Check inactive OAuth2 clients

src/lib/server/oauth2/controller/authorization.ts

@@ -80,7 +80,7 @@ export class OAuth2AuthorizationController {
 		// console.debug('Parameter grant_type is', grantTypes.join(' '));
 
 		const client = await OAuth2Clients.fetchById(clientId);
-		if (!client) {
+		if (!client || client.activated === 0) {
 			throw new InvalidClient('Client not found');
 		}
 

src/lib/server/oauth2/controller/bearer.ts

@@ -1,3 +1,4 @@
+import { ApiUtils } from '$lib/server/api-utils';
 import { AccessDenied } from '../error';
 import { OAuth2AccessTokens, type OAuth2AccessToken } from '../model';
 
@@ -28,7 +29,7 @@ export class OAuth2BearerController {
 		} else if (url?.searchParams.has('access_token')) {
 			token = url.searchParams.get('access_token') as string;
 		} else {
-			const body = await request.json().catch(() => ({}));
+			const body = await ApiUtils.getJsonOrFormBody(request);
 			if (!body.access_token) {
 				throw new AccessDenied('Bearer token not found');
 			}

src/lib/server/oauth2/controller/introspection.ts

@@ -44,7 +44,7 @@ export class OAuth2IntrospectionController {
 
 		const client = await OAuth2Clients.fetchById(clientId);
 
-		if (!client) {
+		if (!client || client.activated === 0) {
 			throw new InvalidClient('Client not found');
 		}
 

src/lib/server/oauth2/controller/token.ts

@@ -56,7 +56,7 @@ export class OAuth2TokenController {
 
 		const client = await OAuth2Clients.fetchById(clientId);
 
-		if (!client) {
+		if (!client || client.activated === 0) {
 			throw new InvalidClient('Client not found');
 		}
 

src/lib/server/oauth2/model/tokens.ts

@@ -165,6 +165,10 @@ export class OAuth2Codes {
 		}
 
 		const client = await OAuth2Clients.fetchById(find.clientId as number);
+		if (!client || client.activated === 0) {
+			return undefined;
+		}
+
 		return {
 			...find,
 			clientIdPub: client.client_id,
@@ -227,6 +231,10 @@ export class OAuth2AccessTokens {
 		}
 
 		const client = await OAuth2Clients.fetchById(find.clientId as number);
+		if (!client || client.activated === 0) {
+			return undefined;
+		}
+
 		return {
 			...find,
 			clientIdPub: client.client_id
@@ -291,6 +299,10 @@ export class OAuth2RefreshTokens {
 		}
 
 		const client = await OAuth2Clients.fetchById(find.clientId as number);
+		if (!client || client.activated === 0) {
+			return undefined;
+		}
+
 		return {
 			...find,
 			clientIdPub: client.client_id