feat(user): block login when .. blocked

app/models/user.rb

@@ -267,6 +267,10 @@ class User < ApplicationRecord
     devise_mailer.send(notification, self, *args).deliver_later
   end
 
+  def active_for_authentication?
+    super && blocked_at.nil?
+  end
+
   private
 
   def does_not_merge_on_self

spec/system/users/sign_up_spec.rb

@@ -142,4 +142,17 @@ describe 'Signing up:' do
       expect(page).to have_current_path new_user_session_path
     end
   end
+
+  context 'when the user already has a confirmed account but is blocked' do
+    before do
+      create(:user, email: user_email, password: user_password, blocked_at: Time.current)
+    end
+
+    scenario 'they cannot signed in' do
+      visit new_user_session_path
+      sign_in_with user_email, user_password
+
+      expect(page).to have_current_path new_user_session_path
+    end
+  end
 end