feat: moderation

app/Http/Controllers/AuthController.php

@@ -65,6 +65,12 @@ class AuthController extends Controller
             ], 401);
         }
 
+        if ($user->isSuspended()) {
+            return response()->json([
+                'message' => __('api.auth.suspended'),
+            ], 403);
+        }
+
         if (isset($data['locale']) && $user->locale !== $data['locale']) {
             $user->forceFill(['locale' => $data['locale']])->save();
         }
@@ -224,6 +230,9 @@ class AuthController extends Controller
     public function update(UpdateUserRequest $request): JsonResource
     {
         $user = $request->user();
+
+        abort_if($user->isSuspended(), 403, __('api.auth.suspended'));
+
         $data = $request->validated();
         $nutritionGoals = $data['nutritionGoals'] ?? null;
 

app/Http/Controllers/MealPostController.php

@@ -137,6 +137,8 @@ class MealPostController extends Controller
 
     public function show(Request $request, MealPosts $mealPost): MealPostsResource
     {
+        $this->abortIfUnavailable($mealPost);
+
         return new MealPostsResource($this->loadMealPostForResponse($mealPost, $request));
     }
 
@@ -171,6 +173,8 @@ class MealPostController extends Controller
 
     public function like(Request $request, MealPosts $mealPost): MealPostsResource
     {
+        $this->abortIfUnavailable($mealPost);
+
         $mealPost->likedByUsers()->syncWithoutDetaching([$request->user()->getKey()]);
 
         return new MealPostsResource($this->loadMealPostForResponse($mealPost, $request));
@@ -178,6 +182,8 @@ class MealPostController extends Controller
 
     public function unlike(Request $request, MealPosts $mealPost): MealPostsResource
     {
+        $this->abortIfUnavailable($mealPost);
+
         $mealPost->likedByUsers()->detach($request->user()->getKey());
 
         return new MealPostsResource($this->loadMealPostForResponse($mealPost, $request));
@@ -198,6 +204,14 @@ class MealPostController extends Controller
         abort_unless($mealPost->user_id === $request->user()->getKey(), 404);
     }
 
+    private function abortIfUnavailable(MealPosts $mealPost): void
+    {
+        abort_if(
+            $mealPost->isHidden() || $mealPost->user()->whereNotNull('suspended_at')->exists(),
+            404,
+        );
+    }
+
     private function loadMealPostForResponse(MealPosts $mealPost, Request $request): MealPosts
     {
         return $mealPost
@@ -207,6 +221,8 @@ class MealPostController extends Controller
     private function mealPostListQuery(Request $request): Builder
     {
         return MealPosts::query()
+            ->whereNull('hidden_at')
+            ->whereHas('user', fn (Builder $query): Builder => $query->whereNull('suspended_at'))
             ->with('user:id,name,avatar_url,account_verified_at');
     }
 

app/Http/Controllers/PostReviewsController.php

@@ -15,6 +15,8 @@ class PostReviewsController extends Controller
 {
     public function index(Request $request, MealPosts $mealPost): AnonymousResourceCollection
     {
+        $this->abortIfUnavailable($mealPost);
+
         $perPage = max(1, min($request->integer('per_page', 15), 100));
 
         $reviews = $mealPost->reviews()
@@ -28,6 +30,8 @@ class PostReviewsController extends Controller
 
     public function store(PostReviewsRequest $request, MealPosts $mealPost): JsonResponse
     {
+        $this->abortIfUnavailable($mealPost);
+
         $userId = $request->user()->getKey();
 
         abort_if(
@@ -52,6 +56,9 @@ class PostReviewsController extends Controller
 
     public function show(PostReviews $postReview): PostReviewsResource
     {
+        $postReview->loadMissing('mealPost.user');
+        $this->abortIfUnavailable($postReview->mealPost);
+
         return new PostReviewsResource($postReview->loadMissing(
             'mealPost.ingredients',
             'mealPost.user:id,name,avatar_url',
@@ -82,4 +89,12 @@ class PostReviewsController extends Controller
         abort_unless($request->user(), 401);
         abort_unless($postReview->user_id === $request->user()->getKey(), 404);
     }
+
+    private function abortIfUnavailable(MealPosts $mealPost): void
+    {
+        abort_if(
+            $mealPost->isHidden() || $mealPost->user()->whereNotNull('suspended_at')->exists(),
+            404,
+        );
+    }
 }

app/Http/Controllers/PublicUserProfileController.php

@@ -13,8 +13,11 @@ class PublicUserProfileController extends Controller
 {
     public function show(Request $request, User $user): JsonResponse
     {
+        abort_if($user->isSuspended(), 404);
+
         $meals = $user->mealPosts()
             ->where('visibility', MealPostVisibility::Public->value)
+            ->whereNull('hidden_at')
             ->with('user:id,name,avatar_url,account_verified_at')
             ->latest('eaten_at')
             ->limit(18)
@@ -34,6 +37,7 @@ class PublicUserProfileController extends Controller
                 'stats' => [
                     'mealsCount' => $user->mealPosts()
                         ->where('visibility', MealPostVisibility::Public->value)
+                        ->whereNull('hidden_at')
                         ->count(),
                 ],
                 'meals' => MealPostsResource::collection($meals)->resolve($request),

app/Http/Controllers/ReportController.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\ReportReason;
+use App\Http\Requests\StoreReportRequest;
+use App\Http\Resources\ReportResource;
+use App\Models\MealPosts;
+use App\Models\User;
+use App\Services\ModerationReportService;
+use Illuminate\Http\JsonResponse;
+
+class ReportController extends Controller
+{
+    public function storeMealPost(
+        StoreReportRequest $request,
+        MealPosts $mealPost,
+        ModerationReportService $reports,
+    ): JsonResponse {
+        $report = $reports->report(
+            reportable: $mealPost,
+            reporter: $request->user(),
+            reason: ReportReason::from($request->validated('reason')),
+            details: $request->validated('details'),
+        );
+
+        return (new ReportResource($report))
+            ->additional(['message' => __('api.reports.created')])
+            ->response()
+            ->setStatusCode(201);
+    }
+
+    public function storeUser(
+        StoreReportRequest $request,
+        User $user,
+        ModerationReportService $reports,
+    ): JsonResponse {
+        $report = $reports->report(
+            reportable: $user,
+            reporter: $request->user(),
+            reason: ReportReason::from($request->validated('reason')),
+            details: $request->validated('details'),
+        );
+
+        return (new ReportResource($report))
+            ->additional(['message' => __('api.reports.created')])
+            ->response()
+            ->setStatusCode(201);
+    }
+}

app/Http/Middleware/EnsureAccountIsNotSuspended.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAccountIsNotSuspended
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($request->user()?->isSuspended()) {
+            return response()->json([
+                'message' => __('api.auth.suspended'),
+            ], 403);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Requests/StoreReportRequest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Enums\ReportReason;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreReportRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'reason' => ['required', Rule::enum(ReportReason::class)],
+            'details' => ['nullable', 'string', 'max:2000'],
+        ];
+    }
+
+    public function messages(): array
+    {
+        return [
+            'reason.required' => __('api.validation.report_reason_required'),
+            'reason' => __('api.validation.report_reason_valid'),
+            'details.max' => __('api.validation.report_details_max'),
+        ];
+    }
+}

app/Http/Resources/ReportResource.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\MealPosts;
+use App\Models\Report;
+use App\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin Report */
+class ReportResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'reason' => $this->reason,
+            'reasonLabel' => $this->reason?->getLabel(),
+            'details' => $this->details,
+            'status' => $this->status,
+            'statusLabel' => $this->status?->getLabel(),
+            'reportableType' => $this->reportableType(),
+            'reportableId' => $this->reportable_id,
+            'moderationCaseId' => $this->moderation_case_id,
+            'createdAt' => $this->created_at,
+        ];
+    }
+
+    private function reportableType(): string
+    {
+        return match ($this->reportable_type) {
+            MealPosts::class => 'meal_post',
+            User::class => 'user',
+            default => 'unknown',
+        };
+    }
+}

app/Http/Resources/UserResource.php

@@ -27,6 +27,7 @@ class UserResource extends JsonResource
             'bio' => $this->bio,
             'role' => $this->role,
             'accountVerified' => $this->account_verified_at !== null,
+            'suspendedAt' => $this->suspended_at?->toISOString(),
             'physicalActivityLevel' => $this->physical_activity_level,
             'physicalActivityLevelLabel' => $this->physical_activity_level?->getLabel(),
             'weightGoal' => $this->weight_goal,