Fixes issue with API token auth

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## v5.0.3
+- Patch API token auth to check user's status
+
 ## v5.0.2
 - Bump Ruby to v3.1.4 and use `.ruby-version` in CI
   - [#3566](https://github.com/DMPRoadmap/roadmap/pull/3566)

app/controllers/api/v0/base_controller.rb

@@ -119,8 +119,7 @@ def authenticate_token
           else
             @token = token
             @user = User.find_by(api_token: token)
-            # if no user found, return false, otherwise true
-            !@user.nil? && @user.can_use_api?
+            @user.present? && @user.active? && @user.can_use_api?
           end
         end
       end

app/services/api/v1/auth/jwt/authorization_service.rb

@@ -19,9 +19,8 @@ def call
 
           private
 
-          # Lookup the Client bassed on the client_id embedded in the JWT
-          # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity
-          def client
+          # Lookup the Client based on the client_id embedded in the JWT
+          def client # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
             return @api_client if @api_client.present?
 
             token = decoded_auth_token
@@ -33,9 +32,11 @@ def client
             @api_client = ApiClient.where(client_id: token[:client_id]).first
             return @api_client if @api_client.present?
 
-            @api_client = User.where(email: token[:client_id]).first
+            # Valid if User is active, has permission to use the API and
+            # the :client_secret matches the token
+            usr = User.where(email: token[:client_id], active: true).first
+            @api_client = usr.present? && usr.can_use_api? ? usr : nil
           end
-          # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity
 
           def decoded_auth_token
             return @token if @token.present?