fix(mailer): reject incoming email tokens of users who cannot sign in (#39833) (#39841)

Backport #39833 by @basavaraj-sm05

Incoming email reply tokens stay valid for a year and are verified with
`user.Rands`, which is not rotated when an account is deactivated or
prohibited from signing in. A suspended user could therefore keep
commenting on public repos by replying to old notifications.

`DecodeToken` now rejects tokens of organizations, inactive users and
users prohibited from signing in, which covers every incoming mail
handler.

Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/mailer/token/token.go

@@ -98,7 +98,7 @@ func DecodeToken(ctx context.Context, token string) (HandlerType, *user_model.Us
 		return UnknownHandlerType, nil, nil, err
 	}
 
-	user, err := user_model.GetUserByID(ctx, userID)
+	user, err := user_model.GetValidDoerUserByID(ctx, userID)
 	if err != nil {
 		return UnknownHandlerType, nil, nil, err
 	}

services/mailer/token/token_test.go

@@ -0,0 +1,34 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package token
+
+import (
+	"testing"
+
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+
+	_ "gitea.dev/models"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMain(m *testing.M) {
+	unittest.MainTest(m)
+}
+
+func TestDecodeTokenRejectsUserWhoCannotSignIn(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	for id, expectedErr := range map[int64]string{2: "", 3: "not a doer", 9: "inactive", 37: "prohibited"} {
+		token, err := CreateToken(ReplyHandlerType, unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: id}), []byte{1})
+		require.NoError(t, err)
+		_, _, _, err = DecodeToken(t.Context(), token)
+		if expectedErr == "" {
+			assert.NoError(t, err)
+		} else {
+			assert.ErrorContains(t, err, expectedErr)
+		}
+	}
+}