Suspended users cannot log in to web, but their git-bridge personal
access tokens kept working for clone/pull/push. Treat a token whose
owner is suspended like an unknown token in GitBridgePATManager.getUserId,
which backs both /oauth/token/info and the token checks on the
/api/v0/docs routes, so git-bridge gets a 401.
The /git/ location proxied every path to git-bridge, which made its
internal routes reachable from the internet: /status, /health_check,
/metrics, /diags, /api/<project>/<key>/postback and the unauthenticated
DELETE /api/projects/<project id> used by web on project expiry.
Forward only /git/<24 hex project id>[.git]/... (the git smart-HTTP
endpoints, which git-bridge protects with Oauth2Filter) and return 404
for everything else under /git/. Web talks to git-bridge directly
(GIT_BRIDGE_HOST:GIT_BRIDGE_PORT), not through nginx, so it is not
affected.
Tobias Hallmen