From 4d98c7cb7022437f746db6cf65213e8a22165af7 Mon Sep 17 00:00:00 2001 From: Lizandro Guarnizo <77708265+lizandrogd@users.noreply.github.com> Date: Thu, 2 Jul 2026 14:56:28 -0500 Subject: [PATCH] feat(auth): reject login and invalidate token for blocked users Checks is_active on email login, phone OTP login, and /auth/me so existing tokens also stop working immediately after a user is blocked. Co-Authored-By: Claude Sonnet 4.6 --- backend/src/auth/auth.service.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/backend/src/auth/auth.service.ts b/backend/src/auth/auth.service.ts index a2281e2..c1bda47 100644 --- a/backend/src/auth/auth.service.ts +++ b/backend/src/auth/auth.service.ts @@ -34,6 +34,8 @@ export class AuthService { const valid = await bcrypt.compare(password, user.password_hash); if (!valid) throw new UnauthorizedException('Credenciales inválidas'); + if (user.is_active === false) throw new UnauthorizedException('Tu cuenta ha sido bloqueada'); + return this.generateToken(user); } @@ -51,6 +53,7 @@ export class AuthService { data: { phone, name: name || phone, is_phone_verified: true }, }); } else { + if (user.is_active === false) throw new UnauthorizedException('Tu cuenta ha sido bloqueada'); user = await this.prisma.users.update({ where: { id: user.id }, data: { is_phone_verified: true }, @@ -107,6 +110,7 @@ export class AuthService { }, }); if (!user) throw new UnauthorizedException('Usuario no encontrado'); + if (user.is_active === false) throw new UnauthorizedException('Tu cuenta ha sido bloqueada'); return { ...user, professional_state: user.pro_state }; }