Fix system hook not firing for blocked users when LDAP sign-in is used

An LDAP sign-in request results in a different request parameter than
a standard GitLab sign-in. Since Warden doesn't pass us the user that
was blocked, we first search for a `username` in the request parameters
and then look for `user.login`.

Closes #46307

1 files changed, 27 insertions, 17 deletions

diff --git a/spec/lib/gitlab/auth/blocked_user_tracker_spec.rb b/spec/lib/gitlab/auth/blocked_user_tracker_spec.rb
index 726a3c1c83a..43b68e69131 100644
--- a/spec/lib/gitlab/auth/blocked_user_tracker_spec.rb
+++ b/spec/lib/gitlab/auth/blocked_user_tracker_spec.rb
@@ -17,12 +17,8 @@ describe Gitlab::Auth::BlockedUserTracker do
     end
 
     context 'failed login due to blocked user' do
-      let(:env) do
-        {
-          'warden.options' => { message: User::BLOCKED_MESSAGE },
-          described_class::ACTIVE_RECORD_REQUEST_PARAMS => { 'user' => { 'login' => user.username } }
-        }
-      end
+      let(:base_env) { { 'warden.options' => { message: User::BLOCKED_MESSAGE } } }
+      let(:env) { base_env.merge(request_env) }
 
       subject { described_class.log_if_user_blocked(env) }
 
@@ -30,23 +26,37 @@ describe Gitlab::Auth::BlockedUserTracker do
         expect_any_instance_of(SystemHooksService).to receive(:execute_hooks_for).with(user, :failed_login)
       end
 
-      it 'logs a blocked user' do
-        user.block!
+      context 'via GitLab login' do
+        let(:request_env) { { described_class::ACTIVE_RECORD_REQUEST_PARAMS => { 'user' => { 'login' => user.username } } } }
 
-        expect(subject).to be_truthy
-      end
+        it 'logs a blocked user' do
+          user.block!
+
+          expect(subject).to be_truthy
+        end
 
-      it 'logs a blocked user by e-mail' do
-        user.block!
-        env[described_class::ACTIVE_RECORD_REQUEST_PARAMS]['user']['login'] = user.email
+        it 'logs a blocked user by e-mail' do
+          user.block!
+          env[described_class::ACTIVE_RECORD_REQUEST_PARAMS]['user']['login'] = user.email
 
-        expect(subject).to be_truthy
+          expect(subject).to be_truthy
+        end
       end
 
-      it 'logs a LDAP blocked user' do
-        user.ldap_block!
+      context 'via LDAP login' do
+        let(:request_env) { { described_class::ACTIVE_RECORD_REQUEST_PARAMS => { 'username' => user.username } } }
+
+        it 'logs a blocked user' do
+          user.block!
+
+          expect(subject).to be_truthy
+        end
+
+        it 'logs a LDAP blocked user' do
+          user.ldap_block!
 
-        expect(subject).to be_truthy
+          expect(subject).to be_truthy
+        end
       end
     end
   end