fix: deactivated users can still refresh their token (#2105)

6ef7b0f1 · Regev Brody · GitHub · 4bc284b0 · 6ef7b0f1
Unverified Commit 6ef7b0f1 authored Jun 25, 2020 by Regev Brody Committed by GitHub Jun 24, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 0 deletions

users.js server/models/users.js +4 -0

No files found.
--- a/server/models/users.js
+++ b/server/models/users.js
@@ -337,6 +337,10 @@ module.exports = class User extends Model {
        WIKI.logger.warn(`Failed to refresh token for user ${user}: Not found.`)
        throw new WIKI.Error.AuthGenericError()
      }
+      if (!user.isActive) {
+        WIKI.logger.warn(`Failed to refresh token for user ${user}: Inactive.`)
+        throw new WIKI.Error.AuthAccountBanned()
+      }
    } else if (_.isNil(user.groups)) {
      user.groups = await user.$relatedQuery('groups').select('groups.id', 'permissions')
    }