fix issue with API token auth

Author: briri

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## v5.0.3
+- Patch API token auth to check user's status
+
 ## v5.0.2
 - Bump Ruby to v3.1.4 and use `.ruby-version` in CI
   - [#3566](https://github.com/DMPRoadmap/roadmap/pull/3566)

app/services/api/v1/auth/jwt/authorization_service.rb

@@ -19,7 +19,7 @@ def call
 
           private
 
-          # Lookup the Client bassed on the client_id embedded in the JWT
+          # Lookup the Client based on the client_id embedded in the JWT
           # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity
           def client
             return @api_client if @api_client.present?
@@ -33,7 +33,10 @@ def client
             @api_client = ApiClient.where(client_id: token[:client_id]).first
             return @api_client if @api_client.present?
 
-            @api_client = User.where(email: token[:client_id]).first
+            # Valid if User is active, has permission to use the API and
+            # the :client_secret matches the token
+            usr = User.where(email: token[:client_id], active: true, api_token: @client_secret).first
+            @api_client = usr.present? && usr.can_use_api? ? usr : nil
           end
           # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity