docs: add block/mute user relations, emoji-sync CLI, and uid indexes

- Add `/block`, `/mute` endpoints with block/unblock and mute/unmute functionality in `routers/relations.py`, hiding blocked users' content everywhere except their own profile while muting only suppresses notifications
- Introduce `devplace emoji-sync` CLI command to regenerate `static/js/emoji-shortcodes.js` from the emoji library, documented in `CLAUDE.md` and wired in `cli.py`
- Create `get_blocked_uids()` database helper and apply it in `content.py` `load_detail()` to filter blocked users' posts from detail views
- Implement `_uid_index()` and `_drop_index()` helpers in `database.py` for unique uid indexes across tables, with `user_relations` added to `SOFT_DELETE_TABLES`
- Document new routes in `AGENTS.md` and `README.md`, including emoji shortcodes rendering behavior distinct from the emoji picker

tests/api/admin/aiusage/index.py

@@ -18,7 +18,7 @@ def _admin_aiusage(seeded_db):
 
 def test_admin_ai_usage_page_requires_admin(app_server):
     r = requests.get(f"{BASE_URL}/admin/ai-usage", allow_redirects=False)
-    assert r.status_code in (302, 401, 403)
+    assert r.status_code in (302, 303, 401, 403)
 
 
 def test_admin_ai_usage_page_returns_html(app_server, seeded_db):

tests/api/admin/backups/download.py

@@ -4,7 +4,12 @@ import time
 import requests
 from tests.conftest import BASE_URL
 from devplacepy import config
-from devplacepy.database import get_table, get_primary_admin_uid, refresh_snapshot
+from devplacepy.database import (
+    get_table,
+    get_primary_admin_uid,
+    invalidate_admins_cache,
+    refresh_snapshot,
+)
 from devplacepy.services.backup import store
 from devplacepy.utils import clear_user_cache
 
@@ -33,6 +38,7 @@ def _make_admin():
     row = _signup()
     get_table("users").update({"uid": row["uid"], "role": "Admin"}, ["uid"])
     clear_user_cache(row["uid"])
+    invalidate_admins_cache()
     return row["api_key"]
 
 

tests/api/block/index.py

@@ -0,0 +1,118 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"blk{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def _key(name):
+    return get_table("users").find_one(username=name)["api_key"]
+
+
+def _relation(actor_uid, target_uid, kind):
+    return get_table("user_relations").count(
+        user_uid=actor_uid, target_uid=target_uid, kind=kind, deleted_at=None
+    )
+
+
+def test_block_creates_relation(app_server):
+    blocker_session, blocker = _signup()
+    _, target = _signup()
+    r = blocker_session.post(
+        f"{BASE_URL}/block/{target}", allow_redirects=False
+    )
+    assert r.status_code in (302, 200)
+    assert _relation(_uid(blocker), _uid(target), "block") == 1
+
+
+def test_block_via_api_key_header(app_server):
+    blocker_session, blocker = _signup()
+    _, target = _signup()
+    r = requests.post(
+        f"{BASE_URL}/block/{target}",
+        headers={"X-API-KEY": _key(blocker)},
+        allow_redirects=False,
+    )
+    assert r.status_code in (302, 200)
+    assert _relation(_uid(blocker), _uid(target), "block") == 1
+
+
+def test_block_is_idempotent(app_server):
+    blocker_session, blocker = _signup()
+    _, target = _signup()
+    blocker_session.post(f"{BASE_URL}/block/{target}", allow_redirects=False)
+    blocker_session.post(f"{BASE_URL}/block/{target}", allow_redirects=False)
+    assert _relation(_uid(blocker), _uid(target), "block") == 1
+
+
+def test_self_block_rejected(app_server):
+    blocker_session, blocker = _signup()
+    blocker_session.post(f"{BASE_URL}/block/{blocker}", allow_redirects=False)
+    assert _relation(_uid(blocker), _uid(blocker), "block") == 0
+
+
+def test_block_nonexistent_user_redirects(app_server):
+    blocker_session, _ = _signup()
+    r = blocker_session.post(
+        f"{BASE_URL}/block/no_such_user_zzz", allow_redirects=False
+    )
+    assert r.status_code == 302
+
+
+def test_block_no_credentials_redirects(app_server):
+    _, target = _signup()
+    r = requests.post(f"{BASE_URL}/block/{target}", allow_redirects=False)
+    assert r.status_code == 303
+
+
+def test_block_invalid_api_key_returns_401(app_server):
+    _, target = _signup()
+    r = requests.post(
+        f"{BASE_URL}/block/{target}",
+        headers={"X-API-KEY": "not-a-real-key"},
+        allow_redirects=False,
+    )
+    assert r.status_code == 401
+
+
+def test_block_recorded_in_audit(seeded_db):
+    blocker_session, blocker = _signup()
+    blocker_session.post(
+        f"{BASE_URL}/block/bob_test", headers=JSON, allow_redirects=False
+    )
+    admin = requests.Session()
+    admin.headers.update({"X-API-KEY": _key("alice_test")})
+    data = admin.get(
+        f"{BASE_URL}/admin/audit-log",
+        headers=JSON,
+        params={"event_key": "relation.block"},
+    ).json()
+    assert any(
+        e.get("target_label") == "bob_test" and blocker in (e.get("summary") or "")
+        for e in data["entries"]
+    )

tests/api/block/unblock.py

@@ -0,0 +1,71 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"unblk{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def _active_blocks(actor_uid, target_uid):
+    return get_table("user_relations").count(
+        user_uid=actor_uid, target_uid=target_uid, kind="block", deleted_at=None
+    )
+
+
+def test_unblock_reverses_block(app_server):
+    blocker_session, blocker = _signup()
+    _, target = _signup()
+    blocker_session.post(f"{BASE_URL}/block/{target}", allow_redirects=False)
+    assert _active_blocks(_uid(blocker), _uid(target)) == 1
+
+    r = blocker_session.post(
+        f"{BASE_URL}/block/unblock/{target}", allow_redirects=False
+    )
+    assert r.status_code in (302, 200)
+    assert _active_blocks(_uid(blocker), _uid(target)) == 0
+
+
+def test_unblock_then_reblock_revives_one_row(app_server):
+    blocker_session, blocker = _signup()
+    _, target = _signup()
+    blocker_session.post(f"{BASE_URL}/block/{target}", allow_redirects=False)
+    blocker_session.post(f"{BASE_URL}/block/unblock/{target}", allow_redirects=False)
+    blocker_session.post(f"{BASE_URL}/block/{target}", allow_redirects=False)
+
+    assert _active_blocks(_uid(blocker), _uid(target)) == 1
+    total = get_table("user_relations").count(
+        user_uid=_uid(blocker), target_uid=_uid(target), kind="block"
+    )
+    assert total == 1
+
+
+def test_unblock_when_not_blocked_is_noop(app_server):
+    blocker_session, _ = _signup()
+    _, target = _signup()
+    r = blocker_session.post(
+        f"{BASE_URL}/block/unblock/{target}", allow_redirects=False
+    )
+    assert r.status_code in (302, 200)

tests/api/block/visibility.py

@@ -0,0 +1,206 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+from uuid import uuid4
+from datetime import datetime, timezone
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+from devplacepy.utils import make_combined_slug
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"blkvis{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def _new_post(session, content="blocked author post body"):
+    return session.post(
+        f"{BASE_URL}/posts/create",
+        headers=JSON,
+        data={"title": f"blkpost{uuid4().hex[:8]}", "content": content, "topic": "devlog"},
+    ).json()["data"]
+
+
+def _new_project(session):
+    return session.post(
+        f"{BASE_URL}/projects/create",
+        headers=JSON,
+        data={
+            "title": f"blkproj{uuid4().hex[:8]}",
+            "description": "blocked author project description",
+            "project_type": "software",
+            "status": "In Development",
+            "platforms": "",
+        },
+    ).json()["data"]
+
+
+def _new_gist(session):
+    return session.post(
+        f"{BASE_URL}/gists/create",
+        headers=JSON,
+        data={
+            "title": f"blkgist{uuid4().hex[:8]}",
+            "description": "blocked author gist",
+            "source_code": "print('x')",
+            "language": "python",
+        },
+    ).json()["data"]
+
+
+def test_blocked_author_post_hidden_from_feed(app_server):
+    blocker_session, blocker = _signup()
+    author_session, author = _signup()
+    post = _new_post(author_session)
+
+    before = blocker_session.get(f"{BASE_URL}/feed", headers=JSON).json()
+    assert post["uid"] in [i["post"]["uid"] for i in before["posts"]]
+
+    blocker_session.post(f"{BASE_URL}/block/{author}", allow_redirects=False)
+
+    after = blocker_session.get(f"{BASE_URL}/feed", headers=JSON).json()
+    assert post["uid"] not in [i["post"]["uid"] for i in after["posts"]]
+
+
+def test_blocked_author_gist_hidden_from_listing(app_server):
+    blocker_session, blocker = _signup()
+    author_session, author = _signup()
+    gist = _new_gist(author_session)
+    blocker_session.post(f"{BASE_URL}/block/{author}", allow_redirects=False)
+
+    data = blocker_session.get(f"{BASE_URL}/gists", headers=JSON).json()
+    assert gist["uid"] not in [i["gist"]["uid"] for i in data["gists"]]
+
+
+def test_blocked_author_project_hidden_from_listing(app_server):
+    blocker_session, blocker = _signup()
+    author_session, author = _signup()
+    project = _new_project(author_session)
+    blocker_session.post(f"{BASE_URL}/block/{author}", allow_redirects=False)
+
+    data = blocker_session.get(f"{BASE_URL}/projects", headers=JSON).json()
+    assert project["uid"] not in [i["uid"] for i in data["projects"]]
+
+
+def test_blocked_author_post_detail_404(app_server):
+    blocker_session, blocker = _signup()
+    author_session, author = _signup()
+    post = _new_post(author_session)
+    blocker_session.post(f"{BASE_URL}/block/{author}", allow_redirects=False)
+
+    r = blocker_session.get(f"{BASE_URL}/posts/{post['slug']}")
+    assert r.status_code == 404
+
+
+def test_blocked_author_comment_hidden_on_detail(app_server):
+    blocker_session, blocker = _signup()
+    host_session, host = _signup()
+    commenter_session, commenter = _signup()
+    post = _new_post(host_session)
+
+    commenter_session.post(
+        f"{BASE_URL}/comments/create",
+        headers=JSON,
+        data={
+            "target_type": "post",
+            "target_uid": post["uid"],
+            "content": "comment from a blocked user",
+        },
+    )
+
+    detail = blocker_session.get(
+        f"{BASE_URL}/posts/{post['slug']}", headers=JSON
+    ).json()
+    assert any(
+        c["comment"]["content"] == "comment from a blocked user"
+        for c in detail["comments"]
+    )
+
+    blocker_session.post(f"{BASE_URL}/block/{commenter}", allow_redirects=False)
+
+    detail2 = blocker_session.get(
+        f"{BASE_URL}/posts/{post['slug']}", headers=JSON
+    ).json()
+    assert not any(
+        c["comment"]["content"] == "comment from a blocked user"
+        for c in detail2["comments"]
+    )
+
+
+def test_blocked_user_cannot_send_dm(app_server):
+    blocker_session, blocker = _signup()
+    sender_session, sender = _signup()
+    blocker_session.post(f"{BASE_URL}/block/{sender}", allow_redirects=False)
+
+    sender_session.post(
+        f"{BASE_URL}/messages/send",
+        headers=JSON,
+        data={"receiver_uid": _uid(blocker), "content": "you blocked me"},
+        allow_redirects=False,
+    )
+
+    assert (
+        get_table("messages").count(
+            sender_uid=_uid(sender), receiver_uid=_uid(blocker)
+        )
+        == 0
+    )
+
+
+def test_block_suppresses_notifications(app_server):
+    blocker_session, blocker = _signup()
+    actor_session, actor = _signup()
+    blocker_session.post(f"{BASE_URL}/block/{actor}", allow_redirects=False)
+
+    actor_session.post(f"{BASE_URL}/follow/{blocker}", allow_redirects=False)
+
+    assert (
+        get_table("notifications").count(
+            user_uid=_uid(blocker), related_uid=_uid(actor), type="follow"
+        )
+        == 0
+    )
+
+
+def test_profile_json_reports_is_blocked(app_server):
+    blocker_session, blocker = _signup()
+    _, target = _signup()
+    blocker_session.post(f"{BASE_URL}/block/{target}", allow_redirects=False)
+
+    data = blocker_session.get(
+        f"{BASE_URL}/profile/{target}", headers=JSON
+    ).json()
+    assert data["is_blocked"] is True
+    assert data["is_muted"] is False
+
+
+def test_blocked_user_profile_still_shows_their_posts(app_server):
+    blocker_session, blocker = _signup()
+    author_session, author = _signup()
+    post = _new_post(author_session, content="visible on my own profile")
+    blocker_session.post(f"{BASE_URL}/block/{author}", allow_redirects=False)
+
+    data = blocker_session.get(
+        f"{BASE_URL}/profile/{author}", headers=JSON
+    ).json()
+    assert post["uid"] in [p["post"]["uid"] for p in data["posts"]]

tests/api/dbapi/conftest.py

@@ -5,7 +5,7 @@ from datetime import datetime, timezone
 import pytest
 from fastapi.testclient import TestClient
 
-from devplacepy.database import get_table, internal_gateway_key, purge, refresh_snapshot
+from devplacepy.database import get_table, purge, refresh_snapshot
 from devplacepy.main import app
 from devplacepy.services.manager import service_manager
 from devplacepy.utils import generate_uid
@@ -55,4 +55,32 @@ def client():
 
 @pytest.fixture
 def auth(client):
-    return {"X-API-KEY": internal_gateway_key()}
+    from devplacepy.database import get_primary_admin_uid, invalidate_admins_cache
+    from devplacepy.utils import clear_user_cache
+
+    users = get_table("users")
+    uid = get_primary_admin_uid()
+    if uid is None:
+        uid = generate_uid()
+        users.insert(
+            {
+                "uid": uid,
+                "username": f"dbapi_admin_{uid[:8]}",
+                "email": f"{uid[:8]}@dbapi.test",
+                "role": "Admin",
+                "api_key": f"dbapikey_{uid}",
+                "xp": 0,
+                "level": 1,
+                "created_at": datetime.now(timezone.utc).isoformat(),
+            }
+        )
+        invalidate_admins_cache()
+        refresh_snapshot()
+    admin = users.find_one(uid=uid)
+    key = admin.get("api_key")
+    if not key:
+        key = f"dbapikey_{uid}"
+        users.update({"uid": uid, "api_key": key}, ["uid"])
+        clear_user_cache(uid)
+        refresh_snapshot()
+    return {"X-API-KEY": key}

tests/api/feed.py

@@ -386,3 +386,17 @@ def test_x_frame_options_header(app_server):
 def test_x_frame_options_excluded_for_ingress_proxy(app_server):
     r = requests.get(f"{BASE_URL}/p/nonexistent-instance", allow_redirects=False)
     assert "X-Frame-Options" not in r.headers
+
+
+def test_content_security_policy_header(app_server):
+    r = requests.get(f"{BASE_URL}/feed", allow_redirects=True)
+    csp = r.headers.get("Content-Security-Policy", "")
+    assert "object-src 'none'" in csp
+    assert "base-uri 'self'" in csp
+    assert "frame-ancestors 'none'" in csp
+    assert "form-action 'self'" in csp
+
+
+def test_content_security_policy_excluded_for_ingress_proxy(app_server):
+    r = requests.get(f"{BASE_URL}/p/nonexistent-instance", allow_redirects=False)
+    assert "Content-Security-Policy" not in r.headers

tests/api/mute/index.py

@@ -0,0 +1,128 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+from uuid import uuid4
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"mut{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def _key(name):
+    return get_table("users").find_one(username=name)["api_key"]
+
+
+def _relation(actor_uid, target_uid, kind):
+    return get_table("user_relations").count(
+        user_uid=actor_uid, target_uid=target_uid, kind=kind, deleted_at=None
+    )
+
+
+def _new_post(session):
+    return session.post(
+        f"{BASE_URL}/posts/create",
+        headers=JSON,
+        data={
+            "title": f"mutpost{uuid4().hex[:8]}",
+            "content": "muted author still visible post",
+            "topic": "devlog",
+        },
+    ).json()["data"]
+
+
+def test_mute_creates_relation(app_server):
+    muter_session, muter = _signup()
+    _, target = _signup()
+    r = muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+    assert r.status_code in (302, 200)
+    assert _relation(_uid(muter), _uid(target), "mute") == 1
+
+
+def test_mute_is_idempotent(app_server):
+    muter_session, muter = _signup()
+    _, target = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+    muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+    assert _relation(_uid(muter), _uid(target), "mute") == 1
+
+
+def test_self_mute_rejected(app_server):
+    muter_session, muter = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{muter}", allow_redirects=False)
+    assert _relation(_uid(muter), _uid(muter), "mute") == 0
+
+
+def test_mute_recorded_in_audit(seeded_db):
+    muter_session, muter = _signup()
+    muter_session.post(
+        f"{BASE_URL}/mute/bob_test", headers=JSON, allow_redirects=False
+    )
+    admin = requests.Session()
+    admin.headers.update({"X-API-KEY": _key("alice_test")})
+    data = admin.get(
+        f"{BASE_URL}/admin/audit-log",
+        headers=JSON,
+        params={"event_key": "relation.mute"},
+    ).json()
+    assert any(
+        e.get("target_label") == "bob_test" and muter in (e.get("summary") or "")
+        for e in data["entries"]
+    )
+
+
+def test_muted_user_notifications_suppressed(app_server):
+    muter_session, muter = _signup()
+    actor_session, actor = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{actor}", allow_redirects=False)
+
+    actor_session.post(f"{BASE_URL}/follow/{muter}", allow_redirects=False)
+
+    assert (
+        get_table("notifications").count(
+            user_uid=_uid(muter), related_uid=_uid(actor), type="follow"
+        )
+        == 0
+    )
+
+
+def test_muted_user_content_still_visible(app_server):
+    muter_session, muter = _signup()
+    author_session, author = _signup()
+    post = _new_post(author_session)
+    muter_session.post(f"{BASE_URL}/mute/{author}", allow_redirects=False)
+
+    feed = muter_session.get(f"{BASE_URL}/feed", headers=JSON).json()
+    assert post["uid"] in [i["post"]["uid"] for i in feed["posts"]]
+
+
+def test_profile_json_reports_is_muted(app_server):
+    muter_session, muter = _signup()
+    _, target = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+
+    data = muter_session.get(f"{BASE_URL}/profile/{target}", headers=JSON).json()
+    assert data["is_muted"] is True
+    assert data["is_blocked"] is False

tests/api/mute/unmute.py

@@ -0,0 +1,65 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _signup():
+    _counter[0] += 1
+    name = f"unmut{int(time.time() * 1000)}{_counter[0]}"
+    session = requests.Session()
+    session.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return session, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def _active_mutes(actor_uid, target_uid):
+    return get_table("user_relations").count(
+        user_uid=actor_uid, target_uid=target_uid, kind="mute", deleted_at=None
+    )
+
+
+def test_unmute_reverses_mute(app_server):
+    muter_session, muter = _signup()
+    _, target = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{target}", allow_redirects=False)
+    assert _active_mutes(_uid(muter), _uid(target)) == 1
+
+    r = muter_session.post(
+        f"{BASE_URL}/mute/unmute/{target}", allow_redirects=False
+    )
+    assert r.status_code in (302, 200)
+    assert _active_mutes(_uid(muter), _uid(target)) == 0
+
+
+def test_unmute_restores_notifications(app_server):
+    muter_session, muter = _signup()
+    actor_session, actor = _signup()
+    muter_session.post(f"{BASE_URL}/mute/{actor}", allow_redirects=False)
+    muter_session.post(f"{BASE_URL}/mute/unmute/{actor}", allow_redirects=False)
+
+    actor_session.post(f"{BASE_URL}/follow/{muter}", allow_redirects=False)
+
+    assert (
+        get_table("notifications").count(
+            user_uid=_uid(muter), related_uid=_uid(actor), type="follow"
+        )
+        == 1
+    )

tests/api/project/visibility.py

@@ -4,7 +4,7 @@ import time
 import pytest
 import requests
 from tests.conftest import BASE_URL
-from devplacepy.database import get_table
+from devplacepy.database import get_table, invalidate_admins_cache
 from devplacepy.utils import clear_user_cache
 from devplacepy import project_files
 from devplacepy.project_files import ProjectFileError
@@ -33,7 +33,18 @@ def _make_admin_project_visibility():
     name, uid, key = _signup_project_visibility()
     get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
     clear_user_cache(uid)
+    invalidate_admins_cache()
     return name, uid, key
+
+
+def _eventually(predicate, *, attempts=25, delay=0.15):
+    result = predicate()
+    for _ in range(attempts):
+        if result:
+            return result
+        time.sleep(delay)
+        result = predicate()
+    return result
 def _h_project_visibility(key=None):
     headers = {"Accept": "application/json"}
     if key:
@@ -117,9 +128,13 @@ def test_admin_private_hidden_from_other_admin(app_server):
     slug = _create_project_project_visibility(
         owner_key, "Admin Hidden", is_private=True
     )["slug"]
-    assert slug not in _list_slugs(key=other_admin_key, user_uid=owner_uid)
-    assert _detail_status(other_admin_key, slug) == 404
-    assert _file_raw_status(other_admin_key, slug, "missing.txt") == 404
+    assert _eventually(
+        lambda: slug not in _list_slugs(key=other_admin_key, user_uid=owner_uid)
+    )
+    assert _eventually(lambda: _detail_status(other_admin_key, slug) == 404)
+    assert _eventually(
+        lambda: _file_raw_status(other_admin_key, slug, "missing.txt") == 404
+    )
     assert slug in _list_slugs(key=owner_key, user_uid=owner_uid)
     assert _detail_status(owner_key, slug) == 200
 

tests/e2e/admin/backups/index.py

@@ -4,7 +4,12 @@ import time
 import requests
 from tests.conftest import BASE_URL, login_user
 from devplacepy import config
-from devplacepy.database import get_table, get_primary_admin_uid, refresh_snapshot
+from devplacepy.database import (
+    get_table,
+    get_primary_admin_uid,
+    invalidate_admins_cache,
+    refresh_snapshot,
+)
 from devplacepy.services.backup import store
 from devplacepy.utils import clear_user_cache
 
@@ -29,6 +34,7 @@ def _make_admin():
     row = get_table("users").find_one(username=name)
     get_table("users").update({"uid": row["uid"], "role": "Admin"}, ["uid"])
     clear_user_cache(row["uid"])
+    invalidate_admins_cache()
     return {"email": f"{name}@t.dev", "password": password, "uid": row["uid"]}
 
 
@@ -84,15 +90,20 @@ def test_download_enabled_for_primary_admin(page, app_server):
     for uid in others:
         get_table("users").update({"uid": uid, "role": "Member"}, ["uid"])
         clear_user_cache(uid)
+    invalidate_admins_cache()
     try:
         assert get_primary_admin_uid() == admin["uid"]
         backup_uid = _seed_done_backup(admin["uid"])
         login_user(page, admin)
-        page.goto(f"{BASE_URL}/admin/backups", wait_until="domcontentloaded")
-        row = _row(page, backup_uid)
-        row.wait_for(state="visible", timeout=15000)
-
-        link = row.locator("a.admin-btn:has-text('Download')")
+        link = None
+        for _ in range(20):
+            page.goto(f"{BASE_URL}/admin/backups", wait_until="domcontentloaded")
+            row = _row(page, backup_uid)
+            row.wait_for(state="visible", timeout=15000)
+            link = row.locator("a.admin-btn:has-text('Download')")
+            if link.count() > 0:
+                break
+            time.sleep(0.3)
         link.wait_for(state="visible")
         assert link.get_attribute("href") == f"/admin/backups/{backup_uid}/download"
         assert row.locator("button.admin-btn[title='Not available']").count() == 0

tests/e2e/feed.py

@@ -503,10 +503,9 @@ def test_feed_tab_switching(alice):
 def test_feed_topic_filter_sidebar(alice):
     page, user = alice
     page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
-    page.locator(".sidebar-more .sidebar-more-toggle").click()
     topics = ["Devlog", "Showcase", "Question", "Rant", "Fun"]
     for topic in topics:
-        link = page.locator(f"a:has-text('{topic}')").first
+        link = page.locator(f".sidebar-nav a:has-text('{topic}')").first
         assert link.is_visible()
 
 
@@ -689,8 +688,7 @@ def test_feed_guest_reply_disabled(page, app_server):
 def test_feed_signals_topic(alice):
     page, _ = alice
     page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
-    page.locator(".sidebar-more .sidebar-more-toggle").click()
-    signals_link = page.locator("a:has-text('Signals')")
+    signals_link = page.locator(".sidebar-nav a:has-text('Signals')")
     assert signals_link.is_visible()
 
 

tests/e2e/messages.py

@@ -1,6 +1,8 @@
 # retoor <retoor@molodetz.nl>
 
+import re
 import time
+from playwright.sync_api import expect
 from tests.conftest import BASE_URL
 from devplacepy.database import get_table
 import requests
@@ -211,6 +213,49 @@ def test_messages_search_for_bob(alice):
     assert result.is_visible()
 
 
+def test_messages_search_first_result_highlighted(alice):
+    page, _ = alice
+    page.goto(f"{BASE_URL}/messages", wait_until="domcontentloaded")
+    page.fill("#message-search", "bob_test")
+    result = page.locator(".search-dropdown-item:has-text('bob_test')")
+    result.wait_for(state="visible", timeout=5000)
+    expect(result.first).to_have_class(re.compile(r"\bactive\b"))
+
+
+def test_messages_search_enter_opens_conversation(alice):
+    page, _ = alice
+    page.goto(f"{BASE_URL}/messages", wait_until="domcontentloaded")
+    page.fill("#message-search", "bob_test")
+    page.locator(".search-dropdown-item:has-text('bob_test')").wait_for(
+        state="visible", timeout=5000
+    )
+    page.locator("#message-search").press("Enter")
+    page.wait_for_url(re.compile(r"with_uid="), wait_until="domcontentloaded")
+
+
+def test_messages_search_arrow_then_enter_opens_conversation(alice):
+    page, _ = alice
+    page.goto(f"{BASE_URL}/messages", wait_until="domcontentloaded")
+    page.fill("#message-search", "bob_test")
+    page.locator(".search-dropdown-item:has-text('bob_test')").wait_for(
+        state="visible", timeout=5000
+    )
+    search = page.locator("#message-search")
+    search.press("ArrowDown")
+    search.press("Enter")
+    page.wait_for_url(re.compile(r"with_uid="), wait_until="domcontentloaded")
+
+
+def test_messages_search_escape_closes_dropdown(alice):
+    page, _ = alice
+    page.goto(f"{BASE_URL}/messages", wait_until="domcontentloaded")
+    page.fill("#message-search", "bob_test")
+    result = page.locator(".search-dropdown-item:has-text('bob_test')")
+    result.wait_for(state="visible", timeout=5000)
+    page.locator("#message-search").press("Escape")
+    expect(result).to_be_hidden()
+
+
 def test_messages_header_visible(alice):
     page, _ = alice
     page.goto(f"{BASE_URL}/messages", wait_until="domcontentloaded")

tests/e2e/news.py

@@ -195,6 +195,7 @@ def _seed_news_image(news_uid):
             "deleted_by": None,
             "news_uid": news_uid,
             "url": "https://example.com/seo-news-image.jpg",
+            "is_placeholder": 0,
         }
     )
 def _seed_feed_posts(count):

tests/e2e/post.py

@@ -124,11 +124,64 @@ def test_comment_voted_state_persists(alice):
     )
 
 
+def test_mention_first_match_highlighted(alice):
+    page, _ = alice
+    create_post(page, "random", "Mention highlight test post")
+    textarea = page.locator(".comment-form textarea[name='content']").first
+    textarea.wait_for(state="visible", timeout=10000)
+    textarea.fill("@bob")
+    item = page.locator(".mention-dropdown-item:has-text('bob_test')").first
+    item.wait_for(state="visible", timeout=5000)
+    expect(item).to_have_class(re.compile(r"\bactive\b"))
+
+
+def test_mention_tab_inserts_first_match(alice):
+    page, _ = alice
+    create_post(page, "random", "Mention tab insert test post")
+    textarea = page.locator(".comment-form textarea[name='content']").first
+    textarea.wait_for(state="visible", timeout=10000)
+    textarea.fill("@bob")
+    page.locator(".mention-dropdown-item:has-text('bob_test')").first.wait_for(
+        state="visible", timeout=5000
+    )
+    textarea.press("Tab")
+    expect(textarea).to_have_value(re.compile(r"^@bob_test\s"))
+
+
+def test_mention_arrow_then_enter_inserts(alice):
+    page, _ = alice
+    create_post(page, "random", "Mention arrow nav test post")
+    textarea = page.locator(".comment-form textarea[name='content']").first
+    textarea.wait_for(state="visible", timeout=10000)
+    textarea.fill("@bob")
+    page.locator(".mention-dropdown-item:has-text('bob_test')").first.wait_for(
+        state="visible", timeout=5000
+    )
+    textarea.press("ArrowDown")
+    textarea.press("Enter")
+    expect(textarea).to_have_value(re.compile(r"@bob_test\s"))
+
+
+def test_mention_escape_closes_dropdown(alice):
+    page, _ = alice
+    create_post(page, "random", "Mention escape test post")
+    textarea = page.locator(".comment-form textarea[name='content']").first
+    textarea.wait_for(state="visible", timeout=10000)
+    textarea.fill("@bob")
+    item = page.locator(".mention-dropdown-item:has-text('bob_test')").first
+    item.wait_for(state="visible", timeout=5000)
+    textarea.press("Escape")
+    expect(item).to_be_hidden()
+
+
 def test_profile_stars_reflect_content_votes(alice):
     page, user = alice
     before = _profile_stars(page, user["username"])
     create_post(page, "devlog", "Reputation contribution post")
-    page.locator(".post-action-btn.vote-up").first.click()
+    with page.expect_response(
+        lambda r: "/votes/" in r.url and r.request.method == "POST"
+    ):
+        page.locator(".post-action-btn.vote-up").first.click()
     expect(page.locator(".post-vote-count").first).to_have_text("1")
     after = _profile_stars(page, user["username"])
     assert after == before + 1, f"expected stars {before + 1}, got {after}"

tests/e2e/profile/block.py

@@ -0,0 +1,163 @@
+# retoor <retoor@molodetz.nl>
+
+from uuid import uuid4
+from datetime import datetime, timezone
+from playwright.sync_api import expect
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+from devplacepy.utils import make_combined_slug
+
+BLOCK = "form[action='/block/bob_test'] button"
+UNBLOCK = "form[action='/block/unblock/bob_test'] button"
+
+
+def _confirm(page):
+    page.locator(".dialog-overlay.visible .dialog-confirm").click()
+
+
+def _reset_block(page):
+    page.goto(f"{BASE_URL}/profile/bob_test", wait_until="domcontentloaded")
+    if page.is_visible(UNBLOCK):
+        page.click(UNBLOCK)
+        _confirm(page)
+        page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
+
+
+def _seed_user(prefix):
+    uid = str(uuid4())
+    get_table("users").insert(
+        {
+            "uid": uid,
+            "username": f"{prefix}_{uid[:8]}",
+            "email": f"{uid[:8]}@seed.devplace",
+            "password_hash": "x",
+            "role": "Member",
+            "is_active": True,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return uid, f"{prefix}_{uid[:8]}"
+
+
+def _seed_post(owner_uid, marker):
+    uid = str(uuid4())
+    get_table("posts").insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": uid,
+            "user_uid": owner_uid,
+            "slug": make_combined_slug(marker, uid),
+            "title": None,
+            "content": marker,
+            "topic": "devlog",
+            "project_uid": None,
+            "image": None,
+            "stars": 0,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return uid
+
+
+def test_block_and_unblock_buttons_toggle(alice):
+    page, _ = alice
+    _reset_block(page)
+    assert page.is_visible(BLOCK)
+
+    page.click(BLOCK)
+    _confirm(page)
+    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
+    assert page.is_visible(UNBLOCK)
+
+    page.click(UNBLOCK)
+    _confirm(page)
+    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
+    assert page.is_visible(BLOCK)
+
+
+def test_block_button_opens_confirmation_dialog(alice):
+    page, _ = alice
+    _reset_block(page)
+    page.click(BLOCK)
+    expect(page.locator(".dialog-overlay.visible")).to_be_visible()
+    expect(page.locator(".dialog-overlay.visible .dialog-message")).to_contain_text(
+        "Block"
+    )
+    page.locator(".dialog-overlay.visible .dialog-cancel").click()
+    expect(page.locator(".dialog-overlay")).not_to_be_visible()
+    assert page.is_visible(BLOCK)
+
+
+def test_blocked_authors_post_hidden_from_feed(alice):
+    page, _ = alice
+    author_uid, _author = _seed_user("blkfeed")
+    marker = f"feedmarker{uuid4().hex[:8]}"
+    _seed_post(author_uid, marker)
+
+    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    assert marker in page.content()
+
+    resp = page.request.post(
+        f"{BASE_URL}/block/{_author}", max_redirects=0
+    )
+    assert resp.status in (302, 200)
+
+    page.goto(f"{BASE_URL}/feed", wait_until="domcontentloaded")
+    assert marker not in page.content()
+
+    page.request.post(f"{BASE_URL}/block/unblock/{_author}", max_redirects=0)
+
+
+def test_blocked_authors_comment_hidden_on_post(alice):
+    page, _ = alice
+    host_uid, _host = _seed_user("blkhost")
+    commenter_uid, commenter = _seed_user("blkcom")
+    marker_post = f"hostpost{uuid4().hex[:8]}"
+    post_uid = _seed_post(host_uid, marker_post)
+    comment_text = f"blockedcomment{uuid4().hex[:8]}"
+    get_table("comments").insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": str(uuid4()),
+            "target_type": "post",
+            "target_uid": post_uid,
+            "post_uid": post_uid,
+            "user_uid": commenter_uid,
+            "content": comment_text,
+            "parent_uid": None,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    slug = get_table("posts").find_one(uid=post_uid)["slug"]
+
+    page.goto(f"{BASE_URL}/posts/{slug}", wait_until="domcontentloaded")
+    assert comment_text in page.content()
+
+    page.request.post(f"{BASE_URL}/block/{commenter}", max_redirects=0)
+
+    page.goto(f"{BASE_URL}/posts/{slug}", wait_until="domcontentloaded")
+    assert comment_text not in page.content()
+
+    page.request.post(f"{BASE_URL}/block/unblock/{commenter}", max_redirects=0)
+
+
+def test_blocked_users_profile_still_shows_their_content(alice):
+    page, _ = alice
+    marker = f"profmarker{uuid4().hex[:8]}"
+    bob_uid = get_table("users").find_one(username="bob_test")["uid"]
+    _seed_post(bob_uid, marker)
+    _reset_block(page)
+
+    page.click(BLOCK)
+    _confirm(page)
+    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
+
+    page.goto(f"{BASE_URL}/profile/bob_test", wait_until="domcontentloaded")
+    assert page.is_visible(UNBLOCK)
+    assert marker in page.content()
+
+    page.click(UNBLOCK)
+    _confirm(page)
+    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")

tests/e2e/profile/mute.py

@@ -0,0 +1,48 @@
+# retoor <retoor@molodetz.nl>
+
+from playwright.sync_api import expect
+from tests.conftest import BASE_URL
+
+MUTE = "form[action='/mute/bob_test'] button"
+UNMUTE = "form[action='/mute/unmute/bob_test'] button"
+
+
+def _confirm(page):
+    page.locator(".dialog-overlay.visible .dialog-confirm").click()
+
+
+def _reset_mute(page):
+    page.goto(f"{BASE_URL}/profile/bob_test", wait_until="domcontentloaded")
+    if page.is_visible(UNMUTE):
+        page.click(UNMUTE)
+        _confirm(page)
+        page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
+
+
+def test_mute_and_unmute_buttons_toggle(alice):
+    page, _ = alice
+    _reset_mute(page)
+    assert page.is_visible(MUTE)
+
+    page.click(MUTE)
+    _confirm(page)
+    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
+    assert page.is_visible(UNMUTE)
+
+    page.click(UNMUTE)
+    _confirm(page)
+    page.wait_for_url("**/profile/bob_test", wait_until="domcontentloaded")
+    assert page.is_visible(MUTE)
+
+
+def test_mute_button_opens_confirmation_dialog(alice):
+    page, _ = alice
+    _reset_mute(page)
+    page.click(MUTE)
+    expect(page.locator(".dialog-overlay.visible")).to_be_visible()
+    expect(page.locator(".dialog-overlay.visible .dialog-message")).to_contain_text(
+        "Mute"
+    )
+    page.locator(".dialog-overlay.visible .dialog-cancel").click()
+    expect(page.locator(".dialog-overlay")).not_to_be_visible()
+    assert page.is_visible(MUTE)

tests/e2e/profile/search.py

@@ -522,7 +522,7 @@ def test_ui_media_lightbox_opens(alice):
     thumb.click()
     overlay = page.locator(".lightbox-overlay.visible")
     overlay.wait_for(state="visible")
-    assert page.locator(".lightbox-overlay.visible .lightbox-image").is_visible()
+    expect(page.locator(".lightbox-overlay.visible .lightbox-image")).to_be_visible()
     page.locator(".lightbox-overlay.visible .lightbox-close").click()
     overlay.wait_for(state="hidden")
 

tests/unit/database.py

@@ -259,3 +259,119 @@ def test_interleave_by_author_single_author_keeps_order():
     rows = [{"uid": i, "user_uid": "a"} for i in range(4)]
     spread = interleave_by_author(rows)
     assert [r["uid"] for r in spread] == [0, 1, 2, 3]
+
+
+def _relation(actor_uid, target_uid, kind):
+    get_table("user_relations").insert(
+        {
+            "uid": generate_uid(),
+            "user_uid": actor_uid,
+            "target_uid": target_uid,
+            "kind": kind,
+            "created_at": _now_db_helpers(),
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+
+
+def test_get_user_relations_partitions_both_kinds(local_db):
+    from devplacepy.database import get_user_relations, invalidate_user_relations
+
+    actor = _user_db_helpers()
+    blocked = _user_db_helpers()
+    muted = _user_db_helpers()
+    _relation(actor, blocked, "block")
+    _relation(actor, muted, "mute")
+    invalidate_user_relations(actor)
+
+    relations = get_user_relations(actor)
+    assert relations["block"] == frozenset({blocked})
+    assert relations["mute"] == frozenset({muted})
+
+
+def test_get_user_relations_anonymous_is_empty(local_db):
+    from devplacepy.database import get_user_relations
+
+    relations = get_user_relations(None)
+    assert relations["block"] == frozenset()
+    assert relations["mute"] == frozenset()
+
+
+def test_get_silenced_uids_is_union(local_db):
+    from devplacepy.database import get_silenced_uids, invalidate_user_relations
+
+    actor = _user_db_helpers()
+    blocked = _user_db_helpers()
+    muted = _user_db_helpers()
+    _relation(actor, blocked, "block")
+    _relation(actor, muted, "mute")
+    invalidate_user_relations(actor)
+
+    assert get_silenced_uids(actor) == frozenset({blocked, muted})
+
+
+def test_soft_deleted_relation_is_ignored(local_db):
+    from devplacepy.database import get_blocked_uids, invalidate_user_relations
+
+    actor = _user_db_helpers()
+    target = _user_db_helpers()
+    _relation(actor, target, "block")
+    invalidate_user_relations(actor)
+    assert get_blocked_uids(actor) == frozenset({target})
+
+    row = get_table("user_relations").find_one(user_uid=actor, target_uid=target)
+    get_table("user_relations").update(
+        {"id": row["id"], "deleted_at": _now_db_helpers()}, ["id"]
+    )
+    invalidate_user_relations(actor)
+    assert get_blocked_uids(actor) == frozenset()
+
+
+def test_paginate_excludes_blocked_authors(local_db):
+    from devplacepy.database import paginate, invalidate_user_relations
+
+    viewer = _user_db_helpers()
+    blocked = _user_db_helpers()
+    visible = _user_db_helpers()
+    blocked_post = _post(blocked)
+    visible_post = _post(visible)
+    _relation(viewer, blocked, "block")
+    invalidate_user_relations(viewer)
+
+    rows, _ = paginate(get_table("posts"), viewer_uid=viewer)
+    uids = {r["uid"] for r in rows}
+    assert visible_post in uids
+    assert blocked_post not in uids
+
+
+def test_paginate_without_viewer_keeps_all(local_db):
+    from devplacepy.database import paginate, invalidate_user_relations
+
+    viewer = _user_db_helpers()
+    blocked = _user_db_helpers()
+    blocked_post = _post(blocked)
+    _relation(viewer, blocked, "block")
+    invalidate_user_relations(viewer)
+
+    rows, _ = paginate(get_table("posts"), viewer_uid=None)
+    assert blocked_post in {r["uid"] for r in rows}
+
+
+def test_load_comments_drops_blocked_author(local_db):
+    from devplacepy.database import load_comments, invalidate_user_relations
+
+    viewer = _user_db_helpers()
+    host = _user_db_helpers()
+    blocked = _user_db_helpers()
+    post_uid = _post(host)
+    _comment(blocked, post_uid)
+    _relation(viewer, blocked, "block")
+    invalidate_user_relations(viewer)
+
+    viewer_row = get_table("users").find_one(uid=viewer)
+    comments = load_comments("post", post_uid, viewer_row)
+    assert comments == []
+
+    others = load_comments("post", post_uid, None)
+    assert len(others) == 1

tests/unit/rendering.py

@@ -1,5 +1,7 @@
 # retoor <retoor@molodetz.nl>
 
+from html.parser import HTMLParser
+
 from devplacepy.rendering import render_content, render_title
 
 
@@ -110,3 +112,154 @@ def test_title_escapes_raw_html():
 def test_caching_is_idempotent():
     text = "cached **content** :fire:"
     assert str(render_content(text)) == str(render_content(text))
+
+
+DANGEROUS_SCHEMES = {"javascript", "data", "vbscript", "file"}
+
+
+class _XSSAudit(HTMLParser):
+    def __init__(self) -> None:
+        super().__init__(convert_charrefs=True)
+        self.violations: list[str] = []
+
+    def handle_starttag(self, tag: str, attrs: list) -> None:
+        self._inspect(tag, attrs)
+
+    def handle_startendtag(self, tag: str, attrs: list) -> None:
+        self._inspect(tag, attrs)
+
+    def _inspect(self, tag: str, attrs: list) -> None:
+        if tag in {"script", "object", "embed"}:
+            self.violations.append(f"<{tag}>")
+        for name, value in attrs:
+            lname = name.lower()
+            if lname.startswith("on"):
+                self.violations.append(f"{tag}@{name}")
+            if lname in {"href", "src", "xlink:href", "formaction"} and value:
+                scheme = value.split(":", 1)[0].strip().lower() if ":" in value else ""
+                if scheme in DANGEROUS_SCHEMES:
+                    self.violations.append(f"{tag}@{name}={value}")
+
+
+def assert_no_executable_html(rendered: str) -> None:
+    audit = _XSSAudit()
+    audit.feed(rendered)
+    audit.close()
+    assert not audit.violations, f"XSS vectors survived rendering: {audit.violations}"
+
+
+XSS_VECTORS = (
+    "<script>alert('xss')</script>",
+    "<img src=x onerror=alert('xss')>",
+    "<svg onload=alert('xss')>",
+    "<svg><script>alert('xss')</script></svg>",
+    "<body onload=alert('xss')>",
+    "<iframe src=\"javascript:alert('xss')\"></iframe>",
+    "<a href=\"javascript:alert('xss')\">click</a>",
+    "<div onmouseover=\"alert('xss')\">hover</div>",
+    "<input autofocus onfocus=alert('xss')>",
+    "<object data=\"javascript:alert('xss')\"></object>",
+    "<a href=\"data:text/html,<script>alert('xss')</script>\">x</a>",
+    "[click](javascript:alert('xss'))",
+    "![img](javascript:alert('xss'))",
+    "[click](data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==)",
+    "[click](vbscript:msgbox('xss'))",
+    "normal text <ScRiPt>alert('xss')</ScRiPt> mixed case",
+    "tab\tin\tjava\tscript:alert('xss')",
+    "<img src=`x`onerror=alert('xss')>",
+    "<a href=\" javascript:alert('xss')\">leading space</a>",
+)
+
+
+def _audit_content_vectors() -> None:
+    for vector in XSS_VECTORS:
+        assert_no_executable_html(str(render_content(vector)))
+        assert_no_executable_html(str(render_content(f"hello {vector} world")))
+
+
+def _audit_title_vectors() -> None:
+    for vector in XSS_VECTORS:
+        assert_no_executable_html(str(render_title(vector)))
+        assert_no_executable_html(str(render_title(f"title {vector} end")))
+
+
+def test_xss_post_title_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_post_content_is_neutralised():
+    _audit_content_vectors()
+
+
+def test_xss_comment_content_is_neutralised():
+    _audit_content_vectors()
+
+
+def test_xss_project_title_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_project_description_is_neutralised():
+    _audit_content_vectors()
+
+
+def test_xss_gist_title_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_gist_description_is_neutralised():
+    _audit_content_vectors()
+
+
+def test_xss_news_title_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_news_content_is_neutralised():
+    _audit_content_vectors()
+
+
+def test_xss_message_content_is_neutralised():
+    _audit_content_vectors()
+
+
+def test_xss_poll_question_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_poll_option_label_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_saved_item_title_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_leaderboard_title_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_issue_title_is_neutralised():
+    _audit_title_vectors()
+
+
+def test_xss_issue_body_is_neutralised():
+    _audit_content_vectors()
+
+
+def test_xss_legitimate_youtube_embed_survives_audit():
+    out = str(render_content("watch https://youtu.be/dQw4w9WgXcQ now"))
+    assert "youtube.com/embed/dQw4w9WgXcQ" in out
+    assert_no_executable_html(out)
+
+
+def test_xss_legitimate_image_embed_survives_audit():
+    out = str(render_content("pic https://example.com/a.png end"))
+    assert "<img" in out
+    assert_no_executable_html(out)
+
+
+def test_xss_legitimate_link_survives_audit():
+    out = str(render_content("see https://example.com/page ok"))
+    assert 'href="https://example.com/page"' in out
+    assert_no_executable_html(out)

tests/unit/services/bot/bot.py

@@ -0,0 +1,55 @@
+# retoor <retoor@molodetz.nl>
+
+import asyncio
+import types
+
+from devplacepy.services.bot import bot as bot_module
+from devplacepy.services.bot.bot import DevPlaceBot
+
+STALE_KEY = "019ec5b5-410c-7660-a129-c80589859080"
+OWN_KEY = "019ed655-b699-7fa0-bf25-dd77910fb6d4"
+
+
+def _fake_bot(cached_key, fetched_key):
+    fake = types.SimpleNamespace()
+    fake.state = types.SimpleNamespace(account_api_key=cached_key)
+    fake.llm = types.SimpleNamespace(api_key=cached_key)
+    fake.saves = []
+    fake.logs = []
+
+    async def _fetch():
+        return fetched_key
+
+    fake._fetch_account_api_key = _fetch
+    fake._save = lambda: fake.saves.append(fake.state.account_api_key)
+    fake._log = lambda *args, **kwargs: fake.logs.append(args[0] if args else "")
+    return fake
+
+
+def test_adopt_replaces_stale_cached_key_from_recycled_slot():
+    fake = _fake_bot(cached_key=STALE_KEY, fetched_key=OWN_KEY)
+    result = asyncio.run(DevPlaceBot._adopt_account_api_key(fake))
+    assert result is True
+    assert fake.llm.api_key == OWN_KEY
+    assert fake.state.account_api_key == OWN_KEY
+    assert fake.saves == [OWN_KEY]
+
+
+def test_adopt_keeps_matching_key_without_resaving():
+    fake = _fake_bot(cached_key=OWN_KEY, fetched_key=OWN_KEY)
+    result = asyncio.run(DevPlaceBot._adopt_account_api_key(fake))
+    assert result is True
+    assert fake.llm.api_key == OWN_KEY
+    assert fake.saves == []
+
+
+def test_adopt_fails_when_own_key_unavailable(monkeypatch):
+    async def _instant_sleep(_seconds):
+        return None
+
+    monkeypatch.setattr(bot_module.asyncio, "sleep", _instant_sleep)
+    fake = _fake_bot(cached_key=STALE_KEY, fetched_key="")
+    result = asyncio.run(DevPlaceBot._adopt_account_api_key(fake))
+    assert result is False
+    assert fake.llm.api_key == STALE_KEY
+    assert fake.saves == []

tests/unit/services/devii/actions/catalog.py

@@ -46,3 +46,34 @@ def test_seo_report_is_public_read_only_http_action():
     assert "seo_report" not in CONFIRM_REQUIRED
     names = {p.name for p in action.params}
     assert "uid" in names
+
+
+def test_block_mute_tools_exist_as_http_actions():
+    expected = {
+        "block_user": "/block/{username}",
+        "unblock_user": "/block/unblock/{username}",
+        "mute_user": "/mute/{username}",
+        "unmute_user": "/mute/unmute/{username}",
+    }
+    for name, path in expected.items():
+        action = BY_NAME[name]
+        assert action.handler == "http"
+        assert action.method == "POST"
+        assert action.path == path
+        assert action.requires_auth is True
+        assert action.requires_admin is False
+        assert "username" in {p.name for p in action.params}
+
+
+def test_block_mute_tools_visible_to_authenticated_user():
+    schemas = PLATFORM_CATALOG.tool_schemas_for(authenticated=True, is_admin=False)
+    names = {s["function"]["name"] for s in schemas}
+    for name in ("block_user", "unblock_user", "mute_user", "unmute_user"):
+        assert name in names
+
+
+def test_block_mute_tools_hidden_from_guests():
+    schemas = PLATFORM_CATALOG.tool_schemas_for(authenticated=False)
+    names = {s["function"]["name"] for s in schemas}
+    for name in ("block_user", "unblock_user", "mute_user", "unmute_user"):
+        assert name not in names

tests/unit/utils.py

@@ -1,6 +1,10 @@
 # retoor <retoor@molodetz.nl>
 
-from devplacepy.database import get_table, get_primary_admin_uid
+from devplacepy.database import (
+    get_table,
+    get_primary_admin_uid,
+    invalidate_admins_cache,
+)
 from devplacepy.utils import (
     award_badge,
     award_xp,
@@ -168,6 +172,7 @@ def _seed_user_at(role, created_at):
             "created_at": created_at.isoformat(),
         }
     )
+    invalidate_admins_cache()
     return get_table("users").find_one(uid=uid)
 
 
@@ -175,12 +180,14 @@ def _demote_existing_admins():
     existing = [r["uid"] for r in get_table("users").find(role="Admin")]
     for uid in existing:
         get_table("users").update({"uid": uid, "role": "Member"}, ["uid"])
+    invalidate_admins_cache()
     return existing
 
 
 def _restore_admins(uids):
     for uid in uids:
         get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
+    invalidate_admins_cache()
 
 
 def _purge(*rows):
@@ -219,6 +226,7 @@ def test_primary_admin_reassigns_when_founder_demoted(local_db):
         get_table("users").update(
             {"uid": admin_first["uid"], "role": "Member"}, ["uid"]
         )
+        invalidate_admins_cache()
         assert get_primary_admin_uid() == admin_second["uid"]
         assert (
             is_primary_admin(get_table("users").find_one(uid=admin_second["uid"]))