block user in django admin

static/css/customer-login-access.css

@@ -0,0 +1,17 @@
+.customer-login-block {
+  margin-block: 1.25rem;
+  padding: 1rem 1.25rem;
+  border: 1px solid #fca5a5;
+  border-inline-start: 4px solid #b91c1c;
+  border-radius: 12px;
+  background: #fff1f2;
+  color: #991b1b;
+  font-family: inherit;
+  font-size: 1rem;
+  line-height: 1.9;
+  text-align: start;
+  overflow-wrap: anywhere;
+}
+.customer-login-block strong { display: block; font-size: 1.125rem; font-weight: 800; }
+.customer-login-block .customer-login-block-label { margin: .5rem 0 0; color: #991b1b; }
+.customer-login-block .customer-login-block-reason { margin: .25rem 0 0; color: #991b1b; font-weight: 700; white-space: pre-wrap; }

static/js/customer-login-access.js

@@ -0,0 +1,25 @@
+(() => {
+  const script = document.querySelector('script[data-customer-login-access]');
+  if (!script) return;
+  let pending = false;
+  async function checkAccess() {
+    if (pending || document.hidden) return;
+    pending = true;
+    try {
+      const response = await fetch(script.dataset.customerLoginAccess, {
+        credentials: 'same-origin', cache: 'no-store', headers: {Accept: 'application/json'}
+      });
+      if (!response.ok) return;
+      const result = await response.json();
+      if (!result.authenticated) window.location.replace(result.login_url);
+    } catch (_) {
+      // Retry on the next heartbeat or when the browser returns online.
+    } finally {
+      pending = false;
+    }
+  }
+  window.setInterval(checkAccess, 10000);
+  document.addEventListener('visibilitychange', checkAccess);
+  window.addEventListener('pageshow', checkAccess);
+  window.addEventListener('online', checkAccess);
+})();