Make sure group and project creation is blocked for new users that are external by defaultdm-block-group-and-project-creation-when-external-by-default

3 files changed, 11 insertions, 3 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index bcda4564595..38f43ce9d4c 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -164,7 +164,7 @@ class User < ActiveRecord::Base
   before_validation :set_notification_email, if: :email_changed?
   before_validation :set_public_email, if: :public_email_changed?
   before_save :ensure_incoming_email_token
-  before_save :ensure_user_rights_and_limits, if: :external_changed?
+  before_save :ensure_user_rights_and_limits, if: ->(user) { user.new_record? || user.external_changed? }
   before_save :skip_reconfirmation!, if: ->(user) { user.email_changed? && user.read_only_attribute?(:email) }
   before_save :check_for_verified_email, if: ->(user) { user.email_changed? && !user.new_record? }
   after_save :ensure_namespace_correct
diff --git a/changelogs/unreleased/dm-block-group-and-project-creation-when-external-by-default.yml b/changelogs/unreleased/dm-block-group-and-project-creation-when-external-by-default.yml
new file mode 100644
index 00000000000..42bcf9b1edd
--- /dev/null
+++ b/changelogs/unreleased/dm-block-group-and-project-creation-when-external-by-default.yml
@@ -0,0 +1,6 @@
+---
+title: Make sure group and project creation is blocked for new users that are external
+  by default
+merge_request:
+author:
+type: fixed
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index e0896d64c8f..d2f97009ad9 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -788,14 +788,16 @@ describe User do
       end
 
       it "creates external user by default" do
-        user = build(:user)
+        user = create(:user)
 
         expect(user.external).to be_truthy
+        expect(user.can_create_group).to be_falsey
+        expect(user.projects_limit).to be 0
       end
 
       describe 'with default overrides' do
         it "creates a non-external user" do
-          user = build(:user, external: false)
+          user = create(:user, external: false)
 
           expect(user.external).to be_falsey
         end