feat: add reciprocal user blocking

app/Http/Controllers/FollowController.php

@@ -18,10 +18,12 @@ class FollowController extends Controller
 
         if ($authUser->id === $user->id) {
             return response()->json([
-                'message' => __('api.follows.cannot_follow_self')
+                'message' => __('api.follows.cannot_follow_self'),
             ], 422);
         }
 
+        abort_if($authUser->hasBlockingRelationshipWith($user), 404);
+
         // Default to Accepted as is_private doesn't exist in the DB yet
         $status = FollowStatus::Accepted;
 
@@ -44,6 +46,8 @@ class FollowController extends Controller
 
     public function accept(FollowRequest $request, User $user): JsonResponse
     {
+        abort_if($request->user()->hasBlockingRelationshipWith($user), 404);
+
         $updated = $request->user()->followers()->updateExistingPivot($user->id, [
             'status' => FollowStatus::Accepted,
         ]);
@@ -55,6 +59,8 @@ class FollowController extends Controller
 
     public function reject(FollowRequest $request, User $user): JsonResponse
     {
+        abort_if($request->user()->hasBlockingRelationshipWith($user), 404);
+
         $detached = $request->user()->followers()->detach($user->id);
 
         return response()->json([
@@ -70,6 +76,7 @@ class FollowController extends Controller
 
         $followers = $user->followers()
             ->wherePivot('status', FollowStatus::Accepted)
+            ->withoutBlockingRelationshipWith($request->user())
             ->paginate($perPage);
 
         return FollowResource::collection($followers);
@@ -83,6 +90,7 @@ class FollowController extends Controller
 
         $following = $user->following()
             ->wherePivot('status', FollowStatus::Accepted)
+            ->withoutBlockingRelationshipWith($request->user())
             ->paginate($perPage);
 
         return FollowResource::collection($following);

app/Http/Controllers/MealPostController.php

@@ -137,7 +137,7 @@ class MealPostController extends Controller
 
     public function show(Request $request, MealPosts $mealPost): MealPostsResource
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         return new MealPostsResource($this->loadMealPostForResponse($mealPost, $request));
     }
@@ -173,7 +173,7 @@ class MealPostController extends Controller
 
     public function like(Request $request, MealPosts $mealPost): MealPostsResource
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $mealPost->likedByUsers()->syncWithoutDetaching([$request->user()->getKey()]);
 
@@ -182,7 +182,7 @@ class MealPostController extends Controller
 
     public function unlike(Request $request, MealPosts $mealPost): MealPostsResource
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $mealPost->likedByUsers()->detach($request->user()->getKey());
 
@@ -204,10 +204,16 @@ class MealPostController extends Controller
         abort_unless($mealPost->user_id === $request->user()->getKey(), 404);
     }
 
-    private function abortIfUnavailable(MealPosts $mealPost): void
+    private function abortIfUnavailable(Request $request, MealPosts $mealPost): void
     {
+        $mealPost->loadMissing('user');
+        $owner = $mealPost->user;
+
         abort_if(
-            $mealPost->isHidden() || $mealPost->user()->whereNotNull('suspended_at')->exists(),
+            $mealPost->isHidden()
+                || $owner === null
+                || $owner->isSuspended()
+                || $request->user()?->hasBlockingRelationshipWith($owner),
             404,
         );
     }
@@ -222,7 +228,12 @@ class MealPostController extends Controller
     {
         return MealPosts::query()
             ->whereNull('hidden_at')
-            ->whereHas('user', fn (Builder $query): Builder => $query->whereNull('suspended_at'))
+            ->whereHas(
+                'user',
+                fn (Builder $query): Builder => $query
+                    ->whereNull('suspended_at')
+                    ->withoutBlockingRelationshipWith($request->user())
+            )
             ->with('user:id,name,avatar_url,account_verified_at');
     }
 

app/Http/Controllers/PostReviewsController.php

@@ -7,6 +7,7 @@ use App\Http\Resources\PostReviewsResource;
 use App\Models\MealPosts;
 use App\Models\PostReviews;
 use App\Notifications\MealPostCommentedNotification;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
@@ -16,11 +17,15 @@ class PostReviewsController extends Controller
 {
     public function index(Request $request, MealPosts $mealPost): AnonymousResourceCollection
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $perPage = max(1, min($request->integer('per_page', 15), 100));
 
         $reviews = $mealPost->reviews()
+            ->whereHas(
+                'user',
+                fn (Builder $query): Builder => $query->withoutBlockingRelationshipWith($request->user())
+            )
             ->with('user:id,name,avatar_url')
             ->latest()
             ->paginate($perPage)
@@ -31,7 +36,7 @@ class PostReviewsController extends Controller
 
     public function store(PostReviewsRequest $request, MealPosts $mealPost): JsonResponse
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $userId = $request->user()->getKey();
 
@@ -60,7 +65,7 @@ class PostReviewsController extends Controller
 
     public function mine(Request $request, MealPosts $mealPost): JsonResponse|PostReviewsResource
     {
-        $this->abortIfUnavailable($mealPost);
+        $this->abortIfUnavailable($request, $mealPost);
 
         $postReview = $mealPost->reviews()
             ->where('user_id', $request->user()->getKey())
@@ -74,10 +79,15 @@ class PostReviewsController extends Controller
         return new PostReviewsResource($postReview);
     }
 
-    public function show(PostReviews $postReview): PostReviewsResource
+    public function show(Request $request, PostReviews $postReview): PostReviewsResource
     {
-        $postReview->loadMissing('mealPost.user');
-        $this->abortIfUnavailable($postReview->mealPost);
+        $postReview->loadMissing('mealPost.user', 'user');
+        $this->abortIfUnavailable($request, $postReview->mealPost);
+        abort_if(
+            $postReview->user === null
+                || $request->user()->hasBlockingRelationshipWith($postReview->user),
+            404,
+        );
 
         return new PostReviewsResource($postReview->loadMissing(
             'mealPost.ingredients',
@@ -110,10 +120,16 @@ class PostReviewsController extends Controller
         abort_unless($postReview->user_id === $request->user()->getKey(), 404);
     }
 
-    private function abortIfUnavailable(MealPosts $mealPost): void
+    private function abortIfUnavailable(Request $request, MealPosts $mealPost): void
     {
+        $mealPost->loadMissing('user');
+        $owner = $mealPost->user;
+
         abort_if(
-            $mealPost->isHidden() || $mealPost->user()->whereNotNull('suspended_at')->exists(),
+            $mealPost->isHidden()
+                || $owner === null
+                || $owner->isSuspended()
+                || $request->user()?->hasBlockingRelationshipWith($owner),
             404,
         );
     }

app/Http/Controllers/PublicUserProfileController.php

@@ -15,6 +15,7 @@ class PublicUserProfileController extends Controller
     public function show(Request $request, User $user): JsonResponse
     {
         abort_if($user->isSuspended(), 404);
+        abort_if($request->user()?->hasBlockingRelationshipWith($user), 404);
 
         $meals = $user->mealPosts()
             ->where('visibility', MealPostVisibility::Public->value)

app/Http/Controllers/UserBlockController.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Actions\BlockUser;
+use App\Http\Resources\BlockedUserResource;
+use App\Models\User;
+use App\Models\UserBlock;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Http\Response;
+
+class UserBlockController extends Controller
+{
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        $perPage = max(1, min($request->integer('per_page', 15), 100));
+        $blockedUsers = $request->user()
+            ->blockedUsers()
+            ->orderByPivotDesc('created_at')
+            ->paginate($perPage)
+            ->withQueryString();
+
+        return BlockedUserResource::collection($blockedUsers);
+    }
+
+    public function store(Request $request, User $user, BlockUser $blockUser): JsonResponse
+    {
+        abort_if($request->user()->is($user), 422, __('api.blocks.cannot_block_self'));
+
+        $blockUser->execute($request->user(), $user);
+
+        return response()->json([
+            'message' => __('api.blocks.blocked'),
+        ]);
+    }
+
+    public function destroy(Request $request, User $user): Response
+    {
+        UserBlock::query()
+            ->where('blocker_id', $request->user()->getKey())
+            ->where('blocked_id', $user->getKey())
+            ->delete();
+
+        return response()->noContent();
+    }
+}