Add "locked" flag to accounts, prevent blocked users from following, force-unfollow blocked users

app/controllers/api_controller.rb

@@ -30,6 +30,10 @@ class ApiController < ApplicationController
     render json: { error: 'Remote SSL certificate could not be verified' }, status: 503
   end
 
+  rescue_from Mastodon::NotPermitted do
+    render json: { error: 'This action is not allowed' }, status: 403
+  end
+
   def doorkeeper_unauthorized_render_options(error: nil)
     { json: { error: (error.try(:description) || 'Not authorized') } }
   end

app/controllers/settings/profiles_controller.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
 
 class Settings::ProfilesController < ApplicationController
+  include ObfuscateFilename
+
   layout 'auth'
 
   before_action :authenticate_user!
   before_action :set_account
 
-  include ObfuscateFilename
   obfuscate_filename [:account, :avatar]
   obfuscate_filename [:account, :header]
 
@@ -23,7 +24,7 @@ class Settings::ProfilesController < ApplicationController
   private
 
   def account_params
-    params.require(:account).permit(:display_name, :note, :avatar, :header)
+    params.require(:account).permit(:display_name, :note, :avatar, :header, :locked)
   end
 
   def set_account