fix: protect publish path from mysql exhaustion

server/im_security_policy_runtime.go

@@ -47,6 +47,12 @@ func imYouthModePolicyDecision(tenantID types.TenantID, actor types.Uid, action
 	if store.Security == nil || actor.IsZero() {
 		return imAllowDecision()
 	}
+	// Message content filtering is enforced by moderation below the policy
+	// check. Youth mode currently has no message-level deny rule, so avoid a
+	// database lookup on every ordinary publish.
+	if strings.TrimSpace(action) == imYouthActionMessage {
+		return imAllowDecision()
+	}
 	settings, err := store.Security.GetYouthMode(tenantID, actor)
 	if err != nil {
 		if !errors.Is(err, types.ErrNotFound) && !errors.Is(err, types.ErrUnsupported) {
@@ -65,10 +71,6 @@ func imYouthModePolicyDecision(tenantID types.TenantID, actor types.Uid, action
 				"policy_version": settings.PolicyVersion,
 			})
 		}
-	case imYouthActionMessage:
-		// content_filter is enforced by routing messages through content moderation
-		// before persistence; the decision remains allow unless moderation rejects it.
-		return imAllowDecision()
 	}
 	return imAllowDecision()
 }