Logout inactive user

Describe the bug The @login_required decorator does not check if a user is active. I’m not sure if this was a design choice, but intuitively I would expect to be able to log a user out by deactivating it.

To Reproduce Steps to reproduce the behavior:

1. Create a user
2. Login with that user
3. Set user.is_active = False
4. User is still able to access view decorated with @login_required

Expected behavior Intuitively I would expect this line in the @login_required decorator

elif not current_user.is_authenticated:
    return current_app.login_manager.unauthorized()

to read

elif not (current_user.is_authenticated and current_user.is_active):
    return current_app.login_manager.unauthorized()

Screenshots NA

Desktop (please complete the following information):

• OS: N/A
• Browser [e.g. chrome, safari]: N/A
• Version [e.g. 22]: 0.4.1 (I think it came as a dependency from flask-security)

Additional context Again, not sure whether it is a genuine bug or a misunderstanding from my side. We could get around it on our side by overriding user.is_authenticated in our User class to return super().is_authenticated and self.is_active.

Addressed in #489

[alanhamlett]

If @login_required checks the User.is_active property it leads people to not check is_active in their is_authenticated method. That leads to inactive users still able to access resources requiring login when manually checking current_user.is_authenticated. Instead, we’ll update UserMixin.is_authenticated to:

    @property
    def is_authenticated(self):
        return self.is_active

[WaizungTaam]

Setting a logged-in user inactive is meaningless. is_active = False prevents inactive users from logging in, and login_user() is doing the job.

To inactivate an already logged-in user, logout first, and then set is_active = False to prevent it from logging in again.