pocket-id: fix CVE-2026-43983

Not-cherry-picked-because: the package in unstable has advanced to the next major version

pkgs/by-name/po/pocket-id/CVE-2026-43983.patch

@@ -0,0 +1,57 @@
+diff --git a/backend/internal/service/oidc_service.go b/backend/internal/service/oidc_service.go
+index ef765b277..6c09cb8c5 100644
+--- a/backend/internal/service/oidc_service.go
++++ b/backend/internal/service/oidc_service.go
+@@ -534,6 +534,36 @@ func (s *OidcService) createTokenFromRefreshToken(ctx context.Context, input dto
+ 		return CreatedTokens{}, &common.OidcInvalidRefreshTokenError{}
+ 	}
+ 
++	if storedRefreshToken.User.Disabled {
++		return CreatedTokens{}, &common.OidcInvalidRefreshTokenError{}
++	}
++
++	var authorizedClient model.UserAuthorizedOidcClient
++	err = tx.
++		WithContext(ctx).
++		Where("user_id = ? AND client_id = ?", storedRefreshToken.UserID, input.ClientID).
++		First(&authorizedClient).
++		Error
++	if errors.Is(err, gorm.ErrRecordNotFound) {
++		err = tx.WithContext(ctx).Delete(&storedRefreshToken).Error
++		if err != nil {
++			return CreatedTokens{}, err
++		}
++
++		err = tx.Commit().Error
++		if err != nil {
++			return CreatedTokens{}, err
++		}
++
++		return CreatedTokens{}, &common.OidcInvalidRefreshTokenError{}
++	} else if err != nil {
++		return CreatedTokens{}, err
++	}
++
++	if !s.IsUserGroupAllowedToAuthorize(storedRefreshToken.User, *client) {
++		return CreatedTokens{}, &common.OidcAccessDeniedError{}
++	}
++
+ 	// Generate a new access token
+ 	authenticationMethods := storedRefreshToken.AuthenticationMethod
+ 	accessToken, err := s.jwtService.GenerateOAuthAccessToken(storedRefreshToken.User, input.ClientID, authenticationMethods)
+@@ -1500,6 +1537,15 @@ func (s *OidcService) RevokeAuthorizedClient(ctx context.Context, userID string,
+ 		return err
+ 	}
+ 
++	err = tx.
++		WithContext(ctx).
++		Where("user_id = ? AND client_id = ?", userID, clientID).
++		Delete(&model.OidcRefreshToken{}).
++		Error
++	if err != nil {
++		return err
++	}
++
+ 	err = tx.Commit().Error
+ 	if err != nil {
+ 		return err

pkgs/by-name/po/pocket-id/package.nix

@@ -28,6 +28,11 @@ buildGo125Module (finalAttrs: {
       url = "https://github.com/pocket-id/pocket-id/commit/34890235ba8c2d856e3a121fdf59fe9d627e8596.patch?full_index=1";
       hash = "sha256-Th1/J9M7kxcXyuNa0CZIIX1CuIS31Dx12+O4bzSxS0E=";
     })
+    # based on https://github.com/pocket-id/pocket-id/commit/978ac87deffec58beaccd15aead975e91b94c8a5.patch, modifications:
+    # - remove added tests due to merge conflicts
+    # - remove group restriction check as it's a v2 feature: https://github.com/pocket-id/pocket-id/pull/1164
+    # - adapt to IsUserGroupAllowedToAuthorize function signature changes
+    ./CVE-2026-43983.patch
   ];
 
   patchFlags = [ "-p2" ];