1

server-node/src/middleware/auth.ts

@@ -22,10 +22,13 @@ export function requireJwtAuth(config: AppConfig, userRepository: UserRepository
       }
 
       const claims = await verifyAccessToken(token, config);
-      const user = userRepository.findById(claims.userId);
+      const user = await userRepository.findById(claims.userId);
       if (!user) {
         throw unauthorized('用户不存在');
       }
+      if (user.accountStatus === 'disabled') {
+        throw unauthorized('账号已被禁用');
+      }
       if (user.tokenVersion !== claims.tokenVersion) {
         throw unauthorized('登录状态已失效，请重新登录');
       }