API tokens remain valid for disabled users

[Galaxync]

API tokens remain valid for disabled users

Summary

API token authentication accepts a token for a user without checking whether that user account is active. As a result, disabling a user does not revoke API access.

Proof of concept

1. Create a normal user and record their API token.
2. Disable the user account, for example by setting is_active=False.
3. Send an API request with the disabled user's token:

GET /api/v1/dashboard/ HTTP/1.1
Authorization: Token <disabled-user-api-token>

4. The API request succeeds and returns dashboard data.

Evidence

• shynet/api/mixins.py:11 authenticates by User.objects.filter(api_token=token).first() and does not filter by is_active=True.
• shynet/api/mixins.py:20 only checks that a user object was authenticated.
• shynet/api/views.py:14 exposes dashboard API data.
• core/models.py:53 defines the API token field.

Expected behavior

API requests from disabled users should be rejected, normally with 401 or 403.

Actual behavior

A disabled user's API token remains valid.

Impact

Revoking or disabling a user account does not reliably remove API access. A retained token can continue to access analytics data after the account has been disabled.

Suggested fix

Require is_active=True during token authentication, and consider clearing or rotating API tokens when accounts are disabled.