feat: moderation

app/Http/Controllers/SearchController.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\MealPostVisibility;
+use App\Http\Requests\SearchRequest;
+use App\Http\Resources\MealPostsResource;
+use App\Http\Resources\SearchUserResource;
+use App\Models\MealPosts;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+
+class SearchController extends Controller
+{
+    public function __invoke(SearchRequest $request): AnonymousResourceCollection
+    {
+        $query = (string) $request->validated('q');
+        $perPage = (int) ($request->validated('per_page') ?? 20);
+
+        if ($request->validated('type') === 'users') {
+            $users = User::query()
+                ->whereKeyNot($request->user()->getKey())
+                ->whereNull('suspended_at')
+                ->withoutBlockingRelationshipWith($request->user())
+                ->where(function (Builder $builder) use ($query): void {
+                    $builder
+                        ->whereLike('name', "%{$query}%", caseSensitive: false)
+                        ->orWhereLike('bio', "%{$query}%", caseSensitive: false);
+                })
+                ->orderByRaw('CASE WHEN LOWER(name) = LOWER(?) THEN 0 WHEN LOWER(name) LIKE LOWER(?) THEN 1 ELSE 2 END', [
+                    $query,
+                    "{$query}%",
+                ])
+                ->orderBy('name')
+                ->paginate($perPage)
+                ->withQueryString();
+
+            return SearchUserResource::collection($users);
+        }
+
+        $meals = MealPosts::query()
+            ->where('visibility', MealPostVisibility::Public)
+            ->whereNull('hidden_at')
+            ->whereHas(
+                'user',
+                fn (Builder $builder): Builder => $builder
+                    ->whereNull('suspended_at')
+                    ->withoutBlockingRelationshipWith($request->user())
+            )
+            ->where(function (Builder $builder) use ($query): void {
+                $builder
+                    ->whereLike('title', "%{$query}%", caseSensitive: false)
+                    ->orWhereLike('caption', "%{$query}%", caseSensitive: false)
+                    ->orWhereHas(
+                        'ingredients',
+                        fn (Builder $ingredientQuery): Builder => $ingredientQuery
+                            ->whereLike('ingredient', "%{$query}%", caseSensitive: false)
+                    );
+            })
+            ->with('user:id,name,avatar_url,account_verified_at')
+            ->latest('eaten_at')
+            ->paginate($perPage)
+            ->withQueryString();
+
+        return MealPostsResource::collection($meals);
+    }
+}

app/Http/Requests/Concerns/ModeratesUserContent.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Requests\Concerns;
+
+use App\Services\ContentModerationService;
+use Illuminate\Contracts\Validation\Validator;
+
+trait ModeratesUserContent
+{
+    /**
+     * @param  array<int, mixed>  $texts
+     * @param  array<int, mixed>  $images
+     * @return array<int, callable>
+     */
+    protected function moderationChecks(array $texts, array $images = []): array
+    {
+        return [function (Validator $validator) use ($texts, $images): void {
+            if ($validator->errors()->isNotEmpty()) {
+                return;
+            }
+
+            app(ContentModerationService::class)->ensureAcceptable($texts, $images);
+        }];
+    }
+}

app/Http/Requests/MealPostsRequest.php

@@ -6,18 +6,24 @@ use App\Enums\DietType;
 use App\Enums\IngredientUnit;
 use App\Enums\MealPostType;
 use App\Enums\MealPostVisibility;
+use App\Http\Requests\Concerns\ModeratesUserContent;
+use App\Models\MealPosts;
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
 use Illuminate\Validation\Rule;
 
 class MealPostsRequest extends FormRequest
 {
+    use ModeratesUserContent;
+
     public function rules(): array
     {
         $isCreating = $this->isMethod('post');
 
         return [
             'image' => [$isCreating ? 'required_without:image_url' : 'sometimes', 'nullable', 'image', 'max:4096'],
-            'image_url' => [$isCreating ? 'required_without:image' : 'sometimes', 'nullable', 'string', 'max:2048'],
+            'image_url' => [$isCreating ? 'required_without:image' : 'sometimes', 'nullable', 'url:http,https', 'max:2048'],
             'caption' => ['nullable', 'string', 'max:1000'],
             'calories' => ['nullable', 'integer', 'min:0'],
             'proteins' => ['nullable', 'numeric', 'min:0'],
@@ -42,6 +48,39 @@ class MealPostsRequest extends FormRequest
         return true;
     }
 
+    public function after(): array
+    {
+        $mealPost = $this->route('mealPost');
+        $currentVisibility = $mealPost instanceof MealPosts
+            ? $mealPost->visibility
+            : MealPostVisibility::Private;
+        $visibility = MealPostVisibility::tryFrom((string) $this->input('visibility')) ?? $currentVisibility;
+
+        if ($visibility !== MealPostVisibility::Public) {
+            return [];
+        }
+
+        $isBecomingPublic = $mealPost instanceof MealPosts
+            && $mealPost->visibility !== MealPostVisibility::Public;
+        $ingredients = $this->has('ingredients')
+            ? collect($this->input('ingredients', []))->pluck('ingredient')->all()
+            : ($isBecomingPublic ? $mealPost->ingredients()->pluck('ingredient')->all() : []);
+        $existingImageUrl = $isBecomingPublic && filled($mealPost->image_url)
+            ? (Str::startsWith($mealPost->image_url, ['http://', 'https://'])
+                ? $mealPost->image_url
+                : asset(Storage::url($mealPost->image_url)))
+            : null;
+
+        return $this->moderationChecks(
+            [
+                $this->has('title') ? $this->input('title') : ($isBecomingPublic ? $mealPost->title : null),
+                $this->has('caption') ? $this->input('caption') : ($isBecomingPublic ? $mealPost->caption : null),
+                $ingredients,
+            ],
+            [$this->file('image'), $this->input('image_url'), $existingImageUrl],
+        );
+    }
+
     public function messages(): array
     {
         return [

app/Http/Requests/PostReviewsRequest.php

@@ -2,10 +2,13 @@
 
 namespace App\Http\Requests;
 
+use App\Http\Requests\Concerns\ModeratesUserContent;
 use Illuminate\Foundation\Http\FormRequest;
 
 class PostReviewsRequest extends FormRequest
 {
+    use ModeratesUserContent;
+
     public function rules(): array
     {
         $isCreating = $this->isMethod('post');
@@ -20,4 +23,9 @@ class PostReviewsRequest extends FormRequest
     {
         return true;
     }
+
+    public function after(): array
+    {
+        return $this->moderationChecks([$this->input('comment')]);
+    }
 }

app/Http/Requests/RegisterRequest.php

@@ -6,12 +6,15 @@ use App\Enums\PacePreference;
 use App\Enums\PhysicalActivityLevel;
 use App\Enums\UserSex;
 use App\Enums\WeightGoal;
+use App\Http\Requests\Concerns\ModeratesUserContent;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\Rules\Password;
 
 class RegisterRequest extends FormRequest
 {
+    use ModeratesUserContent;
+
     /**
      * Determine if the user is authorized to make this request.
      */
@@ -68,6 +71,14 @@ class RegisterRequest extends FormRequest
         ];
     }
 
+    public function after(): array
+    {
+        return $this->moderationChecks(
+            [$this->input('name'), $this->input('bio')],
+            [$this->file('avatar')],
+        );
+    }
+
     protected function prepareForValidation(): void
     {
         if ($this->has('locale')) {

app/Http/Requests/SearchRequest.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class SearchRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'q' => ['required', 'string', 'min:2', 'max:100'],
+            'type' => ['required', Rule::in(['meals', 'users'])],
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'per_page' => ['sometimes', 'integer', 'min:1', 'max:50'],
+        ];
+    }
+
+    protected function prepareForValidation(): void
+    {
+        if ($this->has('q')) {
+            $this->merge([
+                'q' => trim((string) $this->input('q')),
+            ]);
+        }
+    }
+}

app/Http/Requests/UpdateUserRequest.php

@@ -6,11 +6,14 @@ use App\Enums\PacePreference;
 use App\Enums\PhysicalActivityLevel;
 use App\Enums\UserSex;
 use App\Enums\WeightGoal;
+use App\Http\Requests\Concerns\ModeratesUserContent;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 
 class UpdateUserRequest extends FormRequest
 {
+    use ModeratesUserContent;
+
     public function authorize(): bool
     {
         return true;
@@ -36,6 +39,14 @@ class UpdateUserRequest extends FormRequest
         ];
     }
 
+    public function after(): array
+    {
+        return $this->moderationChecks(
+            [$this->input('bio')],
+            [$this->file('avatar')],
+        );
+    }
+
     public function messages(): array
     {
         return [

app/Http/Resources/SearchUserResource.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Support\Facades\Storage;
+
+/** @mixin User */
+class SearchUserResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'bio' => $this->bio,
+            'avatarUrl' => $this->avatar_url ? asset(Storage::url($this->avatar_url)) : null,
+            'accountVerified' => $this->account_verified_at !== null,
+        ];
+    }
+}

app/Services/ContentModerationService.php

@@ -0,0 +1,132 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+use Throwable;
+
+class ContentModerationService
+{
+    /**
+     * @param  array<int, mixed>  $texts
+     * @param  array<int, mixed>  $images
+     */
+    public function ensureAcceptable(array $texts = [], array $images = []): void
+    {
+        $normalizedTexts = collect($texts)
+            ->flatten()
+            ->filter(fn (mixed $text): bool => is_string($text) && filled(trim($text)))
+            ->map(fn (string $text): string => trim($text))
+            ->values()
+            ->all();
+        $normalizedImages = collect($images)
+            ->filter(fn (mixed $image): bool => $image instanceof UploadedFile || $this->isRemoteImageUrl($image))
+            ->values()
+            ->all();
+
+        if ($normalizedTexts === [] && $normalizedImages === []) {
+            return;
+        }
+
+        if ($this->containsExplicitlyBlockedText($normalizedTexts)) {
+            $this->rejectContent();
+        }
+
+        if (! config('moderation.content.enabled')) {
+            return;
+        }
+
+        $apiKey = trim((string) config('moderation.content.openai_key'));
+
+        if ($apiKey === '') {
+            throw new HttpException(503, __('api.moderation.unavailable'));
+        }
+
+        $input = [];
+
+        if ($normalizedTexts !== []) {
+            $input[] = [
+                'type' => 'text',
+                'text' => implode("\n", $normalizedTexts),
+            ];
+        }
+
+        foreach ($normalizedImages as $image) {
+            $input[] = [
+                'type' => 'image_url',
+                'image_url' => [
+                    'url' => $image instanceof UploadedFile
+                        ? $this->uploadedFileDataUrl($image)
+                        : $image,
+                ],
+            ];
+        }
+
+        try {
+            $response = Http::baseUrl(rtrim((string) config('moderation.content.openai_url'), '/'))
+                ->withToken($apiKey)
+                ->acceptJson()
+                ->timeout((int) config('moderation.content.timeout', 12))
+                ->retry(2, 250)
+                ->post('/moderations', [
+                    'model' => config('moderation.content.model'),
+                    'input' => $input,
+                ])
+                ->throw();
+        } catch (Throwable $exception) {
+            report($exception);
+
+            throw new HttpException(503, __('api.moderation.unavailable'), $exception);
+        }
+
+        if (collect($response->json('results', []))->contains(
+            fn (mixed $result): bool => is_array($result) && ($result['flagged'] ?? false) === true
+        )) {
+            $this->rejectContent();
+        }
+    }
+
+    /**
+     * @param  array<int, string>  $texts
+     */
+    private function containsExplicitlyBlockedText(array $texts): bool
+    {
+        $content = Str::lower(Str::ascii(implode("\n", $texts)));
+
+        return collect(config('moderation.content.blocked_phrases', []))
+            ->filter(fn (mixed $phrase): bool => is_string($phrase) && filled($phrase))
+            ->contains(fn (string $phrase): bool => Str::contains($content, Str::lower(Str::ascii($phrase))));
+    }
+
+    private function uploadedFileDataUrl(UploadedFile $image): string
+    {
+        $contents = file_get_contents($image->getRealPath());
+
+        if ($contents === false) {
+            throw new HttpException(503, __('api.moderation.unavailable'));
+        }
+
+        return sprintf(
+            'data:%s;base64,%s',
+            $image->getMimeType() ?: 'application/octet-stream',
+            base64_encode($contents),
+        );
+    }
+
+    private function isRemoteImageUrl(mixed $image): bool
+    {
+        return is_string($image)
+            && Str::startsWith($image, ['https://', 'http://']);
+    }
+
+    private function rejectContent(): never
+    {
+        throw ValidationException::withMessages([
+            'content' => [__('api.moderation.rejected')],
+        ]);
+    }
+}