#327

backend/app/controllers/application_controller.rb

@@ -1,14 +1,16 @@
 class ApplicationController < ActionController::API
+  before_action :reject_banned_ip_address!
   before_action :authenticate_user
+  before_action :reject_banned_user!
 
-  def current_user
+  def current_user = @current_user
-    @current_user
-  end
 
   private
 
   def authenticate_user
     code = request.headers['X-Transfer-Code'] || request.headers['HTTP_X_TRANSFER_CODE']
+    return if code.blank?
+
     @current_user = User.find_by(inheritance_code: code)
   end
 
@@ -22,4 +24,17 @@ class ApplicationController < ActionController::API
       s.in?(['', '1', 'true', 'on', 'yes'])
     end
   end
+
+  def reject_banned_ip_address!
+    ip_address = IpAddress.find_by(ip_address: IPAddr.new(request.remote_ip).hton)
+    return unless ip_address&.banned?
+
+    head :forbidden
+  end
+
+  def reject_banned_user!
+    return unless current_user&.banned?
+
+    head :forbidden
+  end
 end

backend/app/models/ip_address.rb

@@ -5,5 +5,6 @@ class IpAddress < ApplicationRecord
   has_many :users, through: :user_ips
 
   def banned? = banned_at.present?
-  def ban! = update!(banned_at: Time.current)
+  def ban! = banned? or update!(banned_at: Time.current)
+  def unban! = update!(banned_at: nil)
 end

backend/app/models/user.rb

@@ -22,5 +22,6 @@ class User < ApplicationRecord
   def gte_member? = member? || admin?
 
   def banned? = banned_at.present?
-  def ban! = update!(banned_at: Time.current)
+  def ban! = banned? or update!(banned_at: Time.current)
+  def unban! = update!(banned_at: nil)
 end