feat: enforce tenant content moderation

server/topic.go

@@ -20,6 +20,7 @@ import (
 
 	"github.com/tinode/chat/server/auth"
 	"github.com/tinode/chat/server/logs"
+	"github.com/tinode/chat/server/moderation"
 	"github.com/tinode/chat/server/store"
 	"github.com/tinode/chat/server/store/types"
 )
@@ -1494,6 +1495,22 @@ func (t *Topic) handlePubBroadcast(msg *ClientComMessage) {
 		msg.Pub.Head = head
 		msg.Pub.Content = content
 	}
+	if msg.sess != nil && msg.sess.authLvl != auth.LevelRoot && !isCall {
+		scene := moderation.ScenePrivateMessage
+		if t.cat == types.TopicCatGrp {
+			scene = moderation.SceneGroupMessage
+		}
+		if text := moderation.ExtractText(msg.Pub.Content); text != "" {
+			result, reviewErr := moderation.Review(context.Background(), moderation.Request{
+				TenantID: t.tenantID, TenantCode: msg.sess.tenantCode, Scene: scene,
+				ActorID: asUid, Topic: t.name, Text: text, TraceID: msg.Id,
+			})
+			if reviewErr != nil {
+				msg.sess.queueOut(ErrContentModerationReply(msg, types.TimeNow(), reviewErr, result))
+				return
+			}
+		}
+	}
 
 	// Save to DB at master topic.
 	attachments := messageAttachmentURLs(msg)
@@ -2880,6 +2897,32 @@ func (t *Topic) replySetDesc(sess *Session, asUid types.Uid, asChan bool,
 			sess.queueOut(ErrPermissionDeniedReply(msg, now))
 			return errors.New("attempt to change Trusted by non-root")
 		}
+		if sess != nil && authLevel != auth.LevelRoot {
+			reviewMeta := func(scene string, value any) error {
+				text := moderation.ExtractText(value)
+				if text == "" {
+					return nil
+				}
+				result, reviewErr := moderation.Review(context.Background(), moderation.Request{TenantID: t.tenantID, TenantCode: sess.tenantCode, Scene: scene, ActorID: asUid, Topic: t.name, Text: text, TraceID: msg.Id})
+				if reviewErr != nil {
+					sess.queueOut(ErrContentModerationReply(msg, now, reviewErr, result))
+					return reviewErr
+				}
+				return nil
+			}
+			if t.cat == types.TopicCatMe {
+				if err = reviewMeta(moderation.SceneUserNickname, set.Desc.Public); err != nil {
+					return err
+				}
+			} else if t.cat == types.TopicCatGrp {
+				if err = reviewMeta(moderation.SceneGroupName, set.Desc.Public); err != nil {
+					return err
+				}
+				if err = reviewMeta(moderation.SceneGroupNickname, set.Desc.Private); err != nil {
+					return err
+				}
+			}
+		}
 
 		switch t.cat {
 		case types.TopicCatMe: