Don't allow deleted users to do actions. Fixes #1656 (#1704)

2021-08-16 16:51:08 -04:00 · 2021-08-16 16:51:08 -04:00 · 2966203653
parent 32874163a8
commit 2966203653
1 changed files with 5 additions and 0 deletions
--- a/crates/api_common/src/lib.rs
+++ b/crates/api_common/src/lib.rs
@ -272,6 +272,11 @@ pub async fn get_local_user_view_from_jwt(
    return Err(ApiError::err("site_ban").into());
  }

+  // Check for user deletion
+  if local_user_view.person.deleted {
+    return Err(ApiError::err("deleted").into());
+  }
+
  check_validator_time(&local_user_view.local_user.validator_time, &claims)?;

  Ok(local_user_view)