"/report/user":
    post:
        tags: [Reports]
        operationId: reportAccount
        summary: Report a user account
        description: |
            Submits an account report. Restricted to the `cloud-api`
            bearer (`restrictRequestToApp("cloud-api")`) — `cloud_api`
            forwards reports filed by end users; the public client does
            not call this directly. Returns `{ message: "OK" }` on
            success.
        security:
            - apiKey: []
              accessToken: []
        requestBody:
            required: true
            content:
                application/json:
                    schema:
                        type: object
                        required: [targetSocialId, reason]
                        properties:
                            targetSocialId:
                                type: string
                                description: Social id of the account being reported.
                            reason:
                                type: string
                                description: |
                                    Free-form report text. The reporting
                                    client typically combines a coarse
                                    category and the user's free input.
                            metaData:
                                type: object
                                additionalProperties: true
        responses:
            "200":
                description: Report accepted.
                content:
                    application/json:
                        schema:
                            type: object
                            required: [message]
                            properties:
                                message: { type: string, example: OK }
            "401": { $ref: "../public-api.yaml#/components/responses/Unauthorized" }
            "403":
                description: Caller bearer is not the `cloud-api` app.
                content:
                    application/json:
                        schema: { $ref: "../public-api.yaml#/components/schemas/Error" }
            "404":
                description: Reported user not found.
                content:
                    application/json:
                        schema: { $ref: "../public-api.yaml#/components/schemas/Error" }

"/report/room":
    post:
        tags: [Reports]
        operationId: reportRoom
        summary: Report a room
        description: |
            Submits a room report. Same restriction as `/report/user` —
            only the `cloud-api` bearer is admitted. Returns
            `{ message: "OK" }` on success.
        security:
            - apiKey: []
              accessToken: []
        requestBody:
            required: true
            content:
                application/json:
                    schema:
                        type: object
                        required: [reason, roomSnapshot]
                        properties:
                            reason:
                                type: string
                                description: Free-form report text.
                            roomSnapshot:
                                type: object
                                description: |
                                    Snapshot of the room at the time of
                                    reporting — denormalised so the
                                    report survives room deletion.
                                additionalProperties: true
                            roomCreatorSocialId:
                                type: string
                                description: Social id of the room creator, when known.
                            metaData:
                                type: object
                                additionalProperties: true
        responses:
            "200":
                description: Report accepted.
                content:
                    application/json:
                        schema:
                            type: object
                            required: [message]
                            properties:
                                message: { type: string, example: OK }
            "401": { $ref: "../public-api.yaml#/components/responses/Unauthorized" }
            "403":
                description: Caller bearer is not the `cloud-api` app.
                content:
                    application/json:
                        schema: { $ref: "../public-api.yaml#/components/schemas/Error" }
