[MuhammadDG]

Overview

This PR ensures soft-deleted accounts are consistently rejected across every authentication entry point — login, token refresh, and credential reset — while remaining excluded from ordinary email lookup. It also hardens the JWT strategy so a valid token issued before deletion can no longer authenticate a deleted user.

Related Issue

Changes

🔐 Auth Service Guards

• [MODIFY] backend/src/auth/auth.service.ts

  • Reject soft-deleted users in login, refresh, and credential-reset paths before any credential or token work is performed.
  • Keep deleted accounts excluded from ordinary email lookup so they cannot be resolved through standard flows.

• [MODIFY] backend/src/auth/strategy/jwt.strategy.ts

  • Validate the resolved user during JWT validation and reject the request when the account is soft-deleted, so pre-existing tokens stop working after deletion.

• [MODIFY] backend/src/auth/auth.service.spec.ts

  • Added coverage asserting each auth entry point (login, refresh, reset) rejects a soft-deleted user, plus the email-lookup exclusion and JWT rejection path.

Verification Results

npm test -- backend/src/auth/auth.service.spec.ts
✅ Auth service suite passed (soft-delete rejection covered for each entry point)

Acceptance Criteria	Status
All auth entry points consistently reject a soft-deleted user	✅ Login, refresh, reset, and JWT validation reject deleted accounts
Tests cover each path	✅ Spec updated for login, refresh, reset, email lookup, and JWT strategy

Closes #639

[drips-wave]

@MuhammadDG Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits