add a `manual_only` (manual trust only) moderation option + handle more `reject_unknown`/graylist mode caveats

3 files changed, 33 insertions, 6 deletions

diff --git a/app/models/account.rb b/app/models/account.rb
index a2fa60a83..b0b9e9191 100644
--- a/app/models/account.rb
+++ b/app/models/account.rb
@@ -56,6 +56,7 @@
 #  unboostable             :boolean          default(FALSE), not null
 #  block_anon              :boolean          default(FALSE), not null
 #  trust_level             :integer
+#  manual_only             :boolean          default(FALSE), not null
 #
 
 class Account < ApplicationRecord
@@ -192,7 +193,7 @@ class Account < ApplicationRecord
   end
 
   def froze?
-    local? ? (self&.user.nil? ? true : user.disabled?) : froze
+    local? ? (self&.user.nil? ? true : user.disabled?) : froze || !known
   end
 
   def bot?
@@ -246,11 +247,17 @@ class Account < ApplicationRecord
   end
 
   def mark_unknown!
-    update!(known: false)
+    known = false
+    avatar = nil
+    header = nil
+    self[:avatar_remote_url] = ''
+    self[:header_remote_url] = ''
+    save!
   end
 
   def mark_known!
-    update!(known: true)
+    update!(known: true, last_webfingered_at: nil)
+    refresh!
 
     unless local? || !Setting.auto_mark_instance_actors_known || domain == username
       _instance_actor = Account.find_remote(domain, domain)
@@ -260,6 +267,14 @@ class Account < ApplicationRecord
     end
   end
 
+  def manual_only!
+    update!(manual_only: true)
+  end
+
+  def auto_trust!
+    update!(manual_only: false)
+  end
+
   def force_unlisted!
     transaction do
       update!(force_unlisted: true)
@@ -479,7 +494,7 @@ class Account < ApplicationRecord
   end
 
   def can_be_marked_known?
-    !known && (!service || (service? && Setting.auto_mark_services_known)) && Setting.auto_mark_known
+    !known && !manual_only && (!service || (service? && Setting.auto_mark_services_known)) && Setting.auto_mark_known
   end
 
   class Field < ActiveModelSerializers::Model
diff --git a/app/models/admin/account_action.rb b/app/models/admin/account_action.rb
index cb6b4715a..9789cb553 100644
--- a/app/models/admin/account_action.rb
+++ b/app/models/admin/account_action.rb
@@ -13,6 +13,7 @@ class Admin::AccountAction
     silence
     suspend
     mark_unknown
+    manual_only
   ).freeze
 
   attr_accessor :target_account,
@@ -69,6 +70,8 @@ class Admin::AccountAction
       handle_suspend!
     when 'mark_unknown'
       handle_mark_unknown!
+    when 'manual_only'
+      handle_manual_only!
     end
   end
 
@@ -137,6 +140,12 @@ class Admin::AccountAction
     target_account.mark_unknown!
   end
 
+  def handle_manual_only!
+    authorize(target_account, :manual_only?)
+    log_action(:manual_only, target_account)
+    target_account.manual_only!
+  end
+
   def text_for_warning
     [warning_preset&.text, text].compact.join("\n\n")
   end
diff --git a/app/models/domain_block.rb b/app/models/domain_block.rb
index c7395f7a3..26cec6ae6 100644
--- a/app/models/domain_block.rb
+++ b/app/models/domain_block.rb
@@ -14,6 +14,7 @@
 #  reason          :text
 #  reject_unknown  :boolean          default(FALSE), not null
 #  processing      :boolean          default(TRUE), not null
+#  manual_only     :boolean          default(FALSE), not null
 #
 
 class DomainBlock < ApplicationRecord
@@ -58,6 +59,7 @@ class DomainBlock < ApplicationRecord
     additionals << "reject media" if reject_media?
     additionals << "reject reports" if reject_reports?
     additionals << "reject unknown accounts" if reject_unknown?
+    additionals << "manual trust only" if manual_only?
     additionals
   end
 
@@ -67,14 +69,15 @@ class DomainBlock < ApplicationRecord
 
   # workaround for the domain policy editor
   def undo
-    return false
+    false
   end
 
   private
 
   def set_processing
     return if processing
-    return unless (changed & %w(severity suspended_at silenced_at force_sensitive reject_media reject_reports reject_unknown)).any?
+    return unless (changed & %w(severity suspended_at silenced_at force_sensitive reject_media reject_reports reject_unknown manual_only)).any?
+
     self.processing = true
   end
 end