feat: Implement comprehensive ban enforcement

supabase/functions/process-selective-approval/index.ts

@@ -116,6 +116,60 @@ serve(async (req) => {
     
     edgeLogger.info('Authentication successful', { action: 'approval_auth_success', userId: user.id });
     
+    // Check if user is banned
+    const { data: profile, error: profileError } = await supabaseAuth
+      .from('profiles')
+      .select('banned')
+      .eq('user_id', user.id)
+      .single();
+
+    if (profileError || !profile) {
+      edgeLogger.error('Profile check failed', { 
+        action: 'approval_profile_check',
+        error: profileError?.message,
+        requestId: tracking.requestId
+      });
+      const duration = endRequest(tracking);
+      return new Response(
+        JSON.stringify({ 
+          error: 'Unable to verify user profile',
+          requestId: tracking.requestId
+        }),
+        { 
+          status: 403, 
+          headers: { 
+            ...corsHeaders, 
+            'Content-Type': 'application/json',
+            'X-Request-ID': tracking.requestId 
+          } 
+        }
+      );
+    }
+
+    if (profile.banned) {
+      edgeLogger.warn('Banned user attempted approval', { 
+        action: 'approval_banned_user',
+        userId: user.id,
+        requestId: tracking.requestId
+      });
+      const duration = endRequest(tracking);
+      return new Response(
+        JSON.stringify({ 
+          error: 'Account suspended',
+          message: 'Your account has been suspended. Contact support for assistance.',
+          requestId: tracking.requestId
+        }),
+        { 
+          status: 403, 
+          headers: { 
+            ...corsHeaders, 
+            'Content-Type': 'application/json',
+            'X-Request-ID': tracking.requestId 
+          } 
+        }
+      );
+    }
+    
     // SECURITY NOTE: Service role key used later in this function
     // Reason: Need to bypass RLS to write approved changes to entity tables
     // (parks, rides, companies, ride_models) which have RLS policies