~edwargix/git.sr.ht

eeec3e9ab1769812daeb8824ce70929acacf52dd — Drew DeVault 5 years ago 5409a28
api/auth: don't authorize suspended accounts
1 files changed, 7 insertions(+), 0 deletions(-)

M graphql/auth/auth.go
M graphql/auth/auth.go => graphql/auth/auth.go +7 -0
@@ 7,6 7,7 @@ import (
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"
	"regexp"
	"strings"


@@ 171,6 172,12 @@ Expected 'Authentication: Bearer <token>'`, http.StatusForbidden)
				return
			}

			if user.UserType == USER_SUSPENDED {
				authError(w, fmt.Sprintf("Account suspended with the following notice: %s\nContact support",
					user.SuspensionNotice), http.StatusForbidden)
				return
			}

			ctx := context.WithValue(r.Context(), userCtxKey, &user)

			r = r.WithContext(ctx)