feat: user blocking and content reporting/flagging

- user_blocks table (composite PK), Block/Unblock button on profiles. Blocking severs any existing follow relationship both ways and prevents the blocked party from following, commenting on the blocker's recipes, or the blocker from seeing their comments. - reports table (recipe/comment/user targets, pending/reviewed/ dismissed status). ReportButton on comments, admin review queue at /admin/reports with dismiss/mark-reviewed actions, audit-logged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-03 22:09:14 +02:00
parent a3f387fa2a
commit 57c29f62b4
19 changed files with 4441 additions and 14 deletions
@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdmin } from "@/lib/api-auth";
+import { db, reports, auditLogs, eq } from "@epicure/db";
+import { randomUUID } from "crypto";
+
+interface RouteContext {
+  params: Promise<{ id: string }>;
+}
+
+export async function PATCH(req: NextRequest, { params }: RouteContext) {
+  const { session, response } = await requireAdmin();
+  if (response) return response;
+
+  const { id } = await params;
+  const body = (await req.json()) as { status?: string };
+  if (body.status !== "reviewed" && body.status !== "dismissed") {
+    return NextResponse.json({ error: "Invalid status" }, { status: 400 });
+  }
+
+  const [updated] = await db
+    .update(reports)
+    .set({ status: body.status, reviewedById: session!.user.id, reviewedAt: new Date() })
+    .where(eq(reports.id, id))
+    .returning();
+
+  if (!updated) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  await db.insert(auditLogs).values({
+    id: randomUUID(),
+    userId: session!.user.id,
+    action: "admin.report.resolve",
+    targetType: "report",
+    targetId: id,
+    metadata: JSON.stringify({ status: body.status }),
+    createdAt: new Date(),
+  });
+
+  return NextResponse.json({ report: updated });
+}
@@ -0,0 +1,28 @@
+import { NextResponse } from "next/server";
+import { requireAdmin } from "@/lib/api-auth";
+import { db, reports, users, eq, desc } from "@epicure/db";
+
+export async function GET() {
+  const { response } = await requireAdmin();
+  if (response) return response;
+
+  const rows = await db
+    .select({
+      id: reports.id,
+      targetType: reports.targetType,
+      targetId: reports.targetId,
+      reason: reports.reason,
+      status: reports.status,
+      createdAt: reports.createdAt,
+      reporterId: reports.reporterId,
+      reporterName: users.name,
+      reporterEmail: users.email,
+    })
+    .from(reports)
+    .innerJoin(users, eq(reports.reporterId, users.id))
+    .where(eq(reports.status, "pending"))
+    .orderBy(desc(reports.createdAt))
+    .limit(100);
+
+  return NextResponse.json({ reports: rows });
+}