# frozen_string_literal: true class Reviewable < ActiveRecord::Base class UpdateConflict < StandardError; end class InvalidAction < StandardError def initialize(action_id, klass) @action_id, @klass = action_id, klass super("Can't perform `#{action_id}` on #{klass.name}") end end before_save :apply_review_group attr_accessor :created_new validates_presence_of :type, :status, :created_by_id belongs_to :target, polymorphic: true belongs_to :created_by, class_name: 'User' belongs_to :target_created_by, class_name: 'User' belongs_to :reviewable_by_group, class_name: 'Group' # Optional, for filtering belongs_to :topic belongs_to :category has_many :reviewable_histories has_many :reviewable_scores, -> { order(created_at: :desc) } after_create do log_history(:created, created_by) end after_commit(on: :create) do DiscourseEvent.trigger(:reviewable_created, self) end after_commit(on: [:create, :update]) do Jobs.enqueue(:notify_reviewable, reviewable_id: self.id) if pending? end # Can be used if several actions are equivalent def self.action_aliases {} end # The gaps are in case we want more precision in the future def self.priorities @priorities ||= Enum.new( low: 0, medium: 5, high: 10 ) end # The gaps are in case we want more precision in the future def self.sensitivity @sensitivity ||= Enum.new( disabled: 0, low: 9, medium: 6, high: 3 ) end def self.statuses @statuses ||= Enum.new( pending: 0, approved: 1, rejected: 2, ignored: 3, deleted: 4 ) end # This number comes from looking at forums in the wild and what numbers work. # As the site accumulates real data it'll be based on the site activity instead. def self.typical_sensitivity 12.5 end # Generate `pending?`, `rejected?`, etc helper methods statuses.each do |name, id| define_method("#{name}?") { status == id } singleton_class.define_method(name) { where(status: id) } end def self.default_visible where("score >= ?", min_score_for_priority) end def self.valid_type?(type) return false unless type =~ /^Reviewable[A-Za-z]+$/ type.constantize <= Reviewable rescue NameError false end def self.types %w[ReviewableFlaggedPost ReviewableQueuedPost ReviewableUser ReviewablePost] end def self.custom_filters @reviewable_filters ||= [] end def self.add_custom_filter(new_filter) custom_filters << new_filter end def self.clear_custom_filters! @reviewable_filters = [] end def created_new! self.created_new = true self.topic = target.topic if topic.blank? && target.is_a?(Post) self.target_created_by_id = target.is_a?(Post) ? target.user_id : nil self.category_id = topic.category_id if category_id.blank? && topic.present? end # Create a new reviewable, or if the target has already been reviewed return it to the # pending state and re-use it. # # You probably want to call this to create your reviewable rather than `.create`. def self.needs_review!( target: nil, topic: nil, created_by:, payload: nil, reviewable_by_moderator: false, potential_spam: true ) reviewable = new( target: target, topic: topic, created_by: created_by, reviewable_by_moderator: reviewable_by_moderator, payload: payload, potential_spam: potential_spam ) reviewable.created_new! if target.blank? || !Reviewable.where(target: target, type: reviewable.type).exists? # If there is no target, or no existing reviewable with matching target and type, there's no chance of a conflict reviewable.save! else # In this case, a reviewable might already exist for this (type, target_id) index. # ActiveRecord can only validate indexes using a SELECT before the INSERT which # is not safe under concurrency. Instead, we perform an UPDATE on the status, and return # the previous value. We then know: # # a) if a previous row existed # b) if it was changed # # And that allows us to complete our logic. update_args = { status: statuses[:pending], id: target.id, type: target.class.name, potential_spam: potential_spam == true ? true : nil } row = DB.query_single(<<~SQL, update_args) UPDATE reviewables SET status = :status, potential_spam = COALESCE(:potential_spam, reviewables.potential_spam) FROM reviewables AS old_reviewables WHERE reviewables.target_id = :id AND reviewables.target_type = :type RETURNING old_reviewables.status SQL old_status = row[0] if old_status.blank? reviewable.save! else reviewable = find_by(target: target) if old_status != statuses[:pending] # If we're transitioning back from reviewed to pending, we should recalculate # the score to prevent posts from being hidden. reviewable.recalculate_score reviewable.log_history(:transitioned, created_by) end end end reviewable end def add_score( user, reviewable_score_type, reason: nil, created_at: nil, take_action: false, meta_topic_id: nil, force_review: false ) type_bonus = PostActionType.where(id: reviewable_score_type).pluck(:score_bonus)[0] || 0 take_action_bonus = take_action ? 5.0 : 0.0 user_accuracy_bonus = ReviewableScore.user_accuracy_bonus(user) sub_total = ReviewableScore.calculate_score(user, type_bonus, take_action_bonus) rs = reviewable_scores.new( user: user, status: ReviewableScore.statuses[:pending], reviewable_score_type: reviewable_score_type, score: sub_total, user_accuracy_bonus: user_accuracy_bonus, meta_topic_id: meta_topic_id, take_action_bonus: take_action_bonus, created_at: created_at || Time.zone.now ) rs.reason = reason.to_s if reason rs.save! update(score: self.score + rs.score, latest_score: rs.created_at, force_review: force_review) topic.update(reviewable_score: topic.reviewable_score + rs.score) if topic DiscourseEvent.trigger(:reviewable_score_updated, self) rs end def self.set_priorities(values) values.each do |k, v| id = Reviewable.priorities[k] PluginStore.set('reviewables', "priority_#{id}", v) unless id.nil? end end def self.sensitivity_score_value(sensitivity, scale) return Float::MAX if sensitivity == 0 ratio = sensitivity / Reviewable.sensitivity[:low].to_f high = ( PluginStore.get('reviewables', "priority_#{Reviewable.priorities[:high]}") || typical_sensitivity ).to_f # We want this to be hard to reach ((high.to_f * ratio) * scale).truncate(2) end def self.sensitivity_score(sensitivity, scale: 1.0) # If the score is less than the default visibility, bring it up to that level. # Otherwise we have the confusing situation where a post might be hidden and # moderators would never see it! [sensitivity_score_value(sensitivity, scale), min_score_for_priority].max end def self.score_to_auto_close_topic sensitivity_score(SiteSetting.auto_close_topic_sensitivity, scale: 2.5) end def self.spam_score_to_silence_new_user sensitivity_score(SiteSetting.silence_new_user_sensitivity, scale: 0.6) end def self.score_required_to_hide_post sensitivity_score(SiteSetting.hide_post_sensitivity) end def self.min_score_for_priority(priority = nil) priority ||= SiteSetting.reviewable_default_visibility id = Reviewable.priorities[priority.to_sym] return 0.0 if id.nil? PluginStore.get('reviewables', "priority_#{id}").to_f end def history reviewable_histories.order(:created_at) end def log_history(reviewable_history_type, performed_by, edited: nil) reviewable_histories.create!( reviewable_history_type: ReviewableHistory.types[reviewable_history_type], status: status, created_by: performed_by, edited: edited ) end def apply_review_group return unless SiteSetting.enable_category_group_moderation? && category.present? && category.reviewable_by_group_id self.reviewable_by_group_id = category.reviewable_by_group_id end def actions_for(guardian, args = nil) args ||= {} Actions.new(self, guardian).tap do |actions| build_actions(actions, guardian, args) end end def editable_for(guardian, args = nil) args ||= {} EditableFields.new(self, guardian, args).tap do |fields| build_editable_fields(fields, guardian, args) end end # subclasses must implement "build_actions" to list the actions they're capable of def build_actions(actions, guardian, args) raise NotImplementedError end # subclasses can implement "build_editable_fields" to list stuff that can be edited def build_editable_fields(actions, guardian, args) end def update_fields(params, performed_by, version: nil) return true if params.blank? (params[:payload] || {}).each { |k, v| self.payload[k] = v } self.category_id = params[:category_id] if params.has_key?(:category_id) result = false Reviewable.transaction do increment_version!(version) changes_json = changes.as_json changes_json.delete('version') result = save log_history(:edited, performed_by, edited: changes_json) if result end result end # Delegates to a `perform_#{action_id}` method, which returns a `PerformResult` with # the result of the operation and whether the status of the reviewable changed. def perform(performed_by, action_id, args = nil) args ||= {} # Support this action or any aliases aliases = self.class.action_aliases valid = [ action_id, aliases.to_a.select { |k, v| v == action_id }.map(&:first) ].flatten # Ensure the user has access to the action actions = actions_for(Guardian.new(performed_by), args) raise InvalidAction.new(action_id, self.class) unless valid.any? { |a| actions.has?(a) } perform_method = "perform_#{aliases[action_id] || action_id}".to_sym raise InvalidAction.new(action_id, self.class) unless respond_to?(perform_method) result = nil update_count = false Reviewable.transaction do increment_version!(args[:version]) result = public_send(perform_method, performed_by, args) raise ActiveRecord::Rollback unless result.success? update_count = transition_to(result.transition_to, performed_by) if result.transition_to update_flag_stats(**result.update_flag_stats) if result.update_flag_stats recalculate_score if result.recalculate_score end if result && result.after_commit result.after_commit.call end if update_count || result.remove_reviewable_ids.present? Jobs.enqueue( :notify_reviewable, reviewable_id: self.id, performing_username: performed_by.username, updated_reviewable_ids: result.remove_reviewable_ids ) end result end def transition_to(status_symbol, performed_by) was_pending = pending? self.status = Reviewable.statuses[status_symbol] save! log_history(:transitioned, performed_by) DiscourseEvent.trigger(:reviewable_transitioned_to, status_symbol, self) if score_status = ReviewableScore.score_transitions[status_symbol] reviewable_scores.pending.update_all( status: score_status, reviewed_by_id: performed_by.id, reviewed_at: Time.zone.now ) end was_pending end def post_options Discourse.deprecate( "Reviewable#post_options is deprecated. Please use #payload instead.", output_in_test: true, drop_from: '2.9.0', ) end def self.bulk_perform_targets(performed_by, action, type, target_ids, args = nil) args ||= {} viewable_by(performed_by).where(type: type, target_id: target_ids).each do |r| r.perform(performed_by, action, args) end end def self.viewable_by(user, order: nil, preload: true) return none unless user.present? result = self.order(order || 'reviewables.score desc, reviewables.created_at desc') if preload result = result.includes( { created_by: :user_stat }, :topic, :target, :target_created_by, :reviewable_histories ).includes(reviewable_scores: { user: :user_stat, meta_topic: :posts }) end return result if user.admin? group_ids = SiteSetting.enable_category_group_moderation? ? user.group_users.pluck(:group_id) : [] result.where( '(reviewables.reviewable_by_moderator AND :staff) OR (reviewables.reviewable_by_group_id IN (:group_ids))', staff: user.staff?, group_ids: group_ids ).where("reviewables.category_id IS NULL OR reviewables.category_id IN (?)", Guardian.new(user).allowed_category_ids) end def self.pending_count(user) list_for(user).count end def self.list_for( user, ids: nil, status: :pending, category_id: nil, topic_id: nil, type: nil, limit: nil, offset: nil, priority: nil, username: nil, reviewed_by: nil, sort_order: nil, from_date: nil, to_date: nil, additional_filters: {} ) order = case sort_order when 'score_asc' 'reviewables.score ASC, reviewables.created_at DESC' when 'created_at' 'reviewables.created_at DESC, reviewables.score DESC' when 'created_at_asc' 'reviewables.created_at ASC, reviewables.score DESC' else 'reviewables.score DESC, reviewables.created_at DESC' end if username.present? user_id = User.find_by_username(username)&.id return [] if user_id.blank? end return [] if user.blank? result = viewable_by(user, order: order) result = by_status(result, status) result = result.where(id: ids) if ids result = result.where('reviewables.type = ?', type) if type result = result.where('reviewables.category_id = ?', category_id) if category_id result = result.where('reviewables.topic_id = ?', topic_id) if topic_id result = result.where("reviewables.created_at >= ?", from_date) if from_date result = result.where("reviewables.created_at <= ?", to_date) if to_date if reviewed_by reviewed_by_id = User.find_by_username(reviewed_by)&.id return [] if reviewed_by_id.nil? result = result.joins(<<~SQL INNER JOIN( SELECT reviewable_id FROM reviewable_histories WHERE reviewable_history_type = #{ReviewableHistory.types[:transitioned]} AND status <> #{Reviewable.statuses[:pending]} AND created_by_id = #{reviewed_by_id} ) AS rh ON rh.reviewable_id = reviewables.id SQL ) end min_score = Reviewable.min_score_for_priority(priority) if min_score > 0 && status == :pending result = result.where("reviewables.score >= ? OR reviewables.force_review", min_score) elsif min_score > 0 result = result.where("reviewables.score >= ?", min_score) end if !custom_filters.empty? result = custom_filters.reduce(result) do |memo, filter| key = filter.first filter_query = filter.last next(memo) unless additional_filters[key] filter_query.call(result, additional_filters[key]) end end # If a reviewable doesn't have a target, allow us to filter on who created that reviewable. if user_id result = result.where( "(reviewables.target_created_by_id IS NULL AND reviewables.created_by_id = :user_id) OR (reviewables.target_created_by_id = :user_id)", user_id: user_id ) end result = result.limit(limit) if limit result = result.offset(offset) if offset result end def serializer self.class.serializer_for(self) end def self.lookup_serializer_for(type) "#{type}Serializer".constantize rescue NameError ReviewableSerializer end def self.serializer_for(reviewable) type = reviewable.type @@serializers ||= {} @@serializers[type] ||= lookup_serializer_for(type) end def create_result(status, transition_to = nil) result = PerformResult.new(self, status) result.transition_to = transition_to yield result if block_given? result end def self.scores_with_topics ReviewableScore.joins(reviewable: :topic).where("reviewables.type = ?", name) end def self.count_by_date(start_date, end_date, category_id = nil, include_subcategories = false) query = scores_with_topics.where('reviewable_scores.created_at BETWEEN ? AND ?', start_date, end_date) if category_id if include_subcategories query = query.where("topics.category_id IN (?)", Category.subcategory_ids(category_id)) else query = query.where("topics.category_id = ?", category_id) end end query .group("date(reviewable_scores.created_at)") .order('date(reviewable_scores.created_at)') .count end def explain_score DB.query(<<~SQL, reviewable_id: id) SELECT rs.reviewable_id, rs.user_id, CASE WHEN (u.admin OR u.moderator) THEN 5.0 ELSE u.trust_level END AS trust_level_bonus, us.flags_agreed, us.flags_disagreed, us.flags_ignored, rs.score, rs.user_accuracy_bonus, rs.take_action_bonus, COALESCE(pat.score_bonus, 0.0) AS type_bonus FROM reviewable_scores AS rs INNER JOIN users AS u ON u.id = rs.user_id LEFT OUTER JOIN user_stats AS us ON us.user_id = rs.user_id LEFT OUTER JOIN post_action_types AS pat ON pat.id = rs.reviewable_score_type WHERE rs.reviewable_id = :reviewable_id SQL end def recalculate_score # pending/agreed scores count sql = <<~SQL UPDATE reviewables SET score = COALESCE(( SELECT sum(score) FROM reviewable_scores AS rs WHERE rs.reviewable_id = :id AND rs.status IN (:pending, :agreed) ), 0.0) WHERE id = :id RETURNING score SQL result = DB.query( sql, id: self.id, pending: ReviewableScore.statuses[:pending], agreed: ReviewableScore.statuses[:agreed] ) # Update topic score sql = <<~SQL UPDATE topics SET reviewable_score = COALESCE(( SELECT SUM(score) FROM reviewables AS r WHERE r.topic_id = :topic_id AND r.status IN (:pending, :approved) ), 0.0) WHERE id = :topic_id SQL DB.query( sql, topic_id: topic_id, pending: Reviewable.statuses[:pending], approved: Reviewable.statuses[:approved] ) self.score = result[0].score DiscourseEvent.trigger(:reviewable_score_updated, self) self.score end def delete_user_actions(actions, require_reject_reason: false) reject = actions.add_bundle( 'reject_user', icon: 'user-times', label: 'reviewables.actions.reject_user.title' ) actions.add(:delete_user, bundle: reject) do |a| a.icon = 'user-times' a.label = "reviewables.actions.reject_user.delete.title" a.require_reject_reason = require_reject_reason a.description = "reviewables.actions.reject_user.delete.description" end actions.add(:delete_user_block, bundle: reject) do |a| a.icon = 'ban' a.label = "reviewables.actions.reject_user.block.title" a.require_reject_reason = require_reject_reason a.description = "reviewables.actions.reject_user.block.description" end end protected def increment_version!(version = nil) version_result = nil if version version_result = DB.query_single( "UPDATE reviewables SET version = version + 1 WHERE id = :id AND version = :version RETURNING version", version: version, id: self.id ) else # We didn't supply a version to update safely, so just increase it version_result = DB.query_single( "UPDATE reviewables SET version = version + 1 WHERE id = :id RETURNING version", id: self.id ) end if version_result && version_result[0] self.version = version_result[0] else raise UpdateConflict.new end end def self.by_status(partial_result, status) return partial_result if status == :all if status == :reviewed partial_result.where(status: statuses.except(:pending).values) else partial_result.where(status: statuses[status]) end end private def update_flag_stats(status:, user_ids:) return unless [:agreed, :disagreed, :ignored].include?(status) # Don't count self-flags user_ids -= [post&.user_id] return if user_ids.blank? result = DB.query(<<~SQL, user_ids: user_ids) UPDATE user_stats SET flags_#{status} = flags_#{status} + 1 WHERE user_id IN (:user_ids) RETURNING user_id, flags_agreed + flags_disagreed + flags_ignored AS total SQL user_ids = result.select { |r| r.total > Jobs::TruncateUserFlagStats.truncate_to }.map(&:user_id) return if user_ids.blank? Jobs.enqueue(:truncate_user_flag_stats, user_ids: user_ids) end end # == Schema Information # # Table name: reviewables # # id :bigint not null, primary key # type :string not null # status :integer default(0), not null # created_by_id :integer not null # reviewable_by_moderator :boolean default(FALSE), not null # reviewable_by_group_id :integer # category_id :integer # topic_id :integer # score :float default(0.0), not null # potential_spam :boolean default(FALSE), not null # target_id :integer # target_type :string # target_created_by_id :integer # payload :json # version :integer default(0), not null # latest_score :datetime # created_at :datetime not null # updated_at :datetime not null # force_review :boolean default(FALSE), not null # reject_reason :text # # Indexes # # index_reviewables_on_reviewable_by_group_id (reviewable_by_group_id) # index_reviewables_on_status_and_created_at (status,created_at) # index_reviewables_on_status_and_score (status,score) # index_reviewables_on_status_and_type (status,type) # index_reviewables_on_target_id_where_post_type_eq_post (target_id) WHERE ((target_type)::text = 'Post'::text) # index_reviewables_on_topic_id_and_status_and_created_by_id (topic_id,status,created_by_id) # index_reviewables_on_type_and_target_id (type,target_id) UNIQUE #