security fix and fix parent pages

app/Http/Middleware/MultiAuth.php

@@ -22,6 +22,10 @@ class MultiAuth
         if ($sanctumUser) {
             Auth::setUser($sanctumUser);
 
+            if ($response = $this->denyUnavailableAccount($sanctumUser)) {
+                return $response;
+            }
+
             return $next($request);
         }
 
@@ -29,6 +33,10 @@ class MultiAuth
             if ($apiUser = Auth::guard('api')->user()) {
                 Auth::setUser($apiUser);
 
+                if ($response = $this->denyUnavailableAccount($apiUser)) {
+                    return $response;
+                }
+
                 return $next($request);
             }
         } catch (\Throwable) {
@@ -41,6 +49,10 @@ class MultiAuth
                 if ($jwtUser) {
                     Auth::setUser($jwtUser);
 
+                    if ($response = $this->denyUnavailableAccount($jwtUser)) {
+                        return $response;
+                    }
+
                     return $next($request);
                 }
             } catch (JWTException $e) {
@@ -49,4 +61,17 @@ class MultiAuth
 
         return response()->json(['message' => 'Unauthorized.'], 401);
     }
+
+    private function denyUnavailableAccount(object $user): ?Response
+    {
+        $status = strtolower(trim((string) ($user->status ?? '')));
+        $isVerified = filter_var($user->is_verified ?? false, FILTER_VALIDATE_BOOLEAN);
+        $isSuspended = filter_var($user->is_suspended ?? false, FILTER_VALIDATE_BOOLEAN);
+
+        if (! $isVerified || $status !== 'active' || $isSuspended) {
+            return response()->json(['message' => 'Account unavailable.'], 403);
+        }
+
+        return null;
+    }
 }