fix: check user active while login or refresh session

Author: zzswang

src/auth/auth.controller.ts

@@ -39,6 +39,15 @@ import { SignTokenDto } from './dto/sign-token.dto';
 import { Authorizer } from './entities/authorizer.entity';
 import { SessionWithToken, Token } from './entities/session-with-token.entity';
 
+function checkUserActive(user: UserDocument) {
+  if (user.active === false) {
+    throw new ForbiddenException({
+      code: ErrorCodes.USER_INACTIVE,
+      message: 'user inactive',
+    });
+  }
+}
+
 @ApiTags('auth')
 @Controller('auth')
 export class AuthController {
@@ -85,6 +94,8 @@ export class AuthController {
       });
     }
 
+    checkUserActive(user);
+
     return this.authService.login(user);
   }
 
@@ -194,6 +205,7 @@ export class AuthController {
         });
       }
 
+      checkUserActive(user);
       return this.authService.login(user);
     }
 
@@ -220,6 +232,7 @@ export class AuthController {
       });
     }
 
+    checkUserActive(user);
     return this.authService.login(user);
   }
 
@@ -242,6 +255,7 @@ export class AuthController {
       });
     }
 
+    checkUserActive(user);
     return this.authService.login(user);
   }
 
@@ -446,6 +460,8 @@ export class AuthController {
         });
       }
 
+      checkUserActive(user);
+
       payload.ns = user.ns;
       payload.groups = user.groups;
       payload.roles = user.roles;

src/constants.ts

@@ -4,6 +4,7 @@ export const ErrorCodes = {
   CAPTCHA_INVALID: 'CAPTCHA_INVALID',
   TOO_MANY_LOGIN_ATTEMPTS: 'TOO_MANY_LOGIN_ATTEMPTS',
   USER_NOT_FOUND: 'USER_NOT_FOUND',
+  USER_INACTIVE: 'USER_INACTIVE',
   CAPTCHA_NOT_FOUND: 'CAPTCHA_NOT_FOUND',
   CASTERROR: 'CASTERROR',
   DUPLICATE: 'DUPLICATE',