Add user account suspension controls

app/Filament/Admin/Resources/Users/Actions/UserSuspensionActions.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Filament\Admin\Resources\Users\Actions;
+
+use App\Enums\TablerIcon;
+use App\Models\User;
+use App\Services\Users\AccountSuspensionService;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+
+final class UserSuspensionActions
+{
+    public static function suspend(): Action
+    {
+        return Action::make('suspendAccount')
+            ->label(trans('admin/user.suspension.actions.suspend'))
+            ->icon(TablerIcon::UserOff)
+            ->color('danger')
+            ->visible(fn (User $record) => !$record->isSuspended() && user()->isNot($record) && user()->can('update', $record))
+            ->modalHeading(fn (User $record) => trans('admin/user.suspension.actions.suspend_heading', ['username' => $record->username]))
+            ->modalDescription(trans('admin/user.suspension.actions.suspend_description'))
+            ->requiresConfirmation()
+            ->action(function (User $record, AccountSuspensionService $service): void {
+                /** @var User $actor */
+                $actor = user();
+                $service->suspend($actor, $record);
+
+                Notification::make()
+                    ->title(trans('admin/user.suspension.notifications.suspended'))
+                    ->success()
+                    ->send();
+            });
+    }
+
+    public static function unsuspend(): Action
+    {
+        return Action::make('unsuspendAccount')
+            ->label(trans('admin/user.suspension.actions.unsuspend'))
+            ->icon(TablerIcon::UserShield)
+            ->color('success')
+            ->visible(fn (User $record) => $record->isSuspended() && user()->isNot($record) && user()->can('update', $record))
+            ->modalHeading(fn (User $record) => trans('admin/user.suspension.actions.unsuspend_heading', ['username' => $record->username]))
+            ->modalDescription(trans('admin/user.suspension.actions.unsuspend_description'))
+            ->requiresConfirmation()
+            ->action(function (User $record, AccountSuspensionService $service): void {
+                /** @var User $actor */
+                $actor = user();
+                $service->unsuspend($actor, $record);
+
+                Notification::make()
+                    ->title(trans('admin/user.suspension.notifications.unsuspended'))
+                    ->success()
+                    ->send();
+            });
+    }
+}

app/Filament/Admin/Resources/Users/Pages/EditUser.php

@@ -3,6 +3,7 @@
 namespace App\Filament\Admin\Resources\Users\Pages;
 
 use App\Enums\TablerIcon;
+use App\Filament\Admin\Resources\Users\Actions\UserSuspensionActions;
 use App\Filament\Admin\Resources\Users\UserResource;
 use App\Models\User;
 use App\Services\Users\UserUpdateService;
@@ -32,6 +33,8 @@ public function boot(UserUpdateService $service): void
     protected function getDefaultHeaderActions(): array
     {
         return [
+            UserSuspensionActions::suspend(),
+            UserSuspensionActions::unsuspend(),
             DeleteAction::make()
                 ->tooltip(fn (User $user) => user()?->id === $user->id ? trans('admin/user.self_delete') : ($user->servers()->count() > 0 ? trans('admin/user.has_servers') : trans('filament-actions::delete.single.modal.actions.delete.label')))
                 ->disabled(fn (User $user) => user()?->id === $user->id || $user->servers()->count() > 0),

app/Filament/Admin/Resources/Users/Pages/ViewUser.php

@@ -2,6 +2,7 @@
 
 namespace App\Filament\Admin\Resources\Users\Pages;
 
+use App\Filament\Admin\Resources\Users\Actions\UserSuspensionActions;
 use App\Filament\Admin\Resources\Users\UserResource;
 use App\Traits\Filament\CanCustomizeHeaderActions;
 use App\Traits\Filament\CanCustomizeHeaderWidgets;
@@ -21,6 +22,8 @@ class ViewUser extends ViewRecord
     protected function getDefaultHeaderActions(): array
     {
         return [
+            UserSuspensionActions::suspend(),
+            UserSuspensionActions::unsuspend(),
             EditAction::make(),
         ];
     }

app/Filament/Admin/Resources/Users/UserResource.php

@@ -6,6 +6,7 @@
 use App\Enums\TablerIcon;
 use App\Extensions\OAuth\OAuthService;
 use App\Facades\Activity;
+use App\Filament\Admin\Resources\Users\Actions\UserSuspensionActions;
 use App\Filament\Admin\Resources\Users\Pages\CreateUser;
 use App\Filament\Admin\Resources\Users\Pages\EditUser;
 use App\Filament\Admin\Resources\Users\Pages\ListUsers;
@@ -53,6 +54,7 @@
 use Filament\Tables\Columns\IconColumn;
 use Filament\Tables\Columns\ImageColumn;
 use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\TernaryFilter;
 use Filament\Tables\Table;
 use Illuminate\Auth\Events\PasswordResetLinkSent;
 use Illuminate\Database\Eloquent\Builder;
@@ -124,6 +126,13 @@ public static function defaultTable(Table $table): Table
                     ->label(trans('admin/user.email'))
                     ->searchable()
                     ->sortable(),
+                TextColumn::make('account_status')
+                    ->label(trans('admin/user.suspension.status'))
+                    ->state(fn (User $user) => $user->isSuspended()
+                        ? trans('admin/user.suspension.suspended')
+                        : trans('admin/user.suspension.active'))
+                    ->badge()
+                    ->color(fn (User $record) => $record->isSuspended() ? 'danger' : 'success'),
                 IconColumn::make('mfa_email_enabled')
                     ->label(trans('profile.tabs.2fa'))
                     ->visibleFrom('lg')
@@ -142,10 +151,23 @@ public static function defaultTable(Table $table): Table
                     ->counts('subusers'),
             ])
             ->recordActions([
+                UserSuspensionActions::suspend(),
+                UserSuspensionActions::unsuspend(),
                 ViewAction::make()
                     ->hidden(fn ($record) => static::getEditAuthorizationResponse($record)->allowed()),
                 EditAction::make(),
             ])
+            ->filters([
+                TernaryFilter::make('suspended')
+                    ->label(trans('admin/user.suspension.status'))
+                    ->placeholder(trans('admin/user.suspension.filters.all'))
+                    ->trueLabel(trans('admin/user.suspension.filters.suspended'))
+                    ->falseLabel(trans('admin/user.suspension.filters.active'))
+                    ->queries(
+                        true: fn (Builder $query) => $query->whereNotNull('suspended_at'),
+                        false: fn (Builder $query) => $query->whereNull('suspended_at'),
+                    ),
+            ])
             ->toolbarActions([
                 BulkActionGroup::make([
                     DeleteBulkAction::make('exclude_bulk_delete'),
@@ -181,6 +203,16 @@ protected static function getDefaultTabs(): array
                     'lg' => 3,
                 ])
                 ->schema([
+                    Section::make(trans('admin/user.suspension.section.title'))
+                        ->description(trans('admin/user.suspension.section.description'))
+                        ->icon(TablerIcon::UserOff)
+                        ->columnSpanFull()
+                        ->visible(fn (?User $record) => $record?->isSuspended() ?? false)
+                        ->schema([
+                            TextEntry::make('suspended_at')
+                                ->label(trans('admin/user.suspension.suspended_at'))
+                                ->dateTime(),
+                        ]),
                     TextInput::make('username')
                         ->label(trans('admin/user.username'))
                         ->columnSpan([

app/Filament/Pages/Auth/Login.php

@@ -5,6 +5,7 @@
 use App\Enums\TablerIcon;
 use App\Extensions\Captcha\CaptchaService;
 use App\Extensions\OAuth\OAuthService;
+use App\Models\User;
 use BladeUI\Icons\Exceptions\SvgNotFound;
 use BladeUI\Icons\Factory as IconFactory;
 use Filament\Actions\Action;
@@ -17,6 +18,7 @@
 use Filament\Support\Colors\Color;
 use Filament\Support\Enums\Alignment;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Validation\ValidationException;
 
 class Login extends BaseLogin
@@ -92,6 +94,19 @@ protected function throwFailureValidationException(): never
     {
         $this->dispatch('reset-captcha');
 
+        $login = $this->data['login'] ?? null;
+        $password = $this->data['password'] ?? null;
+        if (is_string($login) && is_string($password)) {
+            $field = filter_var($login, FILTER_VALIDATE_EMAIL) ? 'email' : 'username';
+            $user = User::query()->where($field, mb_strtolower($login))->first();
+
+            if ($user?->isSuspended() && Hash::check($password, $user->password)) {
+                throw ValidationException::withMessages([
+                    'data.login' => User::suspensionMessage(),
+                ]);
+            }
+        }
+
         throw ValidationException::withMessages([
             'data.login' => trans('filament-panels::auth/pages/login.messages.failed')]);
     }

app/Http/Controllers/Api/Remote/SftpAuthenticationController.php

@@ -69,6 +69,11 @@ public function __invoke(SftpAuthenticationFormRequest $request): JsonResponse
             }
         }
 
+        if ($user->isSuspended()) {
+            Activity::event('auth:sftp.suspended')->subject($user)->log();
+            throw new HttpForbiddenException(User::suspensionMessage());
+        }
+
         $this->validateSftpAccess($user, $server);
 
         return new JsonResponse([

app/Http/Controllers/Auth/OAuthController.php

@@ -113,6 +113,10 @@ private function handleMissingUser(OAuthSchemaInterface $driver, OAuthUser $oaut
 
     private function loginUser(User $user): RedirectResponse
     {
+        if ($user->isSuspended()) {
+            return $this->errorRedirect(User::suspensionMessage());
+        }
+
         auth()->guard()->login($user, true);
 
         return redirect('/');

app/Http/Middleware/AddPasskeyErrorMessage.php

@@ -23,6 +23,17 @@ public function handle(Request $request, Closure $next): Response
         if ($response instanceof JsonResponse && ($response->isClientError() || $response->isServerError())) {
             $data = $response->getData(true);
 
+            if ($message = $request->session()->pull('passkeys.suspension_message')) {
+                $data['message'] = $message;
+                if (isset($data['errors'][0]) && is_array($data['errors'][0])) {
+                    $data['errors'][0]['detail'] = $message;
+                }
+
+                $response->setData($data);
+
+                return $response;
+            }
+
             if (is_array($data) && !isset($data['message']) && isset($data['errors'][0]['detail'])) {
                 $data['message'] = $data['errors'][0]['detail'];
 

app/Http/Middleware/EnsureAccountIsActive.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\User;
+use Closure;
+use Filament\Notifications\Notification;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+
+class EnsureAccountIsActive
+{
+    public const SESSION_KEY = 'auth_remember_token_hash';
+
+    public function handle(Request $request, Closure $next): mixed
+    {
+        /** @var User|null $user */
+        $user = $request->user();
+        if (!$user) {
+            return $next($request);
+        }
+
+        if ($user->isSuspended()) {
+            if ($request->is('api/*') || $request->expectsJson()) {
+                throw new AccessDeniedHttpException(User::suspensionMessage());
+            }
+
+            return $this->logout($request, User::suspensionMessage());
+        }
+
+        if ($request->hasSession()) {
+            $sessionTokenHash = $request->session()->get(self::SESSION_KEY);
+            $currentTokenHash = hash('sha256', (string) $user->getRememberToken());
+
+            if (!is_string($sessionTokenHash) || !hash_equals($sessionTokenHash, $currentTokenHash)) {
+                return $this->logout($request, trans('auth.session_expired'));
+            }
+        }
+
+        return $next($request);
+    }
+
+    private function logout(Request $request, string $message): mixed
+    {
+        auth()->guard()->logout();
+        if ($request->hasSession()) {
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+        }
+
+        Notification::make()->title($message)->danger()->persistent()->send();
+
+        return redirect()->route('filament.app.auth.login');
+    }
+}

app/Listeners/Auth/AuthenticationListener.php

@@ -3,6 +3,8 @@
 namespace App\Listeners\Auth;
 
 use App\Facades\Activity;
+use App\Http\Middleware\EnsureAccountIsActive;
+use App\Models\User;
 use Illuminate\Auth\Events\Failed;
 use Illuminate\Auth\Events\Login;
 
@@ -18,6 +20,13 @@ class AuthenticationListener
      */
     public function handle(Failed|Login $event): void
     {
+        if ($event instanceof Login && $event->user instanceof User && request()->hasSession()) {
+            request()->session()->put(
+                EnsureAccountIsActive::SESSION_KEY,
+                hash('sha256', (string) $event->user->getRememberToken())
+            );
+        }
+
         $activity = Activity::withRequestMetadata();
 
         if ($event->user) {

app/Models/User.php

@@ -70,6 +70,7 @@
  * @property string[]|null $mfa_app_recovery_codes
  * @property bool $mfa_email_enabled
  * @property bool $is_managed_externally
+ * @property Carbon|null $suspended_at
  * @property-read \Illuminate\Database\Eloquent\Collection<int, ActivityLog> $activity
  * @property-read int|null $activity_count
  * @property-read \Illuminate\Database\Eloquent\Collection<int, ApiKey> $apiKeys
@@ -162,7 +163,7 @@ class User extends Model implements AuthenticatableContract, AuthorizableContrac
     /**
      * The attributes excluded from the model's JSON form.
      */
-    protected $hidden = ['password', 'remember_token', 'mfa_app_secret', 'mfa_app_recovery_codes', 'oauth'];
+    protected $hidden = ['password', 'remember_token', 'mfa_app_secret', 'mfa_app_recovery_codes', 'oauth', 'suspended_at'];
 
     /**
      * Default values for specific fields in the database.
@@ -177,6 +178,7 @@ class User extends Model implements AuthenticatableContract, AuthorizableContrac
         'mfa_email_enabled' => false,
         'oauth' => '[]',
         'customization' => null,
+        'suspended_at' => null,
     ];
 
     /** @var array<array-key, string[]> */
@@ -213,6 +215,7 @@ protected function casts(): array
             'mfa_email_enabled' => 'boolean',
             'oauth' => 'array',
             'customization' => 'array',
+            'suspended_at' => 'datetime',
         ];
     }
 
@@ -277,6 +280,22 @@ public function servers(): HasMany
         return $this->hasMany(Server::class, 'owner_id');
     }
 
+    public function isSuspended(): bool
+    {
+        return !is_null($this->suspended_at);
+    }
+
+    public static function suspensionMessage(): string
+    {
+        $email = config('mail.from.address');
+
+        if (is_string($email) && filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            return trans('auth.account_suspended_contact', ['email' => $email]);
+        }
+
+        return trans('auth.account_suspended');
+    }
+
     public function apiKeys(): HasMany
     {
         return $this->hasMany(ApiKey::class)
@@ -472,6 +491,10 @@ public function isAdmin(): bool
 
     public function canAccessPanel(Panel $panel): bool
     {
+        if ($this->isSuspended()) {
+            return false;
+        }
+
         if ($this->isRootAdmin()) {
             return true;
         }