thepraandClaude Opus 5.5
9f68ca3ed0
Roles (user, moderator, administrator) from the CLI and /clientapi/admin/roots/{id}/role, never one's own nor the last
administrator. Silence keeps an account's posts out of public timelines, hashtags, trends, search and relays while its
followers still get them; suspension refuses and revokes a local persona's tokens, answers 404 for its posts and
collections, holds back every delivery and tells other servers nothing new, its actor unchanged; a suspended remote
account's activities are dropped and nothing goes to its own inbox (a shared one still serves its server). A banned
login's personas are held back in memory alone (Restrictions), so nothing pairs them in stored data. Personas and groups
are deleted one at a time (PersonaRemoval, GroupRemoval), by their login or an administrator with the password. Reports
resolve with an action and a note; posts are taken down, a remote copy hidden. Warnings reach the persona as Mastodon's
moderation_warning. Every staff act goes to the staff's log. Migration _020 limits posts from servers already silenced;
a restore keeps the moderation made since the backup.
Verified: interop.sh moderation gts mastodon with SecureMode, 194 passed; restore.sh, 25 passed, now with a suspension,
a silence and a takedown made after the backup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof
89 lines
4.6 KiB
C#
89 lines
4.6 KiB
C#
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.Extensions.Localization;
|
|
|
|
using PrivaPub.ClientModels;
|
|
using PrivaPub.ClientModels.Group;
|
|
using PrivaPub.Extensions;
|
|
using PrivaPub.Resources;
|
|
using PrivaPub.Services;
|
|
|
|
namespace PrivaPub.Controllers.ClientToServer
|
|
{
|
|
[ApiController,
|
|
Route("clientapi/group"),
|
|
Authorize(Policy = Policies.IsUser)]
|
|
public class GroupController : ControllerBase
|
|
{
|
|
readonly IGroupUsersService _groupUsersService;
|
|
readonly IStringLocalizer _localizer;
|
|
|
|
public GroupController(IGroupUsersService groupUsersService, IStringLocalizer<GenericRes> localizer)
|
|
{
|
|
_groupUsersService = groupUsersService;
|
|
_localizer = localizer;
|
|
}
|
|
|
|
[HttpGet, Route("/clientapi/group/list")]
|
|
public async Task<IActionResult> List([FromQuery] string avatarId, CancellationToken token) =>
|
|
Answer(await _groupUsersService.GetGroups(User.GetUserId(), avatarId, token));
|
|
|
|
[HttpPost, Route("/clientapi/group/insert")]
|
|
public async Task<IActionResult> Insert(InsertGroupForm form, CancellationToken token) =>
|
|
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.InsertGroup(User.GetUserId(), form, token));
|
|
|
|
[HttpPost, Route("/clientapi/group/update")]
|
|
public async Task<IActionResult> Update(UpdateGroupForm form, CancellationToken token) =>
|
|
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.UpdateGroup(User.GetUserId(), form, token));
|
|
|
|
[HttpPost, Route("/clientapi/group/join")]
|
|
public async Task<IActionResult> Join(JoinGroupForm form, CancellationToken token) =>
|
|
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.JoinGroup(User.GetUserId(), form, token));
|
|
|
|
[HttpPost, Route("/clientapi/group/leave")]
|
|
public async Task<IActionResult> Leave(GroupMembershipForm form, CancellationToken token) =>
|
|
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.LeaveGroup(User.GetUserId(), form, token));
|
|
|
|
[HttpPost, Route("/clientapi/group/approve")]
|
|
public async Task<IActionResult> Approve(GroupMembershipForm form, CancellationToken token) =>
|
|
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.ApproveMember(User.GetUserId(), form, token));
|
|
|
|
[HttpGet, Route("/clientapi/group/members")]
|
|
public async Task<IActionResult> Members([FromQuery] string avatarId, [FromQuery] string groupId, CancellationToken token) =>
|
|
Answer(await _groupUsersService.GetMembers(User.GetUserId(), avatarId, groupId, token));
|
|
|
|
[HttpPost, Route("/clientapi/group/reject")]
|
|
public async Task<IActionResult> Reject(GroupMembershipForm form, CancellationToken token) =>
|
|
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.RejectMember(User.GetUserId(), form, token));
|
|
|
|
[HttpPost, Route("/clientapi/group/remove")]
|
|
public async Task<IActionResult> Remove(GroupMembershipForm form, CancellationToken token) =>
|
|
!ModelState.IsValid ? Invalid() : Answer(await _groupUsersService.RemoveMember(User.GetUserId(), form, token));
|
|
|
|
// the group's owner deletes it, with the login's password (R6): its members and followers are told, its name stays
|
|
// taken (GroupRemoval)
|
|
[HttpPost, Route("/clientapi/group/delete"), Microsoft.AspNetCore.RateLimiting.EnableRateLimiting(Infrastructure.RateLimiting.Accounts)]
|
|
public async Task<IActionResult> Delete(DeleteGroupForm form, [FromServices] IRootUsersService users, [FromServices] IGroupRemoval groups,
|
|
[FromServices] StaticServices.DbEntities dbEntities, CancellationToken token)
|
|
{
|
|
if (!ModelState.IsValid)
|
|
return Invalid();
|
|
var rootId = User.GetUserId();
|
|
if (!await users.PasswordMatches(rootId, form.Password))
|
|
return StatusCode(StatusCodes.Status403Forbidden, new WebResult().Invalidate(_localizer[RootUsersService.NoMatch], StatusCodes.Status403Forbidden));
|
|
var owns = await dbEntities.RootToAvatars.Match(ra => ra.RootId == rootId && ra.AvatarId == form.AvatarId).ExecuteAnyAsync(token);
|
|
var group = owns ? await dbEntities.Groups.MatchID(form.GroupId).Match(g => !g.DeletionAt.HasValue).ExecuteFirstAsync(token) : default;
|
|
if (group == default)
|
|
return NotFound(new WebResult().Invalidate(_localizer["Group not found."], StatusCodes.Status404NotFound));
|
|
if (group.OwnerAvatarId != form.AvatarId)
|
|
return StatusCode(StatusCodes.Status403Forbidden, new WebResult().Invalidate(_localizer["Only the group's owner can delete it."], StatusCodes.Status403Forbidden));
|
|
await groups.Remove(group.ID, CancellationToken.None);
|
|
return Ok();
|
|
}
|
|
|
|
IActionResult Invalid() => BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
|
|
|
|
IActionResult Answer(WebResult result) => result.IsValid ? Ok(result.Data) : StatusCode(result.StatusCode, result);
|
|
}
|
|
}
|