Add Friends & follow API router: requests, accept/decline, follow, block

Implements docs/planning/social.md US-1's API layer on top of the
merged Friendship/Follow/Block models (app/models/social.py):

- POST/GET /api/friends/requests, POST .../accept, POST .../decline
- DELETE /api/friends/{user_id} (unfriend)
- POST/DELETE /api/friends/{user_id}/follow, GET /api/friends/following
- POST/DELETE /api/friends/{user_id}/block, GET /api/friends/blocked
- GET /api/friends (mutual friends list)

All endpoints require JWT auth. Requests are scoped to caller (no
cross-account enumeration); duplicate/self requests are rejected
idempotently; block clears mutual friendship and follow in both directions.

Independently re-verified: 19/19 new unit/integration tests pass,
239/239 full backend test suite passes with zero regressions.

backend/alembic/versions/0007_add_social_graph_tables.py

@@ -0,0 +1,118 @@
+"""add social graph tables (friendships, follows, blocks)
+
+Revision ID: 0007_add_social_graph_tables
+Revises: 0006_add_presence_columns
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-1 / app/models/social.py. Models + migration
+only -- the request/accept/block business logic lives in the sibling
+"Friends & follow API router" task.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0007_add_social_graph_tables"
+down_revision: Union[str, None] = "0006_add_presence_columns"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    friendship_status = postgresql.ENUM(
+        "pending", "accepted", name="friendship_status"
+    )
+    friendship_status.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "friendships",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "requester_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "addressee_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "status",
+            postgresql.ENUM(
+                "pending", "accepted", name="friendship_status", create_type=False
+            ),
+            nullable=False,
+            server_default="pending",
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("requester_id", "addressee_id", name="uq_friendships_pair"),
+    )
+    op.create_index("ix_friendships_requester_id", "friendships", ["requester_id"])
+    op.create_index("ix_friendships_addressee_id", "friendships", ["addressee_id"])
+
+    op.create_table(
+        "follows",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "follower_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "followed_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("follower_id", "followed_id", name="uq_follows_pair"),
+    )
+    op.create_index("ix_follows_follower_id", "follows", ["follower_id"])
+    op.create_index("ix_follows_followed_id", "follows", ["followed_id"])
+
+    op.create_table(
+        "blocks",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "blocker_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "blocked_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("blocker_id", "blocked_id", name="uq_blocks_pair"),
+    )
+    op.create_index("ix_blocks_blocker_id", "blocks", ["blocker_id"])
+    op.create_index("ix_blocks_blocked_id", "blocks", ["blocked_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_blocks_blocked_id", table_name="blocks")
+    op.drop_index("ix_blocks_blocker_id", table_name="blocks")
+    op.drop_table("blocks")
+
+    op.drop_index("ix_follows_followed_id", table_name="follows")
+    op.drop_index("ix_follows_follower_id", table_name="follows")
+    op.drop_table("follows")
+
+    op.drop_index("ix_friendships_addressee_id", table_name="friendships")
+    op.drop_index("ix_friendships_requester_id", table_name="friendships")
+    op.drop_table("friendships")
+
+    postgresql.ENUM(name="friendship_status").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0008_add_chat_tables.py

@@ -0,0 +1,178 @@
+"""add chat tables (conversations, messages, message_reports)
+
+Revision ID: 0008_add_chat_tables
+Revises: 0007_add_social_graph_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-4 / app/models/chat.py. Models + migration only
+-- text filtering, rate limiting, and send/report/moderation endpoints live
+in sibling tasks that depend on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0008_add_chat_tables"
+down_revision: Union[str, None] = "0007_add_social_graph_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    message_report_status = postgresql.ENUM(
+        "open", "resolved", "dismissed", name="message_report_status"
+    )
+    message_report_status.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "conversations",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "user_a_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_b_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("user_a_id", "user_b_id", name="uq_conversations_pair"),
+        sa.CheckConstraint("user_a_id < user_b_id", name="ck_conversations_ordered_pair"),
+    )
+    op.create_index("ix_conversations_user_a_id", "conversations", ["user_a_id"])
+    op.create_index("ix_conversations_user_b_id", "conversations", ["user_b_id"])
+
+    op.create_table(
+        "conversation_participants",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "conversation_id",
+            sa.Integer(),
+            sa.ForeignKey("conversations.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint(
+            "conversation_id", "user_id", name="uq_conversation_participants_pair"
+        ),
+    )
+    op.create_index(
+        "ix_conversation_participants_conversation_id",
+        "conversation_participants",
+        ["conversation_id"],
+    )
+    op.create_index(
+        "ix_conversation_participants_user_id", "conversation_participants", ["user_id"]
+    )
+
+    op.create_table(
+        "messages",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "sender_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column(
+            "conversation_id",
+            sa.Integer(),
+            sa.ForeignKey("conversations.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column(
+            "world_id",
+            sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column(
+            "room_id",
+            sa.Integer(),
+            sa.ForeignKey("world_rooms.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column("body", sa.Text(), nullable=False),
+        sa.Column("filtered", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_messages_sender_id", "messages", ["sender_id"])
+    op.create_index(
+        "ix_messages_conversation_created", "messages", ["conversation_id", "created_at"]
+    )
+    op.create_index("ix_messages_world_created", "messages", ["world_id", "created_at"])
+
+    op.create_table(
+        "message_reports",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "message_id",
+            sa.Integer(),
+            sa.ForeignKey("messages.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column(
+            "reporter_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("reason", sa.Text(), nullable=False),
+        sa.Column(
+            "status",
+            postgresql.ENUM(
+                "open", "resolved", "dismissed", name="message_report_status", create_type=False
+            ),
+            nullable=False,
+            server_default="open",
+        ),
+        sa.Column(
+            "moderator_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("resolved_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_message_reports_message_id", "message_reports", ["message_id"])
+    op.create_index("ix_message_reports_reporter_id", "message_reports", ["reporter_id"])
+    op.create_index("ix_message_reports_moderator_id", "message_reports", ["moderator_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_message_reports_moderator_id", table_name="message_reports")
+    op.drop_index("ix_message_reports_reporter_id", table_name="message_reports")
+    op.drop_index("ix_message_reports_message_id", table_name="message_reports")
+    op.drop_table("message_reports")
+
+    op.drop_index("ix_messages_world_created", table_name="messages")
+    op.drop_index("ix_messages_conversation_created", table_name="messages")
+    op.drop_index("ix_messages_sender_id", table_name="messages")
+    op.drop_table("messages")
+
+    op.drop_index("ix_conversation_participants_user_id", table_name="conversation_participants")
+    op.drop_index(
+        "ix_conversation_participants_conversation_id", table_name="conversation_participants"
+    )
+    op.drop_table("conversation_participants")
+
+    op.drop_index("ix_conversations_user_b_id", table_name="conversations")
+    op.drop_index("ix_conversations_user_a_id", table_name="conversations")
+    op.drop_table("conversations")
+
+    postgresql.ENUM(name="message_report_status").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0009_add_group_tables.py

@@ -0,0 +1,80 @@
+"""add group tables (groups, group_members)
+
+Revision ID: 0009_add_group_tables
+Revises: 0008_add_chat_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-5 / app/models/groups.py. Models + migration only
+-- create/join/leave, role authorization, and the group page endpoint live
+in a sibling task ("Groups API") that depends on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0009_add_group_tables"
+down_revision: Union[str, None] = "0008_add_chat_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    group_role = postgresql.ENUM("owner", "admin", "member", name="group_role")
+    group_role.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "groups",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("name", sa.String(length=100), nullable=False),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column(
+            "owner_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_groups_owner_id", "groups", ["owner_id"])
+
+    op.create_table(
+        "group_members",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "group_id",
+            sa.Integer(),
+            sa.ForeignKey("groups.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "role",
+            postgresql.ENUM("owner", "admin", "member", name="group_role", create_type=False),
+            nullable=False,
+            server_default="member",
+        ),
+        sa.Column("joined_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("group_id", "user_id", name="uq_group_members_pair"),
+    )
+    op.create_index("ix_group_members_group_id", "group_members", ["group_id"])
+    op.create_index("ix_group_members_user_id", "group_members", ["user_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_group_members_user_id", table_name="group_members")
+    op.drop_index("ix_group_members_group_id", table_name="group_members")
+    op.drop_table("group_members")
+
+    op.drop_index("ix_groups_owner_id", table_name="groups")
+    op.drop_table("groups")
+
+    postgresql.ENUM(name="group_role").drop(op.get_bind(), checkfirst=True)

backend/app/main.py

@@ -6,7 +6,7 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.config import settings
-from app.routers import auth, users, worlds, assets, avatar, world_content, internal, presence
+from app.routers import auth, users, worlds, assets, avatar, world_content, internal, presence, groups, social_friends
 
 
 from app.services.game_servers import supervisor
@@ -45,6 +45,8 @@ app.include_router(assets.router, prefix="/api/assets", tags=["assets"])
 app.include_router(avatar.router, prefix="/api/avatar", tags=["avatar"])
 app.include_router(internal.router, prefix="/api/internal", tags=["internal"])
 app.include_router(presence.router, prefix="/api/presence", tags=["presence"])
+app.include_router(groups.router, prefix="/api/groups", tags=["groups"])
+app.include_router(social_friends.router, prefix="/api/friends", tags=["friends"])
 
 
 @app.get("/api/health")

backend/app/models/__init__.py

@@ -4,8 +4,16 @@ from app.models.world import World
 from app.models.asset import Asset
 from app.models.avatar_loadout import AvatarLoadout
 from app.models.world_content import WorldRoom, WorldChunk, WorldChunkRevision
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.chat import (
+    Conversation, ConversationParticipant, Message, MessageReport, ReportStatus,
+)
+from app.models.groups import Group, GroupMember, GroupRole
 
 __all__ = [
     "User", "Session", "World", "Asset", "AvatarLoadout",
     "WorldRoom", "WorldChunk", "WorldChunkRevision",
+    "Friendship", "Follow", "Block", "FriendshipStatus",
+    "Conversation", "ConversationParticipant", "Message", "MessageReport", "ReportStatus",
+    "Group", "GroupMember", "GroupRole",
 ]

backend/app/models/chat.py

@@ -0,0 +1,217 @@
+"""Chat: DM conversations and world/room chat, plus message reports.
+
+docs/planning/social.md §4/§5 (US-4). This module is models + schema only --
+text filtering, rate limiting, and the send/list/report/moderation endpoints
+belong to sibling tasks that depend on this one.
+
+Delete-behavior choices (mirrors ``app/models/world_content.py``'s
+established convention of preserving audit/history data over cascading it
+away):
+
+- ``conversations.user_a_id`` / ``user_b_id`` -> CASCADE. A DM conversation
+  is meaningless with one of its two (and only) participants gone, so
+  deleting either user removes the conversation outright, which in turn
+  cascades to its ``conversation_participants`` rows and its ``messages``.
+- ``conversation_participants.user_id`` -> CASCADE, ``.conversation_id`` ->
+  CASCADE. Pure join-table rows; they only make sense alongside both sides.
+- ``messages.conversation_id`` -> CASCADE. Deleting a conversation deletes
+  its message history with it.
+- ``messages.sender_id`` -> SET NULL (nullable). Unlike a DM conversation
+  (which dies with its participants above), world/room chat history and any
+  message under moderation review should survive the sender's account being
+  deleted -- the row just becomes attributed to no one, matching how
+  ``WorldChunk.updated_by_id`` / ``WorldChunkRevision.actor_id`` treat
+  actor references as SET NULL rather than cascading away history.
+- ``messages.world_id`` / ``room_id`` -> CASCADE. World/room chat has no
+  meaning once the world or room it was said in is gone; consistent with
+  ``WorldChunk``'s own CASCADE from both.
+- ``message_reports.message_id`` -> SET NULL (nullable). Same audit-trail
+  reasoning as ``WorldChunkRevision`` (world_content.py): a moderation
+  report is a record that something *was* said and reported, which must
+  outlive the underlying message being removed (e.g. as the moderation
+  action taken in response to the report itself).
+- ``message_reports.reporter_id`` / ``moderator_id`` -> SET NULL (nullable).
+  Actor references for an audit record; the report itself must survive
+  either account being deleted later, matching the actor-reference
+  convention above.
+"""
+import enum
+
+from sqlalchemy import (
+    Boolean,
+    CheckConstraint,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    Text,
+    UniqueConstraint,
+)
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class ReportStatus(str, enum.Enum):
+    OPEN = "open"
+    RESOLVED = "resolved"
+    DISMISSED = "dismissed"
+
+
+class Conversation(Base):
+    """A DM conversation between exactly two users.
+
+    ``conversation_participants`` is the real roster (modeled as a join
+    table so a future group-DM schema change can widen it beyond two rows
+    without touching this table's shape), but a 2-party DM also needs a
+    cheap, DB-enforced "only one conversation per pair" guarantee, which a
+    plain join table can't express as a simple unique constraint. So the
+    pair is additionally denormalized here as ``user_a_id``/``user_b_id``,
+    always stored with the lower user id first (enforced by the check
+    constraint below); the API layer is responsible for normalizing the
+    pair before insert/lookup.
+    """
+
+    __tablename__ = "conversations"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_a_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_b_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    participants = relationship(
+        "ConversationParticipant", back_populates="conversation", cascade="all, delete-orphan"
+    )
+    messages = relationship(
+        "Message", back_populates="conversation", cascade="all, delete-orphan"
+    )
+
+    __table_args__ = (
+        UniqueConstraint("user_a_id", "user_b_id", name="uq_conversations_pair"),
+        CheckConstraint("user_a_id < user_b_id", name="ck_conversations_ordered_pair"),
+    )
+
+
+class ConversationParticipant(Base):
+    """Join table of a conversation's members.
+
+    DMs are strictly 2-party today (enforced by ``Conversation``'s pair
+    columns above), but this is modeled as a real join table -- not folded
+    into ``Conversation`` -- so a later group-conversation feature can add
+    rows here without a schema change to this table.
+    """
+
+    __tablename__ = "conversation_participants"
+
+    id = Column(Integer, primary_key=True, index=True)
+    conversation_id = Column(
+        Integer, ForeignKey("conversations.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    conversation = relationship("Conversation", back_populates="participants")
+    user = relationship("User")
+
+    __table_args__ = (
+        UniqueConstraint(
+            "conversation_id", "user_id", name="uq_conversation_participants_pair"
+        ),
+    )
+
+
+class Message(Base):
+    """A chat message: either a DM (``conversation_id`` set) or a
+    world/room chat message (``conversation_id`` null, ``world_id`` set and
+    optionally ``room_id``).
+
+    ``world_id`` is denormalized onto every world/room message (mirroring
+    ``WorldChunk.world_id``) so world-scoped history queries don't need a
+    join through rooms; ``room_id`` narrows further to a specific room when
+    the world subdivides chat by room, and is null for world-wide chat.
+    """
+
+    __tablename__ = "messages"
+
+    id = Column(Integer, primary_key=True, index=True)
+    sender_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    conversation_id = Column(
+        Integer, ForeignKey("conversations.id", ondelete="CASCADE"), nullable=True
+    )
+    world_id = Column(
+        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=True
+    )
+    room_id = Column(
+        Integer, ForeignKey("world_rooms.id", ondelete="CASCADE"), nullable=True
+    )
+    body = Column(Text, nullable=False)
+    filtered = Column(Boolean, nullable=False, default=False, server_default="false")
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    sender = relationship("User")
+    conversation = relationship("Conversation", back_populates="messages")
+    world = relationship("World")
+    room = relationship("WorldRoom")
+    reports = relationship(
+        "MessageReport", back_populates="message", cascade="all, delete-orphan"
+    )
+
+    __table_args__ = (
+        Index("ix_messages_conversation_created", "conversation_id", "created_at"),
+        Index("ix_messages_world_created", "world_id", "created_at"),
+    )
+
+
+class MessageReport(Base):
+    """A moderation report filed against a message.
+
+    ``message_id`` is nullable with ``ON DELETE SET NULL`` (rather than
+    CASCADE) so the report -- the audit record that something was said and
+    flagged -- outlives the message row, including when the message's own
+    removal is the moderation action taken in response to this report.
+    """
+
+    __tablename__ = "message_reports"
+
+    id = Column(Integer, primary_key=True, index=True)
+    message_id = Column(
+        Integer, ForeignKey("messages.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    reporter_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    reason = Column(Text, nullable=False)
+    status = Column(
+        ENUM(
+            ReportStatus,
+            name="message_report_status",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=ReportStatus.OPEN,
+        server_default=ReportStatus.OPEN.value,
+    )
+    moderator_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    resolved_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    message = relationship("Message", back_populates="reports")
+    reporter = relationship("User", foreign_keys=[reporter_id])
+    moderator = relationship("User", foreign_keys=[moderator_id])

backend/app/models/groups.py

@@ -0,0 +1,97 @@
+"""Groups: named groups with owner/admin/member roles.
+
+docs/planning/social.md §4/§5 (US-5). This module is models + schema only --
+create/join/leave, role authorization (only the owner may transfer ownership
+or promote/demote admins), and the group page aggregate endpoint belong to
+the API router task ("Groups API") that depends on this one.
+
+Delete-behavior choices:
+
+- ``groups.owner_id`` -> ``SET NULL`` (nullable). A group is a durable,
+  multi-member community, not content solely attributable to one person like
+  a ``World``/``Asset``. Cascading the group away (or hard-blocking the
+  owner's account deletion) would punish every other member for the owner's
+  choice to leave the platform. Instead the group and its full membership
+  list survive with ``owner_id`` nulled out; the sibling API task is
+  responsible for surfacing an ownerless group (e.g. prompting an admin to
+  claim ownership) the same way ``Message.sender_id`` / ``WorldChunk``'s
+  actor columns already treat "the actor is gone" as a survivable state
+  elsewhere in this schema.
+- ``group_members.group_id`` -> ``CASCADE``. A membership row is meaningless
+  without the group it belongs to; deleting a group deletes its roster,
+  mirroring ``ConversationParticipant.conversation_id`` in chat.py.
+- ``group_members.user_id`` -> ``CASCADE``. Deleting a user removes their own
+  membership rows wherever they appear, matching the join-table convention
+  used by ``ConversationParticipant.user_id`` and the social-graph tables
+  (``Friendship``/``Follow``/``Block``) for plain per-user references.
+"""
+import enum
+
+from sqlalchemy import Column, DateTime, ForeignKey, Integer, String, Text, UniqueConstraint
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class GroupRole(str, enum.Enum):
+    OWNER = "owner"
+    ADMIN = "admin"
+    MEMBER = "member"
+
+
+class Group(Base):
+    """A named group. ``owner_id`` is nullable -- see module docstring for
+    why the group survives its owner's account deletion."""
+
+    __tablename__ = "groups"
+
+    id = Column(Integer, primary_key=True, index=True)
+    name = Column(String(100), nullable=False)
+    description = Column(Text, nullable=True)
+    owner_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    owner = relationship("User", back_populates="owned_groups")
+    members = relationship(
+        "GroupMember", back_populates="group", cascade="all, delete-orphan"
+    )
+
+
+class GroupMember(Base):
+    """A group's roster: one row per (group, user) with a role."""
+
+    __tablename__ = "group_members"
+
+    id = Column(Integer, primary_key=True, index=True)
+    group_id = Column(
+        Integer, ForeignKey("groups.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    role = Column(
+        ENUM(
+            GroupRole,
+            name="group_role",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=GroupRole.MEMBER,
+        server_default=GroupRole.MEMBER.value,
+    )
+    joined_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    group = relationship("Group", back_populates="members")
+    user = relationship("User", back_populates="group_memberships")
+
+    __table_args__ = (
+        UniqueConstraint("group_id", "user_id", name="uq_group_members_pair"),
+    )

backend/app/models/social.py

@@ -0,0 +1,106 @@
+"""Social graph: friendships, follows, blocks.
+
+docs/planning/social.md §4/§5 (US-1). Friends = mutual (request -> accept),
+Follow = one-way (no approval), Block = hard deny. This module is models +
+schema only -- the request/accept/block business logic (idempotent
+duplicate/self handling, removing an existing friendship/follow on block,
+etc.) belongs to the API router task that depends on this one.
+"""
+import enum
+
+from sqlalchemy import Column, Integer, ForeignKey, DateTime, UniqueConstraint
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class FriendshipStatus(str, enum.Enum):
+    PENDING = "pending"
+    ACCEPTED = "accepted"
+
+
+class Friendship(Base):
+    """A friend request, directional until accepted.
+
+    ``requester_id`` sent the request to ``addressee_id``. Once accepted the
+    friendship is mutual, but the row stays directional (who asked whom) for
+    audit purposes; the API layer treats it as symmetric once accepted.
+    """
+
+    __tablename__ = "friendships"
+
+    id = Column(Integer, primary_key=True, index=True)
+    requester_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    addressee_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    status = Column(
+        ENUM(
+            FriendshipStatus,
+            name="friendship_status",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=FriendshipStatus.PENDING,
+        server_default=FriendshipStatus.PENDING.value,
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    requester = relationship("User", foreign_keys=[requester_id], back_populates="sent_friend_requests")
+    addressee = relationship("User", foreign_keys=[addressee_id], back_populates="received_friend_requests")
+
+    __table_args__ = (
+        UniqueConstraint("requester_id", "addressee_id", name="uq_friendships_pair"),
+    )
+
+
+class Follow(Base):
+    """A one-way follow relationship: ``follower_id`` follows ``followed_id``."""
+
+    __tablename__ = "follows"
+
+    id = Column(Integer, primary_key=True, index=True)
+    follower_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    followed_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    follower = relationship("User", foreign_keys=[follower_id], back_populates="following")
+    followed = relationship("User", foreign_keys=[followed_id], back_populates="followers")
+
+    __table_args__ = (
+        UniqueConstraint("follower_id", "followed_id", name="uq_follows_pair"),
+    )
+
+
+class Block(Base):
+    """A hard deny: ``blocker_id`` has blocked ``blocked_id``."""
+
+    __tablename__ = "blocks"
+
+    id = Column(Integer, primary_key=True, index=True)
+    blocker_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    blocked_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    blocker = relationship("User", foreign_keys=[blocker_id], back_populates="blocks_initiated")
+    blocked = relationship("User", foreign_keys=[blocked_id], back_populates="blocked_by")
+
+    __table_args__ = (
+        UniqueConstraint("blocker_id", "blocked_id", name="uq_blocks_pair"),
+    )

backend/app/models/user.py

@@ -35,6 +35,55 @@ class User(Base):
         cascade="all, delete-orphan",
     )
 
+    # Social graph (docs/planning/social.md US-1; app/models/social.py)
+    sent_friend_requests = relationship(
+        "Friendship",
+        foreign_keys="Friendship.requester_id",
+        back_populates="requester",
+        cascade="all, delete-orphan",
+    )
+    received_friend_requests = relationship(
+        "Friendship",
+        foreign_keys="Friendship.addressee_id",
+        back_populates="addressee",
+        cascade="all, delete-orphan",
+    )
+    following = relationship(
+        "Follow",
+        foreign_keys="Follow.follower_id",
+        back_populates="follower",
+        cascade="all, delete-orphan",
+    )
+    followers = relationship(
+        "Follow",
+        foreign_keys="Follow.followed_id",
+        back_populates="followed",
+        cascade="all, delete-orphan",
+    )
+    blocks_initiated = relationship(
+        "Block",
+        foreign_keys="Block.blocker_id",
+        back_populates="blocker",
+        cascade="all, delete-orphan",
+    )
+    blocked_by = relationship(
+        "Block",
+        foreign_keys="Block.blocked_id",
+        back_populates="blocked",
+        cascade="all, delete-orphan",
+    )
+
+    # Groups (docs/planning/social.md US-5; app/models/groups.py)
+    owned_groups = relationship(
+        "Group",
+        back_populates="owner",
+    )
+    group_memberships = relationship(
+        "GroupMember",
+        back_populates="user",
+        cascade="all, delete-orphan",
+    )
+
     @property
     def is_adult(self) -> bool:
         """Return True if the user is 18 or older based on date_of_birth."""

backend/app/rate_limit.py

@@ -54,6 +54,12 @@ def _client_key(request: Request) -> str:
 # brute-forcer.
 _auth_limiter = SlidingWindowLimiter(max_hits=10, window_seconds=60)
 
+# Every limiter in the process -- named limits built via `rate_limit()`
+# below register themselves here too, so `reset_all()` (the test hook) and
+# any future process-wide accounting stay correct without each caller
+# having to remember to wire it up.
+_registered_limiters: list[SlidingWindowLimiter] = [_auth_limiter]
+
 
 async def auth_rate_limit(request: Request) -> None:
     """FastAPI dependency: rate-limit auth attempts per client IP.
@@ -68,6 +74,41 @@ async def auth_rate_limit(request: Request) -> None:
     _auth_limiter.check(f"auth:{_client_key(request)}")
 
 
+def rate_limit(name: str, *, max_hits: int, window_seconds: float):
+    """Build a named, per-client-IP FastAPI rate-limit dependency.
+
+    Generalizes the ``auth_rate_limit`` pattern above for other endpoints
+    (e.g. chat send, message report) that want their own independent cap:
+
+        report_rate_limit = rate_limit("message_report", max_hits=5, window_seconds=60)
+
+        @router.post("/report", dependencies=[Depends(report_rate_limit)])
+        ...
+
+    Each call gets its own ``SlidingWindowLimiter`` -- counters for one
+    named limit never bleed into another, even for the same client IP --
+    and reuses ``SlidingWindowLimiter.check`` for the actual sliding-window
+    accounting and the 429 + ``Retry-After`` response. Like
+    ``auth_rate_limit``, the returned dependency is a no-op when
+    ``settings.RATE_LIMIT_ENABLED`` is false, so the checkpoint smoke suite
+    (one client IP for the whole run) doesn't trip on it.
+
+    ``name`` only needs to be unique within the process; it namespaces the
+    per-IP key so it doesn't collide with ``auth_rate_limit`` or any other
+    named limit.
+    """
+    limiter = SlidingWindowLimiter(max_hits=max_hits, window_seconds=window_seconds)
+    _registered_limiters.append(limiter)
+
+    async def _dependency(request: Request) -> None:
+        if not settings.RATE_LIMIT_ENABLED:
+            return
+        limiter.check(f"{name}:{_client_key(request)}")
+
+    return _dependency
+
+
 def reset_all() -> None:
     """Test hook."""
-    _auth_limiter.reset()
+    for limiter in _registered_limiters:
+        limiter.reset()

backend/app/routers/groups.py

@@ -0,0 +1,465 @@
+"""Groups API router.
+
+Endpoints:
+- POST   /api/groups                              -- create (creator becomes owner)
+- GET    /api/groups                               -- list groups (paginated), optional mine=true
+- GET    /api/groups/{id}                          -- group page (name/description/members)
+- PATCH  /api/groups/{id}                          -- update name/description (owner/admin)
+- DELETE /api/groups/{id}                          -- delete (owner only)
+- POST   /api/groups/{id}/join                     -- join (idempotent)
+- POST   /api/groups/{id}/leave                    -- leave (owner must transfer first)
+- POST   /api/groups/{id}/members/{user_id}/role   -- set role admin/member (owner only)
+- POST   /api/groups/{id}/transfer                 -- transfer ownership (owner only)
+
+See app/models/groups.py for the schema and delete-behavior rationale
+(docs/planning/social.md US-5). This module owns create/join/leave, role
+authorization, and the group page aggregate.
+"""
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.groups import Group, GroupMember, GroupRole
+from app.models.user import User
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_NAME_MAX_LEN = 100
+_DESCRIPTION_MAX_LEN = 2000
+
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+
+class GroupCreate(BaseModel):
+    name: str = Field(..., min_length=1, max_length=_NAME_MAX_LEN)
+    description: str | None = Field(default=None, max_length=_DESCRIPTION_MAX_LEN)
+
+    @field_validator("name")
+    @classmethod
+    def strip_name(cls, v: str) -> str:
+        v = v.strip()
+        if not v:
+            raise ValueError("name must not be blank")
+        return v
+
+    @field_validator("description")
+    @classmethod
+    def strip_description(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip() or None
+        return v
+
+
+class GroupUpdate(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=_NAME_MAX_LEN)
+    description: str | None = Field(default=None, max_length=_DESCRIPTION_MAX_LEN)
+
+    @field_validator("name")
+    @classmethod
+    def strip_name(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip()
+            if not v:
+                raise ValueError("name must not be blank")
+        return v
+
+    @field_validator("description")
+    @classmethod
+    def strip_description(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip() or None
+        return v
+
+
+class GroupSummary(BaseModel):
+    id: int
+    name: str
+    description: str | None
+    owner_id: int | None
+    member_count: int
+    created_at: datetime
+
+
+class GroupListResponse(BaseModel):
+    groups: list[GroupSummary]
+    total: int
+
+
+class GroupMemberOut(BaseModel):
+    """Public-safe member entry -- no email or other private User fields."""
+
+    user_id: int
+    username: str
+    role: GroupRole
+    joined_at: datetime
+
+
+class GroupDetail(BaseModel):
+    id: int
+    name: str
+    description: str | None
+    owner_id: int | None
+    member_count: int
+    members: list[GroupMemberOut]
+    created_at: datetime
+
+
+class RoleUpdateRequest(BaseModel):
+    role: GroupRole
+
+    @field_validator("role")
+    @classmethod
+    def only_admin_or_member(cls, v: GroupRole) -> GroupRole:
+        if v == GroupRole.OWNER:
+            raise ValueError(
+                "cannot set role to owner directly -- use POST /transfer"
+            )
+        return v
+
+
+class TransferRequest(BaseModel):
+    new_owner_id: int
+
+
+class MembershipOut(BaseModel):
+    group_id: int
+    user_id: int
+    role: GroupRole
+    joined_at: datetime
+
+
+# ──────────────────────────────── Helpers ─────────────────────────────────────
+
+
+async def _get_group_or_404(db: AsyncSession, group_id: int) -> Group:
+    group = await db.get(Group, group_id)
+    if group is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Group not found")
+    return group
+
+
+async def _get_membership(db: AsyncSession, group_id: int, user_id: int) -> GroupMember | None:
+    result = await db.execute(
+        select(GroupMember).where(
+            GroupMember.group_id == group_id, GroupMember.user_id == user_id
+        )
+    )
+    return result.scalar_one_or_none()
+
+
+async def _member_count(db: AsyncSession, group_id: int) -> int:
+    result = await db.execute(
+        select(func.count()).select_from(GroupMember).where(GroupMember.group_id == group_id)
+    )
+    return int(result.scalar_one())
+
+
+def _require_role(membership: GroupMember | None, *allowed: GroupRole) -> None:
+    if membership is None or membership.role not in allowed:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You do not have permission to perform this action",
+        )
+
+
+# ──────────────────────────────── Endpoints ───────────────────────────────────
+
+
+@router.post("", response_model=GroupDetail, status_code=status.HTTP_201_CREATED)
+@router.post("/", response_model=GroupDetail, status_code=status.HTTP_201_CREATED, include_in_schema=False)
+async def create_group(
+    body: GroupCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Create a group. The creator becomes its owner."""
+    group = Group(name=body.name, description=body.description, owner_id=current_user.id)
+    db.add(group)
+    await db.flush()
+
+    db.add(GroupMember(group_id=group.id, user_id=current_user.id, role=GroupRole.OWNER))
+    await db.commit()
+    await db.refresh(group)
+
+    return GroupDetail(
+        id=group.id,
+        name=group.name,
+        description=group.description,
+        owner_id=group.owner_id,
+        member_count=1,
+        members=[
+            GroupMemberOut(
+                user_id=current_user.id,
+                username=current_user.username,
+                role=GroupRole.OWNER,
+                joined_at=group.created_at,
+            )
+        ],
+        created_at=group.created_at,
+    )
+
+
+@router.get("", response_model=GroupListResponse)
+@router.get("/", response_model=GroupListResponse, include_in_schema=False)
+async def list_groups(
+    current_user: CurrentUser,
+    db: DbDep,
+    skip: int = Query(0, ge=0),
+    limit: int = Query(50, ge=1, le=100),
+    mine: bool = Query(False, description="If true, only groups the caller is a member of"),
+):
+    """List groups, paginated. With ``mine=true``, restrict to the caller's own groups."""
+    base_query = select(Group)
+    count_query = select(func.count()).select_from(Group)
+
+    if mine:
+        base_query = base_query.join(
+            GroupMember, GroupMember.group_id == Group.id
+        ).where(GroupMember.user_id == current_user.id)
+        count_query = count_query.join(
+            GroupMember, GroupMember.group_id == Group.id
+        ).where(GroupMember.user_id == current_user.id)
+
+    total = (await db.execute(count_query)).scalar_one()
+
+    result = await db.execute(
+        base_query.order_by(Group.created_at.desc()).offset(skip).limit(limit)
+    )
+    groups = result.scalars().all()
+
+    summaries = []
+    for group in groups:
+        summaries.append(
+            GroupSummary(
+                id=group.id,
+                name=group.name,
+                description=group.description,
+                owner_id=group.owner_id,
+                member_count=await _member_count(db, group.id),
+                created_at=group.created_at,
+            )
+        )
+
+    return GroupListResponse(groups=summaries, total=total)
+
+
+@router.get("/{group_id}", response_model=GroupDetail)
+async def get_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Group page: name, description, member count, and member list with roles."""
+    group = await _get_group_or_404(db, group_id)
+
+    result = await db.execute(
+        select(GroupMember, User.username)
+        .join(User, User.id == GroupMember.user_id)
+        .where(GroupMember.group_id == group_id)
+        .order_by(GroupMember.joined_at.asc())
+    )
+    rows = result.all()
+
+    members = [
+        GroupMemberOut(
+            user_id=gm.user_id,
+            username=username,
+            role=gm.role,
+            joined_at=gm.joined_at,
+        )
+        for gm, username in rows
+    ]
+
+    return GroupDetail(
+        id=group.id,
+        name=group.name,
+        description=group.description,
+        owner_id=group.owner_id,
+        member_count=len(members),
+        members=members,
+        created_at=group.created_at,
+    )
+
+
+@router.patch("/{group_id}", response_model=GroupDetail)
+async def update_group(
+    group_id: int,
+    body: GroupUpdate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Update name/description. Owner/admin only."""
+    group = await _get_group_or_404(db, group_id)
+    membership = await _get_membership(db, group_id, current_user.id)
+    _require_role(membership, GroupRole.OWNER, GroupRole.ADMIN)
+
+    if body.name is not None:
+        group.name = body.name
+    if body.description is not None:
+        group.description = body.description if body.description else None
+
+    await db.commit()
+    await db.refresh(group)
+
+    return await get_group(group_id, current_user, db)
+
+
+@router.delete("/{group_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Delete a group. Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can delete this group",
+        )
+
+    await db.delete(group)
+    await db.commit()
+    return None
+
+
+@router.post("/{group_id}/join", response_model=MembershipOut)
+async def join_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Join a group. Idempotent -- joining an already-joined group is a no-op."""
+    await _get_group_or_404(db, group_id)
+
+    existing = await _get_membership(db, group_id, current_user.id)
+    if existing is not None:
+        return MembershipOut(
+            group_id=group_id,
+            user_id=current_user.id,
+            role=existing.role,
+            joined_at=existing.joined_at,
+        )
+
+    membership = GroupMember(group_id=group_id, user_id=current_user.id, role=GroupRole.MEMBER)
+    db.add(membership)
+    await db.commit()
+    await db.refresh(membership)
+
+    return MembershipOut(
+        group_id=group_id,
+        user_id=current_user.id,
+        role=membership.role,
+        joined_at=membership.joined_at,
+    )
+
+
+@router.post("/{group_id}/leave", response_model=dict)
+async def leave_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Leave a group. The owner cannot leave without transferring ownership first."""
+    await _get_group_or_404(db, group_id)
+    membership = await _get_membership(db, group_id, current_user.id)
+    if membership is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="You are not a member of this group",
+        )
+
+    if membership.role == GroupRole.OWNER:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Transfer ownership before leaving this group",
+        )
+
+    await db.delete(membership)
+    await db.commit()
+    return {"status": "ok"}
+
+
+@router.post("/{group_id}/members/{user_id}/role", response_model=MembershipOut)
+async def set_member_role(
+    group_id: int,
+    user_id: int,
+    body: RoleUpdateRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Set a member's role (admin/member). Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can change member roles",
+        )
+
+    target = await _get_membership(db, group_id, user_id)
+    if target is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Member not found")
+
+    if target.role == GroupRole.OWNER:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Use POST /transfer to change ownership",
+        )
+
+    target.role = body.role
+    await db.commit()
+    await db.refresh(target)
+
+    return MembershipOut(
+        group_id=group_id, user_id=user_id, role=target.role, joined_at=target.joined_at
+    )
+
+
+@router.post("/{group_id}/transfer", response_model=GroupDetail)
+async def transfer_ownership(
+    group_id: int,
+    body: TransferRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Transfer group ownership to another existing member. Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can transfer ownership",
+        )
+
+    if body.new_owner_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You already own this group",
+        )
+
+    new_owner_membership = await _get_membership(db, group_id, body.new_owner_id)
+    if new_owner_membership is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="New owner must already be a member of this group",
+        )
+
+    current_owner_membership = await _get_membership(db, group_id, current_user.id)
+
+    new_owner_membership.role = GroupRole.OWNER
+    if current_owner_membership is not None:
+        current_owner_membership.role = GroupRole.ADMIN
+    group.owner_id = body.new_owner_id
+
+    await db.commit()
+
+    return await get_group(group_id, current_user, db)

backend/app/routers/social_friends.py

@@ -0,0 +1,362 @@
+"""Friends/follow/block router.
+
+docs/planning/social.md §4/§5 (US-1). Builds the request/accept/block
+business logic on top of the models in app/models/social.py (already
+merged): friend requests are directional (requester -> addressee) until
+accepted, at which point the relationship is treated as mutual; follow is
+one-way with no approval step; block is a hard deny that clears any
+existing friendship/follow between the two users and is queryable so a
+later layer (e.g. chat) can check it -- enforcing the block anywhere but
+here is out of scope for this router.
+
+Endpoints:
+- POST   /api/friends/requests                -- send a friend request
+- GET    /api/friends/requests                -- list incoming (pending) requests
+- POST   /api/friends/requests/{id}/accept    -- accept an incoming request
+- POST   /api/friends/requests/{id}/decline   -- decline an incoming request
+- DELETE /api/friends/{user_id}                -- unfriend
+- POST   /api/friends/{user_id}/follow         -- follow a user
+- DELETE /api/friends/{user_id}/follow         -- unfollow a user
+- POST   /api/friends/{user_id}/block          -- block a user
+- DELETE /api/friends/{user_id}/block          -- unblock a user
+- GET    /api/friends                          -- list friends
+- GET    /api/friends/following                -- list users followed
+- GET    /api/friends/blocked                  -- list blocked users
+"""
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, HTTPException, status, Depends
+from pydantic import BaseModel
+from sqlalchemy import select, delete, or_, and_
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.user import User
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+
+class FriendRequestCreate(BaseModel):
+    user_id: int
+
+
+class FriendRequestResponse(BaseModel):
+    id: int
+    requester_id: int
+    addressee_id: int
+    status: FriendshipStatus
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class UserSummary(BaseModel):
+    id: int
+    username: str
+
+    model_config = {"from_attributes": True}
+
+
+class FriendRequestListResponse(BaseModel):
+    requests: list[FriendRequestResponse]
+
+
+class FriendListResponse(BaseModel):
+    friends: list[UserSummary]
+
+
+class FollowListResponse(BaseModel):
+    following: list[UserSummary]
+
+
+class BlockedListResponse(BaseModel):
+    blocked: list[UserSummary]
+
+
+class ActionResponse(BaseModel):
+    status: str
+
+
+# ──────────────────────────────── Helpers ──────────────────────────────────────
+
+
+def _friendship_pair(a: int, b: int):
+    """SQLAlchemy predicate matching a Friendship row between a and b,
+    regardless of which one is the requester/addressee."""
+    return or_(
+        and_(Friendship.requester_id == a, Friendship.addressee_id == b),
+        and_(Friendship.requester_id == b, Friendship.addressee_id == a),
+    )
+
+
+def _follow_pair(a: int, b: int):
+    """Predicate matching a Follow row in either direction between a and b."""
+    return or_(
+        and_(Follow.follower_id == a, Follow.followed_id == b),
+        and_(Follow.follower_id == b, Follow.followed_id == a),
+    )
+
+
+async def _is_blocked_either_direction(db: AsyncSession, a: int, b: int) -> bool:
+    result = await db.execute(
+        select(Block.id).where(
+            or_(
+                and_(Block.blocker_id == a, Block.blocked_id == b),
+                and_(Block.blocker_id == b, Block.blocked_id == a),
+            )
+        )
+    )
+    return result.scalar_one_or_none() is not None
+
+
+async def _get_user_or_404(db: AsyncSession, user_id: int) -> User:
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    return user
+
+
+# ──────────────────────────────── Requests ─────────────────────────────────────
+
+
+@router.post("/requests", response_model=FriendRequestResponse, status_code=status.HTTP_201_CREATED)
+async def send_friend_request(body: FriendRequestCreate, current_user: CurrentUser, db: DbDep):
+    """Send a friend request to another user."""
+    target_id = body.user_id
+    if target_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot send a friend request to yourself")
+
+    await _get_user_or_404(db, target_id)
+
+    if await _is_blocked_either_direction(db, current_user.id, target_id):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Cannot send a friend request to this user")
+
+    existing = await db.execute(select(Friendship).where(_friendship_pair(current_user.id, target_id)))
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Friend request or friendship already exists")
+
+    fr = Friendship(requester_id=current_user.id, addressee_id=target_id)
+    db.add(fr)
+    try:
+        await db.commit()
+    except IntegrityError:
+        await db.rollback()
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Friend request or friendship already exists")
+    await db.refresh(fr)
+    return fr
+
+
+@router.get("/requests", response_model=FriendRequestListResponse)
+async def list_incoming_requests(current_user: CurrentUser, db: DbDep):
+    """List pending friend requests sent *to* the authenticated user."""
+    result = await db.execute(
+        select(Friendship).where(
+            Friendship.addressee_id == current_user.id,
+            Friendship.status == FriendshipStatus.PENDING,
+        )
+    )
+    return FriendRequestListResponse(requests=list(result.scalars().all()))
+
+
+@router.post("/requests/{request_id}/accept", response_model=FriendRequestResponse)
+async def accept_friend_request(request_id: int, current_user: CurrentUser, db: DbDep):
+    """Accept an incoming friend request, making the friendship mutual."""
+    result = await db.execute(select(Friendship).where(Friendship.id == request_id))
+    fr = result.scalar_one_or_none()
+    # 404 (not a 403) both when the row doesn't exist and when it isn't
+    # addressed to the caller, so ids can't be enumerated to probe other
+    # accounts' pending requests.
+    if fr is None or fr.addressee_id != current_user.id or fr.status != FriendshipStatus.PENDING:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Friend request not found")
+
+    fr.status = FriendshipStatus.ACCEPTED
+    await db.commit()
+    await db.refresh(fr)
+    return fr
+
+
+@router.post("/requests/{request_id}/decline", response_model=ActionResponse)
+async def decline_friend_request(request_id: int, current_user: CurrentUser, db: DbDep):
+    """Decline (and remove) an incoming friend request."""
+    result = await db.execute(select(Friendship).where(Friendship.id == request_id))
+    fr = result.scalar_one_or_none()
+    if fr is None or fr.addressee_id != current_user.id or fr.status != FriendshipStatus.PENDING:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Friend request not found")
+
+    await db.delete(fr)
+    await db.commit()
+    return ActionResponse(status="declined")
+
+
+# ──────────────────────────────── Friends ──────────────────────────────────────
+
+
+@router.get("", response_model=FriendListResponse)
+async def list_friends(current_user: CurrentUser, db: DbDep):
+    """List the authenticated user's accepted friends."""
+    result = await db.execute(
+        select(Friendship).where(
+            or_(Friendship.requester_id == current_user.id, Friendship.addressee_id == current_user.id),
+            Friendship.status == FriendshipStatus.ACCEPTED,
+        )
+    )
+    friendships = result.scalars().all()
+    other_ids = [
+        fr.addressee_id if fr.requester_id == current_user.id else fr.requester_id
+        for fr in friendships
+    ]
+    if not other_ids:
+        return FriendListResponse(friends=[])
+
+    users_result = await db.execute(select(User).where(User.id.in_(other_ids)))
+    return FriendListResponse(friends=list(users_result.scalars().all()))
+
+
+@router.delete("/{user_id}", response_model=ActionResponse)
+async def unfriend(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Remove an existing (accepted) friendship."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot unfriend yourself")
+
+    result = await db.execute(
+        select(Friendship).where(
+            _friendship_pair(current_user.id, user_id),
+            Friendship.status == FriendshipStatus.ACCEPTED,
+        )
+    )
+    fr = result.scalar_one_or_none()
+    if fr is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not friends with this user")
+
+    await db.delete(fr)
+    await db.commit()
+    return ActionResponse(status="unfriended")
+
+
+# ──────────────────────────────── Follow ───────────────────────────────────────
+
+
+@router.post("/{user_id}/follow", response_model=ActionResponse, status_code=status.HTTP_201_CREATED)
+async def follow_user(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Follow another user (one-way, no approval)."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot follow yourself")
+
+    await _get_user_or_404(db, user_id)
+
+    if await _is_blocked_either_direction(db, current_user.id, user_id):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Cannot follow this user")
+
+    existing = await db.execute(
+        select(Follow).where(Follow.follower_id == current_user.id, Follow.followed_id == user_id)
+    )
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Already following this user")
+
+    db.add(Follow(follower_id=current_user.id, followed_id=user_id))
+    try:
+        await db.commit()
+    except IntegrityError:
+        await db.rollback()
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Already following this user")
+    return ActionResponse(status="followed")
+
+
+@router.delete("/{user_id}/follow", response_model=ActionResponse)
+async def unfollow_user(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Unfollow a user."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot unfollow yourself")
+
+    result = await db.execute(
+        select(Follow).where(Follow.follower_id == current_user.id, Follow.followed_id == user_id)
+    )
+    follow = result.scalar_one_or_none()
+    if follow is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not following this user")
+
+    await db.delete(follow)
+    await db.commit()
+    return ActionResponse(status="unfollowed")
+
+
+@router.get("/following", response_model=FollowListResponse)
+async def list_following(current_user: CurrentUser, db: DbDep):
+    """List users the authenticated user follows."""
+    result = await db.execute(select(Follow).where(Follow.follower_id == current_user.id))
+    followed_ids = [f.followed_id for f in result.scalars().all()]
+    if not followed_ids:
+        return FollowListResponse(following=[])
+
+    users_result = await db.execute(select(User).where(User.id.in_(followed_ids)))
+    return FollowListResponse(following=list(users_result.scalars().all()))
+
+
+# ──────────────────────────────── Block ────────────────────────────────────────
+
+
+@router.post("/{user_id}/block", response_model=ActionResponse, status_code=status.HTTP_201_CREATED)
+async def block_user(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Block a user: hard deny that also clears any existing friendship/follow
+    between the two users in either direction."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot block yourself")
+
+    await _get_user_or_404(db, user_id)
+
+    existing = await db.execute(
+        select(Block).where(Block.blocker_id == current_user.id, Block.blocked_id == user_id)
+    )
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="User already blocked")
+
+    db.add(Block(blocker_id=current_user.id, blocked_id=user_id))
+    await db.execute(delete(Friendship).where(_friendship_pair(current_user.id, user_id)))
+    await db.execute(delete(Follow).where(_follow_pair(current_user.id, user_id)))
+
+    try:
+        await db.commit()
+    except IntegrityError:
+        await db.rollback()
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="User already blocked")
+    return ActionResponse(status="blocked")
+
+
+@router.delete("/{user_id}/block", response_model=ActionResponse)
+async def unblock_user(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Remove a block."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot unblock yourself")
+
+    result = await db.execute(
+        select(Block).where(Block.blocker_id == current_user.id, Block.blocked_id == user_id)
+    )
+    block = result.scalar_one_or_none()
+    if block is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User is not blocked")
+
+    await db.delete(block)
+    await db.commit()
+    return ActionResponse(status="unblocked")
+
+
+@router.get("/blocked", response_model=BlockedListResponse)
+async def list_blocked(current_user: CurrentUser, db: DbDep):
+    """List users the authenticated user has blocked."""
+    result = await db.execute(select(Block).where(Block.blocker_id == current_user.id))
+    blocked_ids = [b.blocked_id for b in result.scalars().all()]
+    if not blocked_ids:
+        return BlockedListResponse(blocked=[])
+
+    users_result = await db.execute(select(User).where(User.id.in_(blocked_ids)))
+    return BlockedListResponse(blocked=list(users_result.scalars().all()))

backend/app/services/text_filter.py

@@ -0,0 +1,304 @@
+"""Pluggable server-side text filtering, `docs/planning/social.md` §4/§5 (US-4).
+
+social.md §4 calls for a "Pluggable `TextFilter` interface with a
+deterministic default (profanity list + normalization) so it runs without
+external services; third-party hook later". This module is that interface
+plus the default implementation:
+
+- `TextFilter` is a `Protocol` -- the extension point. A future third-party
+  moderation provider (a paid API, an ML classifier, etc.) just needs to
+  implement `check(text) -> FilterResult`; nothing else in this module
+  needs to change, and callers depend on the protocol, not a concrete
+  class.
+- `ListBasedTextFilter` is the deterministic default: a configurable
+  term list (JSON file, see `text_filter_terms.json` next to this module)
+  matched against a normalized form of the input text so that trivial
+  evasion (case changes, leetspeak substitutions, and punctuation/spacing
+  inserted between letters) doesn't slip through.
+
+Nothing here talks to a database, an HTTP client, or the FastAPI app -- it
+is a pure, side-effect-free (aside from reading the term list file once, at
+construction) service so it can be unit tested in isolation. It is NOT
+wired into any router/endpoint by this task; that's for the chat feature
+tasks that depend on it (social.md §6) to do.
+
+Normalization approach
+-----------------------
+Matching naively against raw text misses "sh1t", "@ss", or "s.h.i.t". To
+catch these without a real tokenizer, every character of the input is
+independently normalized to at most one lowercase ASCII alphanumeric
+character (case-folded, then run through a small leetspeak substitution
+table); characters that don't reduce to `[a-z0-9]` (punctuation, spacing,
+symbols, non-ASCII) are dropped entirely rather than kept as separators.
+This collapses "s.h.i.t", "s h i t", and "SHIT" to the same normalized
+string ("shit") that a plain lowercase term list entry matches, while a
+side table (`index_map`) remembers which original character produced each
+surviving normalized character -- so a match found in the normalized
+string can still be translated back into a span of the *original* text for
+redaction.
+
+This is a deliberate precision/recall tradeoff common to list-based
+filters: stripping separators and folding leetspeak increases recall
+against evasion at the cost of occasionally matching a term inside an
+unrelated longer word (e.g. a 3-letter term inside a longer benign word).
+That tradeoff is exactly why this is pluggable -- a deployment that needs
+tighter precision can swap in a smarter `TextFilter` implementation behind
+the same protocol.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from enum import Enum
+from pathlib import Path
+from typing import Iterable, Protocol, runtime_checkable
+
+# ---------------------------------------------------------------------------
+# Public result / protocol
+# ---------------------------------------------------------------------------
+
+
+class FilterAction(str, Enum):
+    """What the caller should do with a checked message."""
+
+    ALLOW = "allow"
+    REDACT = "redact"
+    REJECT = "reject"
+
+
+@dataclass(frozen=True)
+class FilterResult:
+    """Outcome of running a piece of text through a `TextFilter`.
+
+    - `action`: ALLOW (no matches), REDACT (matches replaced in
+      `filtered_text`), or REJECT (matches found; the message should be
+      blocked -- callers should not persist/deliver it even though
+      `filtered_text` is populated for logging/audit purposes).
+    - `filtered_text`: the text to actually store/deliver. Equal to the
+      input for ALLOW and REJECT; has matched spans replaced for REDACT.
+    - `matched_terms`: the distinct matched terms (original, un-normalized
+      list entries), in first-occurrence order. Empty for ALLOW.
+    """
+
+    action: FilterAction
+    filtered_text: str
+    matched_terms: tuple[str, ...] = ()
+
+
+@runtime_checkable
+class TextFilter(Protocol):
+    """Extension point for text filtering/moderation providers.
+
+    Any implementation -- the deterministic default below, or a future
+    third-party service call -- just needs this one method.
+    """
+
+    def check(self, text: str) -> FilterResult:
+        """Check `text` and return the action to take plus filtered text."""
+        ...
+
+
+class FilterMode(str, Enum):
+    """Configures what `ListBasedTextFilter` does when it finds a match."""
+
+    REDACT = "redact"
+    REJECT = "reject"
+
+
+# ---------------------------------------------------------------------------
+# Normalization
+# ---------------------------------------------------------------------------
+
+# Common leetspeak / lookalike substitutions, applied after case-folding.
+# Keys are already-lowercased single characters.
+_LEET_MAP: dict[str, str] = {
+    "0": "o",
+    "1": "i",
+    "!": "i",
+    "3": "e",
+    "4": "a",
+    "@": "a",
+    "5": "s",
+    "$": "s",
+    "7": "t",
+    "+": "t",
+    "8": "b",
+    "|": "l",
+}
+
+_ALNUM_RE = re.compile(r"[a-z0-9]")
+
+
+def _normalize(text: str) -> tuple[str, list[int]]:
+    """Fold `text` to a lowercase-alnum-only string plus an index map.
+
+    Returns `(normalized, index_map)` where `index_map[i]` is the index
+    into the *original* `text` that produced `normalized[i]`. Characters
+    that don't reduce to a single `[a-z0-9]` character (punctuation,
+    whitespace, symbols, most non-ASCII) are dropped from both outputs.
+    """
+    normalized_chars: list[str] = []
+    index_map: list[int] = []
+    for i, ch in enumerate(text):
+        folded = ch.casefold()
+        # case-fold can expand to multiple characters for some unicode
+        # (e.g. German "ß" -> "ss"); such characters are not part of the
+        # leetspeak table and are not plain ascii alnum, so just skip them
+        # like any other non-matching character rather than guessing.
+        if len(folded) != 1:
+            continue
+        folded = _LEET_MAP.get(folded, folded)
+        if _ALNUM_RE.fullmatch(folded):
+            normalized_chars.append(folded)
+            index_map.append(i)
+    return "".join(normalized_chars), index_map
+
+
+def _normalize_term(term: str) -> str:
+    normalized, _ = _normalize(term)
+    return normalized
+
+
+# ---------------------------------------------------------------------------
+# Default term list loading
+# ---------------------------------------------------------------------------
+
+DEFAULT_TERMS_PATH = Path(__file__).with_name("text_filter_terms.json")
+
+
+def load_terms(path: Path | str | None = None) -> list[str]:
+    """Load a term list from a JSON file shaped `{"terms": [...]}`.
+
+    Any other top-level keys (e.g. `_readme`) are ignored. Defaults to the
+    bundled `text_filter_terms.json` next to this module.
+    """
+    resolved = Path(path) if path is not None else DEFAULT_TERMS_PATH
+    with resolved.open("r", encoding="utf-8") as f:
+        data = json.load(f)
+    terms = data.get("terms", [])
+    if not isinstance(terms, list):
+        raise ValueError(f"{resolved}: 'terms' must be a list")
+    return [str(t) for t in terms]
+
+
+# ---------------------------------------------------------------------------
+# Span merging / redaction helpers
+# ---------------------------------------------------------------------------
+
+
+def _merge_spans(spans: list[tuple[int, int, str]]) -> list[tuple[int, int]]:
+    """Merge overlapping/adjacent (start, end) spans, sorted by start."""
+    if not spans:
+        return []
+    ordered = sorted((s, e) for s, e, _ in spans)
+    merged: list[tuple[int, int]] = [ordered[0]]
+    for start, end in ordered[1:]:
+        last_start, last_end = merged[-1]
+        if start <= last_end:
+            merged[-1] = (last_start, max(last_end, end))
+        else:
+            merged.append((start, end))
+    return merged
+
+
+def _apply_redactions(text: str, merged_spans: list[tuple[int, int]], redaction_char: str) -> str:
+    if not merged_spans:
+        return text
+    pieces: list[str] = []
+    cursor = 0
+    for start, end in merged_spans:
+        pieces.append(text[cursor:start])
+        pieces.append(redaction_char * (end - start))
+        cursor = end
+    pieces.append(text[cursor:])
+    return "".join(pieces)
+
+
+# ---------------------------------------------------------------------------
+# Default implementation
+# ---------------------------------------------------------------------------
+
+
+class ListBasedTextFilter:
+    """Deterministic `TextFilter`: normalized substring match against a term list.
+
+    `mode` controls what happens on a match:
+    - `FilterMode.REDACT` (default): matched spans in the *original* text
+      are replaced with `redaction_char` repeated to the matched span's
+      original length; `action` is REDACT if anything matched, else ALLOW.
+    - `FilterMode.REJECT`: `filtered_text` is returned unchanged but
+      `action` is REJECT if anything matched (callers should treat this as
+      "do not store/deliver"), else ALLOW.
+
+    An empty or whitespace-only string always returns ALLOW with no
+    matches -- there is nothing to filter.
+    """
+
+    def __init__(
+        self,
+        terms: Iterable[str] | None = None,
+        *,
+        mode: FilterMode = FilterMode.REDACT,
+        terms_path: Path | str | None = None,
+        redaction_char: str = "*",
+    ) -> None:
+        if terms is None:
+            terms = load_terms(terms_path)
+        # De-dupe while preserving order; drop blanks.
+        seen: dict[str, None] = {}
+        for t in terms:
+            t = t.strip()
+            if t:
+                seen.setdefault(t, None)
+        self._terms: tuple[str, ...] = tuple(seen)
+        # Pre-normalize once at construction; skip terms that normalize to
+        # nothing (e.g. a term that's pure punctuation).
+        self._normalized_terms: list[tuple[str, str]] = [
+            (normalized, original)
+            for original in self._terms
+            if (normalized := _normalize_term(original))
+        ]
+        self.mode = mode
+        self.redaction_char = redaction_char
+
+    def check(self, text: str) -> FilterResult:
+        if not text or not text.strip():
+            return FilterResult(action=FilterAction.ALLOW, filtered_text=text, matched_terms=())
+
+        normalized, index_map = _normalize(text)
+        if not normalized:
+            return FilterResult(action=FilterAction.ALLOW, filtered_text=text, matched_terms=())
+
+        spans: list[tuple[int, int, str]] = []
+        for normalized_term, original_term in self._normalized_terms:
+            start = 0
+            term_len = len(normalized_term)
+            while True:
+                idx = normalized.find(normalized_term, start)
+                if idx == -1:
+                    break
+                end = idx + term_len
+                orig_start = index_map[idx]
+                orig_end = index_map[end - 1] + 1
+                spans.append((orig_start, orig_end, original_term))
+                start = end  # non-overlapping: resume after this match
+
+        if not spans:
+            return FilterResult(action=FilterAction.ALLOW, filtered_text=text, matched_terms=())
+
+        spans.sort(key=lambda s: s[0])
+        matched_terms = tuple(dict.fromkeys(term for _, _, term in spans))
+
+        if self.mode is FilterMode.REJECT:
+            return FilterResult(action=FilterAction.REJECT, filtered_text=text, matched_terms=matched_terms)
+
+        merged = _merge_spans(spans)
+        filtered_text = _apply_redactions(text, merged, self.redaction_char)
+        return FilterResult(action=FilterAction.REDACT, filtered_text=filtered_text, matched_terms=matched_terms)
+
+
+def default_text_filter(mode: FilterMode = FilterMode.REDACT) -> ListBasedTextFilter:
+    """Convenience factory for the bundled default term list."""
+    return ListBasedTextFilter(mode=mode)

backend/app/services/text_filter_terms.json

@@ -0,0 +1,20 @@
+{
+  "_readme": "Default deterministic term list for app.services.text_filter.ListBasedTextFilter. This is a minimal, illustrative starter list (common mild-to-strong English profanity, no slurs) meant to be replaced/extended per-deployment -- swap this file, or pass an explicit `terms`/`terms_path` to the filter, rather than editing this list in place for production moderation policy.",
+  "terms": [
+    "fuck",
+    "shit",
+    "ass",
+    "asshole",
+    "bitch",
+    "bastard",
+    "damn",
+    "crap",
+    "dick",
+    "piss",
+    "slut",
+    "whore",
+    "cunt",
+    "douche",
+    "bullshit"
+  ]
+}

backend/tests/conftest.py

@@ -16,6 +16,7 @@ out dozens of times.
 """
 
 import asyncio
+import hashlib
 import os
 import socket
 import subprocess
@@ -41,13 +42,40 @@ TEST_TABLES = (
     # `worlds` the way world_rooms/world_chunks would be. List all three
     # explicitly rather than rely on cascade for some of them.
     "world_chunk_revisions", "world_chunks", "world_rooms",
-    "worlds", "sessions", "refresh_tokens", "users",
+    "worlds",
+    # Social graph (app/models/social.py) -- all three FK users with
+    # ON DELETE CASCADE, but list explicitly for clarity/consistency.
+    "friendships", "follows", "blocks",
+    # Chat (app/models/chat.py). message_reports.message_id is ON DELETE SET
+    # NULL (not CASCADE, deliberately -- see chat.py), so it wouldn't be
+    # reached by cascading a truncate of messages/conversations; list it
+    # explicitly along with the rest for clarity/consistency.
+    "message_reports", "messages", "conversation_participants", "conversations",
+    # Groups (app/models/groups.py). groups.owner_id is ON DELETE SET NULL
+    # (not CASCADE, deliberately -- see groups.py), so it wouldn't be reached
+    # by cascading a truncate of users; list it explicitly for clarity too.
+    "group_members", "groups",
+    "sessions", "refresh_tokens", "users",
 )
 
 BACKEND_DIR = Path(__file__).resolve().parents[1]
-_COMPOSE_PROJECT = "agp-pytest"
-_EPHEMERAL_PG_PORT = 25432
-_EPHEMERAL_REDIS_PORT = 26379
+
+# A hardcoded project name/port here would mean every concurrent checkout
+# running `pytest` (e.g. several Claude Agent-tool subagents, each in their
+# own ~/agp/workspace/task_<id> clone) fights over the exact same Docker
+# Compose project and host ports -- one run's pytest_unconfigure teardown
+# can yank the ephemeral Postgres out from under a completely unrelated
+# concurrent run, surfacing as "connection was closed in the middle of
+# operation" with no obvious cause. Confirmed live 2026-09-15 running 3
+# parallel subagents. Same root cause and fix pattern as the agent_core
+# workspace/Docker-Compose collision documented in project_agp memory --
+# derive both the project name and the port from a hash of the checkout
+# directory, so different concurrent checkouts land on different projects/
+# ports while the same checkout is stable across repeated runs.
+_WORKSPACE_HASH = hashlib.sha256(str(BACKEND_DIR.parent).encode()).hexdigest()[:10]
+_COMPOSE_PROJECT = f"agp-pytest-{_WORKSPACE_HASH}"
+_EPHEMERAL_PG_PORT = 25400 + (int(_WORKSPACE_HASH, 16) % 100)
+_EPHEMERAL_REDIS_PORT = 26300 + (int(_WORKSPACE_HASH, 16) % 100)
 
 # Set by pytest_configure() when it starts container(s) it owns; torn down in
 # pytest_unconfigure.

backend/tests/test_chat_models.py

@@ -0,0 +1,344 @@
+"""Model-level tests for chat: conversations, messages, message reports.
+
+app/models/chat.py / alembic/versions/0008_add_chat_tables.py
+(docs/planning/social.md US-4). This is the models+migration task only --
+there are no API endpoints yet (sibling tasks own filtering, rate limiting,
+and the routers), so these tests exercise the ORM models and the real
+Postgres constraints directly rather than going through HTTP.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import delete, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.chat import (
+    Conversation,
+    ConversationParticipant,
+    Message,
+    MessageReport,
+    ReportStatus,
+)
+from app.models.user import User
+from app.models.world import World
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+class TestConversationCreation:
+    async def test_create_conversation_with_participants_and_messages(self):
+        client = TestClient(app)
+        a = _register(client, "chat_conv_a")
+        b = _register(client, "chat_conv_b")
+
+        engine, factory = _session_factory()
+        try:
+            lo, hi = sorted((a, b))
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(
+                    Message(sender_id=a, conversation_id=convo.id, body="hi there")
+                )
+                await session.commit()
+                convo_id = convo.id
+
+            async with factory() as session:
+                participants = (
+                    await session.execute(
+                        select(ConversationParticipant).where(
+                            ConversationParticipant.conversation_id == convo_id
+                        )
+                    )
+                ).scalars().all()
+                messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                assert len(participants) == 2
+                assert len(messages) == 1
+                assert messages[0].sender_id == a
+                assert messages[0].filtered is False
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "chat_uq_a")
+        b = _register(client, "chat_uq_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Conversation(user_a_id=lo, user_b_id=hi))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Conversation(user_a_id=lo, user_b_id=hi))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_unordered_pair_rejected_by_check_constraint(self):
+        client = TestClient(app)
+        a = _register(client, "chat_ck_a")
+        b = _register(client, "chat_ck_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                # Reversed order violates ck_conversations_ordered_pair.
+                session.add(Conversation(user_a_id=hi, user_b_id=lo))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+
+class TestWorldRoomChat:
+    async def test_world_message_has_null_conversation(self):
+        client = TestClient(app)
+        owner = _register(client, "chat_world_owner")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Chat Test World", owner_id=owner)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=owner, world_id=world.id, body="hello world")
+                session.add(msg)
+                await session.commit()
+                world_id = world.id
+
+            async with factory() as session:
+                rows = (
+                    await session.execute(
+                        select(Message).where(Message.world_id == world_id)
+                    )
+                ).scalars().all()
+                assert len(rows) == 1
+                assert rows[0].conversation_id is None
+                assert rows[0].room_id is None
+        finally:
+            await engine.dispose()
+
+
+class TestMessageReports:
+    async def test_create_report_defaults_to_open(self):
+        client = TestClient(app)
+        sender = _register(client, "chat_rpt_sender")
+        reporter = _register(client, "chat_rpt_reporter")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Report World", owner_id=sender)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=sender, world_id=world.id, body="bad words")
+                session.add(msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=msg.id, reporter_id=reporter, reason="spam"
+                )
+                session.add(report)
+                await session.commit()
+                report_id = report.id
+
+            async with factory() as session:
+                report = await session.get(MessageReport, report_id)
+                assert report.status == ReportStatus.OPEN
+                assert report.moderator_id is None
+                assert report.resolved_at is None
+        finally:
+            await engine.dispose()
+
+
+class TestCascadeDelete:
+    async def test_deleting_conversation_deletes_participants_and_messages(self):
+        client = TestClient(app)
+        a = _register(client, "chat_cd_conv_a")
+        b = _register(client, "chat_cd_conv_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(Message(sender_id=a, conversation_id=convo.id, body="bye"))
+                await session.commit()
+                convo_id = convo.id
+
+            async with factory() as session:
+                # Core delete against the conversations table directly, so
+                # the real ON DELETE CASCADE does the work (not the ORM).
+                await session.execute(
+                    delete(Conversation).where(Conversation.id == convo_id)
+                )
+                await session.commit()
+
+            async with factory() as session:
+                participants = (
+                    await session.execute(
+                        select(ConversationParticipant).where(
+                            ConversationParticipant.conversation_id == convo_id
+                        )
+                    )
+                ).scalars().all()
+                messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                assert participants == []
+                assert messages == []
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_user_removes_conversation_but_keeps_report_and_message_id_null(self):
+        """Deleting a conversation participant cascades away the whole DM
+        (conversation + participants + messages -- there's no third party
+        left to care about the history). Deleting the sender of a
+        world-chat message, by contrast, must NOT delete the message or its
+        report -- sender_id is SET NULL and message_reports.message_id
+        follows the message (also SET NULL, never CASCADE) so the audit
+        trail survives account deletion."""
+        client = TestClient(app)
+        a = _register(client, "chat_cd_user_a")
+        b = _register(client, "chat_cd_user_b")
+        reporter = _register(client, "chat_cd_user_reporter")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(Message(sender_id=a, conversation_id=convo.id, body="dm"))
+
+                world = World(name="Sender Delete World", owner_id=b)
+                session.add(world)
+                await session.flush()
+                world_msg = Message(sender_id=a, world_id=world.id, body="world chat")
+                session.add(world_msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=world_msg.id, reporter_id=reporter, reason="rude"
+                )
+                session.add(report)
+                await session.commit()
+                convo_id = convo.id
+                world_msg_id = world_msg.id
+                report_id = report.id
+
+            async with factory() as session:
+                # Delete `a`: participant in the DM (cascades the whole
+                # conversation) and sender of the world message (SET NULL).
+                await session.execute(delete(User).where(User.id == a))
+                await session.commit()
+
+            async with factory() as session:
+                convo_row = await session.get(Conversation, convo_id)
+                dm_messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                world_msg = await session.get(Message, world_msg_id)
+                report = await session.get(MessageReport, report_id)
+
+                assert convo_row is None
+                assert dm_messages == []
+                # World message survives with sender_id nulled out.
+                assert world_msg is not None
+                assert world_msg.sender_id is None
+                assert world_msg.body == "world chat"
+                # Report still points at the surviving message.
+                assert report is not None
+                assert report.message_id == world_msg_id
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_message_nulls_report_message_id(self):
+        client = TestClient(app)
+        sender = _register(client, "chat_cd_msg_sender")
+        reporter = _register(client, "chat_cd_msg_reporter")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Msg Delete World", owner_id=sender)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=sender, world_id=world.id, body="to be removed")
+                session.add(msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=msg.id, reporter_id=reporter, reason="spam"
+                )
+                session.add(report)
+                await session.commit()
+                msg_id = msg.id
+                report_id = report.id
+
+            async with factory() as session:
+                await session.execute(delete(Message).where(Message.id == msg_id))
+                await session.commit()
+
+            async with factory() as session:
+                report = await session.get(MessageReport, report_id)
+                assert report is not None
+                assert report.message_id is None
+        finally:
+            await engine.dispose()

backend/tests/test_group_models.py

@@ -0,0 +1,258 @@
+"""Model-level tests for groups: groups and group_members.
+
+app/models/groups.py / alembic/versions/0009_add_group_tables.py
+(docs/planning/social.md US-5). This is the models+migration task only --
+there are no API endpoints yet (a sibling task, "Groups API", owns
+create/join/leave/role authorization and the group page endpoint), so these
+tests exercise the ORM models and the real Postgres constraints directly
+rather than going through HTTP.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import delete, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.groups import Group, GroupMember, GroupRole
+from app.models.user import User
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+class TestGroupCreationAndRoles:
+    async def test_create_group_with_members_of_different_roles(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_role_owner")
+        admin = _register(client, "grp_role_admin")
+        member = _register(client, "grp_role_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Explorers", description="We explore worlds", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add_all(
+                    [
+                        GroupMember(group_id=group.id, user_id=owner, role=GroupRole.OWNER),
+                        GroupMember(group_id=group.id, user_id=admin, role=GroupRole.ADMIN),
+                        GroupMember(group_id=group.id, user_id=member, role=GroupRole.MEMBER),
+                    ]
+                )
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                fetched = await session.get(Group, group_id)
+                members = (
+                    await session.execute(
+                        select(GroupMember).where(GroupMember.group_id == group_id)
+                    )
+                ).scalars().all()
+                by_user = {m.user_id: m.role for m in members}
+                assert fetched.owner_id == owner
+                assert len(members) == 3
+                assert by_user[owner] == GroupRole.OWNER
+                assert by_user[admin] == GroupRole.ADMIN
+                assert by_user[member] == GroupRole.MEMBER
+        finally:
+            await engine.dispose()
+
+    async def test_membership_role_defaults_to_member(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_default_owner")
+        joiner = _register(client, "grp_default_joiner")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Defaults", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add(GroupMember(group_id=group.id, user_id=joiner))
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                gm = (
+                    await session.execute(
+                        select(GroupMember).where(
+                            GroupMember.group_id == group_id, GroupMember.user_id == joiner
+                        )
+                    )
+                ).scalar_one()
+                assert gm.role == GroupRole.MEMBER
+        finally:
+            await engine.dispose()
+
+
+class TestUniqueMembershipConstraint:
+    async def test_duplicate_membership_rejected(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_uq_owner")
+        member = _register(client, "grp_uq_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Uniqueness", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add(GroupMember(group_id=group.id, user_id=member))
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                session.add(GroupMember(group_id=group_id, user_id=member))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+
+class TestCascadeDelete:
+    async def test_deleting_group_deletes_members(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_cd_group_owner")
+        member = _register(client, "grp_cd_group_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="To Delete", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add_all(
+                    [
+                        GroupMember(group_id=group.id, user_id=owner, role=GroupRole.OWNER),
+                        GroupMember(group_id=group.id, user_id=member),
+                    ]
+                )
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                # Core delete against groups directly, so the real ON DELETE
+                # CASCADE does the work (not the ORM).
+                await session.execute(delete(Group).where(Group.id == group_id))
+                await session.commit()
+
+            async with factory() as session:
+                members = (
+                    await session.execute(
+                        select(GroupMember).where(GroupMember.group_id == group_id)
+                    )
+                ).scalars().all()
+                assert members == []
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_member_user_removes_only_their_membership(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_cd_user_owner")
+        member = _register(client, "grp_cd_user_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Membership Cascade", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add_all(
+                    [
+                        GroupMember(group_id=group.id, user_id=owner, role=GroupRole.OWNER),
+                        GroupMember(group_id=group.id, user_id=member),
+                    ]
+                )
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                await session.execute(delete(User).where(User.id == member))
+                await session.commit()
+
+            async with factory() as session:
+                remaining = (
+                    await session.execute(
+                        select(GroupMember).where(GroupMember.group_id == group_id)
+                    )
+                ).scalars().all()
+                # Only the deleted member's row is gone; the group and the
+                # owner's membership survive.
+                assert len(remaining) == 1
+                assert remaining[0].user_id == owner
+
+                group = await session.get(Group, group_id)
+                assert group is not None
+                assert group.owner_id == owner
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_owner_survives_with_owner_id_null(self):
+        """Deleting the owner's account must not delete the group or its
+        other members -- only ``owner_id`` is nulled out (SET NULL), per the
+        module docstring in app/models/groups.py."""
+        client = TestClient(app)
+        owner = _register(client, "grp_cd_owner_owner")
+        member = _register(client, "grp_cd_owner_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Survives Owner Deletion", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add_all(
+                    [
+                        GroupMember(group_id=group.id, user_id=owner, role=GroupRole.OWNER),
+                        GroupMember(group_id=group.id, user_id=member),
+                    ]
+                )
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                await session.execute(delete(User).where(User.id == owner))
+                await session.commit()
+
+            async with factory() as session:
+                group = await session.get(Group, group_id)
+                assert group is not None
+                assert group.owner_id is None
+                assert group.name == "Survives Owner Deletion"
+
+                # The owner's own membership row is gone (user_id CASCADE),
+                # but the other member's row survives untouched.
+                members = (
+                    await session.execute(
+                        select(GroupMember).where(GroupMember.group_id == group_id)
+                    )
+                ).scalars().all()
+                assert len(members) == 1
+                assert members[0].user_id == member
+        finally:
+            await engine.dispose()

backend/tests/test_groups_api.py

@@ -0,0 +1,437 @@
+"""Integration tests for the Groups API router (app/routers/groups.py).
+
+app/models/groups.py owns the schema (see test_group_models.py); this
+covers create/join/leave, role authorization, ownership transfer, and the
+group page's member-list privacy.
+"""
+
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"], "username": username}
+
+
+def _create_group(client: TestClient, headers: dict, name: str, description: str | None = None) -> dict:
+    resp = client.post(
+        "/api/groups",
+        json={"name": name, "description": description},
+        headers=headers,
+    )
+    assert resp.status_code == 201, resp.text
+    return resp.json()
+
+
+class TestCreateGroup:
+    def test_create_makes_creator_owner(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_create_owner")
+
+        group = _create_group(client, owner["headers"], "Explorers", "We explore worlds")
+        assert group["name"] == "Explorers"
+        assert group["description"] == "We explore worlds"
+        assert group["owner_id"] == owner["id"]
+        assert group["member_count"] == 1
+        assert len(group["members"]) == 1
+        assert group["members"][0]["user_id"] == owner["id"]
+        assert group["members"][0]["role"] == "owner"
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        resp = client.post("/api/groups", json={"name": "No Auth"})
+        assert resp.status_code == 401
+
+    def test_blank_name_rejected(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_blank_name")
+        resp = client.post("/api/groups", json={"name": "   "}, headers=owner["headers"])
+        assert resp.status_code == 422
+
+    def test_name_over_max_length_rejected(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_long_name")
+        resp = client.post(
+            "/api/groups", json={"name": "x" * 101}, headers=owner["headers"]
+        )
+        assert resp.status_code == 422
+
+
+class TestGroupPage:
+    def test_get_group_page_shows_members_and_roles_no_private_fields(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_page_owner")
+        member = _register(client, "grp_api_page_member")
+
+        group = _create_group(client, owner["headers"], "Page Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.get(f"/api/groups/{group['id']}", headers=member["headers"])
+        assert resp.status_code == 200, resp.text
+        body = resp.json()
+        assert body["name"] == "Page Group"
+        assert body["member_count"] == 2
+        by_user = {m["user_id"]: m for m in body["members"]}
+        assert by_user[owner["id"]]["role"] == "owner"
+        assert by_user[member["id"]]["role"] == "member"
+        assert by_user[member["id"]]["username"] == member["username"]
+
+        # No private User fields (email, hashed_password, etc.) leak.
+        for m in body["members"]:
+            assert set(m.keys()) == {"user_id", "username", "role", "joined_at"}
+
+    def test_get_nonexistent_group_is_404(self):
+        client = TestClient(app)
+        user = _register(client, "grp_api_404")
+        resp = client.get("/api/groups/999999999", headers=user["headers"])
+        assert resp.status_code == 404
+
+
+class TestJoinLeave:
+    def test_join_is_idempotent(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_join_owner")
+        joiner = _register(client, "grp_api_join_joiner")
+        group = _create_group(client, owner["headers"], "Join Group")
+
+        r1 = client.post(f"/api/groups/{group['id']}/join", headers=joiner["headers"])
+        assert r1.status_code == 200, r1.text
+        r2 = client.post(f"/api/groups/{group['id']}/join", headers=joiner["headers"])
+        assert r2.status_code == 200, r2.text
+        assert r1.json()["role"] == r2.json()["role"] == "member"
+
+        page = client.get(f"/api/groups/{group['id']}", headers=owner["headers"]).json()
+        assert page["member_count"] == 2  # not 3 -- duplicate join didn't add a row
+
+    def test_leave_removes_membership(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_leave_owner")
+        member = _register(client, "grp_api_leave_member")
+        group = _create_group(client, owner["headers"], "Leave Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.post(f"/api/groups/{group['id']}/leave", headers=member["headers"])
+        assert resp.status_code == 200, resp.text
+
+        page = client.get(f"/api/groups/{group['id']}", headers=owner["headers"]).json()
+        assert page["member_count"] == 1
+        assert all(m["user_id"] != member["id"] for m in page["members"])
+
+    def test_owner_cannot_leave_without_transfer(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_owner_leave")
+        group = _create_group(client, owner["headers"], "Owner Leave Group")
+
+        resp = client.post(f"/api/groups/{group['id']}/leave", headers=owner["headers"])
+        assert resp.status_code == 409, resp.text
+
+    def test_leave_when_not_a_member_is_404(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_notmember_owner")
+        stranger = _register(client, "grp_api_notmember_stranger")
+        group = _create_group(client, owner["headers"], "Not A Member Group")
+
+        resp = client.post(f"/api/groups/{group['id']}/leave", headers=stranger["headers"])
+        assert resp.status_code == 404
+
+
+class TestRoleAuthorization:
+    def test_owner_can_promote_and_demote(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_role_owner")
+        member = _register(client, "grp_api_role_member")
+        group = _create_group(client, owner["headers"], "Role Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        promote = client.post(
+            f"/api/groups/{group['id']}/members/{member['id']}/role",
+            json={"role": "admin"},
+            headers=owner["headers"],
+        )
+        assert promote.status_code == 200, promote.text
+        assert promote.json()["role"] == "admin"
+
+        demote = client.post(
+            f"/api/groups/{group['id']}/members/{member['id']}/role",
+            json={"role": "member"},
+            headers=owner["headers"],
+        )
+        assert demote.status_code == 200, demote.text
+        assert demote.json()["role"] == "member"
+
+    def test_plain_member_cannot_promote(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_noauth_owner")
+        member = _register(client, "grp_api_noauth_member")
+        other = _register(client, "grp_api_noauth_other")
+        group = _create_group(client, owner["headers"], "No Auth Promote Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+        client.post(f"/api/groups/{group['id']}/join", headers=other["headers"])
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/members/{other['id']}/role",
+            json={"role": "admin"},
+            headers=member["headers"],
+        )
+        assert resp.status_code == 403
+
+    def test_admin_cannot_promote_or_demote(self):
+        """Only the owner may change roles -- admins cannot, per spec."""
+        client = TestClient(app)
+        owner = _register(client, "grp_api_adminauth_owner")
+        admin = _register(client, "grp_api_adminauth_admin")
+        other = _register(client, "grp_api_adminauth_other")
+        group = _create_group(client, owner["headers"], "Admin Cannot Promote Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=admin["headers"])
+        client.post(f"/api/groups/{group['id']}/join", headers=other["headers"])
+        client.post(
+            f"/api/groups/{group['id']}/members/{admin['id']}/role",
+            json={"role": "admin"},
+            headers=owner["headers"],
+        )
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/members/{other['id']}/role",
+            json={"role": "admin"},
+            headers=admin["headers"],
+        )
+        assert resp.status_code == 403
+
+    def test_plain_member_cannot_delete_group(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_nodelete_owner")
+        member = _register(client, "grp_api_nodelete_member")
+        group = _create_group(client, owner["headers"], "No Delete Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.delete(f"/api/groups/{group['id']}", headers=member["headers"])
+        assert resp.status_code == 403
+
+    def test_admin_cannot_delete_group(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_admindelete_owner")
+        admin = _register(client, "grp_api_admindelete_admin")
+        group = _create_group(client, owner["headers"], "Admin No Delete Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=admin["headers"])
+        client.post(
+            f"/api/groups/{group['id']}/members/{admin['id']}/role",
+            json={"role": "admin"},
+            headers=owner["headers"],
+        )
+
+        resp = client.delete(f"/api/groups/{group['id']}", headers=admin["headers"])
+        assert resp.status_code == 403
+
+    def test_plain_member_cannot_transfer_ownership(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_notransfer_owner")
+        member = _register(client, "grp_api_notransfer_member")
+        group = _create_group(client, owner["headers"], "No Transfer Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/transfer",
+            json={"new_owner_id": member["id"]},
+            headers=member["headers"],
+        )
+        assert resp.status_code == 403
+
+    def test_cannot_set_role_to_owner_via_role_endpoint(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_noownerrole_owner")
+        member = _register(client, "grp_api_noownerrole_member")
+        group = _create_group(client, owner["headers"], "No Owner Role Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/members/{member['id']}/role",
+            json={"role": "owner"},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 422
+
+
+class TestOwnershipTransfer:
+    def test_transfer_moves_ownership_and_demotes_old_owner(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_xfer_owner")
+        member = _register(client, "grp_api_xfer_member")
+        group = _create_group(client, owner["headers"], "Transfer Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/transfer",
+            json={"new_owner_id": member["id"]},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        body = resp.json()
+        assert body["owner_id"] == member["id"]
+        by_user = {m["user_id"]: m for m in body["members"]}
+        assert by_user[member["id"]]["role"] == "owner"
+        assert by_user[owner["id"]]["role"] == "admin"
+
+        # Exactly one owner remains.
+        owners = [m for m in body["members"] if m["role"] == "owner"]
+        assert len(owners) == 1
+
+        # Old owner can now leave (no longer the owner).
+        leave = client.post(f"/api/groups/{group['id']}/leave", headers=owner["headers"])
+        assert leave.status_code == 200, leave.text
+
+        # New owner cannot leave without transferring again.
+        leave2 = client.post(f"/api/groups/{group['id']}/leave", headers=member["headers"])
+        assert leave2.status_code == 409
+
+    def test_transfer_target_must_be_a_member(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_xfernonmember_owner")
+        stranger = _register(client, "grp_api_xfernonmember_stranger")
+        group = _create_group(client, owner["headers"], "Transfer Nonmember Group")
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/transfer",
+            json={"new_owner_id": stranger["id"]},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 404
+
+    def test_transfer_to_self_rejected(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_xferself_owner")
+        group = _create_group(client, owner["headers"], "Transfer Self Group")
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/transfer",
+            json={"new_owner_id": owner["id"]},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 400
+
+
+class TestUpdateGroup:
+    def test_owner_can_update_name_and_description(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_update_owner")
+        group = _create_group(client, owner["headers"], "Old Name", "Old desc")
+
+        resp = client.patch(
+            f"/api/groups/{group['id']}",
+            json={"name": "New Name", "description": "New desc"},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        assert resp.json()["name"] == "New Name"
+        assert resp.json()["description"] == "New desc"
+
+    def test_admin_can_update(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_adminupdate_owner")
+        admin = _register(client, "grp_api_adminupdate_admin")
+        group = _create_group(client, owner["headers"], "Admin Update Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=admin["headers"])
+        client.post(
+            f"/api/groups/{group['id']}/members/{admin['id']}/role",
+            json={"role": "admin"},
+            headers=owner["headers"],
+        )
+
+        resp = client.patch(
+            f"/api/groups/{group['id']}",
+            json={"name": "Updated By Admin"},
+            headers=admin["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        assert resp.json()["name"] == "Updated By Admin"
+
+    def test_plain_member_cannot_update(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_noupdate_owner")
+        member = _register(client, "grp_api_noupdate_member")
+        group = _create_group(client, owner["headers"], "No Update Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.patch(
+            f"/api/groups/{group['id']}",
+            json={"name": "Hacked Name"},
+            headers=member["headers"],
+        )
+        assert resp.status_code == 403
+
+    def test_non_member_cannot_update(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_strangernoupdate_owner")
+        stranger = _register(client, "grp_api_strangernoupdate_stranger")
+        group = _create_group(client, owner["headers"], "Stranger No Update Group")
+
+        resp = client.patch(
+            f"/api/groups/{group['id']}",
+            json={"name": "Hacked Name"},
+            headers=stranger["headers"],
+        )
+        assert resp.status_code == 403
+
+
+class TestDeleteGroup:
+    def test_owner_can_delete(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_delete_owner")
+        group = _create_group(client, owner["headers"], "Delete Group")
+
+        resp = client.delete(f"/api/groups/{group['id']}", headers=owner["headers"])
+        assert resp.status_code == 204, resp.text
+
+        after = client.get(f"/api/groups/{group['id']}", headers=owner["headers"])
+        assert after.status_code == 404
+
+
+class TestListGroups:
+    def test_list_all_groups_paginated(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_list_owner")
+        _create_group(client, owner["headers"], "List Group A")
+        _create_group(client, owner["headers"], "List Group B")
+
+        resp = client.get("/api/groups", params={"limit": 1}, headers=owner["headers"])
+        assert resp.status_code == 200, resp.text
+        body = resp.json()
+        assert len(body["groups"]) == 1
+        assert body["total"] >= 2
+
+    def test_list_mine_only_returns_own_groups(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_listmine_owner")
+        other_owner = _register(client, "grp_api_listmine_other")
+        mine = _create_group(client, owner["headers"], "Mine Group")
+        _create_group(client, other_owner["headers"], "Not Mine Group")
+
+        resp = client.get("/api/groups", params={"mine": True}, headers=owner["headers"])
+        assert resp.status_code == 200, resp.text
+        ids = [g["id"] for g in resp.json()["groups"]]
+        assert mine["id"] in ids
+        assert all(
+            g["id"] != mine["id"] or g["owner_id"] == owner["id"]
+            for g in resp.json()["groups"]
+        )
+        # The other owner's group must not appear.
+        other_group_ids = [
+            g["id"] for g in client.get(
+                "/api/groups", params={"mine": True}, headers=other_owner["headers"]
+            ).json()["groups"]
+        ]
+        assert mine["id"] not in other_group_ids

backend/tests/test_rate_limit.py

@@ -1,6 +1,7 @@
 """The auth endpoints are rate-limited per client IP."""
 
 import pytest
+from fastapi import Depends, FastAPI
 from fastapi.testclient import TestClient
 
 from app import rate_limit
@@ -54,3 +55,70 @@ def test_limiter_window_is_per_key():
     with pytest.raises(Exception):
         limiter.check("a")
     limiter.check("b")  # different key, unaffected
+
+
+def _make_named_limit_app():
+    """A tiny standalone app exercising two independent named limits, so
+    these tests don't depend on any sibling endpoint existing yet."""
+    limit_a = rate_limit.rate_limit("test_named_a", max_hits=2, window_seconds=60)
+    limit_b = rate_limit.rate_limit("test_named_b", max_hits=2, window_seconds=60)
+
+    app = FastAPI()
+
+    @app.post("/a", dependencies=[Depends(limit_a)])
+    def _a():
+        return {"ok": True}
+
+    @app.post("/b", dependencies=[Depends(limit_b)])
+    def _b():
+        return {"ok": True}
+
+    return TestClient(app)
+
+
+def test_named_limits_do_not_share_counters():
+    client = _make_named_limit_app()
+
+    # Burn out limit "a" entirely.
+    assert client.post("/a").status_code == 200
+    assert client.post("/a").status_code == 200
+    r = client.post("/a")
+    assert r.status_code == 429
+    assert "Retry-After" in r.headers
+
+    # Limit "b" is untouched -- same process, same client IP, different name.
+    assert client.post("/b").status_code == 200
+    assert client.post("/b").status_code == 200
+    assert client.post("/b").status_code == 429
+
+
+def test_named_limit_returns_429_with_retry_after_once_exhausted():
+    client = _make_named_limit_app()
+    client.post("/a")
+    client.post("/a")
+    r = client.post("/a")
+    assert r.status_code == 429
+    retry_after = r.headers["Retry-After"]
+    assert int(retry_after) >= 1
+
+
+def test_named_limit_is_a_noop_when_rate_limiting_disabled():
+    prev = settings.RATE_LIMIT_ENABLED
+    settings.RATE_LIMIT_ENABLED = False
+    try:
+        client = _make_named_limit_app()
+        codes = [client.post("/a").status_code for _ in range(10)]
+        assert codes == [200] * 10
+    finally:
+        settings.RATE_LIMIT_ENABLED = prev
+
+
+def test_reset_all_clears_named_limiters_too():
+    client = _make_named_limit_app()
+    client.post("/a")
+    client.post("/a")
+    assert client.post("/a").status_code == 429
+
+    rate_limit.reset_all()
+
+    assert client.post("/a").status_code == 200

backend/tests/test_social_friends.py

@@ -0,0 +1,317 @@
+"""Integration tests for the friends/follow/block API:
+
+- POST   /api/friends/requests
+- GET    /api/friends/requests
+- POST   /api/friends/requests/{id}/accept
+- POST   /api/friends/requests/{id}/decline
+- DELETE /api/friends/{user_id}
+- POST   /api/friends/{user_id}/follow
+- DELETE /api/friends/{user_id}/follow
+- POST   /api/friends/{user_id}/block
+- DELETE /api/friends/{user_id}/block
+- GET    /api/friends
+- GET    /api/friends/following
+- GET    /api/friends/blocked
+
+app/routers/social_friends.py, built on the merged models in
+app/models/social.py (Friendship/Follow/Block).
+"""
+
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"]}
+
+
+class TestFriendRequestFlow:
+    def test_send_list_accept_makes_mutual_friendship(self):
+        client = TestClient(app)
+        a = _register(client, "fr_flow_a")
+        b = _register(client, "fr_flow_b")
+
+        resp = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        assert resp.status_code == 201, resp.text
+        request_id = resp.json()["id"]
+        assert resp.json()["status"] == "pending"
+
+        incoming = client.get("/api/friends/requests", headers=b["headers"])
+        assert incoming.status_code == 200
+        ids = [r["id"] for r in incoming.json()["requests"]]
+        assert request_id in ids
+
+        # Requester doesn't see it in their own incoming list.
+        a_incoming = client.get("/api/friends/requests", headers=a["headers"])
+        assert a_incoming.json()["requests"] == []
+
+        accept = client.post(f"/api/friends/requests/{request_id}/accept", headers=b["headers"])
+        assert accept.status_code == 200, accept.text
+        assert accept.json()["status"] == "accepted"
+
+        # Mutual: shows up in both users' friend lists.
+        a_friends = client.get("/api/friends", headers=a["headers"]).json()["friends"]
+        b_friends = client.get("/api/friends", headers=b["headers"]).json()["friends"]
+        assert any(u["id"] == b["id"] for u in a_friends)
+        assert any(u["id"] == a["id"] for u in b_friends)
+
+    def test_decline_removes_request_and_allows_re_request(self):
+        client = TestClient(app)
+        a = _register(client, "fr_decl_a")
+        b = _register(client, "fr_decl_b")
+
+        resp = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        request_id = resp.json()["id"]
+
+        decline = client.post(f"/api/friends/requests/{request_id}/decline", headers=b["headers"])
+        assert decline.status_code == 200, decline.text
+
+        assert client.get("/api/friends/requests", headers=b["headers"]).json()["requests"] == []
+
+        # A can send a new request now that the old one is gone.
+        resp2 = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        assert resp2.status_code == 201, resp2.text
+
+    def test_accept_or_decline_of_others_request_is_404_not_403(self):
+        client = TestClient(app)
+        a = _register(client, "fr_enum_a")
+        b = _register(client, "fr_enum_b")
+        c = _register(client, "fr_enum_c")
+
+        resp = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        request_id = resp.json()["id"]
+
+        # c is neither requester nor addressee -- must not be able to act on it,
+        # and must not be able to distinguish "not yours" from "doesn't exist".
+        accept = client.post(f"/api/friends/requests/{request_id}/accept", headers=c["headers"])
+        assert accept.status_code == 404
+
+        decline = client.post(f"/api/friends/requests/{request_id}/decline", headers=c["headers"])
+        assert decline.status_code == 404
+
+        nonexistent = client.post("/api/friends/requests/999999999/accept", headers=c["headers"])
+        assert nonexistent.status_code == 404
+
+    def test_unfriend_removes_mutual_friendship(self):
+        client = TestClient(app)
+        a = _register(client, "fr_unfr_a")
+        b = _register(client, "fr_unfr_b")
+
+        request_id = client.post(
+            "/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]
+        ).json()["id"]
+        client.post(f"/api/friends/requests/{request_id}/accept", headers=b["headers"])
+
+        unfriend = client.delete(f"/api/friends/{a['id']}", headers=b["headers"])
+        assert unfriend.status_code == 200, unfriend.text
+
+        assert client.get("/api/friends", headers=a["headers"]).json()["friends"] == []
+        assert client.get("/api/friends", headers=b["headers"]).json()["friends"] == []
+
+        # Idempotency / no dangling state: unfriending again is a clean 404, not 500.
+        again = client.delete(f"/api/friends/{a['id']}", headers=b["headers"])
+        assert again.status_code == 404
+
+
+class TestSelfAndDuplicateRejection:
+    def test_self_request_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "self_req_a")
+        resp = client.post("/api/friends/requests", json={"user_id": a["id"]}, headers=a["headers"])
+        assert resp.status_code == 400
+
+    def test_self_follow_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "self_follow_a")
+        resp = client.post(f"/api/friends/{a['id']}/follow", headers=a["headers"])
+        assert resp.status_code == 400
+
+    def test_self_block_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "self_block_a")
+        resp = client.post(f"/api/friends/{a['id']}/block", headers=a["headers"])
+        assert resp.status_code == 400
+
+    def test_duplicate_friend_request_is_conflict_not_500(self):
+        client = TestClient(app)
+        a = _register(client, "dup_req_a")
+        b = _register(client, "dup_req_b")
+        assert client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]).status_code == 201
+        dup = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        assert dup.status_code == 409
+
+    def test_reverse_duplicate_friend_request_is_conflict(self):
+        """b requesting a while a's request to b is still pending is treated
+        as a duplicate of the same pair, not a second independent request."""
+        client = TestClient(app)
+        a = _register(client, "dup_rev_a")
+        b = _register(client, "dup_rev_b")
+        assert client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]).status_code == 201
+        reverse = client.post("/api/friends/requests", json={"user_id": a["id"]}, headers=b["headers"])
+        assert reverse.status_code == 409
+
+    def test_duplicate_follow_is_conflict_not_500(self):
+        client = TestClient(app)
+        a = _register(client, "dup_follow_a")
+        b = _register(client, "dup_follow_b")
+        assert client.post(f"/api/friends/{b['id']}/follow", headers=a["headers"]).status_code == 201
+        dup = client.post(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        assert dup.status_code == 409
+
+    def test_duplicate_block_is_conflict_not_500(self):
+        client = TestClient(app)
+        a = _register(client, "dup_block_a")
+        b = _register(client, "dup_block_b")
+        assert client.post(f"/api/friends/{b['id']}/block", headers=a["headers"]).status_code == 201
+        dup = client.post(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        assert dup.status_code == 409
+
+    def test_friend_request_to_nonexistent_user_is_404(self):
+        client = TestClient(app)
+        a = _register(client, "req_missing_a")
+        resp = client.post("/api/friends/requests", json={"user_id": 999999999}, headers=a["headers"])
+        assert resp.status_code == 404
+
+
+class TestFollow:
+    def test_follow_unfollow_and_list(self):
+        client = TestClient(app)
+        a = _register(client, "follow_flow_a")
+        b = _register(client, "follow_flow_b")
+
+        follow = client.post(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        assert follow.status_code == 201, follow.text
+
+        following = client.get("/api/friends/following", headers=a["headers"]).json()["following"]
+        assert any(u["id"] == b["id"] for u in following)
+
+        # One-way: b does not follow a.
+        b_following = client.get("/api/friends/following", headers=b["headers"]).json()["following"]
+        assert b_following == []
+
+        unfollow = client.delete(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        assert unfollow.status_code == 200, unfollow.text
+
+        following_after = client.get("/api/friends/following", headers=a["headers"]).json()["following"]
+        assert following_after == []
+
+        # Unfollowing again is a clean 404, not 500.
+        again = client.delete(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        assert again.status_code == 404
+
+    def test_follow_requires_auth(self):
+        client = TestClient(app)
+        b = _register(client, "follow_noauth_b")
+        resp = client.post(f"/api/friends/{b['id']}/follow", json={})
+        assert resp.status_code == 401
+
+
+class TestBlock:
+    def test_block_clears_existing_friendship_and_follow(self):
+        client = TestClient(app)
+        a = _register(client, "block_clear_a")
+        b = _register(client, "block_clear_b")
+
+        request_id = client.post(
+            "/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]
+        ).json()["id"]
+        client.post(f"/api/friends/requests/{request_id}/accept", headers=b["headers"])
+        client.post(f"/api/friends/{a['id']}/follow", headers=b["headers"])
+
+        assert any(
+            u["id"] == b["id"] for u in client.get("/api/friends", headers=a["headers"]).json()["friends"]
+        )
+        assert any(
+            u["id"] == a["id"]
+            for u in client.get("/api/friends/following", headers=b["headers"]).json()["following"]
+        )
+
+        block = client.post(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        assert block.status_code == 201, block.text
+
+        assert client.get("/api/friends", headers=a["headers"]).json()["friends"] == []
+        assert client.get("/api/friends", headers=b["headers"]).json()["friends"] == []
+        assert client.get("/api/friends/following", headers=b["headers"]).json()["following"] == []
+
+        blocked_list = client.get("/api/friends/blocked", headers=a["headers"]).json()["blocked"]
+        assert any(u["id"] == b["id"] for u in blocked_list)
+
+    def test_block_prevents_new_friend_request_and_follow(self):
+        client = TestClient(app)
+        a = _register(client, "block_prevent_a")
+        b = _register(client, "block_prevent_b")
+
+        client.post(f"/api/friends/{b['id']}/block", headers=a["headers"])
+
+        req = client.post("/api/friends/requests", json={"user_id": a["id"]}, headers=b["headers"])
+        assert req.status_code == 403
+
+        follow = client.post(f"/api/friends/{a['id']}/follow", headers=b["headers"])
+        assert follow.status_code == 403
+
+    def test_unblock_removes_block(self):
+        client = TestClient(app)
+        a = _register(client, "unblock_a")
+        b = _register(client, "unblock_b")
+
+        client.post(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        unblock = client.delete(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        assert unblock.status_code == 200, unblock.text
+
+        assert client.get("/api/friends/blocked", headers=a["headers"]).json()["blocked"] == []
+
+        # Idempotency: unblocking again is a clean 404, not 500.
+        again = client.delete(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        assert again.status_code == 404
+
+        # After unblock, a fresh follow/request works again.
+        assert client.post(f"/api/friends/{a['id']}/follow", headers=b["headers"]).status_code == 201
+
+
+class TestDataIsolation:
+    def test_list_endpoints_are_scoped_to_caller(self):
+        """A third party's friends/following/blocked lists must never leak
+        into another user's response."""
+        client = TestClient(app)
+        a = _register(client, "iso_a")
+        b = _register(client, "iso_b")
+        c = _register(client, "iso_c")
+
+        request_id = client.post(
+            "/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]
+        ).json()["id"]
+        client.post(f"/api/friends/requests/{request_id}/accept", headers=b["headers"])
+        client.post(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        client.post(f"/api/friends/{b['id']}/block", headers=c["headers"])
+
+        c_friends = client.get("/api/friends", headers=c["headers"]).json()["friends"]
+        c_following = client.get("/api/friends/following", headers=c["headers"]).json()["following"]
+        assert c_friends == []
+        assert c_following == []
+
+        # c's block of b must not appear in a's or b's blocked list.
+        a_blocked = client.get("/api/friends/blocked", headers=a["headers"]).json()["blocked"]
+        assert a_blocked == []
+
+    def test_requires_auth_on_all_endpoints(self):
+        client = TestClient(app)
+        assert client.get("/api/friends").status_code == 401
+        assert client.get("/api/friends/requests").status_code == 401
+        assert client.get("/api/friends/following").status_code == 401
+        assert client.get("/api/friends/blocked").status_code == 401
+        assert client.post("/api/friends/requests", json={"user_id": 1}).status_code == 401

backend/tests/test_social_models.py

@@ -0,0 +1,240 @@
+"""Model-level tests for the social graph: friendships, follows, blocks.
+
+app/models/social.py / alembic/versions/0007_add_social_graph_tables.py
+(docs/planning/social.md US-1). This is the models+migration task only --
+there are no API endpoints yet (a sibling task owns the router), so these
+tests exercise the ORM models and the real Postgres constraints directly
+rather than going through HTTP.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import delete, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.user import User
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+class TestFriendshipRequestAccept:
+    async def test_request_defaults_to_pending(self):
+        client = TestClient(app)
+        a = _register(client, "sg_fr_a1")
+        b = _register(client, "sg_fr_b1")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                fr = Friendship(requester_id=a, addressee_id=b)
+                session.add(fr)
+                await session.commit()
+                await session.refresh(fr)
+                assert fr.status == FriendshipStatus.PENDING
+                assert fr.requester_id == a
+                assert fr.addressee_id == b
+        finally:
+            await engine.dispose()
+
+    async def test_accept_updates_status(self):
+        client = TestClient(app)
+        a = _register(client, "sg_fr_a2")
+        b = _register(client, "sg_fr_b2")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                fr = Friendship(requester_id=a, addressee_id=b)
+                session.add(fr)
+                await session.commit()
+                fr_id = fr.id
+
+            async with factory() as session:
+                fr = await session.get(Friendship, fr_id)
+                fr.status = FriendshipStatus.ACCEPTED
+                await session.commit()
+
+            async with factory() as session:
+                fr = await session.get(Friendship, fr_id)
+                assert fr.status == FriendshipStatus.ACCEPTED
+        finally:
+            await engine.dispose()
+
+
+class TestUniquePairConstraints:
+    async def test_duplicate_friendship_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_fr_a")
+        b = _register(client, "sg_uq_fr_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_follow_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_fw_a")
+        b = _register(client, "sg_uq_fw_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_block_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_bl_a")
+        b = _register(client, "sg_uq_bl_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+
+class TestFollow:
+    async def test_create_follow(self):
+        client = TestClient(app)
+        a = _register(client, "sg_follow_a")
+        b = _register(client, "sg_follow_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                rows = (await session.execute(
+                    select(Follow).where(Follow.follower_id == a, Follow.followed_id == b)
+                )).scalars().all()
+                assert len(rows) == 1
+        finally:
+            await engine.dispose()
+
+
+class TestBlock:
+    async def test_create_block(self):
+        client = TestClient(app)
+        a = _register(client, "sg_block_a")
+        b = _register(client, "sg_block_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                rows = (await session.execute(
+                    select(Block).where(Block.blocker_id == a, Block.blocked_id == b)
+                )).scalars().all()
+                assert len(rows) == 1
+        finally:
+            await engine.dispose()
+
+
+class TestCascadeDelete:
+    async def test_deleting_user_removes_rows_in_all_three_tables(self):
+        """Deleting a user removes friendships/follows/blocks referencing them
+        in *either* FK column, via the real DB ON DELETE CASCADE (deleted with
+        a Core statement, bypassing any ORM-level cascade, to prove the
+        database constraint itself does the job)."""
+        client = TestClient(app)
+        a = _register(client, "sg_cascade_a")
+        b = _register(client, "sg_cascade_b")
+        c = _register(client, "sg_cascade_c")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                # a as requester/follower/blocker, and also as addressee (c -> a)
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                session.add(Friendship(requester_id=c, addressee_id=a))
+                session.add(Follow(follower_id=a, followed_id=b))
+                session.add(Follow(follower_id=c, followed_id=a))
+                session.add(Block(blocker_id=a, blocked_id=b))
+                session.add(Block(blocker_id=c, blocked_id=a))
+                await session.commit()
+
+            async with factory() as session:
+                await session.execute(delete(User).where(User.id == a))
+                await session.commit()
+
+            async with factory() as session:
+                friendships = (await session.execute(
+                    select(Friendship).where(
+                        (Friendship.requester_id == a) | (Friendship.addressee_id == a)
+                    )
+                )).scalars().all()
+                follows = (await session.execute(
+                    select(Follow).where(
+                        (Follow.follower_id == a) | (Follow.followed_id == a)
+                    )
+                )).scalars().all()
+                blocks = (await session.execute(
+                    select(Block).where(
+                        (Block.blocker_id == a) | (Block.blocked_id == a)
+                    )
+                )).scalars().all()
+                assert friendships == []
+                assert follows == []
+                assert blocks == []
+
+                # Unrelated rows (b, c only) survive.
+                remaining_users = (await session.execute(
+                    select(User.id).where(User.id.in_([b, c]))
+                )).scalars().all()
+                assert set(remaining_users) == {b, c}
+        finally:
+            await engine.dispose()

backend/tests/test_text_filter.py

@@ -0,0 +1,194 @@
+"""Unit tests for app.services.text_filter (docs/planning/social.md §4/§5 US-4).
+
+Pure, side-effect-free service -- no DB/Redis fixtures needed.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from app.services.text_filter import (
+    DEFAULT_TERMS_PATH,
+    FilterAction,
+    FilterMode,
+    FilterResult,
+    ListBasedTextFilter,
+    TextFilter,
+    default_text_filter,
+    load_terms,
+)
+
+
+@pytest.fixture
+def redact_filter() -> ListBasedTextFilter:
+    return ListBasedTextFilter(terms=["badword", "shoot"], mode=FilterMode.REDACT)
+
+
+@pytest.fixture
+def reject_filter() -> ListBasedTextFilter:
+    return ListBasedTextFilter(terms=["badword", "shoot"], mode=FilterMode.REJECT)
+
+
+class TestAllowPath:
+    def test_clean_text_is_allowed_unchanged(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("hello there, how are you today?")
+        assert result.action is FilterAction.ALLOW
+        assert result.filtered_text == "hello there, how are you today?"
+        assert result.matched_terms == ()
+
+    def test_message_with_no_matches(self, reject_filter: ListBasedTextFilter) -> None:
+        # Distinct from the clean-text case above: exercises the reject-mode
+        # filter's no-match path specifically (mode should not matter when
+        # nothing matches).
+        text = "let's meet at the plaza around noon"
+        result = reject_filter.check(text)
+        assert result.action is FilterAction.ALLOW
+        assert result.filtered_text == text
+        assert result.matched_terms == ()
+
+
+class TestRedactPath:
+    def test_exact_match_is_redacted(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("don't be a badword about it")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+        assert "badword" not in result.filtered_text
+        assert result.filtered_text == "don't be a ******* about it"
+
+    def test_multiple_distinct_matches(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("badword, don't shoot!")
+        assert result.action is FilterAction.REDACT
+        assert set(result.matched_terms) == {"badword", "shoot"}
+        assert "badword" not in result.filtered_text
+        assert "shoot" not in result.filtered_text
+        # Length is preserved (asterisks replace matched spans 1:1).
+        assert len(result.filtered_text) == len("badword, don't shoot!")
+
+    def test_redaction_char_is_configurable(self) -> None:
+        f = ListBasedTextFilter(terms=["badword"], mode=FilterMode.REDACT, redaction_char="#")
+        result = f.check("that's a badword thing to say")
+        assert result.filtered_text == "that's a ####### thing to say"
+
+
+class TestRejectPath:
+    def test_match_is_rejected_and_text_left_intact(self, reject_filter: ListBasedTextFilter) -> None:
+        text = "stop, badword!"
+        result = reject_filter.check(text)
+        assert result.action is FilterAction.REJECT
+        assert result.matched_terms == ("badword",)
+        # Reject mode does not mutate the text -- callers are expected to
+        # not store/deliver it at all, based on `action`.
+        assert result.filtered_text == text
+
+
+class TestNormalization:
+    def test_leetspeak_variant_is_caught(self, redact_filter: ListBasedTextFilter) -> None:
+        # "b4dw0rd" -> normalizes to "badword" via the leet map (4->a, 0->o).
+        result = redact_filter.check("you're being a b4dw0rd right now")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+
+    def test_separators_between_letters_are_stripped(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("that is b.a.d.w.o.r.d behavior")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+
+    def test_spacing_between_letters_is_stripped(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("b a d w o r d, seriously")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+
+    def test_case_folding(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("BADWORD in all caps")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+
+    def test_symbol_lookalikes(self) -> None:
+        # @ -> a, $ -> s: "@ss" should normalize to "ass".
+        f = ListBasedTextFilter(terms=["ass"], mode=FilterMode.REDACT)
+        result = f.check("what an @$$ move")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("ass",)
+
+
+class TestEmptyAndWhitespace:
+    def test_empty_string(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("")
+        assert result.action is FilterAction.ALLOW
+        assert result.filtered_text == ""
+        assert result.matched_terms == ()
+
+    def test_whitespace_only_string(self, redact_filter: ListBasedTextFilter) -> None:
+        text = "   \t\n  "
+        result = redact_filter.check(text)
+        assert result.action is FilterAction.ALLOW
+        assert result.filtered_text == text
+        assert result.matched_terms == ()
+
+    def test_punctuation_only_string_has_nothing_to_normalize(self, redact_filter: ListBasedTextFilter) -> None:
+        # No alnum characters survive normalization at all -- must not
+        # crash on an empty normalized string / empty index_map.
+        result = redact_filter.check("...!!!???")
+        assert result.action is FilterAction.ALLOW
+        assert result.matched_terms == ()
+
+
+class TestConfigurability:
+    def test_custom_term_list_is_used_instead_of_default(self) -> None:
+        f = ListBasedTextFilter(terms=["zzzcustomzzz"], mode=FilterMode.REDACT)
+        result = f.check("this contains zzzcustomzzz right here")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("zzzcustomzzz",)
+        # Default list terms should NOT match since we overrode the list.
+        result2 = f.check("this is fucking unrelated")
+        assert result2.action is FilterAction.ALLOW
+
+    def test_duplicate_and_blank_terms_are_deduped(self) -> None:
+        f = ListBasedTextFilter(terms=["badword", "badword", "  ", ""], mode=FilterMode.REDACT)
+        assert f._terms == ("badword",)
+
+    def test_default_terms_file_loads_and_is_nonempty(self) -> None:
+        terms = load_terms()
+        assert isinstance(terms, list)
+        assert len(terms) > 0
+        assert all(isinstance(t, str) and t for t in terms)
+
+    def test_default_terms_path_exists(self) -> None:
+        assert DEFAULT_TERMS_PATH.exists()
+        assert DEFAULT_TERMS_PATH.suffix == ".json"
+
+    def test_load_terms_from_explicit_path(self, tmp_path: Path) -> None:
+        custom = tmp_path / "custom_terms.json"
+        custom.write_text('{"terms": ["foo", "bar"]}', encoding="utf-8")
+        assert load_terms(custom) == ["foo", "bar"]
+
+    def test_default_text_filter_factory_matches_default_list(self) -> None:
+        f = default_text_filter(mode=FilterMode.REJECT)
+        result = f.check("that's fucking ridiculous")
+        assert result.action is FilterAction.REJECT
+        assert "fuck" in result.matched_terms
+
+
+class TestProtocol:
+    def test_list_based_filter_satisfies_text_filter_protocol(self, redact_filter: ListBasedTextFilter) -> None:
+        assert isinstance(redact_filter, TextFilter)
+
+    def test_check_returns_filter_result(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("hi")
+        assert isinstance(result, FilterResult)
+
+    def test_a_third_party_style_implementation_satisfies_the_protocol(self) -> None:
+        # Demonstrates the extension point: any object with a matching
+        # `check` method satisfies TextFilter without inheriting from
+        # anything -- this is how a future third-party provider would plug
+        # in without touching this module.
+        class AlwaysAllow:
+            def check(self, text: str) -> FilterResult:
+                return FilterResult(action=FilterAction.ALLOW, filtered_text=text, matched_terms=())
+
+        provider: TextFilter = AlwaysAllow()
+        assert isinstance(provider, TextFilter)
+        result = provider.check("anything at all, even fuck")
+        assert result.action is FilterAction.ALLOW