Reject 2FA verification tokens for API authentication

services/nginx/app/classes/authentication.php

@@ -100,9 +100,16 @@ class authentication implements authentication_i
     public function validate_token(string $token): bool
     {
         // First: try validating as a classic user auth token
-        $dbToken = (new tokens_o())->getToken($token);
-        if ($dbToken && $dbToken->id) {
-            return true;
+        try {
+            $dbToken = (new tokens_o())->getToken($token);
+            if ($dbToken && $dbToken->id) {
+                $type = $dbToken->type->value();
+                if ($type === 'AUTH_TOKEN' || $type === 'AUTH_TOKEN_SUBUSER') {
+                    return true;
+                }
+            }
+        } catch (Exception) {
+            // Ignore and continue to subuser session validation
         }
         // Fallback: try validating as a subuser session token
         $subuser = (new subusers_o())->getSubuserBySessionToken($token);
@@ -129,11 +136,18 @@ class authentication implements authentication_i
         // Strip the Bearer prefix
         $token = str_replace('Bearer ', '', $token);
         // Get the token from the database
-        $token = (new tokens_o())->getToken($token);
+        try {
+            $token = (new tokens_o())->getToken($token);
+        } catch (Exception) {
+            return false;
+        }
         // Check if the token exists
         if (!$token->id) {
             return false;
         }
+        if ($token->type->value() !== 'AUTH_TOKEN' && $token->type->value() !== 'AUTH_TOKEN_SUBUSER') {
+            return false;
+        }
         if ($token->type->value() === "AUTH_TOKEN_SUBUSER") {
             // Get the customer number from the headers
             if (!isset($headers['X-Customer-Number'])) {
@@ -232,4 +246,4 @@ class authentication implements authentication_i
         }
         return (int)$headers['X-Customer-Number'];
     }
-}
+}