feat: mute and block people from the API by simonhamp · Pull Request #555 · dev-null-sh/dev-null.sh

simonhamp · 2026-10-19T06:37:49Z

Lets the mobile app mute and block people, and list who the user mutes and blocks, the way Settings → Safety does on the web. It follows #130, which added the signed API, and is one of a few small PRs for the endpoints the app (NativePHP/dev-null-app) uses on top of it.

Endpoints

All signed.

Request	Answer
`POST /api/v1/users/{username}/mute`	`200` with the user and `is_muting: true`
`DELETE /api/v1/users/{username}/mute`	`200` with the user and `is_muting: false`
`POST /api/v1/users/{username}/block`	`200` with the user and `is_blocking: true`
`DELETE /api/v1/users/{username}/block`	`200` with the user and `is_blocking: false`
`GET /api/v1/me/muted`	The people the user mutes, last first, 20 a page with a cursor
`GET /api/v1/me/blocked`	The people the user blocks, the same way

They reuse the web's actions and mirror its form requests. Nobody can mute or block themselves (403), and undoing is always allowed. Muting is silent. Blocking ends the follows both ways, and unblocking doesn't bring them back. The web has no rate limit of its own on these, so they only get the signed API's 120 a minute.

The user_blocked error now also carries the blocked user, so the app's blocked page can show their name and avatar the way the web's page does. user_unavailable still says nothing about who.

Worth checking

ApiException::acrossBlock() takes a third argument, the UserResource to send. The arch preset doesn't let App\Exceptions use App\Http, so the form requests that throw it build the resource and pass it in. This PR updates the two callers on production.
The follower lists PR (feat: list a profile's followers and following in the API #556) adds two more callers. Whichever of the two merges second needs shown: UserResource::make($user) added to ListApiUserFollowersRequest and ListApiUserFollowingRequest.
The lists order by the pivot's created_at with the user id as a tie-break, like SafetyController. A test with 25 people muted at the same moment checks the paging.

The log already leaves muted people out through the web's queries, and the existing log tests cover it, so nothing changed there.

Testing

Everything CI runs passes on this branch locally: Pint, Rector, the JS lint, PHPStan, tsc, type coverage, and all 2,976 tests at 100% coverage.

The app's mute and block actions, and the lists under its account screen (NativePHP/dev-null-app#6), have been running against these endpoints on a phone.

…ocks

Copilot