add alert for account is locked

app/controllers/users/sessions_controller.rb

@@ -15,9 +15,14 @@ class Users::SessionsController < Sessions::SessionsController
   # POST /resource/sign_in
   def create
     remember_me = params[:user][:remember_me] == '1'
-    try_to_authenticate(User, remember_me)
-    try_to_authenticate(Gestionnaire, remember_me)
-    try_to_authenticate(Administrateur, remember_me)
+
+    if resource_locked?(try_to_authenticate(User, remember_me)) ||
+      resource_locked?(try_to_authenticate(Gestionnaire, remember_me)) ||
+      resource_locked?(try_to_authenticate(Administrateur, remember_me))
+      flash.alert = 'Votre compte est verrouillé.'
+      new
+      return render :new, status: 401
+    end
 
     if user_signed_in?
       current_user.update(loged_in_with_france_connect: nil)
@@ -103,13 +108,16 @@ class Users::SessionsController < Sessions::SessionsController
     resource = klass.find_for_database_authentication(email: params[:user][:email])
 
     if resource.present?
-      if resource.access_locked?
-        if resource.valid_password?(params[:user][:password])
-          resource.remember_me = remember_me
-          sign_in resource
-          resource.force_sync_credentials
-        end
+      if resource.valid_password?(params[:user][:password])
+        resource.remember_me = remember_me
+        sign_in resource
+        resource.force_sync_credentials
       end
     end
+    resource
+  end
+
+  def resource_locked?(resource)
+    resource.present? && resource.access_locked?
   end
 end

config/initializers/devise.rb

@@ -164,7 +164,7 @@ Devise.setup do |config|
   config.lock_strategy = :failed_attempts
 
   # Defines which key will be used when locking and unlocking an account
-  config.unlock_keys = [ :email ]
+  config.unlock_keys = [:email]
 
   # Defines which strategy will be used to unlock an account.
   # :email = Sends an unlock link to the user email