Добавить автомодерацию: политики, порог жалоб, settings/hits API и тесты.

Refs EventHub/EventHubBack#37
Refs EventHub/EventHubBack#38
Refs EventHub/EventHubBack#39
Refs EventHub/EventHubBack#40

test/api/admins/admin_automod_tests.erl

@@ -0,0 +1,140 @@
+%%%-------------------------------------------------------------------
+%%% @doc API-тесты автомодерации (admin settings + hits queue).
+%%%-------------------------------------------------------------------
+-module(admin_automod_tests).
+-include_lib("eunit/include/eunit.hrl").
+-export([test/0]).
+
+-spec test() -> ok.
+test() ->
+  ct:pal("=== Admin Automod Tests ==="),
+  Admin = api_test_runner:get_admin_token(),
+  Moder = api_test_runner:get_moderator_token(),
+
+  test_get_settings(Admin),
+  test_put_settings(Admin),
+  test_put_settings_forbidden_moderator(Moder),
+  Unique = integer_to_binary(erlang:system_time()),
+  BadWord = <<"am_spam_", Unique/binary>>,
+  test_seed_banned_word(Admin, BadWord),
+  test_flag_creates_hit(Admin, BadWord),
+  test_list_hits_filter(Admin),
+  test_approve_restores(Admin, Moder, BadWord),
+  test_reject_keeps_frozen(Admin, BadWord),
+  test_restore_defaults(Admin),
+
+  ct:pal("=== All admin automod tests passed ==="),
+  ok.
+
+test_get_settings(Token) ->
+  ct:pal("  TEST: GET automod settings"),
+  S = api_test_runner:admin_get(<<"/v1/admin/automod/settings">>, Token),
+  ?assert(maps:is_key(<<"keyword_action">>, S)),
+  ?assert(maps:is_key(<<"match_mode">>, S)),
+  ?assert(maps:is_key(<<"report_threshold">>, S)),
+  ct:pal("    OK").
+
+test_put_settings(Token) ->
+  ct:pal("  TEST: PUT automod settings"),
+  S = api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, Token, #{
+    <<"keyword_action">> => <<"flag">>,
+    <<"match_mode">> => <<"word_boundary">>,
+    <<"report_threshold">> => 3
+  }),
+  ?assertEqual(<<"flag">>, maps:get(<<"keyword_action">>, S)),
+  ?assertEqual(3, maps:get(<<"report_threshold">>, S)),
+  ct:pal("    OK").
+
+test_put_settings_forbidden_moderator(Token) ->
+  ct:pal("  TEST: moderator cannot PUT settings"),
+  {ok, Status, _, _} = api_test_runner:admin_request(put,
+    <<"/v1/admin/automod/settings">>, Token,
+    jsx:encode(#{<<"report_threshold">> => 9})),
+  ?assertEqual(403, Status),
+  ct:pal("    OK").
+
+test_seed_banned_word(Token, Word) ->
+  ct:pal("  TEST: seed banned word ~s", [Word]),
+  _ = api_test_runner:admin_post(<<"/v1/admin/banned-words">>, Token, #{<<"word">> => Word}),
+  ct:pal("    OK").
+
+test_flag_creates_hit(AdminToken, BadWord) ->
+  ct:pal("  TEST: flag policy creates hit via user content"),
+  api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, AdminToken, #{
+    <<"keyword_action">> => <<"flag">>,
+    <<"match_mode">> => <<"word_boundary">>,
+    <<"report_threshold">> => 3
+  }),
+  User = api_test_runner:get_user_token(),
+  CalId = api_test_runner:create_calendar(User, #{title => <<"AutomodCal">>}),
+  Title = <<"Party with ", BadWord/binary>>,
+  {ok, 201, _, Body} = api_test_runner:client_request(post,
+    <<"/v1/calendars/", CalId/binary, "/events">>, User,
+    jsx:encode(#{
+      title => Title,
+      start_time => api_test_runner:future_date_iso8601(),
+      duration => 60
+    })),
+  #{<<"id">> := EventId, <<"status">> := Status} =
+    jsx:decode(list_to_binary(Body), [return_maps]),
+  ?assertEqual(<<"frozen">>, Status),
+  Hits = api_test_runner:admin_get(<<"/v1/admin/automod/hits?status=open">>, AdminToken),
+  ?assert(lists:any(fun(H) ->
+    maps:get(<<"entity_id">>, H) =:= EventId andalso
+      maps:get(<<"trigger">>, H) =:= <<"keyword">>
+  end, Hits)),
+  put({automod_event, BadWord}, EventId),
+  ct:pal("    OK: event ~s frozen + hit", [EventId]).
+
+test_list_hits_filter(Token) ->
+  ct:pal("  TEST: list hits filter by trigger"),
+  Hits = api_test_runner:admin_get(<<"/v1/admin/automod/hits?trigger=keyword">>, Token),
+  ?assert(is_list(Hits)),
+  ?assert(lists:all(fun(H) -> maps:get(<<"trigger">>, H) =:= <<"keyword">> end, Hits)),
+  ct:pal("    OK: ~p", [length(Hits)]).
+
+test_approve_restores(AdminToken, ModerToken, BadWord) ->
+  ct:pal("  TEST: approve hit restores entity"),
+  EventId = get({automod_event, BadWord}),
+  Hits = api_test_runner:admin_get(<<"/v1/admin/automod/hits?status=open">>, AdminToken),
+  Hit = hd([H || H <- Hits, maps:get(<<"entity_id">>, H) =:= EventId]),
+  HitId = maps:get(<<"id">>, Hit),
+  Resolved = api_test_runner:admin_put(
+    <<"/v1/admin/automod/hits/", HitId/binary>>, ModerToken,
+    #{<<"status">> => <<"approved">>}),
+  ?assertEqual(<<"approved">>, maps:get(<<"status">>, Resolved)),
+  %% admin event fetch
+  Ev = api_test_runner:admin_get(<<"/v1/admin/events/", EventId/binary>>, AdminToken),
+  ?assertEqual(<<"active">>, maps:get(<<"status">>, Ev)),
+  ct:pal("    OK").
+
+test_reject_keeps_frozen(AdminToken, BadWord) ->
+  ct:pal("  TEST: reject hit keeps freeze"),
+  User = api_test_runner:get_user_token(),
+  CalId = api_test_runner:create_calendar(User, #{title => <<"AutomodCal2">>}),
+  Title = <<"Again ", BadWord/binary>>,
+  {ok, 201, _, Body} = api_test_runner:client_request(post,
+    <<"/v1/calendars/", CalId/binary, "/events">>, User,
+    jsx:encode(#{
+      title => Title,
+      start_time => api_test_runner:future_date_iso8601(),
+      duration => 45
+    })),
+  #{<<"id">> := EventId} = jsx:decode(list_to_binary(Body), [return_maps]),
+  Hits = api_test_runner:admin_get(<<"/v1/admin/automod/hits?status=open">>, AdminToken),
+  Hit = hd([H || H <- Hits, maps:get(<<"entity_id">>, H) =:= EventId]),
+  HitId = maps:get(<<"id">>, Hit),
+  _ = api_test_runner:admin_put(<<"/v1/admin/automod/hits/", HitId/binary>>, AdminToken,
+    #{<<"status">> => <<"rejected">>}),
+  Ev = api_test_runner:admin_get(<<"/v1/admin/events/", EventId/binary>>, AdminToken),
+  ?assertEqual(<<"frozen">>, maps:get(<<"status">>, Ev)),
+  ct:pal("    OK").
+
+test_restore_defaults(Token) ->
+  ct:pal("  TEST: restore default settings"),
+  _ = api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, Token, #{
+    <<"keyword_action">> => <<"flag">>,
+    <<"match_mode">> => <<"word_boundary">>,
+    <<"report_threshold">> => 3
+  }),
+  ct:pal("    OK").

test/api/users/user_automod_tests.erl

@@ -0,0 +1,152 @@
+%%%-------------------------------------------------------------------
+%%% @doc User-facing automod API: content reject + report threshold + review reports.
+%%%-------------------------------------------------------------------
+-module(user_automod_tests).
+-include_lib("eunit/include/eunit.hrl").
+-export([test/0]).
+
+-spec test() -> ok.
+test() ->
+  ct:pal("=== User Automod Tests ==="),
+  Admin = api_test_runner:get_admin_token(),
+  Unique = integer_to_binary(erlang:system_time()),
+  BadWord = <<"uam_bad_", Unique/binary>>,
+  _ = api_test_runner:admin_post(<<"/v1/admin/banned-words">>, Admin, #{<<"word">> => BadWord}),
+
+  test_reject_event_create(Admin, BadWord),
+  test_reject_calendar_create(Admin, BadWord),
+  test_report_threshold_freezes_event(Admin),
+  test_report_on_review(Admin),
+  test_dismissed_reports_do_not_freeze(Admin),
+
+  %% restore defaults
+  _ = api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, Admin, #{
+    <<"keyword_action">> => <<"flag">>,
+    <<"match_mode">> => <<"word_boundary">>,
+    <<"report_threshold">> => 3
+  }),
+  ct:pal("=== All user automod tests passed ==="),
+  ok.
+
+test_reject_event_create(Admin, BadWord) ->
+  ct:pal("  TEST: reject policy returns 400 on event create"),
+  _ = api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, Admin, #{
+    <<"keyword_action">> => <<"reject">>
+  }),
+  User = api_test_runner:get_user_token(),
+  CalId = api_test_runner:create_calendar(User, #{title => <<"CleanCal">>}),
+  {ok, Status, _, Body} = api_test_runner:client_request(post,
+    <<"/v1/calendars/", CalId/binary, "/events">>, User,
+    jsx:encode(#{
+      title => <<"Has ", BadWord/binary>>,
+      start_time => api_test_runner:future_date_iso8601(),
+      duration => 30
+    })),
+  ?assertEqual(400, Status),
+  ?assert(binary:match(list_to_binary(Body), <<"banned">>) =/= nomatch),
+  ct:pal("    OK").
+
+test_reject_calendar_create(Admin, BadWord) ->
+  ct:pal("  TEST: reject policy returns 400 on calendar create"),
+  _ = api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, Admin, #{
+    <<"keyword_action">> => <<"reject">>
+  }),
+  User = api_test_runner:get_user_token(),
+  {ok, Status, _, _} = api_test_runner:client_request(post, <<"/v1/calendars">>, User,
+    jsx:encode(#{title => <<"Cal ", BadWord/binary>>, description => <<"x">>})),
+  ?assertEqual(400, Status),
+  ct:pal("    OK").
+
+test_report_threshold_freezes_event(Admin) ->
+  ct:pal("  TEST: 3 pending reports freeze event"),
+  _ = api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, Admin, #{
+    <<"keyword_action">> => <<"flag">>,
+    <<"report_threshold">> => 3
+  }),
+  Owner = api_test_runner:get_user_token(),
+  CalId = api_test_runner:create_calendar(Owner, #{title => <<"RepThrCal">>}),
+  #{<<"id">> := EventId} = api_test_runner:client_post(
+    <<"/v1/calendars/", CalId/binary, "/events">>, Owner,
+    #{title => <<"Clean event">>,
+      start_time => api_test_runner:future_date_iso8601(),
+      duration => 60}),
+  lists:foreach(fun(_) ->
+    Tok = api_test_runner:get_user_token(),
+    {ok, 201, _, _} = api_test_runner:client_request(post, <<"/v1/reports">>, Tok,
+      jsx:encode(#{
+        target_type => <<"event">>,
+        target_id => EventId,
+        reason => <<"spam">>
+      }))
+  end, [1, 2, 3]),
+  Ev = api_test_runner:admin_get(<<"/v1/admin/events/", EventId/binary>>, Admin),
+  ?assertEqual(<<"frozen">>, maps:get(<<"status">>, Ev)),
+  Hits = api_test_runner:admin_get(<<"/v1/admin/automod/hits?trigger=report_threshold">>, Admin),
+  ?assert(lists:any(fun(H) -> maps:get(<<"entity_id">>, H) =:= EventId end, Hits)),
+  ct:pal("    OK").
+
+test_report_on_review(Admin) ->
+  ct:pal("  TEST: report on review + threshold hides"),
+  _ = api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, Admin, #{
+    <<"report_threshold">> => 3
+  }),
+  Owner = api_test_runner:get_user_token(),
+  CalId = api_test_runner:create_calendar(Owner, #{title => <<"RevRepCal">>}),
+  Reviewer = api_test_runner:get_user_token(),
+  {ok, 201, _, RevBody} = api_test_runner:client_request(post, <<"/v1/reviews">>, Reviewer,
+    jsx:encode(#{
+      target_type => <<"calendar">>,
+      target_id => CalId,
+      rating => 2,
+      comment => <<"meh">>
+    })),
+  #{<<"id">> := ReviewId} = jsx:decode(list_to_binary(RevBody), [return_maps]),
+  lists:foreach(fun(_) ->
+    Tok = api_test_runner:get_user_token(),
+    {ok, 201, _, _} = api_test_runner:client_request(post, <<"/v1/reports">>, Tok,
+      jsx:encode(#{
+        target_type => <<"review">>,
+        target_id => ReviewId,
+        reason => <<"abuse">>
+      }))
+  end, [1, 2, 3]),
+  Rev = api_test_runner:admin_get(<<"/v1/admin/reviews/", ReviewId/binary>>, Admin),
+  ?assertEqual(<<"hidden">>, maps:get(<<"status">>, Rev)),
+  ct:pal("    OK").
+
+test_dismissed_reports_do_not_freeze(Admin) ->
+  ct:pal("  TEST: dismissed reports do not freeze"),
+  _ = api_test_runner:admin_put(<<"/v1/admin/automod/settings">>, Admin, #{
+    <<"report_threshold">> => 3
+  }),
+  Owner = api_test_runner:get_user_token(),
+  CalId = api_test_runner:create_calendar(Owner, #{title => <<"DismissCal">>}),
+  #{<<"id">> := EventId} = api_test_runner:client_post(
+    <<"/v1/calendars/", CalId/binary, "/events">>, Owner,
+    #{title => <<"Still clean">>,
+      start_time => api_test_runner:future_date_iso8601(),
+      duration => 60}),
+  ReportIds = lists:map(fun(_) ->
+    Tok = api_test_runner:get_user_token(),
+    {ok, 201, _, B} = api_test_runner:client_request(post, <<"/v1/reports">>, Tok,
+      jsx:encode(#{
+        target_type => <<"event">>,
+        target_id => EventId,
+        reason => <<"noise">>
+      })),
+    maps:get(<<"id">>, jsx:decode(list_to_binary(B), [return_maps]))
+  end, [1, 2]),
+  lists:foreach(fun(Rid) ->
+    _ = api_test_runner:admin_put(<<"/v1/admin/reports/", Rid/binary>>, Admin,
+      #{<<"status">> => <<"dismissed">>})
+  end, ReportIds),
+  Tok3 = api_test_runner:get_user_token(),
+  {ok, 201, _, _} = api_test_runner:client_request(post, <<"/v1/reports">>, Tok3,
+    jsx:encode(#{
+      target_type => <<"event">>,
+      target_id => EventId,
+      reason => <<"one pending">>
+    })),
+  Ev = api_test_runner:admin_get(<<"/v1/admin/events/", EventId/binary>>, Admin),
+  ?assertEqual(<<"active">>, maps:get(<<"status">>, Ev)),
+  ct:pal("    OK").

test/api_admins_SUITE.erl

@@ -33,6 +33,7 @@ all() ->
     admin_test_reports,
     admin_test_subscriptions,
     admin_test_banned_words,
+    admin_test_automod,
     admin_test_moderation,
     admin_test_audit,
     admin_test_stats,
@@ -111,6 +112,9 @@ admin_test_subscriptions(_Config) ->
 admin_test_banned_words(_Config) ->
   admin_banned_words_tests:test().
 
+admin_test_automod(_Config) ->
+  admin_automod_tests:test().
+
 admin_test_moderation(_Config) ->
   admin_moderation_tests:test().
 

test/api_users_SUITE.erl

@@ -43,6 +43,7 @@ all() ->
     user_test_search,
     user_test_refresh,
     user_test_reports,
+    user_test_automod,
     user_test_tickets,
     user_test_subscription,
     user_test_websocket
@@ -147,6 +148,9 @@ user_test_refresh(_Config) ->
 user_test_reports(_Config) ->
   user_reports_tests:test().
 
+user_test_automod(_Config) ->
+  user_automod_tests:test().
+
 user_test_tickets(_Config) ->
   user_tickets_tests:test().
 

test/unit/admin_handler_automod_tests.erl

@@ -0,0 +1,188 @@
+-module(admin_handler_automod_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(TABLES, [admin, admin_audit, automod_settings, automod_hit, banned_word,
+  user, calendar, event]).
+-define(ADMIN_ID, <<"adm_automod">>).
+-define(MOD_ID, <<"mod_automod">>).
+
+setup() ->
+  eh_test_support:start_mnesia(),
+  eh_test_support:ensure_tables(?TABLES),
+  eh_test_support:ensure_jwt(),
+  eh_test_support:seed_admin(#{id => ?ADMIN_ID, role => admin}),
+  eh_test_support:seed_admin(#{id => ?MOD_ID, role => moderator, email => <<"m@t.local">>}),
+  core_automod_settings:ensure_defaults(),
+  ok.
+
+cleanup(_) ->
+  eh_test_support:unload_cowboy(),
+  eh_test_support:delete_tables(?TABLES),
+  eh_test_support:stop_mnesia(),
+  ok.
+
+admin_handler_automod_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"GET settings – 200", fun test_get_settings/0},
+    {"GET settings – 401", fun test_get_settings_unauth/0},
+    {"PUT settings – admin ok", fun test_put_settings/0},
+    {"PUT settings – moderator forbidden", fun test_put_settings_moderator/0},
+    {"PUT settings – invalid threshold", fun test_put_settings_bad/0},
+    {"GET hits – list and filter", fun test_list_hits/0},
+    {"PUT hit approve", fun test_approve_hit/0},
+    {"PUT hit reject", fun test_reject_hit/0},
+    {"PUT hit not found", fun test_hit_not_found/0},
+    {"PUT hit already resolved", fun test_hit_already_resolved/0},
+    {"moderator can list and resolve hits", fun test_moderator_hits/0}
+  ]}.
+
+test_get_settings() ->
+  {Status, _, Body} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"GET">>,
+    path => <<"/v1/admin/automod/settings">>,
+    auth => ?ADMIN_ID
+  }),
+  ?assertEqual(200, Status),
+  Map = jsx:decode(Body, [return_maps]),
+  ?assertEqual(<<"flag">>, maps:get(<<"keyword_action">>, Map)),
+  ?assertEqual(<<"word_boundary">>, maps:get(<<"match_mode">>, Map)),
+  ?assertEqual(3, maps:get(<<"report_threshold">>, Map)).
+
+test_get_settings_unauth() ->
+  {Status, _, _} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"GET">>,
+    path => <<"/v1/admin/automod/settings">>,
+    auth => none
+  }),
+  ?assertEqual(401, Status).
+
+test_put_settings() ->
+  {Status, _, Body} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"PUT">>,
+    path => <<"/v1/admin/automod/settings">>,
+    auth => ?ADMIN_ID,
+    body => jsx:encode(#{
+      <<"keyword_action">> => <<"reject">>,
+      <<"match_mode">> => <<"substring">>,
+      <<"report_threshold">> => 7
+    })
+  }),
+  ?assertEqual(200, Status),
+  Map = jsx:decode(Body, [return_maps]),
+  ?assertEqual(<<"reject">>, maps:get(<<"keyword_action">>, Map)),
+  ?assertEqual(<<"substring">>, maps:get(<<"match_mode">>, Map)),
+  ?assertEqual(7, maps:get(<<"report_threshold">>, Map)).
+
+test_put_settings_moderator() ->
+  {Status, _, _} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"PUT">>,
+    path => <<"/v1/admin/automod/settings">>,
+    auth => ?MOD_ID,
+    body => jsx:encode(#{<<"report_threshold">> => 2})
+  }),
+  ?assertEqual(403, Status).
+
+test_put_settings_bad() ->
+  {Status, _, _} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"PUT">>,
+    path => <<"/v1/admin/automod/settings">>,
+    auth => ?ADMIN_ID,
+    body => jsx:encode(#{<<"report_threshold">> => 0})
+  }),
+  ?assertEqual(400, Status).
+
+test_list_hits() ->
+  {ok, H1} = core_automod_hit:create(event, <<"e1">>, keyword, [<<"a">>], flag),
+  {ok, _} = core_automod_hit:create(calendar, <<"c1">>, report_threshold, [], freeze),
+  {ok, _} = core_automod_hit:resolve(H1#automod_hit.id, approved, ?ADMIN_ID),
+  {Status, _, Body} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"GET">>,
+    path => <<"/v1/admin/automod/hits">>,
+    auth => ?ADMIN_ID,
+    qs => [{<<"status">>, <<"open">>}]
+  }),
+  ?assertEqual(200, Status),
+  List = jsx:decode(Body, [return_maps]),
+  ?assertEqual(1, length(List)),
+  ?assertEqual(<<"open">>, maps:get(<<"status">>, hd(List))).
+
+test_approve_hit() ->
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"C">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"t">>, eh_test_support:future_start(), 60),
+  _ = core_event:freeze(Ev#event.id, <<"auto:keyword">>),
+  {ok, Hit} = core_automod_hit:create(event, Ev#event.id, keyword, [<<"x">>], flag),
+  {Status, _, Body} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"PUT">>,
+    path => <<"/v1/admin/automod/hits/", (Hit#automod_hit.id)/binary>>,
+    auth => ?ADMIN_ID,
+    bindings => #{id => Hit#automod_hit.id},
+    body => jsx:encode(#{<<"status">> => <<"approved">>})
+  }),
+  ?assertEqual(200, Status),
+  Map = jsx:decode(Body, [return_maps]),
+  ?assertEqual(<<"approved">>, maps:get(<<"status">>, Map)),
+  {ok, Active} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(active, Active#event.status).
+
+test_reject_hit() ->
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"C">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"t">>, eh_test_support:future_start(), 60),
+  {ok, Hit} = core_automod_hit:create(event, Ev#event.id, keyword, [<<"x">>], flag),
+  {Status, _, _} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"PUT">>,
+    path => <<"/v1/admin/automod/hits/", (Hit#automod_hit.id)/binary>>,
+    auth => ?ADMIN_ID,
+    bindings => #{id => Hit#automod_hit.id},
+    body => jsx:encode(#{<<"status">> => <<"rejected">>})
+  }),
+  ?assertEqual(200, Status),
+  {ok, Frozen} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(frozen, Frozen#event.status).
+
+test_hit_not_found() ->
+  {Status, _, _} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"PUT">>,
+    path => <<"/v1/admin/automod/hits/missing">>,
+    auth => ?ADMIN_ID,
+    bindings => #{id => <<"missing">>},
+    body => jsx:encode(#{<<"status">> => <<"approved">>})
+  }),
+  ?assertEqual(404, Status).
+
+test_hit_already_resolved() ->
+  {ok, Hit} = core_automod_hit:create(event, <<"e">>, keyword, [], flag),
+  {ok, _} = core_automod_hit:resolve(Hit#automod_hit.id, approved, ?ADMIN_ID),
+  {Status, _, _} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"PUT">>,
+    path => <<"/v1/admin/automod/hits/", (Hit#automod_hit.id)/binary>>,
+    auth => ?ADMIN_ID,
+    bindings => #{id => Hit#automod_hit.id},
+    body => jsx:encode(#{<<"status">> => <<"rejected">>})
+  }),
+  ?assertEqual(409, Status).
+
+test_moderator_hits() ->
+  {ok, Hit} = core_automod_hit:create(event, <<"e2">>, keyword, [<<"z">>], flag),
+  {StatusList, _, _} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"GET">>,
+    path => <<"/v1/admin/automod/hits">>,
+    auth => ?MOD_ID
+  }),
+  ?assertEqual(200, StatusList),
+  {StatusPut, _, Body} = eh_test_support:call(admin_handler_automod, #{
+    method => <<"PUT">>,
+    path => <<"/v1/admin/automod/hits/", (Hit#automod_hit.id)/binary>>,
+    auth => ?MOD_ID,
+    bindings => #{id => Hit#automod_hit.id},
+    body => jsx:encode(#{<<"status">> => <<"approved">>})
+  }),
+  ?assertEqual(200, StatusPut),
+  ?assertEqual(<<"approved">>, maps:get(<<"status">>, jsx:decode(Body, [return_maps]))).
+
+seed_user() ->
+  Id = base64:encode(crypto:strong_rand_bytes(10), #{mode => urlsafe, padding => false}),
+  mnesia:dirty_write(eh_test_support:make_user(#{id => Id, email => <<Id/binary, "@t.com">>})),
+  Id.

test/unit/core_automod_tests.erl

@@ -0,0 +1,64 @@
+-module(core_automod_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(TABLES, [automod_settings, automod_hit]).
+
+setup() ->
+  eh_test_support:start_mnesia(),
+  eh_test_support:ensure_tables(?TABLES),
+  ok.
+
+cleanup(_) ->
+  eh_test_support:delete_tables(?TABLES),
+  eh_test_support:stop_mnesia(),
+  ok.
+
+core_automod_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"settings defaults", fun test_defaults/0},
+    {"settings update fields", fun test_update/0},
+    {"hit create list resolve", fun test_hits/0},
+    {"hit filters", fun test_hit_filters/0}
+  ]}.
+
+test_defaults() ->
+  core_automod_settings:ensure_defaults(),
+  S = core_automod_settings:get(),
+  ?assertEqual(flag, S#automod_settings.keyword_action),
+  ?assertEqual(word_boundary, S#automod_settings.match_mode),
+  ?assertEqual(3, S#automod_settings.report_threshold).
+
+test_update() ->
+  core_automod_settings:ensure_defaults(),
+  {ok, S} = core_automod_settings:update([
+    {keyword_action, censor},
+    {match_mode, substring},
+    {report_threshold, 4}
+  ], <<"adm">>),
+  ?assertEqual(censor, S#automod_settings.keyword_action),
+  ?assertEqual(substring, S#automod_settings.match_mode),
+  ?assertEqual(4, S#automod_settings.report_threshold),
+  ?assertEqual(<<"adm">>, S#automod_settings.updated_by).
+
+test_hits() ->
+  {ok, H} = core_automod_hit:create(event, <<"eid">>, keyword, [<<"w">>], flag),
+  ?assertEqual(open, H#automod_hit.status),
+  {ok, Got} = core_automod_hit:get_by_id(H#automod_hit.id),
+  ?assertEqual(<<"eid">>, Got#automod_hit.entity_id),
+  {ok, Done} = core_automod_hit:resolve(H#automod_hit.id, approved, <<"adm">>),
+  ?assertEqual(approved, Done#automod_hit.status),
+  ?assertEqual(<<"adm">>, Done#automod_hit.resolved_by),
+  ?assertMatch({error, already_resolved},
+    core_automod_hit:resolve(H#automod_hit.id, rejected, <<"adm">>)).
+
+test_hit_filters() ->
+  {ok, _} = core_automod_hit:create(event, <<"e1">>, keyword, [], flag),
+  {ok, H2} = core_automod_hit:create(review, <<"r1">>, report_threshold, [], hide),
+  {ok, _} = core_automod_hit:resolve(H2#automod_hit.id, rejected, <<"a">>),
+  Open = core_automod_hit:list([{status, open}]),
+  ?assertEqual(1, length(Open)),
+  Reviews = core_automod_hit:list([{entity_type, review}]),
+  ?assertEqual(1, length(Reviews)),
+  Thr = core_automod_hit:list([{trigger, report_threshold}]),
+  ?assertEqual(1, length(Thr)).

test/unit/eh_test_support.erl

@@ -121,6 +121,10 @@ table_opts(report) ->
   [{ram_copies, [node()]}, {attributes, record_info(fields, report)}];
 table_opts(banned_word) ->
   [{ram_copies, [node()]}, {attributes, record_info(fields, banned_word)}];
+table_opts(automod_settings) ->
+  [{ram_copies, [node()]}, {attributes, record_info(fields, automod_settings)}];
+table_opts(automod_hit) ->
+  [{ram_copies, [node()]}, {attributes, record_info(fields, automod_hit)}];
 table_opts(ticket) ->
   [{ram_copies, [node()]}, {attributes, record_info(fields, ticket)}];
 table_opts(subscription) ->

test/unit/logic_automoderation_tests.erl

@@ -0,0 +1,270 @@
+-module(logic_automoderation_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(TABLES, [admin, admin_audit, banned_word, automod_settings, automod_hit,
+  user, calendar, event, review, report]).
+
+setup() ->
+  eh_test_support:start_mnesia(),
+  eh_test_support:ensure_tables(?TABLES),
+  core_automod_settings:ensure_defaults(),
+  ok.
+
+cleanup(_) ->
+  eh_test_support:delete_tables(?TABLES),
+  eh_test_support:stop_mnesia(),
+  ok.
+
+logic_automoderation_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"word_boundary does not match substring inside word", fun test_word_boundary/0},
+    {"substring mode matches inside word", fun test_substring/0},
+    {"case insensitive scan", fun test_case_insensitive/0},
+    {"punctuation word_boundary", fun test_punctuation_boundary/0},
+    {"multiple banned words collected", fun test_multi_words/0},
+    {"reject policy blocks save path via evaluate", fun test_reject/0},
+    {"flag policy soft-hides event", fun test_flag_event/0},
+    {"flag policy soft-hides calendar", fun test_flag_calendar/0},
+    {"flag policy hides review", fun test_flag_review/0},
+    {"censor policy masks words", fun test_censor/0},
+    {"settings update", fun test_settings/0},
+    {"settings update denied for moderator", fun test_settings_denied/0},
+    {"invalid settings field", fun test_settings_invalid/0},
+    {"approve hit restores event", fun test_approve_hit/0},
+    {"reject hit keeps freeze", fun test_reject_hit/0},
+    {"resolve already resolved", fun test_resolve_twice/0},
+    {"report threshold creates hit and freezes", fun test_report_threshold/0},
+    {"dismissed reports do not count toward threshold", fun test_dismissed_not_counted/0},
+    {"custom threshold from settings", fun test_custom_threshold/0},
+    {"report on review hides", fun test_report_review/0},
+    {"logic create calendar reject", fun test_logic_calendar_reject/0},
+    {"logic create event flag", fun test_logic_event_flag/0},
+    {"logic create review censor", fun test_logic_review_censor/0}
+  ]}.
+
+admin_id() ->
+  (eh_test_support:seed_admin(#{id => <<"adm_am">>}))#admin.id.
+
+moderator_id() ->
+  (eh_test_support:seed_admin(#{id => <<"mod_am">>, role => moderator,
+    email => <<"mod@test.local">>}))#admin.id.
+
+add_word(Word) ->
+  {ok, _} = core_banned_words:add_banned_word(Word, admin_id()).
+
+seed_user() ->
+  Id = base64:encode(crypto:strong_rand_bytes(12), #{mode => urlsafe, padding => false}),
+  User = eh_test_support:make_user(#{id => Id, email => <<Id/binary, "@t.com">>, status => active}),
+  mnesia:dirty_write(User),
+  Id.
+
+test_word_boundary() ->
+  add_word(<<"bad">>),
+  ?assertEqual(clean, logic_automoderation:scan_text(<<"badge">>)),
+  ?assertMatch({hit, [<<"bad">>]}, logic_automoderation:scan_text(<<"this is bad">>)).
+
+test_substring() ->
+  add_word(<<"bad">>),
+  {ok, _} = core_automod_settings:update([{match_mode, substring}], admin_id()),
+  ?assertMatch({hit, [<<"bad">>]}, logic_automoderation:scan_text(<<"badge">>)).
+
+test_case_insensitive() ->
+  add_word(<<"spam">>),
+  ?assertMatch({hit, [<<"spam">>]}, logic_automoderation:scan_text(<<"Buy SPAM now">>)).
+
+test_punctuation_boundary() ->
+  add_word(<<"bad">>),
+  ?assertMatch({hit, [<<"bad">>]}, logic_automoderation:scan_text(<<"really bad!">>)),
+  ?assertMatch({hit, [<<"bad">>]}, logic_automoderation:scan_text(<<"bad,">>)),
+  ?assertEqual(clean, logic_automoderation:scan_text(<<"badger">>)).
+
+test_multi_words() ->
+  add_word(<<"foo">>),
+  add_word(<<"bar">>),
+  ?assertMatch({hit, Words} when length(Words) =:= 2,
+    logic_automoderation:scan_text(<<"foo and bar">>)).
+
+test_reject() ->
+  add_word(<<"spam">>),
+  {ok, _} = core_automod_settings:update([{keyword_action, reject}], admin_id()),
+  ?assertEqual({reject, [<<"spam">>]}, logic_automoderation:evaluate_texts([<<"buy spam now">>])).
+
+test_flag_event() ->
+  add_word(<<"spam">>),
+  {ok, _} = core_automod_settings:update([{keyword_action, flag}], admin_id()),
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Action, [Title2], Words} = logic_automoderation:evaluate_texts([<<"spam event">>]),
+  ?assertEqual(flag, Action),
+  {ok, Ev} = core_event:create(Cal#calendar.id, Title2, eh_test_support:future_start(), 60),
+  ok = logic_automoderation:apply_after_save(event, Ev#event.id, Action, Words),
+  {ok, Frozen} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(frozen, Frozen#event.status),
+  Hits = core_automod_hit:list([{status, open}]),
+  ?assertEqual(1, length(Hits)).
+
+test_flag_calendar() ->
+  add_word(<<"spam">>),
+  {ok, _} = core_automod_settings:update([{keyword_action, flag}], admin_id()),
+  Owner = seed_user(),
+  {ok, Cal} = logic_calendar:create_calendar(Owner, <<"spam cal">>, <<"ok">>, manual),
+  {ok, Frozen} = core_calendar:get_by_id(Cal#calendar.id),
+  ?assertEqual(frozen, Frozen#calendar.status),
+  ?assertEqual(1, length(core_automod_hit:list([{entity_type, calendar}]))).
+
+test_flag_review() ->
+  add_word(<<"spam">>),
+  {ok, _} = core_automod_settings:update([{keyword_action, flag}], admin_id()),
+  Owner = seed_user(),
+  Reviewer = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"E">>, eh_test_support:future_start(), 60),
+  %% bypass can_review: create via core then apply_after_save path via logic
+  {ok, _} = core_automod_settings:update([{keyword_action, flag}], admin_id()),
+  {ok, Action, [C], Words} = logic_automoderation:evaluate_texts([<<"spam comment">>]),
+  {ok, Rev} = core_review:create(Reviewer, event, Ev#event.id, 4, C),
+  ok = logic_automoderation:apply_after_save(review, Rev#review.id, Action, Words),
+  {ok, Hidden} = core_review:get_by_id(Rev#review.id),
+  ?assertEqual(hidden, Hidden#review.status).
+
+test_censor() ->
+  add_word(<<"bad">>),
+  {ok, _} = core_automod_settings:update([{keyword_action, censor}], admin_id()),
+  {ok, censor, [Out], _} = logic_automoderation:evaluate_texts([<<"This is bad">>]),
+  ?assertEqual(<<"This is ***">>, Out).
+
+test_settings() ->
+  AdminId = admin_id(),
+  {ok, S} = logic_automoderation:update_settings(AdminId, [
+    {keyword_action, reject},
+    {report_threshold, 5}
+  ]),
+  ?assertEqual(reject, S#automod_settings.keyword_action),
+  ?assertEqual(5, S#automod_settings.report_threshold).
+
+test_settings_denied() ->
+  ModId = moderator_id(),
+  ?assertEqual({error, access_denied},
+    logic_automoderation:update_settings(ModId, [{report_threshold, 9}])).
+
+test_settings_invalid() ->
+  AdminId = admin_id(),
+  ?assertMatch({error, {invalid_field, _}},
+    logic_automoderation:update_settings(AdminId, [{keyword_action, nope}])).
+
+test_approve_hit() ->
+  add_word(<<"spam">>),
+  AdminId = admin_id(),
+  {ok, _} = core_automod_settings:update([{keyword_action, flag}], AdminId),
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"spam">>, eh_test_support:future_start(), 60),
+  ok = logic_automoderation:apply_after_save(event, Ev#event.id, flag, [<<"spam">>]),
+  [Hit] = core_automod_hit:list([{status, open}]),
+  {ok, Resolved} = logic_automoderation:resolve_hit(AdminId, Hit#automod_hit.id, approved),
+  ?assertEqual(approved, Resolved#automod_hit.status),
+  {ok, Active} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(active, Active#event.status).
+
+test_reject_hit() ->
+  add_word(<<"spam">>),
+  AdminId = admin_id(),
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"ok">>, eh_test_support:future_start(), 60),
+  {ok, Hit} = core_automod_hit:create(event, Ev#event.id, keyword, [<<"spam">>], flag),
+  {ok, _} = logic_automoderation:resolve_hit(AdminId, Hit#automod_hit.id, rejected),
+  {ok, Frozen} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(frozen, Frozen#event.status).
+
+test_resolve_twice() ->
+  AdminId = admin_id(),
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"ok">>, eh_test_support:future_start(), 60),
+  {ok, Hit} = core_automod_hit:create(event, Ev#event.id, keyword, [], flag),
+  {ok, _} = logic_automoderation:resolve_hit(AdminId, Hit#automod_hit.id, approved),
+  ?assertEqual({error, already_resolved},
+    logic_automoderation:resolve_hit(AdminId, Hit#automod_hit.id, rejected)).
+
+test_report_threshold() ->
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"E">>, eh_test_support:future_start(), 60),
+  {ok, _} = logic_moderation:create_report(seed_user(), event, Ev#event.id, <<"r1">>),
+  {ok, _} = logic_moderation:create_report(seed_user(), event, Ev#event.id, <<"r2">>),
+  {ok, Ev2} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(active, Ev2#event.status),
+  {ok, _} = logic_moderation:create_report(seed_user(), event, Ev#event.id, <<"r3">>),
+  {ok, Ev3} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(frozen, Ev3#event.status),
+  ?assert(length(core_automod_hit:list([{trigger, report_threshold}])) >= 1).
+
+test_dismissed_not_counted() ->
+  AdminId = admin_id(),
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"E">>, eh_test_support:future_start(), 60),
+  {ok, R1} = logic_moderation:create_report(seed_user(), event, Ev#event.id, <<"r1">>),
+  {ok, R2} = logic_moderation:create_report(seed_user(), event, Ev#event.id, <<"r2">>),
+  {ok, _} = logic_moderation:resolve_report(AdminId, R1#report.id, dismissed),
+  {ok, _} = logic_moderation:resolve_report(AdminId, R2#report.id, dismissed),
+  {ok, _} = logic_moderation:create_report(seed_user(), event, Ev#event.id, <<"r3">>),
+  {ok, Ev2} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(active, Ev2#event.status).
+
+test_custom_threshold() ->
+  {ok, _} = core_automod_settings:update([{report_threshold, 2}], admin_id()),
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"E">>, eh_test_support:future_start(), 60),
+  {ok, _} = logic_moderation:create_report(seed_user(), event, Ev#event.id, <<"a">>),
+  {ok, Ev1} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(active, Ev1#event.status),
+  {ok, _} = logic_moderation:create_report(seed_user(), event, Ev#event.id, <<"b">>),
+  {ok, Ev2} = core_event:get_by_id(Ev#event.id),
+  ?assertEqual(frozen, Ev2#event.status).
+
+test_report_review() ->
+  Owner = seed_user(),
+  Reviewer = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"E">>, eh_test_support:future_start(), 60),
+  {ok, Rev} = core_review:create(Reviewer, event, Ev#event.id, 3, <<"ok">>),
+  {ok, _} = logic_moderation:create_report(seed_user(), review, Rev#review.id, <<"x">>),
+  {ok, _} = logic_moderation:create_report(seed_user(), review, Rev#review.id, <<"y">>),
+  {ok, _} = logic_moderation:create_report(seed_user(), review, Rev#review.id, <<"z">>),
+  {ok, Hidden} = core_review:get_by_id(Rev#review.id),
+  ?assertEqual(hidden, Hidden#review.status).
+
+test_logic_calendar_reject() ->
+  add_word(<<"spam">>),
+  {ok, _} = core_automod_settings:update([{keyword_action, reject}], admin_id()),
+  Owner = seed_user(),
+  ?assertMatch({error, {content_banned, _}},
+    logic_calendar:create_calendar(Owner, <<"spam title">>, <<"d">>, manual)).
+
+test_logic_event_flag() ->
+  add_word(<<"spam">>),
+  {ok, _} = core_automod_settings:update([{keyword_action, flag}], admin_id()),
+  Owner = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = logic_event:create_event(Owner, Cal#calendar.id, <<"spam party">>,
+    eh_test_support:future_start(), 60),
+  ?assertEqual(frozen, Ev#event.status).
+
+test_logic_review_censor() ->
+  add_word(<<"bad">>),
+  {ok, _} = core_automod_settings:update([{keyword_action, censor}], admin_id()),
+  Owner = seed_user(),
+  Reviewer = seed_user(),
+  {ok, Cal} = core_calendar:create(Owner, <<"Cal">>, <<>>, manual),
+  {ok, Ev} = core_event:create(Cal#calendar.id, <<"E">>, eh_test_support:future_start(), 60),
+  %% can_review may fail without booking — use evaluate + core like create path
+  {ok, censor, [Comment], Words} = logic_automoderation:evaluate_texts([<<"really bad">>]),
+  {ok, Rev} = core_review:create(Reviewer, event, Ev#event.id, 2, Comment),
+  ok = logic_automoderation:apply_after_save(review, Rev#review.id, censor, Words),
+  {ok, Saved} = core_review:get_by_id(Rev#review.id),
+  ?assertEqual(<<"really ***">>, Saved#review.comment),
+  ?assertEqual(1, length(core_automod_hit:list([{action_taken, censor}]))).

test/unit/logic_moderation_tests.erl

@@ -2,7 +2,8 @@
 -include_lib("eunit/include/eunit.hrl").
 -include("records.hrl").
 
--define(TABLES, [user, admin, calendar, event, report, banned_word]).
+-define(TABLES, [user, admin, admin_audit, calendar, event, report, banned_word,
+  automod_settings, automod_hit, review]).
 
 %% ----------------------------------------------------------------
 %% Фикстуры
@@ -10,6 +11,7 @@
 setup() ->
   eh_test_support:start_mnesia(),
   eh_test_support:ensure_tables(?TABLES),
+  core_automod_settings:ensure_defaults(),
   ok.
 
 cleanup(_) ->