mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-29 02:51:29 +02:00
3db1260328
The reverse proxy authorization path only checked the session token, the user's account, and group membership, so a user awaiting approval — stored as blocked and pending approval — could complete SSO and reach any service distributed to a group they belong to, including the All Users group. The REST API and peer registration gate on the same state through the permissions manager, but the proxy gRPC service never consults it. ValidateSession now denies on account status with pending_approval or user_blocked as the reason, so proxy access logs and the denied page carry the cause. GenerateSessionToken refuses to mint a token for such a user at all, which keeps the session cookie out of the browser and lets the OIDC callback tell the user why. ValidateUserGroupAccess and ValidateTunnelPeer close the same gap, the latter for a user blocked after registering a peer. A user the store cannot resolve is denied rather than passed through.