Require rejection reason when rejecting a new user

dandiapi/api/templates/dashboard/user_approval.html

@@ -81,15 +81,15 @@ <h5>Last changed: {{ user.metadata.modified }}</h5>
           {% csrf_token %}
           <input type="hidden" name="status" value="REJECTED">
           <button
-            {% if user.metadata.status == 'REJECTED' %}
-              disabled
-            {% endif %}
+            disabled
+            id="rejection_btn"
             class="waves-effect waves-light btn-large red accent-5 mb-5" type="submit">
             <span>REJECT</span>
           </button>
           <br /><br /><br />
           <label for="rejection_reason">Rejection reason (optional)</label>
           <input
+            id="rejection_reason"
             type="text"
             name="rejection_reason"
             value="{% if user.metadata.rejection_reason != None %}{{ user.metadata.rejection_reason }}{% endif %}"
@@ -100,4 +100,18 @@ <h5>Last changed: {{ user.metadata.modified }}</h5>
     </div>
   </div>
 </div>
+
+<script>
+// Event listener that disables the Reject button when no rejection reason is provided
+var rejectionReason = document.getElementById('rejection_reason');
+rejectionReason.addEventListener('keyup', function (event) {
+  var rejection_btn = document.getElementById('rejection_btn');
+  if (event.target.value) {
+    rejection_btn.removeAttribute('disabled');
+  }
+  else {
+    rejection_btn.setAttribute('disabled', true);
+  }
+});
+</script>
 {% endblock %}

dandiapi/api/views/dashboard.py

@@ -1,7 +1,7 @@
 from allauth.socialaccount.models import SocialAccount
 from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
 from django.contrib.auth.models import User
-from django.core.exceptions import PermissionDenied
+from django.core.exceptions import PermissionDenied, ValidationError
 from django.db.models import Exists, OuterRef
 from django.shortcuts import get_object_or_404, render
 from django.views.decorators.http import require_http_methods
@@ -84,7 +84,12 @@ def user_approval_view(request, username: str):
 
     if request.method == 'POST':
         req_body = request.POST.dict()
-        user.metadata.status = req_body.get('status')
+        status = req_body.get('status')
+
+        if status == UserMetadata.Status.REJECTED and not req_body.get('rejection_reason'):
+            raise ValidationError('A rejection reason must be provided to reject a user.')
+
+        user.metadata.status = status
         if req_body.get('rejection_reason') is not None:
             user.metadata.rejection_reason = req_body.get('rejection_reason')
         user.metadata.save()