feat: review delete/update AP propagation, remote actor avatars, OpenAPI updates

- Send Delete activity when a review is deleted
- Send Update(Note) activity when a review is edited
- Remote actor avatars shown in followers/following pages
- OpenAPI spec updated with profile, blocked domains, blocked actor endpoints
- Fix: worker wire() call missing allow_registration argument

crates/presentation/src/dtos.rs

@@ -495,20 +495,20 @@ pub struct MovieDetailResponse {
     pub reviews: SocialFeedResponse,
 }
 
-#[derive(serde::Serialize)]
+#[derive(serde::Serialize, utoipa::ToSchema)]
 pub struct BlockedDomainResponse {
     pub domain: String,
     pub reason: Option<String>,
     pub blocked_at: String,
 }
 
-#[derive(serde::Deserialize)]
+#[derive(serde::Deserialize, utoipa::ToSchema)]
 pub struct AddBlockedDomainRequest {
     pub domain: String,
     pub reason: Option<String>,
 }
 
-#[derive(serde::Serialize)]
+#[derive(serde::Serialize, utoipa::ToSchema)]
 pub struct BlockedActorResponse {
     pub url: String,
     pub handle: String,

crates/presentation/src/handlers/api.rs

@@ -412,6 +412,15 @@ fn entry_to_dto(entry: &DiaryEntry) -> DiaryEntryDto {
 }
 
 #[cfg(feature = "federation")]
+#[utoipa::path(
+    get, path = "/api/v1/admin/blocked-domains",
+    responses(
+        (status = 200, body = Vec<crate::dtos::BlockedDomainResponse>),
+        (status = 401, description = "Unauthorized"),
+        (status = 403, description = "Forbidden — admin only"),
+    ),
+    security(("bearer_auth" = []))
+)]
 pub async fn get_blocked_domains_admin(
     State(state): State<AppState>,
     _admin: crate::extractors::AdminUser,
@@ -433,6 +442,16 @@ pub async fn get_blocked_domains_admin(
 }
 
 #[cfg(feature = "federation")]
+#[utoipa::path(
+    post, path = "/api/v1/admin/blocked-domains",
+    request_body = crate::dtos::AddBlockedDomainRequest,
+    responses(
+        (status = 201, description = "Domain blocked"),
+        (status = 401, description = "Unauthorized"),
+        (status = 403, description = "Forbidden — admin only"),
+    ),
+    security(("bearer_auth" = []))
+)]
 pub async fn add_blocked_domain_admin(
     State(state): State<AppState>,
     _admin: crate::extractors::AdminUser,
@@ -445,6 +464,16 @@ pub async fn add_blocked_domain_admin(
 }
 
 #[cfg(feature = "federation")]
+#[utoipa::path(
+    delete, path = "/api/v1/admin/blocked-domains/{domain}",
+    params(("domain" = String, Path, description = "Domain to unblock")),
+    responses(
+        (status = 204, description = "Domain unblocked"),
+        (status = 401, description = "Unauthorized"),
+        (status = 403, description = "Forbidden — admin only"),
+    ),
+    security(("bearer_auth" = []))
+)]
 pub async fn remove_blocked_domain_admin(
     State(state): State<AppState>,
     _admin: crate::extractors::AdminUser,
@@ -457,6 +486,15 @@ pub async fn remove_blocked_domain_admin(
 }
 
 #[cfg(feature = "federation")]
+#[utoipa::path(
+    post, path = "/api/v1/social/block",
+    request_body = ActorUrlRequest,
+    responses(
+        (status = 204, description = "Actor blocked"),
+        (status = 401, description = "Unauthorized"),
+    ),
+    security(("bearer_auth" = []))
+)]
 pub async fn block_actor_api(
     State(state): State<AppState>,
     user: AuthenticatedUser,
@@ -469,6 +507,15 @@ pub async fn block_actor_api(
 }
 
 #[cfg(feature = "federation")]
+#[utoipa::path(
+    post, path = "/api/v1/social/unblock",
+    request_body = ActorUrlRequest,
+    responses(
+        (status = 204, description = "Actor unblocked"),
+        (status = 401, description = "Unauthorized"),
+    ),
+    security(("bearer_auth" = []))
+)]
 pub async fn unblock_actor_api(
     State(state): State<AppState>,
     user: AuthenticatedUser,
@@ -481,6 +528,14 @@ pub async fn unblock_actor_api(
 }
 
 #[cfg(feature = "federation")]
+#[utoipa::path(
+    get, path = "/api/v1/social/blocked",
+    responses(
+        (status = 200, body = Vec<crate::dtos::BlockedActorResponse>),
+        (status = 401, description = "Unauthorized"),
+    ),
+    security(("bearer_auth" = []))
+)]
 pub async fn get_blocked_actors_api(
     State(state): State<AppState>,
     user: AuthenticatedUser,

crates/presentation/src/handlers/html.rs

@@ -481,6 +481,7 @@ pub async fn get_users_list(
                     handle: a.handle,
                     display_name: a.display_name,
                     url: a.url,
+                    avatar_url: None,
                 })
                 .collect();
             let data = application::ports::UsersPageData {
@@ -619,6 +620,7 @@ pub async fn get_user_profile(
                 handle: a.handle,
                 url: a.url,
                 display_name: a.display_name,
+                avatar_url: a.avatar_url.clone(),
             })
             .collect()
     } else {
@@ -818,6 +820,7 @@ pub async fn get_following_page(
                     handle: a.handle,
                     display_name: a.display_name,
                     url: a.url,
+                    avatar_url: a.avatar_url.clone(),
                 })
                 .collect();
             let data = FollowingPageData {
@@ -871,6 +874,7 @@ pub async fn get_followers_page(
                     handle: a.handle,
                     display_name: a.display_name,
                     url: a.url,
+                    avatar_url: a.avatar_url.clone(),
                 })
                 .collect();
             let data = FollowersPageData {

crates/presentation/src/openapi.rs

@@ -7,15 +7,18 @@ use crate::dtos::{
     ActivityFeedResponse, DiaryEntryDto, DiaryResponse,
     DirectorStatDto, FeedEntryDto, LoginRequest, LoginResponse, LogReviewRequest,
     MonthActivityDto, MonthlyRatingDto, MovieDetailResponse, MovieDto, MovieStatsDto,
-    RegisterRequest, ReviewDto, ReviewHistoryResponse, SocialFeedResponse, SocialReviewDto,
-    UserProfileResponse, UserStatsDto, UserSummaryDto, UserTrendsDto, UsersResponse,
+    ProfileResponse, RegisterRequest, ReviewDto, ReviewHistoryResponse, SocialFeedResponse,
+    SocialReviewDto, UserProfileResponse, UserStatsDto, UserSummaryDto, UserTrendsDto, UsersResponse,
 };
 use crate::handlers::import::{
     ApiFieldMapping, ApplyMappingRequest, ConfirmRequest, SaveProfileRequest,
     SessionCreatedResponse, SessionStateResponse,
 };
 #[cfg(feature = "federation")]
-use crate::dtos::{ActorListResponse, ActorUrlRequest, FollowRequest, RemoteActorDto};
+use crate::dtos::{
+    ActorListResponse, ActorUrlRequest, BlockedActorResponse, BlockedDomainResponse,
+    AddBlockedDomainRequest, FollowRequest, RemoteActorDto,
+};
 
 struct SecurityAddon;
 
@@ -57,6 +60,8 @@ impl Modify for SecurityAddon {
         crate::handlers::import::api_get_profiles,
         crate::handlers::import::api_post_profile,
         crate::handlers::import::api_delete_profile,
+        crate::handlers::api::get_profile,
+        crate::handlers::api::update_profile_handler,
     ),
     components(schemas(
         DiaryResponse,
@@ -82,6 +87,7 @@ impl Modify for SecurityAddon {
         MonthlyRatingDto,
         DirectorStatDto,
         UserTrendsDto,
+        ProfileResponse,
         SessionCreatedResponse,
         SessionStateResponse,
         ApiFieldMapping,
@@ -122,6 +128,14 @@ pub struct ApiDoc;
         crate::handlers::api::accept_follower,
         crate::handlers::api::reject_follower,
         crate::handlers::api::remove_follower,
+        crate::handlers::api::get_profile,
+        crate::handlers::api::update_profile_handler,
+        crate::handlers::api::get_blocked_domains_admin,
+        crate::handlers::api::add_blocked_domain_admin,
+        crate::handlers::api::remove_blocked_domain_admin,
+        crate::handlers::api::block_actor_api,
+        crate::handlers::api::unblock_actor_api,
+        crate::handlers::api::get_blocked_actors_api,
         crate::handlers::import::api_post_session,
         crate::handlers::import::api_get_session,
         crate::handlers::import::api_put_mapping,
@@ -148,6 +162,10 @@ pub struct ApiDoc;
         RemoteActorDto,
         FollowRequest,
         ActorUrlRequest,
+        ProfileResponse,
+        BlockedDomainResponse,
+        AddBlockedDomainRequest,
+        BlockedActorResponse,
         ActivityFeedResponse,
         FeedEntryDto,
         UsersResponse,