WIP checkpoint: Text filtering service + profanity config

backend/alembic/versions/0002_add_date_of_birth_to_users.py

@@ -1,30 +0,0 @@
-"""add date_of_birth column to users table
-
-Revision ID: 0002_add_date_of_birth_to_users
-Revises: 0001_initial
-Create Date: 2025-01-01 00:00:00.000000
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-
-# revision identifiers, used by Alembic.
-revision: str = "0002_add_date_of_birth_to_users"
-down_revision: Union[str, None] = "0001_initial"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Add date_of_birth column to users table."""
-    op.add_column(
-        "users",
-        sa.Column("date_of_birth", sa.Date(), nullable=True),
-    )
-
-
-def downgrade() -> None:
-    """Remove date_of_birth column from users table."""
-    op.drop_column("users", "date_of_birth")

backend/alembic/versions/0003_add_gltf_asset_type.py

@@ -1,36 +0,0 @@
-"""add model_gltf value to asset_type enum
-
-Revision ID: 0003_add_gltf_asset_type
-Revises: 0002_add_date_of_birth_to_users
-Create Date: 2025-06-15 00:00:00.000000
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision: str = "0003_add_gltf_asset_type"
-down_revision: Union[str, None] = "0002_add_date_of_birth_to_users"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Add the 'model_gltf' value to the asset_type enum."""
-    # IF NOT EXISTS is supported on PostgreSQL 12+; the project targets
-    # PostgreSQL 16. Adding an enum value and using it in the same
-    # transaction is restricted until commit, but this migration only adds
-    # the value so it is safe inside Alembic's transaction.
-    op.execute("ALTER TYPE asset_type ADD VALUE IF NOT EXISTS 'model_gltf'")
-
-
-def downgrade() -> None:
-    """Remove the 'model_gltf' value from the asset_type enum.
-
-    PostgreSQL does not support dropping an enum value without table scans;
-    this is intentionally a no-op to keep downgrades safe. Re-creating the
-    enum or deleting rows that use this value would be a destructive action
-    better performed manually if ever needed.
-    """
-    pass

backend/app/models/asset.py

@@ -13,7 +13,6 @@ class AssetType(str, enum.Enum):
     VIDEO = "video"
     DOCUMENT = "document"
     MODEL_3D = "model_3d"
-    MODEL_GLTF = "model_gltf"
     OTHER = "other"
 
 

backend/app/models/user.py

@@ -1,7 +1,4 @@
-from datetime import date
+from sqlalchemy import Column, Integer, String, Boolean, DateTime
-from typing import Optional
-
-from sqlalchemy import Column, Integer, String, Boolean, DateTime, Date
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
 
@@ -15,7 +12,6 @@ class User(Base):
     username = Column(String(50), unique=True, index=True, nullable=False)
     email = Column(String(120), unique=True, index=True, nullable=False)
     hashed_password = Column(String(255), nullable=False)
-    date_of_birth = Column(Date, nullable=True)
     is_active = Column(Boolean, default=True)
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(DateTime(timezone=True), onupdate=func.now())
@@ -23,15 +19,3 @@ class User(Base):
     sessions = relationship("Session", back_populates="user", cascade="all, delete-orphan")
     worlds = relationship("World", back_populates="owner")
     assets = relationship("Asset", back_populates="owner")
-
-    @property
-    def is_adult(self) -> bool:
-        """Return True if the user is 18 or older based on date_of_birth."""
-        if self.date_of_birth is None:
-            return False
-        today = date.today()
-        age = today.year - self.date_of_birth.year
-        # Adjust if birthday hasn't occurred yet this year
-        if (today.month, today.day) < (self.date_of_birth.month, self.date_of_birth.day):
-            age -= 1
-        return age >= 18

backend/app/routers/assets.py

@@ -1,6 +1,5 @@
 """Asset management router."""
 
-import json
 import os
 from pathlib import Path
 from typing import Optional
@@ -65,177 +64,6 @@ def _sanitize_filename(filename: str) -> str:
     return safe or "file"
 
 
-def _validate_gltf_json(content: bytes) -> dict:
-    """Validate that content is a valid .gltf file (JSON-based glTF).
-
-    Returns the parsed JSON dict on success.
-    Raises ValueError if the file is not valid glTF.
-    """
-    try:
-        data = json.loads(content)
-    except (json.JSONDecodeError, UnicodeDecodeError) as e:
-        raise ValueError(f"Invalid JSON in .gltf file: {e}")
-
-    if not isinstance(data, dict):
-        raise ValueError("glTF file root must be a JSON object")
-
-    if "asset" not in data:
-        raise ValueError("Missing required 'asset' property in glTF file")
-
-    if "scenes" not in data and "meshes" not in data and "nodes" not in data:
-        # glTF 2.0 spec: at least one of scenes, meshes, nodes, accessors,
-        # bufferViews, buffers, materials, textures, samplers, skin,
-        # animations, or extensions must be present.
-        # For simplicity, we require at least one of scenes/meshes/nodes.
-        raise ValueError(
-            "glTF file must contain at least one of: scenes, meshes, or nodes"
-        )
-
-    return data
-
-
-def _validate_glb(content: bytes) -> dict:
-    """Validate that content is a valid .glb file (binary glTF).
-
-    Returns the parsed JSON chunk data on success.
-    Raises ValueError if the file is not valid glTF.
-    """
-    if len(content) < 12:
-        raise ValueError("glb file too short")
-
-    # Check magic bytes: must start with b'glTF'
-    magic = content[:4]
-    if magic != b"glTF":
-        raise ValueError(
-            f"Invalid glb magic bytes: expected b'glTF', got {magic!r}"
-        )
-
-    # Version check (we support version 2)
-    version = int.from_bytes(content[4:8], byteorder="little")
-    if version != 2:
-        raise ValueError(f"Unsupported glTF version: {version} (expected 2)")
-
-    # Total length check
-    total_length = int.from_bytes(content[8:12], byteorder="little")
-    if total_length != len(content):
-        raise ValueError(
-            f"glb total length mismatch: header says {total_length}, "
-            f"actual is {len(content)}"
-        )
-
-    # Parse JSON chunk
-    # Chunk format: length (4 bytes) + type (4 bytes) + data
-    offset = 12
-    json_chunk_data = None
-
-    while offset < len(content):
-        if offset + 8 > len(content):
-            raise ValueError("Incomplete chunk header in glb file")
-
-        chunk_length = int.from_bytes(content[offset:offset + 4], byteorder="little")
-        chunk_type = content[offset + 4:offset + 8]
-
-        if chunk_length + 8 > len(content) - offset:
-            raise ValueError("Chunk extends beyond file end")
-
-        if chunk_type == b"JSON":
-            json_chunk_data = content[offset + 8:offset + 8 + chunk_length]
-            # JSON chunk may have padding
-            break
-        elif chunk_type == b"BIN":
-            # Skip binary chunk
-            offset += 8 + chunk_length
-            continue
-        else:
-            # Unknown chunk type - skip it
-            offset += 8 + chunk_length
-            continue
-
-    if json_chunk_data is None:
-        raise ValueError("No JSON chunk found in glb file")
-
-    try:
-        data = json.loads(json_chunk_data)
-    except (json.JSONDecodeError, UnicodeDecodeError) as e:
-        raise ValueError(f"Invalid JSON in glb chunk: {e}")
-
-    if not isinstance(data, dict):
-        raise ValueError("glTF file root must be a JSON object")
-
-    if "asset" not in data:
-        raise ValueError("Missing required 'asset' property in glTF file")
-
-    return data
-
-
-def _extract_metadata(data: dict) -> dict:
-    """Extract metadata from parsed glTF data.
-
-    Returns a dict with:
-    - bounding_box: {"min": [...], "max": [...]} or null
-    - vertex_count: int
-    - material_count: int
-    - has_animation: bool
-    """
-    metadata = {
-        "bounding_box": None,
-        "vertex_count": 0,
-        "material_count": 0,
-        "has_animation": False,
-    }
-
-    # Count materials
-    if "materials" in data and isinstance(data["materials"], list):
-        metadata["material_count"] = len(data["materials"])
-
-    # Check for animations
-    if "animations" in data and isinstance(data["animations"], list):
-        metadata["has_animation"] = len(data["animations"]) > 0
-
-    # Count vertices from meshes
-    vertex_count = 0
-    bounds_min = None
-    bounds_max = None
-
-    if "meshes" in data and isinstance(data["meshes"], list):
-        for mesh in data["meshes"]:
-            if "primitives" in mesh and isinstance(mesh["primitives"], list):
-                for primitive in mesh["primitives"]:
-                    # Accessor index for positions
-                    pos_accessor_idx = primitive.get("attributes", {}).get("POSITION")
-                    if pos_accessor_idx is not None:
-                        accessors = data.get("accessors", [])
-                        if isinstance(accessors, list) and 0 <= pos_accessor_idx < len(accessors):
-                            accessor = accessors[pos_accessor_idx]
-                            count = accessor.get("count", 0)
-                            vertex_count += count
-
-                            # Extract bounding box from min/max
-                            if "min" in accessor and "max" in accessor:
-                                acc_min = accessor["min"]
-                                acc_max = accessor["max"]
-                                if bounds_min is None:
-                                    bounds_min = acc_min
-                                    bounds_max = acc_max
-                                else:
-                                    bounds_min = [
-                                        min(a, b) for a, b in zip(bounds_min, acc_min)
-                                    ]
-                                    bounds_max = [
-                                        max(a, b) for a, b in zip(bounds_max, acc_max)
-                                    ]
-
-    metadata["vertex_count"] = vertex_count
-
-    if bounds_min is not None and bounds_max is not None:
-        metadata["bounding_box"] = {
-            "min": bounds_min,
-            "max": bounds_max,
-        }
-
-    return metadata
-
-
 # --- Endpoints ---
 
 @router.post("/", response_model=AssetResponse, status_code=201)
@@ -379,89 +207,3 @@ async def upload_asset_file(
     await db.commit()
     await db.refresh(asset)
     return asset
-
-
-@router.post("/import-gltf", response_model=AssetResponse, status_code=201)
-async def import_gltf(
-    current_user: CurrentUser,
-    file: UploadFile = File(...),
-    db: AsyncSession = Depends(get_db),
-):
-    """Import a glTF or glb file as an asset.
-
-    Accepts a .gltf or .glb file, validates it, extracts metadata
-    (bounding box, vertex count, material count, animation flag),
-    stores the file, and returns an AssetResponse with the new asset's ID.
-    """
-    filename = file.filename or ""
-    lower_filename = filename.lower()
-
-    # Validate file extension
-    if not (lower_filename.endswith(".gltf") or lower_filename.endswith(".glb")):
-        raise HTTPException(
-            status_code=400,
-            detail="File must be a .gltf or .glb file",
-        )
-
-    # Validate file size against configured maximum.
-    max_bytes = settings.MAX_UPLOAD_SIZE_MB * 1024 * 1024
-    content = await file.read()
-    file_size = len(content)
-    if file_size > max_bytes:
-        raise HTTPException(
-            status_code=413,
-            detail=f"File size {file_size} exceeds maximum allowed size {max_bytes} bytes",
-        )
-
-    # Validate file content based on format
-    try:
-        if lower_filename.endswith(".gltf"):
-            gltf_data = _validate_gltf_json(content)
-        else:
-            gltf_data = _validate_glb(content)
-    except ValueError as e:
-        raise HTTPException(
-            status_code=400,
-            detail=f"Invalid glTF file: {e}",
-        )
-
-    # Extract metadata
-    metadata = _extract_metadata(gltf_data)
-
-    # Create the asset record
-    asset = Asset(
-        name=Path(filename).stem,
-        description=None,
-        asset_type=AssetType.MODEL_GLTF,
-        file_path="",  # Will be set after file storage
-        owner_id=current_user.id,
-        world_id=None,
-        is_public=False,
-    )
-    db.add(asset)
-    await db.commit()
-    await db.refresh(asset)
-
-    # Sanitize filename for storage.
-    # The original extension was validated above, so we keep exactly one
-    # extension after the sanitized stem.
-    original_stem = Path(filename).stem
-    safe_stem = _sanitize_filename(original_stem)
-    extension = ".gltf" if lower_filename.endswith(".gltf") else ".glb"
-    stored_name = f"{asset.id}_{safe_stem}{extension}"
-
-    # Write the file to the upload directory
-    upload_dir = Path(settings.UPLOAD_DIR)
-    upload_dir.mkdir(parents=True, exist_ok=True)
-    file_path = upload_dir / stored_name
-    file_path.write_bytes(content)
-
-    # Update asset with file info and metadata
-    asset.file_path = str(file_path)
-    asset.file_size = file_size
-    asset.mime_type = "model/gltf+json" if lower_filename.endswith(".gltf") else "model/gltf+binary"
-    asset.metadata_json = json.dumps(metadata)
-
-    await db.commit()
-    await db.refresh(asset)
-    return asset

backend/app/routers/auth.py

@@ -1,10 +1,10 @@
 """Authentication router - login, register, token refresh."""
 
-from datetime import date, datetime, timedelta, timezone
+from datetime import datetime, timedelta, timezone
 
 from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordRequestForm
-from pydantic import BaseModel, EmailStr, field_validator
+from pydantic import BaseModel, EmailStr
 
 from jose import jwt
 from passlib.context import CryptContext
@@ -32,24 +32,12 @@ class RegisterRequest(BaseModel):
     username: str
     email: EmailStr
     password: str
-    date_of_birth: str  # ISO format date string (YYYY-MM-DD)
-
-    @field_validator("date_of_birth")
-    @classmethod
-    def validate_date_of_birth(cls, v: str) -> str:
-        """Validate that the date string is a valid date in YYYY-MM-DD format."""
-        try:
-            datetime.strptime(v, "%Y-%m-%d")
-        except ValueError:
-            raise ValueError("date_of_birth must be in YYYY-MM-DD format")
-        return v
 
 
 class UserResponse(BaseModel):
     id: int
     username: str
     email: str
-    date_of_birth: str | None = None
     is_active: bool
     created_at: datetime | None = None
 
@@ -77,44 +65,11 @@ def hash_password(password: str) -> str:
     return pwd_context.hash(password)
 
 
-def calculate_age(birth_date: date, today: date | None = None) -> int:
-    """Calculate age in years from a birth date.
-
-    Args:
-        birth_date: The person's date of birth.
-        today: The reference date. Defaults to today's date (UTC).
-
-    Returns:
-        Age in whole years as of the reference date.
-    """
-    if today is None:
-        today = datetime.now(timezone.utc).date()
-
-    age = today.year - birth_date.year
-    # Adjust if birthday hasn't occurred yet this year
-    if (today.month, today.day) < (birth_date.month, birth_date.day):
-        age -= 1
-    return age
-
-
 # --- Endpoints ---
 
 @router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
 async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
-    """Register a new user and return an access token.
+    """Register a new user and return an access token."""
-
-    Requires date_of_birth and rejects users under 18.
-    """
-    # Parse and validate date_of_birth
-    dob = datetime.strptime(req.date_of_birth, "%Y-%m-%d").date()
-    age = calculate_age(dob)
-
-    if age < 18:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Must be 18 or older to register (provided date of birth: {req.date_of_birth})",
-        )
-
     # Check if username already exists
     result = await db.execute(select(User).where(User.username == req.username))
     if result.scalar_one_or_none():
@@ -135,7 +90,6 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
         username=req.username,
         email=req.email,
         hashed_password=hash_password(req.password),
-        date_of_birth=dob,
     )
     db.add(user)
     await db.commit()

backend/app/services/__init__.py

@@ -0,0 +1 @@
+"""Application services."""

backend/app/services/text_filter.py

@@ -0,0 +1,340 @@
+"""Pluggable server-side text filtering service.
+
+Provides a ``TextFilter`` protocol with a deterministic default
+implementation (profanity/term list with normalization) and a hook
+for third-party providers.
+
+Usage::
+
+    from app.services.text_filter import TextFilter, FilterResult, \
+        ProfanityTextFilter, get_text_filter
+
+    # Default factory reads config from the path below
+    filt = get_text_filter()
+    result = filt.check("Hello wor1d!")
+    # result.action == FilterAction.ALLOW
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import unicodedata
+from abc import ABC, abstractmethod
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+from typing import Any
+
+# ---------------------------------------------------------------------------
+# Enums / Data classes
+# ---------------------------------------------------------------------------
+
+
+class FilterAction(str, Enum):
+    """Action the filter wants the caller to take."""
+
+    ALLOW = "allow"
+    REDACT = "redact"
+    REJECT = "reject"
+
+
+@dataclass(frozen=True)
+class FilterResult:
+    """Immutable result of a single ``TextFilter.check()`` call.
+
+    Attributes:
+        action: What to do with the message.
+        filtered_text: The text after redaction (may equal *text* if
+            action is ``ALLOW``).
+        matched_terms: Sorted list of terms that triggered the filter.
+    """
+
+    action: FilterAction
+    filtered_text: str
+    matched_terms: list[str] = field(default_factory=list)
+
+    @property
+    def is_allowed(self) -> bool:
+        return self.action == FilterAction.ALLOW
+
+    @property
+    def is_rejected(self) -> bool:
+        return self.action == FilterAction.REJECT
+
+    @property
+    def is_redacted(self) -> bool:
+        return self.action == FilterAction.REDACT
+
+
+# ---------------------------------------------------------------------------
+# Protocol / abstract base
+# ---------------------------------------------------------------------------
+
+
+class TextFilter(ABC):
+    """Protocol for server-side text filters.
+
+    Every concrete filter must implement ``check()``.  The default
+    implementation (``ProfanityTextFilter``) is deterministic and
+    requires no external service.  A third-party provider can be
+    plugged in by subclassing ``TextFilter`` and overriding ``check``.
+    """
+
+    @abstractmethod
+    def check(self, text: str) -> FilterResult:
+        """Analyse *text* and return a ``FilterResult``.
+
+        Args:
+            text: Raw message text to filter.
+
+        Returns:
+            A ``FilterResult`` with the decision and any redacted text.
+        """
+
+
+# ---------------------------------------------------------------------------
+# Normalisation helpers
+# ---------------------------------------------------------------------------
+
+# Common leetspeak substitutions (char -> set of possible originals)
+_LEETSPEAK: dict[str, str] = {
+    "0": "o",
+    "1": "i",
+    "3": "e",
+    "4": "a",
+    "5": "s",
+    "7": "t",
+    "8": "b",
+    "9": "g",
+    "@": "a",
+}
+
+# Normalise separators that are often used to obfuscate words
+_SEPARATORS = re.compile(r"[\s_\-\.]+")
+
+
+def _normalize(text: str) -> str:
+    """Case-fold, strip diacritics, and replace leetspeak / separators.
+
+    This produces a canonical form for matching against the term list.
+    """
+    # Case-fold
+    text = text.casefold()
+    # Strip diacritics (e.g. é -> e)
+    text = unicodedata.normalize("NFKD", text)
+    text = "".join(c for c in text if not unicodedata.combining(c))
+    # Replace leetspeak
+    normalized = ""
+    for ch in text:
+        normalized += _LEETSPEAK.get(ch, ch)
+    # Collapse separators
+    normalized = _SEPARATORS.sub("", normalized)
+    return normalized
+
+
+# ---------------------------------------------------------------------------
+# Default implementation
+# ---------------------------------------------------------------------------
+
+# Default config path (relative to project root)
+_DEFAULT_CONFIG_PATH = Path(__file__).resolve().parent.parent.parent / "data" / "text_filter_config.json"
+
+
+@dataclass
+class _FilterPolicy:
+    """Filtering policy loaded from config."""
+
+    mode: str  # "redact" or "reject"
+    redaction_char: str = "*"
+    # Minimum term length to consider (avoids matching single chars)
+    min_term_length: int = 3
+    # If True, match terms case-insensitively after normalisation
+    case_insensitive: bool = True
+    # If True, match whole words only (after normalisation)
+    whole_word: bool = True
+
+
+class ProfanityTextFilter(TextFilter):
+    """Deterministic text filter backed by a JSON term list.
+
+    The config file is a JSON object with:
+
+    .. code-block:: json
+
+        {
+            "mode": "redact",
+            "redaction_char": "*",
+            "min_term_length": 3,
+            "case_insensitive": true,
+            "whole_word": true,
+            "terms": ["badword", "another", ...]
+        }
+
+    Terms are matched after normalisation (case-fold, leetspeak
+    substitution, separator removal, diacritic stripping).
+    """
+
+    def __init__(
+        self,
+        config_path: str | Path | None = None,
+        terms: list[str] | None = None,
+        policy: _FilterPolicy | None = None,
+    ) -> None:
+        """
+        Args:
+            config_path: Path to a JSON config file.  Ignored if *terms*
+                is provided.
+            terms: Inline list of terms (overrides config file).
+            policy: Filter policy.  Defaults to a redact policy.
+        """
+        if terms is not None:
+            self._terms: list[str] = [t.lower() for t in terms]
+        elif config_path is not None:
+            self._terms = self._load_terms(Path(config_path))
+        else:
+            # Try default path
+            if _DEFAULT_CONFIG_PATH.exists():
+                self._terms = self._load_terms(_DEFAULT_CONFIG_PATH)
+            else:
+                self._terms = []
+
+        self._policy = policy or _FilterPolicy(mode="redact")
+        # Pre-compile patterns for each term
+        self._patterns: list[tuple[re.Pattern[str], str]] = []
+        for term in self._terms:
+            if len(term) < self._policy.min_term_length:
+                continue
+            if self._policy.whole_word:
+                pattern = re.compile(
+                    r"(?<!\w)" + re.escape(term) + r"(?!\w)",
+                    re.IGNORECASE if self._policy.case_insensitive else 0,
+                )
+            else:
+                pattern = re.compile(
+                    re.escape(term),
+                    re.IGNORECASE if self._policy.case_insensitive else 0,
+                )
+            self._patterns.append((pattern, term))
+
+    # -- config loading --------------------------------------------------
+
+    @staticmethod
+    def _load_terms(config_path: Path) -> list[str]:
+        """Load terms from a JSON config file."""
+        with open(config_path, "r", encoding="utf-8") as f:
+            data: dict[str, Any] = json.load(f)
+
+        terms: list[str] = []
+        for raw in data.get("terms", []):
+            term = str(raw).strip()
+            if term:
+                terms.append(term.casefold())
+        return terms
+
+    # -- public API ------------------------------------------------------
+
+    def check(self, text: str) -> FilterResult:
+        """Check *text* against the loaded term list.
+
+        Returns a ``FilterResult`` with the appropriate action,
+        filtered text, and matched terms.
+        """
+        if not text:
+            return FilterResult(
+                action=FilterAction.ALLOW,
+                filtered_text=text,
+                matched_terms=[],
+            )
+
+        normalized = _normalize(text)
+        matched_terms: list[str] = []
+
+        # Collect all matches
+        for pattern, term in self._patterns:
+            if pattern.search(normalized):
+                if term not in matched_terms:
+                    matched_terms.append(term)
+
+        if not matched_terms:
+            return FilterResult(
+                action=FilterAction.ALLOW,
+                filtered_text=text,
+                matched_terms=[],
+            )
+
+        matched_terms.sort()
+
+        # Build filtered text by replacing matched terms
+        filtered = text
+        for term in matched_terms:
+            norm_term = _normalize(term)
+            # Find all occurrences in the normalised text and replace in original
+            # We need to map positions from normalised text back to original
+            filtered = self._replace_terms(filtered, term, norm_term)
+
+        action = FilterAction.REJECT if self._policy.mode == "reject" else FilterAction.REDACT
+
+        return FilterResult(
+            action=action,
+            filtered_text=filtered,
+            matched_terms=matched_terms,
+        )
+
+    def _replace_terms(
+        self, text: str, term: str, norm_term: str
+    ) -> str:
+        """Replace occurrences of *term* in *text* with redaction chars.
+
+        Uses normalised text for matching but preserves original casing
+        in the output.
+        """
+        norm_text = _normalize(text)
+        norm_term_len = len(norm_term)
+        result_chars = list(text)
+
+        start = 0
+        while start < len(norm_text):
+            idx = norm_text.find(norm_term, start)
+            if idx == -1:
+                break
+            # Replace characters in original text
+            for i in range(idx, min(idx + norm_term_len, len(result_chars))):
+                result_chars[i] = self._policy.redaction_char
+            start = idx + norm_term_len
+
+        return "".join(result_chars)
+
+    @property
+    def terms(self) -> list[str]:
+        """Read-only access to the loaded term list."""
+        return list(self._terms)
+
+    @property
+    def policy(self) -> _FilterPolicy:
+        """Read-only access to the filter policy."""
+        return self._policy
+
+
+# ---------------------------------------------------------------------------
+# Factory
+# ---------------------------------------------------------------------------
+
+
+def get_text_filter(
+    config_path: str | Path | None = None,
+    terms: list[str] | None = None,
+    policy: _FilterPolicy | None = None,
+) -> TextFilter:
+    """Return a ``TextFilter`` instance.
+
+    By default this creates a ``ProfanityTextFilter``.  To use a
+    third-party provider, subclass ``TextFilter`` and pass an
+    instance here instead.
+    """
+    return ProfanityTextFilter(
+        config_path=config_path,
+        terms=terms,
+        policy=policy,
+    )

backend/pytest.ini

@@ -1,3 +0,0 @@
-[pytest]
-asyncio_mode = auto
-testpaths = tests

backend/tests/test_auth_age_gate.py

@@ -1,94 +0,0 @@
-"""Tests for the 18+ age gate on user registration."""
-
-from datetime import date, timedelta
-
-import pytest
-
-from app.routers.auth import calculate_age
-
-
-class TestCalculateAge:
-    """Unit tests for the calculate_age helper."""
-
-    def test_exactly_18(self):
-        """A person born exactly 18 years ago today is 18."""
-        today = date(2025, 6, 15)
-        dob = today.replace(year=today.year - 18)
-        assert calculate_age(dob, today=today) == 18
-
-    def test_just_turned_18(self):
-        """A person who turned 18 yesterday is 18."""
-        today = date(2025, 6, 15)
-        dob = today.replace(year=today.year - 18) - timedelta(days=1)
-        assert calculate_age(dob, today=today) == 18
-
-    def test_one_day_short_of_18(self):
-        """A person born one day after their 18th birthday is 17."""
-        today = date(2025, 6, 15)
-        dob = today.replace(year=today.year - 18) + timedelta(days=1)
-        assert calculate_age(dob, today=today) == 17
-
-    def test_17_years_old(self):
-        """A person who is 17 years old today is 17."""
-        today = date(2025, 6, 15)
-        dob = date(2008, 6, 15)
-        assert calculate_age(dob, today=today) == 17
-
-    def test_65_years_old(self):
-        """A person who is 65 is correctly calculated."""
-        today = date(2025, 6, 15)
-        dob = today.replace(year=today.year - 65)
-        assert calculate_age(dob, today=today) == 65
-
-    def test_newborn(self):
-        """A newborn is 0."""
-        today = date(2025, 6, 15)
-        dob = today
-        assert calculate_age(dob, today=today) == 0
-
-    def test_birthday_not_yet_this_year(self):
-        """Person born Dec 31, 2000 — on Jan 1, 2025 they are still 24."""
-        dob = date(2000, 12, 31)
-        assert calculate_age(dob, today=date(2025, 1, 1)) == 24
-
-    def test_birthday_today(self):
-        """Person born Dec 31, 2000 — on Dec 31, 2024 they turn 24."""
-        dob = date(2000, 12, 31)
-        assert calculate_age(dob, today=date(2024, 12, 31)) == 24
-
-
-class TestRegisterRequestDateValidation:
-    """Tests for the RegisterRequest date_of_birth field validator."""
-
-    @pytest.mark.parametrize(
-        "dob",
-        [
-            "2000-01-01",
-            "1990-12-31",
-            "2004-02-29",  # leap day
-        ],
-    )
-    def test_valid_dates(self, dob):
-        """Valid YYYY-MM-DD dates pass validation."""
-        from app.routers.auth import RegisterRequest
-
-        req = RegisterRequest(username="u", email="u@example.com", password="p", date_of_birth=dob)
-        assert req.date_of_birth == dob
-
-    @pytest.mark.parametrize(
-        "dob",
-        [
-            "01-01-2000",
-            "2000/01/01",
-            "2000-13-01",
-            "2000-00-10",
-            "not-a-date",
-            "",
-        ],
-    )
-    def test_invalid_dates_rejected(self, dob):
-        """Invalid dates are rejected by the validator."""
-        from app.routers.auth import RegisterRequest
-
-        with pytest.raises(ValueError):
-            RegisterRequest(username="u", email="u@example.com", password="p", date_of_birth=dob)

backend/tests/test_gltf_import.py

@@ -1,493 +0,0 @@
-"""Tests for the glTF import pipeline."""
-
-import json
-from pathlib import Path
-
-import pytest
-from fastapi.testclient import TestClient
-from sqlalchemy import select
-
-from app.config import settings
-from app.database import get_db, SessionLocal
-from app.models.asset import Asset, AssetType
-from app.models.user import User
-from app.main import app
-
-
-# --- Fixtures ---
-
-
-@pytest.fixture
-def db_session():
-    """Provide a test database session with rollback."""
-    async_session = SessionLocal()
-
-    async def override_get_db():
-        return async_session
-
-    app.dependency_overrides[get_db] = override_get_db
-
-    yield async_session
-
-    async def cleanup():
-        await async_session.rollback()
-        await async_session.close()
-
-    import asyncio
-
-    asyncio.get_event_loop().run_until_complete(cleanup())
-    app.dependency_overrides.clear()
-
-
-@pytest.fixture
-def test_user(db_session):
-    """Create a test user."""
-    user = User(
-        username="test_gltf_user",
-        email="gltf_test@example.com",
-        hashed_password="$2b$12$EixZaYVK1fsbw1ZfbX3OXePaWxn96p36PQm3iV8jEGPym2fA1Wile",  # pass
-        is_active=True,
-    )
-    db_session.add(user)
-    import asyncio
-
-    asyncio.get_event_loop().run_until_complete(db_session.commit())
-    asyncio.get_event_loop().run_until_complete(db_session.refresh(user))
-    return user
-
-
-@pytest.fixture
-def client(db_session, test_user):
-    """Create a test client with auth."""
-    from jose import jwt
-    from datetime import datetime, timedelta, timezone
-
-    token = jwt.encode(
-        {
-            "sub": str(test_user.id),
-            "exp": datetime.now(timezone.utc)
-            + timedelta(minutes=30),
-        },
-        settings.SECRET_KEY,
-        algorithm=settings.ALGORITHM,
-    )
-
-    from fastapi.testclient import TestClient
-
-    client = TestClient(app)
-    client.headers["Authorization"] = f"Bearer {token}"
-    return client
-
-
-# --- Helpers for building test glTF files ---
-
-
-def make_gltf_json(
-    scenes=True,
-    meshes=True,
-    nodes=False,
-    materials=0,
-    animations=0,
-    vertex_count=0,
-    has_bounds=True,
-):
-    """Build a minimal valid .gltf JSON structure."""
-    data = {
-        "asset": {"version": "2.0", "generator": "test"},
-    }
-    if scenes:
-        data["scenes"] = [{"nodes": [0]}]
-    if nodes:
-        data["nodes"] = [{"name": "root"}]
-    if meshes:
-        accessors = []
-        if vertex_count > 0 and has_bounds:
-            accessors.append(
-                {
-                    "count": vertex_count,
-                    "componentType": 5126,
-                    "type": "VEC3",
-                    "min": [0.0, 0.0, 0.0],
-                    "max": [1.0, 1.0, 1.0],
-                }
-            )
-        elif vertex_count > 0:
-            accessors.append(
-                {
-                    "count": vertex_count,
-                    "componentType": 5126,
-                    "type": "VEC3",
-                }
-            )
-        meshes_list = []
-        for _ in range(1):
-            prim = {"attributes": {"POSITION": 0}} if accessors else {}
-            meshes_list.append({"primitives": [prim]})
-        data["meshes"] = meshes_list
-        if accessors:
-            data["accessors"] = accessors
-    if materials > 0:
-        data["materials"] = [{"name": f"mat_{i}"} for i in range(materials)]
-    if animations > 0:
-        data["animations"] = [{"name": f"anim_{i}"} for i in range(animations)]
-    return data
-
-
-def make_glb(data_dict):
-    """Build a minimal valid .glb binary file from a dict."""
-    json_bytes = json.dumps(data_dict).encode("utf-8")
-    # Pad JSON to 4-byte boundary
-    json_padding = (4 - len(json_bytes) % 4) % 4
-    json_bytes += b" " * json_padding
-
-    json_chunk_length = len(json_bytes)
-    json_chunk_type = b"JSON"
-
-    # No binary chunks for simplicity
-    total_length = 12 + 8 + json_chunk_length + 8  # header + json chunk header + data + BIN padding
-
-    header = b"glTF"
-    header += int.to_bytes(2, 4, "little")  # version
-    header += int.to_bytes(total_length, 4, "little")  # total length
-
-    chunk_header = int.to_bytes(json_chunk_length, 4, "little")
-    chunk_header += json_chunk_type
-
-    # Add a BIN chunk with zero length to pad
-    bin_chunk_length = 0
-    bin_chunk_type = b"BIN"
-    bin_padding = (4 - bin_chunk_length % 4) % 4
-
-    return (
-        header
-        + chunk_header
-        + json_bytes
-        + bin_chunk_type
-        + int.to_bytes(bin_chunk_length, 4, "little")
-        + b" " * bin_padding
-    )
-
-
-# --- Tests: Extension validation ---
-
-
-class TestImportGltfExtensionValidation:
-    """Test that only .gltf and .glb files are accepted."""
-
-    def test_rejects_non_gltf_extension(self, client):
-        """Files without .gltf or .glb extension return 400."""
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("test.png", b"fake png data", "image/png")},
-        )
-        assert response.status_code == 400
-        assert ".gltf" in response.json()["detail"].lower() or ".glb" in response.json()["detail"].lower()
-
-    def test_rejects_txt_extension(self, client):
-        """A .txt file is rejected."""
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.txt", b"not a gltf", "text/plain")},
-        )
-        assert response.status_code == 400
-
-
-# --- Tests: .gltf validation ---
-
-
-class TestImportGltfJsonValidation:
-    """Test validation of .gltf (JSON) files."""
-
-    def test_valid_minimal_gltf(self, client):
-        """A minimal valid .gltf is accepted."""
-        data = make_gltf_json(vertex_count=24, materials=2, animations=1)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        body = response.json()
-        assert body["asset_type"] == "model_gltf"
-        assert body["file_size"] == len(json_bytes)
-        assert body["mime_type"] == "model/gltf+json"
-        metadata = json.loads(body["metadata_json"])
-        assert metadata["vertex_count"] == 24
-        assert metadata["material_count"] == 2
-        assert metadata["has_animation"] is True
-
-    def test_rejects_invalid_json(self, client):
-        """Malformed JSON returns 400."""
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("bad.gltf", b"{not valid json", "model/gltf+json")},
-        )
-        assert response.status_code == 400
-        assert "Invalid JSON" in response.json()["detail"]
-
-    def test_rejects_gltf_missing_asset(self, client):
-        """glTF without 'asset' property returns 400."""
-        data = {"scenes": [{}]}
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("no_asset.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 400
-        assert "Missing required 'asset'" in response.json()["detail"]
-
-    def test_rejects_gltf_no_meshes_scenes_nodes(self, client):
-        """glTF with neither scenes, meshes, nor nodes returns 400."""
-        data = {"asset": {"version": "2.0"}, "materials": []}
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("empty.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 400
-        assert "scenes, meshes, or nodes" in response.json()["detail"]
-
-
-# --- Tests: .glb validation ---
-
-
-class TestImportGlbValidation:
-    """Test validation of .glb (binary) files."""
-
-    def test_valid_minimal_glb(self, client):
-        """A minimal valid .glb is accepted."""
-        data = make_gltf_json(vertex_count=12, materials=1)
-        glb_bytes = make_glb(data)
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.glb", glb_bytes, "model/gltf+binary")},
-        )
-        assert response.status_code == 201
-        body = response.json()
-        assert body["asset_type"] == "model_gltf"
-        assert body["file_size"] == len(glb_bytes)
-        assert body["mime_type"] == "model/gltf+binary"
-        metadata = json.loads(body["metadata_json"])
-        assert metadata["vertex_count"] == 12
-        assert metadata["material_count"] == 1
-
-    def test_rejects_invalid_magic_bytes(self, client):
-        """File not starting with 'glTF' magic returns 400."""
-        bad_glb = b"xxxx" + int.to_bytes(2, 4, "little") + int.to_bytes(16, 4, "little")
-        bad_glb += int.to_bytes(4, 4, "little") + b"JSON" + b"{}" + b"BIN" + int.to_bytes(0, 4, "little")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("bad.glb", bad_glb, "model/gltf+binary")},
-        )
-        assert response.status_code == 400
-        assert "magic" in response.json()["detail"].lower()
-
-    def test_rejects_wrong_version(self, client):
-        """glTF version 1 returns 400."""
-        data = {"asset": {"version": "1.0"}}
-        json_bytes = json.dumps(data).encode("utf-8")
-        json_padding = (4 - len(json_bytes) % 4) % 4
-        json_bytes += b" " * json_padding
-        json_len = len(json_bytes)
-
-        header = b"glTF" + int.to_bytes(1, 4, "little") + int.to_bytes(12 + 8 + json_len + 8, 4, "little")
-        chunk = int.to_bytes(json_len, 4, "little") + b"JSON"
-        bin_pad = b"BIN" + int.to_bytes(0, 4, "little")
-
-        glb_bytes = header + chunk + json_bytes + bin_pad
-
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("v1.glb", glb_bytes, "model/gltf+binary")},
-        )
-        assert response.status_code == 400
-        assert "Unsupported glTF version" in response.json()["detail"]
-
-    def test_rejects_too_short(self, client):
-        """A file shorter than 12 bytes returns 400."""
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("tiny.glb", b"glTF123", "model/gltf+binary")},
-        )
-        assert response.status_code == 400
-        assert "too short" in response.json()["detail"].lower()
-
-
-# --- Tests: File size validation ---
-
-
-class TestImportGltfFileSize:
-    """Test file size limits."""
-
-    def test_rejects_oversized_file(self, client):
-        """Files exceeding MAX_UPLOAD_SIZE_MB return 413."""
-        # Create a file larger than the default 100 MB limit
-        large_content = b"X" * (settings.MAX_UPLOAD_SIZE_MB * 1024 * 1024 + 1)
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("big.gltf", large_content, "model/gltf+json")},
-        )
-        assert response.status_code == 413
-        assert "exceeds maximum" in response.json()["detail"].lower()
-
-
-# --- Tests: Metadata extraction ---
-
-
-class TestMetadataExtraction:
-    """Test that metadata is correctly extracted from glTF data."""
-
-    def test_vertex_count_from_meshes(self, client):
-        """Vertex count is extracted from mesh primitives."""
-        data = make_gltf_json(vertex_count=100, materials=0, animations=0)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        metadata = json.loads(response.json()["metadata_json"])
-        assert metadata["vertex_count"] == 100
-
-    def test_material_count(self, client):
-        """Material count is extracted from materials array."""
-        data = make_gltf_json(materials=5, vertex_count=0)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        metadata = json.loads(response.json()["metadata_json"])
-        assert metadata["material_count"] == 5
-
-    def test_has_animation_flag(self, client):
-        """has_animation is True when animations exist."""
-        data = make_gltf_json(animations=3, vertex_count=0)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        metadata = json.loads(response.json()["metadata_json"])
-        assert metadata["has_animation"] is True
-
-    def test_no_animation_flag(self, client):
-        """has_animation is False when no animations exist."""
-        data = make_gltf_json(animations=0, vertex_count=0)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        metadata = json.loads(response.json()["metadata_json"])
-        assert metadata["has_animation"] is False
-
-    def test_bounding_box_extraction(self, client):
-        """Bounding box is extracted from accessor min/max."""
-        data = make_gltf_json(vertex_count=8, has_bounds=True)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        metadata = json.loads(response.json()["metadata_json"])
-        assert metadata["bounding_box"] is not None
-        assert "min" in metadata["bounding_box"]
-        assert "max" in metadata["bounding_box"]
-
-    def test_no_bounding_box_without_accessor_bounds(self, client):
-        """Bounding box is None when accessor has no min/max."""
-        data = make_gltf_json(vertex_count=8, has_bounds=False)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        metadata = json.loads(response.json()["metadata_json"])
-        assert metadata["bounding_box"] is None
-
-
-# --- Tests: Database persistence ---
-
-
-class TestDatabasePersistence:
-    """Test that assets are correctly stored in the database."""
-
-    def test_asset_created_in_db(self, client, db_session, test_user):
-        """An asset record is created in the database."""
-        data = make_gltf_json(vertex_count=10)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-
-        # Verify in database
-        result = db_session.execute(select(Asset).where(Asset.id == response.json()["id"]))
-        asset = result.scalar_one_or_none()
-        assert asset is not None
-        assert asset.asset_type == AssetType.MODEL_GLTF
-        assert asset.owner_id == test_user.id
-        assert asset.file_size == len(json_bytes)
-        assert asset.metadata_json is not None
-
-    def test_file_stored_on_disk(self, client, db_session, test_user):
-        """The file is stored in the upload directory."""
-        data = make_gltf_json(vertex_count=10)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-
-        asset_id = response.json()["id"]
-        upload_dir = Path(settings.UPLOAD_DIR)
-        # The stored file should exist
-        found = False
-        for f in upload_dir.iterdir():
-            if f.name.startswith(f"{asset_id}_"):
-                found = True
-                assert f.read_bytes() == json_bytes
-                break
-        assert found, f"File not found in {upload_dir}"
-
-
-# --- Tests: Filename sanitization ---
-
-
-class TestFilenameSanitization:
-    """Test that filenames are properly sanitized."""
-
-    def test_sanitizes_special_chars(self, client):
-        """Special characters in filename are stripped."""
-        data = make_gltf_json(vertex_count=10)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("my model (1).gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        # The name should be the stem without special chars
-        assert response.json()["name"] == "my model 1"
-
-    def test_preserves_extension(self, client):
-        """The .gltf extension is preserved in the stored file."""
-        data = make_gltf_json(vertex_count=10)
-        json_bytes = json.dumps(data).encode("utf-8")
-        response = client.post(
-            "/api/assets/import-gltf",
-            files={"file": ("model.gltf", json_bytes, "model/gltf+json")},
-        )
-        assert response.status_code == 201
-        upload_dir = Path(settings.UPLOAD_DIR)
-        for f in upload_dir.iterdir():
-            if f.name.endswith(".gltf"):
-                assert f.read_bytes() == json_bytes
-                break

docs/planning/economy.md

@@ -1,295 +0,0 @@
-# Economy — Currency, Marketplace & Creator Payouts — Plan
-
-> **Status:** Planned
-> **Owner:** Platform team
-> **Feature ID:** `economy`
-> **Godot version:** 4.6.2 stable
-> **Backend:** FastAPI + SQLAlchemy (async) + PostgreSQL + Redis
-
-## 1. Overview
-
-This document breaks the **Economy** feature into user stories and right-sized
-implementation tasks. The feature delivers:
-
-- **Virtual currency ("Credits")** — a single, server-authoritative currency
-  with an immutable, append-only transaction ledger.
-- **Premium purchase** — buying Credits with real money through a pluggable
-  payment-provider hook.
-- **Marketplace** — user-generated content (UGC) listings where creators sell
-  items (assets, avatar items, experience passes) to players for Credits.
-- **Creator payouts** — accumulating creator earnings and paying them out to
-  external accounts through a pluggable payout-provider hook.
-- **Godot client** — wallet/transaction history, marketplace browse/buy/sell,
-  and creator payout screens.
-
-The economy is the monetization backbone of the platform. Because it moves
-virtual value between real people, correctness (no double-spend, no lost funds,
-no balance drift) and safety (fraud prevention, moderation, audit) are treated
-as **blocking requirements**, not add-ons.
-
-## 2. Why correctness is the differentiator
-
-The platform is a creator economy (players buy UGC from other players). The
-economy is the highest-risk surface after chat: a single arithmetic or
-concurrency bug can mint or destroy value and irreversibly erode trust.
-Correctness is therefore designed in from the start:
-
-- **One currency, integer units.** Credits are whole-number integers. There are
-  no floats, no rounding, and no client-computed totals.
-- **Append-only ledger.** Every balance change is a row in a `transactions`
-  table with a signed amount, a `balance_after` snapshot, a reference to the
-  event that caused it, and an **idempotency key** so retries cannot double
-  credit or double debit.
-- **Atomic, locked mutations.** Balance changes run in a single database
-  transaction with row locking (`SELECT ... FOR UPDATE`) so concurrent
-  purchases/payouts cannot race.
-- **Escrow hold.** Marketplace proceeds are held in `pending_escrow` for a
-  configurable window before becoming available to the seller, so fraudulent
-  or moderated sales can be reversed without clawing back paid-out funds.
-- **Server-authoritative fees.** The platform commission is computed
-  server-side from a configured rate; the client never supplies the fee or the
-  seller's net.
-
-## 3. Existing constraints (do not re-build)
-
-- **Auth:** JWT bearer tokens; `get_current_user` / `CurrentUser` dependency in
-  `app/dependencies.py`. All economy endpoints reuse this.
-- **DB:** async SQLAlchemy + Alembic; migration `0001_initial` is the head.
-  Existing tables: `users`, `sessions`, `worlds`, `assets`.
-- **Redis:** configured (`REDIS_URL`) but unused so far; adopted here for
-  idempotency short-caching and rate limiting.
-- **Models:** `User` (owner_id), `Asset` (owner_id, is_public, asset_type).
-  Marketplace items reference existing `assets` rows and/or avatar items.
-- **Content moderation:** `docs/architecture/content_moderation.md` defines
-  flag vocabulary, age gate, and moderation actions. Marketplace items and
-  listings must inherit and enforce these rules (see §7).
-- **Client:** Godot 4.6.2, minimal `main_menu.gd`; no economy UI yet.
-
-## 4. Key design decisions
-
-| Concern | Decision |
-|---|---|
-| Currency model | Single virtual currency **"Credits" (CR)**, integer units. One wallet row per user; no fractional amounts. |
-| Ledger | Append-only `transactions` table: signed `amount`, `balance_after`, `reference_type`/`reference_id`, unique `idempotency_key`. |
-| Concurrency | `SELECT ... FOR UPDATE` on the wallet row inside the mutation transaction; never read-modify-write from stale data. |
-| Payments | Pluggable `PaymentProvider` interface with a **no-op default** that simulates a confirmed payment for dev/testing (clearly flagged). Stripe/PayPal later. |
-| Marketplace items | `catalog_items` (what is sold) + `marketplace_listings` (a seller's offer with a price/status). One item can have multiple listings over time. |
-| Purchase flow | Atomic transaction: debit buyer → hold funds in escrow (`pending_escrow`) → grant item. Platform fee computed server-side. |
-| Escrow | Configurable hold window (default 72h) before `pending_escrow` becomes available seller earnings. Refunds during the window reverse the sale. |
-| Fees | Single configurable `MARKETPLACE_FEE_RATE` (default `0.30`). `seller_net = floor(price * (1 - fee_rate))`. |
-| Creator balance | `creator_balances` table: `available` (earned, payable), `pending` (inside an open payout request), `lifetime_earned`. Updated in the same transaction as the sale completion. |
-| Payouts | Pluggable `PayoutProvider.pay()` with a no-op default (simulated external ref). Minimum payout threshold, admin review for large payouts. |
-| Idempotency | Every money-moving request carries a client-generated `Idempotency-Key`; duplicate keys return the original result. |
-| Rate limiting | Redis token-bucket dependency reused from the social feature for purchase/listing/payout endpoints. |
-| Moderation | Listings enforce content flags + age gate; moderators can `delist`/`remove`; fraud/chargeback reversal is an audited admin action. |
-
-## 5. User stories
-
-### US-1 Currency & wallet
-As a player, I can see my Credit balance and transaction history, and the system
-credits/debits my wallet only through server-authoritative events.
-
-**Acceptance criteria**
-- Exactly one wallet per user, created lazily on first use.
-- Balance is always a non-negative integer; no operation can make it negative.
-- Every mutation appends an immutable ledger row with amount, resulting balance,
-  reference, and idempotency key.
-- Retrying a request with the same idempotency key does not double-apply.
-- `GET` endpoints expose current balance and paged transaction history.
-
-### US-2 Premium purchase (buy Credits)
-As a player, I can purchase Credits with real money and have them credited only
-after the payment is confirmed.
-
-**Acceptance criteria**
-- A purchase session is created through the payment provider (or the no-op
-  default) and is idempotent.
-- Credits are granted exactly once, only after a verified provider confirmation
-  (webhook/confirm endpoint), never on client claim.
-- Purchase amounts are bounded and server-defined; clients cannot pick arbitrary
-  prices.
-- Confirmation is idempotent and audited (provider reference recorded).
-
-### US-3 Marketplace listing (sell)
-As a creator, I can list a catalog item for sale at a Credit price and
-manage/remove my listings.
-
-**Acceptance criteria**
-- A listing references a valid `catalog_item` owned by the seller (or an
-  authorized seller).
-- Price is bounded (min/max) and set server-side; status transitions are
-  explicit (`active`, `sold`, `delisted`, `removed_by_moderation`).
-- Only the seller (or a moderator) can update/remove a listing.
-- Listings are searchable/filterable (item type, price range, owner).
-
-### US-4 Marketplace purchase (buy)
-As a player, I can buy a listed item. The purchase is atomic, holds funds in
-escrow, grants the item, and splits the payment between platform and seller.
-
-**Acceptance criteria**
-- A single transaction debits the buyer, holds funds in escrow, and grants the
-  item — no partial states on failure.
-- Platform fee and seller net are computed server-side from the configured rate.
-- After the escrow hold window, funds move from escrow to the seller's
-  available balance.
-- Refunds during the hold window reverse the sale and return funds to the buyer.
-- Concurrent purchases of a one-of-a-kind listing cannot both succeed.
-
-### US-5 Creator payouts
-As a creator, I can view my earned balance, request a payout, and track its
-status; admins can review and approve/reject payouts.
-
-**Acceptance criteria**
-- Available balance is derived only from completed (escrow-released) sales and
-  completed payouts; it never goes negative.
-- Payout requests are bounded (min threshold, max per period) and rate-limited.
-- Large payouts require admin review; all payout requests carry an audit trail
-  (requested by, reviewed by, provider reference, status).
-- The payout provider is called exactly once; idempotent on retry.
-
-### US-6 Godot client
-As a player, I can manage Credits, browse/buy/sell marketplace items, and manage
-payouts from the game UI.
-
-**Acceptance criteria**
-- An API client handles JWT auth, HTTP, and idempotency keys for all economy
-  calls.
-- Dedicated screens: wallet + transaction history, marketplace browse/buy,
-  sell-listing, and creator payout.
-- The client never computes balances, fees, or seller nets — it only displays
-  server responses.
-
-## 6. Task breakdown
-
-Right-sized to 1–3 files / one coherent piece of functionality each. Task IDs
-are sequential for dependency chaining.
-
-| # | Task | Story | Depends on |
-|---|------|-------|-----------|
-| 1 | Wallet & ledger models + Alembic migration (`wallets`, `transactions`) | US-1 | — |
-| 2 | Wallet service (atomic credit/debit, idempotency, locking) + wallet/transactions API | US-1 | 1 |
-| 3 | Premium purchase: `PaymentProvider` interface + purchase/confirm endpoints | US-2 | 1 |
-| 4 | Catalog item & listing models + migration (`catalog_items`, `marketplace_listings`, `creator_balances`) | US-3 | 1 |
-| 5 | Marketplace listing API (create/list/search/update/remove) | US-3 | 4 |
-| 6 | Marketplace purchase service + API (atomic escrow, fee split, item grant) | US-4 | 2, 4, 5 |
-| 7 | Creator payout request models + API (`payout_requests`) | US-5 | 2, 6 |
-| 8 | Payout admin review + `PayoutProvider` + audit | US-5 | 7 |
-| 9 | Marketplace moderation + content-flag/age-gate enforcement | cross-cutting | 5, 6 |
-| 10 | Godot economy API client (auth + HTTP + idempotency) | US-6 | 2 |
-| 11 | Godot wallet & transaction history UI | US-6 | 10 |
-| 12 | Godot marketplace browse/buy UI | US-6 | 6, 10 |
-| 13 | Godot selling & payout UI | US-6 | 5, 7, 10 |
-
-## 7. Phasing
-
-- **Phase 1 (currency + payments):** tasks 1–3. The foundation — ledger and
-  money movement must be rock-solid before anything spends Credits.
-- **Phase 2 (marketplace):** tasks 4–6. Listing and atomic purchase with escrow.
-- **Phase 3 (payouts):** tasks 7–8. Turn released escrow into creator payouts.
-- **Phase 4 (moderation):** task 9. Lock down the marketplace against mature
-  content and abuse.
-- **Phase 5 (client):** tasks 10–13, each landing after its backend dependency.
-
-## 8. Data model sketch
-
-```text
-wallets
-  id                bigint PK
-  user_id           int UNIQUE FK -> users.id
-  balance           bigint NOT NULL DEFAULT 0  CHECK (balance >= 0)
-  created_at        timestamptz
-  updated_at        timestamptz
-
-transactions        (append-only ledger)
-  id                bigint PK
-  wallet_id         bigint FK -> wallets.id
-  type              enum(credit_purchase, marketplace_purchase,
-                        marketplace_sale, escrow_release, payout,
-                        refund, admin_adjustment)
-  amount            bigint NOT NULL            (signed)
-  balance_after     bigint NOT NULL
-  reference_type    text                        (e.g. "purchase", "sale", "payout_request")
-  reference_id      text
-  idempotency_key   text UNIQUE
-  metadata_json     jsonb
-  created_at        timestamptz
-
-catalog_items
-  id                bigint PK
-  owner_id          int FK -> users.id
-  asset_id          int FK -> assets.id (nullable; null for non-asset virtual items)
-  item_type         enum(asset, avatar_item, experience_pass)
-  name              text
-  description       text
-  metadata_json     jsonb
-  created_at        timestamptz
-
-marketplace_listings
-  id                bigint PK
-  catalog_item_id   bigint FK -> catalog_items.id
-  seller_id         int FK -> users.id
-  price             bigint NOT NULL CHECK (price > 0)
-  status            enum(active, sold, delisted, removed_by_moderation)
-  created_at        timestamptz
-  updated_at        timestamptz
-
-purchases
-  id                bigint PK
-  listing_id        bigint FK -> marketplace_listings.id
-  buyer_id          int FK -> users.id
-  seller_id         int FK -> users.id
-  price             bigint NOT NULL
-  platform_fee      bigint NOT NULL
-  seller_net        bigint NOT NULL
-  status            enum(pending_escrow, completed, refunded, reversed)
-  escrow_hold_until timestamptz
-  created_at        timestamptz
-
-creator_balances
-  id                bigint PK
-  user_id           int UNIQUE FK -> users.id
-  available         bigint NOT NULL DEFAULT 0
-  pending           bigint NOT NULL DEFAULT 0
-  lifetime_earned   bigint NOT NULL DEFAULT 0
-  updated_at        timestamptz
-
-payout_requests
-  id                bigint PK
-  creator_id        int FK -> users.id
-  amount            bigint NOT NULL CHECK (amount > 0)
-  status            enum(pending, approved, paid, rejected)
-  external_ref      text
-  provider_ref      text
-  requested_by      int FK -> users.id
-  reviewed_by       int FK -> users.id (nullable)
-  reviewed_at       timestamptz
-  created_at        timestamptz
-```
-
-## 9. Security, anti-fraud & audit
-
-- **Server-authoritative balances/fees:** clients never compute totals; amounts
-  are validated server-side against bounds and the current listing.
-- **Row locking:** wallet and creator-balance mutations use `SELECT ... FOR
-  UPDATE` within one transaction.
-- **Idempotency:** every money-moving endpoint requires an `Idempotency-Key`;
-  duplicate keys return the stored original outcome.
-- **Rate limiting:** purchase, listing, and payout endpoints are token-bucket
-  rate-limited per user.
-- **Escrow & reversibility:** funds are not payable until the hold window
-  elapses; chargebacks/refunds reverse before release.
-- **Moderation:** listings carry the item's effective content flags; mature
-  items require age verification (per `content_moderation.md`); moderators can
-  `delist`/`remove` and trigger audited reversals.
-- **Audit:** the ledger plus `payout_requests` review fields form an append-only
-  audit trail for every movement of value.
-
-## 10. Out of scope for this feature
-
-- Real Stripe/PayPal/KYC integrations (provider interfaces leave the hooks; the
-  defaults are deterministic no-ops).
-- Subscriptions, recurring billing, or premium memberships.
-- Gift cards, promotional codes, or user-to-user Credit transfers.
-- Partial refunds, chargeback disputes, and seller tax/VAT handling.
-- In-world vending machines / scripted economy triggers (future, built on this
-  ledger via the scripting sandbox).