GEWIS / sudosos / 37586693362

88%

push

github

Reject soft-deleted users from logging in (#157)

* fix(backend): reject deleted users on every login path

LDAP, GEWIS LDAP and GEWISweb login issued tokens to soft-deleted users,
and existing tokens kept working and refreshing after deletion.

Credential lookups now treat deleted users as invalid credentials:
HashAuthentication and LDAPAuthentication reject them with the usual
403, matching the NFC/EAN authenticators. GEWIS LDAP rejects before
bindUser, so no LDAPAuthenticator is created for a deleted member.
GEWISweb's user handling moves into Gewis.findOrCreateUserFromWeb,
which rejects before updateUser could re-activate the account.

TokenMiddleware checks User.deleted on every request, so deleting a
user revokes their tokens and stops sliding refresh.

getSaltedToken still throws DeletedUserError as a last-resort guard
for callers that skip these checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(backend): cover deleted-user rejection for token issuing

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(backend): exclude deleted users from NFC user lookup

GET /users/nfc/{nfcCode} returned soft-deleted users. It now returns
404, like an unknown NFC code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs(backend): document that deleting a user blocks login

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

4617 of 5224 branches covered (88.38%)

Branch coverage included in aggregate %.

67 of 69 new or added lines in 6 files covered. (97.1%)

22979 of 24623 relevant lines covered (93.32%)

805.33 hits per line