fix: add revoked user check to VerifyEmail and VerifyOTP by lakhansamani · Pull Request #491

fix: add revoked user check to VerifyEmail and VerifyOTP by lakhansamani · Pull Request #491 · authorizerdev/authorizer

Merged

lakhansamani merged 3 commits intomainfrom

fix/verify-email-otp-revoked-check

Mar 1, 2026

Merged

fix: add revoked user check to VerifyEmail and VerifyOTP#491
lakhansamani merged 3 commits intomainfrom
fix/verify-email-otp-revoked-check

Conversation

Copy link Copy Markdown

Contributor

lakhansamani commented
Mar 1, 2026

Summary

Added RevokedTimestamp check in VerifyEmail and VerifyOTP after fetching user
Prevents revoked users from obtaining valid tokens through email/OTP verification

Test plan

Verify revoked users cannot verify email or OTP
Verify non-revoked users can still verify normally

Fixes #480

lakhansamani added 3 commits

March 1, 2026 11:47

fix: add revoked user check to VerifyEmail and VerifyOTP

6143e49

Both VerifyEmail and VerifyOTP were missing the RevokedTimestamp check
that Login correctly implements. A revoked user could verify email/OTP
and obtain valid tokens.

Fixes #480

Merge branch 'main' into fix/verify-email-otp-revoked-check

cdc10f8

test: add test for revoked user verify email rejection

4cacc61

lakhansamani merged commit 085a391 into main