Deny suspended directory identities

src/internal/server/oidc/token_test.go

@@ -202,6 +202,30 @@ func TestTokenHandler_ValidExchange_ReturnsJWT(t *testing.T) {
 	}
 }
 
+func TestTokenHandler_SuspendedUserCannotExchangeCode(t *testing.T) {
+	sessions := oidc.NewSessionStore()
+	user := aliceUser()
+	user.Groups = append(user.Groups, "netkingdom-suspended")
+	users := &mockUserRepo{users: map[string]*domain.User{"alice": user}}
+	h, _ := newTokenHandler(t, sessions, users)
+	verifier := "suspended-verifier-with-enough-entropy"
+	code := seededSession(sessions, verifier)
+	req := tokenRequest(url.Values{
+		"grant_type":    {"authorization_code"},
+		"code":          {code},
+		"client_id":     {"test-client"},
+		"code_verifier": {verifier},
+	})
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("expected 403, got %d: %s", w.Code, w.Body.String())
+	}
+	if _, ok := sessions.Get(code); ok {
+		t.Fatal("authorization code must be consumed when suspension is detected")
+	}
+}
+
 func TestTokenHandler_WrongGrantType_FeatureNotSupported(t *testing.T) {
 	sessions := oidc.NewSessionStore()
 	users := &mockUserRepo{}