Prevent any API requests on accounts that are in deleting

internal/api/keppel/accounts.go

@@ -112,7 +112,12 @@ func (a *API) handlePutAccount(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `malformed attribute "account.name" in request body is not allowed here`, http.StatusUnprocessableEntity)
 		return
 	}
-	// ... transfer it here into the struct, to make the below code simpler
+	// ... or state ...
+	if req.Account.State != "" {
+		http.Error(w, `malformed attribute "account.state" in request body is not allowed here`, http.StatusUnprocessableEntity)
+		return
+	}
+	// ... and transfer the name here into the struct, to make the below code simpler
 	req.Account.Name = models.AccountName(mux.Vars(r)["account"])
 
 	// check permission to create account

internal/api/keppel/accounts_test.go

@@ -1951,9 +1951,9 @@ func TestDeleteAccount(t *testing.T) {
 	assert.HTTPRequest{
 		Method:       "DELETE",
 		Path:         "/keppel/v1/accounts/test1",
+		Header:       map[string]string{"X-Test-Perms": "view:tenant1,change:tenant1"},
+		ExpectStatus: http.StatusConflict,
 		ExpectBody:   assert.StringData("account is deleting\n"),
-			"error": "account is already set to be deleted",
-		},
 	}.Check(t, h)
 
 	// that didn't touch the DB

internal/api/keppel/api.go

@@ -184,6 +184,10 @@ func (a *API) findAccountFromRequest(w http.ResponseWriter, r *http.Request, _ *
 		http.Error(w, "account not found", http.StatusNotFound)
 		return nil
 	}
+	if account.IsDeleting {
+		http.Error(w, "account is deleting", http.StatusConflict)
+		return nil
+	}
 	return account
 }