there are two ways of doing this..

1. there is an authenticate method i.e.

if (Auth::attempt(['email' => $email, 'password' => $password])) {
            // Authentication passed...
            return redirect()->intended('dashboard');
        }

send another array called 'activation_key' => null or "" or whatever.. and Laravel will check that field too.

2. hunt down the postLogin method that Laravel uses & replicate/override that inside your AuthContollers with exactly what laravel does, but afterwards check if auth::user()->Activation_key = null, 0 etc if so redirect them to wherever you want (& log them out ofcourse before doing that)

The way you are suggesting could be done.. you have $request in your middleware, so you get the username user entered, and do a query to see if activation_key is null etc and if so redirect back.. not sure why this is confusing?