user blocking

app/controllers/sessions_controller.rb

@@ -4,9 +4,19 @@ class SessionsController < ApplicationController
 
   def create
     @user = User.find_by(email: params[:email])
-    if @user && @user.authenticate(params[:password])
-      session[:user_id] = @user.id
+    unless @user
+      redirect_to '/welcome', notice: 'Wrong email address'
+      return
     end
+    unless @user.authenticate(params[:password])
+      redirect_to '/welcome', notice: 'Wrong password'
+      return
+    end
+    if @user.blocked?
+      redirect_to '/welcome', notice: 'You are blocked, please contact support'
+      return
+    end
+    session[:user_id] = @user.id
     redirect_to '/welcome'
   end
 

app/controllers/users_controller.rb

@@ -1,5 +1,5 @@
 class UsersController < ApplicationController
-  before_action :ensure_admin, only: [:destroy]
+  before_action :ensure_admin, only: [:destroy, :block]
 
   def index
     @users = User.all
@@ -56,4 +56,9 @@ class UsersController < ApplicationController
     User.destroy(params[:id])
     redirect_to '/users'
   end
+
+  def block
+    User.find(params[:id]).update(status: :blocked)
+    redirect_to '/users'
+  end
 end