Add message reporting and account deletion

- Add user message reporting via long press menu
- Add delete-account edge function for App Store compliance
- Update admin moderation page with AI/User tabs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/supabase/functions/delete-account/index.ts

@@ -0,0 +1,204 @@
+import "jsr:@supabase/functions-js/edge-runtime.d.ts";
+import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
+
+const corsHeaders = {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
+};
+
+interface ExpoPushMessage {
+    to: string;
+    title: string;
+    body: string;
+    sound?: string;
+    data?: Record<string, unknown>;
+}
+
+async function sendExpoPushNotifications(messages: ExpoPushMessage[]) {
+    if (messages.length === 0) return;
+
+    const response = await fetch("https://exp.host/--/api/v2/push/send", {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+        },
+        body: JSON.stringify(messages),
+    });
+
+    if (!response.ok) {
+        const error = await response.text();
+        console.error("Expo push error:", error);
+    }
+
+    return response.json();
+}
+
+Deno.serve(async (req) => {
+    // Handle CORS preflight
+    if (req.method === "OPTIONS") {
+        return new Response("ok", { headers: corsHeaders });
+    }
+
+    if (req.method !== "DELETE") {
+        return new Response(
+            JSON.stringify({ error: "Method not allowed" }),
+            { status: 405, headers: { ...corsHeaders, "Content-Type": "application/json" } }
+        );
+    }
+
+    try {
+        const supabase = createClient(
+            Deno.env.get("SUPABASE_URL")!,
+            Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!
+        );
+
+        // Get user from JWT
+        const authHeader = req.headers.get("Authorization");
+        if (!authHeader) {
+            return new Response(
+                JSON.stringify({ error: "Missing authorization header" }),
+                { status: 401, headers: { ...corsHeaders, "Content-Type": "application/json" } }
+            );
+        }
+
+        const { data: { user }, error: authError } = await supabase.auth.getUser(
+            authHeader.replace("Bearer ", "")
+        );
+
+        if (authError || !user) {
+            console.error("Auth Error:", authError);
+            return new Response(
+                JSON.stringify({ error: `Invalid token: ${authError?.message || 'No user found'}` }),
+                { status: 401, headers: { ...corsHeaders, "Content-Type": "application/json" } }
+            );
+        }
+
+        // Get user's profile
+        const { data: profile, error: profileError } = await supabase
+            .from("profiles")
+            .select("couple_id")
+            .eq("id", user.id)
+            .maybeSingle();
+
+        if (profileError) {
+            console.error("Profile fetch error:", profileError);
+            return new Response(
+                JSON.stringify({ error: "Failed to fetch profile" }),
+                { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } }
+            );
+        }
+
+        // If user is in a relationship, handle couple data deletion
+        if (profile?.couple_id) {
+            const coupleId = profile.couple_id;
+
+            // Get partner's push token BEFORE clearing data
+            const { data: partnerProfile } = await supabase
+                .from("profiles")
+                .select("push_token")
+                .eq("couple_id", coupleId)
+                .neq("id", user.id)
+                .maybeSingle();
+
+            // Get all match IDs for this couple (needed for storage cleanup)
+            const { data: matches } = await supabase
+                .from("matches")
+                .select("id")
+                .eq("couple_id", coupleId);
+
+            const matchIds = matches?.map(m => m.id) || [];
+
+            // Delete all chat media from storage for each match
+            for (const matchId of matchIds) {
+                const { data: files } = await supabase.storage
+                    .from("chat-media")
+                    .list(matchId);
+
+                if (files && files.length > 0) {
+                    const filePaths = files.map(f => `${matchId}/${f.name}`);
+                    await supabase.storage
+                        .from("chat-media")
+                        .remove(filePaths);
+                }
+            }
+
+            // Clear couple_id from partner's profile (don't clear our own yet, will be deleted)
+            await supabase
+                .from("profiles")
+                .update({ couple_id: null })
+                .eq("couple_id", coupleId)
+                .neq("id", user.id);
+
+            // Delete the couple record (cascades to responses, matches, messages, couple_packs)
+            const { error: deleteError } = await supabase
+                .from("couples")
+                .delete()
+                .eq("id", coupleId);
+
+            if (deleteError) {
+                console.error("Failed to delete couple:", deleteError);
+                // Continue anyway - we still want to delete the account
+            }
+
+            // Notify partner about the account deletion
+            if (partnerProfile?.push_token) {
+                await sendExpoPushNotifications([{
+                    to: partnerProfile.push_token,
+                    title: "Partner Left",
+                    body: "Your partner has deleted their account. You can start fresh with a new partner anytime.",
+                    sound: "default",
+                    data: { type: "partner_account_deleted" },
+                }]);
+            }
+        }
+
+        // Delete any avatar from storage
+        const { data: avatarFiles } = await supabase.storage
+            .from("avatars")
+            .list(user.id);
+
+        if (avatarFiles && avatarFiles.length > 0) {
+            const avatarPaths = avatarFiles.map(f => `${user.id}/${f.name}`);
+            await supabase.storage
+                .from("avatars")
+                .remove(avatarPaths);
+        }
+
+        // Delete the user's profile (this will cascade delete any orphaned responses)
+        const { error: profileDeleteError } = await supabase
+            .from("profiles")
+            .delete()
+            .eq("id", user.id);
+
+        if (profileDeleteError) {
+            console.error("Failed to delete profile:", profileDeleteError);
+            return new Response(
+                JSON.stringify({ error: "Failed to delete profile" }),
+                { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } }
+            );
+        }
+
+        // Delete the user from auth.users using admin API
+        const { error: authDeleteError } = await supabase.auth.admin.deleteUser(user.id);
+
+        if (authDeleteError) {
+            console.error("Failed to delete auth user:", authDeleteError);
+            return new Response(
+                JSON.stringify({ error: "Failed to delete authentication record" }),
+                { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } }
+            );
+        }
+
+        return new Response(
+            JSON.stringify({ success: true, message: "Account deleted successfully" }),
+            { headers: { ...corsHeaders, "Content-Type": "application/json" } }
+        );
+    } catch (error) {
+        console.error("Error:", error);
+        return new Response(
+            JSON.stringify({ error: "Internal server error" }),
+            { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } }
+        );
+    }
+});

apps/supabase/migrations/20260107000000_add_message_reports.sql

@@ -0,0 +1,65 @@
+-- Create enum for report reasons
+CREATE TYPE report_reason AS ENUM ('harassment', 'spam', 'inappropriate_content', 'other');
+
+-- Create message_reports table
+CREATE TABLE message_reports (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    message_id UUID NOT NULL REFERENCES messages(id) ON DELETE CASCADE,
+    reporter_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    reason report_reason NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'reviewed', 'dismissed')),
+    reviewed_by UUID REFERENCES auth.users(id),
+    reviewed_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT now(),
+
+    -- Prevent duplicate reports from same user
+    UNIQUE(message_id, reporter_id)
+);
+
+-- Indexes for efficient queries
+CREATE INDEX idx_message_reports_status ON message_reports(status);
+CREATE INDEX idx_message_reports_created ON message_reports(created_at DESC);
+CREATE INDEX idx_message_reports_message ON message_reports(message_id);
+
+-- Enable RLS
+ALTER TABLE message_reports ENABLE ROW LEVEL SECURITY;
+
+-- RLS Policies
+
+-- Users can view their own reports
+CREATE POLICY "Users can view own reports"
+    ON message_reports FOR SELECT
+    USING (reporter_id = auth.uid());
+
+-- Users can create reports for messages in their couple's matches (but NOT their own messages)
+CREATE POLICY "Users can report partner messages"
+    ON message_reports FOR INSERT
+    WITH CHECK (
+        reporter_id = auth.uid() AND
+        EXISTS (
+            SELECT 1 FROM messages m
+            JOIN matches ma ON ma.id = m.match_id
+            JOIN profiles p ON p.couple_id = ma.couple_id
+            WHERE m.id = message_reports.message_id
+            AND p.id = auth.uid()
+            AND m.user_id != auth.uid()  -- Cannot report own messages
+        )
+    );
+
+-- Admins can view all reports
+CREATE POLICY "Admins can view all reports"
+    ON message_reports FOR SELECT
+    USING (is_admin());
+
+-- Admins can update reports (for review status)
+CREATE POLICY "Admins can update reports"
+    ON message_reports FOR UPDATE
+    USING (is_admin());
+
+-- Add to realtime for live updates in admin
+ALTER PUBLICATION supabase_realtime ADD TABLE message_reports;
+
+-- Comments
+COMMENT ON TABLE message_reports IS 'User-submitted reports for messages. Separate from AI moderation (moderation_status on messages table).';
+COMMENT ON COLUMN message_reports.status IS 'Report status: pending (new), reviewed (action taken), dismissed (no action needed).';
+COMMENT ON COLUMN message_reports.reason IS 'User-selected reason for reporting: harassment, spam, inappropriate_content, or other.';