From 8f6295542e95251e201b515efd2c1956e6b77935 Mon Sep 17 00:00:00 2001
From: Abhinav Raut <abhinavrautcs@gmail.com>
Date: Sun, 2 Mar 2025 19:17:42 +0530
Subject: [PATCH] fix: destroy user session when user account is disabled.

---
 cmd/login.go       | 4 ++++
 cmd/middlewares.go | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/cmd/login.go b/cmd/login.go
index 8bf1eff1..f7f0732b 100644
--- a/cmd/login.go
+++ b/cmd/login.go
@@ -20,6 +20,10 @@ func handleLogin(r *fastglue.Request) error {
 		return sendErrorEnvelope(r, err)
 	}
 
+	if !user.Enabled {
+		return sendErrorEnvelope(r, envelope.NewError(envelope.GeneralError, "Your account is disabled, please contact administrator", nil))
+	}
+
 	// Set user availability status to online.
 	if err := app.user.UpdateAvailability(user.ID, umodels.Online); err != nil {
 		return sendErrorEnvelope(r, err)
diff --git a/cmd/middlewares.go b/cmd/middlewares.go
index 14233c5e..c6bde8ad 100644
--- a/cmd/middlewares.go
+++ b/cmd/middlewares.go
@@ -96,6 +96,14 @@ func perm(handler fastglue.FastRequestHandler, perm string) fastglue.FastRequest
 			return sendErrorEnvelope(r, err)
 		}
 
+		// Destroy session if user is disabled.
+		if !user.Enabled {
+			if err := app.auth.DestroySession(r); err != nil {
+				app.lo.Error("error destroying session", "error", err)
+			}
+			return r.SendErrorEnvelope(http.StatusUnauthorized, "User account disabled", nil, envelope.PermissionError)
+		}
+
 		// Split the permission string into object and action and enforce it.
 		parts := strings.Split(perm, ":")
 		if len(parts) != 2 {