security fix and fix parent pages

app/Http/Middleware/ApiDocsAuth.php

@@ -38,6 +38,10 @@ class ApiDocsAuth
             return $this->deny('Unauthorized access to documentation.', 401);
         }
 
+        if ($response = $this->denyUnavailableAccount($user)) {
+            return $response;
+        }
+
         if (! $this->userIsAdmin((int) $user->id)) {
             return $this->deny('Admin privileges required.', 403);
         }
@@ -55,6 +59,19 @@ class ApiDocsAuth
             ->exists();
     }
 
+    private function denyUnavailableAccount(object $user): ?Response
+    {
+        $status = strtolower(trim((string) ($user->status ?? '')));
+        $isVerified = filter_var($user->is_verified ?? false, FILTER_VALIDATE_BOOLEAN);
+        $isSuspended = filter_var($user->is_suspended ?? false, FILTER_VALIDATE_BOOLEAN);
+
+        if (! $isVerified || $status !== 'active' || $isSuspended) {
+            return response()->json(['message' => 'Account unavailable.'], 403);
+        }
+
+        return null;
+    }
+
     private function deny(string $message, int $status): Response
     {
         return response()->json([