retoor/devplacepy
1
0
Fork 1
Code Issues 44 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Add the trust and safety subsystem and the App Store compliance work

Browse Source 
Implements the moderation and consent obligations a social platform carries,
so the web version and any client that speaks to it enforce the same rules.

Moderation core (services/moderation/, database/moderation.py): a reportable
target registry, the content filter and its choke points, the report queue with
atomic resolution, enforcement actions, consent tracking, maturity gating, and
account deletion with a grace window.

Surfaces: POST /reports plus the member report list, /admin/moderation and the
per-report admin view, /workspaces, terms acceptance at /auth/terms, consent and
account deletion under /profile, the report button and dialog partials, the
maturity gate, and the moderation stylesheet and ReportDialog client.

Every user-generated surface stays reportable by construction: new content tables
are registered in REPORTABLE_TARGETS or listed in UNREPORTABLE_TABLES with a
reason, and the registry test fails the suite on anything left unclassified.

Docs: community guidelines, content moderation, intellectual property, privacy,
terms, contact, and the admin-only moderation operations page, plus the
moderation API group and the Devii moderation actions.

Compliance record: applecomp.md is the requirement register, applechanges.md the
gap analysis against this codebase, and appleimpl.md the implementation design
they resolve to.

Tests cover the report flow, admin moderation, consent, account deletion, terms
acceptance, workspaces, and the registry invariant across the unit, api, and e2e
tiers.
This commit is contained in:
retoor
2026-08-09 00:18:20 +02:00
parent 68c2bbe387
commit 8e9d3fad98
348 changed files with 10633 additions and 238 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/api/profile/aicorrection.py
+2
View File
@@ -27,6 +27,8 @@ def _member():
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
tests/api/profile/aimodifier.py
+2
View File
@@ -27,6 +27,8 @@ def _member():
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
tests/api/profile/award.py
+2
View File
@@ -20,6 +20,8 @@ def _signup():
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
tests/api/profile/consent.py
+210
View File
@@ -0,0 +1,210 @@
# retoor <retoor@molodetz.nl>
import time
import requests
from devplacepy.database import (
CONSENT_KINDS,
consent_granted,
get_table,
refresh_snapshot,
)
from tests.conftest import BASE_URL
JSON = {"Accept": "application/json"}
_counter = [0]
def _unique(prefix="cons"):
_counter[0] += 1
return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
def _member():
name = _unique()
session = requests.Session()
session.post(
f"{BASE_URL}/auth/signup",
data={
"username": name,
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
refresh_snapshot()
return session, name, get_table("users").find_one(username=name)
def test_the_privacy_tab_lists_every_consent(app_server):
session, name, _ = _member()
payload = session.get(
f"{BASE_URL}/profile/{name}?tab=privacy", headers=JSON
).json()
kinds = {entry["kind"] for entry in payload["consents"]}
assert set(CONSENT_KINDS) == kinds
states = {entry["kind"]: entry["state"] for entry in payload["consents"]}
assert states["ai_third_party"] == "withdrawn"
assert states["terms"] == "granted"
def test_granting_and_withdrawing_takes_effect_immediately(app_server):
session, name, user = _member()
granted = session.post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "ai_third_party", "granted": "1"},
headers=JSON,
)
assert granted.status_code == 200
refresh_snapshot()
assert consent_granted("user", user["uid"], "ai_third_party") is True
withdrawn = session.post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "ai_third_party", "granted": "0"},
headers=JSON,
)
assert withdrawn.status_code == 200
refresh_snapshot()
assert consent_granted("user", user["uid"], "ai_third_party") is False
def test_consent_history_is_never_rewritten(app_server):
session, name, user = _member()
for granted in ("1", "0", "1"):
session.post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "ai_third_party", "granted": granted},
headers=JSON,
)
refresh_snapshot()
rows = list(
get_table("user_consents").find(
owner_kind="user", owner_id=user["uid"], kind="ai_third_party"
)
)
assert len(rows) == 3
def test_an_unknown_consent_kind_is_refused(app_server):
session, name, _ = _member()
response = session.post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "not_a_consent", "granted": "1"},
headers=JSON,
)
assert response.status_code == 422
def test_the_gateway_refuses_user_content_without_consent(app_server):
session, name, user = _member()
refresh_snapshot()
api_key = get_table("users").find_one(uid=user["uid"])["api_key"]
headers = {**JSON, "Authorization": f"Bearer {api_key}"}
body = {"model": "molodetz", "messages": [{"role": "user", "content": "hi"}]}
refused = requests.post(
f"{BASE_URL}/openai/v1/chat/completions", json=body, headers=headers
)
assert refused.status_code == 403
assert "consent" in refused.text.lower()
session.post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "ai_third_party", "granted": "1"},
headers=JSON,
)
allowed = requests.post(
f"{BASE_URL}/openai/v1/chat/completions", json=body, headers=headers
)
assert allowed.status_code != 403
def _admin():
session = requests.Session()
session.post(
f"{BASE_URL}/auth/login",
data={"email": "alice@test.devplace", "password": "secret123"},
allow_redirects=True,
)
return session
def test_an_admin_cannot_grant_a_consent_for_someone_else(app_server, seeded_db):
_, name, user = _member()
response = _admin().post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "ai_third_party", "granted": "1"},
headers=JSON,
)
assert response.status_code == 403
assert "account holder" in response.text
refresh_snapshot()
assert consent_granted("user", user["uid"], "ai_third_party") is False
def test_an_admin_cannot_withdraw_a_consent_for_someone_else(app_server, seeded_db):
session, name, user = _member()
session.post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "ai_third_party", "granted": "1"},
headers=JSON,
)
response = _admin().post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "ai_third_party", "granted": "0"},
headers=JSON,
)
assert response.status_code == 403
refresh_snapshot()
assert consent_granted("user", user["uid"], "ai_third_party") is True
def test_an_admin_cannot_change_someone_elses_mature_preference(app_server, seeded_db):
_, name, user = _member()
before = get_table("users").find_one(uid=user["uid"])["mature_opt_in"]
response = _admin().post(
f"{BASE_URL}/profile/{name}/mature-content",
data={"mature_opt_in": "1"},
headers=JSON,
)
assert response.status_code == 403
assert "account holder" in response.text
refresh_snapshot()
assert get_table("users").find_one(uid=user["uid"])["mature_opt_in"] == before
def test_a_stranger_cannot_change_another_members_consent(app_server):
_, name, user = _member()
stranger, _, _ = _member()
response = stranger.post(
f"{BASE_URL}/profile/{name}/consent",
data={"kind": "ai_third_party", "granted": "1"},
headers=JSON,
)
assert response.status_code == 403
refresh_snapshot()
assert consent_granted("user", user["uid"], "ai_third_party") is False
def test_the_mature_preference_round_trips(app_server):
session, name, user = _member()
response = session.post(
f"{BASE_URL}/profile/{name}/mature-content",
data={"mature_opt_in": "1"},
headers=JSON,
)
assert response.status_code == 200
refresh_snapshot()
assert get_table("users").find_one(uid=user["uid"])["mature_opt_in"] in (1, True)
session.post(
f"{BASE_URL}/profile/{name}/mature-content",
data={"mature_opt_in": "0"},
headers=JSON,
)
refresh_snapshot()
assert get_table("users").find_one(uid=user["uid"])["mature_opt_in"] in (0, False)
tests/api/profile/delete.py
+162
View File
@@ -0,0 +1,162 @@
# retoor <retoor@molodetz.nl>
import time
import requests
from devplacepy.database import get_table, refresh_snapshot
from tests.conftest import BASE_URL
JSON = {"Accept": "application/json"}
_counter = [0]
def _unique(prefix="del"):
_counter[0] += 1
return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
def _member(prefix="del"):
name = _unique(prefix)
session = requests.Session()
session.post(
f"{BASE_URL}/auth/signup",
data={
"username": name,
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
return session, name
def _post(session, title="Doomed post"):
response = session.post(
f"{BASE_URL}/posts/create",
data={"title": title, "content": "Content that disappears with the account."},
headers=JSON,
)
assert response.status_code == 200, response.text
return response.json()["data"]["uid"]
def test_the_page_states_what_is_removed_and_the_grace_window(app_server):
session, name = _member()
payload = session.get(f"{BASE_URL}/profile/{name}/delete", headers=JSON).json()
assert payload["username"] == name
assert payload["removed"]
assert payload["retained"]
assert payload["grace_hours"] >= 0
def test_a_wrong_password_does_not_delete(app_server):
session, name = _member()
response = session.post(
f"{BASE_URL}/profile/{name}/delete",
data={"password": "not-the-password"},
headers=JSON,
)
assert response.status_code == 403
refresh_snapshot()
assert get_table("users").find_one(username=name) is not None
def test_deletion_removes_content_revokes_sessions_and_anonymises(app_server):
session, name = _member()
post_uid = _post(session)
refresh_snapshot()
before = get_table("users").find_one(username=name)
response = session.post(
f"{BASE_URL}/profile/{name}/delete",
data={"password": "secret123"},
headers=JSON,
)
assert response.status_code == 200, response.text
stamp = response.json()["data"]["stamp"]
refresh_snapshot()
assert get_table("users").find_one(username=name) is None
row = get_table("users").find_one(uid=before["uid"])
assert row["username"].startswith("deleted_")
assert not row["email"]
assert not row["api_key"]
assert not row["password_hash"]
assert row["deletion_requested_at"] == stamp
post = get_table("posts").find_one(uid=post_uid)
assert post["deleted_at"] == stamp
assert session.get(f"{BASE_URL}/reports/mine", headers=JSON).status_code == 401
assert requests.get(f"{BASE_URL}/profile/{name}").status_code == 404
def test_only_the_account_holder_can_delete(app_server, seeded_db):
victim, victim_name = _member()
admin = requests.Session()
admin.post(
f"{BASE_URL}/auth/login",
data={"email": "alice@test.devplace", "password": "secret123"},
allow_redirects=True,
)
response = admin.post(
f"{BASE_URL}/profile/{victim_name}/delete",
data={"password": "secret123"},
headers=JSON,
)
assert response.status_code == 403
refresh_snapshot()
assert get_table("users").find_one(username=victim_name) is not None
def test_restore_from_trash_brings_the_whole_event_back(app_server, seeded_db):
session, name = _member()
post_uid = _post(session, title="Restorable post")
session.post(
f"{BASE_URL}/profile/{name}/delete",
data={"password": "secret123"},
headers=JSON,
)
refresh_snapshot()
assert get_table("posts").find_one(uid=post_uid)["deleted_at"]
admin = requests.Session()
admin.post(
f"{BASE_URL}/auth/login",
data={"email": "alice@test.devplace", "password": "secret123"},
allow_redirects=True,
)
response = admin.post(
f"{BASE_URL}/admin/trash/posts/{post_uid}/restore", headers=JSON
)
assert response.status_code == 200
refresh_snapshot()
assert get_table("posts").find_one(uid=post_uid)["deleted_at"] is None
def test_purging_after_the_grace_window_leaves_no_personal_data(app_server):
from devplacepy.services.moderation import deletion
session, name = _member()
post_uid = _post(session, title="Purged post")
refresh_snapshot()
uid = get_table("users").find_one(username=name)["uid"]
session.post(
f"{BASE_URL}/profile/{name}/delete",
data={"password": "secret123"},
headers=JSON,
)
refresh_snapshot()
assert get_table("users").find_one(uid=uid)["username"].startswith("deleted_")
from datetime import datetime, timedelta, timezone
later = datetime.now(timezone.utc) + timedelta(hours=deletion.grace_hours() + 1)
purged = deletion.purge_due(now=later)
assert purged >= 1
refresh_snapshot()
assert get_table("posts").find_one(uid=post_uid) is None
assert get_table("users").find_one(uid=uid) is None
tests/api/profile/index.py
+123
View File
@@ -38,6 +38,7 @@ def _seed_owner():
{
"uid": uid,
"username": f"seo_{uid[:8]}",
"terms_version": "1",
"email": f"{uid[:8]}@seo.test",
"password_hash": "x",
"role": "Member",
@@ -278,6 +279,8 @@ def test_profile_json_exposes_online_presence(app_server):
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -326,6 +329,8 @@ def test_profile_hero_avatar_has_presence_dot(app_server):
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -354,6 +359,8 @@ def test_followers_list_avatar_has_presence_dot(app_server):
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -381,6 +388,8 @@ def test_viewing_profile_marks_notification_read(app_server):
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -511,6 +520,8 @@ def _signup_badge_user():
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -571,4 +582,116 @@ def test_profile_badge_description_exact_string(app_server):
)
PRIVACY_FIELDS = (
"age_band",
"terms_version",
"terms_accepted_at",
"suspended_until",
"suspension_reason",
)
def _privacy_member(prefix="priv"):
import time
name = f"{prefix}{int(time.time() * 1000000)}"
session = requests.Session()
session.post(
f"{BASE_URL}/auth/signup",
data={
"username": name,
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
return session, name
def _admin_session():
session = requests.Session()
session.post(
f"{BASE_URL}/auth/login",
data={"email": "alice@test.devplace", "password": "secret123"},
allow_redirects=True,
)
return session
def test_the_owner_reads_their_own_privacy_state(app_server):
session, name = _privacy_member()
body = session.get(
f"{BASE_URL}/profile/{name}?tab=privacy",
headers={"Accept": "application/json"},
).json()
assert body["age_band"] == "adult"
assert body["terms_version"]
assert body["terms_accepted_at"]
assert body["consents"]
def test_privacy_state_is_withheld_from_a_stranger(app_server):
_, name = _privacy_member()
stranger, _ = _privacy_member("prvs")
body = stranger.get(
f"{BASE_URL}/profile/{name}?tab=privacy",
headers={"Accept": "application/json"},
).json()
for field in PRIVACY_FIELDS:
assert body[field] in ("", None), f"{field} leaked to a stranger: {body[field]!r}"
assert body["mature_opt_in"] is False
assert body["consents"] == []
def test_privacy_state_is_withheld_from_a_guest(app_server):
_, name = _privacy_member()
body = requests.get(
f"{BASE_URL}/profile/{name}?tab=privacy",
headers={"Accept": "application/json"},
).json()
for field in PRIVACY_FIELDS:
assert body[field] in ("", None), f"{field} leaked to a guest: {body[field]!r}"
assert body["consents"] == []
def test_a_strangers_profile_html_never_renders_the_privacy_panel(app_server):
_, name = _privacy_member()
stranger, _ = _privacy_member("prvh")
html = stranger.get(f"{BASE_URL}/profile/{name}?tab=privacy").text
assert "privacy-panel" not in html
assert f"/profile/{name}/consent" not in html
assert f"/profile/{name}/delete" not in html
def test_an_admin_reads_the_state_but_gets_no_controls(app_server, seeded_db):
_, name = _privacy_member()
admin = _admin_session()
body = admin.get(
f"{BASE_URL}/profile/{name}?tab=privacy",
headers={"Accept": "application/json"},
).json()
assert body["age_band"] == "adult"
assert body["consents"]
html = admin.get(f"{BASE_URL}/profile/{name}?tab=privacy").text
assert "privacy-panel" in html
assert "Only the account holder can change this." in html
assert "Only the account holder can change this preference." in html
assert f'action="/profile/{name}/consent"' not in html
assert f'action="/profile/{name}/mature-content"' not in html
assert f"/profile/{name}/delete" not in html
def test_the_owner_gets_the_privacy_controls(app_server):
session, name = _privacy_member()
html = session.get(f"{BASE_URL}/profile/{name}?tab=privacy").text
assert f'action="/profile/{name}/consent"' in html
assert f'action="/profile/{name}/mature-content"' in html
assert f"/profile/{name}/delete" in html
assert "Only the account holder can change this." not in html
tests/api/profile/interactions.py
+2
View File
@@ -28,6 +28,8 @@ def _member():
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
tests/api/profile/regenerateapikey.py
+2
View File
@@ -18,6 +18,8 @@ def _signup_api_auth(password="secret123"):
"email": email,
"password": password,
"confirm_password": password,
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
tests/api/profile/regenerateavatar.py
+2
View File
@@ -27,6 +27,8 @@ def _member():
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
tests/api/profile/search.py
+9
View File
@@ -18,6 +18,8 @@ def _signup_api_auth(password="secret123"):
"email": email,
"password": password,
"confirm_password": password,
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -44,6 +46,8 @@ def _signup_media(prefix="media"):
"email": f"{name}@test.devplace",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -143,6 +147,7 @@ def _make_user_streaks():
{
"uid": uid,
"username": name,
"terms_version": "1",
"email": f"{name}@t.dev",
"role": "Member",
"is_active": True,
@@ -256,6 +261,8 @@ def test_profile_renders_heatmap_and_streak(app_server):
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -287,6 +294,8 @@ def test_profile_badges_json_has_non_null_names(app_server):
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
tests/api/profile/telegram.py
+2
View File
@@ -21,6 +21,8 @@ def _signup(password="secret123"):
"email": f"{name}@t.dev",
"password": password,
"confirm_password": password,
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
tests/api/profile/update.py
+4
View File
@@ -50,6 +50,8 @@ def _member():
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)
@@ -125,6 +127,8 @@ def _session_validation():
"email": f"{name}@t.dev",
"password": "secret123",
"confirm_password": "secret123",
"birth_date": "1990-01-01",
"accept_terms": "1",
},
allow_redirects=True,
)