@de-otio/trellis 0.10.11 → 0.12.0

package/prisma/migrations/20260625000001_p0b_moderation_jobs/migration.sql

@@ -0,0 +1,73 @@
+-- P0b: moderation job tracking — schema additions.
+--
+-- Summary of changes:
+--   ~ media_files.original_key: DROP NOT NULL (nullable for video pending transcode)
+--   ~ media_files.content_hash: DROP NOT NULL (null until the worker hashes the
+--     transcoded bytes; @@unique([tenant, content_hash]) tolerates many NULLs)
+--   + media_files.upload_id (TEXT, UNIQUE, nullable) — client idempotency key
+--   + CREATE TYPE moderation_track AS ENUM ('VISUAL', 'AUDIO')
+--   + CREATE TABLE media_moderation_jobs — per-track job records with FK + indexes
+--   + CREATE TABLE processed_moderation_messages — SQS exactly-once dedup table
+--
+-- Not deployed standalone: consumed by Trellis as an npm dependency; migration
+-- is applied when Trellis bumps @de-otio/trellis and runs prisma migrate deploy.
+
+-- AlterTable: make original_key nullable (video rows have no key until post-transcode)
+ALTER TABLE "media_files"
+    ALTER COLUMN "original_key" DROP NOT NULL;
+
+-- AlterTable: make content_hash nullable (video has no hash until the worker
+-- hashes the transcoded bytes; the within-tenant unique tolerates many NULLs)
+ALTER TABLE "media_files"
+    ALTER COLUMN "content_hash" DROP NOT NULL;
+
+-- AlterTable: add upload_id for client-side idempotency
+ALTER TABLE "media_files"
+    ADD COLUMN "upload_id" TEXT;
+
+-- CreateIndex: unique constraint on upload_id (one row per upload session)
+CREATE UNIQUE INDEX "media_files_upload_id_key" ON "media_files"("upload_id");
+
+-- CreateEnum: moderation track discriminator
+CREATE TYPE "ModerationTrack" AS ENUM ('VISUAL', 'AUDIO');
+
+-- CreateTable: per-track moderation job records
+CREATE TABLE "media_moderation_jobs" (
+    "id"                 TEXT NOT NULL,
+    "media_id"           TEXT NOT NULL,
+    "track"              "ModerationTrack" NOT NULL,
+    "job_id"             TEXT NOT NULL,
+    "decision"           TEXT,
+    "threshold_snapshot" JSONB NOT NULL,
+    "created_at"         TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at"         TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "media_moderation_jobs_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex: unique constraint on job_id (one row per provider job)
+CREATE UNIQUE INDEX "media_moderation_jobs_job_id_key" ON "media_moderation_jobs"("job_id");
+
+-- CreateIndex: lookup jobs by media (used by the pipeline to find in-flight jobs)
+CREATE INDEX "media_moderation_jobs_media_id_idx" ON "media_moderation_jobs"("media_id");
+
+-- CreateIndex: lookup by job_id (used by the result-callback path)
+CREATE INDEX "media_moderation_jobs_job_id_idx" ON "media_moderation_jobs"("job_id");
+
+-- AddForeignKey: media_moderation_jobs -> media_files (cascade on delete)
+ALTER TABLE "media_moderation_jobs"
+    ADD CONSTRAINT "media_moderation_jobs_media_id_fkey"
+    FOREIGN KEY ("media_id") REFERENCES "media_files"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- CreateTable: SQS exactly-once dedup for moderation result messages
+CREATE TABLE "processed_moderation_messages" (
+    "id"                  TEXT NOT NULL,
+    "message_dedupe_key"  TEXT NOT NULL,
+    "processed_at"        TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "processed_moderation_messages_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex: unique constraint on dedupe key (collision = duplicate message)
+CREATE UNIQUE INDEX "processed_moderation_messages_message_dedupe_key_key"
+    ON "processed_moderation_messages"("message_dedupe_key");

package/prisma/schema.prisma

@@ -66,6 +66,18 @@ enum EntityStatus {
   TRANSFERRED
 }
 
+// Media moderation lifecycle state. Mirrors the hand-written ModerationStatus
+// union in apps/api/src/lib/media/moderation-status.ts — spelling must match.
+// Every new MediaFile is born PENDING (fail-closed); only the moderation
+// pipeline can advance to APPROVED.
+enum ModerationStatus {
+  PENDING
+  APPROVED
+  REVIEW
+  QUARANTINED
+  REJECTED
+}
+
 model PostGeoIndex {
   postUri   String   @id @map("post_uri")
   // Multi-tenancy — denormalized from the owning post; location data is
@@ -180,7 +192,7 @@ model User {
   // migration. (WebFinger/AP still resolve on `username` until the federation
   // repoint — that change is code-only, no data migration, since `handle` is the
   // stable key.)
-  handle    String  @unique
+  handle    String   @unique
   createdAt DateTime @default(now()) @map("created_at")
 
   // Cognito Auth integration
@@ -360,6 +372,11 @@ model User {
   notifications          Notification[]
   notificationPreference NotificationPreference?
 
+  // Realtime / server-blind settings sync
+  encryptedSettings EncryptedUserSetting[]
+  blocksInitiated   BlockedUser[]          @relation("BlockedUserBlocker")
+  blockedBy         BlockedUser[]          @relation("BlockedUserBlocked")
+
   // Connection codes (out-of-band invite mechanism)
   createdConnectionCodes  ConnectionCode[]           @relation("ConnectionCodeCreator")
   redeemedConnectionCodes ConnectionCodeRedemption[]
@@ -600,16 +617,32 @@ model Post {
   @@map("posts")
 }
 
-// Media files (content-addressed storage)
+// Media files (tenant-scoped content-addressed storage).
+// tenantId is NOT NULL — every object belongs to exactly one tenant.
+// Dedup is within-tenant: @@unique([tenantId, contentHash]).
+// Every new object is born PENDING (fail-closed); the moderation pipeline
+// advances objects to APPROVED before they can be served.
 model MediaFile {
   id           String  @id @default(cuid())
-  contentHash  String  @unique @map("content_hash") // SHA-256 hash
+  tenantId     String  @map("tenant_id") // Tenant that owns this object (NOT NULL)
+  contentHash  String? @map("content_hash") // SHA-256 hash (lowercase hex); null until post-transcode for video (set by the P0b worker)
   cid          String? @unique // AT Protocol CID (optional, for compatibility)
   mimeType     String  @map("mime_type")
   size         Int
-  originalKey  String  @map("original_key") // S3 key: media/{hash}.{ext}
-  thumbnailKey String? @map("thumbnail_key") // S3 key: media/{hash}_thumb.webp
-  optimizedKey String? @map("optimized_key") // S3 key: media/{hash}_opt.webp
+  // uploadId: client-side idempotency key for the upload session. Nullable
+  // because rows created before P0b (or via the reconciliation path) have no
+  // upload session. UNIQUE so the same upload cannot race into two rows.
+  uploadId     String? @unique @map("upload_id")
+  // originalKey: S3 CAS key for the raw ingested object. Nullable for video —
+  // the CAS key is computed post-transcode by the pipeline worker; the row
+  // exists before transcoding completes.
+  originalKey  String? @map("original_key") // S3 key: cas/{tenantId}/{hash} (null until transcode for video)
+  thumbnailKey String? @map("thumbnail_key") // S3 key: cas/{tenantId}/{hash}/thumb
+  optimizedKey String? @map("optimized_key") // S3 key: cas/{tenantId}/{hash}/opt
+
+  // Moderation state — the lifecycle gate (see ModerationStatus enum above).
+  // Default PENDING means every object is fail-closed until approved.
+  moderationStatus ModerationStatus @default(PENDING) @map("moderation_status")
 
   // Media metadata (extracted from file headers)
   width    Int? // Image/video width in pixels
@@ -622,13 +655,13 @@ model MediaFile {
   videoMetadata Json? @map("video_metadata")
 
   // Denormalized/unified metadata fields
-  dateTaken    DateTime? @map("date_taken")
-  gpsLatitude  Float?    @map("gps_latitude")
-  gpsLongitude Float?    @map("gps_longitude")
-  keywords     String[]  @default([]) @map("keywords")
+  // GPS coordinates are NOT stored — dropped at ingestion (data-minimization).
+  dateTaken DateTime? @map("date_taken")
+  keywords  String[]  @default([]) @map("keywords")
 
-  // Privacy flags
-  metadataVisible Boolean @default(true) @map("metadata_visible")
+  // Privacy flags. metadataVisible defaults false: metadata is private unless
+  // the owner explicitly shares it (data-minimization default).
+  metadataVisible Boolean @default(false) @map("metadata_visible")
   locationVisible Boolean @default(false) @map("location_visible")
 
   // Media visibility and deletion tracking
@@ -654,16 +687,18 @@ model MediaFile {
   updatedAt DateTime @updatedAt @map("updated_at")
 
   // Relations
-  posts PostMedia[] // Many-to-many with posts
+  posts          PostMedia[] // Many-to-many with posts
+  moderationJobs MediaModerationJob[] // P0b: per-track moderation job records
 
-  @@index([contentHash])
+  @@unique([tenantId, contentHash]) // Within-tenant dedup (replaces bare contentHash @unique)
   @@index([cid])
+  @@index([moderationStatus]) // Gate queries: find PENDING for the moderation queue
+  @@index([tenantId, contentHash]) // Serve path: tenant-scoped CAS lookup
   @@index([hidden, deletedAt]) // For filtering visible media
   @@index([createdAt]) // For chronological sorting
   @@index([dateTaken])
   @@index([metadataVisible])
   @@index([locationVisible])
-  @@index([gpsLatitude, gpsLongitude])
   @@index([uploadStatus])
   @@index([uploadedBy])
   @@index([uploadBatchId])
@@ -688,6 +723,54 @@ model UploadSession {
   @@map("upload_sessions")
 }
 
+// ============================================================================
+// P0b — Moderation job tracking
+// ============================================================================
+
+// Discriminator for the two parallel moderation tracks.
+// VISUAL — frame/thumbnail-level visual content analysis.
+// AUDIO  — speech-to-text + audio content analysis.
+enum ModerationTrack {
+  VISUAL
+  AUDIO
+}
+
+// One row per (media, track) moderation job submitted to an external provider.
+// decision is String (not an enum) so the schema stays decoupled from
+// ModerationDecision evolution; app code validates the value on read.
+// thresholdSnapshot captures the operative thresholds at job-submission time
+// so historical decisions remain auditable after a threshold change.
+model MediaModerationJob {
+  id                String          @id @default(cuid())
+  mediaId           String          @map("media_id")
+  media             MediaFile       @relation(fields: [mediaId], references: [id], onDelete: Cascade)
+  track             ModerationTrack
+  // jobId: the external provider's job identifier (unique per provider call).
+  jobId             String          @unique @map("job_id")
+  // decision: resolved ModerationDecision value, or null while the job is in flight.
+  decision          String?
+  // thresholdSnapshot: a copy of env.media.thresholds at submission time (JSON).
+  thresholdSnapshot Json            @map("threshold_snapshot")
+  createdAt         DateTime        @default(now()) @map("created_at")
+  updatedAt         DateTime        @updatedAt @map("updated_at")
+
+  @@index([mediaId])
+  @@index([jobId])
+  @@map("media_moderation_jobs")
+}
+
+// Deduplication table for SQS moderation-result messages (exactly-once delivery).
+// A row is inserted (with ON CONFLICT DO NOTHING / unique-constraint) before
+// processing; duplicate deliveries of the same message find the row present and
+// are skipped. Rows may be pruned after a retention window by a cron worker.
+model ProcessedModerationMessage {
+  id               String   @id @default(cuid())
+  messageDedupeKey String   @unique @map("message_dedupe_key")
+  processedAt      DateTime @default(now()) @map("processed_at")
+
+  @@map("processed_moderation_messages")
+}
+
 // Post media
 model PostMedia {
   id       String  @id @default(cuid())
@@ -1748,6 +1831,7 @@ model Tenant {
   connectionCodes           ConnectionCode[]
   connectionCodeRedemptions ConnectionCodeRedemption[]
   notifications             Notification[]
+  blockedUsers              BlockedUser[]
 
   // Denormalized tenant_id on by-relation children (P1 — for direct RLS).
   postMedia           PostMedia[]
@@ -2013,3 +2097,37 @@ enum EntityRelationshipStatus {
   CONFIRMED
   REJECTED
 }
+
+// Realtime / server-blind settings sync — opaque AEAD blob the server cannot read.
+model EncryptedUserSetting {
+  id         String   @id @default(cuid())
+  userId     String   @map("user_id")
+  namespace  String // allowlisted, e.g. "feed_filters"
+  ciphertext String   @db.Text // opaque AEAD blob; the server cannot read it
+  version    Int      @default(1) // monotonic per (user, namespace)
+  updatedAt  DateTime @updatedAt @map("updated_at")
+  createdAt  DateTime @default(now()) @map("created_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, namespace])
+  @@index([userId])
+  @@map("encrypted_user_settings")
+}
+
+// Realtime delivery safety floor — blocked-sender relation (who blocks whom).
+model BlockedUser {
+  id        String   @id @default(cuid())
+  tenantId  String   @map("tenant_id")
+  blockerId String   @map("blocker_id")
+  blockedId String   @map("blocked_id")
+  createdAt DateTime @default(now()) @map("created_at")
+
+  tenant  Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+  blocker User   @relation("BlockedUserBlocker", fields: [blockerId], references: [id], onDelete: Cascade)
+  blocked User   @relation("BlockedUserBlocked", fields: [blockedId], references: [id], onDelete: Cascade)
+
+  @@unique([tenantId, blockerId, blockedId])
+  @@index([tenantId, blockerId])
+  @@map("blocked_users")
+}