feat(registry): blocked-name list and player reports #25

Merged

kblack0610 merged 1 commit from feat/name-filter-and-reports into main

2026-11-06 02:03:14 +00:00

kblack0610 commented

2026-11-06 02:03:10 +00:00

Owner

For ucp-71: a name filter and a report path, so games with leaderboards (Shape City first) can avoid a PEGI 18 rating before App Store submission.

blocked-names.txt (data) and names.go: a player, account, character or world name holding a listed word is refused with 400 {"error": "name is not allowed"}. Look-alike digits and symbols are folded to letters; a plain entry matches anywhere, a = entry only as a whole word, so Classic, Peacock and Therapist stay allowed. A finished game's result naming a blocked player keeps the last allowed name. Admin renames are not checked.
POST /api/v1/players/{id}/reports {"reporter", "reason": "name"|"cheating"} -> 202. Stored in player_reports (migration 0010), one row per reporter, player and reason; 20 an hour per reporter (429 past it), self-report 400, unknown player 404.
Admin site: the Players page gets a Reported list (GET /api/reports) with Clear name and Dismiss (DELETE /api/reports/{player}[?clear_name=true]), both written to the audit log.

Removed: nothing; the name shape rule in validate.go stays and the list is checked after it.

Verified: go test ./... green locally (Postgres and MinIO containers), including the new TestBlockedNameMatching, TestShippedBlockedNames, TestBlockedNamesAreRefused, TestPlayerReports, TestPlayerReportsAreRateLimitedPerReporter.

Going live needs a release: tag registry-vX.Y.Z to publish the image, then bump REGISTRY_IMAGE_TAG in the home-config stack. The migration runs at boot.

https://claude.ai/code/session_01AWkPsqiyPJFouFVqBtK7i7

For ucp-71: a name filter and a report path, so games with leaderboards (Shape City first) can avoid a PEGI 18 rating before App Store submission. - `blocked-names.txt` (data) and `names.go`: a player, account, character or world name holding a listed word is refused with `400 {"error": "name is not allowed"}`. Look-alike digits and symbols are folded to letters; a plain entry matches anywhere, a `=` entry only as a whole word, so Classic, Peacock and Therapist stay allowed. A finished game's result naming a blocked player keeps the last allowed name. Admin renames are not checked. - `POST /api/v1/players/{id}/reports` `{"reporter", "reason": "name"|"cheating"}` -> 202. Stored in `player_reports` (migration 0010), one row per reporter, player and reason; 20 an hour per reporter (429 past it), self-report 400, unknown player 404. - Admin site: the Players page gets a Reported list (`GET /api/reports`) with Clear name and Dismiss (`DELETE /api/reports/{player}[?clear_name=true]`), both written to the audit log. Removed: nothing; the name shape rule in `validate.go` stays and the list is checked after it. Verified: `go test ./...` green locally (Postgres and MinIO containers), including the new `TestBlockedNameMatching`, `TestShippedBlockedNames`, `TestBlockedNamesAreRefused`, `TestPlayerReports`, `TestPlayerReportsAreRateLimitedPerReporter`. Going live needs a release: tag `registry-vX.Y.Z` to publish the image, then bump `REGISTRY_IMAGE_TAG` in the home-config stack. The migration runs at boot. https://claude.ai/code/session_01AWkPsqiyPJFouFVqBtK7i7

kblack0610 added 1 commit

2026-11-06 02:03:10 +00:00

feat(registry): blocked-name list and player reports e3c7a6c0fe

A name holding a word of blocked-names.txt is refused (400 "name is not
allowed") when a player sets it or names an account, character or world;
a result naming one keeps the last allowed name. POST
/api/v1/players/{id}/reports stores one report per reporter, player and
reason, 20 an hour per reporter. The admin Players page lists reported
players with Clear name and Dismiss, both audited.

For ucp-71: a name filter and a report path so games with leaderboards
can avoid a PEGI 18 rating.

Claude-Session: https://claude.ai/code/session_01AWkPsqiyPJFouFVqBtK7i7