Resolve "It is not possible to force user confirmation from Admin Area if confirmation was expired"

What does this MR do and why?

Related to #212539 (closed)

The problem:

GitLab admins cannot confirm the user from the /admin/users/:username page, by clicking the Confirm user button, if the confirmation period of the user has expired. Currently, this is 1 day as per our Devise settings (User.confirm_within gives this value)

The solution:

GitLab admins should be able to confirm users even if the confirmation period has expired. To do this, we are now introducing a method named force_confirm which is only used in Admin::UsersController#confirm. This way, we are isolating the effect of this change to this method alone, and not touching the confirm method of Devise in any manner.

force_confirm internally calls confirm, but it does so only after setting a virtual attribute that would later skip the check : has the confirmation period of this user expired?. Since this check is skipped whenever admins perform force_confirm on the user, the confirmation always succeeds, even if the confirmation period of 1 day has actually expired.

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

• Turn Gitlab::CurrentSettings.send_user_confirmation_email to true
• Register as a new user on your GitLab instance, say with username abcd
• From Rails console, do the following

user = User.find_by_username 'abcd'
user.confirmation_sent_at = 10.days.ago # this is to make sure that the confirmation period has expired
user.save!

• Login as gitlab admin in a different browser, and navigate to /admin/users/abcd
• Click the Confirm user button

Before: The request would be successful, but the user would remain unconfirmed. The Confirm user button still persists on the page.

After the change: The request would be successful, user would be confirmed and the Confirm user button goes away.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

app/controllers/admin/users_controller.rb

@@ -158,7 +158,7 @@ def unlock
   end
 
   def confirm
-    if update_user { |user| user.confirm }
+    if update_user { |user| user.force_confirm }
       redirect_back_or_admin_user(notice: _("Successfully confirmed"))
     else
       redirect_back_or_admin_user(alert: _("Error occurred. User was not confirmed"))