Merge branch 'sk/250667-fix-block-user-api' into 'master'

Fix 500 error in block user API for internal user

See merge request gitlab-org/gitlab!43461

app/services/users/block_service.rb

@@ -7,6 +7,8 @@ module Users
     end
 
     def execute(user)
+      return error('An internal user cannot be blocked', 403) if user.internal?
+
       if user.block
         after_block_hook(user)
         success

app/views/admin/users/show.html.haml

@@ -182,7 +182,7 @@
               %li Access Git repositories
             %br
             = link_to 'Unblock user', unblock_admin_user_path(@user), method: :put, class: "btn gl-button btn-info", data: { confirm: 'Are you sure?' }
-      - else
+      - elsif !@user.internal?
         .card.border-warning
           .card-header.bg-warning.text-white
             Block this user

changelogs/unreleased/sk-250667-fix-block-user-api.yml

+---
+title: Fix 500 error in block user API for internal user
+merge_request: 43461
+author: Sashi Kumar
+type: fixed

doc/api/users.md

@@ -1210,7 +1210,9 @@ Returns:
 
 - `201 OK` on success.
 - `404 User Not Found` if user cannot be found.
-- `403 Forbidden` when trying to block an already blocked user by LDAP synchronization.
+- `403 Forbidden` when trying to block:
+  - A user that is blocked through LDAP.
+  - An internal user.
 
 ## Unblock user
 

spec/requests/api/users_spec.rb

@@ -2524,6 +2524,15 @@ RSpec.describe API::Users, :do_not_mock_admin_mode do
       expect(json_response['message']).to eq('404 User Not Found')
     end
 
+    it 'returns a 403 error if user is internal' do
+      internal_user = create(:user, :bot)
+
+      post api("/users/#{internal_user.id}/block", admin)
+
+      expect(response).to have_gitlab_http_status(:forbidden)
+      expect(json_response['message']).to eq('An internal user cannot be blocked')
+    end
+
     it 'returns a 201 if user is already blocked' do
       post api("/users/#{blocked_user.id}/block", admin)
 

spec/services/users/block_service_spec.rb

@@ -34,5 +34,15 @@ RSpec.describe Users::BlockService do
         expect { operation }.not_to change { user.state }
       end
     end
+
+    context 'when internal user' do
+      let(:user) { create(:user, :bot) }
+
+      it 'returns error result' do
+        expect(operation[:status]).to eq(:error)
+        expect(operation[:message]).to eq('An internal user cannot be blocked')
+        expect(operation[:http_status]).to eq(403)
+      end
+    end
   end
 end