Add account restrictions, appeals, and admin moderation tools

lib/supabase.ts

@@ -38,7 +38,8 @@ export async function authClient() {
     },
   );
 }
-export const user = cache(async function user() {
+/** Authentication identity only. Restricted accounts use this solely for appeals/auth. */
+export const rawUser = cache(async function rawUser() {
   if (
     !process.env.NEXT_PUBLIC_SUPABASE_URL ||
     !process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
@@ -50,6 +51,27 @@ export const user = cache(async function user() {
   } = await client.auth.getUser();
   return user;
 });
+export const accountState = cache(async function accountState(id: string) {
+  const result = await admin()
+    .from("profiles")
+    .select("account_status")
+    .eq("id", id)
+    .maybeSingle();
+  checkServiceError(result.error);
+  return result.data?.account_status ?? "active";
+});
+export async function assertAccountActive(id: string) {
+  const status = await accountState(id);
+  if (status !== "active") {
+    const { restrictionMessage } = await import("@/shared/account-controls");
+    throw new ServiceError(restrictionMessage(status), 403);
+  }
+}
+export const user = cache(async function user() {
+  const account = await rawUser();
+  if (account) await assertAccountActive(account.id);
+  return account;
+});
 export function required<T>(result: {
   data: T;
   error: { message: string; code?: string } | null;