A suspended user returns 403 instead of 500 (#16408)

app/controllers/application_controller.rb

@@ -131,8 +131,11 @@ class ApplicationController < ActionController::Base
     onboarding_path
   end
 
-  def raise_suspended
-    raise SuspendedError if current_user&.suspended?
+  def check_suspended
+    return unless current_user&.suspended?
+
+    response.status = :forbidden
+    render "pages/forbidden"
   end
 
   def internal_navigation?

app/controllers/articles_controller.rb

@@ -3,7 +3,7 @@ class ArticlesController < ApplicationController
 
   before_action :authenticate_user!, except: %i[feed new]
   before_action :set_article, only: %i[edit manage update destroy stats admin_unpublish]
-  before_action :raise_suspended, only: %i[new create update]
+  before_action :check_suspended, only: %i[new create update]
   before_action :set_cache_control_headers, only: %i[feed]
   after_action :verify_authorized
 

app/controllers/listings_controller.rb

@@ -29,7 +29,7 @@ class ListingsController < ApplicationController
   # rubocop:disable Rails/LexicallyScopedActionFilter
   before_action :set_listing, only: %i[edit update destroy]
   before_action :set_cache_control_headers, only: %i[index]
-  before_action :raise_suspended, only: %i[new create update]
+  before_action :check_suspended, only: %i[new create update]
   before_action :authenticate_user!, only: %i[edit update new dashboard]
   after_action :verify_authorized, only: %i[edit update]
   # rubocop:enable Rails/LexicallyScopedActionFilter

app/controllers/users/notification_settings_controller.rb

@@ -1,6 +1,6 @@
 module Users
   class NotificationSettingsController < ApplicationController
-    before_action :raise_suspended
+    before_action :check_suspended
     before_action :authenticate_user!
     after_action :verify_authorized
 

app/controllers/users/settings_controller.rb

@@ -1,6 +1,6 @@
 module Users
   class SettingsController < ApplicationController
-    before_action :raise_suspended
+    before_action :check_suspended
     before_action :authenticate_user!
     after_action :verify_authorized
 

app/controllers/users_controller.rb

@@ -1,6 +1,6 @@
 class UsersController < ApplicationController
   before_action :set_no_cache_header
-  before_action :raise_suspended, only: %i[update update_password]
+  before_action :check_suspended, only: %i[update update_password]
   before_action :set_user,
                 only: %i[update update_password request_destroy full_delete remove_identity]
   # rubocop:disable Layout/LineLength

app/errors/suspended_error.rb

@@ -1 +0,0 @@
-class SuspendedError < StandardError; end

app/views/pages/forbidden.html.erb

@@ -0,0 +1,8 @@
+<h2>Forbidden</h2>
+
+<p>
+  Your account has been suspended and has limited access.
+  Your ability to post and comment may be limited.
+</p>
+
+<p>For more information, you may send a message to <%= ForemInstance.email %>.</p>

config/initializers/honeybadger.rb

@@ -4,7 +4,6 @@
 # rubocop:disable Metrics/BlockLength
 Rails.application.reloader.to_prepare do
   message_fingerprints = {
-    "SuspendedError" => "banned",
     "Rack::Timeout::RequestTimeoutException" => "rack_timeout",
     "Rack::Timeout::RequestTimeoutError" => "rack_timeout",
     "PG::QueryCanceled" => "pg_query_canceled"

spec/initializers/honeybadger_spec.rb

@@ -2,7 +2,6 @@ require "rails_helper"
 
 describe Honeybadger do
   {
-    "SuspendedError" => "banned",
     "Rack::Timeout::RequestTimeoutException" => "rack_timeout",
     "Rack::Timeout::RequestTimeoutError" => "rack_timeout",
     "PG::QueryCanceled" => "pg_query_canceled"

spec/requests/listings_spec.rb

@@ -333,9 +333,10 @@ RSpec.describe "/listings", type: :request do
     context "when user is suspended" do
       it "raises error" do
         user.add_role(:suspended)
-        expect do
-          post "/listings", params: listing_params
-        end.to raise_error(SuspendedError)
+
+        post "/listings", params: listing_params
+
+        expect(response).to have_http_status :forbidden
       end
     end
 

spec/system/banned_user_interactions_spec.rb

@@ -5,6 +5,9 @@ RSpec.describe "Suspended user", type: :system do
 
   it "tries to create an article" do
     sign_in suspended_user
-    expect { visit "/new" }.to raise_error(SuspendedError)
+
+    visit "/new"
+
+    expect(page.status_code).to eq 403
   end
 end