R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -158,11 +158,12 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			if (parts.Length == 1 || parts[1].Equals(localDomain, StringComparison.OrdinalIgnoreCase))
 			{
 				var local = await _localActors.FindByUserName(parts[0], token);
-				return local is { IsFederated: true, IsCircle: false, IsServerActor: false } ? Json(await _mapper.Local(local, false, token)) : NotFoundError();
+				return local is { IsFederated: true, IsCircle: false, IsServerActor: false, Suspended: false } ? Json(await _mapper.Local(local, false, token)) : NotFoundError();
 			}
 			var userName = parts[0];
 			var domain = parts[1].ToLowerInvariant();
-			var foreign = await _dbEntities.ForeignAvatars.Match(f => f.UserName == userName && f.Domain == domain && !f.DeletionAt.HasValue).ExecuteFirstAsync(token);
+			var foreign = await _dbEntities.ForeignAvatars.Match(f => f.UserName == userName && f.Domain == domain && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue)
+				.ExecuteFirstAsync(token);
 			return foreign == default ? NotFoundError() : Json(_mapper.Foreign(foreign));
 		}
 
@@ -203,7 +204,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> Statuses(string id, CancellationToken token)
 		{
 			var (local, remote) = await Find(id, token);
-			if (local == default && remote == default)
+			// a suspended account's posts answer 404, as its account does (R6)
+			if (local == default && remote == default || local is { Suspended: true } || remote is { SuspendedAt: not null })
 				return NotFoundError();
 			if (Params.Bool("pinned") == true)
 			{
@@ -292,7 +294,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> Follow(string id, CancellationToken token)
 		{
 			var (local, remote) = await Find(id, token);
-			if (local == default && remote == default)
+			// nobody follows a suspended account (R6), here or elsewhere: it is not shown
+			if (local == default && remote == default || local is { Suspended: true } || remote is { SuspendedAt: not null })
 				return NotFoundError();
 			// a feed is read through the server, whose reader follows its communities; the persona follows nothing
 			if (remote is { AvatarType: AvatarType.Feed })

PrivaPub/Api/Mastodon/Controllers/InstanceController.cs

@@ -65,7 +65,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			if (string.IsNullOrEmpty(id))
 				return default;
 			var avatar = await DB.Default.Find<Avatar>().Match(a => a.ID == id && !a.DeletionAt.HasValue).ExecuteFirstAsync(token);
-			if (avatar == default || (await Counted.BarredPersonas(token)).Contains(id))
+			if (avatar == default || (await Counted.HeldBackPersonas(token)).Contains(id))
 				return default;
 			return await _mapper.Local(_localActors.FromAvatar(avatar), false, token);
 		}

PrivaPub/Api/Mastodon/Controllers/SearchController.cs

@@ -93,7 +93,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		// named in, and public posts of authors who let themselves be indexed; newest first, what the persona may see only
 		async Task<List<Status>> Words(string q, int offset, int limit, CancellationToken token)
 		{
-			var candidates = await _dbEntities.Posts.Match(f => f.Text(q)).Match(p => !p.DeletedAt.HasValue && p.ReblogOfPostId == null && !p.AuthorGone)
+			var candidates = await _dbEntities.Posts.Match(f => f.Text(q)).Match(p => p.ReblogOfPostId == null).Match(VisibilityPolicy.IsShown)
 				.Sort(p => p.ID, MongoDB.Entities.Order.Descending).Limit(WordCandidates).ExecuteAsync(token);
 			if (candidates.Count == 0)
 				return new List<Status>();
@@ -128,7 +128,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			{
 				var author = post.AuthorAccountId ?? post.GroupUserId;
 				var reachable = author == MyId && !post.IsFederatedCopy || mine.Contains(post.ID) || post.Mentions.Any(m => m.AccountId == MyId)
-					|| post.Visibility == PostVisibility.Public && Searchable(post, author);
+					|| post.Visibility == PostVisibility.Public && !post.AuthorLimited && Searchable(post, author);//a silenced author's only to who met it (R6)
 				if (reachable && await VisibilityPolicy.CanSee(post, MyId, token))
 					found.Add(post);
 				if (found.Count >= offset + limit)

PrivaPub/Api/Mastodon/Controllers/StreamingController.cs

@@ -159,6 +159,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 						continue;
 					await Send(new JsonObject { ["stream"] = new JsonArray(key.Wire.Select(w => (JsonNode)w).ToArray()), ["event"] = e.Name, ["payload"] = payload });
 				}
+				// the queue ends only when the stream was closed from here (the persona was suspended): the socket goes too
+				done.Cancel();
 				await reading;
 			}
 			catch (Exception ex) when (ex is OperationCanceledException or WebSocketException)
@@ -202,20 +204,23 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			try
 			{
 				await Write(":)\n\n");
+				using var done = CancellationTokenSource.CreateLinkedTokenSource(token);
 				var beating = Task.Run(async () =>
 				{
-					while (!token.IsCancellationRequested)
+					while (!done.IsCancellationRequested)
 					{
-						await Task.Delay(KeepAlive, token);
+						await Task.Delay(KeepAlive, done.Token);
 						await Write(":thump\n\n");
 					}
-				}, token);
+				}, done.Token);
 				await foreach (var (_, e) in listener.Queue.Reader.ReadAllAsync(token))
 				{
 					if (await Payload(e, token) is not { } payload)
 						continue;
 					await Write($"event: {e.Name}\ndata: {payload}\n\n");
 				}
+				// closed from here (the persona was suspended): the response ends
+				done.Cancel();
 				await beating;
 			}
 			catch (OperationCanceledException)

PrivaPub/Api/Mastodon/Controllers/TagsController.cs

@@ -44,6 +44,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			var since = today.AddDays(-6);
 			var posts = await dbEntities.Posts
 				.Match(p => p.Tags.Contains(tag) && p.Visibility == PostVisibility.Public && !p.DeletedAt.HasValue && p.CreationDate >= since)
+				.Match(PrivaPub.Domain.Privacy.VisibilityPolicy.IsPublic).Match(PrivaPub.Domain.Privacy.VisibilityPolicy.IsListed)
 				.Project(p => p.Include(x => x.CreationDate).Include(x => x.AuthorAccountId).Include(x => x.GroupUserId))
 				.ExecuteAsync(token);
 			return Enumerable.Range(0, 7).Select(back => today.AddDays(-back)).Select(day =>

PrivaPub/Api/Mastodon/Controllers/TimelinesController.cs

@@ -54,7 +54,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		[HttpGet("/api/v1/timelines/public"), Scope("read:statuses", requiresUser: false), Microsoft.AspNetCore.Authorization.AllowAnonymous]
 		public async Task<IActionResult> Public(CancellationToken token)
 		{
-			var query = _dbEntities.Posts.Match(p => p.Visibility == PostVisibility.Public && p.ReblogOfPostId == null).Match(VisibilityPolicy.IsPublic);
+			var query = _dbEntities.Posts.Match(p => p.Visibility == PostVisibility.Public && p.ReblogOfPostId == null).Match(VisibilityPolicy.IsPublic)
+				.Match(VisibilityPolicy.IsListed);
 			if (Params.Bool("local") == true)
 				query.Match(p => !p.IsFederatedCopy);
 			if (Params.Bool("remote") == true)
@@ -88,7 +89,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> Tag(string hashtag, CancellationToken token)
 		{
 			var tag = hashtag.TrimStart('#').ToLowerInvariant();
-			var query = _dbEntities.Posts.Match(p => p.Tags.Contains(tag) && p.Visibility == PostVisibility.Public && p.ReblogOfPostId == null).Match(VisibilityPolicy.IsPublic);
+			var query = _dbEntities.Posts.Match(p => p.Tags.Contains(tag) && p.Visibility == PostVisibility.Public && p.ReblogOfPostId == null).Match(VisibilityPolicy.IsPublic)
+				.Match(VisibilityPolicy.IsListed);
 			if (Params.Bool("local") == true)
 				query.Match(p => !p.IsFederatedCopy);
 			return await Respond(query, $"/api/v1/timelines/tag/{hashtag}", token);

PrivaPub/Api/Mastodon/Controllers/TrendsController.cs

@@ -90,30 +90,30 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			var offset = Math.Max(0, Params.Int("offset") ?? 0);
 			var limit = Limit(40, 80);
 			var localOnly = Params.Bool("local") == true;
-			var barred = await Counted.BarredPersonas(token);
+			var barred = await Counted.HeldBackPersonas(token);
 			var wanted = offset + limit;
 			var ordered = new List<string>();
 			if (Params.Get("order") == "new")
 			{
 				// many share a day: the first `wanted` are read with every other of the last one's day, so each page is cut the same way
-				var personas = await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID))
+				var personas = await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID) && !a.SilencedAt.HasValue)
 					.Sort(a => a.PublishedOn, Order.Descending).Limit(wanted).ExecuteAsync(token);
 				if (personas.Count == wanted)
 				{
 					var edge = personas[^1].PublishedOn;
 					var known = personas.Select(a => a.ID).ToList();
-					personas.AddRange(await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID)
+					personas.AddRange(await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID) && !a.SilencedAt.HasValue
 						&& a.PublishedOn == edge && !known.Contains(a.ID)).ExecuteAsync(token));
 				}
 				var remote = localOnly
 					? new List<ForeignAvatar>()
-					: await _dbEntities.ForeignAvatars.Match(f => f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue && f.Published != null)
+					: await _dbEntities.ForeignAvatars.Match(f => f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue && !f.SilencedAt.HasValue && f.Published != null)
 						.Sort(f => f.Published, Order.Descending).Limit(wanted).ExecuteAsync(token);
 				if (remote.Count == wanted)
 				{
 					var edge = remote[^1].Published;
 					var known = remote.Select(f => f.ID).ToList();
-					remote.AddRange(await _dbEntities.ForeignAvatars.Match(f => f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue
+					remote.AddRange(await _dbEntities.ForeignAvatars.Match(f => f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue && !f.SilencedAt.HasValue
 						&& f.Published == edge && !known.Contains(f.ID)).ExecuteAsync(token));
 				}
 				ordered = personas.Select(a => (a.ID, Joined: a.PublishedOn, Tie: Tie(a.UserName)))
@@ -123,7 +123,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			}
 			else
 			{
-				var discoverableLocal = (await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID))
+				var discoverableLocal = (await _dbEntities.Avatars.Match(a => a.Settings.IsDiscoverable && !a.DeletionAt.HasValue && !barred.Contains(a.ID) && !a.SilencedAt.HasValue)
 					.Project(a => a.Include(x => x.ID)).ExecuteAsync(token)).Select(a => a.ID).ToHashSet();
 				var seen = new HashSet<string>();
 				var maxId = default(string);
@@ -144,7 +144,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 					var remoteIds = fresh.Where(a => a.IsFederatedCopy).Select(a => a.Id).ToList();
 					var discoverableRemote = remoteIds.Count == 0
 						? new HashSet<string>()
-						: (await _dbEntities.ForeignAvatars.Match(f => remoteIds.Contains(f.ID) && f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue)
+						: (await _dbEntities.ForeignAvatars.Match(f => remoteIds.Contains(f.ID) && f.IsDiscoverable && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue && !f.SilencedAt.HasValue)
 							.Project(f => f.Include(x => x.ID)).ExecuteAsync(token)).Select(f => f.ID).ToHashSet();
 					ordered.AddRange(fresh.Where(a => a.IsFederatedCopy ? discoverableRemote.Contains(a.Id) : discoverableLocal.Contains(a.Id)).Select(a => a.Id));
 				}