SECURITY: isActive=false students NOT blocked — auth/callback + render path lack isActive gate; disabled+roled user with live session loads app

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-19
• wi-cli-venus completed · 2026-06-20
  SHIPPED v1.73.11 SHA 43a145f (deploy dpl_6cR8NMhb2GHoCQMyM1Hd2vX34RvB, gru1). Closes the isActive=false students-can-still-login gap (Elazar concern e, Puia's failed-test cohort). Render gate in getCurrentUser (realUser.isActive===false→null) + auth/callback main + pre-registered branches (isActive===false→logAuthz+signOut+redirect /login?error=cuenta-deshabilitada, placed before authId-link txn) + login-client amber message + types/db.ts isActive. ===false-only, no legit-user impact, view-as target deliberately allowed, vUsers untouched. Audit triple-green: pre-impl design + pre-push diff (incl DiD delta) + PTD PASS:43a145f (build READY, runtime 0 lines/30m, live-version+deploymentId confirmed). Greenlit by Elazar via pm-venus (evolutiva-management lead) 2026-06-19. Coverage caveat: disabled-login branches not yet runtime-exercised (no night-traffic disabled login) — first real disabled-user login is live proof; logic statically verified + import-clean.