Ensure Downgraded Teams can't authenticate MQTT Clients

forge/db/controllers/TeamBrokerClient.js

@@ -10,6 +10,15 @@ module.exports = {
                 return false
             }
 
+            if (user.Team.suspended) {
+                return false
+            }
+
+            const properties = user.Team.TeamType.properties
+            if (!properties?.features?.teamBroker) {
+                return false
+            }
+
             if (!password || password.length > 128) {
                 return false
             }

forge/db/models/TeamBrokerClient.js

@@ -49,7 +49,13 @@ module.exports = {
                         teamId = M.Team.decodeHashid(teamHashId)
                     }
                     return this.findOne({
-                        where: { username, TeamId: teamId }
+                        where: { username, TeamId: teamId },
+                        include: {
+                            model: M.Team,
+                            include: {
+                                model: M.TeamType
+                            }
+                        }
                     })
                 },
                 byTeam: async (teamHashId, pagination = {}, where = {}) => {

test/unit/forge/ee/routes/teamBroker/index_spec.js

@@ -438,6 +438,27 @@ describe('Team Broker API', function () {
                 const result = response.json()
                 result.should.have.property('result', 'deny')
             })
+            it('Test Authentication fail suspended team', async function () {
+                app.team.suspended = true
+                await app.team.save()
+
+                const response = await app.inject({
+                    method: 'POST',
+                    url: '/api/comms/v2/auth',
+                    cookies: { sid: TestObjects.tokens.bob },
+                    body: {
+                        username: `bob@${app.team.hashid}`,
+                        password: 'bbPassword',
+                        clientId: `bob@${app.team.hashid}`
+                    }
+                })
+                response.statusCode.should.equal(200)
+                const result = response.json()
+                result.should.have.property('result', 'deny')
+
+                app.team.suspended = false
+                await app.team.save()
+            })
             it('Test subscribe allowed', async function () {
                 const response = await app.inject({
                     method: 'POST',