Make requests read only when account disabled

pkg/api/middleware/auth.go

@@ -37,6 +37,12 @@ func UserSession(authService *authz.Service) gin.HandlerFunc {
 			return
 		}
 
+		// If the request is not GET and disabled, deny it
+		if ctx.Request.Method != "GET" && !user.Active {
+			ctx.JSON(http.StatusForbidden, gin.H{"error": "User is disabled"})
+			ctx.Abort()
+		}
+
 		// Get user session
 		userSession, err := authService.GetUserAuthProfile(ctx, sessionId)
 		if err != nil {