Merge pull request #1123 from code0-tech/#529-user-moderation

raphael-goetz · web-flow · commit 4b009196babc · 2026-07-10T10:19:20.000+02:00
added user moderation
diff --git a/app/channels/application_cable/channel.rb b/app/channels/application_cable/channel.rb
@@ -23,7 +23,8 @@ def find_authentication(authorization)
     def create_authentication(token_type, token)
       case token_type
       when 'Session'
-        Sagittarius::Authentication.new(:session, UserSession.find_by(token: token, active: true))
+        Sagittarius::Authentication.new(:session, UserSession.joins(:user).find_by(token: token, active: true,
+                                                                                   users: { blocked_at: nil }))
       else
         Sagittarius::Authentication.new(:invalid, nil)
       end
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
@@ -16,7 +16,8 @@ def find_authentication(authorization)
   def create_authentication(token_type, token)
     case token_type
     when 'Session'
-      Sagittarius::Authentication.new(:session, UserSession.find_by(token: token, active: true))
+      Sagittarius::Authentication.new(:session, UserSession.joins(:user).find_by(token: token, active: true,
+                                                                                 users: { blocked_at: nil }))
     else
       Sagittarius::Authentication.new(:invalid, nil)
     end
diff --git a/app/graphql/mutations/users/update.rb b/app/graphql/mutations/users/update.rb
@@ -12,6 +12,7 @@ class Update < BaseMutation
                description: 'ID of the user to update.'
 
       argument :admin, Boolean, required: false, description: 'New global admin status for the user.'
+      argument :blocked, Boolean, required: false, description: 'New blocked status for the user.'
       argument :email, String, required: false, description: 'New email for the user.'
       argument :firstname, String, required: false, description: 'New firstname for the user.'
       argument :lastname, String, required: false, description: 'New lastname for the user.'
diff --git a/app/graphql/types/user_type.rb b/app/graphql/types/user_type.rb
@@ -12,6 +12,11 @@ class UserType < Types::BaseObject
           null: true,
           description: 'Global admin status of the user',
           authorize: :read_admin_status
+    field :blocked, Boolean,
+          null: true,
+          description: 'Whether the user is blocked from accessing the application',
+          authorize: :read_admin_status,
+          method: :blocked?
     field :email, String, null: true, description: 'Email of the user', authorize: :read_email
     field :email_verified_at, Types::TimeType,
           null: true,
diff --git a/app/models/user.rb b/app/models/user.rb
@@ -39,6 +39,10 @@ def admin?
     admin
   end
 
+  def blocked?
+    blocked_at.present?
+  end
+
   def validate_mfa!(mfa)
     mfa_passed = false
     mfa_type = mfa&.[](:type)
diff --git a/app/services/error_code.rb b/app/services/error_code.rb
@@ -32,6 +32,7 @@ def self.error_codes
       mfa_failed: { description: 'Invalid MFA data provided' },
       mfa_required: { description: 'MFA is required' },
       invalid_login_data: { description: 'Invalid login data provided' },
+      user_blocked: { description: 'The user is blocked from accessing the application' },
       totp_secret_already_set: { description: 'This user already has TOTP set up' },
       invalid_totp_secret: { description: 'The TOTP secret is invalid or cannot be verified' },
       wrong_totp: { description: 'Invalid TOTP code provided' },
@@ -45,6 +46,8 @@ def self.error_codes
       invalid_password_repeat: { description: 'The provided password repeat does not match the password' },
       cannot_modify_admin: { description: 'Only administrators can modify admin status of users' },
       cannot_modify_own_admin: { description: 'Users cannot modify their own admin status' },
+      cannot_moderate_user: { description: 'Only administrators can modify moderation status of users' },
+      cannot_modify_own_blocked_status: { description: 'Users cannot modify their own blocked status' },
       user_not_found: { description: 'The user with the given identifier was not found' },
       invalid_user_identity: { description: 'The user identity is invalid because of active model errors' },
       invalid_user_session: { description: 'The user session is invalid because of active model errors' },
diff --git a/app/services/users/identity/login_service.rb b/app/services/users/identity/login_service.rb
@@ -36,6 +36,12 @@ def execute
 
         user = user_identity.user
 
+        if user.blocked?
+          logger.info(message: 'Blocked user tried to login via identity', user_id: user.id, username: user.username,
+                      provider_id: user_identity.provider_id)
+          return ServiceResponse.error(message: 'User is blocked', error_code: :user_blocked)
+        end
+
         transactional do |t|
           user_session = UserSession.create(user: user)
           unless user_session.persisted?
diff --git a/app/services/users/login_service.rb b/app/services/users/login_service.rb
@@ -19,6 +19,11 @@ def execute
         return ServiceResponse.error(message: 'Invalid login data', error_code: :invalid_login_data)
       end
 
+      if user.blocked?
+        logger.info(message: 'Blocked user tried to login', user_id: user.id, username: user.username)
+        return ServiceResponse.error(message: 'User is blocked', error_code: :user_blocked)
+      end
+
       transactional do |t|
         if mfa.present? && !user.mfa_enabled?
           t.rollback_and_return! ServiceResponse.error(message: 'Tried to login via MFA even if mfa is disabled',
diff --git a/app/services/users/update_service.rb b/app/services/users/update_service.rb
@@ -34,6 +34,18 @@ def execute
         end
       end
 
+      if params.key?(:blocked)
+        unless current_authentication.user.admin?
+          return ServiceResponse.error(message: 'Cannot modify users moderation status because user isn`t admin',
+                                       error_code: :cannot_moderate_user)
+        end
+
+        if current_authentication.user == user
+          return ServiceResponse.error(message: 'Cannot modify own blocked status',
+                                       error_code: :cannot_modify_own_blocked_status)
+        end
+      end
+
       transactional do |t|
         mfa_type = nil
         if params.keys.intersect?(REQUIRES_MFA_FIELDS) && user.mfa_enabled? # is "critical" field
@@ -52,7 +64,10 @@ def execute
           end
         end
 
-        success = user.update(params)
+        update_params = params.except(:blocked)
+        update_params[:blocked_at] = params[:blocked] ? Time.zone.now : nil if params.key?(:blocked)
+
+        success = user.update(update_params)
         unless success
           t.rollback_and_return! ServiceResponse.error(
             message: 'Failed to update user',
diff --git a/db/migrate/20260709120000_add_blocked_at_to_user.rb b/db/migrate/20260709120000_add_blocked_at_to_user.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddBlockedAtToUser < Code0::ZeroTrack::Database::Migration[1.0]
+  def change
+    add_column :users, :blocked_at, :datetime_with_timezone
+  end
+end
diff --git a/db/schema_migrations/20260709120000 b/db/schema_migrations/20260709120000
@@ -0,0 +1 @@
+44c4c37556cf0ad71c2d513d41beb2418ee79de270cbcab149e679ca0a5a9876
diff --git a/db/structure.sql b/db/structure.sql
@@ -1164,6 +1164,7 @@ CREATE TABLE users (
     totp_secret text,
     email_verified_at timestamp with time zone,
     readme text,
+    blocked_at timestamp with time zone,
     CONSTRAINT check_11461c37fb CHECK ((char_length(readme) <= 5000)),
     CONSTRAINT check_3bedaaa612 CHECK ((char_length(email) <= 255)),
     CONSTRAINT check_56606ce552 CHECK ((char_length(username) <= 50)),
diff --git a/docs/graphql/enum/errorcodeenum.md b/docs/graphql/enum/errorcodeenum.md
@@ -7,8 +7,10 @@ Represents the available error responses
 | Value | Description |
 |-------|-------------|
 | `CANNOT_DELETE_LAST_ADMIN_ROLE` | This action would remove the last administrative role |
+| `CANNOT_MODERATE_USER` | Only administrators can modify moderation status of users |
 | `CANNOT_MODIFY_ADMIN` | Only administrators can modify admin status of users |
 | `CANNOT_MODIFY_OWN_ADMIN` | Users cannot modify their own admin status |
+| `CANNOT_MODIFY_OWN_BLOCKED_STATUS` | Users cannot modify their own blocked status |
 | `CANNOT_REMOVE_LAST_ADMINISTRATOR` | This action would remove the last administrator |
 | `CANNOT_REMOVE_LAST_ADMIN_ABILITY` | This action would remove the last administrative ability |
 | `CYCLIC_DATA_TYPE_REFERENCE` | A data type dependency cycle was detected |
@@ -99,6 +101,7 @@ Represents the available error responses
 | `TOTP_SECRET_ALREADY_SET` | This user already has TOTP set up |
 | `UNMODIFIABLE_FIELD` | The user is not permitted to modify this field |
 | `UNSUPPORTED_AUTHENTICATION` | The current authentication is not supported for this operation |
+| `USER_BLOCKED` | The user is blocked from accessing the application |
 | `USER_NOT_FOUND` | The user with the given identifier was not found |
 | `USER_SESSION_NOT_FOUND` | The user session with the given identifier was not found |
 | `WRONG_TOTP` | Invalid TOTP code provided |
diff --git a/docs/graphql/mutation/usersupdate.md b/docs/graphql/mutation/usersupdate.md
@@ -9,6 +9,7 @@ Update an existing user.
 | Name | Type | Description |
 |------|------|-------------|
 | `admin` | [`Boolean`](../scalar/boolean.md) | New global admin status for the user. |
+| `blocked` | [`Boolean`](../scalar/boolean.md) | New blocked status for the user. |
 | `clientMutationId` | [`String`](../scalar/string.md) | A unique identifier for the client performing the mutation. |
 | `email` | [`String`](../scalar/string.md) | New email for the user. |
 | `firstname` | [`String`](../scalar/string.md) | New firstname for the user. |
diff --git a/docs/graphql/object/user.md b/docs/graphql/object/user.md
@@ -10,6 +10,7 @@ Represents a user
 |------|------|-------------|
 | `admin` | [`Boolean`](../scalar/boolean.md) | Global admin status of the user |
 | `avatarPath` | [`String`](../scalar/string.md) | The avatar if present of the user |
+| `blocked` | [`Boolean`](../scalar/boolean.md) | Whether the user is blocked from accessing the application |
 | `createdAt` | [`Time!`](../scalar/time.md) | Time when this User was created |
 | `email` | [`String`](../scalar/string.md) | Email of the user |
 | `emailVerifiedAt` | [`Time`](../scalar/time.md) | Email verification date of the user if present |
diff --git a/spec/factories/users.rb b/spec/factories/users.rb
@@ -18,6 +18,10 @@
       admin { true }
     end
 
+    trait :blocked do
+      blocked_at { Time.zone.now }
+    end
+
     trait :with_namespace do
       after :build, &:ensure_namespace
     end
diff --git a/spec/graphql/types/user_type_spec.rb b/spec/graphql/types/user_type_spec.rb
@@ -13,6 +13,7 @@
       lastname
       readme
       admin
+      blocked
       namespaceMemberships
       avatarPath
       emailVerifiedAt
diff --git a/spec/requests/graphql/mutation/users/update_spec.rb b/spec/requests/graphql/mutation/users/update_spec.rb
@@ -15,6 +15,7 @@
             username
             readme
             admin
+            blocked
           }
         }
       }
@@ -151,6 +152,32 @@
     end
   end
 
+  context 'when admin updates blocked status' do
+    let(:current_user) { create(:user, :admin) }
+    let(:user) { create(:user) }
+    let(:input) do
+      {
+        userId: user.to_global_id.to_s,
+        blocked: true,
+      }
+    end
+
+    it 'blocks the user' do
+      expect(graphql_data_at(:users_update, :user, :blocked)).to be(true)
+      expect(user.reload).to be_blocked
+
+      is_expected.to create_audit_event(
+        :user_updated,
+        author_id: current_user.id,
+        entity_id: user.id,
+        entity_type: 'User',
+        details: { blocked: true },
+        target_id: user.id,
+        target_type: 'User'
+      )
+    end
+  end
+
   context 'when user name is taken' do
     let(:existing_user) { create(:user) }
     let(:input) do
diff --git a/spec/requests/graphql_spec.rb b/spec/requests/graphql_spec.rb
@@ -158,6 +158,15 @@
         expect(graphql_data_at(:echo, :message)).to eq(echo_message)
       end
     end
+
+    context 'when user is blocked' do
+      let(:user_session) { create(:user_session, user: create(:user, :blocked)) }
+
+      it 'returns unauthorized' do
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.body).to be_empty
+      end
+    end
   end
 
   context 'with invalid authorization' do
diff --git a/spec/services/users/identity/login_service_spec.rb b/spec/services/users/identity/login_service_spec.rb
@@ -44,6 +44,18 @@ def setup_identity_provider(identity)
       expect(service_response.payload.user.id).to eq(current_user.id)
       expect(service_response.payload.token).to be_present
     end
+
+    context 'when user is blocked' do
+      before do
+        current_user.update!(blocked_at: Time.zone.now)
+      end
+
+      it do
+        is_expected.not_to create_audit_event
+        expect(service_response).to be_error
+        expect(service_response.payload[:error_code]).to eq(:user_blocked)
+      end
+    end
   end
 
   context 'when user identity validation fails' do
diff --git a/spec/services/users/login_service_spec.rb b/spec/services/users/login_service_spec.rb
@@ -53,6 +53,20 @@
       it_behaves_like 'creates correct audit event', :username, :email
     end
 
+    context 'when user is blocked' do
+      let(:params) { { username: username, password: password } }
+
+      before do
+        current_user.update!(blocked_at: Time.zone.now)
+      end
+
+      it 'returns an error response' do
+        expect(service_response).to be_error
+        expect(service_response.payload[:error_code]).to eq(:user_blocked)
+        is_expected.not_to create_audit_event
+      end
+    end
+
     context 'when using mfa' do
       context 'when mfa is not activated' do
         let(:params) do
diff --git a/spec/services/users/update_service_spec.rb b/spec/services/users/update_service_spec.rb
@@ -119,6 +119,74 @@
       end
     end
 
+    context 'when user tries to update blocked status' do
+      subject(:service_response) { described_class.new(create_authentication(current_user), user, mfa, params).execute }
+
+      let(:params) do
+        { blocked: true }
+      end
+      let(:user) { create(:user) }
+
+      context 'when user is admin' do
+        let(:current_user) { create(:user, :admin) }
+
+        it { is_expected.to be_success }
+
+        it 'updates user' do
+          expect { service_response }.to change { user.reload.blocked? }.from(false).to(true)
+        end
+
+        it do
+          is_expected.to create_audit_event(
+            :user_updated,
+            author_id: current_user.id,
+            entity_type: 'User',
+            details: { blocked: true },
+            target_type: 'User'
+          )
+        end
+
+        context 'when unblocking user' do
+          let(:params) do
+            { blocked: false }
+          end
+          let(:user) { create(:user, :blocked) }
+
+          it 'updates user' do
+            expect { service_response }.to change { user.reload.blocked? }.from(true).to(false)
+          end
+        end
+
+        context 'when user is trying to block itself' do
+          let(:user) { current_user }
+
+          it { is_expected.not_to be_success }
+
+          it 'does not update user' do
+            expect { service_response }.not_to change { user.reload.blocked? }
+          end
+
+          it do
+            is_expected.not_to create_audit_event
+          end
+        end
+      end
+
+      context 'when user is not admin' do
+        let(:current_user) { create(:user) }
+
+        it { is_expected.not_to be_success }
+
+        it 'does not update user' do
+          expect { service_response }.not_to change { user.reload.blocked? }
+        end
+
+        it do
+          is_expected.not_to create_audit_event
+        end
+      end
+    end
+
     context 'when updating mfa required fields' do
       let(:params) do
         { email: generate(:email) }
