feat(hub): reports from public-group members, decided by an administrator

A report needs a person's account at least a day old, membership of the
public group, and fits a daily allowance per account. Past the threshold
a hash is queued and administrators are notified; blocking without
review is an instance setting, off by default. Report menu item in
public groups, Reports tab and settings in the admin panel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 25 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/admin.py b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
index 381378c..dbda197 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/admin.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/admin.py
@@ -43,6 +43,8 @@ class SettingsPatchRequest(BaseModel):
     login: dict[str, int] | None = None
     # Session lifetime, in hours, each optional.
     session: dict[str, int] | None = None
+    # Content reports: who may report, how often, what a report leads to.
+    reports: dict[str, int] | None = None
 
 
 # ── Instance settings ────────────────────────────────────────────────────────
@@ -63,6 +65,9 @@ async def _settings_payload(db: AsyncSession) -> dict:
         "session": await hub_settings.session_limits(db),
         "session_defaults": dict(hub_settings.SESSION_DEFAULTS),
         "session_bounds": {k: list(v) for k, v in hub_settings.SESSION_BOUNDS.items()},
+        "reports": await hub_settings.report_limits(db),
+        "reports_defaults": dict(hub_settings.REPORT_DEFAULTS),
+        "reports_bounds": {k: list(v) for k, v in hub_settings.REPORT_BOUNDS.items()},
     }
 
 
@@ -162,6 +167,26 @@ async def admin_patch_settings(
         ))
         await db.commit()
 
+    if body.reports:
+        unknown = sorted(set(body.reports) - set(hub_settings.REPORT_KEYS))
+        if unknown:
+            raise HTTPException(
+                status_code=422, detail=f"Unknown report setting(s): {unknown}")
+        changed = []
+        for key, value in body.reports.items():
+            clamped = hub_settings.clamp_report_value(key, value)
+            await hub_settings.set_raw(db, f"reports.{key}", str(clamped))
+            changed.append(f"{key}={clamped}")
+        log.info("Report policy changed by %s: %s",
+                 current_user.username, ", ".join(changed))
+        db.add(IPLog(
+            user_id=current_user.id,
+            event="admin_reports_update",
+            ip_address="admin",
+            detail=", ".join(changed)[:255],
+        ))
+        await db.commit()
+
     return await _settings_payload(db)