Dev: banning users

[kenjis]

Implement a feature to ban users.

See

• https://forum.codeigniter.com/showthread.php?tid=83570&pid=401007#pid401007
• Bug: when active field in users table is false users can login #459 (comment)

[davidnsai]

Hi @kenjis I would like to implement this feature. Would it be okay if the issue was assigned to me?

[lonnieezell]

@davidnsai that sounds great! I've assigned it to you. I look forward to seeing it, thanks.

[kenjis]

@davidnsai Yes, no problem! Please do it.

[davidnsai]

So I've been looking at the best implementation for this feature I had a number of thought around it

1. It could be implemented as an action, that way it can be an optional inclusion to the shield functionality.
2. It could be done in such a way that the check is done every time in the attempt() method.
3. Additional code can be added to the filters so that a check is made, this will mean that if a user is banned, they are no longer able to access any site features.
   Regardless though, I still intended to have a modification to the filter to ensure than when a user is banned while they are logged in, their next request is rejected.

[Chuma04]

That sounds great.

[kenjis]

Action seems to be a little different because it is an additional action required at the time of authentication.
It also requires a User Identity record.

User table has status and it can be used.
At least Myth:Auth has the implementation like that.
See https://github.com/lonnieezell/myth-auth/blob/1c646c58e8b9b956b2163ebda8e5ec7e9ed609ce/src/Entities/User.php#L196-L202

[lonnieezell]

Yes, the status field on the user table is what was originally intended to store that (and potentially other statuses, depending on the app needs). status_message was intended to allow a reason to be recorded at the time of the status change that could be relayed to the user, like "You're account has been banned for too many hacking attempts" or whatever.

Off the top of my head, I think adding it to the filter is probably all that's needed. Seems like that would let us more easily redirect with a custom message.