auth: improve pam flow and user status

backend/app.py

@@ -11,6 +11,7 @@ from backend.auth import (
     authenticate_admin_user,
     get_current_admin,
     is_authorized_admin,
+    is_account_locked,
     issue_token,
     list_manageable_users,
 )
@@ -142,7 +143,14 @@ def oidc_status(settings: Settings = Depends(get_settings)) -> dict:
 def users(settings: Settings = Depends(get_settings)) -> List[UserStatus]:
     logged_in = set(actions.list_logged_in_users())
     targets = list_manageable_users(settings)
-    return [UserStatus(user=user, logged_in=user in logged_in) for user in targets]
+    return [
+        UserStatus(
+            user=user,
+            logged_in=user in logged_in,
+            account_locked=is_account_locked(user),
+        )
+        for user in targets
+    ]
 
 
 @app.post(
@@ -151,10 +159,16 @@ def users(settings: Settings = Depends(get_settings)) -> List[UserStatus]:
     dependencies=[Depends(get_current_admin)],
 )
 def disable_user(
+    current_user: str = Depends(get_current_admin),
     username: str = Depends(validate_user),
     payload: ActionRequest | None = Body(default=None),
     settings: Settings = Depends(get_settings),
 ) -> ActionResponse:
+    if username == current_user:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Refusing to disable the currently authenticated user",
+        )
     try:
         steps = actions.disable_user(
             username,