IanM there are many more interesting things if the account connected used OAuth (FoF OAuth) 🙂 I didnt checked it in detailed way and it require a lot of tests (and possibly a lot of fixes and maybe not only in FoF OAuth), but the most correct way for stopping all this things is just to deny login for suspended users (of course with closing all sessions in moment of suspending).
The model of interacting between suspended users and Flarum must be reviewed. I hope it can be dramastically improved in Flarum 2.x life cycle.
rwx authorised priveleged (administrator, etc)
rw- authorised regular
r-- anonymous (equal to not approved account)
--- authorised suspended (also cant read content part, deny or blank for any db request, and also cant exit in standard way for privilege escalation to anonymous level, cant use login controller)
Last still implies recording of last visit date/time (the only advantage of current Flarum 1.8.5 suspending model)
This will be correct.
