moderate 1.0.0.beta1 → 1.0.0

data/lib/moderate.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "set"
-
 # We lean on a couple of ActiveSupport core extensions (notably String#constantize
 # for the lazy class-name resolution that lets `config.user_class = "User"` work
 # before the User model is loaded). In a Rails host these are always present; we
@@ -9,6 +7,8 @@ require "set"
 # context (a console, a non-Rails test) without booting all of Rails. ActiveSupport
 # is a declared runtime dependency in the gemspec.
 require "active_support/core_ext/string/inflections"
+require "active_support/core_ext/string/filters"
+require "active_support/core_ext/object/blank"
 
 require_relative "moderate/version"
 require_relative "moderate/errors"
@@ -31,7 +31,7 @@ require_relative "moderate/macros"
 # the public DSA notice form, and registers the macros on ActiveRecord. Required
 # only when Rails is present so the value objects + macros above can still be used
 # in a plain-Ruby context (a console, a non-Rails script) without booting an engine.
-require_relative "moderate/engine" if defined?(::Rails::Engine)
+require_relative "moderate/engine" if defined?(Rails::Engine)
 
 # `moderate` — a complete Trust & Safety layer for Rails apps with user-generated
 # content: report, block, filter, moderate, appeal, comply (EU DSA / Apple App
@@ -44,6 +44,27 @@ require_relative "moderate/engine" if defined?(::Rails::Engine)
 # The heavy lifting (the AR models, the decision services, the controllers) lives
 # in the autoloaded `app/` tree and calls back into these facade methods.
 module Moderate
+  # Where each of the gem's value lists is labeled for humans, under `moderate.`
+  # in I18n. The gem ships English and Spanish for every value it defines
+  # (config/locales/*.yml); a host overrides any key in its own locale files (they
+  # load after the gem's) and adds the languages it needs. The public DSA notice
+  # form has always read the legal_reasons, content_types and member_states keys.
+  TAXONOMY_LABEL_SCOPES = {
+    category: "categories",              # in-app community report categories (Report#category)
+    legal_reason: "legal_reasons",       # DSA statement-of-reasons grounds (Report#legal_reason)
+    member_state: "member_states",       # EU member-state codes (Report#legal_country_code)
+    content_type: "content_types",       # Report#content_type
+    resolution_basis: "resolution_bases", # the Art. 17 ground of a decision (Report#resolution_basis)
+    decision: "decisions",               # the restriction imposed (Report#decision_visibility, a decision's :action)
+    intake_kind: "intake_kinds",         # community report vs. DSA notice (Report#intake_kind)
+    report_status: "statuses.report",
+    flag_status: "statuses.flag",
+    appeal_status: "statuses.appeal",
+    flag_source: "flag_sources",         # Flag#source (host adapter names fall back to humanize)
+    flag_mode: "flag_modes",             # Flag#mode
+    appeal_source: "appeal_sources"      # Appeal#source
+  }.freeze
+
   class << self
     # --- Configuration --------------------------------------------------------
 
@@ -56,7 +77,7 @@ module Moderate
     # Read alias. Some ecosystem gems expose `.configuration`; we keep `.config`
     # as the canonical name (matches the README's `Moderate.config`) and provide
     # `.configuration` only as a courtesy alias for muscle memory.
-    alias_method :configuration, :config
+    alias configuration config
 
     # The host's entry point: `Moderate.configure do |config| ... end`.
     #
@@ -120,6 +141,8 @@ module Moderate
     #
     # Stored as a Set of STRING class names (not Class objects) so we never pin a
     # class in memory across a Zeitwerk reload in development; we constantize on read.
+    #
+    # @api private: called by Moderate::Reportable on inclusion.
     def register_reportable(klass)
       name = klass.is_a?(Class) ? klass.name : klass.to_s
       return if name.nil? || name.empty?
@@ -139,6 +162,74 @@ module Moderate
       end
     end
 
+    # --- Reportable field labels ----------------------------------------------
+
+    # The human name of a reported field — what the queue, the statement of
+    # reasons, and the appeal page print instead of the raw column name. A
+    # moderator reading «Body» on a chat-message report has to guess what was
+    # reported; «Chat message» they can act on.
+    #
+    #   Moderate.reportable_field_label(message, :body)          # => "Chat message"
+    #   Moderate.reportable_field_label(Message, "body")         # same, from the class
+    #   Moderate.reportable_field_label("Message", "body")       # same, from a stored type
+    #
+    # Resolution, first non-blank answer wins:
+    #
+    #   1. the `labels:` declared next to the field
+    #      (`has_reportable_content :body, labels: { body: "Chat message" }`) —
+    #      a String, or a callable evaluated now (so a lambda can use I18n);
+    #   2. i18n `moderate.reportable_fields.<model>.<field>`, where <model> is the
+    #      model's `model_name.i18n_key` (`chats/message` for `Chats::Message`),
+    #      walking up to STI parents that are themselves reportable;
+    #   3. i18n `moderate.reportable_fields.<field>` — one label for every model
+    #      that has a field by that name (the gem ships a few generic ones);
+    #   4. `field.to_s.humanize`, so an unlabeled field still renders something.
+    #
+    # Returns nil for a blank field: a whole-record report has no field to name,
+    # and callers decide how to say that in their own UI.
+    #
+    # `record_or_class` may be a record, a class, or a class-name String (a
+    # report's `reportable_type`), so a label still resolves after the reported
+    # record is gone. An unknown class name skips straight to steps 3–4.
+    def reportable_field_label(record_or_class, field)
+      field_s = field.to_s.squish
+      return if field_s.empty?
+
+      klass, class_name = reportable_label_class(record_or_class)
+
+      translated = reportable_label_i18n_keys(klass, class_name, field_s)
+        .lazy.filter_map { |key| reportable_label_i18n(key) }
+
+      declared_reportable_field_label(klass, field_s) || translated.first || field_s.humanize
+    end
+
+    # --- Taxonomy labels ------------------------------------------------------
+
+    # The human label for one value of one of the gem's taxonomies, in the current
+    # locale — what a report form, a moderation queue or a statement of reasons
+    # prints instead of the stored value:
+    #
+    #   Moderate.taxonomy_label(:category, "harassment")       # => "Harassment"   ("Acoso" in :es)
+    #   Moderate.taxonomy_label(:legal_reason, :scams_fraud)   # => "Scams and fraud"
+    #   Moderate.taxonomy_label(:flag_status, flag.status)     # => "Awaiting review"
+    #
+    # Reads `moderate.<scope>.<value>` (TAXONOMY_LABEL_SCOPES), falling back to the
+    # value humanized (a member-state code falls back to itself), so a host's own
+    # category or adapter name still renders. nil/blank in, nil out. An unknown kind
+    # raises: a typo'd kind would otherwise silently print raw values forever.
+    def taxonomy_label(kind, value)
+      scope = TAXONOMY_LABEL_SCOPES.fetch(kind.to_sym) do
+        raise ArgumentError, "unknown taxonomy #{kind.inspect}; one of: #{TAXONOMY_LABEL_SCOPES.keys.join(", ")}"
+      end
+      value_s = value.to_s.strip
+      return if value_s.empty?
+
+      fallback = kind.to_sym == :member_state ? value_s : value_s.tr("/", " ").humanize
+      return fallback unless defined?(I18n)
+
+      I18n.t("moderate.#{scope}.#{value_s}", default: fallback)
+    end
+
     # --- Notify / audit hooks -------------------------------------------------
 
     # Dispatch a notifiable moment to the host's `config.notify` hook.
@@ -159,6 +250,8 @@ module Moderate
     # We never let a host hook's exception bubble into a moderation action (a slow
     # or broken mailer must not roll back a decision). On error we audit the failure
     # and return false.
+    #
+    # @api private: the gem's dispatch into config.notify; hosts wire the hook, they don't call this.
     def notify(event_or_name, **payload)
       event = event_or_name.is_a?(Event) ? event_or_name : Event.new(name: event_or_name, **payload)
 
@@ -167,7 +260,7 @@ module Moderate
         # A lambda may legitimately return a delivery handle, a job, true, etc.
         # Anything truthy counts as delivered; nil/false counts as not-delivered.
         result ? true : false
-      rescue => error
+      rescue StandardError => error
         audit(
           name: :notify_failed,
           subject: event.subject,
@@ -187,11 +280,13 @@ module Moderate
     # same `case`. Like notify, an audit hook exception is swallowed (turned into a
     # logged warning) so it can never roll back the action it's recording — audit is
     # observational, never load-bearing.
+    #
+    # @api private: the gem's dispatch into config.audit.
     def audit(event_or_name = nil, **payload)
       event = event_or_name.is_a?(Event) ? event_or_name : Event.new(name: event_or_name, **payload)
       config.audit.call(event)
       true
-    rescue => error
+    rescue StandardError => error
       logger&.warn("[moderate] audit hook failed for #{event&.name}: #{error.class}: #{error.message}")
       false
     end
@@ -201,27 +296,135 @@ module Moderate
     # block row's creation time so hosts can apply time-aware teardown without
     # reaching back into the database. Kept as a facade method so Moderate::Block has
     # one call site and doesn't reach into config internals. No-op by default.
+    #
+    # @api private: called by Moderate::Block.
     def run_on_block(blocker:, blocked:, at:)
       config.on_block.call(blocker: blocker, blocked: blocked, at: at)
     end
 
     # Apply a ban via the host's `ban_handler` (suspend!, soft-delete, flip a flag,
-    # whatever "banned" means in the host's domain). Keyword-arg signature. No-op by
-    # default — the surrounding decision still audits and notifies even if no ban is
-    # wired, so the action is never silently dropped (docs/configuration.md).
-    def apply_ban(user:, by:, reason:)
+    # whatever "banned" means in the host's domain). Keyword-arg signature.
+    #
+    # Raises ConfigurationError when no ban_handler is wired: auditing and announcing
+    # `user_banned` for a ban nothing applied would put a false statement in the
+    # audit trail and in the person's inbox.
+    #
+    # `announce: false` (the decision services) audits now but leaves the
+    # `user_banned` notice to the caller: it returns the event's keywords for
+    # `Moderate.announce_ban`, so the notice can wait for the decision's commit.
+    #
+    # @api private: decisions ban through `report.resolve!(ban_user: true)` or
+    # `flag.action!(ban_user: true)`, which also send the statement of reasons.
+    def apply_ban(user:, by:, reason:, announce: true)
+      ensure_ban_handler!
       result = config.ban_handler.call(user: user, by: by, reason: reason)
       payload = {
         user_id: user&.id,
         reason: reason,
-        summary: "user #{user&.id || '(unknown)'} banned"
+        summary: "user #{user&.id || "(unknown)"} banned"
       }.compact
+      event = { subject: user, actor: by, recipients: [user].compact, payload: payload }
+
+      audit(:user_banned, **event)
+      return event unless announce
 
-      audit(:user_banned, subject: user, actor: by, recipients: [user].compact, payload: payload)
-      notify(:user_banned, subject: user, actor: by, recipients: [user].compact, payload: payload)
+      announce_ban(**event)
       result
     end
 
+    # The `user_banned` notice for a ban applied with `apply_ban(announce: false)`.
+    #
+    # @api private: used by the decision services.
+    def announce_ban(**event)
+      notify(:user_banned, **event)
+    end
+
+    # --- Responsibility -------------------------------------------------------
+
+    # The PERSON responsible for `record` — the account a decision notifies and a
+    # ban reaches — or nil when nobody is. It asks the record's `reported_owner`
+    # (the Reportable contract) and keeps the answer only if it is an instance of
+    # the configured `user_class`.
+    #
+    # Why the type check lives here: content is often spoken by something that
+    # isn't a person — a support desk, a bot, an organization. `chats` answers
+    # `author || sender` for a message, which is a desk for an unsigned support
+    # reply. Every place moderate stores an owner is a `user_class` association
+    # (Report#reported_user, Flag#owner), so a desk there would raise
+    # ActiveRecord::AssociationTypeMismatch and take the report down with it.
+    # "Nobody to reach" is the honest answer: the report still files, the evidence
+    # is still kept, content can still be removed; only a decision notice or a ban
+    # has no addressee.
+    #
+    # A reportable that doesn't define `reported_owner` still raises (loudly, at
+    # the first report) — that omission is a bug in the host, not "nobody".
+    def responsible_user(record)
+      return if record.nil? || !record.respond_to?(:reported_owner)
+
+      owner = record.reported_owner
+      owner if owner.is_a?(user_class)
+    end
+
+    # Raised before anything changes when a ban is asked for and nothing would apply
+    # it. Public so a decision service can check before it takes any lock.
+    #
+    # @api private: used by the decision services.
+    def ensure_ban_handler!
+      return true if config.ban_handler_configured?
+
+      raise ConfigurationError,
+        "a ban was requested but no config.ban_handler is set, so nothing would suspend the account " \
+        "while the audit trail and the statement of reasons said it was. Wire one in " \
+        "config/initializers/moderate.rb, e.g. " \
+        "`config.ban_handler = ->(user:, by:, reason:) { user.suspend!(reason: reason) }`."
+    end
+
+    # --- Transactions -----------------------------------------------------------
+
+    # Hold `record`'s row lock (SELECT … FOR UPDATE) for the block, or just run the
+    # block when there's no saved row to lock. The lock is taken by query, not with
+    # `record.with_lock`, so the caller's object is neither reloaded nor refused for
+    # carrying unsaved changes.
+    #
+    # THE LOCK ORDER — one, everywhere; a path may skip a step, never reverse two:
+    #
+    #   flag  →  content  →  person  →  report
+    #
+    #   - Flag#action!/#dismiss! (ResolveFlag): the flag; to enforce, the content;
+    #     to ban, the person; then the report it resolves.
+    #   - Report#resolve!/#dismiss! (ResolveReport): the content; to ban, the person;
+    #     then the report.
+    #   - Flag.flag! / Flag.flag_for_review!: no lock first. The database allows one
+    #     pending flag per content + field (the unique pending_key), so they insert,
+    #     and only on the collision lock a row: the waiting flag's. Holding no content
+    #     lock, they never hold content while waiting on a flag (the inversion against
+    #     ResolveFlag); the read of the waiting flag is an equality match on a unique
+    #     index, a lock on that one row while it exists.
+    #   - "The flag" is, for a pending flag, its pending_key index entry and then its
+    #     row (Flag#lock!), the order a colliding insert takes them in on InnoDB.
+    #   - The person's lock is taken only when a decision can ban: removal-only
+    #     enforcement never waits on, or holds, an account's row.
+    #
+    # Under the lock, every check that decides "already done" (a covering decision, a
+    # prior ban, whether content is gone, the flag waiting after a collision) is
+    # itself a LOCKING read (`.lock`, `reload(lock: true)`). Under MySQL's REPEATABLE
+    # READ a plain read returns the transaction's snapshot, which may predate the lock,
+    # and would miss what the decision we waited for committed; a locking read returns
+    # the latest committed row on every database. Those reads come after the locks that serialize them
+    # (content, and person for a ban), so two decisions never hold gap locks on the
+    # reports table at once.
+    #
+    # @api private: the lock order the decision services rely on.
+    def with_row_lock(record)
+      model = record.class
+      return yield unless record.respond_to?(:persisted?) && record.persisted? && model.respond_to?(:lock)
+
+      model.transaction do
+        model.unscoped.lock.where(model.primary_key => record.id).ids
+        yield
+      end
+    end
+
     # --- Blocking SSOT --------------------------------------------------------
 
     # The single source-of-truth list of user ids "related to" `user` via a block
@@ -232,10 +435,14 @@ module Moderate
     #   Post.where.not(user_id: Moderate.blocked_ids_for(current_user))
     #
     # Delegates to Moderate::Block (the model that owns the block SQL) so the join
-    # logic lives in exactly one place. Returns an empty array for a blank user.
+    # logic lives in exactly one place.
+    #
+    # ALWAYS a relation selecting user ids (`user_class.where(...).select(:id)`), for
+    # a blank user too (then an empty one): compose it into `where.not(user_id: …)`
+    # and it stays one subquery. Call `.ids` for an Array of id values. (beta2 gave
+    # `[]` for nil and a relation otherwise; a host composing the two got an Array of
+    # User records from `relation | array`, and `include?(id)` silently missed.)
     def blocked_ids_for(user)
-      return [] if user.nil?
-
       Block.related_user_ids(user)
     end
 
@@ -296,6 +503,8 @@ module Moderate
     # The locale for copy the gem generates itself, falling back to the app's
     # default. Read lazily so a host setting I18n.default_locale after our boot
     # still wins.
+    #
+    # @api private: read config.locale.
     def locale
       config.locale || (defined?(I18n) ? I18n.default_locale : :en)
     end
@@ -325,6 +534,44 @@ module Moderate
       }
     end
 
+    # Opt-in retention: redact the personal data in reports, flags and appeals whose
+    # decision is final and older than `older_than` (default 1 year, never less than
+    # the 6-month appeal window), keeping every row and its decision. Nothing calls
+    # it unless the host schedules it. See Moderate::Retention and docs/compliance.md.
+    #
+    #   Moderate.purge(older_than: 1.year)   # => { reports: 12, flags: 40, appeals: 1 }
+    def purge(**)
+      Retention.purge(**)
+    end
+
+    # The host's notifier confirms that a decision notice ACTUALLY went out — call it
+    # from the mailer's delivery (Action Mailer's `after_deliver`), not when the mail
+    # was queued:
+    #
+    #   Moderate.delivered!(report, :affected_user)  # the statement of reasons
+    #   Moderate.delivered!(report, :decision)       # the reporter's / notifier's outcome
+    #
+    # Stamps `affected_user_notified_at` / `decision_notified_at` once and starts the
+    # six-month appeal window from that moment (DSA Art. 20(2)) if that is later than
+    # the decision-time deadline; never earlier, and a second call changes nothing.
+    # Without it the window stays decision + 6 months.
+    def delivered!(report, recipient, at: Time.current)
+      report.record_delivery!(recipient, at: at)
+    end
+
+    # Keep `report` (its appeals, the flags on its content) out of the purge until
+    # `until:`: an out-of-court dispute, a court case, an authority's request.
+    #
+    #   Moderate.hold(report, until: 1.year.from_now, by: admin, reason: "ODS case 2026-114")
+    #   Moderate.release_hold(report, by: admin)
+    def hold(report, **)
+      Retention.hold(report, **)
+    end
+
+    def release_hold(report, **)
+      Retention.release_hold(report, **)
+    end
+
     private
 
     # Median seconds between paired (created_at, resolved_at) timestamps; 0 when empty.
@@ -338,7 +585,80 @@ module Moderate
     # The internal reportable-name set. Set (not Array) so re-including the concern
     # is idempotent.
     def reportable_registry
-      @reportable_classes ||= Set.new
+      @reportable_registry ||= Set.new
+    end
+
+    # [Class or nil, class name or nil] for whatever reportable_field_label got.
+    def reportable_label_class(record_or_class)
+      case record_or_class
+      when nil then [nil, nil]
+      when Class then [record_or_class, record_or_class.name]
+      when String, Symbol
+        name = record_or_class.to_s
+        [name.safe_constantize, name.presence]
+      else
+        [record_or_class.class, record_or_class.class.name]
+      end
+    end
+
+    # A label is display copy, so it must never take a page down: a host lambda
+    # that raises is logged and treated as "no declared label" (the i18n/humanize
+    # fallbacks still answer), the same way a view should treat a nil.
+    def declared_reportable_field_label(klass, field_s)
+      return unless klass.respond_to?(:moderation_reportable_field_labels)
+
+      label = klass.moderation_reportable_field_labels[field_s]
+      label = label.call if label.respond_to?(:call)
+      label.to_s.presence
+    rescue StandardError => error
+      logger&.warn("[moderate] label for #{klass.name}##{field_s} raised #{error.class}: #{error.message}")
+      nil
+    end
+
+    # Model-scoped keys first (the class, then its reportable STI parents), then
+    # the field-wide key. A class name that no longer constantizes still gets its
+    # own model key, derived the way ActiveModel::Name would.
+    def reportable_label_i18n_keys(klass, class_name, field_s)
+      model_keys =
+        if klass
+          chain = klass.ancestors.select { |ancestor| ancestor.is_a?(Class) && reportable_label_model?(ancestor) }
+          chain = [klass] if chain.empty?
+          chain.filter_map { |ancestor| reportable_label_model_key(ancestor) }
+        elsif class_name
+          [class_name.underscore]
+        else
+          []
+        end
+
+      model_keys.uniq.map { |model_key| "moderate.reportable_fields.#{model_key}.#{field_s}" } +
+        ["moderate.reportable_fields.#{field_s}"]
+    end
+
+    def reportable_label_model?(klass)
+      defined?(Moderate::Reportable) && klass.include?(Moderate::Reportable)
+    end
+
+    # `model_name` constantizes the class's namespace, which can raise for a class
+    # whose name doesn't match a loaded module; the underscored name is the same
+    # key ActiveModel would derive for a non-isolated namespace.
+    def reportable_label_model_key(klass)
+      return klass.model_name.i18n_key.to_s if klass.respond_to?(:model_name)
+
+      klass.name&.underscore
+    rescue NameError
+      klass.name&.underscore
+    end
+
+    # A translated String, or nil. Two guards: `I18n.t` with no default returns a
+    # "Translation missing" string rather than nil, so we ask `exists?` first;
+    # and the model-scoped and field-wide keys share one namespace, so a field
+    # called `listing` on a host that also has a `Listing` model would read the
+    # model's Hash of labels — anything that isn't a String is not a label.
+    def reportable_label_i18n(key)
+      return unless defined?(I18n) && I18n.exists?(key)
+
+      value = I18n.t(key)
+      value.presence if value.is_a?(String)
     end
 
     # Coerce whatever an adapter returned into a Moderate::Result, stamping the

data/lib/tasks/moderate.rake

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# Loaded into the host's `bin/rails -T` by Moderate::Engine (every engine loads
+# its lib/tasks/**/*.rake).
+namespace :moderate do
+  desc "Redact personal data from moderation records decided more than OLDER_THAN_DAYS " \
+       "(default 365, at least the 6-month appeal window) ago. DRY_RUN=1 only counts. " \
+       "See docs/compliance.md#retention."
+  task purge: :environment do
+    days = ENV.fetch("OLDER_THAN_DAYS", "365")
+    raise ArgumentError, "OLDER_THAN_DAYS must be a whole number of days, got #{days.inspect}" unless days.match?(/\A\d+\z/)
+
+    dry_run = %w[1 true yes].include?(ENV["DRY_RUN"].to_s.downcase)
+    counts = Moderate.purge(older_than: days.to_i.days, dry_run: dry_run)
+    verb = dry_run ? "would redact" : "redacted"
+    held = counts[:held]
+    puts "moderate:purge #{verb} #{counts[:reports]} reports, #{counts[:flags]} flags, " \
+         "#{counts[:appeals]} appeals decided more than #{days} days ago, " \
+         "#{dry_run ? "would delete" : "deleted"} #{counts[:classifications]} classification rows " \
+         "(#{counts[:claims_kept]} kept for a live claim); kept for a legal hold: " \
+         "#{held[:reports]} reports, #{held[:flags]} flags, #{held[:appeals]} appeals"
+  end
+end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: moderate
 version: !ruby/object:Gem::Version
-  version: 1.0.0.beta1
+  version: 1.0.0
 platform: ruby
 authors:
 - rameerez
 bindir: exe
 cert_chain: []
-date: 2026-06-03 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 8.0.5.1
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 8.0.5.1
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -35,7 +35,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 8.0.5.1
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -45,7 +45,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 8.0.5.1
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -69,7 +69,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 8.0.5.1
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -79,7 +79,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 8.0.5.1
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -133,24 +133,32 @@ files:
 - app/views/moderate/notices/new.html.erb
 - app/views/moderate/transparency_reports/_summary_card.html.erb
 - app/views/moderate/transparency_reports/show.html.erb
+- config/locales/en.yml
+- config/locales/es.yml
 - config/moderate/blocklists/en.yml
 - config/moderate/blocklists/es.yml
 - config/routes.rb
+- context7.json
+- db/migrate/20261018200000_add_pending_key_to_moderate_flags.rb
+- db/migrate/20261018210000_add_retention_and_classifications_to_moderate_tables.rb
+- docs/chats.md
 - docs/compliance.md
 - docs/configuration.md
 - docs/dsa-notice-form.md
+- docs/images/moderate-user-report-block-actions.webp
 - docs/madmin.md
 - docs/notifications.md
 - examples/aws_rekognition_adapter.rb
 - examples/openai_moderation_adapter.rb
-- gemfiles/rails_7.1.gemfile
-- gemfiles/rails_7.2.gemfile
+- examples/regexp_pattern_adapter.rb
+- gemfiles/rails_8.0.gemfile
 - gemfiles/rails_8.1.gemfile
 - lib/generators/moderate/install_generator.rb
 - lib/generators/moderate/templates/create_moderate_tables.rb.erb
 - lib/generators/moderate/templates/initializer.rb
 - lib/generators/moderate/views_generator.rb
 - lib/moderate.rb
+- lib/moderate/attachments.rb
 - lib/moderate/configuration.rb
 - lib/moderate/engine.rb
 - lib/moderate/errors.rb
@@ -163,22 +171,24 @@ files:
 - lib/moderate/models/appeal.rb
 - lib/moderate/models/application_record.rb
 - lib/moderate/models/block.rb
+- lib/moderate/models/classification.rb
 - lib/moderate/models/concerns/actor.rb
 - lib/moderate/models/concerns/content_filterable.rb
+- lib/moderate/models/concerns/deferred_notices.rb
 - lib/moderate/models/concerns/reportable.rb
 - lib/moderate/models/flag.rb
 - lib/moderate/models/report.rb
 - lib/moderate/result.rb
+- lib/moderate/retention.rb
 - lib/moderate/services/intake_appeal.rb
 - lib/moderate/services/intake_notice.rb
 - lib/moderate/services/intake_report.rb
 - lib/moderate/services/resolve_appeal.rb
 - lib/moderate/services/resolve_flag.rb
 - lib/moderate/services/resolve_report.rb
-- lib/moderate/text.rb
 - lib/moderate/text_validator.rb
 - lib/moderate/version.rb
-- lib/moderate/word_list.rb
+- lib/tasks/moderate.rake
 - log/development.log
 - log/test.log
 - sig/moderate.rbs
@@ -199,14 +209,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.2.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Let your Rails users report content and block each other (Trust & Safety)
 test_files: []

data/gemfiles/rails_7.2.gemfile

@@ -1,36 +0,0 @@
-# This file was generated by Appraisal
-
-source "https://rubygems.org"
-
-gem "rake", "~> 13.0"
-gem "rails", "~> 7.2.0"
-
-group :development do
-  gem "appraisal"
-  gem "web-console"
-  gem "standard"
-  gem "rubocop", "~> 1.0"
-  gem "rubocop-minitest", "~> 0.35"
-  gem "rubocop-performance", "~> 1.0"
-end
-
-group :test do
-  gem "minitest", "~> 5.0"
-  gem "mocha"
-  gem "simplecov", require: false
-  gem "activejob"
-  gem "actionmailer"
-  gem "activestorage"
-  gem "sqlite3"
-  gem "pg"
-  gem "mysql2"
-  gem "bootsnap", require: false
-  gem "puma"
-  gem "importmap-rails"
-  gem "sprockets-rails"
-  gem "stimulus-rails"
-  gem "turbo-rails"
-  gem "rdoc", ">= 7.0"
-end
-
-gemspec path: "../"