feat: respect banned_until expiry in tenant ban check

check_tenant_not_banned/1 now allows connections when banned_until is
set and already in the past (time-limited ban expired). Adds tests for
permanent ban, future expiry, and past expiry cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: mentels

lib/supavisor/client_handler/checks.ex

@@ -10,6 +10,15 @@ defmodule Supavisor.ClientHandler.Checks do
 
   def check_tenant_not_banned(%{tenant: %{banned_at: nil}}), do: :ok
 
+  def check_tenant_not_banned(%{tenant: %{banned_until: banned_until, ban_reason: reason}})
+      when not is_nil(banned_until) do
+    if DateTime.compare(banned_until, DateTime.utc_now()) == :lt do
+      :ok
+    else
+      {:error, %TenantBannedError{ban_reason: reason}}
+    end
+  end
+
   def check_tenant_not_banned(%{tenant: %{ban_reason: reason}}) do
     {:error, %TenantBannedError{ban_reason: reason}}
   end

test/supavisor/client_handler_test.exs

@@ -83,13 +83,28 @@ defmodule Supavisor.ClientHandlerTest do
       assert :ok = Checks.check_tenant_not_banned(info)
     end
 
-    test "returns TenantBannedError when tenant has banned_at set" do
-      info = %{tenant: %Tenant{banned_at: ~U[2026-01-01 00:00:00Z], ban_reason: "abuse"}}
+    test "returns TenantBannedError for a permanent ban (banned_until nil)" do
+      info = %{tenant: %Tenant{banned_at: ~U[2026-01-01 00:00:00Z], ban_reason: "abuse", banned_until: nil}}
 
       assert {:error, %TenantBannedError{ban_reason: "abuse"}} =
                Checks.check_tenant_not_banned(info)
     end
 
+    test "returns TenantBannedError when banned_until is in the future" do
+      future = DateTime.utc_now() |> DateTime.add(3600, :second)
+      info = %{tenant: %Tenant{banned_at: ~U[2026-01-01 00:00:00Z], ban_reason: "abuse", banned_until: future}}
+
+      assert {:error, %TenantBannedError{ban_reason: "abuse"}} =
+               Checks.check_tenant_not_banned(info)
+    end
+
+    test "returns :ok when banned_until is in the past (ban expired)" do
+      past = DateTime.utc_now() |> DateTime.add(-3600, :second)
+      info = %{tenant: %Tenant{banned_at: ~U[2026-01-01 00:00:00Z], ban_reason: "abuse", banned_until: past}}
+
+      assert :ok = Checks.check_tenant_not_banned(info)
+    end
+
     test "TenantBannedError produces a FATAL postgres error message" do
       error = %TenantBannedError{ban_reason: "billing"}
       postgres_error = TenantBannedError.postgres_error(error)