Aware comments (#15480)

* Make sure we cannot deactivate the owner

* Use different error code when trying to fetch token for inactive user

homeassistant/auth/__init__.py

@@ -148,6 +148,8 @@ class AuthManager:
 
     async def async_deactivate_user(self, user):
         """Deactivate a user."""
+        if user.is_owner:
+            raise ValueError('Unable to deactive the owner')
         await self._store.async_deactivate_user(user)
 
     async def async_remove_credentials(self, credentials):

homeassistant/components/auth/__init__.py

@@ -243,6 +243,7 @@ class GrantTokenView(HomeAssistantView):
         if client_id is None or not indieauth.verify_client_id(client_id):
             return self.json({
                 'error': 'invalid_request',
+                'error_description': 'Invalid client id',
             }, status_code=400)
 
         grant_type = data.get('grant_type')
@@ -272,14 +273,16 @@ class GrantTokenView(HomeAssistantView):
         if credentials is None:
             return self.json({
                 'error': 'invalid_request',
+                'error_description': 'Invalid code',
             }, status_code=400)
 
         user = await hass.auth.async_get_or_create_user(credentials)
 
         if not user.is_active:
             return self.json({
-                'error': 'invalid_request',
+                'error': 'access_denied',
-            }, status_code=400)
+                'error_description': 'User is not active',
+            }, status_code=403)
 
         refresh_token = await hass.auth.async_create_refresh_token(user,
                                                                    client_id)

tests/auth/test_init.py

@@ -291,3 +291,14 @@ async def test_refresh_token_not_requires_client_for_system_user(hass):
     token = await manager.async_create_refresh_token(user)
     assert token is not None
     assert token.client_id is None
+
+
+async def test_cannot_deactive_owner(mock_hass):
+    """Test that we cannot deactive the owner."""
+    manager = await auth.auth_manager_from_config(mock_hass, [])
+    owner = MockUser(
+        is_owner=True,
+    ).add_to_auth_manager(manager)
+
+    with pytest.raises(ValueError):
+        await manager.async_deactivate_user(owner)

tests/components/auth/test_init.py

@@ -40,7 +40,10 @@ async def test_login_new_user_and_trying_refresh_token(hass, aiohttp_client):
     })
 
     # User is not active
-    assert resp.status == 400
+    assert resp.status == 403
+    data = await resp.json()
+    assert data['error'] == 'access_denied'
+    assert data['error_description'] == 'User is not active'
 
 
 def test_credential_store_expiration():