ability to ban and unban users

backend/middleware/auth.js

@@ -33,6 +33,14 @@ const authenticateToken = async (req, res, next) => {
       });
     }
 
+    // Check if user is banned
+    if (user.isBanned) {
+      return res.status(403).json({
+        error: "Your account has been suspended. Please contact support for more information.",
+        code: "USER_BANNED",
+      });
+    }
+
     // Validate JWT version to invalidate old tokens after password change
     if (decoded.jwtVersion !== user.jwtVersion) {
       return res.status(401).json({
@@ -93,6 +101,12 @@ const optionalAuth = async (req, res, next) => {
       return next();
     }
 
+    // Banned users are treated as unauthenticated for optional auth
+    if (user.isBanned) {
+      req.user = null;
+      return next();
+    }
+
     // Validate JWT version to invalidate old tokens after password change
     if (decoded.jwtVersion !== user.jwtVersion) {
       req.user = null;