Blocks, mutes, bookmarks, pins and reports

- Blocks are per persona and never federate (a Block activity would tell
  the other server who blocked whom): the blocked account is removed as a
  follower, with a Reject{Follow} if it is remote, unfollowed, cleared from
  home and notifications, and refused with Reject if it follows again.
- Mutes (optionally timed, optionally sparing notifications) and per-
  persona domain blocks keep authors out of home timelines, notifications
  and every status list the API returns; the boosts of a hidden author's
  posts are hidden too.
- Bookmarks and pins (at most five, public or unlisted, own posts) with
  their Mastodon endpoints and flags; pinned posts are the actor's
  `featured` collection at /trophies, and `featuredTags` points at
  /tattoos.
- Reports: /api/v1/reports stores the report and, when forwarding to a
  remote account, sends Flag from the instance actor, so the reporting
  persona is never named to the other server. An inbound Flag about a local
  persona or its posts becomes a report; moderators list and resolve them
  under /clientapi/moderator/reports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Api/Mastodon/Controllers/StatusesController.cs

@@ -18,6 +18,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 	public class StatusesController : MastodonController
 	{
 		const int MaxContext = 200;
+		public const int MaxPins = 5;
 
 		readonly IStatusService _statuses;
 		readonly MastodonMapper _mapper;
@@ -227,10 +228,41 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		}
 
 		[HttpPost("/api/v1/statuses/{id}/bookmark"), Scope("write:bookmarks")]
-		public Task<IActionResult> Bookmark(string id, CancellationToken token) => Unchanged(id, token);
+		public async Task<IActionResult> Bookmark(string id, CancellationToken token)
+		{
+			var post = await Visible(id, token);
+			if (post == default)
+				return NotFoundError();
+			try
+			{
+				await DB.Default.SaveAsync(new Models.Social.Bookmark { AvatarId = MyId, PostId = post.ID }, token);
+			}
+			catch (MongoDB.Driver.MongoWriteException ex) when (ex.WriteError?.Category == MongoDB.Driver.ServerErrorCategory.DuplicateKey)
+			{
+			}
+			return Json(await _mapper.Status(post, MyId, token));
+		}
 
 		[HttpPost("/api/v1/statuses/{id}/unbookmark"), Scope("write:bookmarks")]
-		public Task<IActionResult> Unbookmark(string id, CancellationToken token) => Unchanged(id, token);
+		public async Task<IActionResult> Unbookmark(string id, CancellationToken token)
+		{
+			await DB.Default.DeleteAsync<Models.Social.Bookmark>(b => b.AvatarId == MyId && b.PostId == id);
+			return await Unchanged(id, token);
+		}
+
+		[HttpGet("/api/v1/bookmarks"), Scope("read:bookmarks")]
+		public async Task<IActionResult> Bookmarks(CancellationToken token)
+		{
+			var bookmarks = await Page.From(Params, Limit()).Fetch(DB.Default.Find<Models.Social.Bookmark>().Match(b => b.AvatarId == MyId), b => b.ID, token);
+			var ids = bookmarks.Select(b => b.PostId).ToList();
+			var posts = (await _dbEntities.Posts.Match(p => ids.Contains(p.ID) && !p.DeletedAt.HasValue).ExecuteAsync(token)).ToDictionary(p => p.ID);
+			var visible = new List<PostEntity>();
+			foreach (var postId in ids.Where(posts.ContainsKey))
+				if (await VisibilityPolicy.CanSee(posts[postId], MyId, token))
+					visible.Add(posts[postId]);
+			Link("/api/v1/bookmarks", bookmarks.LastOrDefault()?.ID, bookmarks.FirstOrDefault()?.ID);
+			return Json(await _mapper.Statuses(visible, MyId, token));
+		}
 
 		[HttpPost("/api/v1/statuses/{id}/mute"), Scope("write:mutes")]
 		public Task<IActionResult> Mute(string id, CancellationToken token) => Unchanged(id, token);
@@ -239,10 +271,32 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public Task<IActionResult> Unmute(string id, CancellationToken token) => Unchanged(id, token);
 
 		[HttpPost("/api/v1/statuses/{id}/pin"), Scope("write:accounts")]
-		public IActionResult Pin(string id) => Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Pinning is not supported yet");
+		public async Task<IActionResult> Pin(string id, CancellationToken token)
+		{
+			var post = await _dbEntities.Posts.Match(p => p.ID == id && p.GroupUserId == MyId && !p.IsFederatedCopy && !p.DeletedAt.HasValue && p.ReblogOfPostId == null)
+				.ExecuteFirstAsync(token);
+			if (post == default)
+				return NotFoundError();
+			if (post.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
+				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Only public posts can be pinned");
+			if (await DB.Default.CountAsync<Models.Social.Pin>(p => p.AvatarId == MyId, token) >= MaxPins)
+				return Error(StatusCodes.Status422UnprocessableEntity, $"Validation failed: You can pin at most {MaxPins} posts");
+			try
+			{
+				await DB.Default.SaveAsync(new Models.Social.Pin { AvatarId = MyId, PostId = post.ID }, token);
+			}
+			catch (MongoDB.Driver.MongoWriteException ex) when (ex.WriteError?.Category == MongoDB.Driver.ServerErrorCategory.DuplicateKey)
+			{
+			}
+			return Json(await _mapper.Status(post, MyId, token));
+		}
 
 		[HttpPost("/api/v1/statuses/{id}/unpin"), Scope("write:accounts")]
-		public Task<IActionResult> Unpin(string id, CancellationToken token) => Unchanged(id, token);
+		public async Task<IActionResult> Unpin(string id, CancellationToken token)
+		{
+			await DB.Default.DeleteAsync<Models.Social.Pin>(p => p.AvatarId == MyId && p.PostId == id);
+			return await Unchanged(id, token);
+		}
 
 		async Task<IActionResult> Toggle(Task<StatusOutcome> action, string id, CancellationToken token)
 		{