3490be5fb7
Two-pronged enforcement so deactivation has effect both for fresh
logins and already-issued sessions:
- load_current_user(): treat User with active=False as logged-out
(sets g.user=None). Existing sessions stop working immediately.
- login(): include `not user.active` in the existing 401 condition,
so deactivated accounts get the same "invalid credentials"
response as wrong-password / unknown-user — no timing oracle for
deactivation status.
Tests still green (12/12 in test_auth.py).
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| auth_routes.py | ||
| blueprint_routes.py | ||
| files_routes.py | ||
| job_routes.py | ||
| log_routes.py | ||
| overlay_routes.py | ||
| page_routes.py | ||
| server_routes.py | ||
| workshop_routes.py | ||