User Blocking & Safety Mechanisms

Missing user blocking is a critical safety gap under OWASP A01 (Broken Access Control) and CWE-284. Without a blocking system enforced at the query layer, a harassing user remains visible in every surface — profile, feed, search, messaging — regardless of victim intent. This is not merely a UX problem: platforms have faced regulatory scrutiny and civil liability for enabling sustained contact after victims attempted to block. Enforcement must happen at the database level; client-side filtering leaks data before it is suppressed.

Create a Block table with a composite unique index on (blockerId, blockedId) and enforce the block check in every query that returns user content — profile fetches, feed queries, and search results.

// lib/db.ts
export async function getProfile(userId: string, viewerId: string) {
  const isBlocked = await db.block.findFirst({
    where: {
      OR: [
        { blockerId: viewerId, blockedId: userId },
        { blockerId: userId, blockedId: viewerId }
      ]
    }
  })
  if (isBlocked) return null
  return db.user.findUnique({ where: { id: userId } })
}

Apply the same NOT IN (blocked_ids) filter to feed queries and search results. A block check that only covers profiles but not feeds gives a false sense of safety.