thepraandClaude Opus 5.5
9f68ca3ed0
Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.
Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof
57 lines
2.1 KiB
C#
57 lines
2.1 KiB
C#
using MongoDB.Entities;
|
|
|
|
using PrivaPub.Models.User;
|
|
using PrivaPub.StaticServices;
|
|
|
|
namespace PrivaPub.Services
|
|
{
|
|
public interface IRootRemoval
|
|
{
|
|
Task<bool> Remove(string rootId, CancellationToken token);
|
|
}
|
|
|
|
// Deleting a root deletes everything public it had (owner decision 2026-10-04): each of its personas goes as a persona
|
|
// is deleted (PersonaRemoval: each group it owns, a Delete of the actor to everyone who follows it and everyone it
|
|
// follows, its posts emptied, its name kept reserved and its documents answering 410). The root's sessions end first, so
|
|
// nothing acts as it while it goes, and it keeps only a deleted-{id} name.
|
|
public class RootRemoval : IRootRemoval
|
|
{
|
|
readonly DbEntities _dbEntities;
|
|
readonly IRootSessions _sessions;
|
|
readonly IPersonaRemoval _personas;
|
|
|
|
public RootRemoval(DbEntities dbEntities, IRootSessions sessions, IPersonaRemoval personas)
|
|
{
|
|
_dbEntities = dbEntities;
|
|
_sessions = sessions;
|
|
_personas = personas;
|
|
}
|
|
|
|
public async Task<bool> Remove(string rootId, CancellationToken token)
|
|
{
|
|
var root = await _dbEntities.RootUsers.MatchID(rootId).Match(u => u.DeletedAt == null).ExecuteFirstAsync(token);
|
|
if (root == default)
|
|
return false;
|
|
await _sessions.Revoke(root.ID, token);
|
|
var now = DateTime.UtcNow;
|
|
|
|
var avatarIds = (await _dbEntities.RootToAvatars.Match(ra => ra.RootId == root.ID).ExecuteAsync(token)).Select(ra => ra.AvatarId).ToList();
|
|
foreach (var avatarId in avatarIds)
|
|
await _personas.Remove(avatarId, token);
|
|
|
|
await DB.Default.Update<RootUser>().MatchID(root.ID)
|
|
.Modify(u => u.UserName, $"deleted-{root.ID}")//unique, so a second deletion never collides with the first
|
|
.Modify(u => u.Email, null)
|
|
.Modify(u => u.HashedPassword, null)
|
|
.Modify(u => u.Policies, new List<string>())
|
|
.Modify(u => u.IsBanned, false)
|
|
.Modify(u => u.IsEmailValidated, false)
|
|
.Modify(u => u.DeletedAt, now)
|
|
.ExecuteAsync(token);
|
|
await DB.Default.DeleteAsync<EmailRecovery>(r => r.RootUserId == root.ID);
|
|
await Domain.Moderation.Restrictions.Reload(CancellationToken.None);
|
|
return true;
|
|
}
|
|
}
|
|
}
|