[medium] Deactivated users keep access #10

New issue

Closed

opened 2026-10-18 15:51:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:55 +00:00

Owner

Severity: medium
Affects: main

Files: oidc_controller.ex:163-170 (no Accounts.active? check before log_in_user, unlike user_session_controller.ex:25/51); lib/fuzzy_catalog_web/user_auth.ex:67-76 (fetch_current_scope_for_user doesn't check status, so existing sessions/remember-me cookies survive deactivation).
Fix: check active? in the OIDC path and in fetch_current_scope_for_user; delete the user's tokens when an admin deactivates them.

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** medium **Affects:** main Files: oidc_controller.ex:163-170 (no Accounts.active? check before log_in_user, unlike user_session_controller.ex:25/51); lib/fuzzy_catalog_web/user_auth.ex:67-76 (fetch_current_scope_for_user doesn't check status, so existing sessions/remember-me cookies survive deactivation). Fix: check active? in the OIDC path and in fetch_current_scope_for_user; delete the user's tokens when an admin deactivates them. --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

medium

security

main

labels

2026-10-18 15:51:55 +00:00

jfro referenced this issue from a pull request that will close it,

2026-10-18 17:12:26 +00:00

fix: log disabled users out and keep them out #34

jfro referenced this issue from a commit

2026-10-18 17:12:27 +00:00

fix: log disabled users out and keep them out