Make articles from a user with spam role inaccessible (direct access) (#20515)

* Make articles inaccessible if their author has spam role

* Improve specs a bit for showing spammer articles

app/controllers/stories_controller.rb

@@ -262,6 +262,7 @@ class StoriesController < ApplicationController
   def assign_article_show_variables
     not_found if permission_denied?
     not_found unless @article.user
+    not_found if @article.user.spam?
 
     @pinned_article_id = PinnedArticle.id
 

spec/requests/articles/articles_show_spec.rb

@@ -129,6 +129,25 @@ RSpec.describe "ArticlesShow" do
     end
   end
 
+  context "when author has spam role" do
+    before do
+      article.user.add_role(:spam)
+    end
+
+    it "renders 404" do
+      expect do
+        get article.path
+      end.to raise_error(ActiveRecord::RecordNotFound)
+    end
+
+    it "renders 404 for authorized user" do
+      sign_in user
+      expect do
+        get article.path
+      end.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
   context "when user signed in" do
     before do
       sign_in user