update api and add more features

app/Http/Controllers/Api/Auth/AuthController.php

@@ -20,8 +20,7 @@ class AuthController extends BaseApiController
             $payload = is_array($decoded) ? $decoded : [];
         }
 
-        // Match CodeIgniter apiLogin: raw email/password (no trim); empty check is identical to CI `!$email || !$password`.
-        $email = (string) ($payload['email'] ?? '');
+        $email = strtolower(trim((string) ($payload['email'] ?? '')));
         $password = (string) ($payload['password'] ?? '');
 
         if ($email === '' || $password === '') {
@@ -39,7 +38,7 @@ class AuthController extends BaseApiController
             ], 429);
         }
 
-        $user = User::query()->where('email', $email)->first();
+        $user = User::query()->whereRaw('LOWER(email) = ?', [$email])->first();
         if (!$user) {
             $security->logIpAttempt((string) $ip);
 
@@ -49,13 +48,6 @@ class AuthController extends BaseApiController
             ], 401);
         }
 
-        if ($user->is_suspended) {
-            return response()->json([
-                'status' => false,
-                'message' => 'Account suspended. Please reset your password.',
-            ], 403);
-        }
-
         if (! ci_password_verify($password, (string) $user->password)) {
             $security->handleFailedLogin($user, $email, (string) $ip);
 
@@ -65,6 +57,15 @@ class AuthController extends BaseApiController
             ], 401);
         }
 
+        // Suspension is checked AFTER credentials are verified so that the
+        // response shape cannot be used to enumerate which emails exist.
+        if ($user->is_suspended) {
+            return response()->json([
+                'status' => false,
+                'message' => 'Account suspended. Please reset your password.',
+            ], 403);
+        }
+
         $security->resetFailedAttempts($user);
         $security->logSuccessfulLogin($user->fresh(), $request);