M3: Track reported accounts and expose to admins.

[RangerMauve]

🎟️ Re-ticketed from: #
📅 Due date: N/A
🎯 Success criteria: ...

Task Summary

Need to handle incoming flags.
Maybe we can add webhooks for flags? This can then be redirected to sutty or elsewhere.

To Do

• Figure out format of flag activity
• Make sure it gets into the inbox
• Add webhook for "onFlagged" to notify on flagged posts/accounts
• Expose in sutty moderation queue
• Testing

[RangerMauve]

Relted to #104

[fauno]

This is blocking for us, I'll provide the information and report back here.

[fauno]

Here's a Flag activity sent from Mastodon to Social Inbox after reporting the account and selecting some activities to flag.

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "id": "https://mastodon.sutty.local/7347d076-e073-40d7-9b9e-469c406dfa24",
  "type": "Flag",
  "actor": "https://mastodon.sutty.local/actor",
  "content": "qweqweqew",
  "object": [
    "https://skel.sutty.local/about.jsonld",
    "https://skel.sutty.local/2023/02/01/hola-fediverso-5.html",
    "https://skel.sutty.local/hola-a2fe6e8b/"
  ]
}

[fauno]

I can confirm the Flag is stored on the Actor's Inbox. It still feels weird for sites to be reported to themselves but at least the remote actor is anonymized. Hopefully people already knows that reporting to the remote instance exposes them to hostile admins and tailor the contents accordingly.

[fauno]

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "OrderedCollection",
  "id": "/v1/@[email protected]/inbox",
  "orderedItems": [
    {
      "@context": "https://www.w3.org/ns/activitystreams",
      "id": "https://mastodon.sutty.local/7347d076-e073-40d7-9b9e-469c406dfa24",
      "type": "Flag",
      "actor": "https://mastodon.sutty.local/actor",
      "content": "qweqweqew",
      "object": [
        "https://skel.sutty.local/about.jsonld",
        "https://skel.sutty.local/2023/02/01/hola-fediverso-5.html",
        "https://skel.sutty.local/hola-a2fe6e8b/"
      ]
    },
    {
      "@context": "https://www.w3.org/ns/activitystreams",
      "id": "https://mastodon.sutty.local/f34595ab-42d7-443b-bdf2-4fafd1c4f688",
      "type": "Flag",
      "actor": "https://mastodon.sutty.local/actor",
      "content": "wqeqew",
      "object": [
        "https://skel.sutty.local/about.jsonld",
        "https://skel.sutty.local/2023/02/01/hola-fediverso-5.html"
      ]
    }
  ]
}

[fauno]

@RangerMauve not sure if we need a new hook for this, "onmoderationqueued" should be enough and we can direct activities accordingly within the cms

[fauno]

Summary for a future documentation

When a remote instance sends a Flag:

• The Social Inbox will store it on the inbox
• Also sends it to the hook and becomes available to the Sutty CMS
• The Flag is anonymized, it doesn't say which account on the remote instance made the report, only that it comes from a particular instance (meaning it's not anonymous if the instance is single-user)
• When the CMS receives the Flag via webhook, it gets stored but isn't shown to the reported user
  • We need to set an automated report so we're alerted when there's a report on one of our sites

When a CMS user sends a report:

• The Social Inbox isn't involved at all
• The CMS crafts a Flag where the Actor is the CMS itself and the object the reported account plus comments, with a hardcoded message saying something like "A Sutty user made a report, if you need to contact us you can do so at "
• The Flag is sent directly from the CMS to the remote instance
• If the remote instance is Mastodon, it will receive the Flag and generate a report for instance admins. Not sure what other software does with them.