Add account restrictions, appeals, and admin moderation tools

proxy.ts

@@ -1,6 +1,7 @@
 import { createServerClient } from "@supabase/ssr";
 import { NextRequest, NextResponse } from "next/server";
 import { legacyRecoveryToken } from "./shared/legacy-recovery";
+import { restrictionPageAllowed } from "./shared/account-controls";
 export async function proxy(request: NextRequest) {
   const recoveryToken = legacyRecoveryToken(request.nextUrl.pathname);
   if (recoveryToken) {
@@ -34,7 +35,31 @@ export async function proxy(request: NextRequest) {
       },
     },
   );
-  await client.auth.getUser();
+  const {
+    data: { user },
+  } = await client.auth.getUser();
+  const path = request.nextUrl.pathname;
+  if (user && !path.startsWith("/api/") && !restrictionPageAllowed(path)) {
+    const { data, error } = await client
+      .from("profiles")
+      .select("account_status")
+      .eq("id", user.id)
+      .maybeSingle();
+    if (error)
+      return new NextResponse(
+        "Account access could not be verified. Please try again.",
+        { status: 503, headers: { "Cache-Control": "no-store" } },
+      );
+    if (data && data.account_status !== "active") {
+      const destination = new URL("/ban/appeal", request.url);
+      const redirect = NextResponse.redirect(destination);
+      response.cookies
+        .getAll()
+        .forEach((cookie) => redirect.cookies.set(cookie));
+      redirect.headers.set("Cache-Control", "private, no-store");
+      return redirect;
+    }
+  }
   return response;
 }
 export const config = {