Deny suspended directory identities

src/internal/server/oidc/token.go

@@ -108,6 +108,14 @@ func (h *TokenHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "user not found", http.StatusInternalServerError)
 		return
 	}
+	if isSuspended(user) {
+		h.Sessions.Delete(code)
+		profileerrors.RejectedForSafety(
+			"account is suspended",
+			"account_lifecycle",
+		).Write(w, http.StatusForbidden)
+		return
+	}
 
 	// 6. Build JWT claims.
 	now := time.Now()
@@ -270,6 +278,10 @@ func containsString(values []string, wanted string) bool {
 	return false
 }
 
+func isSuspended(user *domain.User) bool {
+	return containsString(user.Groups, "netkingdom-suspended")
+}
+
 // ---------------------------------------------------------------------------
 // IAM Profile core claims (KEY-WP-0005-T01)
 // ---------------------------------------------------------------------------

src/internal/server/oidc/token_test.go

@@ -202,6 +202,30 @@ func TestTokenHandler_ValidExchange_ReturnsJWT(t *testing.T) {
 	}
 }
 
+func TestTokenHandler_SuspendedUserCannotExchangeCode(t *testing.T) {
+	sessions := oidc.NewSessionStore()
+	user := aliceUser()
+	user.Groups = append(user.Groups, "netkingdom-suspended")
+	users := &mockUserRepo{users: map[string]*domain.User{"alice": user}}
+	h, _ := newTokenHandler(t, sessions, users)
+	verifier := "suspended-verifier-with-enough-entropy"
+	code := seededSession(sessions, verifier)
+	req := tokenRequest(url.Values{
+		"grant_type":    {"authorization_code"},
+		"code":          {code},
+		"client_id":     {"test-client"},
+		"code_verifier": {verifier},
+	})
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("expected 403, got %d: %s", w.Code, w.Body.String())
+	}
+	if _, ok := sessions.Get(code); ok {
+		t.Fatal("authorization code must be consumed when suspension is detected")
+	}
+}
+
 func TestTokenHandler_WrongGrantType_FeatureNotSupported(t *testing.T) {
 	sessions := oidc.NewSessionStore()
 	users := &mockUserRepo{}

src/internal/server/oidc/userinfo.go

@@ -59,6 +59,10 @@ func (h *UserinfoHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `{"error":"invalid_token","description":"subject not found"}`, http.StatusUnauthorized)
 		return
 	}
+	if isSuspended(user) {
+		http.Error(w, `{"error":"invalid_token","description":"subject is suspended"}`, http.StatusUnauthorized)
+		return
+	}
 
 	// 5. Build response claims filtered by the scopes embedded in the token.
 	scopeStr, _ := claims["scope"].(string)

src/internal/server/oidc/userinfo_test.go

@@ -100,6 +100,26 @@ func TestUserinfoHandler_ValidToken_ReturnsClaims(t *testing.T) {
 	}
 }
 
+func TestUserinfoHandler_SuspendedUserInvalidatesToken(t *testing.T) {
+	user := aliceUser()
+	user.Groups = append(user.Groups, "netkingdom-suspended")
+	users := &mockUserRepo{users: map[string]*domain.User{"alice": user}}
+	h, key := newUserinfoHandler(t, users)
+	now := time.Now()
+	token := buildToken(t, map[string]interface{}{
+		"iss": "https://auth.netkingdom.local",
+		"sub": "alice",
+		"aud": "test-client",
+		"exp": now.Add(10 * time.Minute).Unix(),
+		"iat": now.Unix(),
+	}, key)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, userinfoRequest(token))
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
 func TestUserinfoHandler_MissingAuthorization_Returns401(t *testing.T) {
 	users := &mockUserRepo{}
 	h, _ := newUserinfoHandler(t, users)