[BE-134] JwtStrategy.validate() never checks user.isActive

[yusuftomilola]

Overview

JwtStrategy.validate() (backend/src/auth/strategies/jwt.strategy.ts) looks up the user by payload.sub and returns them if found — it never checks user.isActive. UsersService.setActive(id, false) exists specifically to deactivate an account, but a deactivated user's still-unexpired access token continues to authenticate successfully against every guarded route until it naturally expires.

Tasks

• Add an isActive check in validate(), throwing UnauthorizedException for a deactivated user.
• Add a unit test: deactivate a user, then assert a previously-issued (mocked) token payload for that user is rejected.
• Consider also revoking the refresh token hash on deactivation (setRefreshTokenHash(id, null)) so a deactivated user can't silently refresh either.

Acceptance Criteria

• A deactivated user's existing access token is rejected on the very next authenticated request.
• A deactivated user cannot obtain a new token pair via /auth/refresh.

Notes for Contributors

Comment below to be assigned.

[bibi-fay]

@bibi-fay has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi boss,

Can you assign me to this issue?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @bibi-fay to this issue.

[drips-wave]

Congratulations, @bibi-fay! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @bibi-fay: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@bibi-fay's PR #1382 was approved and merged by @yusuftomilola.

🏆 @bibi-fay: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (284 total points). Track your full progress on GrantFox.

👏 Great work, @bibi-fay! Keep contributing to DistinctCodes.

[drips-wave]

This issue has been completed by @bibi-fay as part of the Stellar Wave Program's 8th Wave 🥳

😎 @bibi-fay: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.