feat(privacy): add private-message permission toggle

app/users/models.py

@@ -23,6 +23,7 @@ class User(Base):
     avatar_url: Mapped[str | None] = mapped_column(String(512), nullable=True)
     bio: Mapped[str | None] = mapped_column(String(500), nullable=True)
     email_verified: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False, index=True)
+    allow_private_messages: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False, server_default="true")
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now(), nullable=False)
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True),

app/users/router.py

@@ -59,6 +59,7 @@ async def update_profile(
         username=payload.username,
         bio=payload.bio,
         avatar_url=payload.avatar_url,
+        allow_private_messages=payload.allow_private_messages,
     )
     return updated
 

app/users/schemas.py

@@ -20,6 +20,7 @@ class UserRead(UserBase):
     avatar_url: str | None = None
     bio: str | None = None
     email_verified: bool
+    allow_private_messages: bool
     created_at: datetime
     updated_at: datetime
 
@@ -29,6 +30,7 @@ class UserProfileUpdate(BaseModel):
     username: str | None = Field(default=None, min_length=3, max_length=50)
     bio: str | None = Field(default=None, max_length=500)
     avatar_url: str | None = Field(default=None, max_length=512)
+    allow_private_messages: bool | None = None
 
 
 class UserSearchRead(BaseModel):

app/users/service.py

@@ -40,6 +40,7 @@ async def update_user_profile(
     username: str | None = None,
     bio: str | None = None,
     avatar_url: str | None = None,
+    allow_private_messages: bool | None = None,
 ) -> User:
     if name is not None:
         user.name = name
@@ -49,6 +50,8 @@ async def update_user_profile(
         user.bio = bio
     if avatar_url is not None:
         user.avatar_url = avatar_url
+    if allow_private_messages is not None:
+        user.allow_private_messages = allow_private_messages
     await db.commit()
     await db.refresh(user)
     return user