api/auth: don't authorize suspended accounts
1 files changed, 7 insertions(+), 0 deletions(-) M graphql/auth/auth.go
M graphql/auth/auth.go => graphql/auth/auth.go +7 -0
@@ 7,6 7,7 @@ import ( "encoding/hex" "encoding/json" "errors" "fmt" "net/http" "regexp" "strings" @@ 171,6 172,12 @@ Expected 'Authentication: Bearer <token>'`, http.StatusForbidden) return } if user.UserType == USER_SUSPENDED { authError(w, fmt.Sprintf("Account suspended with the following notice: %s\nContact support", user.SuspensionNotice), http.StatusForbidden) return } ctx := context.WithValue(r.Context(), userCtxKey, &user) r = r.WithContext(ctx)