global update and global fix

apps/sso-core/src/domain/oauth-core.service.ts

@@ -4,6 +4,7 @@ import { JwtService } from '@nestjs/jwt';
 import { randomBytes } from 'node:crypto';
 import { PrismaService } from '../infra/prisma.service';
 import { OAuthIssuerService } from './oauth-issuer.service';
+import { assertHumanAccount, HUMAN_USER_WHERE } from './system-account.util';
 
 @Injectable()
 export class OAuthCoreService {
@@ -15,6 +16,14 @@ export class OAuthCoreService {
   ) {}
 
   async authorize(command: { userId: string; clientId: string; redirectUri: string; scope: string; state?: string }) {
+    const user = await this.prisma.user.findFirst({
+      where: { id: command.userId, deletedAt: null, status: 'ACTIVE', ...HUMAN_USER_WHERE }
+    });
+    if (!user) {
+      throw new UnauthorizedException('Пользователь не найден или заблокирован');
+    }
+    assertHumanAccount(user, { asAuth: true });
+
     const client = await this.prisma.oAuthClient.findUnique({ where: { clientId: command.clientId } });
     if (!client?.isActive || !client.redirectUris.includes(command.redirectUri)) {
       throw new BadRequestException('OAuth приложение не найдено или redirect_uri запрещен');
@@ -50,6 +59,7 @@ export class OAuthCoreService {
         throw new UnauthorizedException('Код авторизации недействителен');
       }
       await this.prisma.oAuthAuthorizationCode.update({ where: { id: authCode.id }, data: { consumedAt: new Date() } });
+      assertHumanAccount(authCode.user, { asAuth: true });
       return this.issueOAuthTokens(authCode.user.id, client.clientId, authCode.scopes);
     }
 
@@ -67,10 +77,14 @@ export class OAuthCoreService {
     const payload = await this.jwt.verifyAsync<{ sub: string }>(accessToken, { secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET') });
     const user = await this.prisma.user.findUnique({ where: { id: payload.sub } });
     if (!user) throw new UnauthorizedException('Пользователь не найден');
+    assertHumanAccount(user, { asAuth: true });
     return { sub: user.id, email: user.email, phone: user.phone, name: user.displayName, picture: user.avatarUrl };
   }
 
   private async issueOAuthTokens(userId: string, clientId: string, scopes: string[]) {
+    const user = await this.prisma.user.findUnique({ where: { id: userId } });
+    if (!user) throw new UnauthorizedException('Пользователь не найден');
+    assertHumanAccount(user, { asAuth: true });
     const issuer = await this.oauthIssuer.resolveIssuer();
     const accessToken = await this.jwt.signAsync({ sub: userId, aud: clientId, scopes, typ: 'access_token' }, { secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'), expiresIn: '15m', issuer });
     const refreshToken = await this.jwt.signAsync({ sub: userId, aud: clientId, scopes, typ: 'refresh_token' }, { secret: this.config.getOrThrow<string>('JWT_REFRESH_SECRET'), expiresIn: '30d', issuer });