R6 moderation: roles, silence and suspension, bans that write nothing on the personas, deletions, report actions

Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.

Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Infrastructure/Backup/ProtectiveMerge.cs

@@ -10,7 +10,8 @@ namespace PrivaPub.Infrastructure.Backup
 	// - blocks, mutes, domain blocks (the server's and the personas'), being blocked, reserved names, deletion tombstones,
 	//   reports, filters and OAuth applications are the union of both, P's row winning;
 	// - deletions win: a root, persona, group, post or remote account deleted since is deleted again (P's row, as its
-	//   deletion left it), with what a deletion takes away; P's moderation of a persona (silenced, suspended, banned) stays;
+	//   deletion left it), with what a deletion takes away; P's moderation of a persona or of an account elsewhere (silenced,
+//   suspended) stays, as do the posts the staff took down, and every post's moderation flags are worked out again;
 	// - a root keeps P's password, e-mail, ban and policies;
 	// - roots, personas and groups made since become tombstones: deleted, their names kept; local posts made since answer
 	//   410; media made since go to the trash, as do media trashed since (and they leave the posts restored with them),
@@ -103,9 +104,12 @@ namespace PrivaPub.Infrastructure.Backup
 						await database.GetCollection<BsonDocument>(collection).DeleteManyAsync(new BsonDocument("AvatarId", avatar["_id"].ToString()), token);
 					continue;
 				}
-				var moderated = new[] { "SilencedAt", "SuspendedAt", "BannedAt" }.Where(field => IsSet(avatar, field)).ToArray();
+				var moderated = new[] { "SilencedAt", "SuspendedAt", "BannedAt", "ModerationNote" }.Where(field => IsSet(avatar, field)).ToArray();
 				if (moderated.Length > 0)
+				{
 					await avatars.UpdateOneAsync(Id(avatar["_id"]), Copy(avatar, moderated), cancellationToken: token);
+					report.ProtectiveKept++;
+				}
 			}
 
 			var links = database.GetCollection<BsonDocument>("RootToAvatar");
@@ -131,13 +135,27 @@ namespace PrivaPub.Infrastructure.Backup
 				await groups.ReplaceOneAsync(Id(group["_id"]), group, cancellationToken: token);
 			}
 
-			// remote accounts deleted or gone since: as P has them
+			// remote accounts deleted or gone since: as P has them; the staff's silence or suspension of one stays (R6)
 			var foreign = database.GetCollection<BsonDocument>("ForeignAvatar");
-			foreach (var account in P("ForeignAvatar").Where(a => IsSet(a, "DeletionAt") || IsSet(a, "ForgottenAt")))
-				await foreign.ReplaceOneAsync(Id(account["_id"]), account, cancellationToken: token);
+			foreach (var account in P("ForeignAvatar"))
+			{
+				if (IsSet(account, "DeletionAt") || IsSet(account, "ForgottenAt"))
+				{
+					await foreign.ReplaceOneAsync(Id(account["_id"]), account, cancellationToken: token);
+					continue;
+				}
+				var moderated = new[] { "SilencedAt", "SuspendedAt", "ModerationNote" }.Where(field => IsSet(account, field)).ToArray();
+				if (moderated.Length > 0 && (await foreign.UpdateOneAsync(Id(account["_id"]), Copy(account, moderated), cancellationToken: token)).MatchedCount > 0)
+					report.ProtectiveKept++;
+			}
 
 			await Posts(database, P("Post"), report, token);
 			await Media(database, P("MediaAttachment"), report, token);
+			// what the staff took down stays down, and every post's flags follow the moderation now kept (R6)
+			foreach (var post in P("Post").Where(p => IsSet(p, "ModeratedAt")))
+				await database.GetCollection<BsonDocument>("Post").UpdateOneAsync(
+					new BsonDocument { { "_id", post["_id"] }, { "ModeratedAt", BsonNull.Value } }, Copy(post, "ModeratedAt"), cancellationToken: token);
+			await Domain.Moderation.ModerationFlags.Recompute(database, token);
 
 			// every session ends: a new stamp for each root's tokens, and the personas' OAuth tokens go
 			foreach (var root in await (await roots.FindAsync(FilterDefinition<BsonDocument>.Empty, cancellationToken: token)).ToListAsync(token))

PrivaPub/Infrastructure/Cli/AdminCommands.cs

@@ -19,6 +19,7 @@ namespace PrivaPub.Infrastructure.Cli
 	{
 		const string Usage = """
 			usage: PrivaPub admin promote|demote <root>
+			       PrivaPub admin role <root> <user|moderator|admin>   a login's role; promote and demote are role admin and user
 			       PrivaPub admin create-root <login> [--admin]   the password is read from standard input
 			       PrivaPub admin move-persona <persona> <root>   gives a persona to another login; its Mastodon tokens end
 			       PrivaPub admin delete-root <root>              deletes a login and every persona it still has
@@ -47,7 +48,9 @@ namespace PrivaPub.Infrastructure.Cli
 			switch (args)
 			{
 				case [("promote" or "demote") and var verb, var userName]:
-					return await Promote(services, verb == "promote", userName, output);
+					return await Role(services, userName, verb == "promote" ? RootRole.Admin : RootRole.User, output);
+				case ["role", var userName, var role] when RootUser.TryParseRole(role, out var parsed):
+					return await Role(services, userName, parsed, output);
 				case ["create-root", var login, .. var flags] when flags.All(f => f == "--admin"):
 					return await CreateRoot(services, login, input.ReadLine(), flags.Contains("--admin"), output);
 				case ["move-persona", var persona, var root]:
@@ -194,27 +197,37 @@ namespace PrivaPub.Infrastructure.Cli
 		static Task Log(IServiceProvider services, string action, string kind, string id, string label, string note = default) =>
 			services.GetRequiredService<IModerationLog>().Write(AdminAction.Cli, action, kind, id, label, note: note);
 
-		static async Task<int> Promote(IServiceProvider services, bool promote, string userName, TextWriter output, bool created = false)
+		// The command line is the way back, so it may leave the server without an administrator (the client's route refuses
+		// to); it says so, and `role <root> admin` gives one back.
+		static async Task<int> Role(IServiceProvider services, string userName, RootRole role, TextWriter output, bool created = false)
 		{
 			userName = userName.ToLowerInvariant();
-			var user = await DB.Default.Find<RootUser>().Match(u => u.UserName == userName).ExecuteFirstAsync();
+			var user = await DB.Default.Find<RootUser>().Match(u => u.UserName == userName && u.DeletedAt == null).ExecuteFirstAsync();
 			if (user == default)
 			{
 				Console.Error.WriteLine($"no root user '{userName}'");
 				return 1;
 			}
 
-			user.SetAdmin(promote);
-			await DB.Default.SaveAsync(user);
-			if (promote)
+			var was = user.Role;
+			user.SetRole(role);
+			await DB.Default.Update<RootUser>().MatchID(user.ID).Modify(u => u.Policies, user.Policies).Modify(u => u.UpdatedAt, user.UpdatedAt).ExecuteAsync();
+			if (role == RootRole.Admin)
 				await ServerSetup.Seal(user.ID, default);//an administrator exists: the client's setup is closed
-			if (!created)
-				await Log(services, promote ? AdminActions.RootPromote : AdminActions.RootDemote, AdminTargets.Root, user.ID, userName);
+			if (!created && was != role)
+				await Log(services, role == RootRole.Admin && was == RootRole.User ? AdminActions.RootPromote
+					: role == RootRole.User && was == RootRole.Admin ? AdminActions.RootDemote
+					: AdminActions.RootRole, AdminTargets.Root, user.ID, userName, $"{Name(was)} → {Name(role)}");
 
 			output.WriteLine($"{userName}: {string.Join(", ", user.Policies)}");
+			if (was == RootRole.Admin && role != RootRole.Admin
+				&& !await DB.Default.Find<RootUser>().Match(u => u.DeletedAt == null && !u.IsBanned && u.Policies.Contains(Policies.IsAdmin)).ExecuteAnyAsync())
+				Console.Error.WriteLine("no administrator is left: `PrivaPub admin role <root> admin` makes one");
 			return 0;
 		}
 
+		static string Name(RootRole role) => role switch { RootRole.Admin => "admin", RootRole.Moderator => "moderator", _ => "user" };
+
 		// With sign-up closed, this or the client's setup (while no administrator exists) makes the first root; group invitations
 		// make the rest.
 		static async Task<int> CreateRoot(IServiceProvider services, string login, string password, bool admin, TextWriter output)
@@ -234,7 +247,7 @@ namespace PrivaPub.Infrastructure.Cli
 			}
 			var made = await DB.Default.Find<RootUser>().Match(u => u.UserName == login.ToLowerInvariant()).ExecuteFirstAsync();
 			await Log(services, AdminActions.RootCreate, AdminTargets.Root, made?.ID, login.ToLowerInvariant(), admin ? "administrator" : default);
-			return admin ? await Promote(services, true, login, output, created: true) : await Report(login, output);
+			return admin ? await Role(services, login, RootRole.Admin, output, created: true) : await Report(login, output);
 		}
 
 		static Task<int> Report(string login, TextWriter output)

PrivaPub/Infrastructure/Data/Indexes.cs

@@ -62,6 +62,14 @@ namespace PrivaPub.Infrastructure.Data
 
 			await Unique<ForeignAvatar>(a => a.ActorURI, Builders<ForeignAvatar>.Filter.Gt(a => a.ActorURI, ""), token);
 			await Plain<ForeignAvatar>(token, a => a.PublicKeyId);
+			// the staff's moderation (R6): the moderated accounts, here and elsewhere, and the posts taken down
+			await Plain<ForeignAvatar>(token, a => a.SuspendedAt);
+			await Plain<ForeignAvatar>(token, a => a.SilencedAt);
+			await Plain<Avatar>(token, a => a.SuspendedAt);
+			await Plain<Avatar>(token, a => a.SilencedAt);
+			await DB.Default.Index<Post>().Key(p => p.ModeratedAt, KeyType.Ascending)
+				.Option(o => o.PartialFilterExpression = Builders<Post>.Filter.Type(p => p.ModeratedAt, MongoDB.Bson.BsonType.DateTime))
+				.CreateAsync(token);
 
 			await DB.Default.Index<Follower>()
 				.Key(f => f.LocalActorId, KeyType.Ascending)

PrivaPub/Infrastructure/Data/Migrations/_020_silenced_servers_limit_their_posts.cs

@@ -0,0 +1,13 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Infrastructure.Data.Migrations
+{
+	// Posts carry their author's moderation since completion program R6 (Post.AuthorLimited, AuthorSuspended): the posts
+	// already held from servers silenced before then are limited, as those arriving from now on are, and any account
+	// already silenced or suspended gets the same (Domain/Moderation/ModerationFlags.cs, which a restore runs too)
+	public class _020_silenced_servers_limit_their_posts : IMigration
+	{
+		public async Task UpgradeAsync() =>
+			await Domain.Moderation.ModerationFlags.Recompute(DB.Default.Database(), CancellationToken.None);
+	}
+}