User bans and suspensions are enforced

Without enforceable bans, repeat violators face no real consequence — they continue posting after receiving warnings, and the moderation system becomes a signal they can ignore. OWASP A01:2021 (Broken Access Control, CWE-285) applies when ban records exist in the database but the enforcement check is missing from content-creation and interaction endpoints. A ban table with no WHERE clause enforcement is a paper ban: the record exists, but the behavior continues. Communities with no ban enforcement experience higher recidivism from bad actors who quickly learn there is no real cost to violations.

Check ban status at the start of every content-creation and interaction handler. Invalidate sessions on ban to force immediate logout:

async function assertNotBanned(userId) {
  const user = await db.users.findOneById(userId);
  if (!user.banned) return;
  // Auto-lift expired temporary bans
  if (user.bannedUntil && user.bannedUntil < new Date()) {
    await db.users.update(userId, { banned: false, bannedUntil: null });
    return;
  }
  throw Object.assign(new Error('Account is banned'), { status: 403 });
}

// Apply at every post/comment/message endpoint
app.post('/api/posts', authenticate, async (req, res) => {
  await assertNotBanned(req.user.id);
  // ... create post
});

Store bans with at minimum: userId, reason, bannedAt, bannedBy, and optional bannedUntil for temporary suspensions.