fix: Update active date only for users activated and not banned.

src/Config/Auth.php

@@ -159,7 +159,7 @@ class Auth extends BaseConfig
      * Record Last Active Date
      * --------------------------------------------------------------------
      * If true, will always update the `last_active` datetime for the
-     * logged-in user on every page request.
+     * logged-in user on every page request, provided the user is activated and not banned.
      * This feature only works when session/tokens/hmac/chain/jwt filter is active.
      *
      * @see https://codeigniter4.github.io/shield/quick_start_guide/using_session_auth/#protecting-pages for set filters.

src/Filters/HmacAuth.php

@@ -45,10 +45,6 @@ public function before(RequestInterface $request, $arguments = null)
                 ->setJSON(['message' => lang('Auth.badToken')]);
         }
 
-        if (setting('Auth.recordActiveDate')) {
-            $authenticator->recordActiveDate();
-        }
-
         // Block inactive users when Email Activation is enabled
         $user = $authenticator->getUser();
         if ($user !== null && ! $user->isActivated()) {
@@ -59,6 +55,10 @@ public function before(RequestInterface $request, $arguments = null)
                 ->setJSON(['message' => lang('Auth.activationBlocked')]);
         }
 
+        if (setting('Auth.recordActiveDate')) {
+            $authenticator->recordActiveDate();
+        }
+
         return $request;
     }
 

src/Filters/SessionAuth.php

@@ -52,10 +52,6 @@ public function before(RequestInterface $request, $arguments = null)
         $authenticator = auth('session')->getAuthenticator();
 
         if ($authenticator->loggedIn()) {
-            if (setting('Auth.recordActiveDate')) {
-                $authenticator->recordActiveDate();
-            }
-
             // Block inactive users when Email Activation is enabled
             $user = $authenticator->getUser();
 
@@ -76,6 +72,10 @@ public function before(RequestInterface $request, $arguments = null)
                 }
             }
 
+            if (setting('Auth.recordActiveDate')) {
+                $authenticator->recordActiveDate();
+            }
+
             return;
         }
 

src/Filters/TokenAuth.php

@@ -61,10 +61,6 @@ public function before(RequestInterface $request, $arguments = null)
                 ->setJSON(['message' => lang('Auth.badToken')]);
         }
 
-        if (setting('Auth.recordActiveDate')) {
-            $authenticator->recordActiveDate();
-        }
-
         // Block inactive users when Email Activation is enabled
         $user = $authenticator->getUser();
         if ($user !== null && ! $user->isActivated()) {
@@ -74,6 +70,10 @@ public function before(RequestInterface $request, $arguments = null)
                 ->setStatusCode(Response::HTTP_FORBIDDEN)
                 ->setJSON(['message' => lang('Auth.activationBlocked')]);
         }
+
+        if (setting('Auth.recordActiveDate')) {
+            $authenticator->recordActiveDate();
+        }
     }
 
     /**