server/AyaNova/Controllers/AuthController.cs

@@ -104,6 +104,11 @@ namespace AyaNova.Api.Controllers
                     }
 
 
+                    //If the user is inactive they may not login
+                    if (!u.Active)
+                    {
+                        return StatusCode(401, new ApiErrorResponse(ApiErrorCode.NOT_AUTHORIZED, null, "User deactivated"));
+                    }
 
                     //build the key (JWT set in startup.cs)
                     byte[] secretKey = System.Text.Encoding.ASCII.GetBytes(ServerBootConfig.AYANOVA_JWT_SECRET);