The auth filter has the deactivated/banned user check commented out.
Details
CodeIgniter Shield's loggedIn() re-checks the status field (catching status='banned'), but does not re-check the active field for existing sessions. When an admin deactivates a user (active=0) after they have already logged in:
Their session cookie remains valid
auth()->loggedIn() still returns true
The commented-out code is the only mechanism that would have checked !$user->active
User deactivation does NOT immediately revoke backend access
Deactivated user retains full access until session expires (default: 7200s)
Additional note
The commented-out block appears to be a deferred placeholder — it was written but disabled from the very first commit that introduced the filter, and has never been active. The later addition of SessionTracker (v0.31.4.0) suggests the dev was aware of the session revocation gap, but account-level deactivation (users.active = 0) remains unenforced. Could you verify if this is intentionally pending or simply forgotten and not documented?.