~bigbes/core-go: Don't prevent suspended users from authenticating

cc170f8f3cd85b646def1dff9e42cd215bea42c4 — Drew DeVault 11 months ago 44cf5e7

Don't prevent suspended users from authenticating

With cookies or internal auth. The frontends already prevent users from
accessing services while suspended, and there are some complications if
we don't let the frontends access the backends at all if the
authenticated user is suspended.

patch browse .tar.gz .zip

1 files changed, 8 insertions(+), 7 deletions(-)

M auth/middleware.go

M auth/middleware.go => auth/middleware.go +8 -7

@@ 120,13 120,6 @@ func authForUsername(ctx context.Context, username string) (*AuthContext, error)
 	if err := LookupUser(ctx, username, &auth); err != nil {
 		return nil, err
 	}
-
-	if auth.UserType == USER_TYPE_SUSPENDED {
-		return nil, fmt.Errorf(
-			"Account suspended with the following notice: %s\nContact support",
-			*auth.SuspensionNotice)
-	}
-
 	return &auth, nil
 }
 


@@ 215,6 208,14 @@ func cookieAuth(cookie *http.Cookie, w http.ResponseWriter,
 		return
 	}
 
+	if auth.UserType == USER_TYPE_SUSPENDED {
+		authError(w, fmt.Sprintf(
+			"Account suspended with the following notice: %s\nContact support",
+			*auth.SuspensionNotice),
+			http.StatusForbidden)
+		return
+	}
+
 	auth.AuthMethod = AUTH_COOKIE
 
 	ctx := context.WithValue(r.Context(), userCtxKey, auth)