Prevent login of non-regular users

Author: Taucher2003

app/policies/global_policy.rb

@@ -3,6 +3,7 @@
 class GlobalPolicy < BasePolicy
   condition(:organization_creation_restricted) { ApplicationSetting.current[:organization_creation_restricted] }
   condition(:admin) { user&.admin }
+  condition(:user_is_regular) { user&.regular? }
 
   rule { ~anonymous }.enable :create_organization
   rule { organization_creation_restricted & ~admin }.prevent :create_organization
@@ -15,6 +16,8 @@ class GlobalPolicy < BasePolicy
     enable :read_velorum_config
   end
 
+  rule { user_is_regular }.enable :create_user_session
+
   rule { admin }.policy do
     enable :read_application_setting
     enable :update_application_setting

app/services/users/identity/login_service.rb

@@ -50,6 +50,16 @@ def execute
                                                          details: user_session.errors)
           end
 
+          unless Ability.allowed?(Sagittarius::Authentication.new(:session, user_session), :create_user_session)
+            logger.warn(
+              message: 'User was not allowed to create user session',
+              user_id: user.id,
+              username: user.username
+            )
+            t.rollback_and_return! ServiceResponse.error(message: 'Not allowed to create user session',
+                                                         error_code: :invalid_login_data)
+          end
+
           AuditService.audit(
             :user_logged_in,
             author_id: user.id,

app/services/users/login_service.rb

@@ -45,6 +45,12 @@ def execute
                                                        details: user_session.errors)
         end
 
+        unless Ability.allowed?(Sagittarius::Authentication.new(:session, user_session), :create_user_session)
+          logger.warn(message: 'User was not allowed to create user session', user_id: user.id, username: user.username)
+          t.rollback_and_return! ServiceResponse.error(message: 'Not allowed to create user session',
+                                                       error_code: :invalid_login_data)
+        end
+
         AuditService.audit(
           :user_logged_in,
           author_id: user.id,

spec/services/users/identity/login_service_spec.rb

@@ -56,6 +56,18 @@ def setup_identity_provider(identity)
         expect(service_response.payload[:error_code]).to eq(:user_blocked)
       end
     end
+
+    context 'when user is ghost' do
+      before do
+        current_user.update!(user_type: :ghost)
+      end
+
+      it do
+        is_expected.not_to create_audit_event
+        expect(service_response).to be_error
+        expect(service_response.payload[:error_code]).to eq(:invalid_login_data)
+      end
+    end
   end
 
   context 'when user identity validation fails' do

spec/services/users/login_service_spec.rb

@@ -67,6 +67,20 @@
       end
     end
 
+    context 'when user is ghost' do
+      let(:params) { { username: username, password: password } }
+
+      before do
+        current_user.update!(user_type: :ghost)
+      end
+
+      it 'returns an error response' do
+        expect(service_response).to be_error
+        expect(service_response.payload[:error_code]).to eq(:invalid_login_data)
+        is_expected.not_to create_audit_event
+      end
+    end
+
     context 'when using mfa' do
       context 'when mfa is not activated' do
         let(:params) do