login permission

src/Auth/Business/LuticateUsersBusiness.php

@@ -2,6 +2,7 @@
 
 namespace Luticate\Auth\Business;
 
+use Luticate\Auth\DBO\LuticatePermissions;
 use Luticate\Auth\DBO\LuticateUsersLoginDbo;
 use Luticate\Utils\LuBusiness;
 use Luticate\Auth\DataAccess\LuticateUsersDataAccess;
@@ -70,6 +71,10 @@ class LuticateUsersBusiness extends LuBusiness {
             self::badPassword();
         if (!self::verifyPassword($password, $user->getPassword()))
             self::badPassword();
+
+        if (!LuticatePermissionsBusiness::getUserPermission($user->getId(), LuticatePermissions::USER_LOGIN))
+            self::unauthorized("User not allowed to login");
+
         $user = LuticateUsersLoginDbo::fromUserDbo($user);
         $user->setToken(self::getToken($user));
         return $user;