fix: Update active date only for users activated and not banned.

src/Config/Auth.php

@@ -159,7 +159,7 @@ class Auth extends BaseConfig
  * Record Last Active Date
  * --------------------------------------------------------------------
  * If true, will always update the `last_active` datetime for the
- * logged-in user on every page request.
+ * logged-in user on every page request, provided the user is activated and not banned.
  * This feature only works when session/tokens/hmac/chain/jwt filter is active.
  *
  * @see https://codeigniter4.github.io/shield/quick_start_guide/using_session_auth/#protecting-pages for set filters.

src/Filters/HmacAuth.php

@@ -45,10 +45,6 @@ public function before(RequestInterface $request, $arguments = null)
  ->setJSON(['message' => lang('Auth.badToken')]);
  }
 
- if (setting('Auth.recordActiveDate')) {
- $authenticator->recordActiveDate();
- }
-
  // Block inactive users when Email Activation is enabled
  $user = $authenticator->getUser();
  if ($user !== null && ! $user->isActivated()) {
@@ -59,6 +55,10 @@ public function before(RequestInterface $request, $arguments = null)
  ->setJSON(['message' => lang('Auth.activationBlocked')]);
  }
 
+ if (setting('Auth.recordActiveDate')) {
+ $authenticator->recordActiveDate();
+ }
+
  return $request;
  }
 

src/Filters/SessionAuth.php

@@ -52,10 +52,6 @@ public function before(RequestInterface $request, $arguments = null)
  $authenticator = auth('session')->getAuthenticator();
 
  if ($authenticator->loggedIn()) {
- if (setting('Auth.recordActiveDate')) {
- $authenticator->recordActiveDate();
- }
-
  // Block inactive users when Email Activation is enabled
  $user = $authenticator->getUser();
 
@@ -76,6 +72,10 @@ public function before(RequestInterface $request, $arguments = null)
  }
  }
 
+ if (setting('Auth.recordActiveDate')) {
+ $authenticator->recordActiveDate();
+ }
+
  return;
  }
 

src/Filters/TokenAuth.php

@@ -61,10 +61,6 @@ public function before(RequestInterface $request, $arguments = null)
  ->setJSON(['message' => lang('Auth.badToken')]);
  }
 
- if (setting('Auth.recordActiveDate')) {
- $authenticator->recordActiveDate();
- }
-
  // Block inactive users when Email Activation is enabled
  $user = $authenticator->getUser();
  if ($user !== null && ! $user->isActivated()) {
@@ -74,6 +70,10 @@ public function before(RequestInterface $request, $arguments = null)
  ->setStatusCode(Response::HTTP_FORBIDDEN)
  ->setJSON(['message' => lang('Auth.activationBlocked')]);
  }
+
+ if (setting('Auth.recordActiveDate')) {
+ $authenticator->recordActiveDate();
+ }
  }
 
  /**