The login method AuthService.login already uses findActiveByEmail, which only returns users with active = true. Therefore, disabling a user directly prevents login without any additional changes. For ...