Add user blocking, reporting, and block-filter scope (#946)

## Summary
- add `PersonBlock` and associations for managing block lists
- add reporting model/controller and routes to submit user reports
- add `BlockFilterable` concern and apply to posts to hide blocked
authors

## Testing
- `bundle exec bin/codex_style_guard`
- `bundle exec rubocop`
- `bundle exec brakeman -q -w2`
- `bundle exec bundler-audit --update`
- `bin/ci` *(0 examples)*
- `bundle exec rspec` *(fails: Selenium manager cannot download Chrome)*

------
https://chatgpt.com/codex/tasks/task_e_68927abc1a64832180846fca30b88617

Author: rsmithlal

app/controllers/better_together/person_blocks_controller.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module BetterTogether
+  class PersonBlocksController < ApplicationController # rubocop:todo Style/Documentation
+    before_action :set_person_block, only: :destroy
+    after_action :verify_authorized
+
+    def index
+      authorize PersonBlock
+      @blocked_people = current_person.blocked_people
+    end
+
+    def create
+      @person_block = current_person.person_blocks.new(person_block_params)
+      authorize @person_block
+
+      if @person_block.save
+        redirect_to blocks_path, notice: 'Person was successfully blocked.'
+      else
+        redirect_to blocks_path, alert: @person_block.errors.full_messages.to_sentence
+      end
+    end
+
+    def destroy
+      authorize @person_block
+      @person_block.destroy
+      redirect_to blocks_path, notice: 'Person was successfully unblocked.'
+    end
+
+    private
+
+    def current_person
+      current_user.person
+    end
+
+    def set_person_block
+      @person_block = current_person.person_blocks.find(params[:id])
+    end
+
+    def person_block_params
+      params.require(:person_block).permit(:blocked_id)
+    end
+  end
+end

app/controllers/better_together/reports_controller.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module BetterTogether
+  class ReportsController < ApplicationController # rubocop:todo Style/Documentation
+    after_action :verify_authorized
+
+    def create
+      @report = current_person.reports_made.new(report_params)
+      authorize @report
+
+      if @report.save
+        redirect_back fallback_location: root_path, notice: 'Report was successfully submitted.'
+      else
+        redirect_back fallback_location: root_path, alert: @report.errors.full_messages.to_sentence
+      end
+    end
+
+    private
+
+    def current_person
+      current_user.person
+    end
+
+    def report_params
+      params.require(:report).permit(:reportable_id, :reportable_type, :reason)
+    end
+  end
+end

app/models/better_together/person.rb

@@ -27,6 +27,14 @@ def self.primary_community_delegation_attrs
     has_many :conversations, through: :conversation_participants
     has_many :created_conversations, as: :creator, class_name: 'BetterTogether::Conversation', dependent: :destroy
 
+    has_many :person_blocks, foreign_key: :blocker_id, dependent: :destroy, class_name: 'BetterTogether::PersonBlock'
+    has_many :blocked_people, through: :person_blocks, source: :blocked
+    has_many :blocked_by_person_blocks, foreign_key: :blocked_id, dependent: :destroy, class_name: 'BetterTogether::PersonBlock'
+    has_many :blockers, through: :blocked_by_person_blocks, source: :blocker
+
+    has_many :reports_made, foreign_key: :reporter_id, class_name: 'BetterTogether::Report', dependent: :destroy
+    has_many :reports_received, as: :reportable, class_name: 'BetterTogether::Report', dependent: :destroy
+
     has_many :notifications, as: :recipient, dependent: :destroy, class_name: 'Noticed::Notification'
     has_many :notification_mentions, as: :record, dependent: :destroy, class_name: 'Noticed::Event'
 

app/models/better_together/person_block.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module BetterTogether
+  # Join model tracking which people block other people
+  class PersonBlock < ApplicationRecord
+    belongs_to :blocker, class_name: 'BetterTogether::Person'
+    belongs_to :blocked, class_name: 'BetterTogether::Person'
+
+    validates :blocked_id, uniqueness: { scope: :blocker_id }
+    validate :not_self
+    validate :blocked_not_platform_manager
+
+    private
+
+    def not_self
+      errors.add(:blocked_id, 'cannot block yourself') if blocker_id == blocked_id
+    end
+
+    def blocked_not_platform_manager
+      return unless blocked&.permitted_to?('manage_platform')
+
+      errors.add(:blocked, 'cannot be a platform manager')
+    end
+  end
+end

app/models/better_together/post.rb

@@ -4,6 +4,7 @@ module BetterTogether
   # Represents a blog post
   class Post < ApplicationRecord
     include Authorable
+    include BlockFilterable
     include FriendlySlug
     include Categorizable
     include Creatable

app/models/better_together/report.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module BetterTogether
+  # Record of a person reporting inappropriate content or users
+  class Report < ApplicationRecord
+    belongs_to :reporter, class_name: 'BetterTogether::Person'
+    belongs_to :reportable, polymorphic: true
+
+    validates :reason, presence: true
+  end
+end

app/models/concerns/better_together/block_filterable.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module BetterTogether
+  # Adds a scope to filter out records authored by people blocked by the given person
+  module BlockFilterable
+    extend ActiveSupport::Concern
+
+    included do
+      scope :excluding_blocked_for, lambda { |person|
+        next all unless person
+
+        blocked_ids = person.blocked_people.select(:id)
+        joins(:authorships).where.not(better_together_authorships: { author_id: blocked_ids }).distinct
+      }
+    end
+  end
+end

app/policies/better_together/person_block_policy.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module BetterTogether
+  class PersonBlockPolicy < ApplicationPolicy # rubocop:todo Style/Documentation
+    def index?
+      user.present?
+    end
+
+    def create?
+      user.present? && record.blocker == agent && !record.blocked.permitted_to?('manage_platform')
+    end
+
+    def destroy?
+      user.present? && record.blocker == agent
+    end
+
+    class Scope < Scope # rubocop:todo Style/Documentation
+      def resolve
+        scope.where(blocker: agent)
+      end
+    end
+  end
+end

app/policies/better_together/report_policy.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module BetterTogether
+  class ReportPolicy < ApplicationPolicy # rubocop:todo Style/Documentation
+    def create?
+      user.present? && record.reporter == agent && record.reporter != record.reportable
+    end
+  end
+end

app/views/better_together/person_blocks/index.html.erb

@@ -0,0 +1,6 @@
+<h1>Blocked People</h1>
+<ul>
+  <% @blocked_people.each do |person| %>
+    <li id="<%= dom_id(person) %>"><%= person.name %></li>
+  <% end %>
+</ul>