Prevent any API requests on accounts that are in deleting

internal/api/keppel/accounts_test.go

@@ -320,6 +320,16 @@ func TestAccountsAPI(t *testing.T) {
 			},
 		}.Check(t, h)
 
+		status := http.StatusOK
+		var body assert.HTTPResponseBody
+		body = assert.JSONObject{
+			"account": accountExpect,
+		}
+		if isDeleting {
+			status = http.StatusConflict
+			body = assert.StringData("account is deleting\n")
+		}
+
 		assert.HTTPRequest{
 			Method:       "GET",
 			Path:         "/keppel/v1/accounts/second",
@@ -1885,9 +1895,9 @@ func TestDeleteAccount(t *testing.T) {
 	assert.HTTPRequest{
 		Method:       "DELETE",
 		Path:         "/keppel/v1/accounts/test1",
+		Header:       map[string]string{"X-Test-Perms": "view:tenant1,change:tenant1"},
+		ExpectStatus: http.StatusConflict,
 		ExpectBody:   assert.StringData("account is deleting\n"),
-			"error": "account is already set to be deleted",
-		},
 	}.Check(t, h)
 
 	// that didn't touch the DB

internal/api/keppel/api.go

@@ -184,6 +184,10 @@ func (a *API) findAccountFromRequest(w http.ResponseWriter, r *http.Request, _ *
 		http.Error(w, "account not found", http.StatusNotFound)
 		return nil
 	}
+	if account.IsDeleting {
+		http.Error(w, "account is deleting", http.StatusConflict)
+		return nil
+	}
 	return account
 }