The reverse proxy authorization path only checked the session token, the
user's account, and group membership, so a user awaiting approval — stored
as blocked and pending approval — could complete SSO and reach any service
distributed to a group they belong to, including the All Users group. The
REST API and peer registration gate on the same state through the
permissions manager, but the proxy gRPC service never consults it.
ValidateSession now denies on account status with pending_approval or
user_blocked as the reason, so proxy access logs and the denied page carry
the cause. GenerateSessionToken refuses to mint a token for such a user at
all, which keeps the session cookie out of the browser and lets the OIDC
callback tell the user why. ValidateUserGroupAccess and ValidateTunnelPeer
close the same gap, the latter for a user blocked after registering a peer.
A user the store cannot resolve is denied rather than passed through.
3db1260328