From e6fc2bb056464af989a62ba01eadbc8b384dc26a Mon Sep 17 00:00:00 2001 From: Brian Riley Date: Fri, 31 Jul 2026 09:49:00 -0700 Subject: [PATCH 1/3] fix issue with API token auth --- CHANGELOG.md | 3 +++ app/services/api/v1/auth/jwt/authorization_service.rb | 7 +++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b5637083df..f402b2e254 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,8 @@ # Changelog +## v5.0.3 +- Patch API token auth to check user's status + ## v5.0.2 - Bump Ruby to v3.1.4 and use `.ruby-version` in CI - [#3566](https://github.com/DMPRoadmap/roadmap/pull/3566) diff --git a/app/services/api/v1/auth/jwt/authorization_service.rb b/app/services/api/v1/auth/jwt/authorization_service.rb index 52caea688e..912c40d901 100644 --- a/app/services/api/v1/auth/jwt/authorization_service.rb +++ b/app/services/api/v1/auth/jwt/authorization_service.rb @@ -19,7 +19,7 @@ def call private - # Lookup the Client bassed on the client_id embedded in the JWT + # Lookup the Client based on the client_id embedded in the JWT # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity def client return @api_client if @api_client.present? @@ -33,7 +33,10 @@ def client @api_client = ApiClient.where(client_id: token[:client_id]).first return @api_client if @api_client.present? - @api_client = User.where(email: token[:client_id]).first + # Valid if User is active, has permission to use the API and + # the :client_secret matches the token + usr = User.where(email: token[:client_id], active: true, api_token: @client_secret).first + @api_client = usr.present? && usr.can_use_api? ? usr : nil end # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity From 9c02abee8a451bb15976ea3446271ce0c3026ea3 Mon Sep 17 00:00:00 2001 From: gjacob24 Date: Mon, 3 Aug 2026 17:37:50 +0100 Subject: [PATCH 2/3] fix same issue for api V0 token --- app/controllers/api/v0/base_controller.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/app/controllers/api/v0/base_controller.rb b/app/controllers/api/v0/base_controller.rb index f259096cbc..4d2e99321b 100644 --- a/app/controllers/api/v0/base_controller.rb +++ b/app/controllers/api/v0/base_controller.rb @@ -119,8 +119,7 @@ def authenticate_token else @token = token @user = User.find_by(api_token: token) - # if no user found, return false, otherwise true - !@user.nil? && @user.can_use_api? + @user.present? && @user.active? && @user.can_use_api? end end end From 2d076ef6ee6a10b51e68e9894a9bad6ff452cc6f Mon Sep 17 00:00:00 2001 From: Brian Riley Date: Tue, 4 Aug 2026 15:37:31 -0700 Subject: [PATCH 3/3] removed unecessary @client_secret constraint from authorization_service --- app/services/api/v1/auth/jwt/authorization_service.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/services/api/v1/auth/jwt/authorization_service.rb b/app/services/api/v1/auth/jwt/authorization_service.rb index 912c40d901..d75e3f2a1e 100644 --- a/app/services/api/v1/auth/jwt/authorization_service.rb +++ b/app/services/api/v1/auth/jwt/authorization_service.rb @@ -35,7 +35,7 @@ def client # Valid if User is active, has permission to use the API and # the :client_secret matches the token - usr = User.where(email: token[:client_id], active: true, api_token: @client_secret).first + usr = User.where(email: token[:client_id], active: true).first @api_client = usr.present? && usr.can_use_api? ? usr : nil end # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity