only allow verified accounts to login

2020-09-19 14:29:19 -04:00
parent d478bd0e34
commit ac1aea23dc
2 changed files with 4 additions and 3 deletions
--- a/src/auth/operations/login.js
+++ b/src/auth/operations/login.js
@@ -32,9 +32,9 @@ async function login(args) {

  const userDoc = await Model.findByUsername(email);

-
-  if (!userDoc) throw new AuthenticationError();
-
+  if (!userDoc || (args.collection.config.auth.emailVerification && !userDoc.verified)) {
+    throw new AuthenticationError();
+  }
  const authResult = await userDoc.authenticate(password);

  if (!authResult.user) {