theme-social-network

name	theme-social_network
description	Social-network application palette: variants, pages, entities, and flows for building a varied social app. Use when theme_preset is social_network.

Social network theme

Domain

Apps built around user profiles, connections, posts, and direct messages. The privacy boundaries (who can see a profile/post/DM) and the state-changing actions (follow, like, post) are where access and CSRF exploits live.

Application variants — pick ONE per lab

Honor any hint in theme_free_text / custom_prompt; otherwise pick one.

• Microblog feed — short posts, follows, likes, reposts.
• Photo sharing — image posts, albums, comments, tags.
• Forum / community — boards, threads, replies, votes.
• Professional network — profiles, connections, endorsements, jobs.
• Messaging app — conversations, contacts, groups.
• Dating app — profiles, swipes/likes, matches, chat once matched.
• Audio rooms / podcast social — live rooms or episodes, hosts, follows, reactions.

Roles — choose the set that fits the variant

• anon — view public profiles/posts (where applicable).
• user (member) — post, follow, like, message, manage own privacy.
• moderator — forum variant: lock/delete threads, ban.
• admin — manage users, all content, settings.

Most exploits run as user.

Candidate pages — select a coherent subset

Size the subset to endpoint_count. Candidates: feed/home, profile (own & others), post detail, create post, followers/following, friend/connection requests, direct messages, conversation detail, notifications, search/discover, settings/privacy, albums / photo detail / tags (photo sharing), boards / thread detail (forum), connections / endorsements / jobs (professional), groups / group members (messaging), admin/mod panel.

Candidate entities (seed tables) — select what the variant needs

• users — id, email, password_hash, handle, display_name, bio, avatar_path?, is_private, role
• posts — id, author_id, body, media_path?, visibility, created_at
• follows / connections — id, follower_id, followee_id, status
• likes — id, user_id, post_id
• comments — id, post_id, user_id, body, created_at
• messages — id, conversation_id, from_user_id, body, created_at
• conversations — id, kind (dm/group), title?, created_at
• notifications — id, user_id, kind, actor_id, target_id, read_at
• blocks — id, user_id, blocked_user_id

Variant-specific:

• albums (photo sharing) — id, owner_id, title, visibility
• album_photos (photo sharing) — id, album_id, post_id, position
• photo_tags (photo sharing) — id, post_id, tagged_user_id, x, y
• boards (forum) — id, name, description, visibility
• threads (forum) — id, board_id, author_id, title, locked, created_at
• replies (forum) — id, thread_id, author_id, body, created_at
• votes (forum) — id, user_id, target_type, target_id, value
• endorsements (professional) — id, endorser_id, profile_id, skill
• jobs (professional) — id, poster_id, title, company, description, status
• applications (professional) — id, job_id, applicant_id, status
• conversation_members / group_members (messaging) — id, conversation_id, user_id, role
• contacts (messaging) — id, owner_id, contact_user_id

Seed users with a mix of public/private profiles and some private posts/DMs so cross-account privacy exploits are possible.

Candidate user flows — select the ones matching chosen pages/features

1. Feed → like / comment on a post.
2. Create a post (text/image) with a visibility setting.
3. Visit a profile → follow / send connection request.
4. Open DMs → send a message in a conversation.
5. Adjust privacy (make account private) → others lose access.
6. (photo sharing) Create an album → add photos → tag another user.
7. (forum) Open a board → post a thread → reply / vote on a reply.
8. (forum/mod) Moderator locks or deletes a thread → it stops accepting replies.
9. (professional) Search people → connect → endorse a skill on a profile.
10. (professional) Post a job → another user applies → review applications.
11. (messaging) Start a group conversation → add members → send a message.
12. Block a user → their posts/messages stop reaching you.

Candidate endpoints — a feature may span several

Endpoints are a shared surface, not owned 1:1 by a feature (a single feature often spans several, and an endpoint can back multiple features). Pick a coherent subset alongside the pages above. Grouped by area:

• feed / posts — GET /api/feed, GET/POST /api/posts, GET /api/posts/{id}, DELETE /api/posts/{id}
• engagement — POST /api/posts/{id}/like, GET/POST /api/posts/{id}/comments
• profiles — GET /api/users/{id}, GET /api/me, PUT /api/me
• connections — POST /api/users/{id}/follow, GET /api/users/{id}/followers, POST /api/connections/{id}/accept
• messaging — GET/POST /api/conversations, GET/POST /api/conversations/{id}/messages, POST /api/conversations/{id}/members
• settings / privacy — PUT /api/me/privacy, POST /api/users/{id}/block
• albums / photos (photo sharing) — GET/POST /api/albums, POST /api/albums/{id}/photos, POST /api/posts/{id}/tags
• forum (forum) — GET/POST /api/boards, GET/POST /api/boards/{id}/threads, POST /api/threads/{id}/replies, POST /api/replies/{id}/vote
• professional (professional) — GET/POST /api/jobs, POST /api/jobs/{id}/apply, POST /api/users/{id}/endorse
• admin / mod — /api/admin/..., /api/mod/threads/{id}/lock, /api/mod/users/{id}/ban

Where vulnerabilities fit naturally

• idor → GET /api/users/{id} private profile, /api/conversations/{id}/messages — read another user's private profile/DMs/posts.
• xss → post body, comment, bio rendered to other users (stored XSS).
• csrf → follow / post / privacy-change endpoints that accept state changes without anti-CSRF protection.
• business_logic → bypass privacy (private post visible via direct id), block evasion, like/vote inflation.
• privilege_escalation → member reaching mod/admin actions.
• file_upload → image post / avatar accepting a malicious file.

Diversity guidance

Pick ONE variant and a coherent subset — a forum and a messaging app diverge sharply. Size to endpoint_count; let theme_free_text / custom_prompt bias the variant and naming. Vary the connection model (follow vs friend vs membership) and privacy rules so two social labs feel like different networks.