From 9df19ce647b65eed988f35bdbb3218c167d5a798 Mon Sep 17 00:00:00 2001 From: Kauan Guesser Date: Tue, 14 Jul 2026 03:04:47 -0300 Subject: [PATCH 1/2] fix(rockets-auth): reject inactive users during access-token validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Login already enforces the active flag (LocalUserInactiveException), but RocketsJwtAuthAdapter.validateToken did not — a deactivated user could keep using outstanding access tokens until expiry. Check user.active after the subject lookup and fail with 401, mirroring the login-path semantics. --- .../src/provider/rockets-jwt-auth.adapter.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts b/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts index 4ad463cb..d24dab88 100644 --- a/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts +++ b/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts @@ -63,6 +63,15 @@ export class RocketsJwtAuthAdapter implements AuthAdapterInterface { } const user = userAggregateToEntity(userResult); + + // Honor the user's active flag on EVERY request, matching login semantics + // (LocalService throws LocalUserInactiveException): a deactivated user's + // outstanding access tokens must stop working immediately. + if (user.active !== true) { + this.logger.warn(`User inactive for subject: ${payload.sub}`); + throw new UnauthorizedException('User inactive'); + } + const userRoles = await resolveUserRoles(this.queryBus, user.id); this.logger.log(`Successfully validated token for user: ${payload.sub}`); From 59d298e6191b9154afb937bb77ef09b555f0835f Mon Sep 17 00:00:00 2001 From: Kauan Guesser Date: Tue, 14 Jul 2026 11:55:02 -0300 Subject: [PATCH 2/2] fix: patch RepositoryQueryException context wipe too @concepta/nestjs-repository RepositoryQueryException has the same Object.assign({}, super.context) bug as the nestjs-common/nestjs-crud exceptions this script already patches: the derived constructor wipes context.originalError, so consumers cannot map the underlying driver error (e.g. postgres 23505 unique violations to 409 Conflict). --- scripts/patch-concepta-runtime-context.cjs | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/patch-concepta-runtime-context.cjs b/scripts/patch-concepta-runtime-context.cjs index 868ee571..2f5cac61 100644 --- a/scripts/patch-concepta-runtime-context.cjs +++ b/scripts/patch-concepta-runtime-context.cjs @@ -21,6 +21,7 @@ const files = [ 'node_modules/@concepta/nestjs-common/dist/model/exceptions/model-id-no-match.exception.js', 'node_modules/@concepta/nestjs-crud/dist/infrastructure/exceptions/crud.exception.js', 'node_modules/@concepta/nestjs-crud/dist/infrastructure/exceptions/crud-query.exception.js', + 'node_modules/@concepta/nestjs-repository/dist/exceptions/repository-query.exception.js', ]; const needle = 'Object.assign({}, super.context)';