fix: some security issues

src/lib/api-v1/middleware.ts

@@ -78,6 +78,14 @@ export function withApiKey(handler: ApiKeyHandler) {
         throw new Error("Unable to find user")
       }
 
+      if (userFetched.banned) {
+        return NextResponse.json({ error: "Account suspended" }, { status: 403 });
+      }
+
+      if (userFetched.role === "pending") {
+        return NextResponse.json({ error: "Account pending approval" }, { status: 403 });
+      }
+
       const userPermissions = computeSystemPermissions(userFetched)
 
       const user = {

src/lib/auth/auth.ts

@@ -713,6 +713,7 @@ export const deleteApiKey = async (keyId: string) => {
     await auth.api.deleteApiKey({
         body: {
             keyId: keyId,
+            configId: "standard",
         },
         headers: await headers(),
     });