security fix and fix parent pages

2026-07-06 02:14:16 -04:00
parent 39228168c8
commit 90f9857b06
43 changed files with 4323 additions and 132 deletions
@@ -20,10 +20,27 @@ class ApiJwtAuth
            }

            Auth::setUser($user);
+
+            if ($response = $this->denyUnavailableAccount($user)) {
+                return $response;
+            }
        } catch (JWTException $e) {
            return response()->json(['status' => false, 'message' => 'Unauthorized.'], 401);
        }

        return $next($request);
    }
+
+    private function denyUnavailableAccount(object $user): ?Response
+    {
+        $status = strtolower(trim((string) ($user->status ?? '')));
+        $isVerified = filter_var($user->is_verified ?? false, FILTER_VALIDATE_BOOLEAN);
+        $isSuspended = filter_var($user->is_suspended ?? false, FILTER_VALIDATE_BOOLEAN);
+
+        if (! $isVerified || $status !== 'active' || $isSuspended) {
+            return response()->json(['message' => 'Account unavailable.'], 403);
+        }
+
+        return null;
+    }
 }