feat(promoted): apply the moderation mute list to promoted entries

dotnet/EcencyApi.Tests/ModerationMutesTests.cs

@@ -0,0 +1,99 @@
+using System.Text.Json.Nodes;
+using EcencyApi.Infrastructure;
+using Xunit;
+
+namespace EcencyApi.Tests;
+
+/// <summary>
+/// The moderation mute filter on promoted entries. The list is fetched from
+/// chain, but the parts that can silently break a feed are pure: an empty or
+/// unreadable list must leave the feed alone, and a match must remove exactly
+/// the muted author's entries and nothing else.
+/// </summary>
+public class ModerationMutesTests
+{
+    private static JsonArray Entries(params string?[] authors)
+    {
+        var arr = new JsonArray();
+        foreach (var a in authors)
+        {
+            var o = new JsonObject { ["permlink"] = "p-" + (a ?? "none") };
+            if (a != null)
+            {
+                o["author"] = a;
+            }
+            arr.Add(o);
+        }
+        return arr;
+    }
+
+    private static string?[] AuthorsOf(JsonArray arr) =>
+        arr.Select(e => e is JsonObject o && o.TryGetPropertyValue("author", out var a)
+            ? a?.GetValue<string>()
+            : null).ToArray();
+
+    [Fact]
+    public void AnEmptyMuteListLeavesTheFeedUntouched()
+    {
+        var entries = Entries("alice", "bob");
+        var result = ModerationMutes.FilterMutedAuthors(entries, ModerationMutes.ToSet(Array.Empty<string>()));
+        Assert.Equal(new[] { "alice", "bob" }, AuthorsOf(result));
+    }
+
+    [Fact]
+    public void MutedAuthorsAreDroppedAndTheRestKeptInOrder()
+    {
+        var entries = Entries("alice", "spammer", "bob", "spammer", "carol");
+        var result = ModerationMutes.FilterMutedAuthors(entries, ModerationMutes.ToSet(new[] { "spammer" }));
+        Assert.Equal(new[] { "alice", "bob", "carol" }, AuthorsOf(result));
+    }
+
+    [Fact]
+    public void MatchingIsCaseInsensitive()
+    {
+        // Hive account names are lowercase, but nothing here guarantees the two
+        // sides were normalized by the same code path.
+        var entries = Entries("Spammer");
+        var result = ModerationMutes.FilterMutedAuthors(entries, ModerationMutes.ToSet(new[] { "spammer" }));
+        Assert.Empty(result);
+    }
+
+    [Fact]
+    public void AnEntryWithNoAuthorIsKept()
+    {
+        // An unreadable shape is not evidence of anything; dropping it would
+        // shrink the feed for a reason nobody could see.
+        var entries = Entries("alice", null);
+        var result = ModerationMutes.FilterMutedAuthors(entries, ModerationMutes.ToSet(new[] { "spammer" }));
+        Assert.Equal(2, result.Count);
+    }
+
+    [Fact]
+    public void FilteringEveryEntryYieldsAnEmptyArrayNotNull()
+    {
+        var entries = Entries("spammer", "spammer");
+        var result = ModerationMutes.FilterMutedAuthors(entries, ModerationMutes.ToSet(new[] { "spammer" }));
+        Assert.NotNull(result);
+        Assert.Empty(result);
+    }
+
+    [Fact]
+    public void ReadFollowingTakesTheFollowingNamesAndSkipsUnusableRows()
+    {
+        var rows = new JsonArray(
+            new JsonObject { ["follower"] = "ecency", ["following"] = "spammer", ["what"] = new JsonArray("ignore") },
+            new JsonObject { ["follower"] = "ecency" },
+            new JsonObject { ["follower"] = "ecency", ["following"] = "" },
+            new JsonObject { ["follower"] = "ecency", ["following"] = "phisher", ["what"] = new JsonArray("ignore") });
+
+        Assert.Equal(new[] { "spammer", "phisher" }, ModerationMutes.ReadFollowing(rows));
+    }
+
+    [Fact]
+    public void TheModerationAccountIsEcency()
+    {
+        // Pinned: this account name is the whole control surface. A typo here
+        // would read as "nobody is muted" with no error anywhere.
+        Assert.Equal("ecency", ModerationMutes.Account);
+    }
+}

dotnet/EcencyApi/Handlers/PrivateApi.Feeds.cs

@@ -68,6 +68,15 @@ public static async Task PromotedEntries(HttpContext ctx)
         var shortContent = double.IsNaN(shortNum) ? 0 : (int)Math.Clamp(shortNum, int.MinValue, int.MaxValue);
 
         var posts = await ApiClient.GetPromotedEntries(limit, shortContent);
+
+        // Promoted entries are served from here, not from the waves indexer, so
+        // the moderation mute list has to be applied on this path too. A muted
+        // account buying a promoted slot would otherwise land in the most
+        // prominent position in the feed. Filtered after the cache read rather
+        // than before it, so a new mute takes effect on the mute list's own
+        // refresh instead of waiting out the promoted cache.
+        posts = ModerationMutes.FilterMutedAuthors(posts, await ModerationMutes.Get());
+
         await ctx.SendJson(200, posts);
     }
 

dotnet/EcencyApi/Infrastructure/ModerationMutes.cs

@@ -0,0 +1,176 @@
+using System.Text.Json.Nodes;
+
+namespace EcencyApi.Infrastructure;
+
+/// <summary>
+/// Ecency's on-chain moderation mute list.
+///
+/// Muting an account from the moderation account is how spam and phishing are
+/// kept out of the waves feeds; esync applies that list to every waves query it
+/// serves. Promoted entries never go through esync, so without this they were
+/// the one surface a muted account could still reach an audience through — and
+/// the most prominent one, since a promoted card is a paid placement.
+///
+/// Read straight from chain rather than from another service so this holds even
+/// if the indexer is behind, and cached because the list changes only when a
+/// moderator acts on it.
+/// </summary>
+public static class ModerationMutes
+{
+    /// <summary>The account whose mutes are treated as platform-wide.</summary>
+    public const string Account = "ecency";
+
+    private const string CacheKey = "moderation-muted-authors";
+
+    /// <summary>
+    /// Survives a failed refresh, so an unreachable node degrades to the list we
+    /// last saw rather than to no filtering at all. Never expires on purpose.
+    /// </summary>
+    private const string LastGoodCacheKey = "moderation-muted-authors-last-good";
+
+    private const double TtlSeconds = 300;
+
+    /// <summary>condenser_api.get_following caps a single response at 1000 rows.</summary>
+    private const int PageSize = 1000;
+
+    /// <summary>
+    /// Bounds the paging loop. 20 pages is 20k muted accounts, far past any real
+    /// list, so a node that stops advancing the cursor truncates rather than
+    /// looping forever.
+    /// </summary>
+    private const int MaxPages = 20;
+
+    /// <summary>Replaceable for tests (loopback stub nodes).</summary>
+    internal static HiveRpcClient Rpc = HiveClients.Default;
+
+    /// <summary>
+    /// The muted accounts, cached. Returns an empty set rather than throwing:
+    /// a moderation filter that cannot load must not take a feed down with it.
+    /// </summary>
+    public static async Task<HashSet<string>> Get()
+    {
+        var cached = MemCache.Get<string[]>(CacheKey);
+        if (cached != null)
+        {
+            return ToSet(cached);
+        }
+
+        try
+        {
+            var names = await Fetch();
+            MemCache.Set(CacheKey, names, TtlSeconds);
+            MemCache.Set(LastGoodCacheKey, names);
+            return ToSet(names);
+        }
+        catch (Exception e)
+        {
+            Console.WriteLine($"warn: failed to fetch moderation mutes {e.Message}");
+
+            // Re-arm the short TTL with the stale list so a node outage does not
+            // put an RPC call on every promoted-entries request for its duration.
+            var lastGood = MemCache.Get<string[]>(LastGoodCacheKey);
+            if (lastGood != null)
+            {
+                MemCache.Set(CacheKey, lastGood, TtlSeconds);
+                return ToSet(lastGood);
+            }
+
+            return ToSet(Array.Empty<string>());
+        }
+    }
+
+    private static async Task<string[]> Fetch()
+    {
+        var names = new List<string>();
+        var start = "";
+
+        for (var page = 0; page < MaxPages; page++)
+        {
+            var result = await Rpc.Call("condenser_api", "get_following",
+                new JsonArray(Account, start, "ignore", PageSize));
+
+            if (result is not JsonArray rows || rows.Count == 0)
+            {
+                break;
+            }
+
+            var pageNames = ReadFollowing(rows);
+
+            // `start` is exclusive on Hive, so a page should not repeat the
+            // cursor. Drop it anyway: against a node treating it as inclusive
+            // this would re-append the same account until the page cap.
+            if (pageNames.Count > 0 && pageNames[0] == start)
+            {
+                pageNames.RemoveAt(0);
+            }
+
+            if (pageNames.Count == 0)
+            {
+                break;
+            }
+
+            names.AddRange(pageNames);
+
+            if (rows.Count < PageSize)
+            {
+                break;
+            }
+
+            start = pageNames[^1];
+        }
+
+        return names.ToArray();
+    }
+
+    internal static List<string> ReadFollowing(JsonArray rows)
+    {
+        var names = new List<string>();
+        foreach (var row in rows)
+        {
+            var name = row is JsonObject o && o.TryGetPropertyValue("following", out var f)
+                ? f?.GetValue<string>()
+                : null;
+            if (!string.IsNullOrEmpty(name))
+            {
+                names.Add(name);
+            }
+        }
+        return names;
+    }
+
+    internal static HashSet<string> ToSet(IEnumerable<string> names) =>
+        new(names, StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// Drop entries authored by a muted account. Returns a new array; entries
+    /// with no readable author are kept, since an unreadable shape is not
+    /// evidence of anything and dropping it would silently shrink the feed.
+    /// </summary>
+    public static JsonArray FilterMutedAuthors(JsonArray entries, ISet<string> muted)
+    {
+        if (muted.Count == 0)
+        {
+            return entries;
+        }
+
+        var kept = new JsonArray();
+        foreach (var entry in entries.ToArray())
+        {
+            var author = entry is JsonObject o && o.TryGetPropertyValue("author", out var a)
+                ? a?.GetValue<string>()
+                : null;
+
+            if (author != null && muted.Contains(author))
+            {
+                continue;
+            }
+
+            // A node can only live in one parent, and these come from a cache
+            // clone we own, so detach before re-parenting into the result.
+            entry?.Parent?.AsArray().Remove(entry);
+            kept.Add(entry);
+        }
+
+        return kept;
+    }
+}