API: follower lists, blocking, reports, admin; drop Spotify sign-in

- Followers/following lists (paginated), 'follows you', remove a follower
- Blocking severs follows both ways and hides each user from the other
  (profile 404s, search, follows); the blocker sees activity hidden
- Reports for moderation (App Store guideline 1.2)
- First account on a server becomes admin; admins see the report queue,
  resolve reports, and suspend accounts (signs out, blocks login, hides
  the profile, stops sharing). set-role script to promote/demote
- users.onboardedAt drives first-run onboarding; existing accounts are
  backfilled as already onboarded. Empty PATCH /me no longer 500s
- Remove Spotify account sign-in and polling: Spotify caps new apps at 5
  accounts, so Spotify arrives via its Last.fm/ListenBrainz link or the
  Android reader. App-level catalog search stays for exact links
- Shared: QR code generation and profile-link parsing (verified with jsQR)
- Integration test timeout raised; password hashing is slow by design

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/src/routes/safety.ts

@@ -0,0 +1,84 @@
+/**
+ * Blocking, removing followers, and reporting. App Store guideline 1.2 requires
+ * apps with user content to let people block and report abusive users.
+ */
+import { and, desc, eq, or } from 'drizzle-orm';
+import type { FastifyInstance } from 'fastify';
+import { reportSchema } from '@musicshare/shared';
+import { db, schema } from '../db';
+import { requireUser } from '../lib/auth';
+import { HttpError } from '../lib/http';
+import { FOLLOWS_CHANGED_CHANNEL, redis } from '../lib/redis';
+import { toUserSummary } from '../services/nowPlaying';
+
+async function findUser(username: string) {
+  const [user] = await db.select().from(schema.users).where(eq(schema.users.username, username.toLowerCase()));
+  if (!user) throw new HttpError(404, 'User not found');
+  return user;
+}
+
+/** Live websocket subscriptions are built from follows; refresh them for both people. */
+const followsChanged = (...userIds: string[]) => Promise.all(userIds.map((id) => redis.publish(FOLLOWS_CHANGED_CHANNEL, id)));
+
+export async function safetyRoutes(app: FastifyInstance) {
+  /** Remove someone who follows you. They aren't notified, and can follow again (block to prevent that). */
+  app.delete<{ Params: { username: string } }>('/me/followers/:username', async (req) => {
+    const me = requireUser(req);
+    const them = await findUser(req.params.username);
+    await db.delete(schema.follows).where(and(eq(schema.follows.followerId, them.id), eq(schema.follows.followeeId, me.id)));
+    await followsChanged(them.id);
+    return { ok: true };
+  });
+
+  app.post<{ Params: { username: string } }>('/users/:username/block', async (req) => {
+    const me = requireUser(req);
+    const them = await findUser(req.params.username);
+    if (them.id === me.id) throw new HttpError(400, "You can't block yourself");
+    await db.transaction(async (tx) => {
+      await tx.insert(schema.blocks).values({ blockerId: me.id, blockedId: them.id }).onConflictDoNothing();
+      // Sever follows in both directions (pins go with them).
+      await tx
+        .delete(schema.follows)
+        .where(
+          or(
+            and(eq(schema.follows.followerId, me.id), eq(schema.follows.followeeId, them.id)),
+            and(eq(schema.follows.followerId, them.id), eq(schema.follows.followeeId, me.id)),
+          ),
+        );
+    });
+    await followsChanged(me.id, them.id);
+    return { ok: true };
+  });
+
+  app.delete<{ Params: { username: string } }>('/users/:username/block', async (req) => {
+    const me = requireUser(req);
+    const them = await findUser(req.params.username);
+    await db.delete(schema.blocks).where(and(eq(schema.blocks.blockerId, me.id), eq(schema.blocks.blockedId, them.id)));
+    return { ok: true };
+  });
+
+  app.get('/me/blocks', async (req) => {
+    const me = requireUser(req);
+    const rows = await db
+      .select({ user: schema.users })
+      .from(schema.blocks)
+      .innerJoin(schema.users, eq(schema.users.id, schema.blocks.blockedId))
+      .where(eq(schema.blocks.blockerId, me.id))
+      .orderBy(desc(schema.blocks.createdAt));
+    return rows.map((r) => toUserSummary(r.user));
+  });
+
+  app.post<{ Params: { username: string } }>(
+    '/users/:username/report',
+    { config: { rateLimit: { max: 10, timeWindow: '1 hour' } } },
+    async (req) => {
+      const me = requireUser(req);
+      const them = await findUser(req.params.username);
+      if (them.id === me.id) throw new HttpError(400, "You can't report yourself");
+      const input = reportSchema.parse(req.body);
+      await db.insert(schema.reports).values({ reporterId: me.id, reportedId: them.id, reason: input.reason, note: input.note || null });
+      req.log.warn({ reported: them.username, reason: input.reason }, 'user reported');
+      return { ok: true };
+    },
+  );
+}