Skip to content

fix(social-login): no password-expired on social login#623

Open
Gzerox wants to merge 1 commit intoandrechristikan:developmentfrom
Gzerox:fix/social-login-expired-pwd
Open

fix(social-login): no password-expired on social login#623
Gzerox wants to merge 1 commit intoandrechristikan:developmentfrom
Gzerox:fix/social-login-expired-pwd

Conversation

@Gzerox
Copy link
Contributor

@Gzerox Gzerox commented Jan 27, 2026

When a user signs up via a social provider, we intentionally do not set user.passwordExpired (for obvious reasons — no local password involved).
However, in UserGuard, during the call to userService.validateUserGuard, we currently run the following logic:

const checkPasswordExpired: boolean = this.authUtil.checkPasswordExpired(user.passwordExpired);
if (checkPasswordExpired) {
    throw new ForbiddenException({
        statusCode: EnumUserStatus_CODE_ERROR.passwordExpired,
        message: 'auth.error.passwordExpired',
    });
} else if (requiredVerified === true && user.isVerified !== true) {
    throw new ForbiddenException({
        statusCode: EnumUserStatus_CODE_ERROR.emailNotVerified,
        message: 'user.error.emailNotVerified',
    });
}

The key problem is the call to: this.authUtil.checkPasswordExpired(user.passwordExpired).

In the social login case, user.passwordExpired is always null.
This value is then passed to the following utility method:

checkPasswordExpired(passwordExpired: Date): boolean {
    const today: Date = this.helperService.dateCreate();
    return today > passwordExpired;
}

Since the comparison is performed against a null value, the date check behaves incorrectly and results in users being blocked by the guard, even though password expiration should not apply to social-authenticated users.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments