api: don't return deleted users (#52496)

tests/api/test_user.py

@@ -136,6 +136,10 @@ def test_users(pub, local_user):
     resp = get_app(pub).get(sign_uri('/api/users/?q=foobar'))
     assert len(resp.json['data']) == 0
 
+    local_user.set_deleted()
+    resp = get_app(pub).get(sign_uri('/api/users/?q=HELLO'))
+    assert len(resp.json['data']) == 0
+
 
 def test_users_unaccent(pub, local_user):
     local_user.name = 'Jean Sénisme'

wcs/api.py

@@ -953,7 +953,7 @@ class ApiUsersDirectory(Directory):
             # allowed to submit forms (as they have a form to select an user).
             raise AccessForbiddenError('unsigned request or user has no access to backoffice')
 
-        criterias = []
+        criterias = [st.Null('deleted_timestamp')]
         query = get_request().form.get('q')
         if query:
             formdef = UserFieldsFormDef()