diff --git a/app/services/users/ban_service.rb b/app/services/users/ban_service.rb index 959d4be37956c185afca0d435cfe98147f8fcd62..5ed31cdb778f84757377b4f0099dbd8e21602328 100644 --- a/app/services/users/ban_service.rb +++ b/app/services/users/ban_service.rb @@ -17,3 +17,5 @@ def action end end end + +Users::BanService.prepend_mod_with('Users::BanService') diff --git a/ee/app/services/ee/users/ban_service.rb b/ee/app/services/ee/users/ban_service.rb new file mode 100644 index 0000000000000000000000000000000000000000..f5958fbd4800be49ce4cfed0c960662592e2e26f --- /dev/null +++ b/ee/app/services/ee/users/ban_service.rb @@ -0,0 +1,31 @@ +# frozen_string_literal: true + +module EE + module Users + module BanService + extend ::Gitlab::Utils::Override + + override :update_user + def update_user(user) + super.tap do |result| + log_audit_event(user) if result.present? + end + end + + private + + def log_audit_event(user) + audit_context = { + name: "ban_user", + author: current_user, + scope: user, + target: user, + target_details: user.username, + message: "Banned user" + } + + ::Gitlab::Audit::Auditor.audit(audit_context) + end + end + end +end diff --git a/ee/config/audit_events/types/ban_user.yml b/ee/config/audit_events/types/ban_user.yml new file mode 100644 index 0000000000000000000000000000000000000000..d8efb65c4766351d0654e3387c6d4a55d10fd1c3 --- /dev/null +++ b/ee/config/audit_events/types/ban_user.yml @@ -0,0 +1,8 @@ +name: ban_user +description: Event triggered on user ban action +introduced_by_issue: https://gitlab.com/gitlab-org/gitlab/-/issues/377620 +introduced_by_mr: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/116103 +feature_category: "user_management" +milestone: "15.11" +saved_to_database: true +streamed: true \ No newline at end of file diff --git a/ee/spec/services/ee/users/ban_service_spec.rb b/ee/spec/services/ee/users/ban_service_spec.rb new file mode 100644 index 0000000000000000000000000000000000000000..a78bf84bd21768a7d226ba76fef4c58ca60e32af --- /dev/null +++ b/ee/spec/services/ee/users/ban_service_spec.rb @@ -0,0 +1,62 @@ +# frozen_string_literal: true + +require 'spec_helper' + +RSpec.describe Users::BanService, feature_category: :user_management do + let_it_be(:current_user) { create(:admin) } + + subject(:service) { described_class.new(current_user) } + + describe '#execute' do + let!(:user) { create(:user) } + + subject(:operation) { service.execute(user) } + + describe 'audit events' do + context 'when licensed', :enable_admin_mode do + before do + stub_licensed_features(admin_audit_log: true) + end + + context 'when user ban operation succeeds' do + it 'logs an audit event' do + expect { operation }.to change { AuditEvent.count }.by(1) + end + + it 'logs the audit event info' do + operation + expect(AuditEvent.last).to have_attributes( + details: hash_including(custom_message: 'Banned user') + ) + end + end + + context 'when user ban operation fails' do + let!(:user) { create(:user) } + + before do + allow(user).to receive(:ban).and_return(false) + end + + it 'does not log any audit event' do + expect { operation }.not_to change { AuditEvent.count } + end + end + end + + context 'when not licensed' do + before do + stub_licensed_features( + admin_audit_log: false, + audit_events: false, + extended_audit_events: false + ) + end + + it 'does not log any audit event' do + expect { operation }.not_to change { AuditEvent.count } + end + end + end + end +end