block user in django admin

apps/accounts/apps.py

@@ -2,3 +2,6 @@ from django.apps import AppConfig
 class AccountsConfig(AppConfig):
     name = "apps.accounts"
 
+    def ready(self):
+        from . import customer_access  # Register the login-session receiver.
+

apps/accounts/customer_access.py

@@ -0,0 +1,81 @@
+"""Restrictions for full customer logins; staff and scoped links stay independent."""
+
+from django.contrib import messages
+from django.contrib.auth import logout
+from django.contrib.auth.signals import user_logged_in
+from django.dispatch import receiver
+from django.http import JsonResponse
+from django.shortcuts import redirect
+from django.urls import reverse
+from django.views.decorators.cache import never_cache
+from django.views.decorators.http import require_GET
+from django.utils.cache import add_never_cache_headers
+
+from apps.customers.models import CustomerProfile
+from .models import User
+
+
+ACCESS_VERSION_KEY = "customer_login_access_version"
+BLOCK_REASON_KEY = "customer_login_block_reason"
+DEFAULT_BLOCK_REASON = "ورود شما مسدود شده است. برای پیگیری با پشتیبانی تماس بگیرید."
+
+
+def is_customer_login(user):
+    return user.account_type == User.AccountType.CUSTOMER and not (user.is_staff or user.is_superuser)
+
+
+def customer_login_profile(user):
+    if not is_customer_login(user):
+        return None
+    return CustomerProfile.objects.filter(user_id=user.pk).first()
+
+
+def blocked_login_reason(mobile):
+    user = User.objects.filter(mobile=mobile).first()
+    profile = customer_login_profile(user) if user else None
+    if profile and profile.login_blocked:
+        return profile.login_block_reason.strip() or DEFAULT_BLOCK_REASON
+    return ""
+
+
+@receiver(user_logged_in, dispatch_uid="customer_login_access_version")
+def remember_customer_access(sender, request, user, **kwargs):
+    if not is_customer_login(user):
+        return
+    profile = customer_login_profile(user)
+    request.session[ACCESS_VERSION_KEY] = profile.login_access_version if profile else 0
+    request.session.pop(BLOCK_REASON_KEY, None)
+
+
+class CustomerLoginAccessMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if request.user.is_authenticated:
+            profile = customer_login_profile(request.user)
+            if profile and (
+                profile.login_blocked
+                or request.session.get(ACCESS_VERSION_KEY, 0) != profile.login_access_version
+            ):
+                logout(request)
+                if profile.login_blocked:
+                    request.session[BLOCK_REASON_KEY] = profile.login_block_reason.strip() or DEFAULT_BLOCK_REASON
+                else:
+                    messages.error(request, "نشست قبلی شما باطل شده است. لطفاً دوباره وارد شوید.")
+                if request.path == reverse("accounts:login_access"):
+                    response = JsonResponse({"authenticated": False, "login_url": reverse("accounts:login")})
+                else:
+                    response = redirect("accounts:login")
+                add_never_cache_headers(response)
+                return response
+        return self.get_response(request)
+
+
+@never_cache
+@require_GET
+def customer_login_access(request):
+    return JsonResponse({
+        "authenticated": request.user.is_authenticated,
+        "login_url": reverse("accounts:login"),
+    })

apps/accounts/urls.py

@@ -1,9 +1,11 @@
 from django.urls import path
 
 from . import views
+from .customer_access import customer_login_access
 
 app_name = "accounts"
 urlpatterns = [
+    path("login/access/", customer_login_access, name="login_access"),
     path("", views.home, name="home"),
     path("login/", views.customer_login, name="login"),
     path("login/password/", views.customer_password_login, name="password_login"),

apps/accounts/views.py

@@ -14,6 +14,7 @@ from django.db import transaction
 from django.db.models import F
 from .models import MagicLinkAccessLog, OTPChallenge, TicketMagicLink, User
 from .magic_access import grant_ticket_magic_access
+from .customer_access import BLOCK_REASON_KEY, blocked_login_reason
 from apps.integrations.sms.providers import SMSResult, get_sms_provider
 import logging
 
@@ -46,7 +47,11 @@ def customer_login(request):
     _remember_destination(request)
     if response:=_authenticated_home(request): return response
     form = MobileForm(request.POST or None)
+    block_reason = request.session.pop(BLOCK_REASON_KEY, "")
     if request.method == "POST" and form.is_valid():
+        block_reason = blocked_login_reason(form.cleaned_data["mobile"])
+        if block_reason:
+            return render(request, "accounts/customer_login.html", {"form": form, "block_reason": block_reason})
         challenge = None
         try:
             challenge, code = OTPChallenge.issue(form.cleaned_data["mobile"], request)
@@ -62,13 +67,18 @@ def customer_login(request):
                 challenge.delete()
             logger.exception("OTP SMS delivery failed")
             form.add_error(None, "ارسال پیامک ورود در حال حاضر ممکن نیست؛ لطفاً کمی بعد دوباره تلاش کنید.")
-    return render(request, "accounts/customer_login.html", {"form": form})
+    return render(request, "accounts/customer_login.html", {"form": form, "block_reason": block_reason})
 
 @require_http_methods(["GET", "POST"])
 def verify_otp(request):
     if response:=_authenticated_home(request): return response
     challenge = get_object_or_404(OTPChallenge, pk=request.session.get("otp_challenge_id"))
     form = OTPForm(request.POST or None)
+    block_reason = blocked_login_reason(challenge.mobile)
+    if block_reason:
+        request.session.pop("otp_challenge_id", None)
+        request.session[BLOCK_REASON_KEY] = block_reason
+        return redirect("accounts:login")
     if request.method == "POST" and form.is_valid():
         if challenge.verify(form.cleaned_data["code"]):
             user, created = User.objects.get_or_create(mobile=challenge.mobile, defaults={"username": f"customer_{challenge.mobile[3:]}", "account_type": User.AccountType.CUSTOMER})
@@ -86,12 +96,16 @@ def customer_password_login(request):
     _remember_destination(request)
     if response:=_authenticated_home(request): return response
     form=CustomerPasswordLoginForm(request.POST or None)
+    block_reason = request.session.pop(BLOCK_REASON_KEY, "")
     if request.method=="POST" and form.is_valid():
+        block_reason = blocked_login_reason(form.cleaned_data["mobile"])
+        if block_reason:
+            return render(request, "accounts/customer_password_login.html", {"form": form, "block_reason": block_reason})
         user=form.authenticate(request)
         if user and user.is_active:
             login(request,user); return redirect(_login_destination(request))
         form.add_error(None,"شماره موبایل یا رمز عبور صحیح نیست.")
-    return render(request,"accounts/customer_password_login.html",{"form":form})
+    return render(request,"accounts/customer_password_login.html",{"form":form,"block_reason":block_reason})
 
 @login_required
 @require_http_methods(["GET","POST"])

apps/customers/admin.py

@@ -11,8 +11,8 @@ class ContactGroupAdmin(admin.ModelAdmin):
 
 @admin.register(CustomerProfile)
 class CustomerProfileAdmin(admin.ModelAdmin):
-    list_display = ("user", "stakeholder_type", "organization_name", "first_name", "last_name")
-    list_filter = ("stakeholder_type", "groups")
+    list_display = ("user", "stakeholder_type", "organization_name", "first_name", "last_name", "login_blocked")
+    list_filter = ("stakeholder_type", "groups", "login_blocked")
     search_fields = ("user__mobile", "organization_name", "first_name", "last_name")
     filter_horizontal = ("groups",)
 

apps/customers/migrations/0007_customerprofile_login_access_version_and_more.py

@@ -0,0 +1,28 @@
+# Generated by Django 5.1.1 on 2026-10-14 08:30
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('customers', '0006_backfill_customer_profiles'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='customerprofile',
+            name='login_access_version',
+            field=models.PositiveIntegerField(default=0, editable=False),
+        ),
+        migrations.AddField(
+            model_name='customerprofile',
+            name='login_block_reason',
+            field=models.TextField(blank=True, help_text='این متن به مشتری یا مخاطب نمایش داده می\u200cشود. ورود کارکنان و کارشناسان تحت تأثیر نیست.', verbose_name='دلیل مسدودی ورود'),
+        ),
+        migrations.AddField(
+            model_name='customerprofile',
+            name='login_blocked',
+            field=models.BooleanField(default=False, verbose_name='مسدود کردن ورود مشتری / مخاطب'),
+        ),
+    ]

apps/customers/models.py

@@ -1,5 +1,7 @@
 from django.conf import settings
 from django.db import models
+from django.db import transaction
+from django.core.exceptions import ValidationError
 from apps.core.models import PersianTextNormalizationMixin, TimeStampedModel
 
 
@@ -51,6 +53,34 @@ class CustomerProfile(PersianTextNormalizationMixin, TimeStampedModel):
     groups = models.ManyToManyField(ContactGroup, blank=True, related_name="contacts")
     province = models.CharField(max_length=100, blank=True)
     city = models.CharField(max_length=100, blank=True)
+    login_blocked = models.BooleanField("مسدود کردن ورود مشتری / مخاطب", default=False)
+    login_block_reason = models.TextField(
+        "دلیل مسدودی ورود", blank=True,
+        help_text="این متن به مشتری یا مخاطب نمایش داده می‌شود. ورود کارکنان و کارشناسان تحت تأثیر نیست.",
+    )
+    login_access_version = models.PositiveIntegerField(default=0, editable=False)
+
+    def clean(self):
+        super().clean()
+        if self.login_blocked and not self.login_block_reason.strip():
+            raise ValidationError({"login_block_reason": "برای مسدود کردن ورود، دلیل مسدودی را بنویسید."})
+
+    def save(self, *args, **kwargs):
+        # Keep old sessions revoked even if the administrator later unblocks access.
+        with transaction.atomic():
+            previous = type(self).objects.select_for_update().filter(pk=self.pk).first()
+            if previous is None and self.login_blocked:
+                self.login_access_version = 1
+            if previous is not None:
+                self.login_access_version = previous.login_access_version
+                fields = kwargs.get("update_fields")
+                changes_access = fields is None or "login_blocked" in fields
+                if changes_access and self.login_blocked and not previous.login_blocked:
+                    self.login_access_version += 1
+                    if fields is not None:
+                        kwargs["update_fields"] = set(fields) | {"login_access_version"}
+            super().save(*args, **kwargs)
+
     def __str__(self): return (f"{self.first_name} {self.last_name}".strip() or self.user.mobile or self.user.username)