Add support for admin lockout

db/migrate/20220310120127_add_lockable_fields2.rb

@@ -0,0 +1,10 @@
+class AddLockableFields2 < ActiveRecord::Migration[7.0]
+  def change
+    change_table :admin_users, bulk: true do |t|
+      t.column :failed_attempts, :integer, default: 0
+      t.column :unlock_token, :string
+      t.column :locked_at, :datetime
+    end
+    add_index :admin_users, :unlock_token, unique: true
+  end
+end

db/schema.rb

@@ -36,7 +36,11 @@ ActiveRecord::Schema[7.0].define(version: 202202071123100) do
     t.datetime "last_sign_in_at", precision: nil
     t.string "current_sign_in_ip"
     t.string "last_sign_in_ip"
+    t.integer "failed_attempts", default: 0
+    t.string "unlock_token"
+    t.datetime "locked_at", precision: nil
     t.index ["encrypted_otp_secret_key"], name: "index_admin_users_on_encrypted_otp_secret_key", unique: true
+    t.index ["unlock_token"], name: "index_admin_users_on_unlock_token", unique: true
   end
 
   create_table "case_logs", force: :cascade do |t|

spec/features/auth/user_lockout_spec.rb

@@ -2,9 +2,10 @@ require "rails_helper"
 
 RSpec.describe "User Lockout" do
   let(:user) { FactoryBot.create(:user) }
+  let(:admin) { FactoryBot.create(:admin_user) }
   let(:attempt_number) { Devise.maximum_attempts }
 
-  context "when login-in with the wrong password up to a maximum number of attempts" do
+  context "when login-in with the wrong user password up to a maximum number of attempts" do
     before do
       attempt_number.times do
         visit("/users/sign-in")
@@ -23,4 +24,24 @@ RSpec.describe "User Lockout" do
       expect(page).to have_content("Your account is locked.")
     end
   end
+
+  context "when login-in with the wrong admin password up to a maximum number of attempts" do
+    before do
+      attempt_number.times do
+        visit("/admin/sign-in")
+        fill_in("admin_user[email]", with: admin.email)
+        fill_in("admin_user[password]", with: "wrong_password")
+        click_button("Sign in")
+      end
+    end
+
+    it "locks the admin account" do
+      visit("/admin/sign-in")
+      fill_in("admin_user[email]", with: admin.email)
+      fill_in("admin_user[password]", with: admin.password)
+      click_button("Sign in")
+      expect(page).to have_http_status(:unprocessable_entity)
+      expect(page).to have_content("Your account is locked.")
+    end
+  end
 end