Moderate display names using club word filter

service/person/__init__.py

@@ -289,6 +289,18 @@ def put_audio_in_object_store(
         for future in as_completed(futures):
             future.result()
 
+def is_allowed_club_name(name: str) -> bool:
+    q = _Q_IS_ALLOWED_CLUB_NAME.replace('%()s', '%(club_name)s')
+
+    params = dict(club_name=club_name)
+
+    with api_tx() as tx:
+        row = tx.execute(q, params).fetchone()
+        return bool(row['is_allowed_club_name'])
+
+def is_allowed_display_name(name: str) -> bool:
+    return is_allowed_club_name(name)
+
 def post_answer(req: t.PostAnswer, s: t.SessionInfo):
     params_add_yes_no_count = dict(
         question_id=req.question_id,
@@ -460,6 +472,9 @@ def patch_onboardee_info(req: t.PatchOnboardeeInfo, s: t.SessionInfo):
     [field_name] = req.__pydantic_fields_set__
     field_value = req.dict()[field_name]
 
+    if field_name == 'name' and not is_allowed_display_name(field_value):
+        return '', 403
+
     if field_name in ['name', 'date_of_birth', 'about']:
         params = dict(
             email=s.email,
@@ -927,6 +942,9 @@ def patch_profile_info(req: t.PatchProfileInfo, s: t.SessionInfo):
 
     base64_audio_file = None
 
+    if field_name == 'name' and not is_allowed_display_name(field_value):
+        return '', 403
+
     if field_name == 'base64_file':
         base64_file = t.Base64File(**field_value)
 

test/functionality1/banned-display-names.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+cd "$script_dir"
+
+source ../util/setup.sh
+
+set -xe
+
+! ../util/create-user.sh i_hate_minorities 0 0
+  ../util/create-user.sh i_love_minorities 0 0
+
+assume_role i_love_minorities
+
+! jc PATCH /profile-info -d '{ "name": "i hate minorities" }'
+  jc PATCH /profile-info -d '{ "name": "i love minorities" }'

test/util/create-user.sh

@@ -91,8 +91,10 @@ main () {
 
   SESSION_TOKEN=$(echo "$response" | jq -r '.session_token')
 
+  local display_name=$(printf "$username_or_email" | tr _ ' ')
+
   jc POST /check-otp -d '{ "otp": "000000" }' > /dev/null
-  jc PATCH /onboardee-info -d '{ "name": "'"$username_or_email"'" }'
+  jc PATCH /onboardee-info -d '{ "name": "'"$display_name"'" }'
   jc PATCH /onboardee-info -d '{ "date_of_birth": "'$( \
     date -d "-26 years -6 months" "+%Y-%m-%d")'" }'
   jc PATCH /onboardee-info -d '{ "location": "New York, New York, United States" }'