feat: add reciprocal user blocking

app/Actions/BlockUser.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\User;
+use App\Models\UserBlock;
+use Illuminate\Support\Facades\DB;
+
+class BlockUser
+{
+    public function execute(User $blocker, User $blocked): UserBlock
+    {
+        return DB::transaction(function () use ($blocker, $blocked): UserBlock {
+            $userBlock = UserBlock::query()->firstOrCreate([
+                'blocker_id' => $blocker->getKey(),
+                'blocked_id' => $blocked->getKey(),
+            ]);
+
+            $blocker->following()->detach($blocked->getKey());
+            $blocker->followers()->detach($blocked->getKey());
+
+            return $userBlock;
+        });
+    }
+}

app/Http/Controllers/FollowController.php

@@ -18,10 +18,12 @@ class FollowController extends Controller
 
         if ($authUser->id === $user->id) {
             return response()->json([
-                'message' => __('api.follows.cannot_follow_self')
+                'message' => __('api.follows.cannot_follow_self'),
             ], 422);
         }
 
+        abort_if($authUser->hasBlockingRelationshipWith($user), 404);
+
         // Default to Accepted as is_private doesn't exist in the DB yet
         $status = FollowStatus::Accepted;
 
@@ -44,6 +46,8 @@ class FollowController extends Controller
 
     public function accept(FollowRequest $request, User $user): JsonResponse
     {
+        abort_if($request->user()->hasBlockingRelationshipWith($user), 404);
+
         $updated = $request->user()->followers()->updateExistingPivot($user->id, [
             'status' => FollowStatus::Accepted,
         ]);
@@ -55,6 +59,8 @@ class FollowController extends Controller
 
     public function reject(FollowRequest $request, User $user): JsonResponse
     {
+        abort_if($request->user()->hasBlockingRelationshipWith($user), 404);
+
         $detached = $request->user()->followers()->detach($user->id);
 
         return response()->json([
@@ -70,6 +76,7 @@ class FollowController extends Controller
 
         $followers = $user->followers()
             ->wherePivot('status', FollowStatus::Accepted)
+            ->withoutBlockingRelationshipWith($request->user())
             ->paginate($perPage);
 
         return FollowResource::collection($followers);
@@ -83,6 +90,7 @@ class FollowController extends Controller
 
         $following = $user->following()
             ->wherePivot('status', FollowStatus::Accepted)
+            ->withoutBlockingRelationshipWith($request->user())
             ->paginate($perPage);
 
         return FollowResource::collection($following);

app/Http/Controllers/MealPostController.php

@@ -137,7 +137,7 @@ class MealPostController extends Controller
 
     public function show(Request $request, MealPosts $mealPost): MealPostsResource
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         return new MealPostsResource($this->loadMealPostForResponse($mealPost, $request));
     }
@@ -173,7 +173,7 @@ class MealPostController extends Controller
 
     public function like(Request $request, MealPosts $mealPost): MealPostsResource
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $mealPost->likedByUsers()->syncWithoutDetaching([$request->user()->getKey()]);
 
@@ -182,7 +182,7 @@ class MealPostController extends Controller
 
     public function unlike(Request $request, MealPosts $mealPost): MealPostsResource
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $mealPost->likedByUsers()->detach($request->user()->getKey());
 
@@ -204,10 +204,16 @@ class MealPostController extends Controller
         abort_unless($mealPost->user_id === $request->user()->getKey(), 404);
     }
 
-    private function abortIfUnavailable(MealPosts $mealPost): void
+    private function abortIfUnavailable(Request $request, MealPosts $mealPost): void
     {
+        $mealPost->loadMissing('user');
+        $owner = $mealPost->user;
+
         abort_if(
-            $mealPost->isHidden() || $mealPost->user()->whereNotNull('suspended_at')->exists(),
+            $mealPost->isHidden()
+                || $owner === null
+                || $owner->isSuspended()
+                || $request->user()?->hasBlockingRelationshipWith($owner),
             404,
         );
     }
@@ -222,7 +228,12 @@ class MealPostController extends Controller
     {
         return MealPosts::query()
             ->whereNull('hidden_at')
-            ->whereHas('user', fn (Builder $query): Builder => $query->whereNull('suspended_at'))
+            ->whereHas(
+                'user',
+                fn (Builder $query): Builder => $query
+                    ->whereNull('suspended_at')
+                    ->withoutBlockingRelationshipWith($request->user())
+            )
             ->with('user:id,name,avatar_url,account_verified_at');
     }
 

app/Http/Controllers/PostReviewsController.php

@@ -7,6 +7,7 @@ use App\Http\Resources\PostReviewsResource;
 use App\Models\MealPosts;
 use App\Models\PostReviews;
 use App\Notifications\MealPostCommentedNotification;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
@@ -16,11 +17,15 @@ class PostReviewsController extends Controller
 {
     public function index(Request $request, MealPosts $mealPost): AnonymousResourceCollection
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $perPage = max(1, min($request->integer('per_page', 15), 100));
 
         $reviews = $mealPost->reviews()
+            ->whereHas(
+                'user',
+                fn (Builder $query): Builder => $query->withoutBlockingRelationshipWith($request->user())
+            )
             ->with('user:id,name,avatar_url')
             ->latest()
             ->paginate($perPage)
@@ -31,7 +36,7 @@ class PostReviewsController extends Controller
 
     public function store(PostReviewsRequest $request, MealPosts $mealPost): JsonResponse
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $userId = $request->user()->getKey();
 
@@ -60,7 +65,7 @@ class PostReviewsController extends Controller
 
     public function mine(Request $request, MealPosts $mealPost): JsonResponse|PostReviewsResource
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $postReview = $mealPost->reviews()
             ->where('user_id', $request->user()->getKey())
@@ -74,10 +79,15 @@ class PostReviewsController extends Controller
         return new PostReviewsResource($postReview);
     }
 
-    public function show(PostReviews $postReview): PostReviewsResource
+    public function show(Request $request, PostReviews $postReview): PostReviewsResource
     {
-        $postReview->loadMissing('mealPost.user');
-        $this->abortIfUnavailable($postReview->mealPost);
+        $postReview->loadMissing('mealPost.user', 'user');
+        $this->abortIfUnavailable($request, $postReview->mealPost);
+        abort_if(
+            $postReview->user === null
+                || $request->user()->hasBlockingRelationshipWith($postReview->user),
+            404,
+        );
 
         return new PostReviewsResource($postReview->loadMissing(
             'mealPost.ingredients',
@@ -110,10 +120,16 @@ class PostReviewsController extends Controller
         abort_unless($postReview->user_id === $request->user()->getKey(), 404);
     }
 
-    private function abortIfUnavailable(MealPosts $mealPost): void
+    private function abortIfUnavailable(Request $request, MealPosts $mealPost): void
     {
+        $mealPost->loadMissing('user');
+        $owner = $mealPost->user;
+
         abort_if(
-            $mealPost->isHidden() || $mealPost->user()->whereNotNull('suspended_at')->exists(),
+            $mealPost->isHidden()
+                || $owner === null
+                || $owner->isSuspended()
+                || $request->user()?->hasBlockingRelationshipWith($owner),
             404,
         );
     }

app/Http/Controllers/PublicUserProfileController.php

@@ -15,6 +15,7 @@ class PublicUserProfileController extends Controller
     public function show(Request $request, User $user): JsonResponse
     {
         abort_if($user->isSuspended(), 404);
+        abort_if($request->user()?->hasBlockingRelationshipWith($user), 404);
 
         $meals = $user->mealPosts()
             ->where('visibility', MealPostVisibility::Public->value)

app/Http/Controllers/UserBlockController.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\BlockUser;
+use App\Http\Resources\BlockedUserResource;
+use App\Models\User;
+use App\Models\UserBlock;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Http\Response;
+
+class UserBlockController extends Controller
+{
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        $perPage = max(1, min($request->integer('per_page', 15), 100));
+        $blockedUsers = $request->user()
+            ->blockedUsers()
+            ->orderByPivotDesc('created_at')
+            ->paginate($perPage)
+            ->withQueryString();
+
+        return BlockedUserResource::collection($blockedUsers);
+    }
+
+    public function store(Request $request, User $user, BlockUser $blockUser): JsonResponse
+    {
+        abort_if($request->user()->is($user), 422, __('api.blocks.cannot_block_self'));
+
+        $blockUser->execute($request->user(), $user);
+
+        return response()->json([
+            'message' => __('api.blocks.blocked'),
+        ]);
+    }
+
+    public function destroy(Request $request, User $user): Response
+    {
+        UserBlock::query()
+            ->where('blocker_id', $request->user()->getKey())
+            ->where('blocked_id', $user->getKey())
+            ->delete();
+
+        return response()->noContent();
+    }
+}

app/Http/Resources/BlockedUserResource.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Support\Facades\Storage;
+
+/** @mixin User */
+class BlockedUserResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'avatarUrl' => $this->avatar_url ? asset(Storage::url($this->avatar_url)) : null,
+        ];
+    }
+}

app/Models/User.php

@@ -12,9 +12,11 @@ use Filament\Models\Contracts\HasAvatar;
 use Filament\Panel;
 use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Illuminate\Contracts\Translation\HasLocalePreference;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Concerns\HasUlids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Database\Eloquent\Relations\MorphMany;
@@ -152,20 +154,45 @@ class User extends Authenticatable implements FilamentUser, HasAvatar, HasLocale
         return $this->morphMany(Report::class, 'reportable');
     }
 
-    public function followers(): \Illuminate\Database\Eloquent\Relations\BelongsToMany
+    public function followers(): BelongsToMany
     {
         return $this->belongsToMany(self::class, 'follows', 'following_id', 'follower_id')
             ->withPivot('status')
             ->withTimestamps();
     }
 
-    public function following(): \Illuminate\Database\Eloquent\Relations\BelongsToMany
+    public function following(): BelongsToMany
     {
         return $this->belongsToMany(self::class, 'follows', 'follower_id', 'following_id')
             ->withPivot('status')
             ->withTimestamps();
     }
 
+    public function blockedUsers(): BelongsToMany
+    {
+        return $this->belongsToMany(self::class, 'user_blocks', 'blocker_id', 'blocked_id')
+            ->withTimestamps();
+    }
+
+    public function blockedByUsers(): BelongsToMany
+    {
+        return $this->belongsToMany(self::class, 'user_blocks', 'blocked_id', 'blocker_id')
+            ->withTimestamps();
+    }
+
+    public function scopeWithoutBlockingRelationshipWith(Builder $query, User $user): Builder
+    {
+        return $query
+            ->whereDoesntHave('blockedByUsers', fn (Builder $blockedByQuery): Builder => $blockedByQuery->whereKey($user->getKey()))
+            ->whereDoesntHave('blockedUsers', fn (Builder $blockedQuery): Builder => $blockedQuery->whereKey($user->getKey()));
+    }
+
+    public function hasBlockingRelationshipWith(User $user): bool
+    {
+        return $this->blockedUsers()->whereKey($user->getKey())->exists()
+            || $this->blockedByUsers()->whereKey($user->getKey())->exists();
+    }
+
     public function moderationCase(): MorphOne
     {
         return $this->morphOne(ModerationCase::class, 'caseable');

app/Models/UserBlock.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class UserBlock extends Model
+{
+    /** @use HasFactory<\Database\Factories\UserBlockFactory> */
+    use HasFactory;
+
+    protected $fillable = [
+        'blocker_id',
+        'blocked_id',
+    ];
+
+    public function blocker(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'blocker_id');
+    }
+
+    public function blocked(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'blocked_id');
+    }
+}