feat: Admin interface for abuse reports (#7905)

- Implementation of milestone 5. from **Task F. Moderation features: Reporting** (part of [amendment of the workplan](https://codeberg.org/forgejo/sustainability/src/branch/main/2022-12-01-nlnet/2025-02-07-extended-workplan.md#task-f-moderation-features-reporting) for NLnet 2022-12-035):
  `5. Forgejo admins can see a list of reports`
  There is a lot of room for improvements, but it was decided to start with a basic version so that feedback can be collected from real-life usages (based on which the UI might change a lot).
- Also covers milestone 2. from same **Task F. Moderation features: Reporting**:
  `2. Reports from multiple users are combined in the database and don't create additional reports.`
  But instead of combining the reports when stored, they are grouped when retrieved (it was concluded _that it might be preferable to take care of the deduplication while implementing the admin interface_; see https://codeberg.org/forgejo/forgejo/pulls/7939#issuecomment-4841754 for more details).

---

Follow-up of !6977

### See also:
- forgejo/design#30

---

This adds a new _Moderation reports_ section (/admin/moderation/reports) within the _Site administration_ page, where administrators can see an overview with the submitted abuse reports that are still open (not yet handled in any way). When multiple reports exist for the same content (submitted by distinct users) only the first one will be shown in the list and a counter can be seen on the right side (indicating the number of open reports for the same content type and ID). Clicking on the counter or the icon from the right side will open the details page where a list with all the reports (when multiple) linked to the reported content is available, as well as any shadow copy saved for the current report(s).
The new section is available only when moderation in enabled ([moderation] ENABLED config is set as true within app.ini).

Discussions regarding the UI/UX started with https://codeberg.org/forgejo/design/issues/30#issuecomment-2908849

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/7905
Reviewed-by: Otto <otto@codeberg.org>
Reviewed-by: jerger <jerger@noreply.codeberg.org>
Co-authored-by: floss4good <floss4good@disroot.org>
Co-committed-by: floss4good <floss4good@disroot.org>
This commit is contained in:
floss4good 2025-07-23 00:20:15 +02:00 committed by Otto
commit d87e2e7e40
23 changed files with 1230 additions and 6 deletions

View file

@ -5,6 +5,7 @@ package issues
import (
"context"
"strconv"
"forgejo.org/models/moderation"
"forgejo.org/modules/json"
@ -24,6 +25,21 @@ type IssueData struct {
UpdatedUnix timeutil.TimeStamp
}
// Implements GetFieldsMap() from ShadowCopyData interface, returning a list of <key, value> pairs
// to be used when rendering the shadow copy for admins reviewing the corresponding abuse report(s).
func (cd IssueData) GetFieldsMap() []moderation.ShadowCopyField {
return []moderation.ShadowCopyField{
{Key: "RepoID", Value: strconv.FormatInt(cd.RepoID, 10)},
{Key: "Index", Value: strconv.FormatInt(cd.Index, 10)},
{Key: "PosterID", Value: strconv.FormatInt(cd.PosterID, 10)},
{Key: "Title", Value: cd.Title},
{Key: "Content", Value: cd.Content},
{Key: "ContentVersion", Value: strconv.Itoa(cd.ContentVersion)},
{Key: "CreatedUnix", Value: cd.CreatedUnix.AsLocalTime().String()},
{Key: "UpdatedUnix", Value: cd.UpdatedUnix.AsLocalTime().String()},
}
}
// newIssueData creates a trimmed down issue to be used just to create a JSON structure
// (keeping only the fields relevant for moderation purposes)
func newIssueData(issue *Issue) IssueData {
@ -31,8 +47,8 @@ func newIssueData(issue *Issue) IssueData {
RepoID: issue.RepoID,
Index: issue.Index,
PosterID: issue.PosterID,
Content: issue.Content,
Title: issue.Title,
Content: issue.Content,
ContentVersion: issue.ContentVersion,
CreatedUnix: issue.CreatedUnix,
UpdatedUnix: issue.UpdatedUnix,
@ -50,6 +66,19 @@ type CommentData struct {
UpdatedUnix timeutil.TimeStamp
}
// Implements GetFieldsMap() from ShadowCopyData interface, returning a list of <key, value> pairs
// to be used when rendering the shadow copy for admins reviewing the corresponding abuse report(s).
func (cd CommentData) GetFieldsMap() []moderation.ShadowCopyField {
return []moderation.ShadowCopyField{
{Key: "PosterID", Value: strconv.FormatInt(cd.PosterID, 10)},
{Key: "IssueID", Value: strconv.FormatInt(cd.IssueID, 10)},
{Key: "Content", Value: cd.Content},
{Key: "ContentVersion", Value: strconv.Itoa(cd.ContentVersion)},
{Key: "CreatedUnix", Value: cd.CreatedUnix.AsLocalTime().String()},
{Key: "UpdatedUnix", Value: cd.UpdatedUnix.AsLocalTime().String()},
}
}
// newCommentData creates a trimmed down comment to be used just to create a JSON structure
// (keeping only the fields relevant for moderation purposes)
func newCommentData(comment *Comment) CommentData {

View file

@ -0,0 +1,70 @@
// Copyright 2025 The Forgejo Authors. All rights reserved.
// SPDX-License-Identifier: GPL-3.0-or-later
package issues_test
import (
"testing"
"forgejo.org/models/issues"
"forgejo.org/models/moderation"
"forgejo.org/modules/timeutil"
"github.com/stretchr/testify/assert"
)
const (
tsCreated timeutil.TimeStamp = timeutil.TimeStamp(1753093500) // 2025-07-21 10:25:00 UTC
tsUpdated timeutil.TimeStamp = timeutil.TimeStamp(1753093525) // 2025-07-21 10:25:25 UTC
)
func testShadowCopyField(t *testing.T, scField moderation.ShadowCopyField, key, value string) {
assert.Equal(t, key, scField.Key)
assert.Equal(t, value, scField.Value)
}
func TestIssueDataGetFieldsMap(t *testing.T) {
id := issues.IssueData{
RepoID: 2001,
Index: 2,
PosterID: 1002,
Title: "Professional marketing services",
Content: "Visit my website at promote-your-business.biz for a list of available services.",
ContentVersion: 0,
CreatedUnix: tsCreated,
UpdatedUnix: tsUpdated,
}
scFields := id.GetFieldsMap()
if assert.Len(t, scFields, 8) {
testShadowCopyField(t, scFields[0], "RepoID", "2001")
testShadowCopyField(t, scFields[1], "Index", "2")
testShadowCopyField(t, scFields[2], "PosterID", "1002")
testShadowCopyField(t, scFields[3], "Title", "Professional marketing services")
testShadowCopyField(t, scFields[4], "Content", "Visit my website at promote-your-business.biz for a list of available services.")
testShadowCopyField(t, scFields[5], "ContentVersion", "0")
testShadowCopyField(t, scFields[6], "CreatedUnix", tsCreated.AsLocalTime().String())
testShadowCopyField(t, scFields[7], "UpdatedUnix", tsUpdated.AsLocalTime().String())
}
}
func TestCommentDataGetFieldsMap(t *testing.T) {
cd := issues.CommentData{
PosterID: 1002,
IssueID: 3001,
Content: "Check out [alexsmith/website](/alexsmith/website)",
ContentVersion: 0,
CreatedUnix: tsCreated,
UpdatedUnix: tsUpdated,
}
scFields := cd.GetFieldsMap()
if assert.Len(t, scFields, 6) {
testShadowCopyField(t, scFields[0], "PosterID", "1002")
testShadowCopyField(t, scFields[1], "IssueID", "3001")
testShadowCopyField(t, scFields[2], "Content", "Check out [alexsmith/website](/alexsmith/website)")
testShadowCopyField(t, scFields[3], "ContentVersion", "0")
testShadowCopyField(t, scFields[4], "CreatedUnix", tsCreated.AsLocalTime().String())
testShadowCopyField(t, scFields[5], "UpdatedUnix", tsUpdated.AsLocalTime().String())
}
}

View file

@ -47,14 +47,21 @@ const (
AbuseCategoryTypeIllegalContent // 4
)
var AbuseCategoriesTranslationKeys = map[AbuseCategoryType]string{
AbuseCategoryTypeSpam: "moderation.abuse_category.spam",
AbuseCategoryTypeMalware: "moderation.abuse_category.malware",
AbuseCategoryTypeIllegalContent: "moderation.abuse_category.illegal_content",
AbuseCategoryTypeOther: "moderation.abuse_category.other_violations",
}
// GetAbuseCategoriesList returns a list of pairs with the available abuse category types
// and their corresponding translation keys
func GetAbuseCategoriesList() []AbuseCategoryItem {
return []AbuseCategoryItem{
{AbuseCategoryTypeSpam, "moderation.abuse_category.spam"},
{AbuseCategoryTypeMalware, "moderation.abuse_category.malware"},
{AbuseCategoryTypeIllegalContent, "moderation.abuse_category.illegal_content"},
{AbuseCategoryTypeOther, "moderation.abuse_category.other_violations"},
{AbuseCategoryTypeSpam, AbuseCategoriesTranslationKeys[AbuseCategoryTypeSpam]},
{AbuseCategoryTypeMalware, AbuseCategoriesTranslationKeys[AbuseCategoryTypeMalware]},
{AbuseCategoryTypeIllegalContent, AbuseCategoriesTranslationKeys[AbuseCategoryTypeIllegalContent]},
{AbuseCategoryTypeOther, AbuseCategoriesTranslationKeys[AbuseCategoryTypeOther]},
}
}

View file

@ -0,0 +1,135 @@
// Copyright 2025 The Forgejo Authors. All rights reserved.
// SPDX-License-Identifier: GPL-3.0-or-later
package moderation
import (
"context"
"fmt"
"strings"
"forgejo.org/models/db"
"forgejo.org/modules/setting"
"forgejo.org/modules/timeutil"
"xorm.io/builder"
)
type AbuseReportDetailed struct {
AbuseReport `xorm:"extends"`
ReportedTimes int // only for overview
ReporterName string
ContentReference string
ShadowCopyDate timeutil.TimeStamp // only for details
ShadowCopyRawValue string // only for details
}
func (ard AbuseReportDetailed) ContentTypeIconName() string {
switch ard.ContentType {
case ReportedContentTypeUser:
return "octicon-person"
case ReportedContentTypeRepository:
return "octicon-repo"
case ReportedContentTypeIssue:
return "octicon-issue-opened"
case ReportedContentTypeComment:
return "octicon-comment"
default:
return "octicon-question"
}
}
func (ard AbuseReportDetailed) ContentURL() string {
switch ard.ContentType {
case ReportedContentTypeUser:
return strings.TrimLeft(ard.ContentReference, "@")
case ReportedContentTypeIssue:
return strings.ReplaceAll(ard.ContentReference, "#", "/issues/")
default:
return ard.ContentReference
}
}
func GetOpenReports(ctx context.Context) ([]*AbuseReportDetailed, error) {
var reports []*AbuseReportDetailed
// - For PostgreSQL user table name should be escaped.
// - Escaping can be done with double quotes (") but this doesn't work for MariaDB.
// - For SQLite index column name should be escaped.
// - Escaping can be done with double quotes (") or backticks (`).
// - For MariaDB/MySQL there is no need to escape the above.
// - Therefore we will use double quotes (") but only for PostgreSQL and SQLite.
identifierEscapeChar := ``
if setting.Database.Type.IsPostgreSQL() || setting.Database.Type.IsSQLite3() {
identifierEscapeChar = `"`
}
err := db.GetEngine(ctx).SQL(fmt.Sprintf(`SELECT AR.*, ARD.reported_times, U.name AS reporter_name, REFS.ref AS content_reference
FROM abuse_report AR
INNER JOIN (
SELECT min(id) AS id, count(id) AS reported_times
FROM abuse_report
WHERE status = %[2]d
GROUP BY content_type, content_id
) ARD ON ARD.id = AR.id
LEFT JOIN %[1]suser%[1]s U ON U.id = AR.reporter_id
LEFT JOIN (
SELECT %[3]d AS type, id, concat('@', name) AS "ref"
FROM %[1]suser%[1]s WHERE id IN (
SELECT content_id FROM abuse_report WHERE status = %[2]d AND content_type = %[3]d
)
UNION
SELECT %[4]d AS "type", id, concat(owner_name, '/', name) AS "ref"
FROM repository WHERE id IN (
SELECT content_id FROM abuse_report WHERE status = %[2]d AND content_type = %[4]d
)
UNION
SELECT %[5]d AS "type", I.id, concat(IR.owner_name, '/', IR.name, '#', I.%[1]sindex%[1]s) AS "ref"
FROM issue I
LEFT JOIN repository IR ON IR.id = I.repo_id
WHERE I.id IN (
SELECT content_id FROM abuse_report WHERE status = %[2]d AND content_type = %[5]d
)
UNION
SELECT %[6]d AS "type", C.id, concat(CIR.owner_name, '/', CIR.name, '/issues/', CI.%[1]sindex%[1]s, '#issuecomment-', C.id) AS "ref"
FROM comment C
LEFT JOIN issue CI ON CI.id = C.issue_id
LEFT JOIN repository CIR ON CIR.id = CI.repo_id
WHERE C.id IN (
SELECT content_id FROM abuse_report WHERE status = %[2]d AND content_type = %[6]d
)
) REFS ON REFS.type = AR.content_type AND REFS.id = AR.content_id
ORDER BY AR.created_unix ASC`, identifierEscapeChar, ReportStatusTypeOpen,
ReportedContentTypeUser, ReportedContentTypeRepository, ReportedContentTypeIssue, ReportedContentTypeComment)).
Find(&reports)
if err != nil {
return nil, err
}
return reports, nil
}
func GetOpenReportsByTypeAndContentID(ctx context.Context, contentType ReportedContentType, contentID int64) ([]*AbuseReportDetailed, error) {
var reports []*AbuseReportDetailed
// Some remarks concerning PostgreSQL:
// - user table should be escaped (e.g. `user`);
// - tried to use aliases for table names but errors like 'invalid reference to FROM-clause entry'
// or 'missing FROM-clause entry' were returned;
err := db.GetEngine(ctx).
Select("abuse_report.*, `user`.name AS reporter_name, abuse_report_shadow_copy.created_unix AS shadow_copy_date, abuse_report_shadow_copy.raw_value AS shadow_copy_raw_value").
Table("abuse_report").
Join("LEFT", "user", "`user`.id = abuse_report.reporter_id").
Join("LEFT", "abuse_report_shadow_copy", "abuse_report_shadow_copy.id = abuse_report.shadow_copy_id").
Where(builder.Eq{
"content_type": contentType,
"content_id": contentID,
"status": ReportStatusTypeOpen,
}).
Asc("abuse_report.created_unix").
Find(&reports)
if err != nil {
return nil, err
}
return reports, nil
}

View file

@ -26,6 +26,22 @@ func (sc AbuseReportShadowCopy) NullableID() sql.NullInt64 {
return sql.NullInt64{Int64: sc.ID, Valid: sc.ID > 0}
}
// ShadowCopyField defines a pair of a value stored within the shadow copy
// (of some content reported as abusive) and a corresponding key (caption).
// A list of such pairs is used when rendering shadow copies for admins reviewing abuse reports.
type ShadowCopyField struct {
Key string
Value string
}
// ShadowCopyData interface should be implemented by the type structs used for marshaling/unmarshaling the fields
// preserved as shadow copies for abusive content reports (i.e. UserData, RepositoryData, IssueData, CommentData).
type ShadowCopyData interface {
// GetFieldsMap returns a list of <key, value> pairs with the fields stored within shadow copies
// of content reported as abusive, to be used when rendering a shadow copy in the admin UI.
GetFieldsMap() []ShadowCopyField
}
func init() {
// RegisterModel will create the table if does not already exist
// or any missing columns if the table was previously created.

View file

@ -5,6 +5,8 @@ package repo
import (
"context"
"strconv"
"strings"
"forgejo.org/models/moderation"
"forgejo.org/modules/json"
@ -25,6 +27,22 @@ type RepositoryData struct {
UpdatedUnix timeutil.TimeStamp
}
// Implements GetFieldsMap() from ShadowCopyData interface, returning a list of <key, value> pairs
// to be used when rendering the shadow copy for admins reviewing the corresponding abuse report(s).
func (rd RepositoryData) GetFieldsMap() []moderation.ShadowCopyField {
return []moderation.ShadowCopyField{
{Key: "OwnerID", Value: strconv.FormatInt(rd.OwnerID, 10)},
{Key: "OwnerName", Value: rd.OwnerName},
{Key: "Name", Value: rd.Name},
{Key: "Description", Value: rd.Description},
{Key: "Website", Value: rd.Website},
{Key: "Topics", Value: strings.Join(rd.Topics, ", ")},
{Key: "Avatar", Value: rd.Avatar},
{Key: "CreatedUnix", Value: rd.CreatedUnix.AsLocalTime().String()},
{Key: "UpdatedUnix", Value: rd.UpdatedUnix.AsLocalTime().String()},
}
}
// newRepositoryData creates a trimmed down repository to be used just to create a JSON structure
// (keeping only the fields relevant for moderation purposes)
func newRepositoryData(repo *Repository) RepositoryData {

View file

@ -0,0 +1,51 @@
// Copyright 2025 The Forgejo Authors. All rights reserved.
// SPDX-License-Identifier: GPL-3.0-or-later
package repo_test
import (
"testing"
"forgejo.org/models/moderation"
"forgejo.org/models/repo"
"forgejo.org/modules/timeutil"
"github.com/stretchr/testify/assert"
)
const (
tsCreated timeutil.TimeStamp = timeutil.TimeStamp(1753093500) // 2025-07-21 10:25:00 UTC
tsUpdated timeutil.TimeStamp = timeutil.TimeStamp(1753093525) // 2025-07-21 10:25:25 UTC
)
func testShadowCopyField(t *testing.T, scField moderation.ShadowCopyField, key, value string) {
assert.Equal(t, key, scField.Key)
assert.Equal(t, value, scField.Value)
}
func TestRepositoryDataGetFieldsMap(t *testing.T) {
rd := repo.RepositoryData{
OwnerID: 1002,
OwnerName: "alexsmith",
Name: "website",
Description: "My static website.",
Website: "http://promote-your-business.biz",
Topics: []string{"bulk-email", "email-services"},
Avatar: "avatar-hash-repo-2002",
CreatedUnix: tsCreated,
UpdatedUnix: tsUpdated,
}
scFields := rd.GetFieldsMap()
if assert.Len(t, scFields, 9) {
testShadowCopyField(t, scFields[0], "OwnerID", "1002")
testShadowCopyField(t, scFields[1], "OwnerName", "alexsmith")
testShadowCopyField(t, scFields[2], "Name", "website")
testShadowCopyField(t, scFields[3], "Description", "My static website.")
testShadowCopyField(t, scFields[4], "Website", "http://promote-your-business.biz")
testShadowCopyField(t, scFields[5], "Topics", "bulk-email, email-services")
testShadowCopyField(t, scFields[6], "Avatar", "avatar-hash-repo-2002")
testShadowCopyField(t, scFields[7], "CreatedUnix", tsCreated.AsLocalTime().String())
testShadowCopyField(t, scFields[8], "UpdatedUnix", tsUpdated.AsLocalTime().String())
}
}

View file

@ -37,6 +37,26 @@ type UserData struct { //revive:disable-line:exported
AvatarEmail string
}
// Implements GetFieldsMap() from ShadowCopyData interface, returning a list of <key, value> pairs
// to be used when rendering the shadow copy for admins reviewing the corresponding abuse report(s).
func (ud UserData) GetFieldsMap() []moderation.ShadowCopyField {
return []moderation.ShadowCopyField{
{Key: "Name", Value: ud.Name},
{Key: "FullName", Value: ud.FullName},
{Key: "Email", Value: ud.Email},
{Key: "LoginName", Value: ud.LoginName},
{Key: "Location", Value: ud.Location},
{Key: "Website", Value: ud.Website},
{Key: "Pronouns", Value: ud.Pronouns},
{Key: "Description", Value: ud.Description},
{Key: "CreatedUnix", Value: ud.CreatedUnix.AsLocalTime().String()},
{Key: "UpdatedUnix", Value: ud.UpdatedUnix.AsLocalTime().String()},
{Key: "LastLogin", Value: ud.LastLogin.AsLocalTime().String()},
{Key: "Avatar", Value: ud.Avatar},
{Key: "AvatarEmail", Value: ud.AvatarEmail},
}
}
// newUserData creates a trimmed down user to be used just to create a JSON structure
// (keeping only the fields relevant for moderation purposes)
func newUserData(user *User) UserData {

View file

@ -0,0 +1,60 @@
// Copyright 2025 The Forgejo Authors. All rights reserved.
// SPDX-License-Identifier: GPL-3.0-or-later
package user_test
import (
"testing"
"forgejo.org/models/moderation"
"forgejo.org/models/user"
"forgejo.org/modules/timeutil"
"github.com/stretchr/testify/assert"
)
const (
tsCreated timeutil.TimeStamp = timeutil.TimeStamp(1753093200) // 2025-07-21 10:20:00 UTC
tsUpdated timeutil.TimeStamp = timeutil.TimeStamp(1753093320) // 2025-07-21 10:22:00 UTC
tsLastLogin timeutil.TimeStamp = timeutil.TimeStamp(1753093800) // 2025-07-21 10:30:00 UTC
)
func testShadowCopyField(t *testing.T, scField moderation.ShadowCopyField, key, value string) {
assert.Equal(t, key, scField.Key)
assert.Equal(t, value, scField.Value)
}
func TestUserDataGetFieldsMap(t *testing.T) {
ud := user.UserData{
Name: "alexsmith",
FullName: "Alex Smith",
Email: "alexsmith@example.org",
LoginName: "",
Location: "@master@seo.net",
Website: "http://promote-your-business.biz",
Pronouns: "SEO",
Description: "I can help you promote your business online using SEO.",
CreatedUnix: tsCreated,
UpdatedUnix: tsUpdated,
LastLogin: tsLastLogin,
Avatar: "avatar-hash-user-1002",
AvatarEmail: "alexsmith@example.org",
}
scFields := ud.GetFieldsMap()
if assert.Len(t, scFields, 13) {
testShadowCopyField(t, scFields[0], "Name", "alexsmith")
testShadowCopyField(t, scFields[1], "FullName", "Alex Smith")
testShadowCopyField(t, scFields[2], "Email", "alexsmith@example.org")
testShadowCopyField(t, scFields[3], "LoginName", "")
testShadowCopyField(t, scFields[4], "Location", "@master@seo.net")
testShadowCopyField(t, scFields[5], "Website", "http://promote-your-business.biz")
testShadowCopyField(t, scFields[6], "Pronouns", "SEO")
testShadowCopyField(t, scFields[7], "Description", "I can help you promote your business online using SEO.")
testShadowCopyField(t, scFields[8], "CreatedUnix", tsCreated.AsLocalTime().String())
testShadowCopyField(t, scFields[9], "UpdatedUnix", tsUpdated.AsLocalTime().String())
testShadowCopyField(t, scFields[10], "LastLogin", tsLastLogin.AsLocalTime().String())
testShadowCopyField(t, scFields[11], "Avatar", "avatar-hash-user-1002")
testShadowCopyField(t, scFields[12], "AvatarEmail", "alexsmith@example.org")
}
}