feat(admin): require a resolution and fix panel layout and copy (#3335)

fluxer_admin/tests/csrf_legacy_cookie.rs

@@ -93,6 +93,7 @@ fn production_config(api_endpoint: String) -> AdminConfig {
         api_endpoint,
         media_endpoint: "https://media.example.test".to_owned(),
         static_cdn_endpoint: "https://static.example.test".to_owned(),
+        reports_bucket_origin: "https://reports.example.test".to_owned(),
         admin_endpoint: ADMIN_ORIGIN.to_owned(),
         web_app_endpoint: "https://app.example.test".to_owned(),
         oauth_client_id: "admin-client".to_owned(),

fluxer_admin/tests/htmx_acceptance.rs

@@ -1079,7 +1079,7 @@ async fn redirect_flash_actions_convert_to_htmx_toasts() {
                 &format!("{}; csrf_token={}", app.session_cookie, csrf_token),
             ),
         ],
-        &format!("_csrf={csrf_token}&resolution=done"),
+        &format!("_csrf={csrf_token}&resolution=no_violation&public_comment=done"),
     )
     .await;
     assert_eq!(status, StatusCode::NO_CONTENT, "{response_body}");
@@ -1094,7 +1094,101 @@ async fn redirect_flash_actions_convert_to_htmx_toasts() {
         .and_then(|value| value.to_str().ok())
         .unwrap_or_else(|| panic!("missing toast header\n{response_body}"));
     assert!(toast.contains("success"), "{toast}");
-    assert!(toast.contains("Report resolved"), "{toast}");
+    assert!(toast.contains("Report resolved: No violation"), "{toast}");
+}
+
+#[tokio::test]
+async fn report_resolve_form_sends_the_chosen_resolution_and_refuses_none() {
+    let received = Arc::new(Mutex::new(Vec::<Value>::new()));
+    let sink = received.clone();
+    let api = Router::new()
+        .route(
+            "/admin/reports/1800000000000000001",
+            routing::patch(move |Json(body): Json<Value>| {
+                let sink = sink.clone();
+                async move {
+                    sink.lock().unwrap().push(body);
+                    json_response(json!({
+                        "report_id": "1800000000000000001",
+                        "status": 1,
+                        "resolved_at": "2026-05-26T12:03:00.000Z",
+                        "public_comment": null
+                    }))
+                }
+            })
+            .get(|| async { json_response(searched_report()) }),
+        )
+        .fallback(mock_api);
+    let app = setup_with_api(api).await;
+    let (headers, page) = get_with_headers(&app, "/reports/1800000000000000001", &[]).await;
+    let csrf_token = csrf_cookie(&headers)
+        .unwrap_or_else(|| panic!("report page did not set csrf_token cookie\n{page}"));
+    assert_form_has_csrf(&page, "/reports/1800000000000000001/resolve", &csrf_token);
+    assert!(
+        page.contains(r#"<select id="resolution" name="resolution" required"#),
+        "{page}"
+    );
+    let cookie = format!("{}; csrf_token={}", app.session_cookie, csrf_token);
+    let post = |body: String| {
+        let app = &app;
+        let cookie = cookie.clone();
+        async move {
+            let (status, headers, text) = post_form_with_headers(
+                app,
+                "/reports/1800000000000000001/resolve",
+                &[
+                    ("HX-Request", "true"),
+                    ("HX-Target", "flash-container"),
+                    ("Cookie", &cookie),
+                ],
+                &body,
+            )
+            .await;
+            assert_eq!(status, StatusCode::NO_CONTENT, "{text}");
+            headers
+                .get("X-Fluxer-Admin-Toast")
+                .and_then(|value| value.to_str().ok())
+                .unwrap_or_else(|| panic!("missing toast header\n{text}"))
+                .to_owned()
+        }
+    };
+
+    for (value, label) in [
+        ("actioned", "Action taken"),
+        ("no_violation", "No violation"),
+        ("duplicate", "Duplicate"),
+    ] {
+        let toast = post(format!("_csrf={csrf_token}&resolution={value}")).await;
+        assert!(toast.contains("success"), "{toast}");
+        assert!(
+            toast.contains(&format!("Report resolved: {label}")),
+            "{toast}"
+        );
+    }
+    for refused in [
+        format!("_csrf={csrf_token}&public_comment=Looks+fine"),
+        format!("_csrf={csrf_token}&resolution=&public_comment=Looks+fine"),
+        format!("_csrf={csrf_token}&resolution=auto_resolved"),
+    ] {
+        let toast = post(refused).await;
+        assert!(toast.contains("error"), "{toast}");
+        assert!(toast.contains("Choose a resolution"), "{toast}");
+    }
+    let toast = post(format!(
+        "_csrf={csrf_token}&resolution=actioned&public_comment=Removed&notify_reporter_present=1"
+    ))
+    .await;
+    assert!(toast.contains("Report resolved: Action taken"), "{toast}");
+    let received = received.lock().unwrap();
+    assert_eq!(
+        *received,
+        vec![
+            json!({"status": "resolved", "resolution": "actioned", "notify_reporter": true}),
+            json!({"status": "resolved", "resolution": "no_violation", "notify_reporter": true}),
+            json!({"status": "resolved", "resolution": "duplicate", "notify_reporter": true}),
+            json!({"status": "resolved", "resolution": "actioned", "public_comment": "Removed", "notify_reporter": false}),
+        ]
+    );
 }
 
 #[tokio::test]
@@ -1371,6 +1465,24 @@ async fn rendered_heads_never_reference_the_static_cdn_for_fonts() {
     );
 }
 
+#[tokio::test]
+async fn the_csp_allows_images_from_the_configured_reports_bucket() {
+    let app = setup().await;
+    let (headers, _) = get_with_headers(&app, "/reports/1800000000000000001", &[]).await;
+    let csp = headers
+        .get(header::CONTENT_SECURITY_POLICY)
+        .and_then(|value| value.to_str().ok())
+        .expect("missing CSP");
+    assert!(
+        csp.contains(
+            "img-src 'self' data: blob: https://static.example.test https://media.example.test \
+             https://reports.example.test;"
+        ),
+        "img-src was {csp}"
+    );
+    assert!(!csp.contains("vultrobjects"), "{csp}");
+}
+
 struct SearchCase {
     path: &'static str,
     result_target: &'static str,
@@ -2282,6 +2394,7 @@ fn test_config(api_endpoint: String) -> AdminConfig {
         api_endpoint,
         media_endpoint: "https://media.example.test".to_owned(),
         static_cdn_endpoint: "https://static.example.test".to_owned(),
+        reports_bucket_origin: "https://reports.example.test".to_owned(),
         admin_endpoint: "https://admin.example.test".to_owned(),
         web_app_endpoint: "https://app.example.test".to_owned(),
         oauth_client_id: "admin-client".to_owned(),

fluxer_admin/tests/notification_writes.rs

@@ -131,15 +131,20 @@ async fn report_resolve_sends_notify_reporter_from_the_checkbox() {
     let uri = format!("/reports/{REPORT_ID}/resolve");
     let checked = submit(
         &uri,
-        "resolution=Handled&notify_reporter_present=1&notify_reporter=true",
+        "resolution=actioned&public_comment=Handled&notify_reporter_present=1&notify_reporter=true",
     )
     .await;
     assert_eq!(checked.route, format!("PATCH /admin/reports/{REPORT_ID}"));
     assert_eq!(checked.body["public_comment"], json!("Handled"));
+    assert_eq!(checked.body["resolution"], json!("actioned"));
     assert_eq!(checked.body["notify_reporter"], json!(true));
-    let unchecked = submit(&uri, "resolution=Handled&notify_reporter_present=1").await;
+    let unchecked = submit(
+        &uri,
+        "resolution=no_violation&public_comment=Handled&notify_reporter_present=1",
+    )
+    .await;
     assert_eq!(unchecked.body["notify_reporter"], json!(false));
-    let stale_form = submit(&uri, "resolution=Handled").await;
+    let stale_form = submit(&uri, "resolution=duplicate&public_comment=Handled").await;
     assert_eq!(stale_form.body["notify_reporter"], json!(true));
 }
 
@@ -349,6 +354,7 @@ fn test_config(api_endpoint: String) -> AdminConfig {
         api_endpoint,
         media_endpoint: "https://media.example.test".to_owned(),
         static_cdn_endpoint: "https://static.example.test".to_owned(),
+        reports_bucket_origin: "https://reports.example.test".to_owned(),
         admin_endpoint: "https://admin.example.test".to_owned(),
         web_app_endpoint: "https://app.example.test".to_owned(),
         oauth_client_id: "admin-client".to_owned(),

fluxer_admin/tests/parity.rs

@@ -88,6 +88,7 @@ fn guild_search_fixture_matches_the_generated_response_contract() {
     assert_eq!(response.guilds.len(), 1);
     let guild = &response.guilds[0];
     assert_eq!(guild.name, "Parity Guild");
+    assert_eq!(guild.nsfw, Some(false));
     assert_eq!(guild.content_warning_level.as_deref(), Some(&0));
 }
 
@@ -100,6 +101,7 @@ fn guild_lookup_fixture_matches_the_generated_response_contract() {
         .guild
         .expect("guild lookup fixture must contain a guild");
     assert_eq!(String::from(guild.name), "Parity Guild");
+    assert_eq!(guild.nsfw, Some(false));
     assert_eq!(guild.content_warning_level.as_deref(), Some(&0));
     assert_eq!(guild.channels.len(), 1);
     assert_eq!(guild.channels[0].content_warning_level.as_deref(), Some(&0));

fluxer_admin/tests/parity/rust_server.rs

@@ -53,6 +53,7 @@ fn admin_config(port: u16, api_endpoint: &str, admin_endpoint: &str) -> AdminCon
         api_endpoint: api_endpoint.to_owned(),
         media_endpoint: format!("{api_endpoint}/media"),
         static_cdn_endpoint: "https://static.example.test".to_owned(),
+        reports_bucket_origin: "https://reports.example.test".to_owned(),
         admin_endpoint: admin_endpoint.to_owned(),
         web_app_endpoint: "http://127.0.0.1:8088".to_owned(),
         oauth_client_id: "1234567890123456789".to_owned(),

fluxer_admin/tests/password_reset_link.rs

@@ -431,6 +431,7 @@ fn test_config(api_endpoint: String, self_hosted: bool) -> AdminConfig {
         api_endpoint,
         media_endpoint: "https://media.example.test".to_owned(),
         static_cdn_endpoint: "https://static.example.test".to_owned(),
+        reports_bucket_origin: String::new(),
         admin_endpoint: "https://admin.example.test".to_owned(),
         web_app_endpoint: "https://app.example.test".to_owned(),
         oauth_client_id: "admin-client".to_owned(),

fluxer_admin/tests/username_tags.rs

@@ -226,6 +226,7 @@ fn test_config(api_endpoint: String, self_hosted: bool) -> AdminConfig {
         api_endpoint,
         media_endpoint: "https://media.example.test".to_owned(),
         static_cdn_endpoint: "https://static.example.test".to_owned(),
+        reports_bucket_origin: String::new(),
         admin_endpoint: "https://admin.example.test".to_owned(),
         web_app_endpoint: "https://app.example.test".to_owned(),
         oauth_client_id: "admin-client".to_owned(),

fluxer_admin/tests/voice_restriction_writes.rs

@@ -321,6 +321,7 @@ fn test_config(api_endpoint: String) -> AdminConfig {
         api_endpoint,
         media_endpoint: "https://media.example.test".to_owned(),
         static_cdn_endpoint: "https://static.example.test".to_owned(),
+        reports_bucket_origin: "https://reports.example.test".to_owned(),
         admin_endpoint: "https://admin.example.test".to_owned(),
         web_app_endpoint: "https://app.example.test".to_owned(),
         oauth_client_id: "admin-client".to_owned(),