Add the trust and safety subsystem and the App Store compliance work

Implements the moderation and consent obligations a social platform carries,
so the web version and any client that speaks to it enforce the same rules.

Moderation core (services/moderation/, database/moderation.py): a reportable
target registry, the content filter and its choke points, the report queue with
atomic resolution, enforcement actions, consent tracking, maturity gating, and
account deletion with a grace window.

Surfaces: POST /reports plus the member report list, /admin/moderation and the
per-report admin view, /workspaces, terms acceptance at /auth/terms, consent and
account deletion under /profile, the report button and dialog partials, the
maturity gate, and the moderation stylesheet and ReportDialog client.

Every user-generated surface stays reportable by construction: new content tables
are registered in REPORTABLE_TARGETS or listed in UNREPORTABLE_TABLES with a
reason, and the registry test fails the suite on anything left unclassified.

Docs: community guidelines, content moderation, intellectual property, privacy,
terms, contact, and the admin-only moderation operations page, plus the
moderation API group and the Devii moderation actions.

Compliance record: applecomp.md is the requirement register, applechanges.md the
gap analysis against this codebase, and appleimpl.md the implementation design
they resolve to.

Tests cover the report flow, admin moderation, consent, account deletion, terms
acceptance, workspaces, and the registry invariant across the unit, api, and e2e
tiers.

devplacepy/routers/devrant/CLAUDE.md

@@ -12,7 +12,7 @@ A second REST protocol mounted at `/api` that reproduces the public devRant API
 
 **ID mapping (load-bearing).** devRant integer ids ARE the auto-increment `id` PK every `dataset` table already has: `rant_id`=`posts.id`, `comment_id`=`comments.id`, `user_id`=`users.id`, `token_id`=`devrant_tokens.id`. No translation table exists - `post_by_id` is `find_one(id=...)`. Serialization converts ISO `created_at` to unix via `ids.to_unix`.
 
-**Auth.** `POST /api/users/auth-token` accepts username OR email, verifies with passlib, and inserts a `devrant_tokens` row (in `SOFT_DELETE_TABLES`; born-live; `key`=`secrets.token_hex`, `expire_time` from `session_max_age_days`). Every later call re-validates `(token_id, token_key, user_id)` with `tokens.resolve_user(params)`. Read endpoints take an OPTIONAL viewer (`resolve_user` may return None); write endpoints return `_shared.unauthorized()` (401) when it does.
+**Auth.** `POST /api/users/auth-token` accepts username OR email, verifies with passlib, and inserts a `devrant_tokens` row (in `SOFT_DELETE_TABLES`; born-live; `key`=`secrets.token_hex`, `expire_time` from `session_max_age_days`). Every later call re-validates `(token_id, token_key, user_id)` through **`_shared.resolve_actor(request, params)`**, which wraps `tokens.resolve_user` with `utils.guards.refuse_suspended` - because this path never touches `require_user`, a moderator's suspension would otherwise not bind here at all (the token resolver's `is_account_active` check covers a **ban** but not a time-boxed suspension). `refuse_suspended` gates mutating methods only, so read endpoints are unaffected. Read endpoints take an OPTIONAL viewer (it may return None); write endpoints return `_shared.unauthorized()` (401) when it does. **`DELETE /api/users/me` deliberately calls the bare `resolve_user`** - it is the account-deletion path and must stay reachable to a suspended user, matching the `/profile/{username}/delete` exemption on the web side.
 
 **Writes reuse the audited native cores - never duplicate.** Implementing this drove four DRY extractions in `content.py` (`apply_vote`, `create_comment_record`, `delete_comment_record`, `set_bookmark`) and one in `utils.py` (`register_account`); the native `routers/votes.py`, `routers/comments.py`, and `auth/signup.py` were refactored onto the SAME functions. So a devRant rant/comment/vote awards XP, fires notifications, writes the audit row, and soft-deletes exactly like the UI path. Rant create calls `content.create_content_item` directly; rant delete calls `content.delete_content_item` (full cascade) and returns the devRant envelope.
 

devplacepy/routers/devrant/_shared.py

@@ -2,10 +2,19 @@
 
 from typing import Optional
 
-from fastapi import HTTPException
+from fastapi import HTTPException, Request
 from fastapi.responses import JSONResponse
 
 from devplacepy.database import get_setting
+from devplacepy.services.devrant.tokens import resolve_user
+from devplacepy.utils.guards import refuse_suspended
+
+
+def resolve_actor(request: Request, params: dict) -> Optional[dict]:
+    user = resolve_user(params)
+    if user:
+        refuse_suspended(request, user)
+    return user
 
 
 def api_enabled() -> bool:

devplacepy/routers/devrant/auth.py

@@ -2,7 +2,6 @@
 
 import logging
 import re
-from datetime import datetime, timezone
 
 from fastapi import APIRouter, Request
 from fastapi.responses import Response
@@ -17,7 +16,7 @@ from devplacepy.services.devrant.tokens import issue_token, resolve_user, revoke
 from devplacepy.services.devrant.profile import build_profile
 from devplacepy.services.devrant.ids import user_by_id
 from devplacepy.services.devrant.avatar import render_png
-from devplacepy.routers.devrant._shared import dr_ok, dr_error, unauthorized
+from devplacepy.routers.devrant._shared import dr_ok, dr_error, resolve_actor, unauthorized
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -131,14 +130,14 @@ async def profile(request: Request, user_id: str):
     user = user_by_id(user_id)
     if not user:
         return dr_error("User not found.")
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     return dr_ok(profile=build_profile(user, viewer))
 
 
 @router.post("/users/me/edit-profile")
 async def edit_profile(request: Request):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     updates = {"uid": user["uid"]}
@@ -191,21 +190,29 @@ async def delete_account(request: Request):
     user = resolve_user(params)
     if not user:
         return unauthorized()
-    get_table("users").update(
-        {"uid": user["uid"], "is_active": False}, ["uid"]
-    )
+    from devplacepy.services.moderation import deletion
+
+    username = user["username"]
     revoke_all(user["uid"])
-    logger.info("devrant account deactivated for %s", user["username"])
+    result = deletion.delete_account(user)
+    if result is None:
+        return dr_error("This account is already being deleted.")
+    logger.info("devrant account deleted for %s", username)
     audit.record(
         request,
-        "auth.account.disable",
+        "account.delete.request",
         user=user,
         target_type="user",
         target_uid=user["uid"],
-        target_label=user["username"],
+        target_label=username,
         origin="devrant",
-        summary=f"{user['username']} deactivated account via devrant",
-        links=[audit.target("user", user["uid"], user["username"])],
+        metadata={
+            "stamp": result["stamp"],
+            "rows": result["rows"],
+            "grace_hours": result["grace_hours"],
+        },
+        summary=f"{username} deleted account via devrant",
+        links=[audit.target("user", user["uid"], username)],
     )
     return dr_ok()
 

devplacepy/routers/devrant/comments.py

@@ -17,10 +17,9 @@ from devplacepy.services.audit import record as audit
 from devplacepy.services.correction import schedule_correction
 from devplacepy.services.ai_modifier import schedule_modification
 from devplacepy.services.devrant.params import merge_params
-from devplacepy.services.devrant.tokens import resolve_user
 from devplacepy.services.devrant.ids import as_int, comment_by_id
 from devplacepy.services.devrant.serializers import serialize_comment
-from devplacepy.routers.devrant._shared import dr_ok, dr_error, unauthorized
+from devplacepy.routers.devrant._shared import dr_ok, dr_error, resolve_actor, unauthorized
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -50,7 +49,7 @@ def _serialize_single(comment: dict, viewer) -> dict:
 @router.get("/comments/{comment_id}")
 async def get_comment(request: Request, comment_id: str):
     params = await merge_params(request)
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     comment = comment_by_id(comment_id)
     if not comment:
         return dr_error("Invalid comment specified in path.")
@@ -60,7 +59,7 @@ async def get_comment(request: Request, comment_id: str):
 @router.post("/comments/{comment_id}")
 async def edit_comment(request: Request, comment_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     comment = comment_by_id(comment_id)
@@ -97,7 +96,7 @@ async def edit_comment(request: Request, comment_id: str):
 @router.delete("/comments/{comment_id}")
 async def delete_comment(request: Request, comment_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     comment = comment_by_id(comment_id)
@@ -112,7 +111,7 @@ async def delete_comment(request: Request, comment_id: str):
 @router.post("/comments/{comment_id}/vote")
 async def vote_comment(request: Request, comment_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     comment = comment_by_id(comment_id)

devplacepy/routers/devrant/notifs.py

@@ -5,9 +5,8 @@ import logging
 from fastapi import APIRouter, Request
 
 from devplacepy.services.devrant.params import merge_params
-from devplacepy.services.devrant.tokens import resolve_user
 from devplacepy.services.devrant.notifications import build_notif_feed, clear_notifications
-from devplacepy.routers.devrant._shared import dr_ok, unauthorized
+from devplacepy.routers.devrant._shared import dr_ok, resolve_actor, unauthorized
 from devplacepy.services.audit import record as audit
 
 logger = logging.getLogger(__name__)
@@ -17,7 +16,7 @@ router = APIRouter()
 @router.get("/users/me/notif-feed")
 async def notif_feed(request: Request):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     return dr_ok(data=build_notif_feed(user))
@@ -26,7 +25,7 @@ async def notif_feed(request: Request):
 @router.delete("/users/me/notif-feed")
 async def clear_notif_feed(request: Request):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     clear_notifications(user)

devplacepy/routers/devrant/rants.py

@@ -21,11 +21,10 @@ from devplacepy.services.audit import record as audit
 from devplacepy.services.correction import schedule_correction
 from devplacepy.services.ai_modifier import schedule_modification
 from devplacepy.services.devrant.params import merge_params
-from devplacepy.services.devrant.tokens import resolve_user
 from devplacepy.services.devrant.ids import as_int, post_by_id
 from devplacepy.services.devrant.feed import list_rants, search_rants, load_rant_detail
 from devplacepy.services.devrant.serializers import encode_tags
-from devplacepy.routers.devrant._shared import dr_ok, dr_error, unauthorized
+from devplacepy.routers.devrant._shared import dr_ok, dr_error, resolve_actor, unauthorized
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -45,7 +44,7 @@ def _parse_tags(raw: object) -> list:
 @router.get("/devrant/rants")
 async def rant_feed(request: Request):
     params = await merge_params(request)
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     sort = params.get("sort") or "recent"
     limit = min(MAX_LIMIT, max(1, as_int(params.get("limit"), DEFAULT_LIMIT)))
     skip = max(0, as_int(params.get("skip"), 0))
@@ -70,7 +69,7 @@ async def rant_feed(request: Request):
 @router.get("/devrant/search")
 async def search(request: Request):
     params = await merge_params(request)
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     term = (params.get("term") or "").strip()
     return dr_ok(results=search_rants(term, viewer) if term else [])
 
@@ -78,7 +77,7 @@ async def search(request: Request):
 @router.post("/devrant/rants")
 async def create_rant(request: Request):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     text = (params.get("rant") or "").strip()
@@ -114,7 +113,7 @@ async def create_rant(request: Request):
 @router.get("/devrant/rants/{rant_id}")
 async def get_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    viewer = resolve_user(params)
+    viewer = resolve_actor(request, params)
     post = post_by_id(rant_id)
     if not post:
         return dr_error("This rant does not exist.")
@@ -125,7 +124,7 @@ async def get_rant(request: Request, rant_id: str):
 @router.post("/devrant/rants/{rant_id}")
 async def edit_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
@@ -164,7 +163,7 @@ async def edit_rant(request: Request, rant_id: str):
 @router.delete("/devrant/rants/{rant_id}")
 async def delete_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
@@ -179,7 +178,7 @@ async def delete_rant(request: Request, rant_id: str):
 @router.post("/devrant/rants/{rant_id}/vote")
 async def vote_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
@@ -206,7 +205,7 @@ async def unfavorite_rant(request: Request, rant_id: str):
 
 async def _set_favorite(request: Request, rant_id: str, saved: bool):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)
@@ -219,7 +218,7 @@ async def _set_favorite(request: Request, rant_id: str, saved: bool):
 @router.post("/devrant/rants/{rant_id}/comments")
 async def comment_rant(request: Request, rant_id: str):
     params = await merge_params(request)
-    user = resolve_user(params)
+    user = resolve_actor(request, params)
     if not user:
         return unauthorized()
     post = post_by_id(rant_id)