Add suspendedAt column to teams

app/scenes/Login/components/Notices.tsx

@@ -84,12 +84,18 @@ export default function Notices() {
           requesting another.
         </Trans>
       )}
-      {(notice === "suspended" || notice === "user-suspended") && (
+      {notice === "user-suspended" && (
         <Trans>
           Your account has been suspended. To re-activate your account, please
           contact a workspace admin.
         </Trans>
       )}
+      {notice === "team-suspended" && (
+        <Trans>
+          This workspace has been suspended. Please contact support to restore
+          access.
+        </Trans>
+      )}
       {notice === "authentication-provider-disabled" && (
         <Trans>
           Authentication failed – this login method was disabled by a team

server/migrations/20231123022323-add-suspended-at-teams.js

@@ -0,0 +1,13 @@
+"use strict";
+
+module.exports = {
+  async up(queryInterface, Sequelize) {
+    await queryInterface.addColumn("teams", "suspendedAt", {
+      type: Sequelize.DATE,
+      allowNull: true,
+    });
+  },
+  async down(queryInterface) {
+    await queryInterface.removeColumn("teams", "suspendedAt");
+  },
+};

server/models/Team.ts

@@ -13,6 +13,7 @@ import {
   Table,
   Unique,
   IsIn,
+  IsDate,
   HasMany,
   Scopes,
   Is,
@@ -151,8 +152,19 @@ class Team extends ParanoidModel {
   @Column(DataType.JSONB)
   preferences: TeamPreferences | null;
 
+  @IsDate
+  @Column
+  suspendedAt: Date | null;
+
   // getters
 
+  /**
+   * Returns whether the team has been suspended and is no longer accessible.
+   */
+  get isSuspended(): boolean {
+    return !!this.suspendedAt;
+  }
+
   /**
    * Returns whether the team has email login enabled. For self-hosted installs
    * this also considers whether SMTP connection details have been configured.

server/models/User.ts

@@ -227,7 +227,7 @@ class User extends ParanoidModel {
   // getters
 
   get isSuspended(): boolean {
-    return !!this.suspendedAt;
+    return !!this.suspendedAt || this.team?.isSuspended;
   }
 
   get isInvited() {

server/utils/authentication.ts

@@ -32,8 +32,11 @@ export async function signIn(
   service: string,
   { user, team, client, isNewTeam }: AuthenticationResult
 ) {
+  if (team.isSuspended) {
+    return ctx.redirect("/?notice=team-suspended");
+  }
   if (user.isSuspended) {
-    return ctx.redirect("/?notice=suspended");
+    return ctx.redirect("/?notice=user-suspended");
   }
 
   if (isNewTeam) {

shared/i18n/locales/en_US/translation.json

@@ -686,6 +686,7 @@
   "Authentication failed – you do not have permission to access this workspace.": "Authentication failed – you do not have permission to access this workspace.",
   "Sorry, it looks like that sign-in link is no longer valid, please try requesting another.": "Sorry, it looks like that sign-in link is no longer valid, please try requesting another.",
   "Your account has been suspended. To re-activate your account, please contact a workspace admin.": "Your account has been suspended. To re-activate your account, please contact a workspace admin.",
+  "This workspace has been suspended. Please contact support to restore access.": "This workspace has been suspended. Please contact support to restore access.",
   "Authentication failed – this login method was disabled by a team admin.": "Authentication failed – this login method was disabled by a team admin.",
   "The workspace you are trying to join requires an invite before you can create an account.<1></1>Please request an invite from your workspace admin and try again.": "The workspace you are trying to join requires an invite before you can create an account.<1></1>Please request an invite from your workspace admin and try again.",
   "Sorry, your domain is not allowed. Please try again with an allowed workspace domain.": "Sorry, your domain is not allowed. Please try again with an allowed workspace domain.",