From cc170f8f3cd85b646def1dff9e42cd215bea42c4 Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Wed, 3 Sep 2025 10:12:45 +0200 Subject: [PATCH] Don't prevent suspended users from authenticating With cookies or internal auth. The frontends already prevent users from accessing services while suspended, and there are some complications if we don't let the frontends access the backends at all if the authenticated user is suspended. --- auth/middleware.go | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/auth/middleware.go b/auth/middleware.go index 771756d91367478a3fd0c1824a5229759e403c30..3fc6051962e8d661d85e860c340dcf9ab65ff507 100644 --- a/auth/middleware.go +++ b/auth/middleware.go @@ -120,13 +120,6 @@ func authForUsername(ctx context.Context, username string) (*AuthContext, error) if err := LookupUser(ctx, username, &auth); err != nil { return nil, err } - - if auth.UserType == USER_TYPE_SUSPENDED { - return nil, fmt.Errorf( - "Account suspended with the following notice: %s\nContact support", - *auth.SuspensionNotice) - } - return &auth, nil } @@ -215,6 +208,14 @@ func cookieAuth(cookie *http.Cookie, w http.ResponseWriter, return } + if auth.UserType == USER_TYPE_SUSPENDED { + authError(w, fmt.Sprintf( + "Account suspended with the following notice: %s\nContact support", + *auth.SuspensionNotice), + http.StatusForbidden) + return + } + auth.AuthMethod = AUTH_COOKIE ctx := context.WithValue(r.Context(), userCtxKey, auth)