Deactivated user: Redirect to homepage with flash error when trying to access /admin

[drummer83]

Description

When a deactivated user tries to access an admin page, he/she is redirected to the homepage with the login modal open. Trying to log in there redirects to the homepage without login modal - which feels like the user has successfully logged in, but he/she actually hasn't. He/she can access shops but the checkout flow is broken: Clicking checkout in the cart always takes the user back to the shop with empty cart.

Expected Behavior

When a deactivated user is trying to access an admin page, he/she should be redirected to the homepage with the flash error message as shown below.

Actual Behaviour

The user is redirected to the homepage with login modal but login doesn't work and checkout flow is broken.

Steps to Reproduce

1. As super admin deactivate a user.
2. As deactivated user try to access /admin --> login modal appears
3. Try to login --> homepage opens
4. Try to checkout --> not working

Animated Gif/Screenshot

See above.

Workaround

Severity

bug-s5: we can live with it, only a few users impacted

Your Environment

• Version used: staged 606a56a64de9fd3f6145e45a3d1865e817fcb4de
• Browser name and version: 101.0.1 (64-Bit)
• Operating System and version (desktop or mobile): Desktop Ubuntu 20.04 LTS

Possible Fix

See #9154 for implementation of the deactivation of a user.

[vsmay98]

Hi @drummer83
Can I work on this issue?

[drummer83]

Sure, @vsmay98 and welcome!
I have assigned it to you! Don't hesitate to contact us here or on our Slack in case you get stuck!
Looking forward to your contributions! 😊

[vsmay98]

Hi @drummer83
Do we only need to redirect the user to homepage only when they try to access /admin page? I was thinking of to add redirect to homepage whenever the disabled user tries to access any page.

We have this method to sign out the disabled user and show flash message. So after user sign out we can redirect them to homepage with the flash message.

  def check_disabled_user
    return unless current_spree_user.disabled

    flash[:success] = nil
    flash.now[:error] = I18n.t("devise.failure.disabled")
    sign_out current_spree_user
  end

[RachL]

Hello @vsmay98 yes it's cleaner if we do it for any page rather than just the admin 👍 You can go ahead :)

[vsmay98]

Hello @RachL @drummer83

I have raised a PR #9351, Please review it.

[drummer83]

Thanks for your PR, @vsmay98! It is now in code review by our developers. This may take a few days or so and will probably not happen during the weekend. There seems to be a conflict with another PR #9341. We will get back to you if we need to.
In the meantime feel free to pick another issue and let us know!

Have fun! And thanks again! 😃