moderate 0.1.0 → 1.0.0.beta2

data/app/helpers/moderate/engine_helper.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+module Moderate
+  # View helpers exposed to BOTH the engine's own views and the HOST app's views.
+  #
+  # The headline helper is `moderate_report_link` (and its terser alias
+  # `report_link`): a one-liner you drop next to any reportable piece of content to
+  # render an in-app "Report" affordance — the exact thing Apple Guideline 1.2 and
+  # Google Play's UGC policy require every social/UGC app to surface next to
+  # user-generated content.
+  #   - https://developer.apple.com/app-store/review/guidelines/#user-generated-content
+  #   - https://support.google.com/googleplay/android-developer/answer/9876937
+  #
+  # GOTCHA — isolated engine + host views: `Moderate::Engine` is an *isolated*
+  # engine (`isolate_namespace Moderate`). Rails does NOT auto-include an isolated
+  # engine's helpers into the host application's views — that's the whole point of
+  # isolation. But `moderate_report_link` is meant to be called from the host's own
+  # templates (e.g. `<%= moderate_report_link(@comment, field: :body) %>`), so we
+  # explicitly mix this module into ActionView for the host at load time via the
+  # `ActiveSupport.on_load(:action_view)` hook at the bottom of this file. That is
+  # the same trick Devise uses to expose its url helpers app-wide.
+  module EngineHelper
+    # Render an in-app report affordance for `record`'s `field`, or NOTHING when the
+    # current viewer isn't allowed to report it.
+    #
+    # Renders nothing (returns nil) — deliberately, and in three cases:
+    #   1. there is no signed-in viewer (anonymous users use the public DSA notice
+    #      form instead; this is the *in-app* button), or
+    #   2. the record doesn't know how to be reported (no `report_visible_to?`), or
+    #   3. the record says this viewer may not report this field
+    #      (`record.report_visible_to?(viewer, field:)` is false — e.g. you can't
+    #      report your own content, or content you can't even see).
+    #
+    # This "render nothing unless permitted" contract is what lets a host sprinkle
+    # the helper liberally across a template without guarding each call site — the
+    # helper is the guard. It mirrors the reference app's `report_link`.
+    #
+    # @param record  [Object] any model that `include`s Moderate::Reportable
+    # @param field   [Symbol, String, nil] which field is being reported (nil =>
+    #   the whole record). Passed straight through to the visibility check and the
+    #   intake form so the moderator sees exactly which field was flagged.
+    # @param label   [String, nil] the visible link text. Defaults to a translated
+    #   "Report" string so the host gets i18n for free.
+    # @param html_options [Hash] extra HTML attributes merged onto the <a> (class,
+    #   data-*, aria-*, …) so the host can style it to taste without a wrapper.
+    # @return [ActiveSupport::SafeBuffer, nil]
+    def moderate_report_link(record, field: nil, label: nil, **html_options)
+      viewer = moderate_current_viewer
+      return if viewer.nil?
+
+      # The record gates its own reportability. We `respond_to?`-guard so a host can
+      # pass any object without the helper exploding — a non-reportable object simply
+      # renders nothing, same as "not permitted".
+      return unless record.respond_to?(:report_visible_to?)
+      return unless record.report_visible_to?(viewer, field: field)
+
+      label ||= moderate_report_default_label
+      link_to(label, moderate_report_path_for(record, field: field), **html_options)
+    end
+
+    # Terse alias. The README/docs use `moderate_report_link` in host views (to
+    # avoid clashing with a host's own `report_link`), but `report_link` reads
+    # cleanest inside the engine's own templates. Same method, two names.
+    def report_link(record, field: nil, label: nil, **html_options)
+      moderate_report_link(record, field: field, label: label, **html_options)
+    end
+
+    private
+
+    # The path to the in-app intake form for this record/field.
+    #
+    # The target is passed as a SIGNED Global ID, never a raw `type`+`id`. This is
+    # the load-bearing security decision of the report flow: a raw polymorphic
+    # `reportable_type`/`reportable_id` pair in a URL is attacker-controlled — anyone
+    # could file a report against an arbitrary record (or probe which ids exist).
+    # A signed GID is tamper-proof and scoped to a single purpose, so the intake
+    # controller can `locate_signed_reportable` it back to the exact record the host
+    # chose to expose here, and nothing else.
+    # See: https://api.rubyonrails.org/classes/GlobalID/Identification.html#method-i-to_sgid
+    #
+    # NOTE: the in-app report controller/route is the host's (BYOUI) — `moderate`
+    # ships the primitives, not the in-app report UI. So we build the path from the
+    # host's named route (`new_report_path`/`new_moderate_report_path`) when present
+    # and fall back to a conventional `/reports/new?target=…` otherwise, rather than
+    # hard-coding the engine's routes (which only cover the *public* DSA form).
+    def moderate_report_path_for(record, field:)
+      target = moderate_signed_target(record)
+      query = { target: target, field: field.presence }.compact
+
+      if respond_to?(:new_report_path)
+        new_report_path(query)
+      elsif respond_to?(:new_moderate_report_path)
+        new_moderate_report_path(query)
+      else
+        # Last-resort conventional path so the helper is never a hard dependency on
+        # a particular route name. The host wires the actual route (BYOUI).
+        "/reports/new?#{query.to_query}"
+      end
+    end
+
+    # The record as a signed, purpose-scoped GID parameter. We delegate to the
+    # Reportable concern's own signer when available (so the purpose/expiry stay in
+    # ONE place — the model), and fall back to `to_sgid_param` with the canonical
+    # purpose otherwise.
+    def moderate_signed_target(record)
+      return record.to_moderation_sgid if record.respond_to?(:to_moderation_sgid)
+
+      # GlobalID's signed param, scoped to a stable purpose string so a token minted
+      # for reporting can't be replayed against an unrelated signed-GID feature.
+      #
+      # `expires_in: nil` mints a NON-EXPIRING token on purpose. By default
+      # `to_sgid_param` bakes in an `exp` timestamp (SignedGlobalID.expires_in, ~1
+      # month), which makes the token — and therefore the rendered link's URL —
+      # CHANGE on every render. That breaks HTTP/fragment caching of pages that show
+      # the report link, and makes the link non-deterministic. The token is already
+      # purpose-scoped ("moderate_report") and the locator restricts resolution to the
+      # allow-listed reportable classes, so a stable, non-expiring identifier is the
+      # right trade-off here: it identifies WHICH record to report, it doesn't grant
+      # any capability that needs to time out.
+      record.to_sgid_param(for: "moderate_report", expires_in: nil)
+    end
+
+    # Who is viewing — resolved without coupling `moderate` to any auth gem. We try
+    # `current_user` (Devise/most apps) first; a host with a different actor accessor
+    # can override `moderate_current_viewer` in their own helper. nil => anonymous,
+    # which correctly hides the in-app button.
+    def moderate_current_viewer
+      return current_user if respond_to?(:current_user)
+
+      nil
+    end
+
+    # Default link text, pulled through I18n so it localizes with the host's locale
+    # and can be overridden without touching call sites. Falls back to plain English
+    # if the host hasn't loaded the gem's locale file.
+    def moderate_report_default_label
+      if defined?(I18n)
+        I18n.t("moderate.report_link.label", default: "Report")
+      else
+        "Report"
+      end
+    end
+  end
+end
+
+# Expose the helper to the HOST app's views (see the "isolated engine" gotcha in
+# the module doc above). `on_load(:action_view)` defers until ActionView is loaded,
+# so we never force it at boot and we play nice with the host's load order.
+ActiveSupport.on_load(:action_view) do
+  include Moderate::EngineHelper
+end if defined?(ActiveSupport)

data/app/views/moderate/appeals/new.html.erb

@@ -0,0 +1,78 @@
+<style>
+  .moderate-page { color: var(--moderate-text, #111827); font-family: var(--moderate-font-family, system-ui, sans-serif); }
+  .moderate-hero { background: var(--moderate-accent, #facc15); padding: 3rem 1.25rem; }
+  .moderate-container { max-width: 42rem; margin: 0 auto; }
+  .moderate-eyebrow { margin: 0; font-size: .75rem; font-weight: 800; text-transform: uppercase; letter-spacing: .12em; color: var(--moderate-muted-text, #374151); }
+  .moderate-title { margin: .5rem 0 0; font-size: clamp(2rem, 6vw, 2.5rem); line-height: 1.1; font-weight: 900; }
+  .moderate-main { padding: 2.5rem 1.25rem; }
+  .moderate-panel { margin-bottom: 1.5rem; border: 1px solid rgba(17, 24, 39, .08); border-radius: .5rem; background: var(--moderate-panel, #f9fafb); padding: 1rem; color: var(--moderate-muted-text, #374151); }
+  .moderate-form { display: grid; gap: 1.25rem; }
+  .moderate-grid { display: grid; gap: 1rem; }
+  @media (min-width: 640px) { .moderate-grid { grid-template-columns: 1fr 1fr; } }
+  .moderate-label { display: block; font-size: .875rem; font-weight: 700; }
+  .moderate-input { box-sizing: border-box; margin-top: .5rem; width: 100%; border: 1px solid rgba(17, 24, 39, .14); border-radius: .5rem; background: white; padding: .75rem 1rem; font: inherit; }
+  .moderate-error { border: 1px solid #fecaca; border-radius: .5rem; background: #fef2f2; padding: .75rem 1rem; color: #991b1b; font-size: .875rem; font-weight: 700; }
+  .moderate-button { width: 100%; border: 0; border-radius: 999px; background: var(--moderate-button, #111827); color: white; padding: .85rem 1rem; font: inherit; font-weight: 900; cursor: pointer; }
+  .moderate-turnstile { display: flex; justify-content: center; }
+</style>
+
+<div class="moderate-page">
+  <section class="moderate-hero">
+    <div class="moderate-container">
+      <p class="moderate-eyebrow"><%= t("moderate.appeals.eyebrow", default: "Moderation") %></p>
+      <h1 class="moderate-title"><%= t("moderate.appeals.title", default: "Appeal a decision") %></h1>
+    </div>
+  </section>
+
+  <main class="moderate-main">
+    <div class="moderate-container">
+      <div class="moderate-panel">
+        <p>
+          <strong><%= t("moderate.appeals.decision", default: "Decision") %></strong>
+          <span><%= @report.id %></span>
+        </p>
+        <% if @report.appeal_deadline_at.present? %>
+          <p><%= t("moderate.appeals.deadline", default: "You can request a free internal review until %{deadline}. A person will review it.", deadline: l(@report.appeal_deadline_at, format: :long)) %></p>
+        <% end %>
+      </div>
+
+      <%= form_with model: @appeal, url: appeals_path(token: params[:token]), scope: :appeal, class: "moderate-form" do |form| %>
+        <%= form.hidden_field :source, value: @appeal.source || "notifier" %>
+
+        <div class="moderate-grid">
+          <div>
+            <%= form.label :appellant_name, t("moderate.appeals.fields.name", default: "Name"), class: "moderate-label" %>
+            <%= form.text_field :appellant_name, class: "moderate-input" %>
+          </div>
+          <div>
+            <%= form.label :appellant_email, t("moderate.appeals.fields.email", default: "Email"), class: "moderate-label" %>
+            <%= form.email_field :appellant_email, required: true, class: "moderate-input" %>
+          </div>
+        </div>
+
+        <div>
+          <%= form.label :reason, t("moderate.appeals.fields.reason", default: "Reason for appeal"), class: "moderate-label" %>
+          <%= form.text_area :reason,
+                rows: 8,
+                maxlength: Moderate::Report::MESSAGE_MAX_LENGTH,
+                required: true,
+                class: "moderate-input",
+                placeholder: t("moderate.appeals.placeholders.reason", default: "Explain why you believe the decision should be reviewed and include any useful context.") %>
+        </div>
+
+        <% if turnstile_widget_required? && respond_to?(:cloudflare_turnstile) %>
+          <div class="moderate-turnstile">
+            <%= cloudflare_turnstile_script_tag if respond_to?(:cloudflare_turnstile_script_tag) %>
+            <%= cloudflare_turnstile %>
+          </div>
+        <% end %>
+
+        <% if @appeal.errors.any? %>
+          <div class="moderate-error"><%= @appeal.errors.full_messages.to_sentence %></div>
+        <% end %>
+
+        <%= form.submit t("moderate.appeals.submit", default: "Submit appeal"), class: "moderate-button" %>
+      <% end %>
+    </div>
+  </main>
+</div>

data/app/views/moderate/notices/new.html.erb

@@ -0,0 +1,255 @@
+<%#
+  The default, OVERRIDABLE public DSA Art. 16 "notice and action" form.
+
+  This is the X / YouTube / Reddit-style "Report illegal content (EU)" page. It is
+  deliberately plain: no CSS framework is assumed, every label/hint is pulled
+  through I18n (`moderate.notices.*`), and it themes via CSS custom properties
+  (`:root { --moderate-* }`) so a host can restyle it without forking. To take full
+  control of the markup, eject it with `rails generate moderate:views` — your copy
+  at app/views/moderate/notices/new.html.erb then SHADOWS this one automatically
+  (Rails' view lookup puts the host's app/views ahead of the engine's).
+
+  The form binds a `Moderate::Report` (a notice is NOT a fourth table — it's a
+  Report with intake_kind "dsa") under the `:notice` scope, so params arrive as
+  params[:notice][...] for the controller's strong-params. KEEP ALL THE FIELDS if
+  you customize: they are dictated by DSA Article 16, not by product taste, and they
+  map 1:1 to the model's validations — dropping one makes the notice legally
+  invalid. https://eur-lex.europa.eu/eli/reg/2022/2065/oj (Art. 16)
+
+  PREFILL + LOCK (Art. 16(2)(b)/(c)):
+    * The REPORTED-CONTENT fields (subject URL, reason, details, content type) are
+      prefilled from the query string when the host deep-links here, and stay
+      EDITABLE — the notifier may correct them.
+    * The IDENTITY fields (name/email) are prefilled from Devise `current_user` when
+      someone is logged in, and are LOCKED (readonly) so a notice can't carry a
+      spoofed identity. The controller also re-asserts them server-side on submit.
+%>
+<% legal_reasons = Moderate::Report::DSA_LEGAL_REASONS %>
+<% member_states = Moderate::Report::EU_COUNTRY_CODES %>
+<% content_types = Moderate::Report::CONTENT_TYPES %>
+<%#
+  Identity is "locked" (readonly) whenever it was prefilled from the signed-in user.
+  The controller computes this and hands it over as `@identity_locked`, so the view
+  never reaches for `current_user` itself (it isn't exposed as a view helper on the
+  engine's base controller). The controller ALSO re-derives identity server-side on
+  submit, so even a tampered request that re-enables a locked field can't spoof a
+  name/email onto a legal notice. An anonymous notice (no current_user) leaves these
+  fields fully editable.
+%>
+<% identity_locked = @identity_locked %>
+
+<style>
+  /* Framework-agnostic defaults, all overridable via CSS custom properties so a
+     host can match brand colors without touching this markup. */
+  .moderate-notice {
+    --moderate-max-width: 40rem;
+    --moderate-accent: #111;
+    --moderate-border: #d4d4d4;
+    --moderate-muted: #666;
+    --moderate-radius: 8px;
+    max-width: var(--moderate-max-width);
+    margin: 2rem auto;
+    padding: 0 1rem;
+    font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+    line-height: 1.5;
+    color: #111;
+  }
+  .moderate-notice h1 { font-size: 1.5rem; margin-bottom: 0.25rem; }
+  .moderate-notice .moderate-intro { color: var(--moderate-muted); margin-bottom: 1.5rem; }
+  .moderate-notice .moderate-field { margin-bottom: 1.25rem; }
+  .moderate-notice label { display: block; font-weight: 600; margin-bottom: 0.35rem; }
+  .moderate-notice .moderate-hint { display: block; font-weight: 400; color: var(--moderate-muted); font-size: 0.85rem; margin-top: 0.25rem; }
+  .moderate-notice input[type="text"],
+  .moderate-notice input[type="url"],
+  .moderate-notice input[type="email"],
+  .moderate-notice select,
+  .moderate-notice textarea {
+    width: 100%;
+    padding: 0.6rem 0.7rem;
+    border: 1px solid var(--moderate-border);
+    border-radius: var(--moderate-radius);
+    font: inherit;
+    box-sizing: border-box;
+  }
+  .moderate-notice input[readonly] { background: #f4f4f4; color: var(--moderate-muted); cursor: not-allowed; }
+  .moderate-notice .moderate-checkbox { display: flex; gap: 0.5rem; align-items: flex-start; }
+  .moderate-notice .moderate-checkbox input { margin-top: 0.25rem; }
+  .moderate-notice .moderate-checkbox label { font-weight: 400; }
+  .moderate-notice button[type="submit"] {
+    background: var(--moderate-accent);
+    color: #fff;
+    border: 0;
+    border-radius: var(--moderate-radius);
+    padding: 0.7rem 1.25rem;
+    font: inherit;
+    font-weight: 600;
+    cursor: pointer;
+  }
+  .moderate-notice .moderate-errors {
+    border: 1px solid #e0a0a0;
+    background: #fbeaea;
+    color: #8a1f1f;
+    border-radius: var(--moderate-radius);
+    padding: 0.75rem 1rem;
+    margin-bottom: 1.25rem;
+  }
+</style>
+
+<div class="moderate-notice">
+  <h1><%= t("moderate.notices.title", default: "Report illegal content (EU)") %></h1>
+  <p class="moderate-intro">
+    <%= t("moderate.notices.intro",
+          default: "Use this form to notify us of content you believe is illegal under EU law (Digital Services Act, Article 16). Anyone can submit a notice — you do not need an account. We confirm receipt by email.") %>
+  </p>
+
+  <% if flash[:alert].present? %>
+    <div class="moderate-errors" role="alert">
+      <%= flash[:alert] %>
+    </div>
+  <% elsif flash[:notice].present? %>
+    <div class="moderate-errors" role="status">
+      <%= flash[:notice] %>
+    </div>
+  <% end %>
+
+  <%# Surface validation errors at the top so the submitter sees why a save failed. %>
+  <% if @report.respond_to?(:errors) && @report.errors.any? %>
+    <div class="moderate-errors" role="alert">
+      <%= @report.errors.full_messages.to_sentence %>
+    </div>
+  <% end %>
+
+  <%#
+    `scope: :notice` makes the params arrive as params[:notice][...], matching the
+    controller's `params.require(:notice)`. `url: notices_path` is the engine's
+    POST route, resolved within the mounted engine (e.g. /trust/notices).
+  %>
+  <%= form_with model: @report, scope: :notice, url: notices_path, method: :post do |form| %>
+
+    <%# Legal reason — the DSA statement-of-reasons taxonomy (Art. 16/17 ground). Editable. %>
+    <div class="moderate-field">
+      <%= form.label :legal_reason, t("moderate.notices.fields.legal_reason", default: "Legal reason") %>
+      <%= form.select :legal_reason,
+            legal_reasons.map { |reason| [t("moderate.legal_reasons.#{reason}", default: reason.to_s.tr("_", " ").capitalize), reason] },
+            { prompt: t("moderate.notices.prompts.legal_reason", default: "Select a reason") },
+            required: true %>
+    </div>
+
+    <%# Exact URLs — "the exact electronic location of that information", Art. 16(2)(b).
+        Prefilled from ?content_url=… (X-style deep link) but EDITABLE: the notifier
+        may correct the link to the specific content they are reporting. One URL per
+        line; the model normalizes into subject_urls and keeps subject_url as first. %>
+    <div class="moderate-field">
+      <%= form.label :subject_urls, t("moderate.notices.fields.content_url", default: "Exact URL of the content") %>
+      <textarea name="notice[subject_urls]" id="notice_subject_urls" rows="3" required="required" placeholder="https://"><%= @report.subject_url_list.join("\n") %></textarea>
+      <span class="moderate-hint">
+        <%= t("moderate.notices.hints.content_url", default: "The exact link to the specific content you are reporting.") %>
+      </span>
+    </div>
+
+    <%# Content type — the host-agnostic bucket the snapshot/queue use. Prefilled from
+        ?content_type=… when it names a valid bucket; editable. %>
+    <div class="moderate-field">
+      <%= form.label :content_type, t("moderate.notices.fields.content_type", default: "Type of content") %>
+      <%= form.select :content_type,
+            content_types.map { |type| [t("moderate.content_types.#{type}", default: type.to_s.tr("_", " ").capitalize), type] },
+            { prompt: t("moderate.notices.prompts.content_type", default: "Select a content type") },
+            required: true %>
+    </div>
+
+    <%# Optional host-side handle/identifier the notice is about (a username, an
+        account id, …). Prefilled from ?content_author= or ?content_id= when the host
+        deep-links here; always EDITABLE and optional. %>
+    <div class="moderate-field">
+      <%= form.label :reported_account_identifier, t("moderate.notices.fields.reported_account_identifier", default: "Account or handle (optional)") %>
+      <%= form.text_field :reported_account_identifier %>
+      <span class="moderate-hint">
+        <%= t("moderate.notices.hints.reported_account_identifier", default: "If the content belongs to a specific account, add its username or handle.") %>
+      </span>
+    </div>
+
+    <%# Explanation — the "sufficiently substantiated explanation", Art. 16(2)(a).
+        Maps to the Report `message` column. Editable. %>
+    <div class="moderate-field">
+      <%= form.label :message, t("moderate.notices.fields.explanation", default: "Explanation") %>
+      <%= form.text_area :message, rows: 6, required: true %>
+      <span class="moderate-hint">
+        <%= t("moderate.notices.hints.explanation", default: "Explain why you believe this content is illegal, with enough detail for us to assess it.") %>
+      </span>
+    </div>
+
+    <%# EU member state — establishes jurisdiction and routing. Editable. %>
+    <div class="moderate-field">
+      <%= form.label :legal_country_code, t("moderate.notices.fields.member_state", default: "EU member state where this is illegal") %>
+      <%= form.select :legal_country_code,
+            member_states.map { |code| [t("moderate.member_states.#{code}", default: code.to_s), code] },
+            { prompt: t("moderate.notices.prompts.member_state", default: "Select a country") },
+            required: true %>
+    </div>
+
+    <%#
+      Notifier identity — Art. 16(2)(c). PREFILLED + LOCKED when a Devise
+      `current_user` is signed in: the fields render readonly so a logged-in notifier
+      can't swap in someone else's name/email, and the controller re-asserts the
+      value server-side on submit (a tampered request can't spoof identity onto a
+      legal notice). For an anonymous notifier the fields are blank and editable.
+      Name is required EXCEPT for `protection_of_minors` notices, where the DSA
+      permits anonymity (the model enforces that carve-out).
+      https://eur-lex.europa.eu/eli/reg/2022/2065/oj (Art. 16(2)(c))
+    %>
+    <div class="moderate-field">
+      <%= form.label :notifier_name, t("moderate.notices.fields.notifier_name", default: "Your name") %>
+      <%= form.text_field :notifier_name, readonly: identity_locked %>
+      <span class="moderate-hint">
+        <% if identity_locked %>
+          <%= t("moderate.notices.hints.identity_locked", default: "Taken from your account.") %>
+        <% else %>
+          <%= t("moderate.notices.hints.notifier_name", default: "Optional only for notices about offences involving minors, where the law permits anonymity.") %>
+        <% end %>
+      </span>
+    </div>
+
+    <div class="moderate-field">
+      <%= form.label :notifier_email, t("moderate.notices.fields.notifier_email", default: "Your email") %>
+      <%= form.email_field :notifier_email, required: true, readonly: identity_locked %>
+      <span class="moderate-hint">
+        <% if identity_locked %>
+          <%= t("moderate.notices.hints.identity_locked", default: "Taken from your account.") %>
+        <% else %>
+          <%= t("moderate.notices.hints.notifier_email", default: "We send the confirmation of receipt and our decision here.") %>
+        <% end %>
+      </span>
+    </div>
+
+    <%# Good-faith attestation — Art. 16(2)(d). MUST be checked; the model rejects
+        the save otherwise (`good_faith_confirmed` has `acceptance: true`). %>
+    <div class="moderate-field moderate-checkbox">
+      <%= form.check_box :good_faith_confirmed, required: true %>
+      <%= form.label :good_faith_confirmed,
+            t("moderate.notices.fields.good_faith", default: "I confirm in good faith that the information and allegations in this notice are accurate and complete.") %>
+    </div>
+
+    <%#
+      Cloudflare Turnstile widget — rendered ONLY when the host has the
+      `rails_cloudflare_turnstile` gem installed. When present, the gem mixes
+      RailsCloudflareTurnstile::ViewHelpers into ActionView (via its railtie), so
+      `cloudflare_turnstile` (the widget) and `cloudflare_turnstile_script_tag` (the
+      loader script) are available here and we render both automatically — the host
+      configures nothing beyond the gem + its keys. The controller auto-verifies the
+      challenge server-side (`validate_cloudflare_turnstile` before_action). When the
+      gem is ABSENT this block is skipped entirely and the gate falls back to
+      `config.notice_guard` (no-op by default), so the form just works.
+      https://github.com/instrumentl/rails-cloudflare-turnstile (README)
+    %>
+    <% if turnstile_widget_required? && respond_to?(:cloudflare_turnstile) %>
+      <div class="moderate-field">
+        <%= cloudflare_turnstile_script_tag if respond_to?(:cloudflare_turnstile_script_tag) %>
+        <%= cloudflare_turnstile %>
+      </div>
+    <% end %>
+
+    <div class="moderate-field">
+      <%= form.submit t("moderate.notices.submit", default: "Submit notice") %>
+    </div>
+  <% end %>
+</div>

data/app/views/moderate/transparency_reports/_summary_card.html.erb

@@ -0,0 +1,20 @@
+<%
+  rows = rows.to_h.compact_blank
+  translation_scope = local_assigns[:translation_scope]
+%>
+
+<article class="moderate-card">
+  <h2><%= title %></h2>
+  <% if rows.any? %>
+    <dl>
+      <% rows.sort_by { |key, _value| key.to_s }.each do |key, value| %>
+        <div>
+          <dt><%= translation_scope ? t("#{translation_scope}.#{key}", default: key.to_s.humanize) : key.to_s.humanize %></dt>
+          <dd><%= value %></dd>
+        </div>
+      <% end %>
+    </dl>
+  <% else %>
+    <p><%= t("moderate.transparency.no_data", default: "No data in this period.") %></p>
+  <% end %>
+</article>

data/app/views/moderate/transparency_reports/show.html.erb

@@ -0,0 +1,52 @@
+<style>
+  .moderate-page { color: var(--moderate-text, #111827); font-family: var(--moderate-font-family, system-ui, sans-serif); }
+  .moderate-hero { background: var(--moderate-accent, #facc15); padding: 3rem 1.25rem; }
+  .moderate-container { max-width: 56rem; margin: 0 auto; }
+  .moderate-eyebrow { margin: 0; font-size: .75rem; font-weight: 800; text-transform: uppercase; letter-spacing: .12em; color: var(--moderate-muted-text, #374151); }
+  .moderate-title { margin: .5rem 0 0; font-size: clamp(2rem, 6vw, 2.5rem); line-height: 1.1; font-weight: 900; }
+  .moderate-period { margin-top: 1rem; font-size: .875rem; font-weight: 700; color: var(--moderate-muted-text, #374151); }
+  .moderate-main { padding: 2.5rem 1.25rem; }
+  .moderate-grid { display: grid; gap: 1.5rem; }
+  @media (min-width: 768px) { .moderate-grid { grid-template-columns: 1fr 1fr; } }
+  .moderate-card { border: 1px solid rgba(17, 24, 39, .08); border-radius: .5rem; background: white; padding: 1.5rem; box-shadow: 0 1px 2px rgba(17, 24, 39, .04); }
+  .moderate-card h2 { margin: 0; font-size: 1.125rem; font-weight: 900; }
+  .moderate-card dl { display: grid; gap: .75rem; margin: 1rem 0 0; font-size: .875rem; }
+  .moderate-card dl > div { display: flex; align-items: center; justify-content: space-between; gap: 1rem; }
+  .moderate-card dt { color: var(--moderate-muted-text, #4b5563); }
+  .moderate-card dd { margin: 0; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; font-weight: 800; }
+  .moderate-card p { margin: 1rem 0 0; color: var(--moderate-muted-text, #6b7280); font-size: .875rem; }
+</style>
+
+<div class="moderate-page">
+  <section class="moderate-hero">
+    <div class="moderate-container">
+      <p class="moderate-eyebrow"><%= t("moderate.transparency.eyebrow", default: "Moderation") %></p>
+      <h1 class="moderate-title"><%= t("moderate.transparency.title", default: "Moderation transparency") %></h1>
+      <p class="moderate-period"><%= t("moderate.transparency.period", default: "Period: %{start} - %{end}", start: l(@period_start.to_date, format: :long), end: l(@period_end.to_date, format: :long)) %></p>
+    </div>
+  </section>
+
+  <main class="moderate-main">
+    <div class="moderate-container moderate-grid">
+      <%= render "summary_card", title: t("moderate.transparency.cards.notices_by_intake", default: "Notices by intake"), rows: @summary[:notices_by_intake] %>
+      <%= render "summary_card", title: t("moderate.transparency.cards.dsa_by_reason", default: "DSA notices by legal reason"), rows: @summary[:dsa_notices_by_legal_reason], translation_scope: "moderation.legal_reasons" %>
+      <%= render "summary_card", title: t("moderate.transparency.cards.actions_by_basis", default: "Actions by basis"), rows: @summary[:actions_by_basis], translation_scope: "moderation.resolution_bases" %>
+      <%= render "summary_card", title: t("moderate.transparency.cards.flags_by_source", default: "Automated flags by source"), rows: @summary[:automated_flags_by_source] %>
+      <%= render "summary_card", title: t("moderate.transparency.cards.appeals_by_status", default: "Appeals by status"), rows: @summary[:appeals_by_status] %>
+
+      <article class="moderate-card">
+        <h2><%= t("moderate.transparency.cards.median_times", default: "Median times") %></h2>
+        <dl>
+          <div>
+            <dt><%= t("moderate.transparency.notice_to_decision", default: "Notice to decision") %></dt>
+            <dd><%= distance_of_time_in_words(@summary[:median_notice_action_seconds].seconds) %></dd>
+          </div>
+          <div>
+            <dt><%= t("moderate.transparency.appeal_to_decision", default: "Appeal to decision") %></dt>
+            <dd><%= distance_of_time_in_words(@summary[:median_appeal_action_seconds].seconds) %></dd>
+          </div>
+        </dl>
+      </article>
+    </div>
+  </main>
+</div>

data/config/moderate/blocklists/en.yml

@@ -0,0 +1,81 @@
+# English blocklist for the built-in :wordlist filter adapter
+# (Moderate::Filters::Wordlist).
+#
+# ── Format ───────────────────────────────────────────────────────────────────
+# Top-level keys are CANONICAL TAXONOMY categories (see Moderate::Label::TAXONOMY,
+# itself the OpenAI omni-moderation-latest taxonomy:
+# https://developers.openai.com/api/docs/guides/moderation). Using the canonical
+# vocabulary here — instead of the ad-hoc bucket names a host might invent — is the
+# whole point: every adapter (this offline wordlist, the OpenAI endpoint, a host's
+# own backend) emits the SAME category set, so Moderate::Flag, the DSA Art. 17
+# statement of reasons, and the Art. 24 transparency counters all aggregate over
+# one set. A category may be a bare top-level slug ("hate") or a slash-qualified
+# subcategory ("hate/threatening") — both are valid canonical slugs.
+#
+# Each category maps to a list of REGEX patterns (Ruby Regexp source strings).
+# Patterns are matched against NORMALIZED text — already lowercased, NFKD-folded
+# (accents stripped), leetspeak-transliterated (0->o, 3->e, @->a, ...), and
+# collapsed to single spaces — AND against the same text with all spaces removed
+# (to defeat "f u c k"-style spacing evasion). So write patterns in lowercase,
+# ASCII, space-separated form; the adapter handles the evasion-resistance.
+#
+# ── Why labels, not the raw word, are stored ─────────────────────────────────
+# The adapter records the matched CATEGORY, never the offending substring, so a
+# validation error or a queue entry never echoes abusive language back into the UI
+# or the logs. (Same discipline as Apple Guideline 1.2 / Google Play UGC reviews
+# expect: https://developer.apple.com/app-store/review/guidelines/#user-generated-content
+# https://support.google.com/googleplay/android-developer/answer/9876937)
+#
+# ── This is a SEED, not a complete classifier ────────────────────────────────
+# A static wordlist is a fast, offline, multilingual FIRST line of defense — it
+# satisfies the store bar of "a method for filtering objectionable UGC before
+# posting" and catches the obvious cases with zero dependencies and zero latency.
+# It is deliberately small and conservative (false positives block real users).
+# For nuanced, context-aware moderation, register the :openai adapter or your own.
+# Extend without editing the gem via `config.additional_words` /
+# `config.excluded_words`.
+
+# Slurs / dehumanizing abuse directed at protected groups -> hate.
+# Write plain word-boundary patterns; the adapter's normalization (NFKD fold,
+# leetspeak, punctuation collapse) plus the compact-form match handle spacing and
+# symbol evasion, so there's no need to hand-encode "n i g g e r" variants here.
+hate:
+  - "\\bnigg(er|a)\\b"
+  - "\\bfagg?ot\\b"
+  - "\\bkike\\b"
+  - "\\bspic\\b"
+  - "\\bchink\\b"
+  - "\\btrann(y|ie)\\b"
+
+# Threats of violence / encouraging self-harm of another -> hate/threatening.
+# (Direct threats and incitement to self-harm, e.g. "I'm going to kill you" / "kys".)
+hate/threatening:
+  - "\\bkill\\s+yourself\\b"
+  - "\\bkys\\b"
+  - "\\bi\\s*(am|m)\\s+going\\s+to\\s+kill\\s+you\\b"
+
+# Insults / demeaning abuse aimed at an individual -> harassment.
+harassment:
+  - "\\bbitch\\b"
+  - "\\bcunt\\b"
+  - "\\bfuck(er|ing|ed)?\\b"
+  - "\\basshole\\b"
+  - "\\bretard(ed)?\\b"
+  - "\\bwh[o0]re\\b"
+
+# Explicit sexual content -> sexual.
+sexual:
+  - "\\bporn(o|ography)?\\b"
+  - "\\bnude\\s+pics?\\b"
+  - "\\bexplicit\\s+sex\\b"
+
+# Graphic depiction of violence -> violence/graphic.
+violence/graphic:
+  - "\\bgore\\b"
+  - "\\bbeheading\\b"
+
+# Solicitation of illegal/regulated goods or scams -> illicit.
+illicit:
+  - "\\bfree\\s+crypto\\b"
+  - "\\bquick\\s+money\\b"
+  - "\\bwhatsapp\\s+casino\\b"