// SPDX-License-Identifier: AGPL-3.0-or-later

import {createHash, randomBytes, randomInt} from 'node:crypto';
import type {ChannelID, GuildID, InviteCode, MessageID, ReportID, UserID, WebhookID} from '@app/api/BrandedTypes';
import {
	createAttachmentID,
	createChannelID,
	createGuildID,
	createInviteCode,
	createMessageID,
	createReportID,
	createUserID,
	guildIdToRoleId,
} from '@app/api/BrandedTypes';
import {Config} from '@app/api/Config';
import type {IChannelRepository} from '@app/api/channel/IChannelRepository';
import type {AuthenticatedChannel} from '@app/api/channel/services/AuthenticatedChannel';
import {MessageChannelAuthService} from '@app/api/channel/services/message/MessageChannelAuthService';
import * as MessageHelpers from '@app/api/channel/services/message/MessageHelpers';
import type {ContentWarningChannelLike} from '@app/api/channel/utils/EffectiveContentWarning';
import {
	channelToContentWarningView,
	computeEffectiveChannelNsfw,
	computeEffectiveContentWarning,
	guildToContentWarningView,
} from '@app/api/channel/utils/EffectiveContentWarning';
import {resolveNsfwScopeChannel} from '@app/api/channel/utils/ThreadNsfwScope';
import type {MessageAttachment} from '@app/api/database/types/MessageTypes';
import type {
	DSAReportTicketRow,
	GuildReportSubmissionByReporterRow,
	MessageReportSubmissionByReporterRow,
	UserReportSubmissionByReporterRow,
} from '@app/api/database/types/ReportTypes';
import type {ThreadViewer} from '@app/api/experiment/ChannelThreadsGate';
import type {IGuildRepositoryAggregate} from '@app/api/guild/repositories/IGuildRepositoryAggregate';
import {emitActivity} from '@app/api/infrastructure/activity/ActivityEvents';
import type {ReportOutcome, ReportTarget, ResolvedBy} from '@app/api/infrastructure/activity/Contract.generated';
import {emitReportResolved} from '@app/api/infrastructure/activity/ModerationEvents';
import type {IEmailDnsValidationService} from '@app/api/infrastructure/IEmailDnsValidationService';
import type {IGatewayService} from '@app/api/infrastructure/IGatewayService';
import type {ISnowflakeService} from '@app/api/infrastructure/ISnowflakeService';
import type {IStorageService} from '@app/api/infrastructure/IStorageService';
import type {IInviteRepository} from '@app/api/invite/IInviteRepository';
import {Logger} from '@app/api/Logger';
import type {Attachment} from '@app/api/models/Attachment';
import type {Channel} from '@app/api/models/Channel';
import type {Guild} from '@app/api/models/Guild';
import type {GuildMember} from '@app/api/models/GuildMember';
import type {Message} from '@app/api/models/Message';
import type {User} from '@app/api/models/User';
import type {Webhook} from '@app/api/models/Webhook';
import {resolveReportFlowAnswers, resolveReportFlowLocale} from '@app/api/report/flows/ReportFlowRegistry';
import type {
	IARMessageContextRow,
	IARSubmission,
	IARSubmissionRow,
	IReportRepository,
} from '@app/api/report/IReportRepository';
import {ReportStatus, ReportType} from '@app/api/report/IReportRepository';
import type {IReportSearchService} from '@app/api/search/IReportSearchService';
import type {IUserRepository} from '@app/api/user/IUserRepository';
import {isUnderEnforcement} from '@app/api/user/ProfileVisibility';
import {isAccountClosed} from '@app/api/user/UserHelpers';
import type {IWebhookRepository} from '@app/api/webhook/IWebhookRepository';
import {buildHashedAssetKey} from '@app/api/worker/utils/AssetArchiveHelpers';
import {APIErrorCodes} from '@fluxer/constants/src/ApiErrorCodes';
import {ME} from '@fluxer/constants/src/AppConstants';
import {InviteTypes, MessageFlags, Permissions} from '@fluxer/constants/src/ChannelConstants';
import {GuildFeatures} from '@fluxer/constants/src/GuildConstants';
import {DELETED_USER_USERNAME, UserFlags} from '@fluxer/constants/src/UserConstants';
import {ValidationErrorCodes} from '@fluxer/constants/src/ValidationErrorCodes';
import {CannotReportOwnMessageError} from '@fluxer/errors/src/domains/channel/CannotReportOwnMessageError';
import {UnknownChannelError} from '@fluxer/errors/src/domains/channel/UnknownChannelError';
import {UnknownMessageError} from '@fluxer/errors/src/domains/channel/UnknownMessageError';
import {ConflictError} from '@fluxer/errors/src/domains/core/ConflictError';
import {FeatureTemporarilyDisabledError} from '@fluxer/errors/src/domains/core/FeatureTemporarilyDisabledError';
import {InputValidationError} from '@fluxer/errors/src/domains/core/InputValidationError';
import {RateLimitError} from '@fluxer/errors/src/domains/core/RateLimitError';
import {ServiceUnavailableError} from '@fluxer/errors/src/domains/core/ServiceUnavailableError';
import {CannotReportGuildError} from '@fluxer/errors/src/domains/guild/CannotReportGuildError';
import {CannotReportOwnGuildError} from '@fluxer/errors/src/domains/guild/CannotReportOwnGuildError';
import {UnknownGuildError} from '@fluxer/errors/src/domains/guild/UnknownGuildError';
import {UnknownInviteError} from '@fluxer/errors/src/domains/invite/UnknownInviteError';
import {CannotReportYourselfError} from '@fluxer/errors/src/domains/moderation/CannotReportYourselfError';
import {InvalidDsaReportTargetError} from '@fluxer/errors/src/domains/moderation/InvalidDsaReportTargetError';
import {InvalidDsaTicketError} from '@fluxer/errors/src/domains/moderation/InvalidDsaTicketError';
import {InvalidDsaVerificationCodeError} from '@fluxer/errors/src/domains/moderation/InvalidDsaVerificationCodeError';
import {ReportBannedError} from '@fluxer/errors/src/domains/moderation/ReportBannedError';
import {UnknownReportError} from '@fluxer/errors/src/domains/moderation/UnknownReportError';
import {UnknownUserError} from '@fluxer/errors/src/domains/user/UnknownUserError';
import type {ReportFlowSurface} from '@fluxer/schema/src/domains/report/ReportFlowSchemas';
import {
	type ReportProfileAssetSnapshot,
	type ReportProfileGuildSnapshot,
	type ReportProfileMemberSnapshot,
	type ReportProfileUserSnapshot,
	serializeReportProfileSnapshot,
} from '@fluxer/schema/src/domains/report/ReportProfileSnapshotSchemas';
import type {DsaReportRequest} from '@fluxer/schema/src/domains/report/ReportSchemas';
import {SnowflakeType} from '@fluxer/schema/src/primitives/SchemaPrimitives';
import {snowflakeToDate} from '@fluxer/snowflake/src/Snowflake';
import type {IEmailService} from '@pkgs/email/src/IEmailService';
import type {IRateLimitService} from '@pkgs/rate_limit/src/IRateLimitService';
import {ms} from 'itty-time';

interface ReporterMetadata {
	id: UserID | null;
	email: string | null;
	fullLegalName: string | null;
	countryOfResidence: string | null;
}

export interface ReportFlowRecord {
	reason: string;
	revisionHash: string;
	stepsJson: string;
	locale: string;
	surface: ReportFlowSurface;
}

interface ReportedAuthor {
	userId: UserID | null;
	webhookId: WebhookID | null;
	webhookName: string | null;
	webhookAvatarHash: string | null;
}

interface DsaReportClassification {
	category: string;
	flow: ReportFlowRecord | null;
}

type MessageContextScope = 'window' | 'target';

interface ProfileSnapshotSubject {
	user?: User | null;
	memberGuildId?: GuildID | null;
	guild?: Guild | null;
}

interface ClonedReportAttachments {
	preserved: Array<MessageAttachment>;
	missing: Array<MessageAttachment>;
}

interface DsaReportDraft {
	row: IARSubmissionRow;
	profileSubject: ProfileSnapshotSubject;
}

type ReportFlowColumns = Pick<
	IARSubmissionRow,
	'reason' | 'flow_revision' | 'flow_steps' | 'flow_locale' | 'flow_surface' | 'reporter_good_faith_confirmed'
>;

function buildReportFlowColumns(flow: ReportFlowRecord | null): ReportFlowColumns {
	return {
		reason: flow?.reason ?? null,
		flow_revision: flow?.revisionHash ?? null,
		flow_steps: flow?.stepsJson ?? null,
		flow_locale: flow?.locale ?? null,
		flow_surface: flow?.surface ?? null,
		reporter_good_faith_confirmed: flow?.surface === 'dsa' ? true : null,
	};
}

type ReportedWebhookColumns = Pick<
	IARSubmissionRow,
	| 'reported_webhook_id'
	| 'reported_webhook_name'
	| 'reported_webhook_avatar_hash'
	| 'reported_webhook_default_name'
	| 'reported_webhook_default_avatar_hash'
	| 'reported_webhook_type'
	| 'reported_webhook_application_id'
	| 'reported_webhook_channel_id'
	| 'reported_webhook_guild_id'
	| 'reported_webhook_created_at'
	| 'reported_webhook_creator_id'
	| 'reported_webhook_creator_username'
	| 'reported_webhook_creator_discriminator'
	| 'reported_webhook_creator_global_name'
	| 'reported_webhook_creator_avatar_hash'
>;

function buildReportedWebhookColumns(
	author: ReportedAuthor | null,
	webhook: Webhook | null = null,
	creator: User | null = null,
): ReportedWebhookColumns {
	const creatorSnapshot = creator && !isAccountClosed(creator) ? creator : null;
	return {
		reported_webhook_id: author?.webhookId ?? null,
		reported_webhook_name: author?.webhookName ?? null,
		reported_webhook_avatar_hash: author?.webhookAvatarHash ?? null,
		reported_webhook_default_name: webhook?.name ?? null,
		reported_webhook_default_avatar_hash: webhook?.avatarHash ?? null,
		reported_webhook_type: webhook?.type ?? null,
		reported_webhook_application_id: creator?.isBot ? creator.id : null,
		reported_webhook_channel_id: webhook?.channelId ?? null,
		reported_webhook_guild_id: webhook?.guildId ?? null,
		reported_webhook_created_at: author?.webhookId ? snowflakeToDate(author.webhookId) : null,
		reported_webhook_creator_id: webhook?.creatorId ?? null,
		reported_webhook_creator_username: creatorSnapshot?.username ?? null,
		reported_webhook_creator_discriminator: creatorSnapshot?.discriminator ?? null,
		reported_webhook_creator_global_name: creatorSnapshot?.globalName ?? null,
		reported_webhook_creator_avatar_hash: creatorSnapshot?.avatarHash ?? null,
	};
}

function messageAuthor(message: Message): ReportedAuthor | null {
	if (message.authorId) {
		return {userId: message.authorId, webhookId: null, webhookName: null, webhookAvatarHash: null};
	}
	if (message.webhookId) {
		return {
			userId: null,
			webhookId: message.webhookId,
			webhookName: message.webhookName,
			webhookAvatarHash: message.webhookAvatarHash,
		};
	}
	return null;
}

const REPORT_RATE_LIMIT_WINDOW = ms('1 hour');
const REPORT_RATE_LIMIT_MAX = 5;
const MESSAGE_REPORT_USER_GUILD_RATE_LIMIT_MAX = 4;
const MESSAGE_REPORT_USER_CHANNEL_RATE_LIMIT_MAX = 3;
const MESSAGE_REPORT_TARGET_MESSAGE_RATE_LIMIT_MAX = 20;
const MESSAGE_CONTEXT_WINDOW = 25;
const DSA_CODE_CHARSET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
const DSA_CODE_SEGMENT_LENGTH = 4;
const DSA_CODE_SEPARATOR = '-';
const DSA_TICKET_BYTES = 32;
const DSA_EMAIL_SEND_RECIPIENT_MAX = 3;
const DSA_EMAIL_SEND_RECIPIENT_WINDOW = ms('1 hour');
const DSA_EMAIL_RESEND_COOLDOWN = ms('1 minute');
const DSA_EMAIL_VERIFY_ADDRESS_MAX = 5;
const DSA_EMAIL_VERIFY_ADDRESS_WINDOW = ms('10 minutes');
const PUBLIC_CHANNEL_PERMISSIONS = Permissions.VIEW_CHANNEL | Permissions.READ_MESSAGE_HISTORY;

async function emitReportFiled(row: IARSubmissionRow, target: ReportTarget): Promise<void> {
	const key = row.reported_user_id ?? row.reporter_id ?? 0n;
	await emitActivity(
		'report_filed',
		key.toString(),
		{
			report_id: row.report_id.toString(),
			reporter_id: (row.reporter_id ?? 0n).toString(),
			category: row.category,
			target_type: target,
			reported_user_id: row.reported_user_id?.toString() ?? null,
			guild_id: row.reported_guild_id?.toString() ?? null,
			message_id: row.reported_message_id?.toString() ?? null,
			channel_id: row.reported_channel_id?.toString() ?? null,
		},
		null,
		row.report_id.toString(),
	);
}

export class ReportService {
	private readonly messageChannelAuthService: MessageChannelAuthService;

	constructor(
		private reportRepository: IReportRepository,
		private channelRepository: IChannelRepository,
		private guildRepository: IGuildRepositoryAggregate,
		private userRepository: IUserRepository,
		private inviteRepository: IInviteRepository,
		private emailService: IEmailService,
		private emailDnsValidationService: IEmailDnsValidationService,
		private snowflakeService: ISnowflakeService,
		private storageService: IStorageService,
		private gatewayService: IGatewayService,
		private rateLimitService: IRateLimitService,
		private webhookRepository: IWebhookRepository,
		private reportSearchService: IReportSearchService | null = null,
	) {
		this.messageChannelAuthService = new MessageChannelAuthService(
			this.channelRepository,
			this.userRepository,
			this.guildRepository,
			this.gatewayService,
		);
	}

	async reportMessage(
		reporter: ReporterMetadata,
		viewer: ThreadViewer,
		channelId: ChannelID,
		messageId: MessageID,
		category: string,
		flow: ReportFlowRecord | null = null,
	): Promise<IARSubmission> {
		await this.checkReportBan(reporter.id);
		const reporterKey = this.getReporterRateLimitKey(reporter);
		await this.ensureReportRateLimit(this.createReportRateLimitIdentifier(reporterKey), REPORT_RATE_LIMIT_MAX, false);
		const {authChannel, channel, message} = await this.getReportableMessageForReporter({
			reporterId: reporter.id,
			viewer,
			channelId,
			messageId,
		});
		const author = await this.resolveReportedAuthor(message);
		if (!author) {
			throw new UnknownMessageError();
		}
		if (reporter.id && author.userId === reporter.id) {
			throw new CannotReportOwnMessageError();
		}
		const [reportedUser, messageContext, webhookColumns] = await Promise.all([
			author.userId ? this.userRepository.findUnique(author.userId) : null,
			this.gatherMessageContext(channelId, messageId, author, authChannel),
			this.snapshotReportedWebhook(author),
		]);
		if (author.userId && !reportedUser) {
			throw new UnknownUserError();
		}
		const reportId = createReportID(await this.snowflakeService.generate());
		const guild = channel.guildId ? await this.guildRepository.findUnique(channel.guildId) : null;
		const contentWarningSnapshot = await this.buildContentWarningSnapshot(guild, channel);
		const reportData: IARSubmissionRow = {
			report_id: reportId,
			reporter_id: reporter.id,
			reporter_email: null,
			reporter_full_legal_name: reporter.fullLegalName,
			reporter_country_of_residence: reporter.countryOfResidence,
			reported_at: new Date(),
			status: ReportStatus.PENDING,
			report_type: ReportType.MESSAGE,
			category,
			additional_info: null,
			reported_user_id: author.userId,
			reported_user_avatar_hash: reportedUser?.avatarHash || null,
			reported_guild_id: channel.guildId || null,
			reported_guild_name: guild?.name ?? null,
			reported_guild_icon_hash: guild?.iconHash || null,
			reported_message_id: messageId,
			reported_channel_id: channelId,
			reported_channel_name: channel.name || null,
			message_context: messageContext,
			guild_context_id: channel.guildId || null,
			resolved_at: null,
			resolved_by_admin_id: null,
			public_comment: null,
			audit_log_reason: null,
			reported_guild_invite_code: null,
			...contentWarningSnapshot,
			...buildReportFlowColumns(flow),
			...webhookColumns,
		};
		let reservation: MessageReportSubmissionByReporterRow | null = null;
		if (reporter.id) {
			reservation = {
				reporter_id: reporter.id,
				channel_id: channelId,
				message_id: messageId,
				report_id: reportId,
				reported_at: reportData.reported_at,
			};
			if (!(await this.reportRepository.reserveMessageReportByReporter(reservation))) {
				throw new ConflictError({code: APIErrorCodes.CONFLICT});
			}
		}
		try {
			await this.consumeMessageReportRateLimits({reporter, channel, message});
			reportData.reported_profile_snapshot = await this.captureProfileSnapshot(reportId, {
				user: reportedUser,
				memberGuildId: channel.guildId,
			});
			const report = await this.reportRepository.createReport(reportData);
			await emitReportFiled(reportData, 'message');
			if (this.reportSearchService && 'indexReport' in this.reportSearchService) {
				await this.reportSearchService.indexReport(report).catch((error) => {
					Logger.error({error, reportId: report.reportId}, 'Failed to index message report in search');
				});
			}
			return report;
		} catch (error) {
			if (reservation) {
				await this.reportRepository.releaseMessageReportByReporter(reservation).catch((cleanupError) => {
					Logger.error({error: cleanupError, reportId}, 'Failed to clean up message report duplicate reservation');
				});
			}
			throw error;
		}
	}

	async reportUser(
		reporter: ReporterMetadata,
		reportedUserId: UserID,
		category: string,
		guildId?: GuildID,
		flow: ReportFlowRecord | null = null,
	): Promise<IARSubmission> {
		await this.checkReportBan(reporter.id);
		const rateLimitIdentifier = this.createReportRateLimitIdentifier(this.getReporterRateLimitKey(reporter));
		await this.ensureReportRateLimit(rateLimitIdentifier, REPORT_RATE_LIMIT_MAX, false);
		if (reporter.id && reportedUserId === reporter.id) {
			throw new CannotReportYourselfError();
		}
		const reportedUser = await this.userRepository.findUnique(reportedUserId);
		if (!reportedUser) {
			throw new UnknownUserError();
		}
		const reportId = createReportID(await this.snowflakeService.generate());
		const guild = guildId ? await this.getGuildContextForReporter(reporter.id, guildId) : null;
		const contentWarningSnapshot = await this.buildContentWarningSnapshot(guild, null);
		const reportData: IARSubmissionRow = {
			report_id: reportId,
			reporter_id: reporter.id,
			reporter_email: null,
			reporter_full_legal_name: reporter.fullLegalName,
			reporter_country_of_residence: reporter.countryOfResidence,
			reported_at: new Date(),
			status: ReportStatus.PENDING,
			report_type: ReportType.USER,
			category,
			additional_info: null,
			reported_user_id: reportedUserId,
			reported_user_avatar_hash: reportedUser.avatarHash || null,
			reported_guild_id: guildId || null,
			reported_guild_name: guild?.name ?? null,
			reported_guild_icon_hash: guild?.iconHash || null,
			reported_message_id: null,
			reported_channel_id: null,
			reported_channel_name: null,
			message_context: null,
			guild_context_id: guildId || null,
			resolved_at: null,
			resolved_by_admin_id: null,
			public_comment: null,
			audit_log_reason: null,
			reported_guild_invite_code: null,
			...contentWarningSnapshot,
			...buildReportFlowColumns(flow),
			...buildReportedWebhookColumns(null),
		};
		let reservation: UserReportSubmissionByReporterRow | null = null;
		if (reporter.id) {
			reservation = {
				reporter_id: reporter.id,
				reported_user_id: reportedUserId,
				report_id: reportId,
				reported_at: reportData.reported_at,
			};
			if (!(await this.reportRepository.reserveUserReportByReporter(reservation))) {
				throw new ConflictError({code: APIErrorCodes.CONFLICT});
			}
		}
		try {
			await this.ensureReportRateLimit(rateLimitIdentifier, REPORT_RATE_LIMIT_MAX, true);
			reportData.reported_profile_snapshot = await this.captureProfileSnapshot(reportId, {
				user: reportedUser,
				memberGuildId: guildId,
			});
			const report = await this.reportRepository.createReport(reportData);
			await emitReportFiled(reportData, 'user');
			if (this.reportSearchService && 'indexReport' in this.reportSearchService) {
				await this.reportSearchService.indexReport(report).catch((error) => {
					Logger.error({error, reportId: report.reportId}, 'Failed to index user report in search');
				});
			}
			return report;
		} catch (error) {
			if (reservation) {
				await this.reportRepository.releaseUserReportByReporter(reservation).catch((cleanupError) => {
					Logger.error({error: cleanupError, reportId}, 'Failed to clean up user report duplicate reservation');
				});
			}
			throw error;
		}
	}

	async reportGuild(
		reporter: ReporterMetadata,
		guildId: GuildID,
		category: string,
		inviteCode?: InviteCode,
	): Promise<IARSubmission> {
		await this.checkReportBan(reporter.id);
		const rateLimitIdentifier = this.createReportRateLimitIdentifier(this.getReporterRateLimitKey(reporter));
		await this.ensureReportRateLimit(rateLimitIdentifier, REPORT_RATE_LIMIT_MAX, false);
		const guild = await this.guildRepository.findUnique(guildId);
		if (!guild) {
			throw new UnknownGuildError();
		}
		if (reporter.id && guild.ownerId === reporter.id) {
			throw new CannotReportOwnGuildError();
		}
		await this.authorizeGuildReporter(reporter.id, guild, inviteCode);
		const reportedInviteCode = inviteCode ?? null;
		const reportId = createReportID(await this.snowflakeService.generate());
		const contentWarningSnapshot = await this.buildContentWarningSnapshot(guild, null);
		const reportData: IARSubmissionRow = {
			report_id: reportId,
			reporter_id: reporter.id,
			reporter_email: null,
			reporter_full_legal_name: reporter.fullLegalName,
			reporter_country_of_residence: reporter.countryOfResidence,
			reported_at: new Date(),
			status: ReportStatus.PENDING,
			report_type: ReportType.GUILD,
			category,
			additional_info: null,
			reported_user_id: null,
			reported_user_avatar_hash: null,
			reported_guild_id: guildId,
			reported_guild_name: guild.name,
			reported_guild_icon_hash: guild.iconHash || null,
			reported_message_id: null,
			reported_channel_id: null,
			reported_channel_name: null,
			message_context: null,
			guild_context_id: guildId,
			resolved_at: null,
			resolved_by_admin_id: null,
			public_comment: null,
			audit_log_reason: null,
			reported_guild_invite_code: reportedInviteCode,
			...contentWarningSnapshot,
			...buildReportFlowColumns(null),
			...buildReportedWebhookColumns(null),
		};
		let reservation: GuildReportSubmissionByReporterRow | null = null;
		if (reporter.id) {
			reservation = {
				reporter_id: reporter.id,
				reported_guild_id: guildId,
				report_id: reportId,
				reported_at: reportData.reported_at,
			};
			if (!(await this.reportRepository.reserveGuildReportByReporter(reservation))) {
				throw new ConflictError({code: APIErrorCodes.CONFLICT});
			}
		}
		try {
			await this.ensureReportRateLimit(rateLimitIdentifier, REPORT_RATE_LIMIT_MAX, true);
			reportData.reported_profile_snapshot = await this.captureProfileSnapshot(reportId, {guild});
			const report = await this.reportRepository.createReport(reportData);
			await emitReportFiled(reportData, 'guild');
			if (this.reportSearchService && 'indexReport' in this.reportSearchService) {
				await this.reportSearchService.indexReport(report).catch((error) => {
					Logger.error({error, reportId: report.reportId}, 'Failed to index guild report in search');
				});
			}
			return report;
		} catch (error) {
			if (reservation) {
				await this.reportRepository.releaseGuildReportByReporter(reservation).catch((cleanupError) => {
					Logger.error({error: cleanupError, reportId}, 'Failed to clean up guild report duplicate reservation');
				});
			}
			throw error;
		}
	}

	private async getGuildContextForReporter(reporterId: UserID | null, guildId: GuildID): Promise<Guild> {
		const guild = await this.guildRepository.findUnique(guildId);
		if (!guild || !reporterId || !(await this.guildRepository.getMember(guildId, reporterId))) {
			throw new UnknownGuildError();
		}
		return guild;
	}

	private async authorizeGuildReporter(
		reporterId: UserID | null,
		guild: Guild,
		inviteCode: InviteCode | undefined,
	): Promise<void> {
		if (reporterId) {
			const member = await this.guildRepository.getMember(guild.id, reporterId);
			if (member) return;
		}
		if (guild.features.has(GuildFeatures.DISCOVERABLE)) return;
		if (inviteCode) {
			const invite = await this.inviteRepository.findUnique(inviteCode);
			if (invite && invite.guildId === guild.id) return;
		}
		throw new CannotReportGuildError();
	}

	async sendDsaReportVerificationCode(email: string, locale: string | null = null): Promise<void> {
		const normalizedEmail = this.normalizeEmail(email);
		await this.ensureDsaResendCooldown(normalizedEmail);
		const recipientLimit = await this.rateLimitService.checkLimit({
			identifier: `dsa:report:email:send:recipient:${normalizedEmail}`,
			maxAttempts: DSA_EMAIL_SEND_RECIPIENT_MAX,
			windowMs: DSA_EMAIL_SEND_RECIPIENT_WINDOW,
		});
		if (!recipientLimit.allowed) {
			throw new RateLimitError({
				retryAfter: recipientLimit.retryAfter,
				retryAfterDecimal: recipientLimit.retryAfterDecimal,
				limit: recipientLimit.limit,
				resetTime: recipientLimit.resetTime,
				resetAfterDecimal: recipientLimit.resetAfterDecimal,
			});
		}
		const hasValidDns = await this.emailDnsValidationService.hasValidDnsRecords(normalizedEmail);
		if (!hasValidDns) {
			throw InputValidationError.fromCode('email', ValidationErrorCodes.EMAIL_DOMAIN_CANNOT_RECEIVE_MAIL);
		}
		const verificationCode = this.generateDsaVerificationCode();
		const codeHash = this.hashVerificationCode(verificationCode);
		const expiresAt = new Date(Date.now() + ms('10 minutes'));
		await this.reportRepository.upsertDsaEmailVerification({
			email_lower: normalizedEmail,
			code_hash: codeHash,
			expires_at: expiresAt,
			last_sent_at: new Date(),
		});
		await this.rateLimitService.resetLimit(this.createDsaVerifyAttemptIdentifier(normalizedEmail));
		const sent = await this.emailService.sendDsaReportVerificationCode(
			normalizedEmail,
			verificationCode,
			expiresAt,
			locale,
		);
		if (!sent) {
			await this.reportRepository.consumeDsaEmailVerification(normalizedEmail, codeHash);
			Logger.warn({template: 'dsa_report_verification'}, 'DSA report verification email was not sent');
			throw new ServiceUnavailableError();
		}
	}

	private async ensureDsaResendCooldown(normalizedEmail: string): Promise<void> {
		const current = await this.reportRepository.getDsaEmailVerification(normalizedEmail);
		if (!current) {
			return;
		}
		const now = Date.now();
		if (current.expires_at.getTime() < now) {
			return;
		}
		const remainingMs = current.last_sent_at.getTime() + DSA_EMAIL_RESEND_COOLDOWN - now;
		if (remainingMs <= 0) {
			return;
		}
		throw new RateLimitError({
			retryAfter: Math.ceil(remainingMs / 1000),
			retryAfterDecimal: remainingMs / 1000,
			limit: 1,
			resetTime: new Date(now + remainingMs),
			resetAfterDecimal: remainingMs / 1000,
		});
	}

	private createDsaVerifyAttemptIdentifier(normalizedEmail: string): string {
		return `dsa:report:email:verify:address:${normalizedEmail}`;
	}

	async verifyDsaReportEmail(email: string, code: string): Promise<string> {
		const normalizedEmail = this.normalizeEmail(email);
		const verificationRow = await this.reportRepository.getDsaEmailVerification(normalizedEmail);
		const attempt = await this.rateLimitService.checkLimit({
			identifier: this.createDsaVerifyAttemptIdentifier(normalizedEmail),
			maxAttempts: DSA_EMAIL_VERIFY_ADDRESS_MAX,
			windowMs: DSA_EMAIL_VERIFY_ADDRESS_WINDOW,
		});
		if (!attempt.allowed) {
			if (verificationRow) {
				await this.reportRepository.consumeDsaEmailVerification(normalizedEmail, verificationRow.code_hash);
			}
			throw new InvalidDsaVerificationCodeError();
		}
		if (!verificationRow || verificationRow.expires_at.getTime() < Date.now()) {
			throw new InvalidDsaVerificationCodeError();
		}
		if (this.hashVerificationCode(code) !== verificationRow.code_hash) {
			throw new InvalidDsaVerificationCodeError();
		}
		const consumed = await this.reportRepository.consumeDsaEmailVerification(
			normalizedEmail,
			verificationRow.code_hash,
		);
		if (!consumed) {
			throw new InvalidDsaVerificationCodeError();
		}
		const ticket = randomBytes(DSA_TICKET_BYTES).toString('hex');
		await this.reportRepository.createDsaTicket({
			ticket,
			email_lower: normalizedEmail,
			expires_at: new Date(Date.now() + ms('1 hour')),
			created_at: new Date(),
		});
		return ticket;
	}

	async createDsaReport(report: DsaReportRequest, requestLocale: string | null = null): Promise<IARSubmission> {
		const ticket = await this.readDsaTicket(report.ticket);
		const classification = this.classifyDsaReport(report, requestLocale);
		const reporterMeta: ReporterMetadata = {
			id: null,
			email: ticket.email_lower,
			fullLegalName: report.reporter_full_legal_name ?? null,
			countryOfResidence: report.reporter_country_of_residence,
		};
		await this.checkReportBan(null);
		const reporterKey = this.getReporterRateLimitKey(reporterMeta);
		await this.ensureReportRateLimit(this.createReportRateLimitIdentifier(reporterKey), REPORT_RATE_LIMIT_MAX, false);
		const reportId = createReportID(await this.snowflakeService.generate());
		const {row: reportRow, profileSubject} = await this.buildDsaReportRow(
			reportId,
			report,
			reporterMeta,
			classification,
		);
		await this.ensureReportRateLimit(this.createReportRateLimitIdentifier(reporterKey), REPORT_RATE_LIMIT_MAX, true);
		const claimed = await this.reportRepository.consumeDsaTicket(report.ticket, ticket.email_lower);
		if (!claimed) {
			throw new InvalidDsaTicketError();
		}
		reportRow.reported_profile_snapshot = await this.captureProfileSnapshot(reportId, profileSubject);
		const createdReport = await this.reportRepository.createReport(reportRow);
		await emitReportFiled(reportRow, 'dsa');
		if (this.reportSearchService && 'indexReport' in this.reportSearchService) {
			await this.reportSearchService.indexReport(createdReport).catch((error) => {
				Logger.error({error, reportId: createdReport.reportId}, 'Failed to index DSA report in search');
			});
		}
		await this.sendDsaReportReceipt(
			ticket.email_lower,
			createdReport.reportId,
			report.report_type,
			classification.flow?.locale ?? requestLocale,
		);
		return createdReport;
	}

	private async sendDsaReportReceipt(
		email: string,
		reportId: ReportID,
		targetKind: DsaReportRequest['report_type'],
		locale: string | null,
	): Promise<void> {
		try {
			const sent = await this.emailService.sendReportReceivedEmail(email, reportId.toString(), targetKind, locale);
			if (!sent) {
				Logger.warn({template: 'report_received', reportId}, 'DSA report receipt was not sent');
			}
		} catch (error) {
			Logger.error({error, reportId}, 'Failed to send DSA report receipt');
		}
	}

	private classifyDsaReport(report: DsaReportRequest, requestLocale: string | null): DsaReportClassification {
		if (!report.steps || !report.revision_hash) {
			if (!report.category) {
				throw InputValidationError.fromCode('category', ValidationErrorCodes.INVALID_FORMAT);
			}
			return {category: report.category, flow: null};
		}
		const answers = resolveReportFlowAnswers({
			target: report.report_type,
			surface: 'dsa',
			revisionHash: report.revision_hash,
			steps: report.steps,
		});
		if (!answers.isCurrentRevision) {
			Logger.warn(
				{
					clientRevision: report.revision_hash,
					currentRevision: answers.currentRevisionHash,
					target: report.report_type,
				},
				'Accepted a DSA report flow submission from an outdated revision',
			);
		}
		if (answers.legacyCategory !== 'child_safety' && !report.reporter_full_legal_name) {
			throw InputValidationError.fromCode('reporter_full_legal_name', ValidationErrorCodes.INVALID_FORMAT);
		}
		return {
			category: answers.legacyCategory,
			flow: {
				reason: answers.reason,
				revisionHash: report.revision_hash,
				stepsJson: answers.stepsJson,
				locale: resolveReportFlowLocale(report.locale ?? requestLocale),
				surface: 'dsa',
			},
		};
	}

	private async buildDsaReportRow(
		reportId: ReportID,
		report: DsaReportRequest,
		reporter: ReporterMetadata,
		classification: DsaReportClassification,
	): Promise<DsaReportDraft> {
		switch (report.report_type) {
			case 'message':
				return this.buildDsaMessageReportRow(reportId, report, reporter, classification);
			case 'user':
				return this.buildDsaUserReportRow(reportId, report, reporter, classification);
			case 'guild':
				return this.buildDsaGuildReportRow(reportId, report, reporter, classification);
			default:
				throw new InvalidDsaReportTargetError();
		}
	}

	private async buildDsaMessageReportRow(
		reportId: ReportID,
		report: Extract<
			DsaReportRequest,
			{
				report_type: 'message';
			}
		>,
		reporter: ReporterMetadata,
		classification: DsaReportClassification,
	): Promise<DsaReportDraft> {
		const {guildSegment, channelId, messageId} = this.extractChannelAndMessageFromLink(report.message_link);
		const channel = await this.channelRepository.findUnique(channelId);
		if (!channel || guildSegment !== (channel.guildId?.toString() ?? ME)) {
			throw new UnknownMessageError();
		}
		const message = await this.channelRepository.getMessage(channelId, messageId);
		if (!message || message.channelId !== channelId) {
			throw new UnknownMessageError();
		}
		const author = await this.resolveReportedAuthor(message);
		if (!author) {
			throw new UnknownMessageError();
		}
		if (report.reported_user_tag && !(await this.isTagOfUser(report.reported_user_tag, author.userId))) {
			throw new UnknownMessageError();
		}
		const reportedUser = author.userId ? await this.userRepository.findUnique(author.userId) : null;
		if (author.userId && !reportedUser) {
			throw new UnknownMessageError();
		}
		const scope: MessageContextScope = (await this.isChannelReadableByEveryone(channel)) ? 'window' : 'target';
		const [messageContext, webhookColumns] = await Promise.all([
			this.gatherMessageContext(channelId, messageId, author, undefined, scope),
			this.snapshotReportedWebhook(author),
		]);
		const guild = channel.guildId ? await this.guildRepository.findUnique(channel.guildId) : null;
		const contentWarningSnapshot = await this.buildContentWarningSnapshot(guild, channel);
		const row: IARSubmissionRow = {
			report_id: reportId,
			reporter_id: null,
			reporter_email: reporter.email,
			reporter_full_legal_name: reporter.fullLegalName,
			reporter_country_of_residence: reporter.countryOfResidence,
			reported_at: new Date(),
			status: ReportStatus.PENDING,
			report_type: ReportType.MESSAGE,
			category: classification.category,
			additional_info: report.additional_info ?? null,
			reported_user_id: author.userId,
			reported_user_avatar_hash: reportedUser?.avatarHash || null,
			reported_guild_id: channel.guildId || null,
			reported_guild_name: guild?.name ?? null,
			reported_guild_icon_hash: guild?.iconHash ?? null,
			reported_message_id: messageId,
			reported_channel_id: channelId,
			reported_channel_name: channel.name || null,
			message_context: messageContext,
			guild_context_id: channel.guildId || null,
			resolved_at: null,
			resolved_by_admin_id: null,
			public_comment: null,
			audit_log_reason: null,
			reported_guild_invite_code: null,
			...contentWarningSnapshot,
			...buildReportFlowColumns(classification.flow),
			...webhookColumns,
		};
		return {row, profileSubject: {user: reportedUser, memberGuildId: channel.guildId}};
	}

	private async buildDsaUserReportRow(
		reportId: ReportID,
		report: Extract<
			DsaReportRequest,
			{
				report_type: 'user';
			}
		>,
		reporter: ReporterMetadata,
		classification: DsaReportClassification,
	): Promise<DsaReportDraft> {
		const target = await this.resolveDsaUser(report.user_id ?? undefined, report.user_tag ?? undefined);
		const contentWarningSnapshot = await this.buildContentWarningSnapshot(null, null);
		const row: IARSubmissionRow = {
			report_id: reportId,
			reporter_id: null,
			reporter_email: reporter.email,
			reporter_full_legal_name: reporter.fullLegalName,
			reporter_country_of_residence: reporter.countryOfResidence,
			reported_at: new Date(),
			status: ReportStatus.PENDING,
			report_type: ReportType.USER,
			category: classification.category,
			additional_info: report.additional_info ?? null,
			reported_user_id: target.id,
			reported_user_avatar_hash: target.avatarHash || null,
			reported_guild_id: null,
			reported_guild_name: null,
			reported_guild_icon_hash: null,
			reported_message_id: null,
			reported_channel_id: null,
			reported_channel_name: null,
			message_context: null,
			guild_context_id: null,
			resolved_at: null,
			resolved_by_admin_id: null,
			public_comment: null,
			audit_log_reason: null,
			reported_guild_invite_code: null,
			...contentWarningSnapshot,
			...buildReportFlowColumns(classification.flow),
			...buildReportedWebhookColumns(null),
		};
		return {row, profileSubject: {user: target}};
	}

	private async buildDsaGuildReportRow(
		reportId: ReportID,
		report: Extract<
			DsaReportRequest,
			{
				report_type: 'guild';
			}
		>,
		reporter: ReporterMetadata,
		classification: DsaReportClassification,
	): Promise<DsaReportDraft> {
		const guildId = createGuildID(report.guild_id);
		const guild = await this.guildRepository.findUnique(guildId);
		if (!guild) {
			throw new UnknownGuildError();
		}
		let inviteCode: string | null = null;
		if (report.invite_code) {
			inviteCode = this.sanitizeInviteCode(report.invite_code);
			if (!inviteCode) {
				throw new InvalidDsaReportTargetError();
			}
			await this.validateInviteForGuild(inviteCode, guildId);
		}
		const contentWarningSnapshot = await this.buildContentWarningSnapshot(guild, null);
		const row: IARSubmissionRow = {
			report_id: reportId,
			reporter_id: null,
			reporter_email: reporter.email,
			reporter_full_legal_name: reporter.fullLegalName,
			reporter_country_of_residence: reporter.countryOfResidence,
			reported_at: new Date(),
			status: ReportStatus.PENDING,
			report_type: ReportType.GUILD,
			category: classification.category,
			additional_info: report.additional_info ?? null,
			reported_user_id: null,
			reported_user_avatar_hash: null,
			reported_guild_id: guildId,
			reported_guild_name: guild.name,
			reported_guild_icon_hash: guild.iconHash || null,
			reported_message_id: null,
			reported_channel_id: null,
			reported_channel_name: null,
			message_context: null,
			guild_context_id: guildId,
			resolved_at: null,
			resolved_by_admin_id: null,
			public_comment: null,
			audit_log_reason: null,
			reported_guild_invite_code: inviteCode,
			...contentWarningSnapshot,
			...buildReportFlowColumns(classification.flow),
			...buildReportedWebhookColumns(null),
		};
		return {row, profileSubject: {guild}};
	}

	private async getReportableMessageForReporter({
		reporterId,
		viewer,
		channelId,
		messageId,
	}: {
		reporterId: UserID | null;
		viewer: ThreadViewer;
		channelId: ChannelID;
		messageId: MessageID;
	}): Promise<{
		authChannel: AuthenticatedChannel;
		channel: Channel;
		message: Message;
	}> {
		if (!reporterId) {
			throw new UnknownChannelError();
		}
		const authChannel = await this.messageChannelAuthService.getChannelAuthenticated({
			userId: reporterId,
			channelId,
			viewer,
		});
		if (!(await this.canAccessMessage(authChannel, messageId))) {
			throw new UnknownMessageError();
		}
		const message = await this.channelRepository.getMessage(channelId, messageId);
		if (!message || message.channelId !== channelId) {
			throw new UnknownMessageError();
		}
		return {
			authChannel,
			channel: authChannel.channel,
			message,
		};
	}

	private async snapshotReportedWebhook(author: ReportedAuthor): Promise<ReportedWebhookColumns> {
		if (!author.webhookId) {
			return buildReportedWebhookColumns(author);
		}
		const webhook = await this.webhookRepository.findUnique(author.webhookId);
		const creator = webhook?.creatorId ? await this.userRepository.findUnique(webhook.creatorId) : null;
		return buildReportedWebhookColumns(author, webhook, creator);
	}

	private async resolveReportedAuthor(message: Message): Promise<ReportedAuthor | null> {
		if ((message.flags & MessageFlags.IS_CROSSPOST) === 0) {
			return messageAuthor(message);
		}
		if ((message.flags & MessageFlags.SOURCE_MESSAGE_DELETED) !== 0) {
			return null;
		}
		const reference = message.reference;
		if (!reference?.messageId) {
			return null;
		}
		const source = await this.channelRepository.getMessage(reference.channelId, reference.messageId);
		if (!source || (source.flags & MessageFlags.IS_CROSSPOST) !== 0) {
			return null;
		}
		return messageAuthor(source);
	}

	private async canAccessMessage(authChannel: AuthenticatedChannel, messageId: MessageID): Promise<boolean> {
		if (!authChannel.guild) {
			return true;
		}
		if (await authChannel.hasPermission(Permissions.READ_MESSAGE_HISTORY)) {
			return true;
		}
		const floorMs = this.reportableFloorMs(authChannel);
		return floorMs !== null && snowflakeToDate(messageId).getTime() >= floorMs;
	}

	private reportableFloorMs(authChannel: AuthenticatedChannel): number | null {
		const floors = [authChannel.guild?.message_history_cutoff, authChannel.member?.joined_at]
			.filter((value): value is string => Boolean(value))
			.map((value) => new Date(value).getTime());
		return floors.length > 0 ? Math.min(...floors) : null;
	}

	private async buildContentWarningSnapshot(
		guild: Guild | null,
		channel: Channel | null,
	): Promise<
		Pick<
			IARSubmissionRow,
			| 'reported_guild_nsfw'
			| 'reported_guild_content_warning_level'
			| 'reported_guild_content_warning_text'
			| 'reported_channel_nsfw_override'
			| 'reported_channel_content_warning_level'
			| 'reported_channel_content_warning_text'
			| 'reported_channel_effective_nsfw'
			| 'reported_channel_effective_content_warning_level'
			| 'reported_channel_effective_content_warning_text'
		>
	> {
		if (!guild) {
			return {
				reported_guild_nsfw: null,
				reported_guild_content_warning_level: null,
				reported_guild_content_warning_text: null,
				reported_channel_nsfw_override: channel?.nsfwOverride ?? null,
				reported_channel_content_warning_level: channel?.contentWarningLevel ?? null,
				reported_channel_content_warning_text: channel?.contentWarningText ?? null,
				reported_channel_effective_nsfw: null,
				reported_channel_effective_content_warning_level: null,
				reported_channel_effective_content_warning_text: null,
			};
		}
		const guildView = guildToContentWarningView(guild);
		const scope = channel
			? await resolveNsfwScopeChannel(channel, (channelId) => this.channelRepository.findUnique(channelId))
			: null;
		let parentCategoryView: ContentWarningChannelLike | null = null;
		if (scope?.parentId) {
			const parent = await this.channelRepository.findUnique(scope.parentId);
			if (parent) {
				parentCategoryView = channelToContentWarningView(parent);
			}
		}
		let effectiveNsfw: boolean | null = null;
		let effectiveLevel: number | null = null;
		let effectiveText: string | null = null;
		if (scope) {
			const channelView = channelToContentWarningView(scope);
			effectiveNsfw = computeEffectiveChannelNsfw(channelView, parentCategoryView, guildView);
			const effective = computeEffectiveContentWarning(channelView, parentCategoryView, guildView);
			effectiveLevel = effective.level;
			effectiveText = effective.text;
		}
		return {
			reported_guild_nsfw: guild.nsfw,
			reported_guild_content_warning_level: guild.contentWarningLevel,
			reported_guild_content_warning_text: guild.contentWarningText,
			reported_channel_nsfw_override: channel?.nsfwOverride ?? null,
			reported_channel_content_warning_level: channel?.contentWarningLevel ?? null,
			reported_channel_content_warning_text: channel?.contentWarningText ?? null,
			reported_channel_effective_nsfw: effectiveNsfw,
			reported_channel_effective_content_warning_level: effectiveLevel,
			reported_channel_effective_content_warning_text: effectiveText,
		};
	}

	private async resolveDsaUser(userId?: bigint, userTag?: string | null): Promise<User> {
		if (userId != null) {
			const user = await this.userRepository.findUnique(createUserID(userId));
			if (!user) {
				throw new UnknownUserError();
			}
			if (userTag) {
				const taggedUser = await this.findUserByTag(userTag);
				if (taggedUser.id !== user.id) {
					throw new InvalidDsaReportTargetError();
				}
			}
			return user;
		}
		if (userTag) {
			return this.findUserByTag(userTag);
		}
		throw new InvalidDsaReportTargetError();
	}

	private async findUserByTag(tag: string): Promise<User> {
		const parsed = this.parseFluxerTag(tag);
		if (!parsed) {
			throw new InvalidDsaReportTargetError();
		}
		const user = await this.userRepository.findByUsernameDiscriminator(parsed.username, parsed.discriminator);
		if (!user) {
			throw new UnknownUserError();
		}
		return user;
	}

	private async isTagOfUser(tag: string, userId: UserID | null): Promise<boolean> {
		const parsed = this.parseFluxerTag(tag);
		if (!parsed || !userId) {
			return false;
		}
		const user = await this.userRepository.findByUsernameDiscriminator(parsed.username, parsed.discriminator);
		return user?.id === userId;
	}

	private async isChannelReadableByEveryone(channel: Channel): Promise<boolean> {
		if (!channel.guildId) {
			return false;
		}
		const everyoneRole = await this.guildRepository.getRole(guildIdToRoleId(channel.guildId), channel.guildId);
		if (!everyoneRole) {
			return false;
		}
		if ((everyoneRole.permissions & Permissions.ADMINISTRATOR) !== 0n) {
			return true;
		}
		const overwrite = channel.permissionOverwrites.get(everyoneRole.id);
		const permissions = overwrite
			? (everyoneRole.permissions & ~overwrite.deny) | overwrite.allow
			: everyoneRole.permissions;
		return (permissions & PUBLIC_CHANNEL_PERMISSIONS) === PUBLIC_CHANNEL_PERMISSIONS;
	}

	private async readDsaTicket(ticket: string): Promise<DSAReportTicketRow> {
		const ticketRow = await this.reportRepository.getDsaTicket(ticket);
		if (!ticketRow || ticketRow.expires_at.getTime() < Date.now()) {
			throw new InvalidDsaTicketError();
		}
		return ticketRow;
	}

	private generateDsaVerificationCode(): string {
		const segments: Array<string> = [];
		for (let i = 0; i < 2; i += 1) {
			let segment = '';
			for (let j = 0; j < DSA_CODE_SEGMENT_LENGTH; j += 1) {
				segment += DSA_CODE_CHARSET[randomInt(DSA_CODE_CHARSET.length)];
			}
			segments.push(segment);
		}
		return segments.join(DSA_CODE_SEPARATOR);
	}

	private hashVerificationCode(code: string): string {
		return createHash('sha256').update(code).digest('hex');
	}

	private normalizeEmail(email: string): string {
		return email.trim().toLowerCase();
	}

	private parseFluxerTag(tag: string): {
		username: string;
		discriminator: number;
	} | null {
		const trimmed = tag.trim();
		const match = /^(.+)#(\d{4})$/.exec(trimmed);
		if (!match) return null;
		return {
			username: match[1],
			discriminator: Number.parseInt(match[2], 10),
		};
	}

	private extractChannelAndMessageFromLink(link: string): {
		guildSegment: string;
		channelId: ChannelID;
		messageId: MessageID;
	} {
		let parsed: URL;
		try {
			parsed = new URL(link);
		} catch {
			throw new UnknownMessageError();
		}
		const segments = parsed.pathname.split('/').filter((segment) => segment.length > 0);
		if (segments.length < 4 || segments[0] !== 'channels') {
			throw new UnknownMessageError();
		}
		const channelId = SnowflakeType.safeParse(segments[2]);
		const messageId = SnowflakeType.safeParse(segments[3]);
		if (!channelId.success || !messageId.success) {
			throw new UnknownMessageError();
		}
		return {
			guildSegment: segments[1],
			channelId: createChannelID(channelId.data),
			messageId: createMessageID(messageId.data),
		};
	}

	private sanitizeInviteCode(raw: string): string {
		const trimmed = raw.trim();
		const segments = trimmed.split('/').filter((segment) => segment.length > 0);
		const candidate = segments.length > 0 ? segments[segments.length - 1] : trimmed;
		return candidate;
	}

	private async validateInviteForGuild(code: string, guildId: GuildID): Promise<void> {
		const invite = await this.inviteRepository.findUnique(createInviteCode(code));
		if (!invite) {
			throw new UnknownInviteError();
		}
		if (invite.type !== InviteTypes.GUILD || !invite.guildId || invite.guildId !== guildId) {
			throw new InvalidDsaReportTargetError();
		}
	}

	async getReport(reportId: ReportID): Promise<IARSubmission> {
		const report = await this.reportRepository.getReport(reportId);
		if (!report) {
			throw new UnknownReportError();
		}
		return report;
	}

	async listReportsByStatus(
		status: number,
		limit?: number,
		offset?: number,
	): Promise<{reports: Array<IARSubmission>; total: number}> {
		if (!this.reportSearchService) {
			throw new FeatureTemporarilyDisabledError();
		}
		const {hits, total} = await this.reportSearchService.listReportsByStatus(status, limit, offset);
		const reportIds = hits.map((hit) => createReportID(BigInt(hit.id)));
		const loaded = await Promise.all(reportIds.map((id) => this.reportRepository.getReport(id)));
		const reports = loaded.filter((report): report is IARSubmission => report !== null);
		const orphanedReportIds = reportIds.filter((_, index) => loaded[index] === null).map((id) => id.toString());
		if (orphanedReportIds.length > 0) {
			Logger.warn(
				{orphanedReportIds, status},
				'Report search index lists reports that are no longer stored, run refresh_search_index reports',
			);
		}
		return {reports, total};
	}

	async resolveReport(
		reportId: ReportID,
		adminUserId: UserID,
		publicComment: string | null,
		auditLogReason: string | null,
		resolution: {outcome?: ReportOutcome; resolvedBy?: ResolvedBy} = {},
	): Promise<IARSubmission> {
		const report = await this.reportRepository.resolveReport(reportId, adminUserId, publicComment, auditLogReason);
		if (this.reportSearchService && 'updateReport' in this.reportSearchService) {
			await this.reportSearchService.updateReport(report).catch((error) => {
				Logger.error({error, reportId: report.reportId}, 'Failed to update report in search index');
			});
		}
		const outcome = resolution.outcome ?? (await this.observedOutcome(report));
		await emitReportResolved(report, outcome, resolution.resolvedBy ?? 'staff');
		return report;
	}

	private async observedOutcome(report: IARSubmission): Promise<ReportOutcome> {
		if (!report.reportedUserId) return 'unspecified';
		try {
			const reported = await this.userRepository.findUnique(report.reportedUserId);
			return reported && isUnderEnforcement(reported) ? 'actioned' : 'unspecified';
		} catch (error) {
			Logger.warn({error, reportId: report.reportId}, 'Could not read the reported account for a resolved report');
			return 'unspecified';
		}
	}

	private async gatherMessageContext(
		channelId: ChannelID,
		targetMessageId: MessageID,
		targetAuthor: ReportedAuthor,
		authChannel?: AuthenticatedChannel,
		scope: MessageContextScope = 'window',
	): Promise<Array<IARMessageContextRow>> {
		const messagesBefore =
			scope === 'window'
				? await this.channelRepository.listMessages(channelId, targetMessageId, MESSAGE_CONTEXT_WINDOW)
				: [];
		const messagesAfter =
			scope === 'window'
				? await this.channelRepository.listMessages(channelId, undefined, MESSAGE_CONTEXT_WINDOW, targetMessageId)
				: [];
		const targetMessage = await this.channelRepository.getMessage(channelId, targetMessageId);
		if (!targetMessage) {
			return [];
		}
		messagesBefore.reverse();
		const allMessages = await this.filterReportableContextMessages(
			[...messagesBefore, targetMessage, ...messagesAfter],
			authChannel,
		);
		const contextAuthor = (msg: Message): ReportedAuthor | null =>
			msg.id === targetMessageId ? targetAuthor : messageAuthor(msg);
		const userIds = new Set<UserID>();
		for (const msg of allMessages) {
			const authorId = contextAuthor(msg)?.userId;
			if (authorId) {
				userIds.add(authorId);
			}
		}
		const users = new Map<UserID, User>();
		for (const userId of userIds) {
			const user = await this.userRepository.findUnique(userId);
			if (user) {
				users.set(userId, user);
			}
		}
		const context: Array<IARMessageContextRow> = [];
		for (const message of allMessages) {
			const identity = contextAuthor(message);
			if (!identity) continue;
			const author = identity.userId ? users.get(identity.userId) : null;
			const attachments = await this.cloneAttachmentsForReport(
				message.attachments,
				MessageHelpers.attachmentStorageChannelId(message),
				channelId,
			);
			const embedAttachments = await this.cloneOwnedEmbedAttachmentsForReport(message, channelId);
			const preservedAttachments = [...attachments.preserved, ...embedAttachments.preserved];
			const missingAttachments = [...attachments.missing, ...embedAttachments.missing];
			context.push({
				message_id: message.id,
				channel_id: channelId,
				author_id: identity.userId,
				webhook_id: identity.webhookId,
				author_username: author ? author.username : (identity.webhookName ?? DELETED_USER_USERNAME),
				author_discriminator: author ? author.discriminator : 0,
				author_avatar_hash: author ? author.avatarHash || null : identity.webhookAvatarHash,
				content: message.content || null,
				timestamp: snowflakeToDate(message.id),
				edited_timestamp: message.editedTimestamp || null,
				type: message.type,
				flags: message.flags,
				mention_everyone: message.mentionEveryone,
				mention_users: message.mentionedUserIds.size > 0 ? Array.from(message.mentionedUserIds) : null,
				mention_roles: message.mentionedRoleIds.size > 0 ? Array.from(message.mentionedRoleIds) : null,
				mention_channels: message.mentionedChannelIds.size > 0 ? Array.from(message.mentionedChannelIds) : null,
				attachments: preservedAttachments.length > 0 ? preservedAttachments : null,
				missing_attachments: missingAttachments.length > 0 ? missingAttachments : null,
				embeds: message.embeds.length > 0 ? message.embeds.map((embed) => embed.toMessageEmbed()) : null,
				sticker_items:
					message.stickers.length > 0 ? message.stickers.map((sticker) => sticker.toMessageStickerItem()) : null,
			});
		}
		return context;
	}

	private async filterReportableContextMessages(
		messages: Array<Message>,
		authChannel?: AuthenticatedChannel,
	): Promise<Array<Message>> {
		if (!authChannel?.guild) {
			return messages;
		}
		if (await authChannel.hasPermission(Permissions.READ_MESSAGE_HISTORY)) {
			return messages;
		}
		const floorMs = this.reportableFloorMs(authChannel);
		if (floorMs === null) {
			return [];
		}
		return messages.filter((message) => snowflakeToDate(message.id).getTime() >= floorMs);
	}

	private async cloneAttachmentsForReport(
		attachments: Array<Attachment>,
		sourceChannelId: ChannelID,
		reportedChannelId: ChannelID,
	): Promise<ClonedReportAttachments> {
		const cloned: ClonedReportAttachments = {preserved: [], missing: []};
		for (const attachment of attachments) {
			const sourceKey = MessageHelpers.makeAttachmentCdnKey(sourceChannelId, attachment.id, attachment.filename);
			const snapshot: MessageAttachment = {
				attachment_id: attachment.id,
				filename: attachment.filename,
				size: BigInt(attachment.size),
				title: attachment.title,
				description: attachment.description,
				width: attachment.width,
				height: attachment.height,
				content_type: attachment.contentType,
				content_hash: attachment.contentHash,
				placeholder: attachment.placeholder,
				flags: attachment.flags ?? 0,
				duration: attachment.duration,
				nsfw: attachment.nsfw,
				waveform: attachment.waveform ?? null,
			};
			try {
				await this.storageService.copyObject({
					sourceBucket: Config.s3.buckets.cdn,
					sourceKey,
					destinationBucket: Config.s3.buckets.reports,
					destinationKey: MessageHelpers.makeAttachmentCdnKey(reportedChannelId, attachment.id, attachment.filename),
					newContentType: attachment.contentType,
				});
				cloned.preserved.push(snapshot);
			} catch (error) {
				Logger.error(
					{error, attachmentId: attachment.id, filename: attachment.filename, sourceChannelId},
					'Failed to clone attachment for report',
				);
				cloned.missing.push(snapshot);
			}
		}
		return cloned;
	}

	private async cloneOwnedEmbedAttachmentsForReport(
		message: Message,
		reportedChannelId: ChannelID,
	): Promise<ClonedReportAttachments> {
		const cloned: ClonedReportAttachments = {preserved: [], missing: []};
		for (const {key, media} of MessageHelpers.collectOwnedEmbedAttachments(message)) {
			let snapshot: MessageAttachment | null = null;
			try {
				const [, , attachmentId, ...filenameParts] = key.split('/');
				const filename = filenameParts.join('/');
				const id = createAttachmentID(BigInt(attachmentId!));
				snapshot = {
					attachment_id: id,
					filename,
					size: 0n,
					title: null,
					description: media.description,
					width: media.width,
					height: media.height,
					content_type: media.content_type ?? 'application/octet-stream',
					content_hash: media.content_hash,
					placeholder: media.placeholder,
					flags: media.flags & ~MessageHelpers.EMBED_MEDIA_OWNED_ATTACHMENT_FLAG,
					duration: media.duration,
					nsfw: null,
					waveform: null,
				};
				const metadata = await this.storageService.getObjectMetadata(Config.s3.buckets.cdn, key);
				if (!metadata) {
					Logger.warn({key, reportedChannelId}, 'Embed attachment for report is no longer stored');
					cloned.missing.push(snapshot);
					continue;
				}
				snapshot.size = BigInt(metadata.contentLength);
				snapshot.content_type = media.content_type ?? metadata.contentType;
				await this.storageService.copyObject({
					sourceBucket: Config.s3.buckets.cdn,
					sourceKey: key,
					destinationBucket: Config.s3.buckets.reports,
					destinationKey: MessageHelpers.makeAttachmentCdnKey(reportedChannelId, id, filename),
					newContentType: snapshot.content_type,
				});
				cloned.preserved.push(snapshot);
			} catch (error) {
				Logger.error({error, key, reportedChannelId}, 'Failed to clone embed attachment for report');
				if (snapshot) {
					cloned.missing.push(snapshot);
				}
			}
		}
		return cloned;
	}

	private async captureProfileSnapshot(reportId: ReportID, subject: ProfileSnapshotSubject): Promise<string | null> {
		const user = subject.user ?? null;
		const guild = subject.guild ?? null;
		if (!user && !guild) {
			return null;
		}
		const member =
			user && subject.memberGuildId && !isAccountClosed(user)
				? await this.guildRepository.getMember(subject.memberGuildId, user.id)
				: null;
		return serializeReportProfileSnapshot({
			captured_at: new Date().toISOString(),
			user: user ? await this.snapshotUserProfile(reportId, user) : null,
			member: member ? await this.snapshotMemberProfile(reportId, member) : null,
			guild: guild ? await this.snapshotGuildProfile(reportId, guild) : null,
		});
	}

	private async snapshotUserProfile(reportId: ReportID, user: User): Promise<ReportProfileUserSnapshot> {
		const id = user.id.toString();
		if (isAccountClosed(user)) {
			return {
				id,
				username: null,
				discriminator: null,
				global_name: null,
				bio: null,
				pronouns: null,
				avatar: null,
				banner: null,
			};
		}
		return {
			id,
			username: user.username,
			discriminator: user.discriminator,
			global_name: user.globalName,
			bio: user.bio,
			pronouns: user.pronouns,
			avatar: await this.cloneProfileAssetForReport(reportId, 'user_avatar', 'avatars', id, user.avatarHash),
			banner: await this.cloneProfileAssetForReport(reportId, 'user_banner', 'banners', id, user.bannerHash),
		};
	}

	private async snapshotMemberProfile(reportId: ReportID, member: GuildMember): Promise<ReportProfileMemberSnapshot> {
		const assetBase = `guilds/${member.guildId}/users/${member.userId}`;
		return {
			guild_id: member.guildId.toString(),
			nick: member.nickname,
			bio: member.bio,
			pronouns: member.pronouns,
			joined_at: member.joinedAt.toISOString(),
			avatar: await this.cloneProfileAssetForReport(reportId, 'member_avatar', assetBase, 'avatars', member.avatarHash),
			banner: await this.cloneProfileAssetForReport(reportId, 'member_banner', assetBase, 'banners', member.bannerHash),
		};
	}

	private async snapshotGuildProfile(reportId: ReportID, guild: Guild): Promise<ReportProfileGuildSnapshot> {
		const id = guild.id.toString();
		return {
			id,
			name: guild.name,
			vanity_url_code: guild.vanityUrlCode,
			icon: await this.cloneProfileAssetForReport(reportId, 'guild_icon', 'icons', id, guild.iconHash),
			banner: await this.cloneProfileAssetForReport(reportId, 'guild_banner', 'banners', id, guild.bannerHash),
			splash: await this.cloneProfileAssetForReport(reportId, 'guild_splash', 'splashes', id, guild.splashHash),
		};
	}

	private async cloneProfileAssetForReport(
		reportId: ReportID,
		kind: string,
		sourcePrefix: string,
		sourceEntity: string,
		hash: string | null,
	): Promise<ReportProfileAssetSnapshot | null> {
		if (!hash) {
			return null;
		}
		const key = `reports/${reportId}/profile/${kind}/${hash}`;
		try {
			await this.storageService.copyObject({
				sourceBucket: Config.s3.buckets.cdn,
				sourceKey: buildHashedAssetKey(sourcePrefix, sourceEntity, hash),
				destinationBucket: Config.s3.buckets.reports,
				destinationKey: key,
			});
			return {hash, key};
		} catch (error) {
			Logger.error({error, reportId, kind}, 'Failed to clone profile asset for report');
			return {hash, key: null};
		}
	}

	private async checkReportBan(userId: UserID | null): Promise<void> {
		if (!userId) {
			return;
		}
		const user = await this.userRepository.findUnique(userId);
		if (user && (user.flags & UserFlags.REPORT_BANNED) !== 0n) {
			throw new ReportBannedError();
		}
	}

	private getReporterRateLimitKey(reporter: ReporterMetadata): string {
		if (reporter.id) {
			return `user:${reporter.id.toString()}`;
		}
		if (reporter.email) {
			return `email:${reporter.email.toLowerCase()}`;
		}
		return 'anonymous';
	}

	private createReportRateLimitIdentifier(key: string): string {
		return `report:create:${key}`;
	}

	private async consumeMessageReportRateLimits({
		reporter,
		channel,
		message,
	}: {
		reporter: ReporterMetadata;
		channel: Channel;
		message: Message;
	}): Promise<void> {
		const reporterKey = this.getReporterRateLimitKey(reporter);
		const checks: Array<{
			identifier: string;
			maxAttempts: number;
		}> = [
			{
				identifier: this.createReportRateLimitIdentifier(reporterKey),
				maxAttempts: REPORT_RATE_LIMIT_MAX,
			},
			{
				identifier: `report:message:channel:${reporterKey}:${channel.id.toString()}`,
				maxAttempts: MESSAGE_REPORT_USER_CHANNEL_RATE_LIMIT_MAX,
			},
			{
				identifier: `report:message:target:${message.id.toString()}`,
				maxAttempts: MESSAGE_REPORT_TARGET_MESSAGE_RATE_LIMIT_MAX,
			},
		];
		if (channel.guildId) {
			checks.push({
				identifier: `report:message:guild:${reporterKey}:${channel.guildId.toString()}`,
				maxAttempts: MESSAGE_REPORT_USER_GUILD_RATE_LIMIT_MAX,
			});
		}
		for (const check of checks) {
			await this.ensureReportRateLimit(check.identifier, check.maxAttempts, false);
		}
		for (const check of checks) {
			await this.ensureReportRateLimit(check.identifier, check.maxAttempts, true);
		}
	}

	private async ensureReportRateLimit(identifier: string, maxAttempts: number, consume: boolean): Promise<void> {
		const result = consume
			? await this.rateLimitService.checkLimit({
					identifier,
					maxAttempts,
					windowMs: REPORT_RATE_LIMIT_WINDOW,
				})
			: await this.rateLimitService.peekLimit({
					identifier,
					maxAttempts,
					windowMs: REPORT_RATE_LIMIT_WINDOW,
				});
		if (!result.allowed) {
			throw new RateLimitError({
				retryAfter: result.retryAfter,
				retryAfterDecimal: result.retryAfterDecimal,
				limit: result.limit,
				resetTime: result.resetTime,
				resetAfterDecimal: result.resetAfterDecimal,
			});
		}
	}

	public shutdown(): void {}
}