moderate 1.0.0.beta1 → 1.0.0

data/lib/moderate/models/flag.rb

@@ -16,6 +16,8 @@ module Moderate
   # consumer (e.g. a job that auto-actions high-confidence flags), so the gem
   # doesn't presume a human is the only reviewer.
   class Flag < ApplicationRecord
+    include Moderate::DeferredNotices
+
     self.table_name = "moderate_flags"
 
     STATUSES = %w[pending actioned dismissed].freeze
@@ -48,6 +50,7 @@ module Moderate
     # NotNullViolation on MySQL. (SQLite/PostgreSQL get the defaults from the
     # migration; coalescing is harmless there.)
     before_save :default_json_columns
+    before_save :sync_pending_key
 
     # Announce a new flag through the host's notify hook so admins get pinged (e.g.
     # a Telegram alert) the moment content is flagged. after_create_COMMIT, not
@@ -60,6 +63,10 @@ module Moderate
     scope :dismissed, -> { where(status: "dismissed") }
     scope :recent_first, -> { order(created_at: :desc) }
 
+    # Stripped wherever it is assigned (and in `where(field: …)`), so a field never
+    # differs by surrounding spaces: neither in what a moderator reads nor in the
+    # pending_key, which MySQL's utf8mb4_bin compares ignoring trailing spaces (PAD SPACE).
+    normalizes :field, with: :strip.to_proc
     validates :field, presence: true
     validates :status, inclusion: { in: STATUSES }
     validates :source, inclusion: { in: ->(_flag) { sources } }, on: :create
@@ -71,20 +78,136 @@ module Moderate
     # whatever shape a Moderate::Result exposed without each one re-normalizing.
     # `context` is freeform JSON for audit (which policy fired, the raw classifier
     # payload, etc.) — never relied on by the gem's own logic.
+    #
+    # `owner` is kept only if it is a person (the configured user class): hosts
+    # commonly pass `record.reported_owner`, which can be a desk or a bot.
+    #
+    # AT MOST ONE PENDING FLAG PER CONTENT + FIELD, enforced by the database (the
+    # unique `pending_key`, see #sync_pending_key). If a flag already waits on this
+    # field, the insert collides and that waiting flag is returned instead: the
+    # content is already in the queue (`flag.previously_new_record?` is false). This
+    # holds whatever the isolation level or snapshot, because uniqueness is checked
+    # against what is committed, and the waiting flag is then read with a LOCKING
+    # read (the latest committed row, also under MySQL's REPEATABLE READ).
+    #
+    # On MySQL an insert colliding with a flag that is being decided can be chosen as
+    # a deadlock victim: InnoDB queues the duplicate check as a lock on the gap the
+    # decided flag's index entry moves into. When this call is the whole transaction
+    # (the filters' after_commit, ClassifyJob, the admin button) it is simply tried
+    # again; inside a caller's transaction InnoDB has rolled that transaction back
+    # too, so ActiveRecord::Deadlocked is raised for the caller to retry.
+    #
+    # Up to ATTEMPTS tries, then the last failure is raised as it was:
+    # ActiveRecord::Deadlocked if the database kept choosing this insert as a deadlock
+    # victim, ActiveRecord::RecordNotUnique only if, after a collision, no pending
+    # flag could be found to join (each one was decided before it could be read).
     def self.flag!(flaggable:, field:, owner:, source:, mode:, excerpt:, categories:, scores:, context:)
-      create!(
+      attributes = {
         flaggable: flaggable,
         field: field,
-        owner: owner,
+        owner: (owner if owner.is_a?(Moderate.user_class)),
         source: source,
         mode: mode,
         excerpt: excerpt,
         categories: Array(categories),
         scores: scores.to_h,
         context: context.to_h
+      }
+
+      attempts = 0
+      begin
+        attempts += 1
+        # A savepoint, so a collision doesn't poison a surrounding transaction.
+        transaction(requires_new: true) { create!(attributes) }
+      rescue ActiveRecord::RecordNotUnique
+        waiting = waiting_flag(pending_key_for(flaggable.class.polymorphic_name, flaggable.id, field.to_s.strip))
+        return waiting if waiting&.pending?
+        raise if attempts >= ATTEMPTS
+
+        retry # the waiting flag was decided while we looked: its key is free
+      rescue ActiveRecord::Deadlocked
+        # The caller's transaction died with ours: theirs to retry, as a whole.
+        raise if connection.transaction_open? || attempts >= ATTEMPTS
+
+        retry
+      end
+    end
+
+    ATTEMPTS = 3
+
+    # The pending_key a pending flag on that content and field carries.
+    def self.pending_key_for(flaggable_type, flaggable_id, field)
+      "#{flaggable_type}/#{flaggable_id}/#{field}"
+    end
+
+    # The flag waiting under `key`, by a locking read: on MySQL a plain read could
+    # return the transaction's older snapshot, without the flag the insert collided with.
+    def self.waiting_flag(key)
+      where(pending_key: key).lock.first
+    end
+    private_class_method :waiting_flag
+
+    # An administrator filing `record`'s `field` for review by hand — the "Flag for
+    # review" button on a transcript line or a profile page. It lands in the same
+    # `pending` queue the filters feed, to be decided like any other flag. Nothing is
+    # removed or sanctioned here.
+    #
+    #   flag = Moderate::Flag.flag_for_review!(message, field: :body, by: current_user)
+    #   flag.previously_new_record?   # => true if filed now, false if one already waited
+    #
+    # ONCE per field: if a pending flag on that field already waits, it is returned
+    # instead of a second one. The check and the insert run under the RECORD's row
+    # lock, so two administrators pressing it together file one flag (a check-then-
+    # insert without the lock files two). The record must be persisted.
+    #
+    # The flag is `source: "manual"`, owned by the person responsible for the record
+    # (Moderate.responsible_user), with an excerpt from the record's evidence snapshot
+    # (or the field's text), and `context` naming who filed it and their note. The
+    # filing is audited as `:flag_filed` with the administrator as actor.
+    def self.flag_for_review!(record, field:, by:, note: nil)
+      field_s = field.to_s.strip
+      raise ArgumentError, "field is required" if field_s.empty?
+      unless record.respond_to?(:persisted?) && record.persisted?
+        raise ArgumentError, "#{record.class.name} must be persisted to be flagged"
+      end
+
+      note = note.to_s.strip.presence
+      # No lock taken first and no plain read deciding anything: the insert either
+      # files the flag or collides with the one already waiting (the unique
+      # pending_key), which Flag.flag! then returns. Only on that collision does it
+      # lock a row, the waiting flag's, so the lock order (Moderate.with_row_lock)
+      # holds: it never holds content while waiting on a flag.
+      flag = file_for_review!(record, field_s, by: by, note: note)
+      audit_filed_for_review(flag, by: by, note: note) if flag.previously_new_record?
+      flag
+    end
+
+    def self.file_for_review!(record, field, by:, note:)
+      flag!(
+        flaggable: record, field: field, owner: Moderate.responsible_user(record),
+        source: "manual", mode: "flag", excerpt: review_excerpt(record, field),
+        categories: [], scores: {}, context: { "flagged_by_id" => by&.id, "note" => note }.compact
       )
     end
 
+    def self.audit_filed_for_review(flag, by:, note:)
+      payload = {
+        flag_id: flag.id, flaggable_type: flag.flaggable_type, flaggable_id: flag.flaggable_id,
+        field: flag.field, note: note,
+        summary: "Flag ##{flag.id} filed by hand on #{flag.flaggable_label} · #{flag.field_label}"
+      }
+      Moderate.audit(:flag_filed, subject: flag, actor: by, payload: payload.compact)
+    end
+
+    # What the reviewer reads in the queue: the record's evidence snapshot for the
+    # field (the same text a report would freeze), else the field's own text.
+    def self.review_excerpt(record, field)
+      text = record.moderation_snapshot(field) if record.respond_to?(:moderation_snapshot)
+      text = record.public_send(field) if text.nil? && record.respond_to?(field)
+      text.to_s.truncate(500) if text.is_a?(String) && text.present?
+    end
+    private_class_method :file_for_review!, :audit_filed_for_review, :review_excerpt
+
     def self.sources
       (SOURCES + Moderate.config.adapters.keys.map(&:to_s)).uniq
     end
@@ -97,6 +220,48 @@ module Moderate
       status.in?(%w[actioned dismissed])
     end
 
+    # Close this flag as ACTIONED — someone (or an automated policy) took
+    # action on the flagged content. Sugar over Moderate::Services::ResolveFlag
+    # (row lock, re-check, audit), mirroring Report#resolve!/#dismiss!.
+    # `by:` is the reviewing user when a human decided; leave it nil for
+    # automated closes — recording a human who never looked would poison the
+    # audit trail (DSA statements of reasons read these rows).
+    #
+    # Enforce from the flag itself — the bridge every host used to hand-write:
+    #
+    #   flag.action!(by: admin, note: "Slur", remove_content: true)
+    #   flag.action!(by: admin, note: "Repeat offender", ban_user: true)
+    #
+    # Either option escalates to a report (the open one on the same content and
+    # field, or a system one) and resolves it, so the content is removed through
+    # the reportable's `remove_reported_field!`, the ban through your `ban_handler`,
+    # and the affected user gets the statement of reasons and the appeal window a
+    # restriction requires. `flag.report` is that report afterwards.
+    def action!(note:, by: nil, **enforcement)
+      Moderate::Services::ResolveFlag.new(self, by: by).action!(note: note, **enforcement)
+    end
+
+    # The queue-wide verb: Report#resolve! and Flag#resolve! take the same
+    # keywords, so one admin action (Moderate::Moderation#resolve) decides both.
+    alias resolve! action!
+
+    # Close this flag with NO action taken. The canonical automated use is
+    # SUPERSEDED content: when the flagged field changes (text edited, photo
+    # replaced/reverted), a still-pending flag is about content that is no
+    # longer live — leaving it pending keeps `flagged?` true and mislabels
+    # the NEW content in any host UI keyed on it. Hosts should dismiss with a
+    # note saying what superseded it.
+    def dismiss!(note:, by: nil)
+      Moderate::Services::ResolveFlag.new(self, by: by).dismiss!(note: note)
+    end
+
+    # The report an enforcing `action!` went through, or nil (a triage-only close,
+    # or a flag still pending).
+    def report
+      report_id = context.to_h["report_id"]
+      Moderate::Report.find_by(id: report_id) if report_id.present?
+    end
+
     # A label for the flagged thing in the queue. Asks the flaggable for its own
     # `moderation_label` (Moderate::Reportable interface); falls back to a generic
     # "Type id" string for content that doesn't implement it.
@@ -106,8 +271,38 @@ module Moderate
       "#{flaggable_type} #{flaggable_id}"
     end
 
+    # What humans call the flagged field ("Chat message", not "body"). Same
+    # resolution as Report#reported_field_label, so a queue that lists reports and
+    # flags side by side names a field the same way in both. Works after the
+    # flagged record is gone (falls back to `flaggable_type`).
+    def field_label
+      Moderate.reportable_field_label(flaggable || flaggable_type, field)
+    end
+
+    # Lock the row (`with_lock`, `lock!`) — and, for a pending flag, its entry in the
+    # unique pending_key index FIRST. InnoDB keeps a row in two places, and a flag's
+    # two are taken in opposite orders otherwise: an insert colliding on the key
+    # (Flag.flag!) holds the index entry and then waits for the row, while closing the
+    # flag holds the row and then, freeing the key, needs the entry — a deadlock. One
+    # order, entry then row, everywhere. On PostgreSQL and SQLite it re-locks the
+    # same row (or nothing): harmless.
+    def lock!(lock = true) # rubocop:disable Style/OptionalBooleanParameter -- Rails' signature
+      key = pending_key if persisted? && !has_changes_to_save?
+      self.class.unscoped.where(pending_key: key).lock(lock).ids if key
+      super
+    end
+
     private
 
+    # A pending flag carries its content + field's pending_key; any other status
+    # carries NULL, so closing a flag (ResolveFlag, or any save that changes its
+    # status) frees the key in the same transaction, and reopening one takes it back
+    # (raising RecordNotUnique if another flag is pending there by then). Writes that
+    # skip callbacks (update_column/update_all on status) must set it themselves.
+    def sync_pending_key
+      self.pending_key = (Flag.pending_key_for(flaggable_type, flaggable_id, field) if pending?)
+    end
+
     # See the before_save comment: keep the NOT-NULL JSON columns non-null on MySQL.
     def default_json_columns
       self.categories ||= []
@@ -126,9 +321,10 @@ module Moderate
           flaggable_type: flaggable_type,
           flaggable_id: flaggable_id,
           field: field,
+          field_label: field_label,
           source: source,
           categories: Array(categories),
-          summary: "content flagged (#{source}) on #{flaggable_label}##{field}"
+          summary: "content flagged (#{source}) on #{flaggable_label} · #{field_label}"
         }
       )
     end

data/lib/moderate/models/report.rb

@@ -19,6 +19,8 @@ module Moderate
   # what fields may be reported are all answered by the polymorphic `has_reportable_content`
   # (through the `Moderate::Reportable` interface), never by anything domain-specific.
   class Report < ApplicationRecord
+    include Moderate::DeferredNotices
+
     self.table_name = "moderate_reports"
 
     STATUSES = %w[open actioned dismissed].freeze
@@ -86,6 +88,11 @@ module Moderate
     # locate the *report itself* (and vice versa) — GlobalID verifies the purpose on
     # the way back out. See https://github.com/rails/globalid#signed-global-ids.
     # The strings are gem-stable ("moderate_*") and host-agnostic.
+    #
+    # @api private: build a report target with `record.to_moderation_sgid` (or the
+    # `moderate_report_target_path` helper) and read one back with
+    # `Report.locate_signed_reportable`; appeal links with `report.signed_appeal_gid`.
+    # The strings never change (tokens already sent out carry them).
     SIGNED_GLOBAL_ID_PURPOSE = "moderate_report"
     APPEAL_SIGNED_GLOBAL_ID_PURPOSE = "moderate_appeal"
 
@@ -98,6 +105,9 @@ module Moderate
     # receipt for this seeded record", "also block the reported user"). They never
     # persist; the services read them. Kept here so both the model and its services
     # share one definition.
+    #
+    # `skip_received_notice` is public (seed and import scripts set it).
+    # `block_reported_user` is @api private: say `report!(…, block: true)`.
     attr_accessor :skip_received_notice, :block_reported_user
 
     # All actor associations resolve to the HOST's configured user class, read
@@ -113,6 +123,10 @@ module Moderate
 
     has_many :appeals, class_name: "Moderate::Appeal", dependent: :destroy
 
+    # The decision that removed this report's content while this report was pending
+    # (stamped by that decision); see ResolveReport's covering removal.
+    belongs_to :covered_by, class_name: "Moderate::Report", foreign_key: :covered_by_report_id, optional: true
+
     # The auto-filter flags that touched the SAME (record, field) this report is
     # about. Used to disclose automated means at intake (Art. 17(3)(c)) — if the
     # wordlist/image adapter already flagged this exact content, the decision email
@@ -126,8 +140,10 @@ module Moderate
       foreign_key: :flaggable_id
 
     before_validation :normalize_strings
+    before_validation :default_community_message, on: :create
     before_validation :hydrate_reporter_contact, if: :reporter
     before_validation :infer_reported_user, on: :create
+    before_validation :infer_content_type, on: :create
     before_validation :capture_snapshot, on: :create
     before_validation :capture_automated_processing, on: :create
     # Default the JSON columns to their empty shape before save. WHY: the migration
@@ -192,8 +208,11 @@ module Moderate
     validates :resolution_basis, inclusion: { in: RESOLUTION_BASES }, allow_blank: true
     validate :reporter_cannot_report_self
     validate :reportable_field_must_be_allowed
+    validate :reporter_must_be_allowed_to_report, on: :create
     validate :subject_url_must_be_http_url
-    validate :public_notice_requires_subject_url
+    # At intake only: a report whose content is deleted later has its pointer
+    # nullified, and must still be decidable.
+    validate :public_notice_requires_subject_url, on: :create
     validate :dsa_notice_must_be_substantiated
     validate :anonymous_notice_only_for_child_safety
 
@@ -207,6 +226,17 @@ module Moderate
       Array(Moderate.config.report_categories).map(&:to_s).presence || DEFAULT_CATEGORIES
     end
 
+    # The community categories in effect as `[label, value]` pairs, in the current
+    # locale, ready for a report form's select:
+    #
+    #   f.select :category, Moderate::Report.category_options
+    #
+    # Honors `config.report_categories` (a host list's own values are labeled from
+    # `moderate.categories.<value>`, else humanized). See Moderate.taxonomy_label.
+    def self.category_options
+      report_categories.map { |category| [Moderate.taxonomy_label(:category, category), category] }
+    end
+
     # --- Signed-GlobalID locators --------------------------------------------
 
     # Resolve a signed token back into the reported content. Prefer the
@@ -225,6 +255,8 @@ module Moderate
     # Resolve a signed token back into the Report it was minted for (used by the
     # public appeal flow, where the appellant arrives via an emailed signed link).
     # Locked to `self` so the token can only ever name a Report.
+    #
+    # @api private: the public appeal form's lookup.
     def self.locate_signed_appeal_report(token)
       return if token.blank?
 
@@ -237,6 +269,10 @@ module Moderate
       status == "open"
     end
 
+    # Awaiting a decision — the record-level twin of the `pending` scope, so one
+    # predicate reads the same across Report, Flag and Appeal queues.
+    alias pending? open?
+
     def actioned?
       status == "actioned"
     end
@@ -282,16 +318,27 @@ module Moderate
       subject_url.presence || I18n.t("moderate.reports.legal_notice_label", default: "Legal notice")
     end
 
-    # The snapshotted text of the reported field, asked of the reportable. Returns
-    # nil when the reportable doesn't expose snapshot text (or there's no record).
-    def reported_content_text
-      return unless reportable.respond_to?(:moderation_snapshot)
+    # What humans call the reported field ("Chat message", not "body"), or nil when
+    # the report targets the whole record. Resolved from the reportable's CLASS, so
+    # the label survives the content being deleted: deleting a reportable nullifies
+    # BOTH polymorphic columns (`dependent: :nullify`), so we fall back to the type
+    # frozen into the evidence snapshot. See Moderate.reportable_field_label.
+    def reported_field_label
+      type = reportable_type.presence || snapshot.to_h.with_indifferent_access[:reportable_type]
+      Moderate.reportable_field_label(reportable || type, reported_field)
+    end
 
-      reportable.moderation_snapshot(reported_field)
+    # The reported field's text as it was when the report was filed: the evidence
+    # snapshot taken at intake, so it survives the content being edited or deleted.
+    # nil when the reportable exposed no text, or once a purge redacted the report.
+    def reported_content_text
+      snapshot.to_h.with_indifferent_access[:content_text]
     end
 
     # --- Signed GIDs for emailed links ---------------------------------------
 
+    # @api private: an expiring token for the reported content. Use the reportable's
+    # `to_moderation_sgid`, which doesn't expire.
     def signed_reportable_gid
       reportable&.to_sgid_param(for: SIGNED_GLOBAL_ID_PURPOSE)
     end
@@ -326,6 +373,8 @@ module Moderate
     # `update_column` skips validations/callbacks on purpose — this is a timestamp
     # stamp, not a content change, and must succeed even on an already-validated row.
     # Idempotent: only sets the first acknowledgement.
+    #
+    # @api private: stamped by the intake services.
     def acknowledge!(at: Time.current)
       update_column(:acknowledged_at, at) if acknowledged_at.blank?
     end
@@ -333,6 +382,8 @@ module Moderate
     # DSA Art. 20(1): open the redress (appeal) window for at least six months after
     # the decision. Stamped once when the report is decided; idempotent so re-running
     # a decision flow doesn't slide the deadline.
+    #
+    # @api private: stamped by the decision services.
     def close_redress_window!(at: resolved_at || Time.current)
       update_column(:appeal_deadline_at, at + APPEAL_WINDOW) if appeal_deadline_at.blank?
     end
@@ -344,8 +395,8 @@ module Moderate
     # out-of-transaction notify, statement-of-reasons + appeal-window stamping); this
     # only forwards. `by:` is the moderator; the rest (`note:`, `remove_content:`,
     # `ban_user:`, `resolution_basis:`) pass straight through.
-    def resolve!(by:, **options)
-      Moderate::Services::ResolveReport.new(self, by: by).resolve!(**options)
+    def resolve!(by:, **)
+      Moderate::Services::ResolveReport.new(self, by: by).resolve!(**)
     end
 
     # Dismiss this report (no action taken) — sugar over
@@ -354,6 +405,39 @@ module Moderate
       Moderate::Services::ResolveReport.new(self, by: by).dismiss!(note: note)
     end
 
+    # Which delivery timestamp each decision notice confirms (Moderate.delivered!).
+    DELIVERY_COLUMNS = {
+      decision: :decision_notified_at,          # report_decision, to the reporter / notifier
+      affected_user: :affected_user_notified_at # affected_user_decision, the statement of reasons
+    }.freeze
+
+    # DSA Art. 20(2): the (at least) six-month appeal window starts when the person
+    # is INFORMED of the decision, not when it was taken. The decision stamps
+    # `appeal_deadline_at` six months from itself, a minimum. When the host confirms
+    # that a decision notice actually went out (Moderate.delivered!, called from the
+    # mailer's delivery, not when it was queued), its timestamp is stamped, once, and
+    # the deadline moves to six months after it, never earlier. Later confirmations
+    # change nothing.
+    #
+    # @api private: call Moderate.delivered!(report, :decision | :affected_user).
+    def record_delivery!(recipient, at: Time.current)
+      column = DELIVERY_COLUMNS.fetch(recipient.to_sym) do
+        raise ArgumentError, "unknown decision notice #{recipient.inspect}; one of: #{DELIVERY_COLUMNS.keys.join(", ")}"
+      end
+
+      with_lock do
+        next if self[column].present? || resolved_at.blank?
+
+        update_columns(column => at, appeal_deadline_at: [appeal_deadline_at, at + APPEAL_WINDOW].compact.max)
+      end
+      self
+    end
+
+    # Under a legal hold right now (Moderate.hold)? The purge leaves it alone.
+    def held?(at: Time.current)
+      held_until.present? && held_until > at
+    end
+
     # DSA Art. 17(3)(c): did automated means (a wordlist/image/remote classifier)
     # participate in surfacing or deciding this report? The decision email reads this
     # to truthfully state whether automation was used. We treat the disclosure as
@@ -365,7 +449,7 @@ module Moderate
 
       return true if boolean.cast(automation["used"])
 
-      automation.except("used").values.any? { |value| value == true || value == "true" }
+      automation.except("used").values.any? { |value| [true, "true"].include?(value) }
     end
 
     private
@@ -432,6 +516,18 @@ module Moderate
       self.resolution_note = resolution_note.to_s.strip.presence
     end
 
+    # An in-app reporter's free text is optional: the category they picked IS the
+    # reason (a person who was just insulted shouldn't have to write an essay). The
+    # column is NOT NULL and the queue needs something to read, so a blank message
+    # becomes the category's label, in the reporter's language. A DSA notice must
+    # still be substantiated in the notifier's own words (Art. 16(2)(a)), so this
+    # never applies to one.
+    def default_community_message
+      return unless community? && message.blank? && category.present?
+
+      self.message = Moderate.taxonomy_label(:category, category)
+    end
+
     # When an authenticated user files the report, copy their contact onto the
     # notifier fields so DSA notices and community reports carry the same identity
     # shape downstream. We read `email`/`display_name` via `try` so the host's user
@@ -445,11 +541,31 @@ module Moderate
     # (its `reported_owner`, per the Moderate::Reportable interface). This is how a
     # report against a piece of content becomes a report "about" the user who posted
     # it — without this model knowing anything about the host's ownership model.
+    # Only a person is stored: an owner that isn't the configured user class (a
+    # support desk, a bot) means "nobody to reach" — see Moderate.responsible_user.
     def infer_reported_user
       return if reported_user.present?
-      return unless reportable.respond_to?(:reported_owner)
 
-      self.reported_user = reportable.reported_owner
+      self.reported_user = Moderate.responsible_user(reportable)
+    end
+
+    # The generic content bucket, from the reportable when the caller didn't name
+    # one: `moderation_content_type` (with or without the field — chats' takes none),
+    # kept if it is one of CONTENT_TYPES and filed as "other" if it isn't, so a
+    # host's own word ("ride") can never fail an intake. A caller's explicit value
+    # (the DSA notice form's select) is left alone.
+    def infer_content_type
+      return if content_type.present?
+
+      value = reportable_content_type
+      self.content_type = CONTENT_TYPES.include?(value) ? value : "other" if value
+    end
+
+    def reportable_content_type
+      return unless reportable.respond_to?(:moderation_content_type)
+
+      reader = reportable.method(:moderation_content_type)
+      (reader.arity.zero? ? reader.call : reader.call(reported_field)).to_s.squish.presence
     end
 
     # Capture an IMMUTABLE evidence snapshot at create time. This is the heart of a
@@ -472,11 +588,18 @@ module Moderate
         legal_country_code: legal_country_code,
         content_type: content_type,
         reported_account_identifier: reported_account_identifier,
-        content_text: reported_content_text,
+        content_text: live_content_text,
         captured_at: Time.current.iso8601
       }.compact
     end
 
+    # The reported field's text now, asked of the reportable (what the snapshot keeps).
+    def live_content_text
+      return unless reportable.respond_to?(:moderation_snapshot)
+
+      reportable.moderation_snapshot(reported_field)
+    end
+
     def capture_automated_processing
       evidence = automated_processing_evidence
       return if evidence.blank?
@@ -504,12 +627,50 @@ module Moderate
     # isn't a managed reportable), we don't constrain the field.
     def reportable_field_must_be_allowed
       return if reportable.blank?
+      return if escalated_from_this_flag?
       return unless reportable.respond_to?(:reportable_field_allowed?)
       return if reportable.reportable_field_allowed?(reported_field)
 
       errors.add(:reported_field, I18n.t("moderate.errors.invalid_reported_field", default: "is not a reportable field"))
     end
 
+    # An in-app (community) report from a signed-in person must be about something
+    # that person may report: the reportable's own `report_visible_to?` (never your
+    # own content; for chats, only a conversation you're in). The report affordance
+    # hides itself on that rule, but a hidden link is not a check: a signed target
+    # pasted or replayed from elsewhere reached the model unchecked until now. DSA
+    # notices (anyone may notify) and system reports (no reporter) are not affected.
+    # The self-report and field rules above already explain their own refusals.
+    def reporter_must_be_allowed_to_report
+      return unless visibility_checked?
+      return if reportable.report_visible_to?(reporter, field: reported_field)
+
+      message = I18n.t("moderate.errors.not_reportable_by_reporter", default: "isn't something you can report")
+      errors.add(:reportable, message)
+    end
+
+    # The Moderate::Flag a system report was opened from (Flag#action! enforcing).
+    # Such a report may name the flag's field even if people can't report that field.
+    # Private: only Services::ResolveFlag sets it, so it isn't mass-assignable or a
+    # general way around the field whitelist.
+    attr_accessor :escalated_from_flag
+
+    # The report was opened from a flag on THIS content and field (Flag#action!) —
+    # a system report: no reporter, community intake, never a DSA notice.
+    def escalated_from_this_flag?
+      flag = escalated_from_flag
+      return false unless flag.is_a?(Moderate::Flag) && community? && reporter.nil?
+
+      flag.field.to_s == reported_field.to_s &&
+        flag.flaggable_type == reportable_type && flag.flaggable_id.to_s == reportable_id.to_s
+    end
+
+    def visibility_checked?
+      return false unless community? && reporter.present? && reportable.respond_to?(:report_visible_to?)
+
+      errors.exclude?(:reported_user) && errors.exclude?(:reported_field)
+    end
+
     def subject_url_must_be_http_url
       invalid_urls = subject_url_list.reject { |url| parsed_subject_uri(url).present? }
       return if invalid_urls.empty?
@@ -545,7 +706,9 @@ module Moderate
       return unless anonymous?
       return if legal_reason == "protection_of_minors"
 
-      errors.add(:anonymous, I18n.t("moderate.errors.anonymous_notice_child_safety_only", default: "anonymous notices are only allowed for offences against minors"))
+      errors.add(:anonymous,
+        I18n.t("moderate.errors.anonymous_notice_child_safety_only",
+          default: "anonymous notices are only allowed for offences against minors"))
     end
 
     # Accept either a multi-URL list or newline-separated text, fold in the single
@@ -579,7 +742,8 @@ module Moderate
     def automated_processing_evidence
       evidence = {}
 
-      matching_flags = flags.to_a
+      # A manual flag is an administrator's own judgment, not automated means.
+      matching_flags = flags.reject { |flag| flag.source == "manual" }
       if matching_flags.any?
         evidence["used"] = true
         evidence["flag_ids"] = matching_flags.map(&:id)
@@ -591,7 +755,7 @@ module Moderate
       if result&.flagged?
         evidence["used"] = true
         evidence["field"] = reported_field
-        evidence["sources"] = Array(evidence["sources"]).concat([result.source]).compact.uniq
+        evidence["sources"] = Array(evidence["sources"]).push(result.source).compact.uniq
         evidence["categories"] = Array(evidence["categories"]).concat(result.categories).compact.uniq
         evidence["scores"] = result.scores
         # `raw` is the untouched provider payload (Moderate::Result#raw) — kept for
@@ -611,7 +775,7 @@ module Moderate
       policy = Moderate.filter_policy_for(reportable, reported_field)
       return unless policy.block?
 
-      value = reported_content_text
+      value = live_content_text
       return if value.blank?
 
       Moderate.classify(value, policy: policy)

data/lib/moderate/result.rb

@@ -109,15 +109,8 @@ module Moderate
     # Reconcile the two accepted shapes (`labels:` and `categories:`+`scores:`)
     # into one frozen array of `Moderate::Label`.
     def build_labels(labels, categories, scores_hash)
-      out = []
-
-      Array(labels).each do |label|
-        out << coerce_label(label, scores_hash)
-      end
-
-      Array(categories).each do |category|
-        out << label_from_slug(category.to_s, scores_hash)
-      end
+      out = Array(labels).map { |label| coerce_label(label, scores_hash) }
+      out += Array(categories).map { |category| label_from_slug(category.to_s, scores_hash) }
 
       out
     end
@@ -145,7 +138,7 @@ module Moderate
     end
 
     def label_from_hash(hash, scores_hash)
-      hash = hash.transform_keys { |k| k.to_s }
+      hash = hash.transform_keys(&:to_s)
       category = hash["category"]
       subcategory = hash["subcategory"]
       slug = subcategory ? "#{category}/#{subcategory}" : category.to_s