search

codeigniter4 / shield

Authentication and Authorization for CodeIgniter 4
https://shield.codeigniter.com
MIT License
366 stars 133 forks source link

Dev: banning users #509

Closed kenjis closed 1 year ago

kenjis commented 2 years ago

Implement a feature to ban users.

See

davidnsai commented 1 year ago

Hi @kenjis I would like to implement this feature. Would it be okay if the issue was assigned to me?

lonnieezell commented 1 year ago

@davidnsai that sounds great! I've assigned it to you. I look forward to seeing it, thanks.

kenjis commented 1 year ago

@davidnsai Yes, no problem! Please do it.

davidnsai commented 1 year ago

So I've been looking at the best implementation for this feature I had a number of thought around it

  1. It could be implemented as an action, that way it can be an optional inclusion to the shield functionality.
  2. It could be done in such a way that the check is done every time in the attempt() method.
  3. Additional code can be added to the filters so that a check is made, this will mean that if a user is banned, they are no longer able to access any site features. Regardless though, I still intended to have a modification to the filter to ensure than when a user is banned while they are logged in, their next request is rejected.
Chuma04 commented 1 year ago

That sounds great.

kenjis commented 1 year ago

Action seems to be a little different because it is an additional action required at the time of authentication. It also requires a User Identity record.

User table has status and it can be used. At least Myth:Auth has the implementation like that. See https://github.com/lonnieezell/myth-auth/blob/1c646c58e8b9b956b2163ebda8e5ec7e9ed609ce/src/Entities/User.php#L196-L202

lonnieezell commented 1 year ago

Yes, the status field on the user table is what was originally intended to store that (and potentially other statuses, depending on the app needs). status_message was intended to allow a reason to be recorded at the time of the status change that could be relayed to the user, like "You're account has been banned for too many hacking attempts" or whatever.

Off the top of my head, I think adding it to the filter is probably all that's needed. Seems like that would let us more easily redirect with a custom message.