From 82a0963a9838d705eee78bce9eec5ab48b6daaf3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 16 Apr 2026 04:43:52 +0000
Subject: [PATCH 1/3] Preserve scroll position on status feed poll refresh

The 10-second polling was replacing innerHTML and resetting the
scroll to top. Now refresh() saves and restores feed.scrollTop.
Only scrolls to top explicitly after posting a new status.
---
 home/home.go | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/home/home.go b/home/home.go
index 0d932f43..5de00c51 100644
--- a/home/home.go
+++ b/home/home.go
@@ -445,7 +445,7 @@ const statusCardScript = `<script>
     }
   }
 
-  function refresh() {
+  function refresh(scrollToTop) {
     if (inflight) return;
     inflight = true;
     fetch('/user/status/stream', { credentials: 'same-origin', cache: 'no-store' })
@@ -453,8 +453,16 @@ const statusCardScript = `<script>
       .then(function(html){
         if (html == null) return;
         var saved = currentInput();
+        // Preserve scroll position unless we explicitly want to
+        // scroll to top (e.g. after posting a new status).
+        var feed = document.getElementById('home-statuses');
+        var scrollPos = feed ? feed.scrollTop : 0;
         wrap.innerHTML = html;
         restoreInput(saved);
+        var newFeed = document.getElementById('home-statuses');
+        if (newFeed) {
+          newFeed.scrollTop = scrollToTop ? 0 : scrollPos;
+        }
         bindForm();
       })
       .catch(function(){})
@@ -483,7 +491,7 @@ const statusCardScript = `<script>
         body: body.toString()
       }).then(function(){
         input.value = '';
-        refresh();
+        refresh(true);
       }).catch(function(){
         // Fall back to a native form submit on network error.
         form.submit();

From 03f0138d29efc304729c7b3f87397aeba1a4b24a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 16 Apr 2026 04:47:16 +0000
Subject: [PATCH 2/3] Fix duplicate status bug caused by pointer aliasing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GetProfile returns a pointer to the map entry. Callers were mutating
profile.Status before calling UpdateProfile — but UpdateProfile reads
the 'old' status from the same map, which was already the new value.
Result: new status pushed to history AND set as current → duplicate
on screen. History also doubled on each save because existing.History
and profile.History were the same slice.

Fix: new UpdateStatus(userID, newStatus) helper passes a fresh
&Profile{} to UpdateProfile. Since it's not the map pointer, the
existing lookup correctly reads the old status. All three call sites
(StatusHandler, profile page POST, PostSystemStatus) now use
UpdateStatus instead of mutating the GetProfile pointer.
---
 user/user.go | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/user/user.go b/user/user.go
index a4447a0f..2d5305ed 100644
--- a/user/user.go
+++ b/user/user.go
@@ -219,6 +219,17 @@ func GetProfile(userID string) *Profile {
 	return profile
 }
 
+// UpdateStatus is the safe way to change a user's status. It passes a
+// fresh Profile to UpdateProfile so the existing map entry isn't
+// aliased — UpdateProfile reads the old status from the map correctly
+// and pushes it to history before storing the new one.
+func UpdateStatus(userID, newStatus string) error {
+	return UpdateProfile(&Profile{
+		UserID: userID,
+		Status: newStatus,
+	})
+}
+
 // UpdateProfile saves a user's profile. Every non-empty previous
 // status is pushed onto the history so the full timeline of what a
 // user has said is preserved. Empty updates (clearing a status) are
@@ -439,9 +450,7 @@ func StatusHandler(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	profile := GetProfile(sess.Account)
-	profile.Status = status
-	UpdateProfile(profile)
+	UpdateStatus(sess.Account, status)
 
 	// Async content moderation — flags spam/test/harmful automatically
 	// and auto-bans the user if it's bad. Fire-and-forget.
@@ -483,9 +492,7 @@ func PostSystemStatus(text string) error {
 	if len(text) > MaxStatusLength {
 		text = text[:MaxStatusLength-1] + "…"
 	}
-	profile := GetProfile(app.SystemUserID)
-	profile.Status = text
-	return UpdateProfile(profile)
+	return UpdateStatus(app.SystemUserID, text)
 }
 
 // moderateStatus runs async content moderation on a status post. If the
@@ -615,9 +622,7 @@ func Handler(w http.ResponseWriter, r *http.Request) {
 			status = status[:MaxStatusLength]
 		}
 
-		profile := GetProfile(sess.Account)
-		profile.Status = status
-		UpdateProfile(profile)
+		UpdateStatus(sess.Account, status)
 
 		if status != "" && sess.Account != app.SystemUserID && AIReplyHook != nil && containsMention(status, MicroMention) {
 			go AIReplyHook(sess.Account, status)

From 2a253ee250db0b043f860d293ab779f440efc472 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 16 Apr 2026 04:49:48 +0000
Subject: [PATCH 3/3] Close unguarded profile POST, add 24h delay, tighten
 moderation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three fixes for ongoing spam:

1. Profile page POST (/@user) was completely unguarded — no CanPost,
   no CheckPostRate, no wallet charge, no moderation. Same gates as
   StatusHandler now applied: verification, rate limit, 1 credit
   charge, async moderation with auto-ban.

2. CanPost now requires 24-hour account age for ALL post types (blog,
   social, status, apps, work). Previously only required email
   verification. New accounts must wait 24 hours AND verify their
   email. PostBlockReason shows the remaining time.

3. Moderation prompt tightened — explicitly flags vulgar, crude,
   sexual, and obscene content as HARMFUL. Added 'when in doubt,
   flag it' instruction. 'Big fat balls' will now be caught.
---
 internal/auth/auth.go | 13 ++++++++++---
 internal/flag/flag.go | 19 +++++++------------
 user/user.go          | 35 ++++++++++++++++++++++++++++-------
 3 files changed, 45 insertions(+), 22 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 610aef21..5aa17157 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -5,6 +5,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"net/http"
 	"strings"
 	"sync"
@@ -477,6 +478,11 @@ func CanPost(accountID string) bool {
 		return true
 	}
 
+	// Must be at least 24 hours old.
+	if time.Since(acc.Created) < 24*time.Hour {
+		return false
+	}
+
 	if VerificationRequired == nil || !VerificationRequired() {
 		return true
 	}
@@ -497,10 +503,11 @@ func PostBlockReason(accountID string) string {
 	if acc.Admin || acc.Approved {
 		return ""
 	}
-	if VerificationRequired == nil || !VerificationRequired() {
-		return ""
+	if time.Since(acc.Created) < 24*time.Hour {
+		remaining := (24*time.Hour - time.Since(acc.Created)).Round(time.Minute)
+		return fmt.Sprintf("New accounts must wait 24 hours before posting. %s remaining.", remaining)
 	}
-	if !acc.EmailVerified {
+	if VerificationRequired != nil && VerificationRequired() && !acc.EmailVerified {
 		return "Verify your email at /account before posting."
 	}
 	return ""
diff --git a/internal/flag/flag.go b/internal/flag/flag.go
index b8489487..c71f470c 100644
--- a/internal/flag/flag.go
+++ b/internal/flag/flag.go
@@ -80,21 +80,16 @@ func CheckContent(contentType, itemID, title, content string) {
 		return
 	}
 
-	prompt := `You are a content moderator for a community that values purposeful, respectful discussion. Every post should be meaningful — this is not a place to waste time.
+	prompt := `You are a strict content moderator for a family-friendly community. Every post should be meaningful and respectful. This is not a place to waste time, troll, or post crude content.
 
 Classify the content with ONLY ONE WORD:
 - SPAM (promotional spam, advertising, repetitive junk)
-- TEST (test posts like "test", "hello world", etc.)
-- LOW_QUALITY (low-effort content, memes, nonsensical, no substance)
-- HARMFUL (gossip, backbiting, slander, personal attacks, mocking others, trolling)
-- OK (meaningful, on-topic, respectful content)
-
-Community principles:
-- Stay on topic and contribute something meaningful
-- Be respectful — disagree with ideas, not people
-- No gossip or backbiting (speaking ill of someone behind their back)
-- No personal attacks, mockery, or belittling
-- Religious and political discussion is welcome when done with sincerity and good manners
+- TEST (test posts like "test", "hello world", meaningless typing)
+- LOW_QUALITY (low-effort, memes, nonsensical, no substance, gibberish, single words)
+- HARMFUL (vulgar, crude, sexual, obscene, gossip, slander, personal attacks, mocking, trolling, shock content)
+- OK (meaningful, on-topic, respectful content that adds value)
+
+When in doubt, flag it. Better to flag something borderline than let inappropriate content through.
 
 Respond with just the single word.`
 
diff --git a/user/user.go b/user/user.go
index 2d5305ed..2bc2fd5b 100644
--- a/user/user.go
+++ b/user/user.go
@@ -603,15 +603,14 @@ func Handler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Handle POST request for status update (legacy, profile page form)
+	// Handle POST request for status update (legacy, profile page form).
+	// Same gates as StatusHandler — CanPost, rate limit, wallet charge.
 	if r.Method == "POST" {
-		sess, _, err := auth.RequireSession(r)
+		sess, acc, err := auth.RequireSession(r)
 		if err != nil {
 			app.Unauthorized(w, r)
 			return
 		}
-
-		// Only allow updating own status
 		if sess.Account != username {
 			app.Forbidden(w, r, "")
 			return
@@ -622,13 +621,35 @@ func Handler(w http.ResponseWriter, r *http.Request) {
 			status = status[:MaxStatusLength]
 		}
 
+		if status != "" {
+			if !auth.CanPost(acc.ID) {
+				app.Forbidden(w, r, auth.PostBlockReason(acc.ID))
+				return
+			}
+			if err := auth.CheckPostRate(acc.ID); err != nil {
+				app.Forbidden(w, r, err.Error())
+				return
+			}
+			canProceed, _, cost, _ := wallet.CheckQuota(acc.ID, wallet.OpSocialPost)
+			if !canProceed {
+				app.Forbidden(w, r, fmt.Sprintf("Status updates cost %d credit. Top up at /wallet", cost))
+				return
+			}
+			if err := wallet.ConsumeQuota(acc.ID, wallet.OpSocialPost); err != nil {
+				app.Forbidden(w, r, err.Error())
+				return
+			}
+		}
+
 		UpdateStatus(sess.Account, status)
 
-		if status != "" && sess.Account != app.SystemUserID && AIReplyHook != nil && containsMention(status, MicroMention) {
-			go AIReplyHook(sess.Account, status)
+		if status != "" {
+			go moderateStatus(sess.Account, status)
+			if sess.Account != app.SystemUserID && AIReplyHook != nil && containsMention(status, MicroMention) {
+				go AIReplyHook(sess.Account, status)
+			}
 		}
 
-		// Redirect back to profile
 		http.Redirect(w, r, "/@"+sess.Account, http.StatusSeeOther)
 		return
 	}