[adit24dhaya]

Description

An account deactivated after main login could still gain secondary BM/Community Portal access with its existing token and password. Deleted accounts/server errors returned HTTP 200 with an empty/error response. Require a current active account and return explicit failures.

Original task request

HGN Phase III: Social Architecture — Deliverable 0, page 6. Original requirements: check that the person is active in Main and require secondary login with current credentials. Found during Aditya's assigned Phase 3 general-functionality E2E testing task; this does not complete the entire 60-hour assignment.

Related PRS (if any):

Frontend: OneCommunityGlobal/HighestGoodNetworkApp#5789. Test both branches for user-facing messages; merge backend first.

Main changes explained:

• Return 401 for missing accounts/invalid login tokens and 403 for inactive accounts, without issuing portal access.
• Preserve active-account email/password verification and the existing token payload.
• Return a generic HTTP 500 for verification/database failures instead of serializing errors as success.

How to test:

1. Use Node 20 and an isolated database. Never deactivate a real/shared user for testing.
2. Issue a main token for a synthetic account, then deactivate/delete that stored account. POST /api/bm/login with that token and matching credentials: expect 403/401 and no token.
3. Active matching credentials must still succeed; wrong email/password remain 422. Missing/expired main tokens remain denied by existing JWT middleware. Simulated database failures return generic 500.
4. Run npx jest src/controllers/bmdashboard/tests/bmLoginController.test.js --runInBand.

Validation: 7 backend unit tests passed. Independent HTTP checks using the actual controller/JWT verifier/user model, real signing/password checks and disposable MongoDB passed 7 API cases, after reproducing the inactive-account and deleted-account failures before the fix. Paired browser checks passed 16 cases at 390/1280px. Babel build and changed-file lint pass (zero errors, two existing warnings).

Screenshots or videos of changes:

Note:

This secondary endpoint is shared by BM and Community Portal. No continuous token revocation, main-login policy change or event-level authorization redesign is included. Browser checks use actual auth startup/actions/reducer, portal login/gate and logout; main-token issuance and destination content are fixture-only. No shared writes, real notifications or manual deployments. Code/UI pictures and a short walkthrough are prepared locally in Week 6.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud