@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens

Summary

In OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity. Existing Actual session tokens for the disabled user remain valid, so the user can continue calling authenticated server endpoints after an administrator has disabled the account.

Details

The disabled-user check is present during OpenID login finalization. Existing users are only accepted when the matching row has enabled = 1, and a disabled row causes the OpenID grant to fail before a new session token is created.

// packages/sync-server/src/accounts/openid.ts:284-291
const { id: userIdFromDb, display_name: displayName } =
  accountDb.first(
    'SELECT id, display_name FROM users WHERE user_name = ? and enabled = 1',
    [identity],
  ) || {};

if (userIdFromDb == null) {
  throw new Error('openid-grant-failed');
}

The shared session validation path does not perform the same enabled-user check. It accepts any existing token row that has not expired, then returns the session object to every route protected by validateSessionMiddleware.

// packages/sync-server/src/util/validate-user.ts:10-41
export function validateSession(req: Request, res: Response) {
  let { token } = req.body || {};
  if (!token) {
    token = req.headers['x-actual-token'];
  }

  const session = getSession(token);
  ...
  return session;
}

This means account disablement and session authorization diverge:

OpenID login path: users.enabled must be 1
Existing session path: token exists and is not expired; users.enabled is not checked

The default token expiration setting is never, so this is not just a short race after disablement on default deployments.

// packages/sync-server/src/load-config.js:260-264
token_expiration: {
  doc: 'Token expiration time.',
  format: 'tokenExpiration',
  default: 'never',
  env: 'ACTUAL_TOKEN_EXPIRATION',
},

Admins can change a user's enabled state through the user update route, but that update does not delete the user's existing sessions. After the update, the old token still satisfies validateSession.

// packages/sync-server/src/app-admin.js:91-101
app.patch('/users', validateSessionMiddleware, async (req, res) => {
  if (!isAdmin(res.locals.user_id)) {
    ...
  }

  const { id, userName, role, displayName, enabled } = req.body || {};

// packages/sync-server/src/services/user-service.ts:98-102
getAccountDb().mutate(
  'UPDATE users SET user_name = ?, display_name = ?, enabled = ?, role = ? WHERE id = ?',
  [userName, displayName, enabled, roleId, userId],
);