Fixes GHSA-62j4-hvj7-px3f

spec/support/examples/api.rb

@@ -22,3 +22,14 @@ RSpec.shared_examples 'forbidden for wrong role' do |wrong_role|
     expect(response).to have_http_status(403)
   end
 end
+
+RSpec.shared_examples 'forbidden for disabled user' do
+  let(:user) { Fabricate(:admin_user, disabled: true) }
+
+  it 'returns http forbidden' do
+    # Some examples have a subject which needs to be called to make a request
+    subject if request.nil?
+
+    expect(response).to have_http_status(403)
+  end
+end