From 21165d882e89833a9f1995d18110815a7bd5cdcf Mon Sep 17 00:00:00 2001 From: Tobias Hallmen Date: Wed, 4 Nov 2026 13:11:24 +0000 Subject: [PATCH] Git-bridge: reject personal access tokens of suspended users (#261) Suspended users cannot log in to web, but their git-bridge personal access tokens kept working for clone/pull/push. Treat a token whose owner is suspended like an unknown token in GitBridgePATManager.getUserId, which backs both /oauth/token/info and the token checks on the /api/v0/docs routes, so git-bridge gets a 401. --- .../web/modules/git-bridge/app/src/GitBridgePATManager.mjs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/services/web/modules/git-bridge/app/src/GitBridgePATManager.mjs b/services/web/modules/git-bridge/app/src/GitBridgePATManager.mjs index e078d79aa5..682cf0a5aa 100644 --- a/services/web/modules/git-bridge/app/src/GitBridgePATManager.mjs +++ b/services/web/modules/git-bridge/app/src/GitBridgePATManager.mjs @@ -101,14 +101,14 @@ const GitBridgePATManager = { if (!objToken?.user_id) return null -// does the user still exists and not deleted? +// does the user still exists, not deleted and not suspended? // tokens of a deleted user are not deleted until user expires const user = await db.users.findOne( { _id: new ObjectId(objToken.user_id) }, - { projection: { _id: 1 } } + { projection: { _id: 1, suspended: 1 } } ) - if (!user) return null + if (!user || user.suspended) return null // non-blocking db.oauthAccessTokens.updateOne(