I want to restrict login when the user is disabled by the Auth feature

There are several possible ways.

If you want to meet your needs with simple behaviors such as "Display 403 when an invalid user accesses a page that requires authentication," it may be easier to use the middleware.

For example, if you create middleware such as the following and register it for each route, users with invalid=true will not be able to access those routes, and page 403 will appear instead.

namespace App\Http\Middleware;

use Close;

classIsUserValid
{
    public function handle($request,Closure$next,$role)
    {
        if($request->user()->invalid){
            abort(403, 'error message');
        }

        return$next($request);
    }
}

If you need to show that the user is invalid as a validation message on the login page, I think Create a custom validation rule would be good.

Alternatively, I haven't tried it, but I think I can do the same thing using the existing exist rule because I can customize the eloquent query when I check it.

By the way, even if we implement validation when logging in, it would be better to register middleware.If the user is already logged in and changes to user.invalid=false, it will still be accessible without middleware.