4 files changed, 68 insertions, 18 deletions
diff --git a/app/services/users/ban_service.rb b/app/services/users/ban_service.rb
index 247ed14966b..88e92ebff9b 100644
--- a/app/services/users/ban_service.rb
+++ b/app/services/users/ban_service.rb
@@ -1,25 +1,15 @@
 # frozen_string_literal: true
 
 module Users
-  class BanService < BaseService
-    def initialize(current_user)
-      @current_user = current_user
-    end
+  class BanService < BannedUserBaseService
+    private
 
-    def execute(user)
-      if user.ban
-        log_event(user)
-        success
-      else
-        messages = user.errors.full_messages
-        error(messages.uniq.join('. '))
-      end
+    def update_user(user)
+      user.ban
     end
 
-    private
-
-    def log_event(user)
-      Gitlab::AppLogger.info(message: "User banned", user: "#{user.username}", email: "#{user.email}", banned_by: "#{current_user.username}", ip_address: "#{current_user.current_sign_in_ip}")
+    def action
+      :ban
     end
   end
 end
diff --git a/app/services/users/banned_user_base_service.rb b/app/services/users/banned_user_base_service.rb
new file mode 100644
index 00000000000..16041075941
--- /dev/null
+++ b/app/services/users/banned_user_base_service.rb
@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Users
+  class BannedUserBaseService < BaseService
+    def initialize(current_user)
+      @current_user = current_user
+    end
+
+    def execute(user)
+      return permission_error unless allowed?
+
+      if update_user(user)
+        log_event(user)
+        success
+      else
+        messages = user.errors.full_messages
+        error(messages.uniq.join('. '))
+      end
+    end
+
+    private
+
+    attr_reader :current_user
+
+    def allowed?
+      can?(current_user, :admin_all_resources)
+    end
+
+    def permission_error
+      error(_("You are not allowed to %{action} a user" % { action: action.to_s }), :forbidden)
+    end
+
+    def log_event(user)
+      Gitlab::AppLogger.info(message: "User #{action}", user: "#{user.username}", email: "#{user.email}", "#{action}_by": "#{current_user.username}", ip_address: "#{current_user.current_sign_in_ip}")
+    end
+  end
+end
diff --git a/app/services/users/set_status_service.rb b/app/services/users/set_status_service.rb
index 2b4be8c833b..d0bb40cbcfb 100644
--- a/app/services/users/set_status_service.rb
+++ b/app/services/users/set_status_service.rb
@@ -28,11 +28,12 @@ module Users
       params[:emoji] = UserStatus::DEFAULT_EMOJI if params[:emoji].blank?
       params[:availability] = UserStatus.availabilities[:not_set] unless new_user_availability
 
-      user_status.update(params)
+      bump_user if user_status.update(params)
     end
 
     def remove_status
-      UserStatus.delete(target_user.id)
+      bump_user if UserStatus.delete(target_user.id).nonzero?
+      true
     end
 
     def user_status
@@ -48,5 +49,12 @@ module Users
     def new_user_availability
       UserStatus.availabilities[params[:availability]]
     end
+
+    def bump_user
+      # Intentionally not calling `touch` as that will trigger other callbacks
+      # on target_user (e.g. after_touch, after_commit, after_rollback) and we
+      # don't need them to happen here.
+      target_user.update_column(:updated_at, Time.current)
+    end
   end
 end
diff --git a/app/services/users/unban_service.rb b/app/services/users/unban_service.rb
new file mode 100644
index 00000000000..363783cf240
--- /dev/null
+++ b/app/services/users/unban_service.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Users
+  class UnbanService < BannedUserBaseService
+    private
+
+    def update_user(user)
+      user.activate
+    end
+
+    def action
+      :unban
+    end
+  end
+end