@@ -0,0 +1,6 @@
+CREATE TABLE user_locks (
+	user_id BIGINT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+	locked_by BIGINT NOT NULL REFERENCES users(id),
+	reason TEXT NOT NULL,
+	created TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
@@ -55,6 +55,8 @@ pub enum AuthenticationError {
     SocketError,
     #[error("Invalid callback URL specified")]
     Url,
+    #[error("Your account is locked and cannot perform this action")]
+    AccountLocked,
 }
 
 impl actix_web::ResponseError for AuthenticationError {
@@ -83,6 +85,7 @@ impl actix_web::ResponseError for AuthenticationError {
                 StatusCode::BAD_REQUEST
             }
             AuthenticationError::SocketError => StatusCode::BAD_REQUEST,
+            AuthenticationError::AccountLocked => StatusCode::FORBIDDEN,
         }
     }
 
@@ -115,6 +118,7 @@ impl AuthenticationError {
                 "provider_already_linked"
             }
             AuthenticationError::SocketError => "socket",
+            AuthenticationError::AccountLocked => "account_locked",
         }
     }
 }
 
@@ -349,7 +349,7 @@ pub async fn accept_or_reject_client_scopes(
         &**pool,
         &redis,
         &session_queue,
-        Scopes::SESSION_ACCESS,
+        Scopes::SESSION_ACCESS | Scopes::USER_AUTH_WRITE,
     )
     .await?
     .1;
 
@@ -229,6 +229,13 @@ where
         _ => return Err(AuthenticationError::InvalidAuthMethod),
     };
 
+    if possible_user
+        .as_ref()
+        .is_some_and(|(_, user)| user.is_locked())
+    {
+        return Err(AuthenticationError::AccountLocked);
+    }
+
     Ok(possible_user)
 }
 
 
@@ -36,6 +36,7 @@ pub mod team_item;
 pub mod thread_item;
 pub mod user_item;
 pub mod user_limits;
+pub mod user_lock_item;
 pub mod user_preferences_item;
 pub mod user_subscription_item;
 pub mod users_compliance;
Original file line number	Diff line number	Diff line change
`@@ -55,6 +55,8 @@ pub enum AuthenticationError {`
`55`	`55`	`SocketError,`
`56`	`56`	`#[error("Invalid callback URL specified")]`
`57`	`57`	`Url,`
	`58`	`+ #[error("Your account is locked and cannot perform this action")]`
	`59`	`+ AccountLocked,`
`58`	`60`	`}`
`59`	`61`
`60`	`62`	`impl actix_web::ResponseError for AuthenticationError {`
`@@ -83,6 +85,7 @@ impl actix_web::ResponseError for AuthenticationError {`
`83`	`85`	`StatusCode::BAD_REQUEST`
`84`	`86`	`}`
`85`	`87`	`AuthenticationError::SocketError => StatusCode::BAD_REQUEST,`
	`88`	`+ AuthenticationError::AccountLocked => StatusCode::FORBIDDEN,`
`86`	`89`	`}`
`87`	`90`	`}`
`88`	`91`
`@@ -115,6 +118,7 @@ impl AuthenticationError {`
`115`	`118`	`"provider_already_linked"`
`116`	`119`	`}`
`117`	`120`	`AuthenticationError::SocketError => "socket",`
	`121`	`+ AuthenticationError::AccountLocked => "account_locked",`
`118`	`122`	`}`
`119`	`123`	`}`
`120`	`124`	`}`
Original file line number	Diff line number	Diff line change
`@@ -349,7 +349,7 @@ pub async fn accept_or_reject_client_scopes(`
`349`	`349`	`&**pool,`
`350`	`350`	`&redis,`
`351`	`351`	`&session_queue,`
`352`		`- Scopes::SESSION_ACCESS,`
	`352`	`+ Scopes::SESSION_ACCESS \| Scopes::USER_AUTH_WRITE,`
`353`	`353`	`)`
`354`	`354`	`.await?`
`355`	`355`	`.1;`