Add worker to call the Users::ApproveService

If the :admin_new_user_signups_cap feature is enabled and the cap is
increased by an admin, users in blocked_pending_approval state should
be auto approved.

config/sidekiq_queues.yml

@@ -32,6 +32,8 @@
   - 1
 - - analytics_instance_statistics_counter_job
   - 1
+- - approve_blocked_users
+  - 1
 - - authorized_keys
   - 2
 - - authorized_project_update

ee/app/services/ee/application_settings/update_service.rb

@@ -15,10 +15,13 @@ module EE
         elasticsearch_namespace_ids = params.delete(:elasticsearch_namespace_ids)
         elasticsearch_project_ids = params.delete(:elasticsearch_project_ids)
 
+        previous_user_cap = application_setting.new_user_signups_cap
+
         if result = super
           find_or_create_index
           update_elasticsearch_containers(ElasticsearchIndexedNamespace, elasticsearch_namespace_ids)
           update_elasticsearch_containers(ElasticsearchIndexedProject, elasticsearch_project_ids)
+          auto_approve_blocked_users(previous_user_cap)
         end
 
         result
@@ -40,6 +43,17 @@ module EE
         new_container_ids.each { |id| klass.create!(klass.target_attr_name => id) }
       end
 
+      def auto_approve_blocked_users(previous_user_cap)
+        return if ::Feature.disabled?(:admin_new_user_signups_cap)
+        return if previous_user_cap.nil?
+
+        current_user_cap = application_setting.new_user_signups_cap
+
+        if current_user_cap.nil? || current_user_cap > previous_user_cap
+          ApproveBlockedUsersWorker.perform_async(current_user.id)
+        end
+      end
+
       private
 
       def find_or_create_index

ee/app/workers/all_queues.yml

@@ -597,6 +597,14 @@
   :weight: 1
   :idempotent: true
   :tags: []
+- :name: approve_blocked_users
+  :feature_category: :users
+  :has_external_dependencies:
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent: true
+  :tags: []
 - :name: ci_batch_reset_minutes
   :feature_category: :continuous_integration
   :has_external_dependencies:

ee/app/workers/approve_blocked_users_worker.rb

+# frozen_string_literal: true
+
+class ApproveBlockedUsersWorker
+  include ApplicationWorker
+
+  idempotent!
+
+  feature_category :users
+
+  def perform(current_user_id)
+    current_user = User.find(current_user_id)
+
+    User.blocked_pending_approval.find_each do |user|
+      Users::ApproveService.new(current_user).execute(user)
+    end
+  end
+end

ee/spec/services/application_settings/update_service_spec.rb

@@ -164,5 +164,71 @@ RSpec.describe ApplicationSettings::UpdateService do
         end
       end
     end
+
+    context 'user cap setting' do
+      shared_examples 'worker is not called' do
+        it 'does not call ApproveBlockedUsersWorker' do
+          expect(ApproveBlockedUsersWorker).not_to receive(:perform_async)
+
+          service.execute
+        end
+      end
+
+      shared_examples 'worker is called' do
+        it 'calls ApproveBlockedUsersWorker' do
+          expect(ApproveBlockedUsersWorker).to receive(:perform_async)
+
+          service.execute
+        end
+      end
+
+      context 'when new user cap is set to nil' do
+        context 'when changing new user cap to any number' do
+          let(:opts) { { new_user_signups_cap: 10 } }
+
+          include_examples 'worker is not called'
+        end
+
+        context 'when leaving new user cap set to nil' do
+          let(:opts) { { new_user_signups_cap: nil } }
+
+          include_examples 'worker is not called'
+        end
+      end
+
+      context 'when new user cap is set to a number' do
+        let(:setting) do
+          build(:application_setting, new_user_signups_cap: 10)
+        end
+
+        context 'when decreasing new user cap' do
+          let(:opts) { { new_user_signups_cap: 8 } }
+
+          include_examples 'worker is not called'
+        end
+
+        context 'when increasing new user cap' do
+          let(:opts) { { new_user_signups_cap: 15 } }
+
+          include_examples 'worker is called'
+        end
+
+        context 'when changing user cap to nil' do
+          let(:opts) { { new_user_signups_cap: nil } }
+
+          include_examples 'worker is called'
+        end
+      end
+
+      context 'when feature is disabled' do
+        let(:opts) { { new_user_signups_cap: 10 } }
+
+        before do
+          stub_feature_flags(admin_new_user_signups_cap: false)
+        end
+
+        include_examples 'worker is not called'
+      end
+    end
   end
 end

ee/spec/workers/approve_blocked_users_worker_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe ApproveBlockedUsersWorker, type: :worker do
+  let_it_be(:admin) { create(:admin) }
+  let_it_be(:active_user) { create(:user) }
+  let_it_be(:blocked_user) { create(:user, state: 'blocked_pending_approval') }
+
+  describe '#perform' do
+    subject do
+      described_class.new.perform(admin.id)
+    end
+
+    it 'calls ApproveService for users in blocked_pending_approval state' do
+      expect_next_instance_of(Users::ApproveService, admin) do |service|
+        expect(service).to receive(:execute).with(blocked_user)
+      end
+
+      subject
+    end
+
+    it 'does not call ApproveService for active users' do
+      expect_next_instance_of(Users::ApproveService, admin) do |service|
+        expect(service).not_to receive(:execute).with(active_user)
+      end
+
+      subject
+    end
+  end
+end