Prevent banished users from updating their profiles (#16122)

* Don't update social information for suspended/banished accounts

* Prevent suspended users/accounts from updating their profile information

* Add tests and fix some logic

app/policies/user_policy.rb

@@ -63,7 +63,7 @@ class UserPolicy < ApplicationPolicy
   end
 
   def update?
-    current_user?
+    current_user? && !user_suspended?
   end
 
   def destroy?

app/services/authentication/authenticator.rb

@@ -150,6 +150,8 @@ module Authentication
     end
 
     def update_user(user)
+      return user if user.suspended?
+
       user.tap do |model|
         model.unlock_access! if model.access_locked?
 

spec/policies/user_policy_spec.rb

@@ -23,7 +23,7 @@ RSpec.describe UserPolicy, type: :policy do
     context "with suspended status" do
       before { user.add_role(:suspended) }
 
-      it { is_expected.to forbid_actions(%i[join_org moderation_routes]) }
+      it { is_expected.to forbid_actions(%i[join_org moderation_routes update]) }
     end
   end
 

spec/services/authentication/authenticator_spec.rb

@@ -428,6 +428,15 @@ RSpec.describe Authentication::Authenticator, type: :service do
         tags = hash_including(tags: array_including("error:StandardError"))
         expect(ForemStatsClient).to have_received(:increment).with("identity.errors", tags)
       end
+
+      it "does not update their github_username if the user is suspended" do
+        new_username = "new_username#{rand(1000)}"
+        auth_payload.info.nickname = new_username
+        user.add_role :suspended
+
+        user = described_class.call(auth_payload)
+        expect(user.github_username).not_to eq(new_username)
+      end
     end
 
     describe "user already logged in" do
@@ -707,6 +716,15 @@ RSpec.describe Authentication::Authenticator, type: :service do
           user.profile_updated_at.to_i > original_profile_updated_at.to_i,
         ).to be(true)
       end
+
+      it "does not update their twitter_username if the user is suspended" do
+        new_username = "new_username#{rand(1000)}"
+        auth_payload.info.nickname = new_username
+        user.add_role :suspended
+
+        user = described_class.call(auth_payload)
+        expect(user.github_username).not_to eq(new_username)
+      end
     end
 
     describe "user already logged in" do