fix: check canLogin for OTP and social

smarcet · smarcet · commit 2c567b422ca8 · 2024-08-07T15:23:44.000-03:00
Change-Id: I2abc93a8d9eed5c2093bee6940fee5d421b29f48
diff --git a/app/Http/Controllers/SocialLoginController.php b/app/Http/Controllers/SocialLoginController.php
@@ -14,9 +14,9 @@
 
 use App\libs\Auth\SocialLoginProviders;
 use App\Services\Auth\IUserService;
+use Auth\Exceptions\AuthenticationException;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Log;
-use Illuminate\Support\Facades\Session;
 use Laravel\Socialite\Facades\Socialite;
 use models\exceptions\ValidationException;
 use OAuth2\Services\IMementoOAuth2SerializerService;
@@ -154,9 +154,16 @@ public function callback($provider)
             }
 
             // do login
+            if(!$user->canLogin()) {
+                throw new AuthenticationException
+                (
+                    "We are sorry, your username does not match an existing record."
+                );
+            }
+
             Auth::login($user, true);
             // and continue the usual flow
-            return $this->login_strategy->postLogin([ 'provider'=> $provider ]);
+            return $this->login_strategy->postLogin(['provider' => $provider]);
         }
         catch (\Exception $ex){
 
diff --git a/app/libs/Auth/AuthService.php b/app/libs/Auth/AuthService.php
@@ -158,7 +158,7 @@ public function login(string $username, string $password, bool $remember_me): bo
         Log::debug("AuthService::login: clearing principal");
         $this->principal_service->clear();
         $current_user = $this->getCurrentUser();
-        if(is_null($current_user))
+        if(is_null($current_user) || !$current_user->canLogin())
             throw new AuthenticationException
             (
                 "We are sorry, your username or password does not match an existing record."
@@ -248,12 +248,18 @@ public function loginWithOTP(OAuth2OTP $otpClaim, ?Client $client = null, bool $
                         'email' => $otp->getUserName(),
                         'email_verified' => true,
                         // dont send email
-                        'send_email_verified_notice' => false
+                        'send_email_verified_notice' => false,
+                        'active' => true,
                     ],
                     $otp
                 );
             }
 
+            if(!$user->canLogin()){
+                Log::warning(sprintf("AuthService::loginWithOTP user %s cannot login ( is not active ).", $user->getId()));
+                throw new AuthenticationException("We are sorry, your username or password does not match an existing record.");
+            }
+
             $otp->setAuthTime(time());
             $otp->setUserId($user->getId());
             $otp->redeem();
