sriram veeraghanta fd16d033fc fix(api): reject API key auth for deactivated user accounts (#9225) ...

The custom API key authentication only verified that the APIToken row was
active and unexpired; it never checked the owning user's is_active flag.
DRF's IsAuthenticated only checks user.is_authenticated (always True for a
real User), so a user whose account was deactivated could keep using a
previously issued API key indefinitely.

Add user__is_active=True to the validate_api_token() lookup so a token tied
to a disabled account is treated as invalid (a generic AuthenticationFailed,
avoiding account-state disclosure). Applied to both the external API
middleware (plane/api) and the identical, currently unused copy in
plane/app to prevent the gap from being reintroduced.

Adds unit coverage on validate_api_token and an end-to-end contract test
proving GET /api/v1/users/me/ is denied once the account is deactivated.

2026-06-10 11:36:45 +05:30

..

admin

fix: declare @tailwindcss/postcss in admin/space/web for Docker builds (#9189)

2026-06-01 16:44:16 +05:30

api

fix(api): reject API key auth for deactivated user accounts (#9225)

2026-06-10 11:36:45 +05:30

live

fix: bump npm deps to resolve Dependabot advisories (#9191)

2026-06-01 18:37:35 +05:30

proxy

fix: security vulnerabilities for plane docker images (#9140)

2026-05-26 14:25:01 +05:30

space

fix: declare @tailwindcss/postcss in admin/space/web for Docker builds (#9189)

2026-06-01 16:44:16 +05:30

web

[GIT-238] refactor: migrate types from apps/web to @plane/types (#9203)

2026-06-09 18:06:08 +05:30