fix: a banned user shouldn't be able to access IRs

server/src/server/router/router.ts

@@ -7,13 +7,14 @@ import { UpdateLastSeen } from "server/middleware/update-last-seen";
 
 const router: Router = Router({ mergeParams: true });
 
+router.use(RejectIfBanned);
+
 router.use("/ir", NormalRateLimitMiddleware, irRouter);
 
 // request perms only apply to the api, IR may reuse this
 // but also may require custom authentication.
 router.use(SetRequestPermissions);
 router.use(UpdateLastSeen);
-router.use(RejectIfBanned);
 
 router.use("/api/v1", apiRouterV1);