fix: destroy user session when user account is disabled.

cmd/login.go

@@ -20,6 +20,10 @@ func handleLogin(r *fastglue.Request) error {
 		return sendErrorEnvelope(r, err)
 	}
 
+	if !user.Enabled {
+		return sendErrorEnvelope(r, envelope.NewError(envelope.GeneralError, "Your account is disabled, please contact administrator", nil))
+	}
+
 	// Set user availability status to online.
 	if err := app.user.UpdateAvailability(user.ID, umodels.Online); err != nil {
 		return sendErrorEnvelope(r, err)

cmd/middlewares.go

@@ -96,6 +96,14 @@ func perm(handler fastglue.FastRequestHandler, perm string) fastglue.FastRequest
 			return sendErrorEnvelope(r, err)
 		}
 
+		// Destroy session if user is disabled.
+		if !user.Enabled {
+			if err := app.auth.DestroySession(r); err != nil {
+				app.lo.Error("error destroying session", "error", err)
+			}
+			return r.SendErrorEnvelope(http.StatusUnauthorized, "User account disabled", nil, envelope.PermissionError)
+		}
+
 		// Split the permission string into object and action and enforce it.
 		parts := strings.Split(perm, ":")
 		if len(parts) != 2 {