+export const metadata = { title: "Deleted accounts" };
+
+type Params = { q?: string; page?: string };
+
+/**
+ * Accounts that were closed: by their owners, or by someone deleting them from the Users
+ * screen. Each is kept as it was, so it can be restored, or removed for good. Below them,
+ * the emails whose accounts were removed for good, which can't sign up again.
+ */
+export default async function DeletedAccountsPage({ searchParams }: { searchParams: Promise<Params> }) {
+  await requirePermission("users.delete", "/dashboard/access/deleted");
+  const params = await searchParams;
+  const list = await listDeletedAccounts(params);
+  const ready = list !== null && list !== "migrate";
+  const accounts = ready ? list.data : [];
+  const meta = ready ? list.meta : { page: 1, perPage: 25, total: 0, totalPages: 1 };
+  const blocked = ready && list.blocked > 0 ? await listBlockedEmails() : [];
+
+  const pageHref = (page: number) => `/dashboard/access/deleted?${new URLSearchParams({ ...(params.q ? { q: params.q } : {}), page: String(page) })}`;
+
+  return (
+    <>
+      <PageHeader
+        title="Deleted accounts"
+        description="Accounts that were closed. They can't sign in, and their email can't sign up again. Restore one as it was, or remove it for good."
+        crumbs={[{ label: "Dashboard", href: "/dashboard" }, { label: "Deleted accounts" }]}
+      />
+
+      {list === "migrate" ? (
+        <Empty className="rounded-xl border border-dashed">
+          <EmptyHeader>
+            <EmptyTitle>This app doesn&apos;t keep deleted accounts yet</EmptyTitle>
+            <EmptyDescription>
+              Deleting a user still removes them. Run <code>nevela upgrade</code>, then <code>nevela migrate</code>, and from then on a deleted account is
+              kept here.
+            </EmptyDescription>
+          </EmptyHeader>
+        </Empty>
+      ) : (
+        <>
+          {(meta.total > 0 || params.q) && (
+            <form className="relative w-full max-w-sm" role="search">
+              <SearchIcon className="pointer-events-none absolute top-1/2 left-2.5 size-4 -translate-y-1/2 text-muted-foreground" aria-hidden="true" />
+              <Input type="search" name="q" defaultValue={params.q ?? ""} placeholder="Search by name or email" aria-label="Search deleted accounts" className="pl-8" />
+            </form>
+          )}
+
+          {accounts.length === 0 && blocked.length > 0 && !params.q ? (
+            // With blocked emails to show below, a line is enough: the tall empty box would push them off the screen.
+            <p className="rounded-xl border border-dashed px-4 py-6 text-center text-sm text-muted-foreground">No deleted accounts at the moment.</p>
+          ) : accounts.length === 0 ? (
+            <Empty className="rounded-xl border border-dashed">
+              <EmptyHeader>
+                <EmptyTitle>{params.q ? "Nobody matches" : "No deleted accounts"}</EmptyTitle>
+                <EmptyDescription>
+                  {params.q ? "Try a different name or email." : "When someone closes their account, or you delete a user, the account waits here."}
+                </EmptyDescription>
+              </EmptyHeader>
+            </Empty>
+          ) : (
+            <div className="overflow-x-auto rounded-xl border">
+              <Table>
+                <TableHeader>
+                  <TableRow>
+                    <TableHead>Account</TableHead>
+                    <TableHead>Roles</TableHead>
+                    <TableHead>Closed</TableHead>
+                    <TableHead className="w-64">
+                      <span className="sr-only">Actions</span>
+                    </TableHead>
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
+                  {accounts.map((account) => (
+                    <TableRow key={account.id}>
+                      <TableCell>
+                        <div className="flex items-center gap-3">
+                          <UserAvatar user={{ name: account.name, email: account.email, image: account.image }} className="size-8" />
+                          <div className="flex min-w-0 flex-col">
+                            <span className="truncate text-sm font-medium">{account.name || account.email}</span>
+                            <span className="truncate text-xs text-muted-foreground">{account.email}</span>
+                          </div>
+                        </div>
+                      </TableCell>
+                      <TableCell>
+                        <div className="flex flex-wrap gap-1">
+                          {account.roles.length === 0 && <span className="text-sm text-muted-foreground">None</span>}
+                          {account.roles.map((role) => (
+                            <Badge key={role.id} variant="secondary">
+                              {role.name}
+                            </Badge>
+                          ))}
+                        </div>
+                      </TableCell>
+                      <TableCell className="text-sm text-muted-foreground">
+                        <div className="flex flex-col">
+                          <LocalTime value={account.closedAt} />
+                          <span className="text-xs">
+                            {account.closedBy === "self" ? "by themselves" : account.closedByName ? `by ${account.closedByName}` : account.closedBy === "admin" ? "by an administrator" : ""}
+                          </span>
+                        </div>
+                      </TableCell>
+                      <TableCell>
+                        {/* Only accounts that may do no more than you: the rule the Users screen has. */}
+                        {account.withinYours && <DeletedAccountActions id={account.id} who={account.name || account.email} email={account.email} />}
+                      </TableCell>
+                    </TableRow>
+                  ))}
+                </TableBody>
+              </Table>
+            </div>
+          )}
+
+          {meta.total > 0 && (
+            <div className="flex items-center justify-between gap-3 text-sm text-muted-foreground">
+              <p className="tabular-nums">
+                {(meta.page - 1) * meta.perPage + 1}–{Math.min(meta.page * meta.perPage, meta.total)} of {meta.total.toLocaleString()} deleted{" "}
+                {meta.total === 1 ? "account" : "accounts"}
+              </p>
+              {meta.totalPages > 1 && (
+                <div className="flex items-center gap-2">
+                  {meta.page > 1 ? (
+                    <Button variant="outline" size="sm" asChild>
+                      <Link href={pageHref(meta.page - 1)}>Previous</Link>
+                    </Button>
+                  ) : (
+                    <Button variant="outline" size="sm" disabled>
+                      Previous
+                    </Button>
+                  )}
+                  {meta.page < meta.totalPages ? (
+                    <Button variant="outline" size="sm" asChild>
+                      <Link href={pageHref(meta.page + 1)}>Next</Link>
+                    </Button>
+                  ) : (
+                    <Button variant="outline" size="sm" disabled>
+                      Next
+                    </Button>
+                  )}
+                </div>
+              )}
+            </div>
+          )}
+
+          {blocked.length > 0 && (
+            <section aria-labelledby="blocked-emails" className="flex flex-col gap-3">
+              <div className="flex flex-col gap-1">
+                <h2 id="blocked-emails" className="text-lg font-semibold tracking-tight">
+                  Emails that can&apos;t sign up
+                </h2>
+                <p className="text-sm text-muted-foreground">
+                  Their accounts were removed for good. Only a fingerprint of each address is kept: enough to refuse it, not to read it back.
+                </p>
+              </div>
+              <div className="overflow-x-auto rounded-xl border">
+                <Table>
+                  <TableHeader>
+                    <TableRow>
+                      <TableHead>Email</TableHead>
+                      <TableHead>Blocked</TableHead>
+                      <TableHead className="w-36">
+                        <span className="sr-only">Actions</span>
+                      </TableHead>
+                    </TableRow>
+                  </TableHeader>
+                  <TableBody>
+                    {blocked.map((entry) => (
+                      <TableRow key={entry.id}>
+                        <TableCell className="font-mono text-sm">{entry.hint}</TableCell>
+                        <TableCell className="text-sm text-muted-foreground">
+                          <LocalTime value={entry.blockedAt} />
+                        </TableCell>
+                        <TableCell className="text-right">
+                          <AllowEmailButton id={entry.id} hint={entry.hint} />
+                        </TableCell>
+                      </TableRow>
+                    ))}
+                  </TableBody>
+                </Table>
+              </div>
+            </section>
+          )}
+        </>
+      )}
+    </>
+  );
+}