feat: soft-delete for teamer accounts

addresses #869dv9br3

migrations/Version20260811075140.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260811075140 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE teamer ADD deleted_at DATETIME DEFAULT NULL COMMENT \'(DC2Type:datetime_immutable)\'');
+        $this->addSql('ALTER TABLE user ADD deleted_at DATETIME DEFAULT NULL COMMENT \'(DC2Type:datetime_immutable)\'');
+    }
+
+    public function down(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE teamer DROP deleted_at');
+        $this->addSql('ALTER TABLE user DROP deleted_at');
+    }
+}

src/BusProNet/UserDataHandler.php

@@ -97,6 +97,13 @@ class UserDataHandler
         /** @var User $user */
         $user = $users[0];
 
+        // A deleted account still has to be matched here, otherwise the caller would take
+        // it for an unknown person and create a second account for them - resurrecting
+        // them under a new row. It is returned as found, without writing anything to it.
+        if (true === $user->isDeleted()) {
+            return $user;
+        }
+
         $addressId = $profileResponse->getAddressId();
         $personId = $profileResponse->getPersonId();
         if (null === $addressId || null === $personId) {
@@ -232,6 +239,12 @@ class UserDataHandler
      */
     public function disableForRevokedCrmRoles(User $user): void
     {
+        // a deleted account is already excluded from everything and must not be written
+        // to by the CRM at all
+        if (true === $user->isDeleted()) {
+            return;
+        }
+
         // an existing block may be a disciplinary one and must never be overwritten, but
         // findLocalUser() may have refreshed the BusPro ids and nothing else flushes here
         if (true === $user->isDisabled()) {

src/Controller/Admin/Teamer/DeleteAccountController.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Controller\Admin\Teamer;
+
+use App\Entity\Teamer;
+use App\Htmx\HxRedirectResponse;
+use App\Repository\ApplicationRepository;
+use App\Repository\DispositionRepository;
+use App\Service\Teamer\AccountDeletionHandler;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+class DeleteAccountController extends AbstractController
+{
+    public function __construct(
+        private readonly AccountDeletionHandler $accountDeletionHandler,
+        private readonly ApplicationRepository $applicationRepository,
+        private readonly DispositionRepository $dispositionRepository,
+    ) {
+    }
+
+    #[Route('/admin/teamer/delete-account/{uuid}', name: 'app_admin_teamer_delete_account')]
+    #[IsGranted('ROLE_ADMIN')]
+    public function index(Teamer $teamer, Request $request): Response
+    {
+        if (true === $request->isMethod(Request::METHOD_POST)) {
+            $this->accountDeletionHandler->delete($teamer, AccountDeletionHandler::SOURCE_ADMIN);
+
+            $this->addFlash('success', 'Der Account wurde gelöscht');
+
+            return new HxRedirectResponse($this->generateUrl('app_administrative_teamer_index'));
+        }
+
+        // open commitments survive the deletion and stay visible, but the teamer is no
+        // longer written to about them - withdrawing them is the admin's decision
+        return $this->render('admin/teamer/modal_delete_account.html.twig', [
+            'teamer' => $teamer,
+            'pendingApplicationCount' => count($this->applicationRepository->getPendingForTeamer($teamer, 100)),
+            'upcomingDispositionCount' => count($this->dispositionRepository->getUpcomingDispositionsByTeamer($teamer, 100)),
+        ]);
+    }
+
+    #[Route('/admin/teamer/restore-account/{uuid}', name: 'app_admin_teamer_restore_account')]
+    #[IsGranted('ROLE_ADMIN')]
+    public function restore(Teamer $teamer, Request $request): Response
+    {
+        if (true === $request->isMethod(Request::METHOD_POST)) {
+            $this->accountDeletionHandler->restore($teamer);
+
+            $this->addFlash('success', 'Der Account wurde wiederhergestellt');
+
+            return new HxRedirectResponse($this->generateUrl('app_administrative_teamer_index'));
+        }
+
+        return $this->render('admin/teamer/modal_restore_account.html.twig', [
+            'teamer' => $teamer,
+        ]);
+    }
+}

src/Controller/Teamer/Profile/DeleteAccountController.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Controller\Teamer\Profile;
+
+use App\Entity\User;
+use App\Form\DeleteAccountType;
+use App\Htmx\HxRedirectResponse;
+use App\Service\Teamer\AccountDeletionHandler;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+
+class DeleteAccountController extends AbstractController
+{
+    public function __construct(private readonly AccountDeletionHandler $accountDeletionHandler)
+    {
+    }
+
+    #[Route('/teamer/profile/delete-account', name: 'app_teamer_profile_delete_account')]
+    #[IsGranted('ROLE_TEAMER')]
+    public function index(Request $request): Response
+    {
+        /** @var User $user */
+        $user = $this->getUser();
+
+        $form = $this->createForm(DeleteAccountType::class, null, ['hx_post' => $request->getUri()]);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $this->accountDeletionHandler->delete($user, AccountDeletionHandler::SOURCE_SELF);
+
+            $this->addFlash('success', 'Dein Account wurde gelöscht');
+
+            // the session stays authenticated until the next request, so the logout is
+            // done here rather than left to the DeletedUserSubscriber
+            return new HxRedirectResponse($this->generateUrl('app_security_logout'));
+        }
+
+        return $this->render('teamer/profile/modal_delete_account.html.twig', [
+            'form' => $form->createView(),
+        ]);
+    }
+}

src/Entity/SoftDeletableEntityInterface.php

@@ -6,5 +6,5 @@ interface SoftDeletableEntityInterface
 {
     public function getDeletedAt(): ?\DateTimeImmutable;
 
-    public function setDeletedAt(\DateTimeImmutable $createdAt): static;
+    public function setDeletedAt(?\DateTimeImmutable $deletedAt): static;
 }

src/Entity/Teamer.php

@@ -6,6 +6,7 @@ use App\BusProNet\Model\ProfileResponse;
 use App\Entity\Embeddable\Address;
 use App\Entity\Embeddable\BankAccount;
 use App\Entity\Embeddable\Communication;
+use App\Entity\Traits\SoftDeletableEntity;
 use App\Entity\Traits\TimestampableEntity;
 use App\Repository\TeamerRepository;
 use Doctrine\Common\Collections\ArrayCollection;
@@ -16,9 +17,10 @@ use Symfony\Component\Uid\Uuid;
 use Symfony\Component\Validator\Constraints as Assert;
 
 #[ORM\Entity(repositoryClass: TeamerRepository::class)]
-class Teamer implements TimestampableEntityInterface
+class Teamer implements TimestampableEntityInterface, SoftDeletableEntityInterface
 {
     use TimestampableEntity;
+    use SoftDeletableEntity;
 
     public const STATUS_NEW = 'new';
     public const STATUS_EXISTING = 'existing';

src/Entity/Traits/SoftDeletableEntity.php

@@ -14,7 +14,7 @@ trait SoftDeletableEntity
         return $this->deletedAt;
     }
 
-    public function setDeletedAt(\DateTimeImmutable $deletedAt): static
+    public function setDeletedAt(?\DateTimeImmutable $deletedAt): static
     {
         $this->deletedAt = $deletedAt;
 
@@ -28,6 +28,13 @@ trait SoftDeletableEntity
         return $this;
     }
 
+    public function setRestored(): static
+    {
+        $this->setDeletedAt(null);
+
+        return $this;
+    }
+
     public function isDeleted(): bool
     {
         return null !== $this->getDeletedAt();

src/Entity/User.php

@@ -2,6 +2,7 @@
 
 namespace App\Entity;
 
+use App\Entity\Traits\SoftDeletableEntity;
 use App\Entity\Traits\TimestampableEntity;
 use App\Repository\UserRepository;
 use Doctrine\DBAL\Types\Types;
@@ -12,9 +13,10 @@ use Symfony\Component\Validator\Constraints as Assert;
 use Symfony\Component\Validator\Context\ExecutionContextInterface;
 
 #[ORM\Entity(repositoryClass: UserRepository::class)]
-class User implements UserInterface, TimestampableEntityInterface
+class User implements UserInterface, TimestampableEntityInterface, SoftDeletableEntityInterface
 {
     use TimestampableEntity;
+    use SoftDeletableEntity;
 
     /**
      * Assignable roles and their labels.
@@ -315,6 +317,11 @@ class User implements UserInterface, TimestampableEntityInterface
 
     public function setTeamer(?Teamer $teamer): static
     {
+        // keep the inverse side in sync: it is only ever hydrated from the database, so
+        // without this a teamer attached during the request has no user to point back to
+        $this->teamer?->setUser(null);
+        $teamer?->setUser($this);
+
         $this->teamer = $teamer;
 
         return $this;
@@ -408,6 +415,17 @@ class User implements UserInterface, TimestampableEntityInterface
         return $this->setDisabledAt(new \DateTimeImmutable());
     }
 
+    /**
+     * Whether the account is barred from logging in, for either reason. A block and a
+     * deletion are independent states: a disciplinary block must survive a deletion and
+     * the restore that follows it, so the two are only ever combined for decisions,
+     * never merged into one another.
+     */
+    public function isBlocked(): bool
+    {
+        return $this->isDeleted() || $this->isDisabled();
+    }
+
     public function getDisabledReason(): ?string
     {
         return $this->disabledReason;

src/EventListener/DeletedUserSubscriber.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\EventListener;
+
+use App\Entity\User;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+
+/**
+ * Ends the session of a user whose account was deleted while they were logged in.
+ *
+ * The UserChecker only runs while authenticating, and Symfony's ContextListener does not
+ * re-run it when restoring a session from the cookie. Without this an account deleted by
+ * an admin would stay usable until the person logs out by themselves, which is exactly
+ * the continued participation a deletion is meant to end.
+ */
+class DeletedUserSubscriber implements EventSubscriberInterface
+{
+    public function __construct(
+        private readonly Security $security,
+        private readonly UrlGeneratorInterface $urlGenerator,
+    ) {
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            // ahead of RequiredTeamerCheckSubscriber, so a deleted teamer is logged out
+            // rather than being sent into an outstanding check
+            KernelEvents::REQUEST => ['onKernelRequest', 10],
+        ];
+    }
+
+    public function onKernelRequest(RequestEvent $event): void
+    {
+        if (false === $event->isMainRequest()) {
+            return;
+        }
+
+        $user = $this->security->getUser();
+
+        if (false === $user instanceof User || false === $user->isDeleted()) {
+            return;
+        }
+
+        $this->security->logout(false);
+
+        $event->setResponse(new RedirectResponse($this->urlGenerator->generate('app_security_login')));
+    }
+}

src/EventListener/EmailNotificationSubscriber.php

@@ -4,6 +4,7 @@ namespace App\EventListener;
 
 use App\Email\Mailer;
 use App\Entity\Application;
+use App\Entity\Teamer;
 use App\Entity\Upload;
 use App\Event\ApplicationStatusEvent;
 use App\Event\AssignmentCalledOffEvent;
@@ -46,6 +47,13 @@ class EmailNotificationSubscriber implements EventSubscriberInterface
     {
         $disposition = $event->getDisposition();
         $teamer = $disposition->getTeamer();
+
+        // checked before the contract is rendered, so no document is produced for a mail
+        // that is never sent
+        if (true === $this->isExcluded($teamer)) {
+            return;
+        }
+
         $assignment = $disposition->getAssignment();
         $destination = $assignment->getDestination();
 
@@ -78,6 +86,11 @@ class EmailNotificationSubscriber implements EventSubscriberInterface
 
         $disposition = $document->getDisposition();
         $teamer = $disposition->getTeamer();
+
+        if (true === $this->isExcluded($teamer)) {
+            return;
+        }
+
         $assignment = $disposition->getAssignment();
         $destination = $assignment->getDestination();
 
@@ -152,6 +165,10 @@ class EmailNotificationSubscriber implements EventSubscriberInterface
         $disposition = $document->getDisposition();
         $teamer = $disposition->getTeamer();
 
+        if (true === $this->isExcluded($teamer)) {
+            return;
+        }
+
         $documentTypeLabel = match ($document->getType()) {
             Upload::TYPE_CONTRACT => 'dein Honorarvertrag',
             Upload::TYPE_INVOICE => 'deine Honorarnote',
@@ -182,6 +199,10 @@ class EmailNotificationSubscriber implements EventSubscriberInterface
 
         $teamer = $application->getTeamer();
 
+        if (true === $this->isExcluded($teamer)) {
+            return;
+        }
+
         $this->mailer->createAndSendEmail([
             'application' => $application,
         ], [
@@ -203,6 +224,10 @@ class EmailNotificationSubscriber implements EventSubscriberInterface
         $disposition = $event->getDisposition();
         $teamer = $disposition->getTeamer();
 
+        if (true === $this->isExcluded($teamer)) {
+            return;
+        }
+
         $this->mailer->createAndSendEmail([
             'assignment' => $disposition->getAssignment(),
             'reason' => $disposition->getCalledOffReason(),
@@ -222,6 +247,10 @@ class EmailNotificationSubscriber implements EventSubscriberInterface
         foreach ($assignment->getDispositions() as $disposition) {
             $teamer = $disposition->getTeamer();
 
+            if (true === $this->isExcluded($teamer)) {
+                continue;
+            }
+
             $this->mailer->createAndSendEmail([
                 'assignment' => $assignment,
             ], [
@@ -231,4 +260,13 @@ class EmailNotificationSubscriber implements EventSubscriberInterface
             ]);
         }
     }
+
+    /**
+     * A deleted teamer is excluded from all communication. Their dispositions and
+     * documents stay in place and remain visible, they are simply no longer written to.
+     */
+    private function isExcluded(?Teamer $teamer): bool
+    {
+        return null === $teamer || true === $teamer->isDeleted();
+    }
 }

src/EventListener/RequiredTeamerCheckSubscriber.php

@@ -58,6 +58,9 @@ class RequiredTeamerCheckSubscriber implements EventSubscriberInterface
             // while a check is outstanding - otherwise a teamer asked to confirm
             // wrong data has no way to fix it first
             'app_teamer_profile_index',
+            // deleting the own account must stay reachable while a check is outstanding,
+            // otherwise a teamer could be bounced into a check forever with no way out
+            'app_teamer_profile_delete_account',
             'app_upload_delete',
             'app_security_logout',
         ], true)) {

src/Form/DeleteAccountType.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Form;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\CheckboxType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Validator\Constraints\IsTrue;
+
+class DeleteAccountType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        // deleting one's own account cannot be undone without asking the office, so it
+        // takes a deliberate second step rather than a single click
+        $builder->add('confirmed', CheckboxType::class, [
+            'label' => 'Ja, ich möchte meinen Account endgültig löschen',
+            'mapped' => false,
+            'constraints' => [
+                new IsTrue([
+                    'message' => 'Bitte bestätige die Löschung',
+                ]),
+            ],
+        ]);
+    }
+}

src/Form/TeamerFilterType.php

@@ -59,6 +59,10 @@ class TeamerFilterType extends AbstractType
                 'label' => 'inaktive Teamer:innen anzeigen',
                 'required' => false,
             ])
+            ->add('includeDeleted', CheckboxType::class, [
+                'label' => 'gelöschte Teamer:innen anzeigen',
+                'required' => false,
+            ])
             ->add('apply', SubmitType::class, [
                 'label' => 'filtern',
             ])

src/Model/TeamerFilterDto.php

@@ -13,6 +13,7 @@ class TeamerFilterDto extends AbstractFilterDto
     protected bool $driverLicenseVerified = false;
     protected bool $noTrainings = false;
     protected bool $includeInactive = false;
+    protected bool $includeDeleted = false;
 
     public function getName(): ?string
     {
@@ -119,4 +120,16 @@ class TeamerFilterDto extends AbstractFilterDto
 
         return $this;
     }
+
+    public function isIncludeDeleted(): bool
+    {
+        return $this->includeDeleted;
+    }
+
+    public function setIncludeDeleted(bool $includeDeleted): static
+    {
+        $this->includeDeleted = $includeDeleted;
+
+        return $this;
+    }
 }

src/Repository/AvailabilityRepository.php

@@ -41,7 +41,12 @@ class AvailabilityRepository extends ServiceEntityRepository
         if (false === $custom) {
             $qb->andWhere($qb->expr()->isNull('availability.owner'));
         } else {
-            $qb->andWhere($qb->expr()->isNotNull('availability.owner'));
+            $qb
+                ->andWhere($qb->expr()->isNotNull('availability.owner'))
+                // a deleted teamer takes no further assignments, so their own
+                // availabilities must no longer be offered for disposition
+                ->andWhere($qb->expr()->isNull('teamer.deletedAt'))
+            ;
         }
 
         return $qb->getQuery();
@@ -49,6 +54,10 @@ class AvailabilityRepository extends ServiceEntityRepository
 
     public function getSelectableForTeamer(Teamer $teamer): array
     {
+        if (true === $teamer->isDeleted()) {
+            return [];
+        }
+
         $qb = $this->createQueryBuilder('availability');
 
         return $qb

src/Repository/TeamerRepository.php

@@ -106,7 +106,14 @@ class TeamerRepository extends ServiceEntityRepository
             ;
         }
 
-        if (false === $filterDto->isIncludeInactive()) {
+        if (false === $filterDto->isIncludeDeleted()) {
+            $qb->andWhere($qb->expr()->isNull('teamer.deletedAt'));
+        }
+
+        // a deleted teamer never logs in again and would always count as inactive, so
+        // asking for them has to lift this filter - otherwise they could not be found
+        // again to be restored
+        if (false === $filterDto->isIncludeInactive() && false === $filterDto->isIncludeDeleted()) {
             $qb
                 ->andWhere($qb->expr()->gte('user.lastLoginAt', ':lastLoginThreshold'))
                 ->setParameter('lastLoginThreshold', new \DateTimeImmutable($this->teamerInactivePeriod))
@@ -125,6 +132,7 @@ class TeamerRepository extends ServiceEntityRepository
                 $qb->expr()->like('teamer.lastName', ':search'),
                 $qb->expr()->like('teamer.firstName', ':search'),
             ))
+            ->andWhere($qb->expr()->isNull('teamer.deletedAt'))
             ->orderBy('teamer.lastName', 'ASC')
             ->addOrderBy('teamer.firstName', 'ASC')
             ->setParameter('search', '%'.$this->escapeLikeWildcards($search).'%')

src/Repository/UserRepository.php

@@ -52,6 +52,9 @@ class UserRepository extends ServiceEntityRepository
         ));
 
         return $qb
+            // andWhere after a chain of orWhere yields "(... OR ...) AND ...", so this
+            // narrows the whole list rather than widening it by one more alternative
+            ->andWhere($qb->expr()->isNull('u.deletedAt'))
             ->orderBy('u.lastName', 'ASC')
             ->getQuery()
             ->getResult()
@@ -82,6 +85,7 @@ class UserRepository extends ServiceEntityRepository
 
         return $qb
             ->andWhere('JSON_CONTAINS(user.roles, :role) = 1')
+            ->andWhere($qb->expr()->isNull('user.deletedAt'))
             ->setParameter('role', json_encode($role))
             ->getQuery()
             ->getResult()
@@ -98,6 +102,7 @@ class UserRepository extends ServiceEntityRepository
                 $qb->expr()->like('user.firstName', ':search'),
             ))
             ->andWhere('JSON_CONTAINS(user.roles, :role) = 1')
+            ->andWhere($qb->expr()->isNull('user.deletedAt'))
             ->orderBy('user.lastName', 'ASC')
             ->addOrderBy('user.firstName', 'ASC')
             ->setParameter('search', '%'.$this->escapeLikeWildcards($search).'%')

src/Security/BpnAuthenticator.php

@@ -140,6 +140,19 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             ->findLocalUser($profileResponse)
         ;
 
+        // A deleted account is excluded from every process, and the CRM must not be able
+        // to undo that: no data is written back, no role is granted or revoked, not even
+        // lastLoginAt is bumped. It is returned untouched so the UserChecker can refuse
+        // the login and say why. Only an admin restores it.
+        if (true === $user?->isDeleted()) {
+            $this->logger->info('Skip CRM sync for deleted user', [
+                'user_id' => $user->getId(),
+                'user_email' => $email,
+            ]);
+
+            return $user;
+        }
+
         // BusPro knows this person but grants them nothing in this application, so they
         // are no user of it: never create an account, block an existing one. Returning
         // the blocked user lets the UserChecker explain why the login was refused.

src/Security/UserChecker.php

@@ -15,6 +15,12 @@ class UserChecker implements UserCheckerInterface
             return;
         }
 
+        // checked before the block, as a deletion is the stronger statement and its
+        // message has to win when an account carries both
+        if (true === $user->isDeleted()) {
+            throw new CustomUserMessageAccountStatusException('Dein Account wurde gelöscht. Wende dich an das Team, wenn du ihn wiederherstellen möchtest.');
+        }
+
         if (true === $user->isDisabled()) {
             throw new CustomUserMessageAccountStatusException('Dein Account wurde gesperrt: '.$user->getDisabledReason());
         }

src/Security/Voter/ImpersonationVoter.php

@@ -44,6 +44,12 @@ class ImpersonationVoter extends Voter
             return false;
         }
 
+        // a deleted account is excluded from every process, so impersonating it must not
+        // become a way back into the teamer area
+        if (true === $targetUser->isDeleted()) {
+            return false;
+        }
+
         // Admin is the only role allowed to impersonate
         if (false === $this->security->isGranted('ROLE_ADMIN')) {
             return false;

src/Service/Common/TeamerFilterHandler.php

@@ -33,6 +33,10 @@ class TeamerFilterHandler extends AbstractFilterHandler
             $filterDto->setIncludeInactive((bool) $data['include_inactive']);
         }
 
+        if (isset($data['include_deleted'])) {
+            $filterDto->setIncludeDeleted((bool) $data['include_deleted']);
+        }
+
         if (0 < count($data['job_profiles'])) {
             $jobProfiles = $this
                 ->entityManager
@@ -57,6 +61,7 @@ class TeamerFilterHandler extends AbstractFilterHandler
             'driver_license_verified' => $filterDto->hasDriverLicenseVerified(),
             'no_trainings' => $filterDto->hasNoTrainings(),
             'include_inactive' => $filterDto->isIncludeInactive(),
+            'include_deleted' => $filterDto->isIncludeDeleted(),
             'job_profiles' => array_map(function (JobProfile $jobProfile) {
                 return $jobProfile->getId();
             }, $filterDto->getJobProfiles()),

src/Service/Cron/DispositionReminderService.php

@@ -30,7 +30,9 @@ class DispositionReminderService
             ->innerJoin('disposition.assignment', 'assignment')
             ->innerJoin('assignment.destination', 'destination')
             ->innerJoin('disposition.documents', 'document', Join::WITH, 'document.type = :documentType')
+            ->innerJoin('disposition.teamer', 'teamer')
             ->where($qb->expr()->andX(
+                $qb->expr()->isNull('teamer.deletedAt'),
                 $qb->expr()->notIn('assignment.status', ':statusAssignment'),
                 $qb->expr()->eq('destination.dateFrom', ':dateFrom'),
                 $qb->expr()->eq('document.status', ':statusContract'),

src/Service/Cron/UploadReminderService.php

@@ -35,8 +35,12 @@ class UploadReminderService
             ->innerJoin('disposition.assignment', 'assignment')
             ->innerJoin('assignment.destination', 'destination')
             ->leftJoin('disposition.documents', 'document', Join::WITH, 'document.type = :documentType')
+            ->innerJoin('disposition.teamer', 'teamer')
             ->where($qb->expr()->andX(
                 $qb->expr()->isNull('document'),
+                // deleted teamers are excluded here rather than when sending, so that the
+                // count reported below stays truthful
+                $qb->expr()->isNull('teamer.deletedAt'),
                 $qb->expr()->orX(
                     $qb->expr()->eq('document.createdAt', ':contractDueDateFirst'),
                     $qb->expr()->eq('document.createdAt', ':contractDueDateSecond'),
@@ -90,8 +94,10 @@ class UploadReminderService
             ->innerJoin('disposition.assignment', 'assignment')
             ->innerJoin('assignment.destination', 'destination')
             ->leftJoin('disposition.documents', 'document', Join::WITH, 'document.type = :documentType')
+            ->innerJoin('disposition.teamer', 'teamer')
             ->where($qb->expr()->andX(
                 $qb->expr()->isNull('document'),
+                $qb->expr()->isNull('teamer.deletedAt'),
                 $qb->expr()->orX(
                     // Due date can be determined by assignment's date which potentially overrides destination date
                     $qb->expr()->andX(

src/Service/Teamer/AccountDeletionHandler.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Service\Teamer;
+
+use App\Entity\Teamer;
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Psr\Log\LoggerInterface;
+
+/**
+ * Soft-deletes a teamer together with their user account, and restores them again.
+ *
+ * A deletion excludes the person from every forward-looking process - the teamer list,
+ * autocompletes, forms, mailings and cron reminders - while every existing record stays
+ * untouched and visible: dispositions, applications, documents, feedback and the
+ * contracts and invoices rendered from them are business records that have to survive.
+ *
+ * Both Teamer and User carry their own flag, because neither side is guaranteed to
+ * exist and the queries that have to filter only ever have one of the two aliases at
+ * hand. This class is the only place that writes either flag, so the two cannot drift
+ * apart.
+ *
+ * Deletion is deliberately independent of the block expressed by User::$disabledAt: a
+ * disciplinary block has to survive a deletion and the restore that follows it.
+ */
+class AccountDeletionHandler
+{
+    public const SOURCE_ADMIN = 'admin';
+    public const SOURCE_SELF = 'self';
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly LoggerInterface $logger,
+    ) {
+    }
+
+    public function delete(Teamer|User $subject, string $source): void
+    {
+        [$teamer, $user] = $this->resolvePair($subject);
+
+        if (false === $this->isDeleted($teamer, $user)) {
+            $teamer?->setDeleted();
+            $user?->setDeleted();
+
+            $this->entityManager->flush();
+
+            $this->logger->info('Delete account', [...$this->logContext($teamer, $user), 'source' => $source]);
+        }
+    }
+
+    public function restore(Teamer|User $subject): void
+    {
+        [$teamer, $user] = $this->resolvePair($subject);
+
+        if (true === $this->isDeleted($teamer, $user)) {
+            $teamer?->setRestored();
+            $user?->setRestored();
+
+            $this->entityManager->flush();
+
+            $this->logger->info('Restore account', $this->logContext($teamer, $user));
+        }
+    }
+
+    /**
+     * @return array{0: ?Teamer, 1: ?User}
+     */
+    private function resolvePair(Teamer|User $subject): array
+    {
+        if ($subject instanceof Teamer) {
+            return [$subject, $subject->getUser()];
+        }
+
+        return [$subject->getTeamer(), $subject];
+    }
+
+    /**
+     * Either side being flagged counts as deleted, so that a pair left inconsistent by
+     * an earlier failure is repaired rather than skipped.
+     */
+    private function isDeleted(?Teamer $teamer, ?User $user): bool
+    {
+        return true === $teamer?->isDeleted() || true === $user?->isDeleted();
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function logContext(?Teamer $teamer, ?User $user): array
+    {
+        return [
+            'teamer' => $teamer?->getFullName(),
+            'teamer_id' => $teamer?->getId(),
+            'user' => $user?->getEmail(),
+            'user_id' => $user?->getId(),
+        ];
+    }
+}

src/Validator/Constraints/Application.php

@@ -9,6 +9,8 @@ class Application extends Constraint
 {
     public string $message = 'Diese Bewerbung überlappt sich mit einem deiner bestätigten Einsätze';
 
+    public string $deletedMessage = 'Für einen gelöschten Account können keine Bewerbungen angelegt werden';
+
     public function getTargets(): array|string
     {
         return static::CLASS_CONSTRAINT;

src/Validator/Constraints/ApplicationValidator.php

@@ -21,6 +21,18 @@ class ApplicationValidator extends ConstraintValidator
 
         $teamer = $application->getTeamer();
 
+        // a deleted teamer is excluded from every process, so no new application may be
+        // created for them - not even by an admin acting on their behalf
+        if (true === $teamer->isDeleted()) {
+            $this
+                ->context
+                ->buildViolation($constraint->deletedMessage)
+                ->addViolation()
+            ;
+
+            return;
+        }
+
         if (true === $teamer->isAllowOverlappingApplications()) {
             return;
         }

templates/_partials/_disposition_data.html.twig

@@ -1,5 +1,6 @@
 {% set assignment = disposition.assignment %}
 <span class="whitespace-nowrap">{{ disposition.teamer.fullName(true) }}</span>
+{% include '_partials/_teamer_deleted_badge.html.twig' with { 'teamer': disposition.teamer } %}
 {% include '_partials/_dot.html.twig' %}
 <span class="whitespace-nowrap">{{ assignment.effectivePeriod.start|date('d.m.y') }} - {{ assignment.effectivePeriod.end|date('d.m.y') }}</span>
 {% include '_partials/_dot.html.twig' %}

templates/_partials/_teamer_deleted_badge.html.twig

@@ -0,0 +1,6 @@
+{% if teamer is not null and teamer.deleted %}
+    <span class="inline-block py-1 px-2 text-xs bg-gray-500 text-white"
+          title="Account gelöscht am {{ teamer.deletedAt | date('d.m.Y') }}">
+        gelöscht
+    </span>
+{% endif %}

templates/admin/application/index.html.twig

@@ -100,6 +100,7 @@
                                     <a href="{{ path('app_administrative_assignment_detail', { 'uuid': assignment.uuid, 'r': return_url() }) }}">
                                         {{ application.teamer }}
                                     </a>
+                                    {% include '_partials/_teamer_deleted_badge.html.twig' with { 'teamer': application.teamer } %}
                                 </td>
                                 <td>
                                     <div class="flex items-center justify-end space-x-1"

templates/admin/teamer/modal_delete_account.html.twig

@@ -0,0 +1,33 @@
+{% extends 'htmx_confirmation_modal.html.twig' %}
+
+{% block title %}Account löschen{% endblock %}
+
+{% block content %}
+    <div class="pb-4">
+        Möchtest du <em>{{ teamer }}</em> und den zugehörigen Benutzeraccount wirklich löschen?
+    </div>
+    <div class="pb-4">
+        Die Person wird aus allen Listen, Formularen und dem Mailversand ausgeschlossen und kann
+        sich nicht mehr anmelden. Bestehende Einsätze, Dokumente und Feedbacks bleiben erhalten
+        und weiterhin sichtbar.
+    </div>
+    {% if pendingApplicationCount > 0 or upcomingDispositionCount > 0 %}
+        <div class="p-4 bg-red-50 border border-red-200 rounded-md">
+            <div class="font-bold pb-2">Achtung: offene Vorgänge</div>
+            <ul class="list-disc list-inside">
+                {% if pendingApplicationCount > 0 %}
+                    <li>{{ pendingApplicationCount }} offene Bewerbung(en)</li>
+                {% endif %}
+                {% if upcomingDispositionCount > 0 %}
+                    <li>{{ upcomingDispositionCount }} anstehende(r) Einsatz/Einsätze</li>
+                {% endif %}
+            </ul>
+            <div class="pt-2">
+                Diese bleiben bestehen, die Person wird darüber aber nicht mehr benachrichtigt.
+                Sage sie bei Bedarf vorher ab.
+            </div>
+        </div>
+    {% endif %}
+{% endblock %}
+
+{% block button_confirm %}Löschen{% endblock %}

templates/admin/teamer/modal_restore_account.html.twig

@@ -0,0 +1,17 @@
+{% extends 'htmx_confirmation_modal.html.twig' %}
+
+{% block title %}Account wiederherstellen{% endblock %}
+
+{% block content %}
+    <div class="pb-4">
+        Möchtest du <em>{{ teamer }}</em> und den zugehörigen Benutzeraccount wirklich
+        wiederherstellen?
+    </div>
+    <div>
+        Die Person erscheint danach wieder in allen Listen und erhält wieder E-Mails. Liegt in
+        BusPro keine Berechtigung mehr vor, wird der Account bei der nächsten Anmeldung erneut
+        gesperrt.
+    </div>
+{% endblock %}
+
+{% block button_confirm %}Wiederherstellen{% endblock %}

templates/administrative/assignment/detail.html.twig

@@ -48,6 +48,7 @@
                                             hx-target="body"
                                             hx-swap="beforeend">
                                         <span>{{ application.teamer }}</span>
+                                        {% include '_partials/_teamer_deleted_badge.html.twig' with { 'teamer': application.teamer } %}
                                         {{ icon('info', 'w-4 h-4') }}
                                     </button>
                                     <twig:RatingStars rating="{{ application.teamer.averageRating }}" />
@@ -155,6 +156,7 @@
                                         hx-target="body"
                                         hx-swap="beforeend">
                                     <span>{{ disposition.teamer }}</span>
+                                    {% include '_partials/_teamer_deleted_badge.html.twig' with { 'teamer': disposition.teamer } %}
                                     {{ icon('info', 'w-4 h-4') }}
                                 </button>
                                 <twig:RatingStars rating="{{ disposition.teamer.averageRating }}" />

templates/administrative/document/index.html.twig

@@ -83,6 +83,7 @@
                             </td>
                             <td>
                                 {{ disposition.teamer }}
+                                {% include '_partials/_teamer_deleted_badge.html.twig' with { 'teamer': disposition.teamer } %}
                             </td>
                             <td>
                                 {{ upload.status|upload_status_badge }}

templates/administrative/feedback/index.html.twig

@@ -60,6 +60,7 @@
                         </td>
                         <td>
                             {{ feedback.teamer.firstName }}
+                            {% include '_partials/_teamer_deleted_badge.html.twig' with { 'teamer': feedback.teamer } %}
                         </td>
                         <td>
                             {% if feedback.assignmentDateFrom and feedback.assignmentDateTo %}

templates/administrative/teamer/index.html.twig

@@ -104,7 +104,19 @@
                                         {{ icon('check') }}
                                     </button>
                                 {% endif %}
-                                {% if teamer.user is not null and teamer.user.disabled  %}
+                                {% if teamer.deleted %}
+                                    {% if is_granted('ROLE_ADMIN') %}
+                                        <button type="button"
+                                                role="menuitem"
+                                                tabindex="-1"
+                                                hx-get="{{ path('app_admin_teamer_restore_account', { 'uuid': teamer.uuid }) }}"
+                                                hx-target="body"
+                                                hx-swap="beforeend"
+                                                title="Account wiederherstellen">
+                                            {{ icon('refresh') }}
+                                        </button>
+                                    {% endif %}
+                                {% elseif teamer.user is not null and teamer.user.disabled  %}
                                     {% if is_granted('ROLE_ADMIN') %}
                                         <button type="button"
                                                 role="menuitem"
@@ -132,11 +144,28 @@
                                             {{ icon('mask') }}
                                         </a>
                                     {% endif %}
+                                    {% if is_granted('ROLE_ADMIN') %}
+                                        <button type="button"
+                                                class="text-red-500"
+                                                role="menuitem"
+                                                tabindex="-1"
+                                                hx-get="{{ path('app_admin_teamer_delete_account', { 'uuid': teamer.uuid }) }}"
+                                                hx-target="body"
+                                                hx-swap="beforeend"
+                                                title="Account löschen">
+                                            {{ icon('delete') }}
+                                        </button>
+                                    {% endif %}
                                 {% endif %}
                                 <a href="{{ path('app_administrative_teamer_profile', { 'uuid': teamer.uuid, 'r': return_url() }) }}" title="Teamer:innenprofil {{ teamer }}">
                                     {{ icon('user') }}
                                 </a>
                             </div>
+                            {% if teamer.deleted %}
+                                <div class="py-1 px-2 mt-2 text-xs bg-gray-500 text-white">
+                                    gel. am {{ teamer.deletedAt | date('d.m.Y') }}
+                                </div>
+                            {% endif %}
                             {% if teamer.user is not null and teamer.user.disabled %}
                                 <div class="py-1 px-2 mt-2 text-xs bg-red-500 text-white">
                                     gesp. am {{ teamer.user.disabledAt | date('d.m.Y') }}

templates/common/modal_teamer_filter.html.twig

@@ -14,6 +14,7 @@
         {{ form_row(filterForm.driverLicenseVerified) }}
         {{ form_row(filterForm.noTrainings) }}
         {{ form_row(filterForm.includeInactive) }}
+        {{ form_row(filterForm.includeDeleted) }}
     </div>
     <div class="flex items-center space-x-2">
         {{ form_widget(filterForm.apply, { 'attr': { 'class': 'btn' } }) }}

templates/teamer/profile/index.html.twig

@@ -164,6 +164,23 @@
                                 </button>
                             </div>
                         </div>
+                        <div class="pt-8 mt-4 border-t border-gray-200">
+                            <h4 class="font-bold pb-2">
+                                Account löschen
+                            </h4>
+                            <div class="pb-2 text-sm">
+                                Du kannst deinen Account löschen. Du wirst danach aus allen Listen
+                                und dem E-Mail-Versand ausgeschlossen und kannst dich nicht mehr
+                                anmelden.
+                            </div>
+                            <button type="button"
+                                    class="btn btn--small bg-red-500 text-white"
+                                    hx-get="{{ path('app_teamer_profile_delete_account') }}"
+                                    hx-target="body"
+                                    hx-swap="beforeend">
+                                Account löschen
+                            </button>
+                        </div>
                     </div>
                 </div>
 

templates/teamer/profile/modal_delete_account.html.twig

@@ -0,0 +1,27 @@
+{% extends 'htmx_modal.html.twig' %}
+
+{% block title %}Account löschen{% endblock %}
+
+{% block content %}
+    {{ form_start(form) }}
+    <div class="flex flex-col space-y-4 pb-4">
+        <div>
+            Wenn du deinen Account löschst, wirst du aus allen Listen, Formularen und dem
+            E-Mail-Versand ausgeschlossen und kannst dich nicht mehr anmelden.
+        </div>
+        <div>
+            Deine bisherigen Einsätze, Honorarverträge und Honorarnoten bleiben aus rechtlichen
+            Gründen gespeichert und für das Team weiterhin sichtbar.
+        </div>
+        <div>
+            Wenn du deinen Account später wieder brauchst, wende dich bitte an das Büro. Du
+            kannst ihn nicht selbst wiederherstellen.
+        </div>
+        {{ form_row(form.confirmed) }}
+    </div>
+    <button type="submit" class="btn bg-red-500 text-white">
+        Account löschen
+    </button>
+    {{ form_rest(form) }}
+    {{ form_end(form) }}
+{% endblock %}

tests/BusProNet/UserDataHandlerTest.php

@@ -466,6 +466,73 @@ class UserDataHandlerTest extends TestCase
         $this->assertSame(2, $user->getBusProPersonId());
     }
 
+    /**
+     * A deleted account still has to be matched by email, otherwise the caller takes the
+     * person for unknown and creates a second account for them - which would resurrect
+     * them under a new row and defeat the deletion entirely. Nothing is written to it.
+     */
+    public function testFindLocalUserReturnsADeletedEmailMatchWithoutWritingToIt(): void
+    {
+        $user = (new User())
+            ->setFirstName('First')
+            ->setLastName('Last')
+            ->setEmail('[email protected]')
+            ->setBusProAddressId(1)
+            ->setBusProPersonId(2)
+        ;
+        $user->setDeleted();
+
+        $profileResponse = $this->createProfileResponse();
+
+        $repository = $this->createMock(ObjectRepository::class);
+        $repository
+            ->expects($this->once())
+            ->method('findOneBy')
+            ->willReturn(null);
+
+        $repository
+            ->expects($this->once())
+            ->method('findBy')
+            ->with([
+                'email' => '[email protected]',
+            ])
+            ->willReturn([$user]);
+
+        $this->entityManager
+            ->expects($this->once())
+            ->method('getRepository')
+            ->with(User::class)
+            ->willReturn($repository);
+
+        $handler = new UserDataHandler($this->entityManager, $this->logger);
+        $resolvedUser = $handler->findLocalUser($profileResponse);
+
+        $this->assertSame($user, $resolvedUser);
+        $this->assertSame(1, $user->getBusProAddressId());
+        $this->assertSame(2, $user->getBusProPersonId());
+    }
+
+    public function testDisableForRevokedCrmRolesLeavesADeletedAccountAlone(): void
+    {
+        $user = (new User())
+            ->setFirstName('First')
+            ->setLastName('Last')
+            ->setEmail('[email protected]')
+            ->setRoles(['ROLE_TEAMER'])
+        ;
+        $user->setDeleted();
+
+        $this->entityManager
+            ->expects($this->never())
+            ->method('flush');
+
+        $handler = new UserDataHandler($this->entityManager, $this->logger);
+        $handler->disableForRevokedCrmRoles($user);
+
+        $this->assertFalse($user->isDisabled());
+        $this->assertSame(['ROLE_TEAMER'], $user->getAssignedRoles());
+    }
+
     private function createProfileResponse(?int $addressId = 200, ?int $personId = 100): ProfileResponse
     {
         $address = (new BusProAddress())

tests/Entity/Traits/SoftDeletableEntityTest.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Entity\Traits;
+
+use App\Entity\SoftDeletableEntityInterface;
+use App\Entity\Traits\SoftDeletableEntity;
+use PHPUnit\Framework\TestCase;
+
+class SoftDeletableEntityTest extends TestCase
+{
+    public function testAFreshEntityIsNotDeleted(): void
+    {
+        $entity = $this->createEntity();
+
+        $this->assertFalse($entity->isDeleted());
+        $this->assertNull($entity->getDeletedAt());
+    }
+
+    public function testSetDeletedStampsTheTimestamp(): void
+    {
+        $entity = $this->createEntity();
+        $entity->setDeleted();
+
+        $this->assertTrue($entity->isDeleted());
+        $this->assertNotNull($entity->getDeletedAt());
+    }
+
+    public function testSetRestoredClearsTheTimestamp(): void
+    {
+        $entity = $this->createEntity();
+        $entity->setDeleted();
+        $entity->setRestored();
+
+        $this->assertFalse($entity->isDeleted());
+        $this->assertNull($entity->getDeletedAt());
+    }
+
+    public function testDeletedAtAcceptsNullSoDeletionsCanBeUndone(): void
+    {
+        $entity = $this->createEntity();
+        $entity->setDeletedAt(new \DateTimeImmutable());
+        $entity->setDeletedAt(null);
+
+        $this->assertFalse($entity->isDeleted());
+    }
+
+    private function createEntity(): SoftDeletableEntityInterface
+    {
+        return new class implements SoftDeletableEntityInterface {
+            use SoftDeletableEntity;
+        };
+    }
+}

tests/Entity/UserTest.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Tests\Entity;
 
+use App\Entity\Teamer;
 use App\Entity\User;
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\Validator\ConstraintViolationListInterface;
@@ -118,6 +119,44 @@ class UserTest extends TestCase
         $this->assertNull($enabled->getDisabledAt());
     }
 
+    /**
+     * A block and a deletion are independent states: setting one must never imply or
+     * clear the other, so that a disciplinary block survives a deletion and the restore
+     * that follows it.
+     */
+    public function testDeletionAndBlockAreIndependentStates(): void
+    {
+        $user = new User();
+        $this->assertFalse($user->isBlocked());
+
+        $user->setDeleted();
+        $this->assertTrue($user->isBlocked());
+        $this->assertFalse($user->isDisabled());
+
+        $user->setDisabled(true);
+        $disabledAt = $user->getDisabledAt();
+
+        $user->setRestored();
+        $this->assertFalse($user->isDeleted());
+        $this->assertTrue($user->isBlocked());
+        $this->assertSame($disabledAt, $user->getDisabledAt());
+
+        $user->setDisabled(false);
+        $this->assertFalse($user->isBlocked());
+    }
+
+    public function testSettingTheTeamerKeepsTheInverseSideInSync(): void
+    {
+        $teamer = new Teamer();
+        $user = (new User())->setTeamer($teamer);
+
+        $this->assertSame($user, $teamer->getUser());
+
+        $user->setTeamer(null);
+
+        $this->assertNull($teamer->getUser());
+    }
+
     private function validate(User $user): ConstraintViolationListInterface
     {
         return Validation::createValidatorBuilder()

tests/EventListener/EmailNotificationSubscriberTest.php

@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\EventListener;
+
+use App\Email\Mailer;
+use App\Entity\Application;
+use App\Entity\Assignment;
+use App\Entity\Disposition;
+use App\Entity\Embeddable\Communication;
+use App\Entity\Teamer;
+use App\Event\ApplicationStatusEvent;
+use App\Event\AssignmentCalledOffEvent;
+use App\Event\DispositionCalledOffEvent;
+use App\EventListener\EmailNotificationSubscriber;
+use App\Model\ApplicationStatusDto;
+use App\Repository\UserRepository;
+use App\Service\Pdf\ContractRenderer;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * A deleted teamer must never be mailed again - this is the point of the deletion, so
+ * every handler that writes to a teamer is covered here.
+ */
+class EmailNotificationSubscriberTest extends TestCase
+{
+    private Mailer&MockObject $mailer;
+    private EmailNotificationSubscriber $subscriber;
+
+    protected function setUp(): void
+    {
+        $this->mailer = $this->createMock(Mailer::class);
+
+        $this->subscriber = new EmailNotificationSubscriber(
+            $this->mailer,
+            $this->createMock(UserRepository::class),
+            $this->createMock(ContractRenderer::class),
+        );
+    }
+
+    public function testDeletedTeamerIsNotNotifiedAboutCalledOffDisposition(): void
+    {
+        $disposition = $this->createDisposition($this->createDeletedTeamer());
+
+        $this->mailer->expects($this->never())->method('createAndSendEmail');
+
+        $this->subscriber->onDispositionCalledOff(new DispositionCalledOffEvent($disposition, true));
+    }
+
+    public function testActiveTeamerIsNotifiedAboutCalledOffDisposition(): void
+    {
+        $disposition = $this->createDisposition($this->createTeamer());
+
+        $this->mailer->expects($this->once())->method('createAndSendEmail');
+
+        $this->subscriber->onDispositionCalledOff(new DispositionCalledOffEvent($disposition, true));
+    }
+
+    public function testDeletedTeamerIsNotNotifiedAboutRejectedApplication(): void
+    {
+        $application = new Application(new Assignment(), $this->createDeletedTeamer());
+        $application->setStatus(Application::STATUS_REJECTED);
+
+        $this->mailer->expects($this->never())->method('createAndSendEmail');
+
+        $this->subscriber->onApplicationStatus(
+            new ApplicationStatusEvent(new ApplicationStatusDto($application))
+        );
+    }
+
+    /**
+     * The call-off of a whole assignment mails every teamer on it, so the exclusion has
+     * to happen per teamer rather than for the event as a whole.
+     */
+    public function testCalledOffAssignmentSkipsOnlyTheDeletedTeamer(): void
+    {
+        $assignment = new Assignment();
+        $assignment->addDisposition($this->createDisposition($this->createTeamer(), $assignment));
+        $assignment->addDisposition($this->createDisposition($this->createDeletedTeamer(), $assignment));
+
+        $this->mailer->expects($this->once())->method('createAndSendEmail');
+
+        $this->subscriber->onAssignmentCalledOff(new AssignmentCalledOffEvent($assignment));
+    }
+
+    private function createDisposition(Teamer $teamer, ?Assignment $assignment = null): Disposition
+    {
+        return new Disposition(new Application($assignment ?? new Assignment(), $teamer));
+    }
+
+    private function createTeamer(): Teamer
+    {
+        return (new Teamer())->setCommunication(
+            (new Communication())->setEmail('[email protected]')
+        );
+    }
+
+    private function createDeletedTeamer(): Teamer
+    {
+        $teamer = $this->createTeamer();
+        $teamer->setDeleted();
+
+        return $teamer;
+    }
+}

tests/Security/BpnAuthenticatorTest.php

@@ -86,6 +86,44 @@ class BpnAuthenticatorTest extends TestCase
         $this->loadUser();
     }
 
+    /**
+     * The CRM must not be able to undo a deletion, in either direction: neither by
+     * refreshing the account's data nor by blocking it further.
+     */
+    public function testDeletedUserIsReturnedWithoutAnyCrmSync(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDeleted();
+
+        $this->stubApiClient($this->createCrmAttributes());
+
+        $this->userDataHandler->method('collectRoles')->willReturn(['ROLE_TEAMER']);
+        $this->userDataHandler->method('findLocalUser')->willReturn($user);
+
+        $this->userDataHandler->expects($this->never())->method('updateLocalUser');
+        $this->userDataHandler->expects($this->never())->method('createLocalUser');
+        $this->userDataHandler->expects($this->never())->method('disableForRevokedCrmRoles');
+
+        // returned rather than refused, so the UserChecker can explain the deletion
+        $this->assertSame($user, $this->loadUser());
+    }
+
+    public function testDeletedUserIsNotBlockedWhenTheCrmRevokedEveryRole(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDeleted();
+
+        $this->stubApiClient($this->createCrmAttributes());
+
+        $this->userDataHandler->method('collectRoles')->willReturn([]);
+        $this->userDataHandler->method('findLocalUser')->willReturn($user);
+
+        $this->userDataHandler->expects($this->never())->method('disableForRevokedCrmRoles');
+
+        $this->assertSame($user, $this->loadUser());
+        $this->assertFalse($user->isDisabled());
+    }
+
     private function createCrmAttributes(): CrmAttributesResponse
     {
         return (new CrmAttributesResponse())->setAttributeGroups([new CrmAttributeGroup()]);

tests/Security/UserCheckerTest.php

@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Entity\User;
+use App\Security\UserChecker;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
+
+class UserCheckerTest extends TestCase
+{
+    private UserChecker $userChecker;
+
+    protected function setUp(): void
+    {
+        $this->userChecker = new UserChecker();
+    }
+
+    public function testDeletedUserIsRefused(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDeleted();
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+        $this->expectExceptionMessageMatches('/gelöscht/');
+
+        $this->userChecker->checkPreAuth($user);
+    }
+
+    /**
+     * A deletion is the stronger statement, so its message has to win over the block
+     * message when an account carries both.
+     */
+    public function testDeletedAndDisabledUserIsRefusedWithTheDeletionMessage(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDisabled(true);
+        $user->setDisabledReason('Disziplinarisch gesperrt');
+        $user->setDeleted();
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+        $this->expectExceptionMessageMatches('/gelöscht/');
+
+        $this->userChecker->checkPreAuth($user);
+    }
+
+    public function testDisabledUserStillGetsTheBlockMessage(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDisabled(true);
+        $user->setDisabledReason('Disziplinarisch gesperrt');
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+        $this->expectExceptionMessage('Dein Account wurde gesperrt: Disziplinarisch gesperrt');
+
+        $this->userChecker->checkPreAuth($user);
+    }
+
+    public function testActiveUserWithValidRolePasses(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+
+        $this->userChecker->checkPreAuth($user);
+
+        $this->assertFalse($user->isBlocked());
+    }
+}

tests/Service/Teamer/AccountDeletionHandlerTest.php

@@ -0,0 +1,148 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Service\Teamer;
+
+use App\Entity\Teamer;
+use App\Entity\User;
+use App\Service\Teamer\AccountDeletionHandler;
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+class AccountDeletionHandlerTest extends TestCase
+{
+    private EntityManagerInterface&MockObject $entityManager;
+    private AccountDeletionHandler $handler;
+
+    protected function setUp(): void
+    {
+        $this->entityManager = $this->createMock(EntityManagerInterface::class);
+
+        $this->handler = new AccountDeletionHandler(
+            $this->entityManager,
+            $this->createMock(LoggerInterface::class),
+        );
+    }
+
+    public function testDeleteFromTeamerSideFlagsBothEntities(): void
+    {
+        $teamer = new Teamer();
+        $user = (new User())->setTeamer($teamer);
+
+        $this->entityManager->expects($this->once())->method('flush');
+
+        $this->handler->delete($teamer, AccountDeletionHandler::SOURCE_ADMIN);
+
+        $this->assertTrue($teamer->isDeleted());
+        $this->assertTrue($user->isDeleted());
+    }
+
+    public function testDeleteFromUserSideFlagsBothEntities(): void
+    {
+        $teamer = new Teamer();
+        $user = (new User())->setTeamer($teamer);
+
+        $this->handler->delete($user, AccountDeletionHandler::SOURCE_SELF);
+
+        $this->assertTrue($teamer->isDeleted());
+        $this->assertTrue($user->isDeleted());
+    }
+
+    public function testDeleteWorksForUserWithoutTeamer(): void
+    {
+        $user = new User();
+
+        $this->entityManager->expects($this->once())->method('flush');
+
+        $this->handler->delete($user, AccountDeletionHandler::SOURCE_ADMIN);
+
+        $this->assertTrue($user->isDeleted());
+    }
+
+    public function testDeleteWorksForTeamerWithoutUser(): void
+    {
+        $teamer = new Teamer();
+
+        $this->entityManager->expects($this->once())->method('flush');
+
+        $this->handler->delete($teamer, AccountDeletionHandler::SOURCE_ADMIN);
+
+        $this->assertTrue($teamer->isDeleted());
+    }
+
+    public function testDeletingTwiceIsANoOpAndKeepsTheOriginalTimestamp(): void
+    {
+        $teamer = new Teamer();
+        $user = (new User())->setTeamer($teamer);
+
+        $this->entityManager->expects($this->once())->method('flush');
+
+        $this->handler->delete($teamer, AccountDeletionHandler::SOURCE_ADMIN);
+        $deletedAt = $teamer->getDeletedAt();
+
+        $this->handler->delete($teamer, AccountDeletionHandler::SOURCE_ADMIN);
+
+        $this->assertSame($deletedAt, $teamer->getDeletedAt());
+    }
+
+    /**
+     * A deletion is not a block: the two states are independent, so that a disciplinary
+     * block survives a deletion and the restore that follows it.
+     */
+    public function testDeleteLeavesRolesAndTheBlockUntouched(): void
+    {
+        $teamer = new Teamer();
+        $user = (new User())
+            ->setTeamer($teamer)
+            ->setRoles(['ROLE_TEAMER', 'ROLE_ADMIN'])
+        ;
+        $user->setDisabled(true);
+        $disabledAt = $user->getDisabledAt();
+
+        $this->handler->delete($user, AccountDeletionHandler::SOURCE_ADMIN);
+
+        $this->assertSame(['ROLE_TEAMER', 'ROLE_ADMIN'], $user->getAssignedRoles());
+        $this->assertSame($disabledAt, $user->getDisabledAt());
+    }
+
+    public function testRestoreClearsBothFlags(): void
+    {
+        $teamer = new Teamer();
+        $user = (new User())->setTeamer($teamer);
+
+        $this->handler->delete($teamer, AccountDeletionHandler::SOURCE_ADMIN);
+        $this->handler->restore($teamer);
+
+        $this->assertFalse($teamer->isDeleted());
+        $this->assertFalse($user->isDeleted());
+    }
+
+    public function testRestoreOfAnActiveAccountIsANoOp(): void
+    {
+        $teamer = new Teamer();
+
+        $this->entityManager->expects($this->never())->method('flush');
+
+        $this->handler->restore($teamer);
+
+        $this->assertFalse($teamer->isDeleted());
+    }
+
+    /**
+     * Should a pair ever be left half-flagged, restoring has to repair it rather than
+     * skip it because one side already looks active.
+     */
+    public function testRestoreRepairsAnInconsistentPair(): void
+    {
+        $teamer = (new Teamer())->setDeleted();
+        $user = (new User())->setTeamer($teamer);
+
+        $this->handler->restore($user);
+
+        $this->assertFalse($teamer->isDeleted());
+        $this->assertFalse($user->isDeleted());
+    }
+}