[DCT-Berinyuy]

Summary

Google Play's user-generated content policy requires that users can report content and block other users. This adds both, plus an admin queue for reviewing reports. Bumps to 1.6.3+9.

Closes #

Changes

• DB (20261019000000_reports_and_blocks.sql):
  • content_reports: insert-only for users; reporter_id comes from the JWT; at most 20 reports per day; a repeat open report for the same target is ignored.
  • user_blocks: RLS limits each user to their own rows.
  • A messages trigger refuses messages between blocked users.
  • Account deletion cleans up both tables.
• Rust: GET /admin/reports, POST /admin/reports/:id/dismiss, POST /admin/reports/:id/remove-listing.
• App:
  • A ⋮ menu on book details and in chat: Report listing, Report seller/user, Block or Unblock.
  • The report sheet takes a reason plus optional details.
  • Blocked sellers are hidden from home, search and the offline cache. Blocked conversations are hidden, and the chat input is replaced by an "unblock" bar.
  • New Profile → Blocked users screen.
  • The block list refreshes on launch and every 2 minutes.
  • New Admin → Reports tab.
  • EN and FR strings.

Deploy order: (1) run the migration in prod, (2) deploy Rust on Render, (3) release the app.

Design notes:

• The chat menu reports the user, not the listing.
• Unblocking from the Blocked users screen has no confirmation step.
• A seller's own profile listings are not filtered.

Test plan

• flutter analyze: 3 issues, all pre-existing (unchanged baseline)
• flutter test --no-pub: 306 passed. New tests cover the moderation data source (request shapes, 23505 and limit handling), the blocked-seller filters in listings and search, the chat conversation filter and blocked send, the moderation and admin viewmodels, the admin data source and the report-sheet widget.
• rustfmt --edition 2021 --check on the changed Rust files: clean. Repo-wide cargo fmt --check already fails on untouched files.
• cargo clippy --all-targets -- -D warnings: clean
• cargo test: passed in CI against the CI database, including the new reports, blocks and account-deletion tests. Correction: locally these DB tests skipped (no local Postgres); an earlier version of this text wrongly said they ran locally.
• Migration is idempotent and was tested against the CI database

Checklist

• Targets dev, not main
• No secrets, keys, or personal data in code, logs, or screenshots
• User input is validated; new tables have RLS policies
• User-facing strings added to both EN and FR ARB files
• Docs updated if behavior changed (CHANGELOG)

Screenshots

Not captured. The UI is covered by widget tests.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
book-bridge	Ready	Preview	Oct 6, 2026 8:48pm UTC