From efeb660de603806a158ebee690d9d06e4331f52a Mon Sep 17 00:00:00 2001
From: trisua <me@trisua.com>
Date: Thu, 8 May 2025 17:41:15 -0400
Subject: [PATCH] fix: don't allow users to mention users who have blocked them

---
 crates/core/src/database/messages.rs | 13 +++++++++++++
 crates/core/src/database/posts.rs    | 13 +++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/crates/core/src/database/messages.rs b/crates/core/src/database/messages.rs
index 98378bc..e1b013d 100644
--- a/crates/core/src/database/messages.rs
+++ b/crates/core/src/database/messages.rs
@@ -147,6 +147,17 @@ impl DataManager {
                     ua.to_owned()
                 } else {
                     let user = self.get_user_by_username(&username).await?;
+
+                    // check blocked status
+                    if self
+                        .get_userblock_by_initiator_receiver(user.id, data.owner)
+                        .await
+                        .is_ok()
+                    {
+                        return Err(Error::NotAllowed);
+                    }
+
+                    // create notif
                     self.create_notification(Notification::new(
                         "You've been mentioned in a message!".to_string(),
                         format!(
@@ -156,6 +167,8 @@ impl DataManager {
                         user.id,
                     ))
                     .await?;
+
+                    // ...
                     already_notified.insert(username.to_owned(), user.clone());
                     user
                 }
diff --git a/crates/core/src/database/posts.rs b/crates/core/src/database/posts.rs
index c0d6063..9c70817 100644
--- a/crates/core/src/database/posts.rs
+++ b/crates/core/src/database/posts.rs
@@ -860,6 +860,17 @@ impl DataManager {
                     ua.to_owned()
                 } else {
                     let user = self.get_user_by_username(&username).await?;
+
+                    // check blocked status
+                    if self
+                        .get_userblock_by_initiator_receiver(user.id, data.owner)
+                        .await
+                        .is_ok()
+                    {
+                        return Err(Error::NotAllowed);
+                    }
+
+                    // send notif
                     self.create_notification(Notification::new(
                         "You've been mentioned in a post!".to_string(),
                         format!(
@@ -869,6 +880,8 @@ impl DataManager {
                         user.id,
                     ))
                     .await?;
+
+                    // ...
                     already_notified.insert(username.to_owned(), user.clone());
                     user
                 }