trolls PMs are invisible to other users

modules/message/src/main/Api.scala

@@ -8,6 +8,7 @@ import lila.db.Implicits._
 import lila.db.paginator._
 import lila.hub.actorApi.message._
 import lila.hub.actorApi.SendTo
+import lila.security.Granter
 import lila.user.{ User, UserRepo }
 import tube.threadTube
 
@@ -36,12 +37,20 @@ final class Api(
     )
   } yield threadOption
 
-  def makeThread(data: DataForm.ThreadData, me: User): Fu[Thread] = Thread.make(
-    name = data.subject,
-    text = data.text,
-    creatorId = me.id,
-    invitedId = data.user.id) |> { thread ⇒
-      $insert(thread) >>- updateUser(data.user.id) inject thread
+  def makeThread(data: DataForm.ThreadData, me: User): Fu[Thread] =
+    UserRepo named data.user.id flatMap {
+      _.fold(fufail[Thread]("No such recipient")) { invited ⇒
+        Thread.make(
+          name = data.subject,
+          text = data.text,
+          creatorId = me.id,
+          invitedId = data.user.id) |> { t ⇒
+            val thread = (me.troll && !Granter(_.MarkTroll)(invited)).fold(
+              t deleteFor invited,
+              t)
+            $insert(thread) >>- updateUser(invited.id) inject thread
+          }
+      }
     }
 
   def lichessThread(lt: LichessThread): Funit = Thread.make(

modules/message/src/main/Thread.scala

@@ -46,6 +46,10 @@ case class Thread(
   def receiverOf(post: Post) = post.isByCreator.fold(invitedId, creatorId)
 
   def nonEmptyName = (name.trim.some filter (_.nonEmpty)) | "No subject"
+
+  def deleteFor(user: User) = copy(
+    visibleByUserIds = visibleByUserIds filter (user.id !=)
+  )
 }
 
 object Thread {

project/Build.scala

@@ -121,7 +121,7 @@ object ApplicationBuild extends Build {
     libraryDependencies ++= provided(play.api, reactivemongo, playReactivemongo)
   )
 
-  lazy val message = project("message", Seq(common, db, user, hub, relation)).settings(
+  lazy val message = project("message", Seq(common, db, user, hub, relation, security)).settings(
     libraryDependencies ++= provided(
       play.api, reactivemongo, playReactivemongo, spray.caching)
   )

todo

@@ -68,6 +68,10 @@ unload event http://en.lichess.org/forum/redirect/post/lnsqfhli
 friend box hide on click http://en.lichess.org/forum/lichess-feedback/new-lichess-1#3
 can't delete messages http://www.youtube.com/watch?v=vPNS49ygvCI&feature=youtu.be
 preview board should never touch undertables
+denormalize user.count.*
+forum search bug http://en.lichess.org/forum/search?text=user:SOHAIB
+troll messages
+games with you on own page
 
 ---