feat(labrinth): account locking

apps/labrinth/migrations/20260904120000_account_locked.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users
+	ADD COLUMN account_locked boolean NOT NULL DEFAULT FALSE;

apps/labrinth/src/auth/mod.rs

@@ -9,8 +9,8 @@ pub use checks::{
 };
 use serde::{Deserialize, Serialize};
 pub use validate::{
-    check_is_moderator_from_headers, get_user_from_bearer_token,
-    get_user_from_headers,
+    check_account_unlocked, check_is_moderator_from_headers,
+    get_user_from_bearer_token, get_user_from_headers,
 };
 
 use crate::file_hosting::FileHostingError;
@@ -39,6 +39,8 @@ pub enum AuthenticationError {
     Mail(#[from] crate::queue::email::MailError),
     #[error("Invalid Authentication Credentials")]
     InvalidCredentials,
+    #[error("account is locked")]
+    AccountLocked,
     #[error("Authentication method was not valid")]
     InvalidAuthMethod,
     #[error("GitHub Token from incorrect Client ID")]
@@ -74,6 +76,7 @@ impl actix_web::ResponseError for AuthenticationError {
                 StatusCode::INTERNAL_SERVER_ERROR
             }
             AuthenticationError::InvalidCredentials => StatusCode::UNAUTHORIZED,
+            AuthenticationError::AccountLocked => StatusCode::FORBIDDEN,
             AuthenticationError::Decoding(..) => StatusCode::BAD_REQUEST,
             AuthenticationError::Mail(..) => StatusCode::INTERNAL_SERVER_ERROR,
             AuthenticationError::InvalidAuthMethod => StatusCode::UNAUTHORIZED,
@@ -109,6 +112,7 @@ impl AuthenticationError {
             AuthenticationError::SerDe(..) => "invalid_input",
             AuthenticationError::Reqwest(..) => "network_error",
             AuthenticationError::InvalidCredentials => "invalid_credentials",
+            AuthenticationError::AccountLocked => "account_locked",
             AuthenticationError::Decoding(..) => "decoding_error",
             AuthenticationError::Mail(..) => "mail_error",
             AuthenticationError::InvalidAuthMethod => "invalid_auth_method",

apps/labrinth/src/auth/oauth/errors.rs

@@ -58,6 +58,9 @@ impl OAuthError {
 impl actix_web::ResponseError for OAuthError {
     fn status_code(&self) -> StatusCode {
         match *self.error_type {
+            OAuthErrorType::AuthenticationError(
+                AuthenticationError::AccountLocked,
+            ) if self.valid_redirect_uri.is_none() => StatusCode::FORBIDDEN,
             OAuthErrorType::AuthenticationError(_)
             | OAuthErrorType::FailedScopeParse(_)
             | OAuthErrorType::ScopesTooBroad
@@ -174,6 +177,9 @@ impl OAuthErrorType {
         match self {
             Self::RedirectUriNotConfigured(_)
             | Self::ClientMissingRedirectURI { client_id: _ } => "invalid_uri",
+            Self::AuthenticationError(AuthenticationError::AccountLocked) => {
+                "access_denied"
+            }
             Self::AuthenticationError(_) | Self::InvalidAcceptFlowId => {
                 "server_error"
             }

apps/labrinth/src/auth/oauth/mod.rs

@@ -313,7 +313,10 @@ pub async fn request_token(
                 user_id,
             }
             .insert(&mut transaction)
-            .await?;
+            .await?
+            .ok_or_else(|| {
+                OAuthError::error(OAuthErrorType::InvalidAuthCode)
+            })?;
 
             transaction.commit().await?;
 

apps/labrinth/src/auth/templates/mod.rs

@@ -40,7 +40,7 @@ impl Display for ErrorPage {
 
 impl ErrorPage {
     pub fn render(&self) -> HttpResponse {
-        HttpResponse::Ok()
+        HttpResponse::build(self.code)
             .append_header(("Content-Type", "text/html; charset=utf-8"))
             .body(self.to_string())
     }