@meith/web 0.21.2 → 0.23.0

package/bin/forum-web.test.ts

@@ -36,14 +36,6 @@ describe('rebaseGlobalsCssSources', () => {
     expect(rewritten).toContain('.foo { color: red; }')
   })
 
-  /**
-   * Against the real shipped file, not a fixture: this rebase now runs on
-   * every materialization including the default one, where it must be a
-   * no-op. Every `@source` in that file is written relative to the workspace
-   * root, and this only stays a no-op while that holds — a `@source` meaning
-   * anything else (`../fonts`, for `src/fonts`) would be silently retargeted
-   * at the workspace root, and fails here instead.
-   */
   const shippedGlobalsCss = readFileSync(
     new URL('../src/styles/globals.css', import.meta.url),
     'utf8',
@@ -87,13 +79,6 @@ describe('rebaseGlobalsCssSources', () => {
     ).toBe(css)
   })
 
-  /**
-   * MEI-131. A scaffolded board has none of the directories these sources
-   * name — the same code is installed under `node_modules/@meith` — and
-   * Tailwind emits no utilities for a source it cannot scan while still
-   * exiting 0, so the failure is a board that serves an unstyled page rather
-   * than a build that stops.
-   */
   describe('in a board, where none of those directories exist', () => {
     const inBoard = (path: string) => path.includes('node_modules')
 
@@ -157,13 +142,6 @@ describe('rebaseGlobalsCssSources', () => {
   })
 })
 
-/**
- * `forum-web start --at-root` materializes and then stops, because there is
- * no standalone build for it to exec — which makes it the whole
- * materialization path in under a tenth of a second, with no `next build`
- * anywhere near it. Materialization is the part that has been wrong; the
- * build is not.
- */
 const BIN = fileURLToPath(new URL('./forum-web.mjs', import.meta.url))
 
 function materializeAtRoot(dir: string) {

package/next.config.mjs

@@ -1,33 +1,13 @@
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const here = path.dirname(fileURLToPath(import.meta.url))
 
-/**
- * Two directories up from this file's own location by default — correct
- * where `forum-web` materializes at `.meith/app` and where this file sits in
- * `apps/community` unmaterialized. `boards/stock` and `forum-web --at-root`
- * are both at other depths, and neither relies on this default:
- * `FORUM_WORKSPACE_ROOT` is set for the first by that board's own scripts
- * and passed on by `forum-web` in every case, so this fallback only applies
- * when the file is read outside that bin entirely (see
- * docs/architecture.md, "The stock board"; docs/development.md, "Consuming
- * the board from a workspace").
- */
 const workspaceRoot = process.env.FORUM_WORKSPACE_ROOT
   ? path.resolve(process.env.FORUM_WORKSPACE_ROOT)
   : path.join(here, '../../')
 
-/**
- * The relative equivalent of `workspaceRoot`, for `outputFileTracingIncludes`
- * below — see docs/development.md, "Consuming the board from a workspace",
- * for why that option needs a path relative to this file rather than an
- * absolute one. It is `.` rather than the empty string when this file already
- * sits at the workspace root, which is what `forum-web build --at-root`
- * materializes (same section) — an empty prefix would make the glob below
- * read as an absolute path and match nothing.
- */
 const upToWorkspaceRoot = path.relative(here, workspaceRoot).split(path.sep).join('/') || '.'
 
 const loadedEnvFiles = []
@@ -42,6 +22,8 @@ if (process.env.NODE_ENV !== 'production' && loadedEnvFiles.length > 0) {
   console.log(`- Environments: ${loadedEnvFiles.join(', ')} (${workspaceRoot})`)
 }
 
+const FRAMEWORK_PACKAGES = ['next', 'react', 'react-dom']
+
 const nextConfig = {
   ...(process.env.VERCEL ? {} : { output: 'standalone' }),
   poweredByHeader: false,
@@ -58,11 +40,9 @@ const nextConfig = {
     'nodemailer',
   ],
   outputFileTracingRoot: workspaceRoot,
-  /** See docs/development.md, "Consuming the board from a workspace", for why this is set. */
   turbopack: {
     root: workspaceRoot,
   },
-  /** Works around a gap in Next's own tracing — see docs/development.md, "Consuming the board from a workspace". */
   outputFileTracingIncludes: {
     '/**': [
       `${upToWorkspaceRoot}/node_modules/.pnpm/@swc+helpers@0.5.23/node_modules/@swc/helpers/**/*`,
@@ -72,12 +52,6 @@ const nextConfig = {
   images: {
     unoptimized: true,
   },
-  /**
-   * Every `@meith/*` package this app's dependency graph reaches, not just the
-   * ones apps/community imports directly — see docs/development.md,
-   * "Consuming the board from a workspace", and docs/release.md, "They ship
-   * TypeScript source, deliberately".
-   */
   transpilePackages: [
     '@meith/accounts',
     '@meith/admin',
@@ -103,6 +77,7 @@ const nextConfig = {
     '@meith/messages',
     '@meith/moderation',
     '@meith/notifications',
+    '@meith/plugin-calendar',
     '@meith/plugin-dues',
     '@meith/plugin-kit',
     '@meith/polls',
@@ -146,4 +121,15 @@ const nextConfig = {
   },
 }
 
+const boardManifestFile = path.join(workspaceRoot, 'package.json')
+if (existsSync(boardManifestFile)) {
+  const boardManifest = JSON.parse(readFileSync(boardManifestFile, 'utf8'))
+  for (const name of Object.keys(boardManifest.dependencies ?? {})) {
+    if (FRAMEWORK_PACKAGES.includes(name)) continue
+    if (nextConfig.serverExternalPackages.includes(name)) continue
+    if (nextConfig.transpilePackages.includes(name)) continue
+    nextConfig.transpilePackages.push(name)
+  }
+}
+
 export default nextConfig

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/web",
-  "version": "0.21.2",
+  "version": "0.23.0",
   "description": "The board itself: the Next.js app, and the forum-web bin that materializes it into an external board workspace.",
   "license": "MIT",
   "repository": {
@@ -35,60 +35,61 @@
   "dependencies": {
     "@swc/helpers": "0.5.23",
     "@tailwindcss/postcss": "^4.3.3",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
     "next": "16.3.1",
     "postcss": "^8.5",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "tailwindcss": "^4.3.3",
     "typescript": "7.0.2",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
-    "@meith/accounts": "0.21.2",
-    "@meith/admin": "0.21.2",
-    "@meith/antispam": "0.21.2",
-    "@meith/authorization": "0.21.2",
-    "@meith/api": "0.21.2",
-    "@meith/attachments": "0.21.2",
-    "@meith/avatars": "0.21.2",
-    "@meith/db": "0.21.2",
-    "@meith/core": "0.21.2",
-    "@meith/demo": "0.21.2",
-    "@meith/drivers": "0.21.2",
-    "@meith/events": "0.21.2",
-    "@meith/drafts": "0.21.2",
-    "@meith/forums": "0.21.2",
-    "@meith/i18n": "0.21.2",
-    "@meith/import": "0.21.2",
-    "@meith/groups": "0.21.2",
-    "@meith/install": "0.21.2",
-    "@meith/mail": "0.21.2",
-    "@meith/markdown": "0.21.2",
-    "@meith/marketplace": "0.21.2",
-    "@meith/messages": "0.21.2",
-    "@meith/moderation": "0.21.2",
-    "@meith/plugin-dues": "0.21.2",
-    "@meith/notifications": "0.21.2",
-    "@meith/polls": "0.21.2",
-    "@meith/plugin-kit": "0.21.2",
-    "@meith/reputation": "0.21.2",
-    "@meith/relations": "0.21.2",
-    "@meith/profile-fields": "0.21.2",
-    "@meith/runtime": "0.21.2",
-    "@meith/settings": "0.21.2",
-    "@meith/search": "0.21.2",
-    "@meith/posts": "0.21.2",
-    "@meith/signatures": "0.21.2",
-    "@meith/subscriptions": "0.21.2",
-    "@meith/theme-clubhouse": "0.21.2",
-    "@meith/theme-default": "0.21.2",
-    "@meith/tasks": "0.21.2",
-    "@meith/theme-kit": "0.21.2",
-    "@meith/theme-phasebook": "0.21.2",
-    "@meith/theme-raidframe": "0.21.2",
-    "@meith/theme-midnight": "0.21.2",
-    "@meith/threads": "0.21.2",
-    "@meith/ui": "0.21.2",
-    "@meith/upgrade": "0.21.2"
+    "@meith/accounts": "0.23.0",
+    "@meith/admin": "0.23.0",
+    "@meith/antispam": "0.23.0",
+    "@meith/api": "0.23.0",
+    "@meith/attachments": "0.23.0",
+    "@meith/authorization": "0.23.0",
+    "@meith/avatars": "0.23.0",
+    "@meith/core": "0.23.0",
+    "@meith/db": "0.23.0",
+    "@meith/demo": "0.23.0",
+    "@meith/drafts": "0.23.0",
+    "@meith/drivers": "0.23.0",
+    "@meith/events": "0.23.0",
+    "@meith/forums": "0.23.0",
+    "@meith/groups": "0.23.0",
+    "@meith/i18n": "0.23.0",
+    "@meith/import": "0.23.0",
+    "@meith/install": "0.23.0",
+    "@meith/mail": "0.23.0",
+    "@meith/markdown": "0.23.0",
+    "@meith/marketplace": "0.23.0",
+    "@meith/messages": "0.23.0",
+    "@meith/moderation": "0.23.0",
+    "@meith/notifications": "0.23.0",
+    "@meith/plugin-calendar": "0.23.0",
+    "@meith/plugin-dues": "0.23.0",
+    "@meith/plugin-kit": "0.23.0",
+    "@meith/polls": "0.23.0",
+    "@meith/posts": "0.23.0",
+    "@meith/profile-fields": "0.23.0",
+    "@meith/relations": "0.23.0",
+    "@meith/reputation": "0.23.0",
+    "@meith/search": "0.23.0",
+    "@meith/runtime": "0.23.0",
+    "@meith/settings": "0.23.0",
+    "@meith/signatures": "0.23.0",
+    "@meith/subscriptions": "0.23.0",
+    "@meith/tasks": "0.23.0",
+    "@meith/theme-clubhouse": "0.23.0",
+    "@meith/theme-default": "0.23.0",
+    "@meith/theme-kit": "0.23.0",
+    "@meith/theme-midnight": "0.23.0",
+    "@meith/theme-phasebook": "0.23.0",
+    "@meith/theme-raidframe": "0.23.0",
+    "@meith/threads": "0.23.0",
+    "@meith/ui": "0.23.0",
+    "@meith/upgrade": "0.23.0"
   },
   "scripts": {
     "dev": "next dev",

package/proxy.ts

@@ -48,20 +48,6 @@ interface Policy {
   readonly value: string
 }
 
-/**
- * Passes the request through, and hands a reader something to be counted by.
- *
- * The cookie is minted here because the Edge is the only place that can set one
- * on an ordinary page response — a render cannot. The row it stands for is
- * written by the render, which has the database this runtime does not.
- *
- * Whether the client *returned* the cookie is the load-bearing part, and it
- * cannot be read downstream: Next reflects a cookie set here into the request
- * the render sees, so a first-ever visit is indistinguishable from a returning
- * one by cookie alone. Hence the header — set when the cookie is new, deleted
- * otherwise, so a crawler that never keeps one is never counted and a client
- * cannot supply its own.
- */
 function withPath(req: NextRequest, policy: Policy): NextResponse {
   const fresh = !req.cookies.has(GUEST_COOKIE) && !req.cookies.has(DEV_GUEST_COOKIE)
 

package/src/components/account/notification-forms.tsx

@@ -6,6 +6,7 @@ import { EMPTY_STATE } from '@/server/auth-form-state'
 import {
   markAllNotificationsReadAction,
   markNotificationReadAction,
+  saveMassMailOptInAction,
   saveNotificationPreferencesAction,
 } from '@/server/notification-actions'
 
@@ -155,3 +156,47 @@ export function NotificationPreferencesForm({
     </form>
   )
 }
+
+export function AnnouncementsOptInForm({ optedIn, copy }: { optedIn: boolean; copy: Copy }) {
+  const [state, action] = useActionState(saveMassMailOptInAction, EMPTY_STATE)
+
+  return (
+    <form
+      action={action}
+      className="flex flex-col gap-4 rounded-lg border border-border bg-card p-5"
+    >
+      <FormError message={state.error} />
+
+      <fieldset className="flex flex-col gap-3">
+        <legend className="text-sm font-medium">
+          {fromCopy(copy, 'accountForm.announcements.legend')}
+        </legend>
+
+        <label className="flex items-start gap-3 text-sm">
+          <input
+            type="checkbox"
+            name="announcements"
+            defaultChecked={optedIn}
+            className={`mt-1 ${CHECKBOX}`}
+          />
+          <span>
+            <span className="font-medium">{fromCopy(copy, 'accountForm.announcements.title')}</span>
+            <span className="block text-muted-foreground">
+              {fromCopy(copy, 'accountForm.announcements.description')}
+            </span>
+          </span>
+        </label>
+      </fieldset>
+
+      <p className="text-xs text-muted-foreground">
+        {fromCopy(copy, 'accountForm.announcements.blurb')}
+      </p>
+
+      <div>
+        <button type="submit" className={BUTTON}>
+          {fromCopy(copy, 'accountForm.announcements.submit')}
+        </button>
+      </div>
+    </form>
+  )
+}

package/src/components/admin/admin-nav.tsx

@@ -8,10 +8,6 @@ import { ADMIN_OVERVIEW, adminNavWithPlugin, pluginKeyAt } from '@/view/admin-na
 import type { PanelNav, PanelSection } from '@/view/panel-nav'
 import { pluginNavChildren } from '@/view/plugin-panel'
 
-/**
- * A plugin may reorder, drop, or add a section here. A link it adds reaches a
- * page it declared and nothing else — the panel re-checks who is asking.
- */
 async function withPluginSections(nav: PanelNav, t: Awaited<ReturnType<typeof getTranslator>>) {
   const links = await filterView(
     'admin.navigation',

package/src/components/admin/ban-filter-forms.tsx

@@ -0,0 +1,104 @@
+'use client'
+
+import { useActionState } from 'react'
+
+import { EMPTY_STATE } from '@/server/auth-form-state'
+import { addBanFilterAction, removeBanFilterAction } from '@/server/ban-filter-admin-actions'
+
+import { FormError, SubmitButton } from '../auth/form-controls'
+import { type Copy, formatFromCopy, fromCopy } from '../shell/copy'
+import { INPUT, Saved } from './form-bits'
+
+export interface BanFilterTypeOption {
+  readonly value: string
+  readonly label: string
+}
+
+export function NewBanFilterForm({
+  types,
+  copy,
+}: {
+  types: readonly BanFilterTypeOption[]
+  copy: Copy
+}) {
+  const [state, action] = useActionState(addBanFilterAction, EMPTY_STATE)
+
+  return (
+    <form action={action} className="flex flex-col gap-3" noValidate>
+      <FormError message={state.error} />
+      <Saved when={state.notice === 'created'}>{fromCopy(copy, 'adminBanFilter.added')}</Saved>
+
+      <div className="grid gap-3 sm:grid-cols-2">
+        <label className="flex flex-col gap-1 text-sm">
+          <span className="font-medium">{fromCopy(copy, 'adminBanFilter.type')}</span>
+          <select
+            name="type"
+            defaultValue={state.values?.type ?? types[0]?.value ?? ''}
+            className={INPUT}
+          >
+            {types.map((type) => (
+              <option key={type.value} value={type.value}>
+                {type.label}
+              </option>
+            ))}
+          </select>
+          <span className="text-xs text-muted-foreground">
+            {fromCopy(copy, 'adminBanFilter.typeHint')}
+          </span>
+        </label>
+
+        <label className="flex flex-col gap-1 text-sm">
+          <span className="font-medium">{fromCopy(copy, 'adminBanFilter.pattern')}</span>
+          <input
+            name="pattern"
+            defaultValue={state.values?.pattern ?? ''}
+            className={INPUT}
+            placeholder={fromCopy(copy, 'adminBanFilter.patternPlaceholder')}
+            required
+          />
+          <span className="text-xs text-muted-foreground">
+            {fromCopy(copy, 'adminBanFilter.patternHint')}
+          </span>
+        </label>
+      </div>
+
+      <label className="flex flex-col gap-1 text-sm">
+        <span className="font-medium">{fromCopy(copy, 'adminBanFilter.note')}</span>
+        <input name="note" defaultValue={state.values?.note ?? ''} className={INPUT} />
+        <span className="text-xs text-muted-foreground">
+          {fromCopy(copy, 'adminBanFilter.noteHint')}
+        </span>
+      </label>
+
+      <div>
+        <SubmitButton>{fromCopy(copy, 'adminBanFilter.addFilter')}</SubmitButton>
+      </div>
+    </form>
+  )
+}
+
+export function RemoveBanFilterForm({
+  id,
+  pattern,
+  copy,
+}: {
+  id: number
+  pattern: string
+  copy: Copy
+}) {
+  const [state, action] = useActionState(removeBanFilterAction, EMPTY_STATE)
+
+  return (
+    <form action={action} className="flex flex-col items-end gap-1">
+      <FormError message={state.error} />
+      <input type="hidden" name="id" value={id} />
+      <button
+        type="submit"
+        className="text-xs text-destructive hover:underline"
+        aria-label={formatFromCopy(copy, 'adminBanFilter.removeFilter', { pattern })}
+      >
+        {fromCopy(copy, 'admin.remove')}
+      </button>
+    </form>
+  )
+}

package/src/components/admin/marketplace-listing.tsx

@@ -12,15 +12,6 @@ const TONE_CLASS: Readonly<Record<StatusTone, string>> = {
   destructive: 'bg-destructive/10 text-destructive',
 }
 
-/**
- * One catalog entry, plugin or theme alike — the row model already carries
- * everything both browse pages need, so this is the one place that renders
- * it. Every string here is either our own catalog copy or a value from
- * `MarketplaceListingRow`, which has already capped lengths and validated
- * URLs against the untrusted feed (see `apps/community/src/server/marketplace-admin.ts`);
- * nothing here uses `dangerouslySetInnerHTML`, so the feed's own text is
- * rendered as plain text no matter what it contains.
- */
 export function MarketplaceListingCard({
   listing,
   t,

package/src/components/auth/passkey-client.ts

@@ -105,11 +105,6 @@ export async function signInWithPasskey(next: string | undefined, copy: Copy): P
   return assertPasskey('authenticate', next, copy)
 }
 
-/**
- * The same exchange, against a sign-in that has already given its password.
- * The board scopes the challenge to that member's own credentials, so the
- * browser offers only the keys that could finish this particular sign-in.
- */
 export async function confirmWithPasskey(next: string | undefined, copy: Copy): Promise<string> {
   return assertPasskey('second-factor', next, copy)
 }

package/src/components/auth/register-form.tsx

@@ -105,6 +105,24 @@ export function RegisterForm({
         </>
       )}
 
+      <label className="flex items-start gap-2 text-sm text-muted-foreground">
+        <input
+          type="checkbox"
+          name="announcements"
+          value="1"
+          defaultChecked={state.values?.announcements === '1'}
+          className="mt-0.5 size-4 rounded border-input accent-primary"
+        />
+        <span>
+          <span className="block text-foreground">
+            {fromCopy(copy, 'authForm.register.announcements')}
+          </span>
+          <span className="block text-xs">
+            {fromCopy(copy, 'authForm.register.announcementsHint')}
+          </span>
+        </span>
+      </label>
+
       {terms !== null && (
         <label className="flex items-start gap-2 text-sm text-muted-foreground">
           <input

package/src/components/board/section-page.tsx

@@ -4,6 +4,7 @@ import { currentRequestId } from '@meith/core/logger'
 import type { ForumListingRow } from '@meith/forums'
 import { requireSlot, slotCopy } from '@meith/theme-kit'
 
+import { activeWordFilter } from '@/server/content-admin'
 import { getActor } from '@/server/context'
 import { identitiesFor } from '@/server/group-identity'
 import { getTranslator } from '@/server/i18n'
@@ -44,6 +45,7 @@ export async function SectionPage({
     now: new Date(),
     t: await getTranslator(),
     identities,
+    wordFilter: await activeWordFilter(),
   })
 
   const pluginContext = viewerRef(actor)

package/src/components/content/composer-ids.ts

@@ -1,4 +1,3 @@
-/** The default `id` a page's `EditorToolbar` and the composer's textarea agree on. */
 export const MESSAGE_TEXTAREA_ID = 'post-message'
 
 export function attachmentFieldId(textareaId: string): string {

package/src/components/content/markdown-editor.tsx

@@ -84,13 +84,6 @@ export interface MarkdownEditorProps {
   readonly hint?: React.ReactNode
   readonly scope?: PreviewScope
   readonly attachTo?: AttachmentTarget | undefined
-  /**
-   * Whether the formatting buttons render inside this component (`'inline'`,
-   * the default — every composer outside the post/reply/edit pages) or are
-   * left to the page's `EditorToolbar` slot (`'external'`), which addresses
-   * this textarea by `id` from a different part of the tree. Either way the
-   * textarea works with none of them: the buttons are the enhancement.
-   */
   readonly toolbar?: 'inline' | 'external' | undefined
 }
 

package/src/components/shell/demo-banner.tsx

@@ -2,14 +2,6 @@ import { demoBannerModel } from '@/server/demo'
 import { getTranslator } from '@/server/i18n'
 import { splitAround } from '@/view/copy'
 
-/**
- * The strip at the top of a demo board.
- *
- * Rendered from the root layout rather than through a theme slot, on purpose:
- * the slot contract is frozen, and a visiting administrator can switch themes.
- * A banner a theme could decline to render is a banner that stops telling the
- * next visitor how to log in, on the first theme that has not heard of it.
- */
 export async function DemoBanner() {
   const banner = await demoBannerModel()
   if (banner === null) return null

package/src/config.ts

@@ -1,13 +1,2 @@
-/**
- * `@meith/web/config` — the surface a board's own `community.config.ts`
- * builds against.
- *
- * A scaffolded board depends on `@meith/web` for the app itself, and imports
- * its board-time registry through this subpath rather than reaching into
- * `@meith/core` directly. That indirection is what lets `@meith/web` change
- * which package actually defines `defineForumConfig` without every board's
- * `community.config.ts` following along.
- */
-
 export type { ForumConfig, InstalledPlugin, InstalledTheme, MessageBundle } from '@meith/core'
 export { defineForumConfig } from '@meith/core'

package/src/server/admin-actions.ts

@@ -103,11 +103,6 @@ export async function adminSignInAction(_prev: FormState, form: FormData): Promi
   redirect(target)
 }
 
-/**
- * The panel's door asks for the second factor as well as the password. The
- * panel can rewrite the whole board, so re-proving only the thing most likely
- * to have leaked would be re-proving the wrong one.
- */
 async function adminReauthenticationBucket(userId: number): Promise<string> {
   const prefix = await retainedIpPrefix()
   return prefix === null ? `admin-reauth:${userId}` : `admin-reauth:${userId}@${prefix}`

package/src/server/antispam.ts

@@ -16,7 +16,7 @@ import {
   type RateLimitOutcome,
   subjectFor,
 } from '@meith/antispam'
-import type { Actor, NumericGlobalPermission } from '@meith/authorization'
+import type { Actor, NumericGlobalPermission, Target } from '@meith/authorization'
 import { env, logger } from '@meith/core'
 import { getDb, PostgresCaptchaQuestionRepository, PostgresRateLimitBucketStore } from '@meith/db'
 import type { SettingsSnapshot } from '@meith/settings'
@@ -280,29 +280,42 @@ export async function verifyChallenge(form: FormData): Promise<ChallengeVerdict>
   }
 }
 
+const FIRST_POST_UNRESOLVED = 'could not resolve first-post moderation'
+
+function bypassesModeration(actor: Actor, target: Target): boolean {
+  try {
+    return getContainer().authorizer.can(actor, 'content.viewUnapproved', target)
+  } catch (error) {
+    logger().warn({ err: String(error), stage: 'bypass', held: true }, FIRST_POST_UNRESOLVED)
+    return false
+  }
+}
+
 export async function holdsNewMember(input: {
   readonly actor: Actor
   readonly postCount: number
+  readonly target: Target
   readonly settings?: SettingsSnapshot
 }): Promise<boolean> {
+  let threshold = 0
   try {
     const settings = input.settings ?? (await getSettings())
-    const threshold = Number(settings.get('antispam.moderate_first_posts') ?? 0)
-    if (threshold <= 0) return false
-
-    const { authorizer } = getContainer()
-    return holdsForReview(
-      {
-        userId: input.actor.userId,
-        postCount: input.postCount,
-        bypassesModeration: authorizer.can(input.actor, 'content.viewUnapproved'),
-      },
-      { threshold },
-    )
+    threshold = Number(settings.get('antispam.moderate_first_posts') ?? 0)
   } catch (error) {
-    logger().warn({ err: String(error) }, 'could not resolve first-post moderation')
+    logger().warn({ err: String(error), stage: 'threshold', held: false }, FIRST_POST_UNRESOLVED)
     return false
   }
+
+  if (threshold <= 0) return false
+
+  return holdsForReview(
+    {
+      userId: input.actor.userId,
+      postCount: input.postCount,
+      bypassesModeration: bypassesModeration(input.actor, input.target),
+    },
+    { threshold },
+  )
 }
 
 export function antispamAvailable(): boolean {

package/src/server/api/search.ts

@@ -84,7 +84,7 @@ export const SEARCH_HANDLERS: ApiRoutes = [
             postId: hit.postId,
             threadId: hit.threadId,
             forumId: hit.forumId,
-            threadTitle: hit.threadTitle,
+            threadTitle: filterWords(hit.threadTitle, wordFilter),
             authorUserId: hit.authorUserId,
             authorUsername: hit.authorUsername,
             postedAt: hit.postedAt.toISOString(),