From 7bfb2c90e4ae6d4de62d4af069ddc27dcc95ea91 Mon Sep 17 00:00:00 2001
From: raydeveloppeur-admin <raydeveloppeur@gmail.com>
Date: Sun, 19 Jul 2026 19:49:43 +0200
Subject: [PATCH] =?UTF-8?q?Ban=20system=20:=20Add=20ban/unban=20support=20?=
 =?UTF-8?q?with=20a=20global=20modal=20and=20character=20counter.=20Accoun?=
 =?UTF-8?q?ts=20gain=20is=5Fbanned=20and=20ban=5Freason=20fields;=20servic?=
 =?UTF-8?q?es,=20ports=20and=20adapters=20handle=20ban/unban=20and=20block?=
 =?UTF-8?q?=20banned=20users.=20Frontend=20adds=20a=20site=E2=80=91wide=20?=
 =?UTF-8?q?ban=20dialog,=20reason=20field=20and=20counter,=20updates=20use?=
 =?UTF-8?q?r=20list=20and=20profile=20buttons,=20and=20cleans=20old=20ban?=
 =?UTF-8?q?=20code.=20Full=20test=20coverage=20validates=20domain,=20adapt?=
 =?UTF-8?q?ers,=20services=20and=20integration?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 flask_setup/routes.py                         | 14 ++++
 frontend/static/css/base.css                  | 56 ++++++++++++++
 frontend/static/css/profile.css               |  7 +-
 frontend/static/scripts/confirm-dialog.js     | 32 ++++++++
 frontend/templates/base.html                  | 25 ++++++
 frontend/templates/profile.html               | 12 ++-
 frontend/templates/user_list.html             | 14 ++++
 .../V13__add_ban_columns_to_accounts.sql      |  5 ++
 src/application/domain/account.py             |  8 ++
 .../input_ports/account_session_management.py | 29 +++++++
 .../output_ports/account_repository.py        | 12 +++
 src/application/services/article_service.py   |  3 +
 src/application/services/comment_service.py   |  2 +
 src/application/services/login_service.py     | 51 +++++++++++++
 .../input_adapters/dto/account_response.py    |  8 +-
 .../flask/flask_account_session_adapter.py    | 65 ++++++++++++++++
 .../flask/flask_login_adapter.py              |  5 +-
 .../output_adapters/dto/account_record.py     | 10 ++-
 .../in_memory/account_repository.py           | 18 +++++
 .../models/sqlalchemy_account_model.py        |  8 +-
 .../sqlalchemy/sqlalchemy_account_adapter.py  | 20 +++++
 tests/test_domain_factories.py                |  4 +
 .../dto/test_account_response.py              | 34 +++++++++
 .../test_flask_account_session_adapter.py     | 76 +++++++++++++++++++
 .../tests_flask/test_flask_login_adapter.py   | 14 ++++
 .../dto/test_account_record.py                | 32 ++++++++
 .../test_in_memory_adapters.py                | 21 +++++
 .../test_sqlalchemy_account_adapter.py        | 19 +++++
 .../test_security_integration.py              | 28 +++++++
 tests/tests_services/test_login_service.py    | 52 +++++++++++++
 30 files changed, 672 insertions(+), 12 deletions(-)
 create mode 100644 migrations/V13__add_ban_columns_to_accounts.sql

diff --git a/flask_setup/routes.py b/flask_setup/routes.py
index 5295923c..46e00d16 100644
--- a/flask_setup/routes.py
+++ b/flask_setup/routes.py
@@ -135,6 +135,20 @@ def _register_auth_routes(app: Flask, adapters: dict) -> None:
         endpoint="auth.change_role",
     )
 
+    app.add_url_rule(
+        "/admin/users/<int:account_id>/ban",
+        view_func=acc.ban_account,
+        methods=["POST"],
+        endpoint="auth.ban_account",
+    )
+
+    app.add_url_rule(
+        "/admin/users/<int:account_id>/unban",
+        view_func=acc.unban_account,
+        methods=["POST"],
+        endpoint="auth.unban_account",
+    )
+
 
 def _register_file_routes(app: Flask, adapters: dict) -> None:
     fad = adapters["file_adapter"]
diff --git a/frontend/static/css/base.css b/frontend/static/css/base.css
index d938702d..89ac95f4 100644
--- a/frontend/static/css/base.css
+++ b/frontend/static/css/base.css
@@ -562,6 +562,62 @@ button:hover,
     margin: 0;
 }
 
+#ban-modal {
+    max-width: 32rem;
+}
+
+#ban-modal .modal-input-group {
+    gap: 0;
+}
+
+#ban-modal .modal-input-group label {
+    margin-bottom: var(--spacing-sm);
+    font-family: var(--font-primary);
+}
+
+#ban-modal .char-count {
+    font-family: var(--font-primary);
+}
+
+#ban-modal .ban-reason-textarea {
+    margin-top: var(--spacing-xs);
+}
+
+.ban-reason-textarea {
+    width: 100%;
+    min-height: 4.5rem;
+    height: auto;
+    padding: var(--spacing-sm) var(--spacing-md);
+    border: 1px solid var(--outline-variant);
+    border-radius: var(--radius-default);
+    background: var(--surface-container);
+    color: var(--on-surface);
+    font-family: var(--font-primary);
+    font-size: var(--font-body-base);
+    line-height: 1.5;
+    resize: vertical;
+    outline: none;
+    box-sizing: border-box;
+}
+
+.ban-reason-textarea:focus {
+    border-color: var(--primary);
+}
+
+.hint-row {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    font-size: var(--font-body-sm);
+    color: var(--on-surface-variant);
+}
+
+.char-count {
+    font-size: var(--font-body-sm);
+    color: var(--on-surface-variant);
+    font-family: var(--font-mono);
+}
+
 button:focus-visible,
 .btn:focus-visible,
 a:focus-visible {
diff --git a/frontend/static/css/profile.css b/frontend/static/css/profile.css
index de4d23c5..1049ca31 100644
--- a/frontend/static/css/profile.css
+++ b/frontend/static/css/profile.css
@@ -154,9 +154,12 @@
 
     .profile-actions {
         flex-direction: column;
+        align-items: stretch;
+        width: fit-content;
+        margin-left: auto;
+        margin-right: auto;
     }
-    .profile-actions .btn-secondary,
-    .profile-actions .btn-danger {
+    .profile-actions .btn {
         width: 100%;
     }
 }
diff --git a/frontend/static/scripts/confirm-dialog.js b/frontend/static/scripts/confirm-dialog.js
index 0a6b2b4d..3d53051f 100644
--- a/frontend/static/scripts/confirm-dialog.js
+++ b/frontend/static/scripts/confirm-dialog.js
@@ -62,4 +62,36 @@
             if (e.key === 'Escape') close();
         });
     });
+
+    const BAN_TRIGGER_SELECTOR = '.ban-trigger';
+
+    document.addEventListener('click', (e) => {
+        const trigger = e.target.closest(BAN_TRIGGER_SELECTOR);
+        if (!trigger) return;
+
+        const userId = trigger.getAttribute('data-user-id');
+        const username = trigger.getAttribute('data-username');
+        const modal = document.getElementById('ban-modal');
+        if (!modal) return;
+
+        const form = document.getElementById('ban-form');
+        form.action = '/admin/users/' + userId + '/ban';
+
+        document.getElementById('ban-username').textContent = username;
+        document.getElementById('ban-reason-input').value = '';
+        document.getElementById('ban-reason-count').textContent = '0';
+        modal.showModal();
+    });
+
+    document.addEventListener('click', (e) => {
+        if (e.target.id === 'ban-modal-cancel') {
+            document.getElementById('ban-modal')?.close();
+        }
+    });
+
+    document.addEventListener('input', (e) => {
+        if (e.target.id === 'ban-reason-input') {
+            document.getElementById('ban-reason-count').textContent = e.target.value.length;
+        }
+    });
 })();
diff --git a/frontend/templates/base.html b/frontend/templates/base.html
index 10d7b314..5ed5f2a9 100644
--- a/frontend/templates/base.html
+++ b/frontend/templates/base.html
@@ -110,6 +110,31 @@ <h2 class="modal-title">Confirm</h2>
         </div>
     </dialog>
 
+    <dialog id="ban-modal" class="dialog">
+        <div class="modal-header">
+            <h2 class="modal-title">Ban <span id="ban-username"></span></h2>
+        </div>
+        <form method="POST" id="ban-form">
+            <div class="modal-body">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                <div class="modal-input-group">
+                    <label for="ban-reason-input">Reason (optional)</label>
+                    <div class="hint-row">
+                        <span class="hint-text">Maximum 150 characters</span>
+                        <span class="char-count"><span id="ban-reason-count">0</span> / 150</span>
+                    </div>
+                    <textarea id="ban-reason-input" name="ban_reason"
+                        rows="3" placeholder="e.g., Spam, harassment..."
+                        class="ban-reason-textarea" maxlength="150"></textarea>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-dialog btn-secondary" id="ban-modal-cancel" autofocus>Cancel</button>
+                <button type="submit" class="btn btn-dialog btn-primary">Ban</button>
+            </div>
+        </form>
+    </dialog>
+
     <!-- Simple Footer -->
     <footer class="footer">
         <div class="main-layout">
diff --git a/frontend/templates/profile.html b/frontend/templates/profile.html
index ae33a5e5..f6896fc4 100644
--- a/frontend/templates/profile.html
+++ b/frontend/templates/profile.html
@@ -71,7 +71,7 @@ <h1>{{ user.account_username }}</h1>
         {% endif %}
         <div class="info-row">
             <span class="info-label">Status</span>
-            <span class="info-value">Active</span>
+            <span class="info-value">{% if user.is_banned %}Banned{% if user.ban_reason %}: {{ user.ban_reason }}{% endif %}{% else %}Active{% endif %}</span>
         </div>
     </div>
 
@@ -141,6 +141,16 @@ <h2 class="modal-title">Update Password</h2>
 
     {% if current_user and current_user.account_role == 'admin' and not is_own_profile and user.account_role != 'admin' %}
     <div class="profile-actions">
+        {% if user.is_banned %}
+        <form action="{{ url_for('auth.unban_account', account_id=user.account_id) }}" method="POST" class="logout-form">
+            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+            <button type="submit" class="btn btn-secondary">Unban</button>
+        </form>
+        {% else %}
+        <button type="button" class="btn btn-danger ban-trigger"
+            data-user-id="{{ user.account_id }}"
+            data-username="{{ user.account_username }}">Ban</button>
+        {% endif %}
         <form id="admin-delete-account-form" action="{{ url_for('auth.delete_account') }}" method="POST" class="logout-form">
             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
             <input type="hidden" name="account_id" value="{{ user.account_id }}">
diff --git a/frontend/templates/user_list.html b/frontend/templates/user_list.html
index dfbcaedf..5bf9bcc3 100644
--- a/frontend/templates/user_list.html
+++ b/frontend/templates/user_list.html
@@ -49,6 +49,8 @@ <h1>Manage Users ({{ total_count }} users)</h1>
                     <th>Username</th>
                     <th>Email</th>
                     <th>Role</th>
+                    <th>Status</th>
+                    <th>Reason</th>
                     <th>Member Since</th>
                     <th>Actions</th>
                 </tr>
@@ -59,6 +61,8 @@ <h1>Manage Users ({{ total_count }} users)</h1>
                     <td><a href="{{ url_for('auth.user_profile', username=user.account_username) }}">{{ user.account_username }}</a></td>
                     <td>{{ user.account_email }}</td>
                     <td>{{ user.account_role }}</td>
+                    <td>{{ "Banned" if user.is_banned else "Active" }}</td>
+                    <td>{{ user.ban_reason or '—' }}</td>
                     <td>{{ user.account_created_at|date_format if user.account_created_at else 'N/A' }}</td>
                     <td>
                         {% if user.account_role == 'admin' %}
@@ -73,6 +77,16 @@ <h1>Manage Users ({{ total_count }} users)</h1>
                             </select>
                             <button type="submit" class="btn btn-sm">Update</button>
                         </form>
+                        {% if user.is_banned %}
+                        <form action="{{ url_for('auth.unban_account', account_id=user.account_id) }}" method="POST" class="user-table-form">
+                            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                            <button type="submit" class="btn btn-sm btn-secondary">Unban</button>
+                        </form>
+                        {% else %}
+                        <button type="button" class="btn btn-sm btn-danger ban-trigger"
+                            data-user-id="{{ user.account_id }}"
+                            data-username="{{ user.account_username }}">Ban</button>
+                        {% endif %}
                         <form id="delete-user-{{ user.account_id }}" action="{{ url_for('auth.delete_account') }}" method="POST" class="user-table-form">
                             <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                             <input type="hidden" name="account_id" value="{{ user.account_id }}">
diff --git a/migrations/V13__add_ban_columns_to_accounts.sql b/migrations/V13__add_ban_columns_to_accounts.sql
new file mode 100644
index 00000000..2404cabc
--- /dev/null
+++ b/migrations/V13__add_ban_columns_to_accounts.sql
@@ -0,0 +1,5 @@
+ALTER TABLE accounts
+  ADD COLUMN is_banned BOOLEAN NOT NULL DEFAULT FALSE;
+
+ALTER TABLE accounts
+  ADD COLUMN ban_reason VARCHAR(150);
diff --git a/src/application/domain/account.py b/src/application/domain/account.py
index b1a65ea3..f720d235 100644
--- a/src/application/domain/account.py
+++ b/src/application/domain/account.py
@@ -24,6 +24,8 @@ class Account:
         account_role (AccountRole): Permissions role.
         account_created_at (datetime): Timestamp of account creation.
         avatar_file_id (str | None): UUID of the avatar file in uploaded_files, or None.
+        is_banned (bool): Whether the account is currently banned.
+        ban_reason (str | None): Optional reason provided by admin when banning.
     """
 
     def __init__(
@@ -35,6 +37,8 @@ def __init__(
         account_role: AccountRole,
         account_created_at: datetime | None,
         avatar_file_id: str | None = None,
+        is_banned: bool = False,
+        ban_reason: str | None = None,
     ):
         """
         Initialize a user account.
@@ -47,6 +51,8 @@ def __init__(
             account_role (AccountRole): Permissions role.
             account_created_at (datetime): Timestamp of account creation.
             avatar_file_id (str | None): UUID of the avatar file in uploaded_files, or None.
+            is_banned (bool): Whether the account is currently banned. Defaults to False.
+            ban_reason (str | None): Optional reason provided by admin when banning.
         """
         self.account_id = account_id
         self.account_username = account_username
@@ -55,3 +61,5 @@ def __init__(
         self.account_role = account_role
         self.account_created_at = account_created_at
         self.avatar_file_id = avatar_file_id
+        self.is_banned = is_banned
+        self.ban_reason = ban_reason
diff --git a/src/application/input_ports/account_session_management.py b/src/application/input_ports/account_session_management.py
index ab584882..81cb1694 100644
--- a/src/application/input_ports/account_session_management.py
+++ b/src/application/input_ports/account_session_management.py
@@ -163,6 +163,35 @@ def count_search_accounts(self, query: str) -> int:
         """
         pass
 
+    @abstractmethod
+    def ban_account(self, admin_id: int, target_account_id: int, ban_reason: str | None) -> str | None:
+        """
+        Bans a user account. Only admins can ban non-admin accounts.
+
+        Args:
+            admin_id: The unique identifier of the admin performing the action.
+            target_account_id: The unique identifier of the account to ban.
+            ban_reason: Optional reason for the ban.
+
+        Returns:
+            str | None: None on success, or an error message string if the operation fails.
+        """
+        pass
+
+    @abstractmethod
+    def unban_account(self, admin_id: int, target_account_id: int) -> str | None:
+        """
+        Unbans a user account. Only admins can unban accounts.
+
+        Args:
+            admin_id: The unique identifier of the admin performing the action.
+            target_account_id: The unique identifier of the account to unban.
+
+        Returns:
+            str | None: None on success, or an error message string if the operation fails.
+        """
+        pass
+
     @abstractmethod
     def delete_account(self, account_id: int) -> None:
         """
diff --git a/src/application/output_ports/account_repository.py b/src/application/output_ports/account_repository.py
index 5676bd59..92bb245a 100644
--- a/src/application/output_ports/account_repository.py
+++ b/src/application/output_ports/account_repository.py
@@ -186,6 +186,18 @@ def count_search(self, query: str) -> int:
         """
         pass
 
+    @abstractmethod
+    def update_ban_status(self, account_id: int, is_banned: bool, ban_reason: str | None) -> None:
+        """
+        Sets or clears the ban status for a given account.
+
+        Args:
+            account_id: The ID of the account to update.
+            is_banned: True to ban, False to unban.
+            ban_reason: Optional reason for the ban, or None to clear.
+        """
+        pass
+
     @abstractmethod
     def delete(self, account_id: int) -> None:
         """
diff --git a/src/application/services/article_service.py b/src/application/services/article_service.py
index 621b1563..3bed9993 100644
--- a/src/application/services/article_service.py
+++ b/src/application/services/article_service.py
@@ -114,6 +114,9 @@ def _get_account_if_author_or_admin(self, user_id: int) -> Account | str:
             # TODO: Raise InsufficientPermissionsException
             return "Insufficient permissions."
 
+        if account.is_banned:
+            return "Account is banned."
+
         return account
 
     def create_article(self, title: str, content: str, author_id: int, author_role: str, description: str = "") -> Article | str:
diff --git a/src/application/services/comment_service.py b/src/application/services/comment_service.py
index 4a3f9277..fe43120e 100644
--- a/src/application/services/comment_service.py
+++ b/src/application/services/comment_service.py
@@ -58,6 +58,8 @@ def _get_account_if_exists(self, user_id: int) -> Account | str:
         if not account:
             # TODO: Raise AccountNotFoundException
             return "Account not found."
+        if account.is_banned:
+            return "Account is banned."
         return account
 
     @staticmethod
diff --git a/src/application/services/login_service.py b/src/application/services/login_service.py
index 77963352..a41a02e6 100644
--- a/src/application/services/login_service.py
+++ b/src/application/services/login_service.py
@@ -54,6 +54,9 @@ def authenticate_user(self, username: str, password: str) -> Account | str:
             return "Invalid username or password."
 
         if self.password_hasher_repository.verify(password, account.account_password):
+            if account.is_banned:
+                return "This account has been banned."
+
             if self.password_hasher_repository.check_needs_rehash(account.account_password):
                 new_hash = self.password_hasher_repository.hash(password)
                 account.account_password = new_hash
@@ -276,3 +279,51 @@ def update_account_role(self, admin_id: int, target_id: int, new_role: str) -> s
 
         self.account_repository.update_role(target_id, new_role)
         return None
+
+    def ban_account(self, admin_id: int, target_account_id: int, ban_reason: str | None) -> str | None:
+        """
+        Bans a user account. Only admins can ban non-admin accounts.
+
+        Args:
+            admin_id: The unique identifier of the admin performing the action.
+            target_account_id: The unique identifier of the account to ban.
+            ban_reason: Optional reason for the ban.
+
+        Returns:
+            str | None: None on success, or an error message string if the operation fails.
+        """
+        admin = self.account_repository.get_by_id(admin_id)
+        if not admin or admin.account_role != AccountRole.ADMIN:
+            return "Unauthorized."
+
+        target = self.account_repository.get_by_id(target_account_id)
+        if not target:
+            return "Account not found."
+
+        if target.account_role == AccountRole.ADMIN:
+            return "Cannot ban another admin."
+
+        self.account_repository.update_ban_status(target_account_id, True, ban_reason)
+        return None
+
+    def unban_account(self, admin_id: int, target_account_id: int) -> str | None:
+        """
+        Unbans a user account. Only admins can unban accounts.
+
+        Args:
+            admin_id: The unique identifier of the admin performing the action.
+            target_account_id: The unique identifier of the account to unban.
+
+        Returns:
+            str | None: None on success, or an error message string if the operation fails.
+        """
+        admin = self.account_repository.get_by_id(admin_id)
+        if not admin or admin.account_role != AccountRole.ADMIN:
+            return "Unauthorized."
+
+        target = self.account_repository.get_by_id(target_account_id)
+        if not target:
+            return "Account not found."
+
+        self.account_repository.update_ban_status(target_account_id, False, None)
+        return None
diff --git a/src/infrastructure/input_adapters/dto/account_response.py b/src/infrastructure/input_adapters/dto/account_response.py
index 601790b0..e8676a48 100644
--- a/src/infrastructure/input_adapters/dto/account_response.py
+++ b/src/infrastructure/input_adapters/dto/account_response.py
@@ -11,7 +11,7 @@ class AccountResponse(BaseModel):
 
     This class securely exposes account information to the client,
     intentionally omitting the password field. It also includes the
-    optional avatar file reference for profile display.
+    optional avatar file reference for profile display and ban status fields.
     """
 
     model_config = ConfigDict(from_attributes=True)
@@ -22,6 +22,8 @@ class AccountResponse(BaseModel):
     account_role: str
     account_created_at: datetime | None
     avatar_file_id: str | None = None
+    is_banned: bool = False
+    ban_reason: str | None = None
 
     @classmethod
     def from_domain(cls, account: Account) -> "AccountResponse":
@@ -33,7 +35,7 @@ def from_domain(cls, account: Account) -> "AccountResponse":
 
         Returns:
             AccountResponse: The safe representation for Web output,
-            including the optional avatar_file_id.
+            including the optional avatar_file_id and ban status fields.
         """
         return cls(
             account_id=account.account_id,
@@ -42,4 +44,6 @@ def from_domain(cls, account: Account) -> "AccountResponse":
             account_role=account.account_role.value if account.account_role else "user",
             account_created_at=account.account_created_at,
             avatar_file_id=account.avatar_file_id,
+            is_banned=account.is_banned,
+            ban_reason=account.ban_reason,
         )
diff --git a/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py b/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
index 0810adc1..8e211160 100644
--- a/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_account_session_adapter.py
@@ -416,3 +416,68 @@ def change_role(self, account_id: int):
         if target:
             return redirect(url_for("auth.user_profile", username=target.account_username))
         return redirect(url_for("auth.list_all_users"))
+
+    def ban_account(self, account_id: int):
+        """
+        Handles ban form submission (Admin only).
+
+        Validates authentication, reads the optional ban_reason from the form,
+        and delegates the ban to the session service.
+
+        Args:
+            account_id: The ID of the account to ban.
+
+        Returns:
+            Response: A Flask redirect response.
+
+        Raises:
+            403: If the current user is not authenticated or not an admin.
+        """
+        current_account = self.session_service.get_current_account()
+        if not current_account or current_account.account_role != AccountRole.ADMIN:
+            abort(403)
+
+        ban_reason = request.form.get("ban_reason", "").strip() or None
+        result = self.session_service.ban_account(
+            admin_id=current_account.account_id,
+            target_account_id=account_id,
+            ban_reason=ban_reason,
+        )
+
+        if result is not None:
+            flash(result, "error")
+        else:
+            flash("Account banned.", "success")
+
+        return redirect(url_for("auth.list_all_users"))
+
+    def unban_account(self, account_id: int):
+        """
+        Handles unban form submission (Admin only).
+
+        Validates authentication and delegates the unban to the session service.
+
+        Args:
+            account_id: The ID of the account to unban.
+
+        Returns:
+            Response: A Flask redirect response.
+
+        Raises:
+            403: If the current user is not authenticated or not an admin.
+        """
+        current_account = self.session_service.get_current_account()
+        if not current_account or current_account.account_role != AccountRole.ADMIN:
+            abort(403)
+
+        result = self.session_service.unban_account(
+            admin_id=current_account.account_id,
+            target_account_id=account_id,
+        )
+
+        if result is not None:
+            flash(result, "error")
+        else:
+            flash("Account unbanned.", "success")
+
+        return redirect(url_for("auth.list_all_users"))
diff --git a/src/infrastructure/input_adapters/flask/flask_login_adapter.py b/src/infrastructure/input_adapters/flask/flask_login_adapter.py
index f8e339a5..afabf812 100644
--- a/src/infrastructure/input_adapters/flask/flask_login_adapter.py
+++ b/src/infrastructure/input_adapters/flask/flask_login_adapter.py
@@ -62,5 +62,8 @@ def authenticate(self):
         if not isinstance(result, str):
             return redirect(url_for("article.list_articles"))
 
-        flash("Invalid username or password.", "error")
+        if result == "This account has been banned.":
+            flash(result, "error")
+        else:
+            flash("Invalid username or password.", "error")
         return render_template("login.html", current_user=user, username=login_data.username)
diff --git a/src/infrastructure/output_adapters/dto/account_record.py b/src/infrastructure/output_adapters/dto/account_record.py
index 07bde311..f7e4c8c7 100644
--- a/src/infrastructure/output_adapters/dto/account_record.py
+++ b/src/infrastructure/output_adapters/dto/account_record.py
@@ -11,7 +11,7 @@ class AccountRecord(BaseModel):
 
     This class faithfully mirrors the 'accounts' table schema and provides
     validation when loading data from the persistence layer, including
-    the optional avatar file reference.
+    the optional avatar file reference and ban status fields.
     """
 
     model_config = ConfigDict(from_attributes=True)
@@ -23,6 +23,8 @@ class AccountRecord(BaseModel):
     account_role: str
     account_created_at: datetime | None
     avatar_file_id: str | None = None
+    is_banned: bool = False
+    ban_reason: str | None = None
 
     def to_domain(self) -> Account:
         """
@@ -30,8 +32,8 @@ def to_domain(self) -> Account:
 
         Returns:
             Account: The corresponding domain entity, including the
-            conversion of the 'account_role' string to an AccountRole enum
-            and the optional avatar_file_id reference.
+            conversion of the 'account_role' string to an AccountRole enum,
+            the optional avatar_file_id reference, and the ban status fields.
         """
         return Account(
             account_id=self.account_id,
@@ -41,4 +43,6 @@ def to_domain(self) -> Account:
             account_role=AccountRole(self.account_role),
             account_created_at=self.account_created_at,
             avatar_file_id=self.avatar_file_id,
+            is_banned=self.is_banned,
+            ban_reason=self.ban_reason,
         )
diff --git a/src/infrastructure/output_adapters/in_memory/account_repository.py b/src/infrastructure/output_adapters/in_memory/account_repository.py
index d02af979..9541590e 100644
--- a/src/infrastructure/output_adapters/in_memory/account_repository.py
+++ b/src/infrastructure/output_adapters/in_memory/account_repository.py
@@ -215,6 +215,24 @@ def count_search(self, query: str) -> int:
             if q in a.account_username.lower() or q in a.account_email.lower()
         )
 
+    def update_ban_status(self, account_id: int, is_banned: bool, ban_reason: str | None) -> None:
+        """
+        Sets or clears the ban status for the given account in memory.
+
+        Args:
+            account_id: The ID of the account to update.
+            is_banned: True to ban, False to unban.
+            ban_reason: Optional reason for the ban, or None to clear.
+
+        Raises:
+            ValueError: If no account with the given ID exists.
+        """
+        account = self._accounts.get(account_id)
+        if account is None:
+            raise ValueError(f"Account with id {account_id} not found.")
+        account.is_banned = is_banned
+        account.ban_reason = ban_reason
+
     def delete(self, account_id: int) -> None:
         """
         Deletes an account by its unique identifier from the in-memory store.
diff --git a/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_account_model.py b/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_account_model.py
index 62ba4e79..c016af8f 100644
--- a/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_account_model.py
+++ b/src/infrastructure/output_adapters/sqlalchemy/models/sqlalchemy_account_model.py
@@ -1,6 +1,6 @@
 from datetime import datetime
 
-from sqlalchemy import TIMESTAMP, Integer, Text, func
+from sqlalchemy import TIMESTAMP, Boolean, Integer, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column
 
 from src.infrastructure.output_adapters.sqlalchemy.models.sqlalchemy_registry import SqlAlchemyModel
@@ -11,8 +11,8 @@ class AccountModel(SqlAlchemyModel):
     SQLAlchemy ORM model for the 'accounts' table.
 
     This class defines the database schema for user profiles, including
-    authentication credentials, contact information, and roles.
-    It also stores an optional reference to the user's avatar image
+    authentication credentials, contact information, roles, ban status,
+    and an optional reference to the user's avatar image
     in the ``uploaded_files`` table via ``avatar_file_id``.
     """
 
@@ -25,3 +25,5 @@ class AccountModel(SqlAlchemyModel):
     account_role: Mapped[str] = mapped_column(Text, nullable=False)
     account_created_at: Mapped[datetime] = mapped_column(TIMESTAMP, server_default=func.now())
     avatar_file_id: Mapped[str | None] = mapped_column(Text, nullable=True, default=None)
+    is_banned: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    ban_reason: Mapped[str | None] = mapped_column(String(150), nullable=True, default=None)
diff --git a/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py b/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
index e29e6da6..2d6da6b8 100644
--- a/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
+++ b/src/infrastructure/output_adapters/sqlalchemy/sqlalchemy_account_adapter.py
@@ -217,6 +217,26 @@ def update_password(self, account_id: int, new_hashed_password: str) -> None:
         model.account_password = new_hashed_password
         self._session.commit()
 
+    def update_ban_status(self, account_id: int, is_banned: bool, ban_reason: str | None) -> None:
+        """
+        Sets or clears the ban status for the given account directly in the database.
+
+        Performs a targeted column update without loading or saving the full
+        Account entity, keeping the responsibility focused and avoiding
+        accidental overwrites of other fields.
+
+        Args:
+            account_id: The ID of the account to update.
+            is_banned: True to ban, False to unban.
+            ban_reason: Optional reason for the ban, or None to clear.
+        """
+        model = self._session.get(AccountModel, account_id)
+        if model is None:
+            return
+        model.is_banned = is_banned
+        model.ban_reason = ban_reason
+        self._session.commit()
+
     def update_role(self, account_id: int, new_role: str) -> None:
         """
         Updates the role for the given account directly in the database.
diff --git a/tests/test_domain_factories.py b/tests/test_domain_factories.py
index 6e1fd94b..63db5bc8 100644
--- a/tests/test_domain_factories.py
+++ b/tests/test_domain_factories.py
@@ -13,6 +13,8 @@ def create_test_account(
     account_role: AccountRole = AccountRole.USER,
     account_created_at: datetime | None = None,
     account_avatar_file_id: str | None = None,
+    is_banned: bool = False,
+    ban_reason: str | None = None,
 ) -> Account:
     """Factory to create a test Account entity with sensible defaults."""
     if account_created_at is None:
@@ -26,6 +28,8 @@ def create_test_account(
         account_role=account_role,
         account_created_at=account_created_at,
         avatar_file_id=account_avatar_file_id,
+        is_banned=is_banned,
+        ban_reason=ban_reason,
     )
 
 
diff --git a/tests/tests_infrastructure/tests_input_adapters/dto/test_account_response.py b/tests/tests_infrastructure/tests_input_adapters/dto/test_account_response.py
index 0067ce21..aff7aff9 100644
--- a/tests/tests_infrastructure/tests_input_adapters/dto/test_account_response.py
+++ b/tests/tests_infrastructure/tests_input_adapters/dto/test_account_response.py
@@ -44,3 +44,37 @@ def test_from_domain():
     response_dict = response.model_dump()
     assert "account_password" not in response_dict
     assert "password" not in response_dict
+
+
+def test_from_domain_with_banned_true():
+    fixed_date = datetime(2026, 4, 7, 10, 0, 0)
+
+    domain_account = create_test_account(
+        account_id=1,
+        account_username="leia",
+        account_email="leia@galaxy.com",
+        account_role=AccountRole.USER,
+        account_created_at=fixed_date,
+        is_banned=True,
+        ban_reason="Spam",
+    )
+
+    response = AccountResponse.from_domain(domain_account)
+    assert response.is_banned is True
+    assert response.ban_reason == "Spam"
+
+
+def test_from_domain_with_banned_false():
+    fixed_date = datetime(2026, 4, 7, 10, 0, 0)
+
+    domain_account = create_test_account(
+        account_id=1,
+        account_username="leia",
+        account_email="leia@galaxy.com",
+        account_role=AccountRole.USER,
+        account_created_at=fixed_date,
+    )
+
+    response = AccountResponse.from_domain(domain_account)
+    assert response.is_banned is False
+    assert response.ban_reason is None
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
index 57f99e1e..df5b675b 100644
--- a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
+++ b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_account_session_adapter.py
@@ -553,6 +553,82 @@ def test_non_admin_change_role_returns_403(self):
         assert response.status_code == 403
 
 
+class TestAccountSessionBan(FlaskInputAdapterTestBase):
+    def setup_method(self):
+        super().setup_method()
+        self.mock_session_service = Mock(spec=AccountSessionManagementPort, autospec=True)
+        self.mock_file_service = Mock(spec=FileManagementPort, autospec=True)
+        self.mock_comment_service = Mock(spec=CommentManagementPort, autospec=True)
+        self.adapter = AccountSessionAdapter(
+            session_service=self.mock_session_service,
+            file_service=self.mock_file_service,
+            comment_service=self.mock_comment_service,
+        )
+        self.app.add_url_rule(
+            "/admin/users/<int:account_id>/ban",
+            view_func=self.adapter.ban_account,
+            methods=["POST"],
+            endpoint="auth.ban_account",
+        )
+        self.app.add_url_rule(
+            "/admin/users/<int:account_id>/unban",
+            view_func=self.adapter.unban_account,
+            methods=["POST"],
+            endpoint="auth.unban_account",
+        )
+        self._register_dummy_route("/admin/users", "auth.list_all_users", "users")
+
+    def test_admin_ban_user_redirects(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.ban_account.return_value = None
+        response = self.client.post("/admin/users/2/ban", data={"ban_reason": "Spam"})
+        assert response.status_code == 302
+        self.mock_session_service.ban_account.assert_called_once_with(
+            admin_id=1, target_account_id=2, ban_reason="Spam",
+        )
+
+    def test_admin_unban_user_redirects(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.unban_account.return_value = None
+        response = self.client.post("/admin/users/2/unban")
+        assert response.status_code == 302
+        self.mock_session_service.unban_account.assert_called_once_with(
+            admin_id=1, target_account_id=2,
+        )
+
+    def test_non_admin_ban_returns_403(self):
+        user = create_test_account(account_id=1, account_role=AccountRole.USER)
+        self.set_current_user(user)
+        self.mock_session_service.get_current_account.return_value = user
+        response = self.client.post("/admin/users/2/ban", data={"ban_reason": "Spam"})
+        assert response.status_code == 403
+        self.mock_session_service.ban_account.assert_not_called()
+
+    def test_admin_ban_another_admin_returns_302_with_flash(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.ban_account.return_value = "Cannot ban another admin."
+        response = self.client.post("/admin/users/2/ban", data={"ban_reason": "Spam"}, follow_redirects=True)
+        assert response.status_code == 200
+        assert b"Cannot ban another admin" in response.data
+        self.mock_session_service.ban_account.assert_called_once()
+
+    def test_admin_ban_nonexistent_user_redirects_with_flash(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.set_current_user(admin)
+        self.mock_session_service.get_current_account.return_value = admin
+        self.mock_session_service.ban_account.return_value = "Account not found."
+        response = self.client.post("/admin/users/999/ban", data={"ban_reason": "Spam"}, follow_redirects=True)
+        assert response.status_code == 200
+        assert b"Account not found" in response.data
+        self.mock_session_service.ban_account.assert_called_once()
+
+
 class TestAccountSessionBeforeRequestHook(FlaskInputAdapterTestBase):
     """
     Tests for the 'before_request' lifecycle hook registered by AccountSessionAdapter.
diff --git a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_login_adapter.py b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_login_adapter.py
index b5927289..43087255 100644
--- a/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_login_adapter.py
+++ b/tests/tests_infrastructure/tests_input_adapters/tests_flask/test_flask_login_adapter.py
@@ -88,3 +88,17 @@ def test_post_login_validation_error(self):
         response = self.client.post("/login", data={"username": ""}, follow_redirects=True)
         assert b"Validation Error" in response.data or b"field required" in response.data.lower()
         assert b"alert-error" in response.data
+
+    def test_post_login_banned(self):
+        banned_account = create_test_account(is_banned=True)
+        self.mock_repo.find_by_username.return_value = banned_account
+
+        response = self.client.post("/login", data={
+            "username": "leia",
+            "password": "password123"
+        }, follow_redirects=True)
+
+        assert b"This account has been banned." in response.data
+        assert b"alert-error" in response.data
+        self.mock_repo.find_by_username.assert_called_once_with("leia")
+        self.mock_session_repo.save_account.assert_not_called()
diff --git a/tests/tests_infrastructure/tests_output_adapters/dto/test_account_record.py b/tests/tests_infrastructure/tests_output_adapters/dto/test_account_record.py
index b47ba331..28d97773 100644
--- a/tests/tests_infrastructure/tests_output_adapters/dto/test_account_record.py
+++ b/tests/tests_infrastructure/tests_output_adapters/dto/test_account_record.py
@@ -14,6 +14,8 @@ def __init__(self) -> None:
         self.account_email = "orm@example.com"
         self.account_role = "author"
         self.account_created_at = datetime(2024, 6, 15)
+        self.is_banned = False
+        self.ban_reason = None
 
 
 class TestAccountRecordCreation:
@@ -117,3 +119,33 @@ def test_to_domain_preserves_null_created_at(self):
 
         domain_account = record.to_domain()
         assert domain_account.account_created_at is None
+
+    def test_to_domain_preserves_ban_status(self):
+        record = AccountRecord(
+            account_id=1,
+            account_username="testuser",
+            account_password="password",
+            account_email="test@example.com",
+            account_role="user",
+            account_created_at=None,
+            is_banned=True,
+            ban_reason="Spam",
+        )
+
+        domain_account = record.to_domain()
+        assert domain_account.is_banned is True
+        assert domain_account.ban_reason == "Spam"
+
+    def test_to_domain_without_ban_reason(self):
+        record = AccountRecord(
+            account_id=1,
+            account_username="testuser",
+            account_password="password",
+            account_email="test@example.com",
+            account_role="user",
+            account_created_at=None,
+        )
+
+        domain_account = record.to_domain()
+        assert domain_account.is_banned is False
+        assert domain_account.ban_reason is None
diff --git a/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py b/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
index ed485388..a53a96cd 100644
--- a/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
+++ b/tests/tests_infrastructure/tests_output_adapters/test_in_memory_adapters.py
@@ -249,6 +249,27 @@ def test_delete_nonexistent_account_does_not_raise(self):
         repo = InMemoryAccountRepository()
         repo.delete(999)
 
+    def test_update_ban_status_ban(self):
+        repo = InMemoryAccountRepository()
+        account = Account(0, "user", "pass", "em", AccountRole.USER, datetime.now())
+        repo.save(account)
+        repo.update_ban_status(account.account_id, True, "Spam")
+        updated = repo.get_by_id(account.account_id)
+        assert updated is not None
+        assert updated.is_banned is True
+        assert updated.ban_reason == "Spam"
+
+    def test_update_ban_status_unban(self):
+        repo = InMemoryAccountRepository()
+        account = Account(0, "user", "pass", "em", AccountRole.USER, datetime.now())
+        repo.save(account)
+        repo.update_ban_status(account.account_id, True, "Spam")
+        repo.update_ban_status(account.account_id, False, None)
+        updated = repo.get_by_id(account.account_id)
+        assert updated is not None
+        assert updated.is_banned is False
+        assert updated.ban_reason is None
+
 
 class TestInMemoryCommentRepository:
     def test_save_and_get(self):
diff --git a/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/test_sqlalchemy_account_adapter.py b/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/test_sqlalchemy_account_adapter.py
index 9970f2cd..c5fcd56a 100644
--- a/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/test_sqlalchemy_account_adapter.py
+++ b/tests/tests_infrastructure/tests_output_adapters/tests_sqlalchemy/test_sqlalchemy_account_adapter.py
@@ -227,3 +227,22 @@ def test_search_count(self):
         assert self.repository.count_search("alice") == 1
         assert self.repository.count_search("@t.com") == 2
         assert self.repository.count_search("zzz") == 0
+
+
+class TestAccountUpdateBanStatus(SqlAlchemyAccountAdapterTestBase):
+    def test_update_ban_status_ban(self):
+        account = self.account_builder.create(username="ban_target")
+        self.repository.update_ban_status(account.account_id, True, "Spam")
+        result = self.repository.get_by_id(account.account_id)
+        assert result is not None
+        assert result.is_banned is True
+        assert result.ban_reason == "Spam"
+
+    def test_update_ban_status_unban(self):
+        account = self.account_builder.create(username="unban_target")
+        self.repository.update_ban_status(account.account_id, True, "Spam")
+        self.repository.update_ban_status(account.account_id, False, None)
+        result = self.repository.get_by_id(account.account_id)
+        assert result is not None
+        assert result.is_banned is False
+        assert result.ban_reason is None
diff --git a/tests/tests_integration/test_security_integration.py b/tests/tests_integration/test_security_integration.py
index 788eac90..c8246105 100644
--- a/tests/tests_integration/test_security_integration.py
+++ b/tests/tests_integration/test_security_integration.py
@@ -236,6 +236,34 @@ def test_sql_injection_in_login_integ(self, client, db_session):
 class TestAccessControl:
     """Tests focused on enforcing authorization and permission boundaries."""
 
+    def test_ban_workflow_integ(self, client, db_session):
+        """
+        Verifies the full ban/unban workflow:
+        admin bans user → banned user cannot login → admin unbans → user can login.
+        """
+        from src.infrastructure.output_adapters.sqlalchemy.models.sqlalchemy_account_model import AccountModel
+
+        admin = AccountModel(account_username="admin_ban", account_email="ab@t.com", account_password="p", account_role="admin")
+        target = AccountModel(account_username="target_user", account_email="tu@t.com", account_password="p", account_role="user")
+        db_session.add(admin)
+        db_session.add(target)
+        db_session.commit()
+
+        client.post("/login", data={"username": "admin_ban", "password": "p"}, follow_redirects=True)
+        client.post(f"/admin/users/{target.account_id}/ban", data={"ban_reason": "Test ban"}, follow_redirects=True)
+        client.get("/logout", follow_redirects=True)
+
+        response = client.post("/login", data={"username": "target_user", "password": "p"}, follow_redirects=True)
+        assert b"This account has been banned." in response.data
+
+        client.post("/login", data={"username": "admin_ban", "password": "p"}, follow_redirects=True)
+        client.post(f"/admin/users/{target.account_id}/unban", follow_redirects=True)
+        client.get("/logout", follow_redirects=True)
+
+        response = client.post("/login", data={"username": "target_user", "password": "p"}, follow_redirects=True)
+        assert b"articles" in response.data or b"DevJournal" in response.data
+
+
     def test_unauthorized_article_deletion(self, client, db_session):
         """
         Ensures that a user cannot delete another author's article.
diff --git a/tests/tests_services/test_login_service.py b/tests/tests_services/test_login_service.py
index bb4ae8cf..2796d522 100644
--- a/tests/tests_services/test_login_service.py
+++ b/tests/tests_services/test_login_service.py
@@ -213,3 +213,55 @@ def test_update_role_invalid_role(self):
 
         assert result == "Invalid role."
         self.mock_repo.update_role.assert_not_called()
+
+    def test_ban_account_success(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target = create_test_account(account_id=2, account_role=AccountRole.USER)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin, 2: target}.get(cid)
+
+        result = self.service.ban_account(admin_id=1, target_account_id=2, ban_reason="Spam")
+
+        assert result is None
+        self.mock_repo.update_ban_status.assert_called_once_with(2, True, "Spam")
+
+    def test_ban_account_not_found(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin}.get(cid)
+
+        result = self.service.ban_account(admin_id=1, target_account_id=999, ban_reason="Spam")
+
+        assert result == "Account not found."
+        self.mock_repo.update_ban_status.assert_not_called()
+
+    def test_ban_account_target_is_admin(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target_admin = create_test_account(account_id=2, account_role=AccountRole.ADMIN)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin, 2: target_admin}.get(cid)
+
+        result = self.service.ban_account(admin_id=1, target_account_id=2, ban_reason="Spam")
+
+        assert result == "Cannot ban another admin."
+        self.mock_repo.update_ban_status.assert_not_called()
+
+    def test_unban_account_success(self):
+        admin = create_test_account(account_id=1, account_role=AccountRole.ADMIN)
+        target = create_test_account(account_id=2, account_role=AccountRole.USER)
+        self.mock_repo.get_by_id.side_effect = lambda cid: {1: admin, 2: target}.get(cid)
+
+        result = self.service.unban_account(admin_id=1, target_account_id=2)
+
+        assert result is None
+        self.mock_repo.update_ban_status.assert_called_once_with(2, False, None)
+
+    def test_authenticate_user_banned(self):
+        fake_account = create_test_account(is_banned=True)
+        self.mock_repo.find_by_username.return_value = fake_account
+
+        result = self.service.authenticate_user(
+            username=fake_account.account_username,
+            password=fake_account.account_password
+        )
+
+        self.mock_repo.find_by_username.assert_called_once_with(fake_account.account_username)
+        self.mock_session_repo.save_account.assert_not_called()
+        assert result == "This account has been banned."