Stable user endpoints

Removed security deadlock
2026-09-02 16:11:10 +02:00
parent 669945ad13
commit a04e6f6f50
9 changed files with 96 additions and 13 deletions
@@ -22,8 +22,11 @@ public sealed class ActiveUserFilter(IdentityService identityService) : IEndpoin
        if (!emailDecoded)
            return Results.Json(new { message = "Invalid/missing user email in token." }, statusCode: StatusCodes.Status400BadRequest);

-        if ((await identityService.UserIsAuthorisedAsync(userId, context.HttpContext.RequestAborted)).IsFailed)
-            return (object?)Results.Json(new { message = "Account approval is pending or inactive." }, statusCode: StatusCodes.Status403Forbidden);
+        var path = context.HttpContext.Request.Path.Value;
+
+        if (!string.IsNullOrWhiteSpace(path) && !path!.EndsWith("integration/sync", StringComparison.InvariantCultureIgnoreCase))
+            if ((await identityService.UserIsAuthorisedAsync(userId, context.HttpContext.RequestAborted)).IsFailed)
+                return (object?)Results.Json(new { message = "Account approval is pending or inactive." }, statusCode: StatusCodes.Status403Forbidden);

        context.HttpContext.Items[UserIdItemKey] = userId;
        context.HttpContext.Items[EmailtemKey] = email;