feat: block login for restricted users

Author: ddrayko

routes/admin.js

@@ -36,6 +36,9 @@ router.post('/login', async (req, res) => {
     }
 
     const user = users[0];
+    if (user.restricted) {
+      return res.status(403).json({ error: 'Your account has been restricted. Contact support for assistance.' });
+    }
     if (!user.is_admin) {
       return res.status(403).json({ error: 'Access denied. Admin privileges required.' });
     }

routes/auth.js

@@ -198,6 +198,10 @@ router.post('/login', async (req, res) => {
 
     if (process.env.NODE_ENV !== 'production') console.log('[LOGIN] User found:', { id: user.id, email: user.email });
 
+    if (user.restricted) {
+      return res.status(403).json({ error: 'Your account has been restricted. Contact support for assistance.' });
+    }
+
     const validPassword = await argon2.verify(user.password_hash, password, { type: argon2.argon2id });
     if (!validPassword) {
       if (process.env.NODE_ENV !== 'production') console.log('[LOGIN] Password mismatch for user:', user.id);