kima

please print here the result of dd(app()->getLocale()).

can you save the object without the lang parameter?

what about

    protected function attemptLogin(\Illuminate\Http\Request $request)
    {
        $isPassed = $this->guard()->attempt($this->credentials($request), $request->filled('remember'));

        if (! $isPassed) {
            $isPassed = $this->guard()->attempt(array_merge($this->credentials($request), ["password" => md5($request->input("password"))]), $request->filled('remember'));

            if ($isPassed) {
                $user = Auth::user();
                $user->password = Hash::make($request->password);

                $user->save();

                return true;
            }
        }

        return $isPassed;
    }

what about

    protected function attemptLogin(\Illuminate\Http\Request $request)
    {
        $isPassed = $this->guard()->attempt($this->credentials($request), $request->filled('remember'));

        if (! $isPassed) {
            $isPassed = $this->guard()->attempt(array_merge($this->credentials($request), ["password" => md5($request->input("password"))]), $request->filled('remember'));

            if ($isPassed) {
                $user = Auth::user();
                $user->password = Hash::make($request->password);

                $user->save();

                return true;
            }
        }

        return $isPassed;
    }

how look your products migration? did you put a reference index for categories?

please check if you have product item with category_id = 1

You can override the authenticate() function in App\Http\Middleware\Authenticate:

    protected function authenticate($request, array $guards)
    {
        parent::authenticate($request, $guards);

        // Got here? good! it means the user is session authenticated. now we should check if it authorize
        if (!auth()->user()->is_active) {
            auth()->logout();
            $this->unauthenticated($request, $guards);
        }
    }

Another solution if you're using only the web login, is to not login the user in the first place (I don't checked this solution in systems with different login mechanism, like passport. i guess it wouldn't work).

in App\Http\Controllers\Auth\LoginController, add the following trait use:

    use AuthenticatesUsers {
        attemptLogin as attemptLoginTrait;
        sendLoginResponse as sendLoginResponseTrait;
    }

and override its attemptLogin() function:

    public function attemptLogin(\Illuminate\Http\Request $request)
    {
        if (!$this->attemptLoginTrait($request)) {
            Log::info("--- ADMIN --- User '" . $request->input('email') . "' failed logging in");
            return false;
        }

        Log::info("--- ADMIN --- User '" . $request->input('email') . "' user authenticated successfully");

        if (!auth()->user()->is_active) {
            // Login failed - bad 2FA
            Log::info("--- ADMIN --- User '" . $request->input('email') . "' is not active!");
            auth()->logout();

            throw ValidationException::withMessages([
                "is_active" => ["user is not active"],
            ]);
        }

        // Login success
        return true;
    }

of course! you may override the redirectTo() function:

    /**
     * Get the path the user should be redirected to when they are not authenticated.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return string|null
     */
    protected function redirectTo($request)
    {
        return route('my-error-page');
    }

You can override the authenticate() function in App\Http\Middleware\Authenticate:

    protected function authenticate($request, array $guards)
    {
        parent::authenticate($request, $guards);

        // Got here? good! it means the user is session authenticated. now we should check if it authorize
        if (!auth()->user()->is_active) {
            auth()->logout();
            $this->unauthenticated($request, $guards);
        }
    }

Another solution if you're using only the web login, is to not login the user in the first place (I don't checked this solution in systems with different login mechanism, like passport. i guess it wouldn't work).

in App\Http\Controllers\Auth\LoginController, add the following trait use:

    use AuthenticatesUsers {
        attemptLogin as attemptLoginTrait;
        sendLoginResponse as sendLoginResponseTrait;
    }

and override its attemptLogin() function:

    public function attemptLogin(\Illuminate\Http\Request $request)
    {
        if (!$this->attemptLoginTrait($request)) {
            Log::info("--- ADMIN --- User '" . $request->input('email') . "' failed logging in");
            return false;
        }

        Log::info("--- ADMIN --- User '" . $request->input('email') . "' user authenticated successfully");

        if (!auth()->user()->is_active) {
            // Login failed - bad 2FA
            Log::info("--- ADMIN --- User '" . $request->input('email') . "' is not active!");
            auth()->logout();

            throw ValidationException::withMessages([
                "is_active" => ["user is not active"],
            ]);
        }

        // Login success
        return true;
    }