fix: propagate disabled state to lookup server

Signed-off-by: Cristian Scheid <cristianscheid@gmail.com>

Author: cristianscheid

lib/AppInfo/Application.php

@@ -15,6 +15,7 @@
 use OCA\GlobalSiteSelector\GlobalSiteSelector;
 use OCA\GlobalSiteSelector\Listeners\AddContentSecurityPolicyListener;
 use OCA\GlobalSiteSelector\Listeners\DeletingUser;
+use OCA\GlobalSiteSelector\Listeners\UserChanged;
 use OCA\GlobalSiteSelector\Listeners\UserCreated;
 use OCA\GlobalSiteSelector\Listeners\UserDeleted;
 use OCA\GlobalSiteSelector\Listeners\UserLoggedOut;
@@ -36,6 +37,7 @@
 use OCP\Server;
 use OCP\User\Events\BeforeUserDeletedEvent;
 use OCP\User\Events\BeforeUserLoggedInEvent;
+use OCP\User\Events\UserChangedEvent;
 use OCP\User\Events\UserCreatedEvent;
 use OCP\User\Events\UserDeletedEvent;
 use OCP\User\Events\UserLoggedOutEvent;
@@ -80,6 +82,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerEventListener(BeforeUserDeletedEvent::class, DeletingUser::class);
 		$context->registerEventListener(UserDeletedEvent::class, UserDeleted::class);
 		$context->registerEventListener(UserLoggedOutEvent::class, UserLoggedOut::class);
+		$context->registerEventListener(UserChangedEvent::class, UserChanged::class);
 
 		$context->registerSetupCheck(LongJwtKeySetupCheck::class);
 

lib/Controller/SlaveController.php

@@ -9,6 +9,7 @@
 namespace OCA\GlobalSiteSelector\Controller;
 
 use OC\Authentication\Token\IProvider;
+use OC\User\DisabledUserException;
 use OCA\GlobalSiteSelector\AppInfo\Application;
 use OCA\GlobalSiteSelector\Exceptions\LocalFederatedShareException;
 use OCA\GlobalSiteSelector\Exceptions\MasterUrlException;
@@ -63,6 +64,7 @@ public function __construct(
 		private readonly IUserManager $userManager,
 		private readonly UserBackend $userBackend,
 		private readonly ISession $session,
+		private readonly Slave $slave,
 		private readonly SlaveService $slaveService,
 		private readonly GlobalScaleService $globalScaleService,
 		private readonly GlobalShareService $globalShareService,
@@ -159,6 +161,9 @@ public function autoLogin(string $jwt): RedirectResponse {
 				if (!($user instanceof IUser)) {
 					throw new \InvalidArgumentException('User is not valid');
 				}
+				if (!$user->isEnabled()) {
+					throw new DisabledUserException('Account disabled');
+				}
 				$user->updateLastLoginTimestamp();
 
 				$this->session->set('globalScale.userData', $options);
@@ -191,6 +196,12 @@ public function autoLogin(string $jwt): RedirectResponse {
 			$response = new RedirectResponse($masterUrl);
 			$response->throttle();
 			return $response;
+		} catch (DisabledUserException $e) {
+			// user is disabled, remove from lookup server
+			$params = ['uid' => $uid];
+			$this->slave->preDeleteUser($params);
+			$this->slave->deleteUser($params);
+			return new RedirectResponse($masterUrl);
 		} catch (\Exception $e) {
 			$this->logger->warning('issue during login process', ['exception' => $e]);
 			$response = new RedirectResponse($masterUrl);

lib/Listeners/UserChanged.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\GlobalSiteSelector\Listeners;
+
+use OCA\GlobalSiteSelector\GlobalSiteSelector;
+use OCA\GlobalSiteSelector\Slave;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\User\Events\UserChangedEvent;
+
+/**
+ * @template-implements IEventListener<UserChangedEvent>
+ */
+class UserChanged implements IEventListener {
+
+	public function __construct(
+		private GlobalSiteSelector $globalSiteSelector,
+		private Slave $slave,
+	) {
+	}
+
+	public function handle(Event $event): void {
+		if (!$event instanceof UserChangedEvent) {
+			return;
+		}
+
+		if (!$this->globalSiteSelector->isSlave()) {
+			return;
+		}
+
+		if ($event->getFeature() !== 'enabled') {
+			return;
+		}
+
+		$params = ['uid' => $event->getUser()->getUID()];
+
+		if ($event->getValue() === false) {
+			// user was disabled, remove from lookup server
+			$this->slave->preDeleteUser($params);
+			$this->slave->deleteUser($params);
+		} else {
+			// user was enabled, add to lookup server
+			$this->slave->createUser($params);
+		}
+	}
+}

lib/Slave.php

@@ -160,11 +160,10 @@ public function batchUpdate(): void {
 			$offset = 0;
 			$usersData = [];
 			do {
-
 				$users = $backend->getUsers('', $limit, $offset);
 				foreach ($users as $uid) {
 					$user = $this->userManager->get($uid);
-					if ($user !== null) {
+					if ($user !== null && $user->isEnabled()) {
 						$usersData[$user->getCloudId()] = $this->slaveService->getAccountData($user);
 					}
 				}

psalm.xml

@@ -58,6 +58,7 @@
 		<file name="tests/stubs/oc_server.php" />
 		<file name="tests/stubs/oc_servercontainer.php" />
 		<file name="tests/stubs/oc_settings_authorizedgroupmapper.php" />
+		<file name="tests/stubs/oc_user_disableduserexception.php" />
 		<file name="tests/stubs/oc_user_user.php" />
 		<file name="tests/stubs/oca_circles_circlesmanager.php" />
 		<file name="tests/stubs/oca_circles_circlesqueryhelper.php" />

tests/stubs/oc_user_disableduserexception.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+namespace OC\User;
+
+class DisabledUserException extends LoginException {
+}