No OneTemporary
Actions

Size

113 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	index 38d53fd10..be863d8ed 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	@@ -1,150 +1,217 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [add_link_headers: 2, truthy_param?: 1, assign_account_by_id: 2, json_response: 3]

	+ alias Pleroma.Plugs.RateLimiter
	alias Pleroma.User
	- alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.ActivityPub.ActivityPub
	- alias Pleroma.Web.MastodonAPI.StatusView
	- alias Pleroma.Web.MastodonAPI.MastodonAPI
	+ alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.ListView
	- alias Pleroma.Plugs.RateLimiter
	+ alias Pleroma.Web.MastodonAPI.MastodonAPI
	+ alias Pleroma.Web.MastodonAPI.StatusView
	+ alias Pleroma.Web.OAuth.Token
	+ alias Pleroma.Web.TwitterAPI.TwitterAPI

	- @relations ~w(follow unfollow)a
	+ @relations [:follow, :unfollow]
	+ @needs_account ~W(followers following lists follow unfollow mute unmute block unblock)a

	plug(RateLimiter, {:relations_id_action, params: ["id", "uri"]} when action in @relations)
	plug(RateLimiter, :relations_actions when action in @relations)
	- plug(:assign_account_by_id when action not in [:show, :statuses])
	+ plug(RateLimiter, :app_account_creation when action == :create)
	+ plug(:assign_account_by_id when action in @needs_account)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	+ @doc "POST /api/v1/accounts"
	+ def create(
	+ %{assigns: %{app: app}} = conn,
	+ %{"username" => nickname, "email" => _, "password" => _, "agreement" => true} = params
	+ ) do
	+ params =
	+ params
	+ \|> Map.take([
	+ "email",
	+ "captcha_solution",
	+ "captcha_token",
	+ "captcha_answer_data",
	+ "token",
	+ "password"
	+ ])
	+ \|> Map.put("nickname", nickname)
	+ \|> Map.put("fullname", params["fullname"] \|\| nickname)
	+ \|> Map.put("bio", params["bio"] \|\| "")
	+ \|> Map.put("confirm", params["password"])
	+
	+ with {:ok, user} <- TwitterAPI.register_user(params, need_confirmation: true),
	+ {:ok, token} <- Token.create_token(app, user, %{scopes: app.scopes}) do
	+ json(conn, %{
	+ token_type: "Bearer",
	+ access_token: token.token,
	+ scope: app.scopes,
	+ created_at: Token.Utils.format_created_at(token)
	+ })
	+ else
	+ {:error, errors} -> json_response(conn, :bad_request, errors)
	+ end
	+ end
	+
	+ def create(%{assigns: %{app: _app}} = conn, _) do
	+ render_error(conn, :bad_request, "Missing parameters")
	+ end
	+
	+ def create(conn, _) do
	+ render_error(conn, :forbidden, "Invalid credentials")
	+ end
	+
	+ @doc "GET /api/v1/accounts/verify_credentials"
	+ def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	+ chat_token = Phoenix.Token.sign(conn, "user socket", user.id)
	+
	+ render(conn, "show.json",
	+ user: user,
	+ for: user,
	+ with_pleroma_settings: true,
	+ with_chat_token: chat_token
	+ )
	+ end
	+
	+ @doc "GET /api/v1/accounts/relationships"
	+ def relationships(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	+ targets = User.get_all_by_ids(List.wrap(id))
	+
	+ render(conn, "relationships.json", user: user, targets: targets)
	+ end
	+
	+ # Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	+ def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])
	+
	@doc "GET /api/v1/accounts/:id"
	def show(%{assigns: %{user: for_user}} = conn, %{"id" => nickname_or_id}) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
	true <- User.auth_active?(user) \|\| user.id == for_user.id \|\| User.superuser?(for_user) do
	render(conn, "show.json", user: user, for: for_user)
	else
	_e -> render_error(conn, :not_found, "Can't find user")
	end
	end

	@doc "GET /api/v1/accounts/:id/statuses"
	def statuses(%{assigns: %{user: reading_user}} = conn, params) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(params["id"], for: reading_user) do
	params = Map.put(params, "tag", params["tagged"])
	activities = ActivityPub.fetch_user_activities(user, reading_user, params)

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json", activities: activities, for: reading_user, as: :activity)
	end
	end

	@doc "GET /api/v1/accounts/:id/followers"
	def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_followers(user, params)
	user.info.hide_followers -> []
	true -> MastodonAPI.get_followers(user, params)
	end

	conn
	\|> add_link_headers(followers)
	\|> render("index.json", for: for_user, users: followers, as: :user)
	end

	@doc "GET /api/v1/accounts/:id/following"
	def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_friends(user, params)
	user.info.hide_follows -> []
	true -> MastodonAPI.get_friends(user, params)
	end

	conn
	\|> add_link_headers(followers)
	\|> render("index.json", for: for_user, users: followers, as: :user)
	end

	@doc "GET /api/v1/accounts/:id/lists"
	def lists(%{assigns: %{user: user, account: account}} = conn, _params) do
	lists = Pleroma.List.get_lists_account_belongs(user, account)

	conn
	\|> put_view(ListView)
	\|> render("index.json", lists: lists)
	end

	@doc "POST /api/v1/accounts/:id/follow"
	def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, :not_found}
	end

	def follow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
	with {:ok, follower} <- MastodonAPI.follow(follower, followed, conn.params) do
	render(conn, "relationship.json", user: follower, target: followed)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unfollow"
	def unfollow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, :not_found}
	end

	def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.unfollow(follower, followed) do
	render(conn, "relationship.json", user: follower, target: followed)
	end
	end

	@doc "POST /api/v1/accounts/:id/mute"
	def mute(%{assigns: %{user: muter, account: muted}} = conn, params) do
	notifications? = params \|> Map.get("notifications", true) \|> truthy_param?()

	with {:ok, muter} <- User.mute(muter, muted, notifications?) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unmute"
	def unmute(%{assigns: %{user: muter, account: muted}} = conn, _params) do
	with {:ok, muter} <- User.unmute(muter, muted) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/block"
	def block(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, blocker} <- User.block(blocker, blocked),
	{:ok, _activity} <- ActivityPub.block(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unblock"
	def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, blocker} <- User.unblock(blocker, blocked),
	{:ok, _activity} <- ActivityPub.unblock(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	index 197316794..32a58d929 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	@@ -1,726 +1,656 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2, truthy_param?: 1]

	alias Pleroma.Activity
	alias Pleroma.Bookmark
	alias Pleroma.Config
	alias Pleroma.Emoji
	alias Pleroma.HTTP
	alias Pleroma.Object
	alias Pleroma.Pagination
	alias Pleroma.Plugs.RateLimiter
	alias Pleroma.Repo
	alias Pleroma.Stats
	alias Pleroma.User
	alias Pleroma.Web
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.AppView
	alias Pleroma.Web.MastodonAPI.MastodonView
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.MediaProxy
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Scopes
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.TwitterAPI

	require Logger

	- plug(RateLimiter, :app_account_creation when action == :account_register)
	- plug(RateLimiter, :search when action in [:search, :search2, :account_search])
	plug(RateLimiter, :password_reset when action == :password_reset)

	@local_mastodon_name "Mastodon-Local"

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	def create_app(conn, params) do
	scopes = Scopes.fetch_scopes(params, ["read"])

	app_attrs =
	params
	\|> Map.drop(["scope", "scopes"])
	\|> Map.put("scopes", scopes)

	with cs <- App.register_changeset(%App{}, app_attrs),
	false <- cs.changes[:client_name] == @local_mastodon_name,
	{:ok, app} <- Repo.insert(cs) do
	conn
	\|> put_view(AppView)
	\|> render("show.json", %{app: app})
	end
	end

	defp add_if_present(
	map,
	params,
	params_field,
	map_field,
	value_function \\ fn x -> {:ok, x} end
	) do
	if Map.has_key?(params, params_field) do
	case value_function.(params[params_field]) do
	{:ok, new_value} -> Map.put(map, map_field, new_value)
	:error -> map
	end
	else
	map
	end
	end

	def update_credentials(%{assigns: %{user: user}} = conn, params) do
	original_user = user

	user_params =
	%{}
	\|> add_if_present(params, "display_name", :name)
	\|> add_if_present(params, "note", :bio, fn value -> {:ok, User.parse_bio(value, user)} end)
	\|> add_if_present(params, "avatar", :avatar, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :avatar) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)

	emojis_text = (user_params["display_name"] \|\| "") <> (user_params["note"] \|\| "")

	user_info_emojis =
	user.info
	\|> Map.get(:emoji, [])
	\|> Enum.concat(Emoji.Formatter.get_emoji_map(emojis_text))
	\|> Enum.dedup()

	info_params =
	[
	:no_rich_text,
	:locked,
	:hide_followers_count,
	:hide_follows_count,
	:hide_followers,
	:hide_follows,
	:hide_favorites,
	:show_role,
	:skip_thread_containment,
	:discoverable
	]
	\|> Enum.reduce(%{}, fn key, acc ->
	add_if_present(acc, params, to_string(key), key, fn value ->
	{:ok, truthy_param?(value)}
	end)
	end)
	\|> add_if_present(params, "default_scope", :default_scope)
	\|> add_if_present(params, "fields", :fields, fn fields ->
	fields = Enum.map(fields, fn f -> Map.update!(f, "value", &AutoLinker.link(&1)) end)

	{:ok, fields}
	end)
	\|> add_if_present(params, "fields", :raw_fields)
	\|> add_if_present(params, "pleroma_settings_store", :pleroma_settings_store, fn value ->
	{:ok, Map.merge(user.info.pleroma_settings_store, value)}
	end)
	\|> add_if_present(params, "header", :banner, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :banner) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)
	\|> add_if_present(params, "pleroma_background_image", :background, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :background) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)
	\|> Map.put(:emoji, user_info_emojis)

	changeset =
	user
	\|> User.update_changeset(user_params)
	\|> User.change_info(&User.Info.profile_update(&1, info_params))

	with {:ok, user} <- User.update_and_set_cache(changeset) do
	if original_user != user, do: CommonAPI.update(user)

	json(
	conn,
	AccountView.render("show.json", %{user: user, for: user, with_pleroma_settings: true})
	)
	else
	_e -> render_error(conn, :forbidden, "Invalid request")
	end
	end

	-
	- def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	- chat_token = Phoenix.Token.sign(conn, "user socket", user.id)
	-
	- account =
	- AccountView.render("show.json", %{
	- user: user,
	- for: user,
	- with_pleroma_settings: true,
	- with_chat_token: chat_token
	- })
	-
	- json(conn, account)
	- end
	def verify_app_credentials(%{assigns: %{user: _user, token: token}} = conn, _) do
	with %Token{app: %App{} = app} <- Repo.preload(token, :app) do
	conn
	\|> put_view(AppView)
	\|> render("short.json", %{app: app})
	end
	end

	@mastodon_api_level "2.7.2"

	def masto_instance(conn, _params) do
	instance = Config.get(:instance)

	response = %{
	uri: Web.base_url(),
	title: Keyword.get(instance, :name),
	description: Keyword.get(instance, :description),
	version: "#{@mastodon_api_level} (compatible; #{Pleroma.Application.named_version()})",
	email: Keyword.get(instance, :email),
	urls: %{
	streaming_api: Pleroma.Web.Endpoint.websocket_url()
	},
	stats: Stats.get_stats(),
	thumbnail: Web.base_url() <> "/instance/thumbnail.jpeg",
	languages: ["en"],
	registrations: Pleroma.Config.get([:instance, :registrations_open]),
	# Extra (not present in Mastodon):
	max_toot_chars: Keyword.get(instance, :limit),
	poll_limits: Keyword.get(instance, :poll_limits)
	}

	json(conn, response)
	end

	def peers(conn, _params) do
	json(conn, Stats.get_peers())
	end

	defp mastodonized_emoji do
	Pleroma.Emoji.get_all()
	\|> Enum.map(fn {shortcode, %Pleroma.Emoji{file: relative_url, tags: tags}} ->
	url = to_string(URI.merge(Web.base_url(), relative_url))

	%{
	"shortcode" => shortcode,
	"static_url" => url,
	"visible_in_picker" => true,
	"url" => url,
	"tags" => tags,
	# Assuming that a comma is authorized in the category name
	"category" => (tags -- ["Custom"]) \|> Enum.join(",")
	}
	end)
	end

	def custom_emojis(conn, _params) do
	mastodon_emoji = mastodonized_emoji()
	json(conn, mastodon_emoji)
	end

	def get_poll(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Object{} = object <- Object.get_by_id_and_maybe_refetch(id, interval: 60),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
	true <- Visibility.visible_for_user?(activity, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("poll.json", %{object: object, for: user})
	else
	error when is_nil(error) or error == false ->
	render_error(conn, :not_found, "Record not found")
	end
	end

	defp get_cached_vote_or_vote(user, object, choices) do
	idempotency_key = "polls:#{user.id}:#{object.data["id"]}"

	{_, res} =
	Cachex.fetch(:idempotency_cache, idempotency_key, fn _ ->
	case CommonAPI.vote(user, object, choices) do
	{:error, _message} = res -> {:ignore, res}
	res -> {:commit, res}
	end
	end)

	res
	end

	def poll_vote(%{assigns: %{user: user}} = conn, %{"id" => id, "choices" => choices}) do
	with %Object{} = object <- Object.get_by_id(id),
	true <- object.data["type"] == "Question",
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _activities, object} <- get_cached_vote_or_vote(user, object, choices) do
	conn
	\|> put_view(StatusView)
	\|> try_render("poll.json", %{object: object, for: user})
	else
	nil ->
	render_error(conn, :not_found, "Record not found")

	false ->
	render_error(conn, :not_found, "Record not found")

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	- def relationships(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	- targets = User.get_all_by_ids(List.wrap(id))
	-
	- conn
	- \|> put_view(AccountView)
	- \|> render("relationships.json", %{user: user, targets: targets})
	- end
	-
	- # Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	- def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])
	-
	def update_media(
	%{assigns: %{user: user}} = conn,
	%{"id" => id, "description" => description} = _
	)
	when is_binary(description) do
	with %Object{} = object <- Repo.get(Object, id),
	true <- Object.authorize_mutation(object, user),
	{:ok, %Object{data: data}} <- Object.update_data(object, %{"name" => description}) do
	attachment_data = Map.put(data, "id", object.id)

	conn
	\|> put_view(StatusView)
	\|> render("attachment.json", %{attachment: attachment_data})
	end
	end

	def update_media(_conn, _data), do: {:error, :bad_request}

	def upload(%{assigns: %{user: user}} = conn, %{"file" => file} = data) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, "description")
	) do
	attachment_data = Map.put(object.data, "id", object.id)

	conn
	\|> put_view(StatusView)
	\|> render("attachment.json", %{attachment: attachment_data})
	end
	end

	def set_mascot(%{assigns: %{user: user}} = conn, %{"file" => file}) do
	with {:ok, object} <- ActivityPub.upload(file, actor: User.ap_id(user)),
	%{} = attachment_data <- Map.put(object.data, "id", object.id),
	# Reject if not an image
	%{type: "image"} = rendered <-
	StatusView.render("attachment.json", %{attachment: attachment_data}) do
	# Sure!
	# Save to the user's info
	{:ok, _user} = User.update_info(user, &User.Info.mascot_update(&1, rendered))

	json(conn, rendered)
	else
	%{type: _} -> render_error(conn, :unsupported_media_type, "mascots can only be images")
	end
	end

	def get_mascot(%{assigns: %{user: user}} = conn, _params) do
	mascot = User.get_mascot(user)

	json(conn, mascot)
	end

	def follows(%{assigns: %{user: follower}} = conn, %{"uri" => uri}) do
	with {_, %User{} = followed} <- {:followed, User.get_cached_by_nickname(uri)},
	{_, true} <- {:followed, follower.id != followed.id},
	{:ok, follower, followed, _} <- CommonAPI.follow(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("show.json", %{user: followed, for: follower})
	else
	{:followed, _} ->
	{:error, :not_found}

	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def mutes(%{assigns: %{user: user}} = conn, _) do
	with muted_accounts <- User.muted_users(user) do
	res = AccountView.render("index.json", users: muted_accounts, for: user, as: :user)
	json(conn, res)
	end
	end

	def blocks(%{assigns: %{user: user}} = conn, _) do
	with blocked_accounts <- User.blocked_users(user) do
	res = AccountView.render("index.json", users: blocked_accounts, for: user, as: :user)
	json(conn, res)
	end
	end

	def favourites(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("favorited_by", user.ap_id)
	\|> Map.put("blocking_user", user)

	activities =
	ActivityPub.fetch_activities([], params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def bookmarks(%{assigns: %{user: user}} = conn, params) do
	user = User.get_cached_by_id(user.id)

	bookmarks =
	Bookmark.for_user_query(user.id)
	\|> Pagination.fetch_paginated(params)

	activities =
	bookmarks
	\|> Enum.map(fn b -> Map.put(b.activity, :bookmark, Map.delete(b, :activity)) end)

	conn
	\|> add_link_headers(bookmarks)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def index(%{assigns: %{user: user}} = conn, _params) do
	token = get_session(conn, :oauth_token)

	if user && token do
	mastodon_emoji = mastodonized_emoji()

	limit = Config.get([:instance, :limit])

	accounts = Map.put(%{}, user.id, AccountView.render("show.json", %{user: user, for: user}))

	initial_state =
	%{
	meta: %{
	streaming_api_base_url: Pleroma.Web.Endpoint.websocket_url(),
	access_token: token,
	locale: "en",
	domain: Pleroma.Web.Endpoint.host(),
	admin: "1",
	me: "#{user.id}",
	unfollow_modal: false,
	boost_modal: false,
	delete_modal: true,
	auto_play_gif: false,
	display_sensitive_media: false,
	reduce_motion: false,
	max_toot_chars: limit,
	mascot: User.get_mascot(user)["url"]
	},
	poll_limits: Config.get([:instance, :poll_limits]),
	rights: %{
	delete_others_notice: present?(user.info.is_moderator),
	admin: present?(user.info.is_admin)
	},
	compose: %{
	me: "#{user.id}",
	default_privacy: user.info.default_scope,
	default_sensitive: false,
	allow_content_types: Config.get([:instance, :allowed_post_formats])
	},
	media_attachments: %{
	accept_content_types: [
	".jpg",
	".jpeg",
	".png",
	".gif",
	".webm",
	".mp4",
	".m4v",
	"image\/jpeg",
	"image\/png",
	"image\/gif",
	"video\/webm",
	"video\/mp4"
	]
	},
	settings:
	user.info.settings \|\|
	%{
	onboarded: true,
	home: %{
	shows: %{
	reblog: true,
	reply: true
	}
	},
	notifications: %{
	alerts: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	},
	shows: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	},
	sounds: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	}
	}
	},
	push_subscription: nil,
	accounts: accounts,
	custom_emojis: mastodon_emoji,
	char_limit: limit
	}
	\|> Jason.encode!()

	conn
	\|> put_layout(false)
	\|> put_view(MastodonView)
	\|> render("index.html", %{initial_state: initial_state})
	else
	conn
	\|> put_session(:return_to, conn.request_path)
	\|> redirect(to: "/web/login")
	end
	end

	def put_settings(%{assigns: %{user: user}} = conn, %{"data" => settings} = _params) do
	with {:ok, _} <- User.update_info(user, &User.Info.mastodon_settings_update(&1, settings)) do
	json(conn, %{})
	else
	e ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: inspect(e)})
	end
	end

	def login(%{assigns: %{user: %User{}}} = conn, _params) do
	redirect(conn, to: local_mastodon_root_path(conn))
	end

	@doc "Local Mastodon FE login init action"
	def login(conn, %{"code" => auth_token}) do
	with {:ok, app} <- get_or_make_app(),
	{:ok, auth} <- Authorization.get_by_token(app, auth_token),
	{:ok, token} <- Token.exchange_token(app, auth) do
	conn
	\|> put_session(:oauth_token, token.token)
	\|> redirect(to: local_mastodon_root_path(conn))
	end
	end

	@doc "Local Mastodon FE callback action"
	def login(conn, _) do
	with {:ok, app} <- get_or_make_app() do
	path =
	o_auth_path(conn, :authorize,
	response_type: "code",
	client_id: app.client_id,
	redirect_uri: ".",
	scope: Enum.join(app.scopes, " ")
	)

	redirect(conn, to: path)
	end
	end

	defp local_mastodon_root_path(conn) do
	case get_session(conn, :return_to) do
	nil ->
	mastodon_api_path(conn, :index, ["getting-started"])

	return_to ->
	delete_session(conn, :return_to)
	return_to
	end
	end

	@spec get_or_make_app() :: {:ok, App.t()} \| {:error, Ecto.Changeset.t()}
	defp get_or_make_app do
	App.get_or_make(
	%{client_name: @local_mastodon_name, redirect_uris: "."},
	["read", "write", "follow", "push"]
	)
	end

	def logout(conn, _) do
	conn
	\|> clear_session
	\|> redirect(to: "/")
	end

	# Stubs for unimplemented mastodon api
	#
	def empty_array(conn, _) do
	Logger.debug("Unimplemented, returning an empty array")
	json(conn, [])
	end

	def empty_object(conn, _) do
	Logger.debug("Unimplemented, returning an empty object")
	json(conn, %{})
	end

	def suggestions(%{assigns: %{user: user}} = conn, _) do
	suggestions = Config.get(:suggestions)

	if Keyword.get(suggestions, :enabled, false) do
	api = Keyword.get(suggestions, :third_party_engine, "")
	timeout = Keyword.get(suggestions, :timeout, 5000)
	limit = Keyword.get(suggestions, :limit, 23)

	host = Config.get([Pleroma.Web.Endpoint, :url, :host])

	user = user.nickname

	url =
	api
	\|> String.replace("{{host}}", host)
	\|> String.replace("{{user}}", user)

	with {:ok, %{status: 200, body: body}} <-
	HTTP.get(url, [], adapter: [recv_timeout: timeout, pool: :default]),
	{:ok, data} <- Jason.decode(body) do
	data =
	data
	\|> Enum.slice(0, limit)
	\|> Enum.map(fn x ->
	x
	\|> Map.put("id", fetch_suggestion_id(x))
	\|> Map.put("avatar", MediaProxy.url(x["avatar"]))
	\|> Map.put("avatar_static", MediaProxy.url(x["avatar_static"]))
	end)

	json(conn, data)
	else
	e ->
	Logger.error("Could not retrieve suggestions at fetch #{url}, #{inspect(e)}")
	end
	else
	json(conn, [])
	end
	end

	defp fetch_suggestion_id(attrs) do
	case User.get_or_fetch(attrs["acct"]) do
	{:ok, %User{id: id}} -> id
	_ -> 0
	end
	end

	- def account_register(
	- %{assigns: %{app: app}} = conn,
	- %{"username" => nickname, "email" => _, "password" => _, "agreement" => true} = params
	- ) do
	- params =
	- params
	- \|> Map.take([
	- "email",
	- "captcha_solution",
	- "captcha_token",
	- "captcha_answer_data",
	- "token",
	- "password"
	- ])
	- \|> Map.put("nickname", nickname)
	- \|> Map.put("fullname", params["fullname"] \|\| nickname)
	- \|> Map.put("bio", params["bio"] \|\| "")
	- \|> Map.put("confirm", params["password"])
	-
	- with {:ok, user} <- TwitterAPI.register_user(params, need_confirmation: true),
	- {:ok, token} <- Token.create_token(app, user, %{scopes: app.scopes}) do
	- json(conn, %{
	- token_type: "Bearer",
	- access_token: token.token,
	- scope: app.scopes,
	- created_at: Token.Utils.format_created_at(token)
	- })
	- else
	- {:error, errors} ->
	- conn
	- \|> put_status(:bad_request)
	- \|> json(errors)
	- end
	- end
	-
	- def account_register(%{assigns: %{app: _app}} = conn, _) do
	- render_error(conn, :bad_request, "Missing parameters")
	- end
	-
	- def account_register(conn, _) do
	- render_error(conn, :forbidden, "Invalid credentials")
	- end
	-
	def password_reset(conn, params) do
	nickname_or_email = params["email"] \|\| params["nickname"]

	with {:ok, _} <- TwitterAPI.password_reset(nickname_or_email) do
	conn
	\|> put_status(:no_content)
	\|> json("")
	else
	{:error, "unknown user"} ->
	send_resp(conn, :not_found, "")

	{:error, _} ->
	send_resp(conn, :bad_request, "")
	end
	end

	def try_render(conn, target, params)
	when is_binary(target) do
	case render(conn, target, params) do
	nil -> render_error(conn, :not_implemented, "Can't display this activity")
	res -> res
	end
	end

	def try_render(conn, _, _) do
	render_error(conn, :not_implemented, "Can't display this activity")
	end

	defp present?(nil), do: false
	defp present?(false), do: false
	defp present?(_), do: true
	end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 5c3fe34e5..a4db5564d 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,705 +1,705 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router

	pipeline :browser do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	end

	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	end

	pipeline :api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :authenticated_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :admin_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.AdminSecretAuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.UserIsAdminPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :mastodon_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :pleroma_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :oauth_read_or_public do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{
	scopes: ["read"],
	fallback: :proceed_unauthenticated
	})

	plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)
	end

	pipeline :oauth_read do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["read"]})
	end

	pipeline :oauth_write do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["write"]})
	end

	pipeline :oauth_follow do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["follow"]})
	end

	pipeline :oauth_push do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["push"]})
	end

	pipeline :well_known do
	plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	pipeline :http_signature do
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", PasswordController, :reset, as: :reset_password)
	post("/password_reset", PasswordController, :do_reset, as: :reset_password)
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	get("/healthcheck", UtilController, :healthcheck)
	end

	scope "/api/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	scope "/api/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through([:admin_api, :oauth_write])

	post("/users/follow", AdminAPIController, :user_follow)
	post("/users/unfollow", AdminAPIController, :user_unfollow)

	delete("/users", AdminAPIController, :user_delete)
	post("/users", AdminAPIController, :users_create)
	patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)

	get("/users/:nickname/permission_group", AdminAPIController, :right_get)
	get("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_get)
	post("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_add)

	delete(
	"/users/:nickname/permission_group/:permission_group",
	AdminAPIController,
	:right_delete
	)

	put("/users/:nickname/activation_status", AdminAPIController, :set_activation_status)

	post("/relay", AdminAPIController, :relay_follow)
	delete("/relay", AdminAPIController, :relay_unfollow)

	post("/users/invite_token", AdminAPIController, :create_invite_token)
	get("/users/invites", AdminAPIController, :invites)
	post("/users/revoke_invite", AdminAPIController, :revoke_invite)
	post("/users/email_invite", AdminAPIController, :email_invite)

	get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)
	patch("/users/:nickname/force_password_reset", AdminAPIController, :force_password_reset)

	get("/users", AdminAPIController, :list_users)
	get("/users/:nickname", AdminAPIController, :user_show)
	get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)

	get("/reports", AdminAPIController, :list_reports)
	get("/reports/:id", AdminAPIController, :report_show)
	put("/reports/:id", AdminAPIController, :report_update_state)
	post("/reports/:id/respond", AdminAPIController, :report_respond)

	put("/statuses/:id", AdminAPIController, :status_update)
	delete("/statuses/:id", AdminAPIController, :status_delete)

	get("/config", AdminAPIController, :config_show)
	post("/config", AdminAPIController, :config_update)
	get("/config/migrate_to_db", AdminAPIController, :migrate_to_db)
	get("/config/migrate_from_db", AdminAPIController, :migrate_from_db)

	get("/moderation_log", AdminAPIController, :list_log)

	post("/reload_emoji", AdminAPIController, :reload_emoji)
	end

	scope "/api/pleroma/emoji", Pleroma.Web.PleromaAPI do
	scope "/packs" do
	# Modifying packs
	pipe_through([:admin_api, :oauth_write])

	post("/import_from_fs", EmojiAPIController, :import_from_fs)

	post("/:pack_name/update_file", EmojiAPIController, :update_file)
	post("/:pack_name/update_metadata", EmojiAPIController, :update_metadata)
	put("/:name", EmojiAPIController, :create)
	delete("/:name", EmojiAPIController, :delete)
	post("/download_from", EmojiAPIController, :download_from)
	post("/list_from", EmojiAPIController, :list_from)
	end

	scope "/packs" do
	# Pack info / downloading
	get("/", EmojiAPIController, :list_packs)
	get("/:name/download_shared/", EmojiAPIController, :download_shared)
	end
	end

	scope "/", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_html)

	post("/main/ostatus", UtilController, :remote_subscribe)
	get("/ostatus_subscribe", UtilController, :remote_follow)

	scope [] do
	pipe_through(:oauth_follow)
	post("/ostatus_subscribe", UtilController, :do_remote_follow)
	end
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:authenticated_api)

	scope [] do
	pipe_through(:oauth_write)

	post("/change_email", UtilController, :change_email)
	post("/change_password", UtilController, :change_password)
	post("/delete_account", UtilController, :delete_account)
	put("/notification_settings", UtilController, :update_notificaton_settings)
	post("/disable_account", UtilController, :disable_account)
	end

	scope [] do
	pipe_through(:oauth_follow)

	post("/blocks_import", UtilController, :blocks_import)
	post("/follow_import", UtilController, :follow_import)
	end
	end

	scope "/oauth", Pleroma.Web.OAuth do
	scope [] do
	pipe_through(:oauth)
	get("/authorize", OAuthController, :authorize)
	end

	post("/authorize", OAuthController, :create_authorization)
	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	get("/registration_details", OAuthController, :registration_details)

	scope [] do
	pipe_through(:browser)

	get("/prepare_request", OAuthController, :prepare_request)
	get("/:provider", OAuthController, :request)
	get("/:provider/callback", OAuthController, :callback)
	post("/register", OAuthController, :register)
	end
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	scope [] do
	pipe_through(:authenticated_api)
	pipe_through(:oauth_read)
	get("/conversations/:id/statuses", PleromaAPIController, :conversation_statuses)
	get("/conversations/:id", PleromaAPIController, :conversation)
	end

	scope [] do
	pipe_through(:authenticated_api)
	pipe_through(:oauth_write)
	patch("/conversations/:id", PleromaAPIController, :update_conversation)
	post("/notifications/read", PleromaAPIController, :read_notification)

	patch("/accounts/update_avatar", AccountController, :update_avatar)
	patch("/accounts/update_banner", AccountController, :update_banner)
	patch("/accounts/update_background", AccountController, :update_background)
	post("/scrobble", ScrobbleController, :new_scrobble)
	end

	scope [] do
	pipe_through(:api)
	pipe_through(:oauth_read_or_public)
	get("/accounts/:id/favourites", AccountController, :favourites)
	end

	scope [] do
	pipe_through(:authenticated_api)
	pipe_through(:oauth_follow)

	post("/accounts/:id/subscribe", AccountController, :subscribe)
	post("/accounts/:id/unsubscribe", AccountController, :unsubscribe)
	end

	post("/accounts/confirmation_resend", AccountController, :confirmation_resend)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through([:api, :oauth_read_or_public])

	get("/accounts/:id/scrobbles", ScrobbleController, :user_scrobbles)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	scope [] do
	pipe_through(:oauth_read)

	- get("/accounts/verify_credentials", MastodonAPIController, :verify_credentials)
	+ get("/accounts/verify_credentials", AccountController, :verify_credentials)

	- get("/accounts/relationships", MastodonAPIController, :relationships)
	+ get("/accounts/relationships", AccountController, :relationships)

	get("/accounts/:id/lists", AccountController, :lists)
	get("/accounts/:id/identity_proofs", MastodonAPIController, :empty_array)

	get("/follow_requests", FollowRequestController, :index)
	get("/blocks", MastodonAPIController, :blocks)
	get("/mutes", MastodonAPIController, :mutes)

	get("/timelines/home", TimelineController, :home)
	get("/timelines/direct", TimelineController, :direct)

	get("/favourites", MastodonAPIController, :favourites)
	get("/bookmarks", MastodonAPIController, :bookmarks)

	get("/notifications", NotificationController, :index)
	get("/notifications/:id", NotificationController, :show)
	post("/notifications/clear", NotificationController, :clear)
	post("/notifications/dismiss", NotificationController, :dismiss)
	delete("/notifications/destroy_multiple", NotificationController, :destroy_multiple)

	get("/scheduled_statuses", ScheduledActivityController, :index)
	get("/scheduled_statuses/:id", ScheduledActivityController, :show)

	get("/lists", ListController, :index)
	get("/lists/:id", ListController, :show)
	get("/lists/:id/accounts", ListController, :list_accounts)

	get("/domain_blocks", DomainBlockController, :index)

	get("/filters", FilterController, :index)

	get("/suggestions", MastodonAPIController, :suggestions)

	get("/conversations", ConversationController, :index)
	post("/conversations/:id/read", ConversationController, :read)

	get("/endorsements", MastodonAPIController, :empty_array)
	end

	scope [] do
	pipe_through(:oauth_write)

	patch("/accounts/update_credentials", MastodonAPIController, :update_credentials)

	post("/statuses", StatusController, :create)
	delete("/statuses/:id", StatusController, :delete)

	post("/statuses/:id/reblog", StatusController, :reblog)
	post("/statuses/:id/unreblog", StatusController, :unreblog)
	post("/statuses/:id/favourite", StatusController, :favourite)
	post("/statuses/:id/unfavourite", StatusController, :unfavourite)
	post("/statuses/:id/pin", StatusController, :pin)
	post("/statuses/:id/unpin", StatusController, :unpin)
	post("/statuses/:id/bookmark", StatusController, :bookmark)
	post("/statuses/:id/unbookmark", StatusController, :unbookmark)
	post("/statuses/:id/mute", StatusController, :mute_conversation)
	post("/statuses/:id/unmute", StatusController, :unmute_conversation)

	put("/scheduled_statuses/:id", ScheduledActivityController, :update)
	delete("/scheduled_statuses/:id", ScheduledActivityController, :delete)

	post("/polls/:id/votes", MastodonAPIController, :poll_vote)

	post("/media", MastodonAPIController, :upload)
	put("/media/:id", MastodonAPIController, :update_media)

	delete("/lists/:id", ListController, :delete)
	post("/lists", ListController, :create)
	put("/lists/:id", ListController, :update)

	post("/lists/:id/accounts", ListController, :add_to_list)
	delete("/lists/:id/accounts", ListController, :remove_from_list)

	post("/filters", FilterController, :create)
	get("/filters/:id", FilterController, :show)
	put("/filters/:id", FilterController, :update)
	delete("/filters/:id", FilterController, :delete)

	get("/pleroma/mascot", MastodonAPIController, :get_mascot)
	put("/pleroma/mascot", MastodonAPIController, :set_mascot)

	post("/reports", ReportController, :create)
	end

	scope [] do
	pipe_through(:oauth_follow)

	post("/follows", MastodonAPIController, :follows)
	post("/accounts/:id/follow", AccountController, :follow)
	post("/accounts/:id/unfollow", AccountController, :unfollow)
	post("/accounts/:id/block", AccountController, :block)
	post("/accounts/:id/unblock", AccountController, :unblock)
	post("/accounts/:id/mute", AccountController, :mute)
	post("/accounts/:id/unmute", AccountController, :unmute)

	post("/follow_requests/:id/authorize", FollowRequestController, :authorize)
	post("/follow_requests/:id/reject", FollowRequestController, :reject)

	post("/domain_blocks", DomainBlockController, :create)
	delete("/domain_blocks", DomainBlockController, :delete)
	end

	scope [] do
	pipe_through(:oauth_push)

	post("/push/subscription", SubscriptionController, :create)
	get("/push/subscription", SubscriptionController, :get)
	put("/push/subscription", SubscriptionController, :update)
	delete("/push/subscription", SubscriptionController, :delete)
	end
	end

	scope "/api/web", Pleroma.Web.MastodonAPI do
	pipe_through([:authenticated_api, :oauth_write])

	put("/settings", MastodonAPIController, :put_settings)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	- post("/accounts", MastodonAPIController, :account_register)
	+ post("/accounts", AccountController, :create)

	get("/instance", MastodonAPIController, :masto_instance)
	get("/instance/peers", MastodonAPIController, :peers)
	post("/apps", MastodonAPIController, :create_app)
	get("/apps/verify_credentials", MastodonAPIController, :verify_app_credentials)
	get("/custom_emojis", MastodonAPIController, :custom_emojis)

	get("/statuses/:id/card", StatusController, :card)

	get("/statuses/:id/favourited_by", StatusController, :favourited_by)
	get("/statuses/:id/reblogged_by", StatusController, :reblogged_by)

	get("/trends", MastodonAPIController, :empty_array)

	get("/accounts/search", SearchController, :account_search)

	scope [] do
	pipe_through(:oauth_read_or_public)

	get("/timelines/public", TimelineController, :public)
	get("/timelines/tag/:tag", TimelineController, :hashtag)
	get("/timelines/list/:list_id", TimelineController, :list)

	get("/statuses", StatusController, :index)
	get("/statuses/:id", StatusController, :show)
	get("/statuses/:id/context", StatusController, :context)

	get("/polls/:id", MastodonAPIController, :get_poll)

	get("/accounts/:id/statuses", AccountController, :statuses)
	get("/accounts/:id/followers", AccountController, :followers)
	get("/accounts/:id/following", AccountController, :following)
	get("/accounts/:id", AccountController, :show)

	get("/search", SearchController, :search)
	end
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	pipe_through([:api, :oauth_read_or_public])
	get("/search", SearchController, :search2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	get("/help/test", TwitterAPI.UtilController, :help_test)
	post("/help/test", TwitterAPI.UtilController, :help_test)
	get("/statusnet/config", TwitterAPI.UtilController, :config)
	get("/statusnet/version", TwitterAPI.UtilController, :version)
	get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	get(
	"/account/confirm_email/:user_id/:token",
	TwitterAPI.Controller,
	:confirm_email,
	as: :confirm_email
	)
	end

	scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	pipe_through(:authenticated_api)

	get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)

	scope [] do
	pipe_through(:oauth_read)

	post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read)
	end
	end

	pipeline :ap_service_actor do
	plug(:accepts, ["activity+json", "json"])
	end

	pipeline :ostatus do
	plug(:accepts, ["html", "xml", "atom", "activity+json", "json"])
	end

	pipeline :oembed do
	plug(:accepts, ["json", "xml"])
	end

	scope "/", Pleroma.Web do
	pipe_through(:ostatus)
	pipe_through(:http_signature)

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)
	get("/users/:nickname/feed", OStatus.OStatusController, :feed)
	get("/users/:nickname", OStatus.OStatusController, :feed_redirect)

	post("/users/:nickname/salmon", OStatus.OStatusController, :salmon_incoming)
	post("/push/hub/:nickname", Websub.WebsubController, :websub_subscription_request)
	get("/push/subscriptions/:id", Websub.WebsubController, :websub_subscription_confirmation)
	post("/push/subscriptions/:id", Websub.WebsubController, :websub_incoming)

	get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)
	end

	pipeline :activitypub do
	plug(:accepts, ["activity+json", "json"])
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	# XXX: not really ostatus
	pipe_through(:ostatus)

	get("/users/:nickname/outbox", ActivityPubController, :outbox)
	get("/objects/:uuid/likes", ActivityPubController, :object_likes)
	end

	pipeline :activitypub_client do
	plug(:accepts, ["activity+json", "json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	scope [] do
	pipe_through(:oauth_read)
	get("/api/ap/whoami", ActivityPubController, :whoami)
	get("/users/:nickname/inbox", ActivityPubController, :read_inbox)
	end

	scope [] do
	pipe_through(:oauth_write)
	post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	post("/api/ap/upload_media", ActivityPubController, :upload_media)
	end

	scope [] do
	pipe_through(:oauth_read_or_public)
	get("/users/:nickname/followers", ActivityPubController, :followers)
	get("/users/:nickname/following", ActivityPubController, :following)
	end
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through(:activitypub)
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :relay)

	scope [] do
	pipe_through(:http_signature)
	post("/inbox", ActivityPubController, :inbox)
	end

	get("/following", ActivityPubController, :following, assigns: %{relay: true})
	get("/followers", ActivityPubController, :followers, assigns: %{relay: true})
	end

	scope "/internal/fetch", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :internal_fetch)
	post("/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web.MastodonAPI do
	pipe_through(:mastodon_html)

	get("/web/login", MastodonAPIController, :login)
	delete("/auth/sign_out", MastodonAPIController, :logout)

	post("/auth/password", MastodonAPIController, :password_reset)

	scope [] do
	pipe_through(:oauth_read)
	get("/web/*path", MastodonAPIController, :index)
	end
	end

	pipeline :remote_media do
	end

	scope "/proxy/", Pleroma.Web.MediaProxy do
	pipe_through(:remote_media)

	get("/:sig/:url", MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxyController, :remote)
	end

	if Pleroma.Config.get(:env) == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	scope "/", Pleroma.Web.MongooseIM do
	get("/user_exists", MongooseIMController, :user_exists)
	get("/check_password", MongooseIMController, :check_password)
	end

	scope "/", Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	get("/api*path", RedirectController, :api_not_implemented)
	get("/*path", RedirectController, :redirector)

	options("/*path", RedirectController, :empty)
	end
	end
	diff --git a/test/web/mastodon_api/controllers/account_controller_test.exs b/test/web/mastodon_api/controllers/account_controller_test.exs
	index 32ccc5351..8c8017838 100644
	--- a/test/web/mastodon_api/controllers/account_controller_test.exs
	+++ b/test/web/mastodon_api/controllers/account_controller_test.exs
	@@ -1,598 +1,852 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
	use Pleroma.Web.ConnCase

	+ alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	+ alias Pleroma.Web.OAuth.Token

	import Pleroma.Factory

	describe "account fetching" do
	test "works by id" do
	user = insert(:user)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/#{user.id}")

	assert %{"id" => id} = json_response(conn, 200)
	assert id == to_string(user.id)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/-1")

	assert %{"error" => "Can't find user"} = json_response(conn, 404)
	end

	test "works by nickname" do
	user = insert(:user)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/#{user.nickname}")

	assert %{"id" => id} = json_response(conn, 200)
	assert id == user.id
	end

	test "works by nickname for remote users" do
	limit_to_local = Pleroma.Config.get([:instance, :limit_to_local_content])
	Pleroma.Config.put([:instance, :limit_to_local_content], false)
	user = insert(:user, nickname: "user@example.com", local: false)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/#{user.nickname}")

	Pleroma.Config.put([:instance, :limit_to_local_content], limit_to_local)
	assert %{"id" => id} = json_response(conn, 200)
	assert id == user.id
	end

	test "respects limit_to_local_content == :all for remote user nicknames" do
	limit_to_local = Pleroma.Config.get([:instance, :limit_to_local_content])
	Pleroma.Config.put([:instance, :limit_to_local_content], :all)

	user = insert(:user, nickname: "user@example.com", local: false)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/#{user.nickname}")

	Pleroma.Config.put([:instance, :limit_to_local_content], limit_to_local)
	assert json_response(conn, 404)
	end

	test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
	limit_to_local = Pleroma.Config.get([:instance, :limit_to_local_content])
	Pleroma.Config.put([:instance, :limit_to_local_content], :unauthenticated)

	user = insert(:user, nickname: "user@example.com", local: false)
	reading_user = insert(:user)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/#{user.nickname}")

	assert json_response(conn, 404)

	conn =
	build_conn()
	\|> assign(:user, reading_user)
	\|> get("/api/v1/accounts/#{user.nickname}")

	Pleroma.Config.put([:instance, :limit_to_local_content], limit_to_local)
	assert %{"id" => id} = json_response(conn, 200)
	assert id == user.id
	end

	test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
	# Need to set an old-style integer ID to reproduce the problem
	# (these are no longer assigned to new accounts but were preserved
	# for existing accounts during the migration to flakeIDs)
	user_one = insert(:user, %{id: 1212})
	user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})

	resp_one =
	conn
	\|> get("/api/v1/accounts/#{user_one.id}")

	resp_two =
	conn
	\|> get("/api/v1/accounts/#{user_two.nickname}")

	resp_three =
	conn
	\|> get("/api/v1/accounts/#{user_two.id}")

	acc_one = json_response(resp_one, 200)
	acc_two = json_response(resp_two, 200)
	acc_three = json_response(resp_three, 200)
	refute acc_one == acc_two
	assert acc_two == acc_three
	end
	end

	describe "user timelines" do
	test "gets a users statuses", %{conn: conn} do
	user_one = insert(:user)
	user_two = insert(:user)
	user_three = insert(:user)

	{:ok, user_three} = User.follow(user_three, user_one)

	{:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})

	{:ok, direct_activity} =
	CommonAPI.post(user_one, %{
	"status" => "Hi, @#{user_two.nickname}.",
	"visibility" => "direct"
	})

	{:ok, private_activity} =
	CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})

	resp =
	conn
	\|> get("/api/v1/accounts/#{user_one.id}/statuses")

	assert [%{"id" => id}] = json_response(resp, 200)
	assert id == to_string(activity.id)

	resp =
	conn
	\|> assign(:user, user_two)
	\|> get("/api/v1/accounts/#{user_one.id}/statuses")

	assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
	assert id_one == to_string(direct_activity.id)
	assert id_two == to_string(activity.id)

	resp =
	conn
	\|> assign(:user, user_three)
	\|> get("/api/v1/accounts/#{user_one.id}/statuses")

	assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
	assert id_one == to_string(private_activity.id)
	assert id_two == to_string(activity.id)
	end

	test "unimplemented pinned statuses feature", %{conn: conn} do
	note = insert(:note_activity)
	user = User.get_cached_by_ap_id(note.data["actor"])

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")

	assert json_response(conn, 200) == []
	end

	test "gets an users media", %{conn: conn} do
	note = insert(:note_activity)
	user = User.get_cached_by_ap_id(note.data["actor"])

	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)

	{:ok, image_post} = CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "true"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(image_post.id)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "1"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(image_post.id)
	end

	test "gets a user's statuses without reblogs", %{conn: conn} do
	user = insert(:user)
	{:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
	{:ok, _, _} = CommonAPI.repeat(post.id, user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "true"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(post.id)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "1"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(post.id)
	end

	test "filters user's statuses by a hashtag", %{conn: conn} do
	user = insert(:user)
	{:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
	{:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"tagged" => "hashtag"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(post.id)
	end
	end

	describe "followers" do
	test "getting followers", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{other_user.id}/followers")

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(user.id)
	end

	test "getting followers, hide_followers", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user, %{info: %{hide_followers: true}})
	{:ok, _user} = User.follow(user, other_user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{other_user.id}/followers")

	assert [] == json_response(conn, 200)
	end

	test "getting followers, hide_followers, same user requesting", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user, %{info: %{hide_followers: true}})
	{:ok, _user} = User.follow(user, other_user)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> get("/api/v1/accounts/#{other_user.id}/followers")

	refute [] == json_response(conn, 200)
	end

	test "getting followers, pagination", %{conn: conn} do
	user = insert(:user)
	follower1 = insert(:user)
	follower2 = insert(:user)
	follower3 = insert(:user)
	{:ok, _} = User.follow(follower1, user)
	{:ok, _} = User.follow(follower2, user)
	{:ok, _} = User.follow(follower3, user)

	conn =
	conn
	\|> assign(:user, user)

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")

	assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
	assert id3 == follower3.id
	assert id2 == follower2.id

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")

	assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
	assert id2 == follower2.id
	assert id1 == follower1.id

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")

	assert [%{"id" => id2}] = json_response(res_conn, 200)
	assert id2 == follower2.id

	assert [link_header] = get_resp_header(res_conn, "link")
	assert link_header =~ ~r/min_id=#{follower2.id}/
	assert link_header =~ ~r/max_id=#{follower2.id}/
	end
	end

	describe "following" do
	test "getting following", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following")

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(other_user.id)
	end

	test "getting following, hide_follows", %{conn: conn} do
	user = insert(:user, %{info: %{hide_follows: true}})
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following")

	assert [] == json_response(conn, 200)
	end

	test "getting following, hide_follows, same user requesting", %{conn: conn} do
	user = insert(:user, %{info: %{hide_follows: true}})
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/#{user.id}/following")

	refute [] == json_response(conn, 200)
	end

	test "getting following, pagination", %{conn: conn} do
	user = insert(:user)
	following1 = insert(:user)
	following2 = insert(:user)
	following3 = insert(:user)
	{:ok, _} = User.follow(user, following1)
	{:ok, _} = User.follow(user, following2)
	{:ok, _} = User.follow(user, following3)

	conn =
	conn
	\|> assign(:user, user)

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")

	assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
	assert id3 == following3.id
	assert id2 == following2.id

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")

	assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
	assert id2 == following2.id
	assert id1 == following1.id

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")

	assert [%{"id" => id2}] = json_response(res_conn, 200)
	assert id2 == following2.id

	assert [link_header] = get_resp_header(res_conn, "link")
	assert link_header =~ ~r/min_id=#{following2.id}/
	assert link_header =~ ~r/max_id=#{following2.id}/
	end
	end

	describe "follow/unfollow" do
	test "following / unfollowing a user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/follow")

	assert %{"id" => _id, "following" => true} = json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/unfollow")

	assert %{"id" => _id, "following" => false} = json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/follows", %{"uri" => other_user.nickname})

	assert %{"id" => id} = json_response(conn, 200)
	assert id == to_string(other_user.id)
	end

	test "following without reblogs" do
	follower = insert(:user)
	followed = insert(:user)
	other_user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, follower)
	\|> post("/api/v1/accounts/#{followed.id}/follow?reblogs=false")

	assert %{"showing_reblogs" => false} = json_response(conn, 200)

	{:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
	{:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)

	conn =
	build_conn()
	\|> assign(:user, User.get_cached_by_id(follower.id))
	\|> get("/api/v1/timelines/home")

	assert [] == json_response(conn, 200)

	conn =
	build_conn()
	\|> assign(:user, follower)
	\|> post("/api/v1/accounts/#{followed.id}/follow?reblogs=true")

	assert %{"showing_reblogs" => true} = json_response(conn, 200)

	conn =
	build_conn()
	\|> assign(:user, User.get_cached_by_id(follower.id))
	\|> get("/api/v1/timelines/home")

	expected_activity_id = reblog.id
	assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
	end

	test "following / unfollowing errors" do
	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, user)

	# self follow
	conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# self unfollow
	user = User.get_cached_by_id(user.id)
	conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# self follow via uri
	user = User.get_cached_by_id(user.id)
	conn_res = post(conn, "/api/v1/follows", %{"uri" => user.nickname})
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# follow non existing user
	conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# follow non existing user via uri
	conn_res = post(conn, "/api/v1/follows", %{"uri" => "doesntexist"})
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# unfollow non existing user
	conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)
	end
	end

	describe "mute/unmute" do
	test "with notifications", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/mute")

	response = json_response(conn, 200)

	assert %{"id" => _id, "muting" => true, "muting_notifications" => true} = response
	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/unmute")

	response = json_response(conn, 200)
	assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
	end

	test "without notifications", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})

	response = json_response(conn, 200)

	assert %{"id" => _id, "muting" => true, "muting_notifications" => false} = response
	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/unmute")

	response = json_response(conn, 200)
	assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
	end
	end

	describe "pinned statuses" do
	setup do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})

	[user: user, activity: activity]
	end

	test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
	{:ok, _} = CommonAPI.pin(activity.id, user)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
	\|> json_response(200)

	id_str = to_string(activity.id)

	assert [%{"id" => ^id_str, "pinned" => true}] = result
	end
	end

	test "blocking / unblocking a user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/block")

	assert %{"id" => _id, "blocking" => true} = json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/unblock")

	assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
	end
	+
	+ describe "create account by app" do
	+ setup do
	+ valid_params = %{
	+ username: "lain",
	+ email: "lain@example.org",
	+ password: "PlzDontHackLain",
	+ agreement: true
	+ }
	+
	+ [valid_params: valid_params]
	+ end
	+
	+ test "Account registration via Application", %{conn: conn} do
	+ conn =
	+ conn
	+ \|> post("/api/v1/apps", %{
	+ client_name: "client_name",
	+ redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
	+ scopes: "read, write, follow"
	+ })
	+
	+ %{
	+ "client_id" => client_id,
	+ "client_secret" => client_secret,
	+ "id" => _,
	+ "name" => "client_name",
	+ "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
	+ "vapid_key" => _,
	+ "website" => nil
	+ } = json_response(conn, 200)
	+
	+ conn =
	+ conn
	+ \|> post("/oauth/token", %{
	+ grant_type: "client_credentials",
	+ client_id: client_id,
	+ client_secret: client_secret
	+ })
	+
	+ assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
	+ json_response(conn, 200)
	+
	+ assert token
	+ token_from_db = Repo.get_by(Token, token: token)
	+ assert token_from_db
	+ assert refresh
	+ assert scope == "read write follow"
	+
	+ conn =
	+ build_conn()
	+ \|> put_req_header("authorization", "Bearer " <> token)
	+ \|> post("/api/v1/accounts", %{
	+ username: "lain",
	+ email: "lain@example.org",
	+ password: "PlzDontHackLain",
	+ bio: "Test Bio",
	+ agreement: true
	+ })
	+
	+ %{
	+ "access_token" => token,
	+ "created_at" => _created_at,
	+ "scope" => _scope,
	+ "token_type" => "Bearer"
	+ } = json_response(conn, 200)
	+
	+ token_from_db = Repo.get_by(Token, token: token)
	+ assert token_from_db
	+ token_from_db = Repo.preload(token_from_db, :user)
	+ assert token_from_db.user
	+
	+ assert token_from_db.user.info.confirmation_pending
	+ end
	+
	+ test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
	+ _user = insert(:user, email: "lain@example.org")
	+ app_token = insert(:oauth_token, user: nil)
	+
	+ conn =
	+ conn
	+ \|> put_req_header("authorization", "Bearer " <> app_token.token)
	+
	+ res = post(conn, "/api/v1/accounts", valid_params)
	+ assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
	+ end
	+
	+ test "rate limit", %{conn: conn} do
	+ app_token = insert(:oauth_token, user: nil)
	+
	+ conn =
	+ put_req_header(conn, "authorization", "Bearer " <> app_token.token)
	+ \|> Map.put(:remote_ip, {15, 15, 15, 15})
	+
	+ for i <- 1..5 do
	+ conn =
	+ conn
	+ \|> post("/api/v1/accounts", %{
	+ username: "#{i}lain",
	+ email: "#{i}lain@example.org",
	+ password: "PlzDontHackLain",
	+ agreement: true
	+ })
	+
	+ %{
	+ "access_token" => token,
	+ "created_at" => _created_at,
	+ "scope" => _scope,
	+ "token_type" => "Bearer"
	+ } = json_response(conn, 200)
	+
	+ token_from_db = Repo.get_by(Token, token: token)
	+ assert token_from_db
	+ token_from_db = Repo.preload(token_from_db, :user)
	+ assert token_from_db.user
	+
	+ assert token_from_db.user.info.confirmation_pending
	+ end
	+
	+ conn =
	+ conn
	+ \|> post("/api/v1/accounts", %{
	+ username: "6lain",
	+ email: "6lain@example.org",
	+ password: "PlzDontHackLain",
	+ agreement: true
	+ })
	+
	+ assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
	+ end
	+
	+ test "returns bad_request if missing required params", %{
	+ conn: conn,
	+ valid_params: valid_params
	+ } do
	+ app_token = insert(:oauth_token, user: nil)
	+
	+ conn =
	+ conn
	+ \|> put_req_header("authorization", "Bearer " <> app_token.token)
	+
	+ res = post(conn, "/api/v1/accounts", valid_params)
	+ assert json_response(res, 200)
	+
	+ [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
	+ \|> Stream.zip(valid_params)
	+ \|> Enum.each(fn {ip, {attr, _}} ->
	+ res =
	+ conn
	+ \|> Map.put(:remote_ip, ip)
	+ \|> post("/api/v1/accounts", Map.delete(valid_params, attr))
	+ \|> json_response(400)
	+
	+ assert res == %{"error" => "Missing parameters"}
	+ end)
	+ end
	+
	+ test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
	+ conn =
	+ conn
	+ \|> put_req_header("authorization", "Bearer " <> "invalid-token")
	+
	+ res = post(conn, "/api/v1/accounts", valid_params)
	+ assert json_response(res, 403) == %{"error" => "Invalid credentials"}
	+ end
	+ end
	+
	+ describe "GET /api/v1/accounts/:id/lists - account_lists" do
	+ test "returns lists to which the account belongs", %{conn: conn} do
	+ user = insert(:user)
	+ other_user = insert(:user)
	+ assert {:ok, %Pleroma.List{} = list} = Pleroma.List.create("Test List", user)
	+ {:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)
	+
	+ res =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/api/v1/accounts/#{other_user.id}/lists")
	+ \|> json_response(200)
	+
	+ assert res == [%{"id" => to_string(list.id), "title" => "Test List"}]
	+ end
	+ end
	+
	+ describe "verify_credentials" do
	+ test "verify_credentials", %{conn: conn} do
	+ user = insert(:user)
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/api/v1/accounts/verify_credentials")
	+
	+ response = json_response(conn, 200)
	+
	+ assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
	+ assert response["pleroma"]["chat_token"]
	+ assert id == to_string(user.id)
	+ end
	+
	+ test "verify_credentials default scope unlisted", %{conn: conn} do
	+ user = insert(:user, %{info: %User.Info{default_scope: "unlisted"}})
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/api/v1/accounts/verify_credentials")
	+
	+ assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
	+ assert id == to_string(user.id)
	+ end
	+
	+ test "locked accounts", %{conn: conn} do
	+ user = insert(:user, %{info: %User.Info{default_scope: "private"}})
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/api/v1/accounts/verify_credentials")
	+
	+ assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
	+ assert id == to_string(user.id)
	+ end
	+ end
	+
	+ describe "user relationships" do
	+ test "returns the relationships for the current user", %{conn: conn} do
	+ user = insert(:user)
	+ other_user = insert(:user)
	+ {:ok, user} = User.follow(user, other_user)
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/api/v1/accounts/relationships", %{"id" => [other_user.id]})
	+
	+ assert [relationship] = json_response(conn, 200)
	+
	+ assert to_string(other_user.id) == relationship["id"]
	+ end
	+
	+ test "returns an empty list on a bad request", %{conn: conn} do
	+ user = insert(:user)
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/api/v1/accounts/relationships", %{})
	+
	+ assert [] = json_response(conn, 200)
	+ end
	+ end
	end
	diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
	index 0acc5d067..f2f8c0578 100644
	--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
	+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
	@@ -1,1122 +1,886 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
	use Pleroma.Web.ConnCase

	alias Ecto.Changeset
	alias Pleroma.Config
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.OAuth.App
	- alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Push

	import ExUnit.CaptureLog
	import Pleroma.Factory
	import Swoosh.TestAssertions
	import Tesla.Mock

	setup do
	mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	clear_config([:instance, :public])
	clear_config([:rich_media, :enabled])

	- test "verify_credentials", %{conn: conn} do
	- user = insert(:user)
	-
	- conn =
	- conn
	- \|> assign(:user, user)
	- \|> get("/api/v1/accounts/verify_credentials")
	-
	- response = json_response(conn, 200)
	-
	- assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
	- assert response["pleroma"]["chat_token"]
	- assert id == to_string(user.id)
	- end
	-
	- test "verify_credentials default scope unlisted", %{conn: conn} do
	- user = insert(:user, %{info: %User.Info{default_scope: "unlisted"}})
	-
	- conn =
	- conn
	- \|> assign(:user, user)
	- \|> get("/api/v1/accounts/verify_credentials")
	-
	- assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
	- assert id == to_string(user.id)
	- end
	-
	test "apps/verify_credentials", %{conn: conn} do
	token = insert(:oauth_token)

	conn =
	conn
	\|> assign(:user, token.user)
	\|> assign(:token, token)
	\|> get("/api/v1/apps/verify_credentials")

	app = Repo.preload(token, :app).app

	expected = %{
	"name" => app.client_name,
	"website" => app.website,
	"vapid_key" => Push.vapid_config() \|> Keyword.get(:public_key)
	}

	assert expected == json_response(conn, 200)
	end

	test "creates an oauth app", %{conn: conn} do
	user = insert(:user)
	app_attrs = build(:oauth_app)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/apps", %{
	client_name: app_attrs.client_name,
	redirect_uris: app_attrs.redirect_uris
	})

	[app] = Repo.all(App)

	expected = %{
	"name" => app.client_name,
	"website" => app.website,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret,
	"id" => app.id \|> to_string(),
	"redirect_uri" => app.redirect_uris,
	"vapid_key" => Push.vapid_config() \|> Keyword.get(:public_key)
	}

	assert expected == json_response(conn, 200)
	end

	- describe "user relationships" do
	- test "returns the relationships for the current user", %{conn: conn} do
	- user = insert(:user)
	- other_user = insert(:user)
	- {:ok, user} = User.follow(user, other_user)
	-
	- conn =
	- conn
	- \|> assign(:user, user)
	- \|> get("/api/v1/accounts/relationships", %{"id" => [other_user.id]})
	-
	- assert [relationship] = json_response(conn, 200)
	-
	- assert to_string(other_user.id) == relationship["id"]
	- end
	-
	- test "returns an empty list on a bad request", %{conn: conn} do
	- user = insert(:user)
	-
	- conn =
	- conn
	- \|> assign(:user, user)
	- \|> get("/api/v1/accounts/relationships", %{})
	-
	- assert [] = json_response(conn, 200)
	- end
	- end
	-
	describe "media upload" do
	setup do
	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, user)

	image = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	[conn: conn, image: image]
	end

	clear_config([:media_proxy])
	clear_config([Pleroma.Upload])

	test "returns uploaded image", %{conn: conn, image: image} do
	desc = "Description of the image"

	media =
	conn
	\|> post("/api/v1/media", %{"file" => image, "description" => desc})
	\|> json_response(:ok)

	assert media["type"] == "image"
	assert media["description"] == desc
	assert media["id"]

	object = Repo.get(Object, media["id"])
	assert object.data["actor"] == User.ap_id(conn.assigns[:user])
	end
	end

	- describe "locked accounts" do
	- test "verify_credentials", %{conn: conn} do
	- user = insert(:user, %{info: %User.Info{default_scope: "private"}})
	-
	- conn =
	- conn
	- \|> assign(:user, user)
	- \|> get("/api/v1/accounts/verify_credentials")
	-
	- assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
	- assert id == to_string(user.id)
	- end
	- end
	-
	describe "/api/v1/pleroma/mascot" do
	test "mascot upload", %{conn: conn} do
	user = insert(:user)

	non_image_file = %Plug.Upload{
	content_type: "audio/mpeg",
	path: Path.absname("test/fixtures/sound.mp3"),
	filename: "sound.mp3"
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/v1/pleroma/mascot", %{"file" => non_image_file})

	assert json_response(conn, 415)

	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> put("/api/v1/pleroma/mascot", %{"file" => file})

	assert %{"id" => _, "type" => image} = json_response(conn, 200)
	end

	test "mascot retrieving", %{conn: conn} do
	user = insert(:user)
	# When user hasn't set a mascot, we should just get pleroma tan back
	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/pleroma/mascot")

	assert %{"url" => url} = json_response(conn, 200)
	assert url =~ "pleroma-fox-tan-smol"

	# When a user sets their mascot, we should get that back
	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> put("/api/v1/pleroma/mascot", %{"file" => file})

	assert json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> get("/api/v1/pleroma/mascot")

	assert %{"url" => url, "type" => "image"} = json_response(conn, 200)
	assert url =~ "an_image"
	end
	end

	test "getting a list of mutes", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, user} = User.mute(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/mutes")

	other_user_id = to_string(other_user.id)
	assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
	end

	test "getting a list of blocks", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, user} = User.block(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/blocks")

	other_user_id = to_string(other_user.id)
	assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
	end

	test "unimplemented follow_requests, blocks, domain blocks" do
	user = insert(:user)

	["blocks", "domain_blocks", "follow_requests"]
	\|> Enum.each(fn endpoint ->
	conn =
	build_conn()
	\|> assign(:user, user)
	\|> get("/api/v1/#{endpoint}")

	assert [] = json_response(conn, 200)
	end)
	end

	test "returns the favorites of a user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _} = CommonAPI.post(other_user, %{"status" => "bla"})
	{:ok, activity} = CommonAPI.post(other_user, %{"status" => "traps are happy"})

	{:ok, _, _} = CommonAPI.favorite(activity.id, user)

	first_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/favourites")

	assert [status] = json_response(first_conn, 200)
	assert status["id"] == to_string(activity.id)

	assert [{"link", _link_header}] =
	Enum.filter(first_conn.resp_headers, fn element -> match?({"link", _}, element) end)

	# Honours query params
	{:ok, second_activity} =
	CommonAPI.post(other_user, %{
	"status" =>
	"Trees Are Never Sad Look At Them Every Once In Awhile They're Quite Beautiful."
	})

	{:ok, _, _} = CommonAPI.favorite(second_activity.id, user)

	last_like = status["id"]

	second_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/favourites?since_id=#{last_like}")

	assert [second_status] = json_response(second_conn, 200)
	assert second_status["id"] == to_string(second_activity.id)

	third_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/favourites?limit=0")

	assert [] = json_response(third_conn, 200)
	end

	test "get instance information", %{conn: conn} do
	conn = get(conn, "/api/v1/instance")
	assert result = json_response(conn, 200)

	email = Config.get([:instance, :email])
	# Note: not checking for "max_toot_chars" since it's optional
	assert %{
	"uri" => _,
	"title" => _,
	"description" => _,
	"version" => _,
	"email" => from_config_email,
	"urls" => %{
	"streaming_api" => _
	},
	"stats" => _,
	"thumbnail" => _,
	"languages" => _,
	"registrations" => _,
	"poll_limits" => _
	} = result

	assert email == from_config_email
	end

	test "get instance stats", %{conn: conn} do
	user = insert(:user, %{local: true})

	user2 = insert(:user, %{local: true})
	{:ok, _user2} = User.deactivate(user2, !user2.info.deactivated)

	insert(:user, %{local: false, nickname: "u@peer1.com"})
	insert(:user, %{local: false, nickname: "u@peer2.com"})

	{:ok, _} = CommonAPI.post(user, %{"status" => "cofe"})

	# Stats should count users with missing or nil `info.deactivated` value

	{:ok, _user} =
	user.id
	\|> User.get_cached_by_id()
	\|> User.update_info(&Changeset.change(&1, %{deactivated: nil}))

	Pleroma.Stats.force_update()

	conn = get(conn, "/api/v1/instance")

	assert result = json_response(conn, 200)

	stats = result["stats"]

	assert stats
	assert stats["user_count"] == 1
	assert stats["status_count"] == 1
	assert stats["domain_count"] == 2
	end

	test "get peers", %{conn: conn} do
	insert(:user, %{local: false, nickname: "u@peer1.com"})
	insert(:user, %{local: false, nickname: "u@peer2.com"})

	Pleroma.Stats.force_update()

	conn = get(conn, "/api/v1/instance/peers")

	assert result = json_response(conn, 200)

	assert ["peer1.com", "peer2.com"] == Enum.sort(result)
	end

	test "put settings", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/web/settings", %{"data" => %{"programming" => "socks"}})

	assert _result = json_response(conn, 200)

	user = User.get_cached_by_ap_id(user.ap_id)
	assert user.info.settings == %{"programming" => "socks"}
	end

	describe "link headers" do
	test "preserves parameters in link headers", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity1} =
	CommonAPI.post(other_user, %{
	"status" => "hi @#{user.nickname}",
	"visibility" => "public"
	})

	{:ok, activity2} =
	CommonAPI.post(other_user, %{
	"status" => "hi @#{user.nickname}",
	"visibility" => "public"
	})

	notification1 = Repo.get_by(Notification, activity_id: activity1.id)
	notification2 = Repo.get_by(Notification, activity_id: activity2.id)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications", %{media_only: true})

	assert [link_header] = get_resp_header(conn, "link")
	assert link_header =~ ~r/media_only=true/
	assert link_header =~ ~r/min_id=#{notification2.id}/
	assert link_header =~ ~r/max_id=#{notification1.id}/
	end
	end

	describe "custom emoji" do
	test "with tags", %{conn: conn} do
	[emoji \| _body] =
	conn
	\|> get("/api/v1/custom_emojis")
	\|> json_response(200)

	assert Map.has_key?(emoji, "shortcode")
	assert Map.has_key?(emoji, "static_url")
	assert Map.has_key?(emoji, "tags")
	assert is_list(emoji["tags"])
	assert Map.has_key?(emoji, "category")
	assert Map.has_key?(emoji, "url")
	assert Map.has_key?(emoji, "visible_in_picker")
	end
	end

	describe "index/2 redirections" do
	setup %{conn: conn} do
	session_opts = [
	store: :cookie,
	key: "_test",
	signing_salt: "cooldude"
	]

	conn =
	conn
	\|> Plug.Session.call(Plug.Session.init(session_opts))
	\|> fetch_session()

	test_path = "/web/statuses/test"
	%{conn: conn, path: test_path}
	end

	test "redirects not logged-in users to the login page", %{conn: conn, path: path} do
	conn = get(conn, path)

	assert conn.status == 302
	assert redirected_to(conn) == "/web/login"
	end

	test "redirects not logged-in users to the login page on private instances", %{
	conn: conn,
	path: path
	} do
	Config.put([:instance, :public], false)

	conn = get(conn, path)

	assert conn.status == 302
	assert redirected_to(conn) == "/web/login"
	end

	test "does not redirect logged in users to the login page", %{conn: conn, path: path} do
	token = insert(:oauth_token)

	conn =
	conn
	\|> assign(:user, token.user)
	\|> put_session(:oauth_token, token.token)
	\|> get(path)

	assert conn.status == 200
	end

	test "saves referer path to session", %{conn: conn, path: path} do
	conn = get(conn, path)
	return_to = Plug.Conn.get_session(conn, :return_to)

	assert return_to == path
	end

	test "redirects to the saved path after log in", %{conn: conn, path: path} do
	app = insert(:oauth_app, client_name: "Mastodon-Local", redirect_uris: ".")
	auth = insert(:oauth_authorization, app: app)

	conn =
	conn
	\|> put_session(:return_to, path)
	\|> get("/web/login", %{code: auth.token})

	assert conn.status == 302
	assert redirected_to(conn) == path
	end

	test "redirects to the getting-started page when referer is not present", %{conn: conn} do
	app = insert(:oauth_app, client_name: "Mastodon-Local", redirect_uris: ".")
	auth = insert(:oauth_authorization, app: app)

	conn = get(conn, "/web/login", %{code: auth.token})

	assert conn.status == 302
	assert redirected_to(conn) == "/web/getting-started"
	end
	end

	- describe "create account by app" do
	- setup do
	- valid_params = %{
	- username: "lain",
	- email: "lain@example.org",
	- password: "PlzDontHackLain",
	- agreement: true
	- }
	-
	- [valid_params: valid_params]
	- end
	-
	- test "Account registration via Application", %{conn: conn} do
	- conn =
	- conn
	- \|> post("/api/v1/apps", %{
	- client_name: "client_name",
	- redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
	- scopes: "read, write, follow"
	- })
	-
	- %{
	- "client_id" => client_id,
	- "client_secret" => client_secret,
	- "id" => _,
	- "name" => "client_name",
	- "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
	- "vapid_key" => _,
	- "website" => nil
	- } = json_response(conn, 200)
	-
	- conn =
	- conn
	- \|> post("/oauth/token", %{
	- grant_type: "client_credentials",
	- client_id: client_id,
	- client_secret: client_secret
	- })
	-
	- assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
	- json_response(conn, 200)
	-
	- assert token
	- token_from_db = Repo.get_by(Token, token: token)
	- assert token_from_db
	- assert refresh
	- assert scope == "read write follow"
	-
	- conn =
	- build_conn()
	- \|> put_req_header("authorization", "Bearer " <> token)
	- \|> post("/api/v1/accounts", %{
	- username: "lain",
	- email: "lain@example.org",
	- password: "PlzDontHackLain",
	- bio: "Test Bio",
	- agreement: true
	- })
	-
	- %{
	- "access_token" => token,
	- "created_at" => _created_at,
	- "scope" => _scope,
	- "token_type" => "Bearer"
	- } = json_response(conn, 200)
	-
	- token_from_db = Repo.get_by(Token, token: token)
	- assert token_from_db
	- token_from_db = Repo.preload(token_from_db, :user)
	- assert token_from_db.user
	-
	- assert token_from_db.user.info.confirmation_pending
	- end
	-
	- test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
	- _user = insert(:user, email: "lain@example.org")
	- app_token = insert(:oauth_token, user: nil)
	-
	- conn =
	- conn
	- \|> put_req_header("authorization", "Bearer " <> app_token.token)
	-
	- res = post(conn, "/api/v1/accounts", valid_params)
	- assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
	- end
	-
	- test "rate limit", %{conn: conn} do
	- app_token = insert(:oauth_token, user: nil)
	-
	- conn =
	- put_req_header(conn, "authorization", "Bearer " <> app_token.token)
	- \|> Map.put(:remote_ip, {15, 15, 15, 15})
	-
	- for i <- 1..5 do
	- conn =
	- conn
	- \|> post("/api/v1/accounts", %{
	- username: "#{i}lain",
	- email: "#{i}lain@example.org",
	- password: "PlzDontHackLain",
	- agreement: true
	- })
	-
	- %{
	- "access_token" => token,
	- "created_at" => _created_at,
	- "scope" => _scope,
	- "token_type" => "Bearer"
	- } = json_response(conn, 200)
	-
	- token_from_db = Repo.get_by(Token, token: token)
	- assert token_from_db
	- token_from_db = Repo.preload(token_from_db, :user)
	- assert token_from_db.user
	-
	- assert token_from_db.user.info.confirmation_pending
	- end
	-
	- conn =
	- conn
	- \|> post("/api/v1/accounts", %{
	- username: "6lain",
	- email: "6lain@example.org",
	- password: "PlzDontHackLain",
	- agreement: true
	- })
	-
	- assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
	- end
	-
	- test "returns bad_request if missing required params", %{
	- conn: conn,
	- valid_params: valid_params
	- } do
	- app_token = insert(:oauth_token, user: nil)
	-
	- conn =
	- conn
	- \|> put_req_header("authorization", "Bearer " <> app_token.token)
	-
	- res = post(conn, "/api/v1/accounts", valid_params)
	- assert json_response(res, 200)
	-
	- [{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
	- \|> Stream.zip(valid_params)
	- \|> Enum.each(fn {ip, {attr, _}} ->
	- res =
	- conn
	- \|> Map.put(:remote_ip, ip)
	- \|> post("/api/v1/accounts", Map.delete(valid_params, attr))
	- \|> json_response(400)
	-
	- assert res == %{"error" => "Missing parameters"}
	- end)
	- end
	-
	- test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
	- conn =
	- conn
	- \|> put_req_header("authorization", "Bearer " <> "invalid-token")
	-
	- res = post(conn, "/api/v1/accounts", valid_params)
	- assert json_response(res, 403) == %{"error" => "Invalid credentials"}
	- end
	- end
	-
	describe "GET /api/v1/polls/:id" do
	test "returns poll entity for object id", %{conn: conn} do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "Pleroma does",
	"poll" => %{"options" => ["what Mastodon't", "n't what Mastodoes"], "expires_in" => 20}
	})

	object = Object.normalize(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/polls/#{object.id}")

	response = json_response(conn, 200)
	id = to_string(object.id)
	assert %{"id" => ^id, "expired" => false, "multiple" => false} = response
	end

	test "does not expose polls for private statuses", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "Pleroma does",
	"poll" => %{"options" => ["what Mastodon't", "n't what Mastodoes"], "expires_in" => 20},
	"visibility" => "private"
	})

	object = Object.normalize(activity)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> get("/api/v1/polls/#{object.id}")

	assert json_response(conn, 404)
	end
	end

	describe "POST /api/v1/polls/:id/votes" do
	test "votes are added to the poll", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "A very delicious sandwich",
	"poll" => %{
	"options" => ["Lettuce", "Grilled Bacon", "Tomato"],
	"expires_in" => 20,
	"multiple" => true
	}
	})

	object = Object.normalize(activity)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> post("/api/v1/polls/#{object.id}/votes", %{"choices" => [0, 1, 2]})

	assert json_response(conn, 200)
	object = Object.get_by_id(object.id)

	assert Enum.all?(object.data["anyOf"], fn %{"replies" => %{"totalItems" => total_items}} ->
	total_items == 1
	end)
	end

	test "author can't vote", %{conn: conn} do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "Am I cute?",
	"poll" => %{"options" => ["Yes", "No"], "expires_in" => 20}
	})

	object = Object.normalize(activity)

	assert conn
	\|> assign(:user, user)
	\|> post("/api/v1/polls/#{object.id}/votes", %{"choices" => [1]})
	\|> json_response(422) == %{"error" => "Poll's author can't vote"}

	object = Object.get_by_id(object.id)

	refute Enum.at(object.data["oneOf"], 1)["replies"]["totalItems"] == 1
	end

	test "does not allow multiple choices on a single-choice question", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "The glass is",
	"poll" => %{"options" => ["half empty", "half full"], "expires_in" => 20}
	})

	object = Object.normalize(activity)

	assert conn
	\|> assign(:user, other_user)
	\|> post("/api/v1/polls/#{object.id}/votes", %{"choices" => [0, 1]})
	\|> json_response(422) == %{"error" => "Too many choices"}

	object = Object.get_by_id(object.id)

	refute Enum.any?(object.data["oneOf"], fn %{"replies" => %{"totalItems" => total_items}} ->
	total_items == 1
	end)
	end

	test "does not allow choice index to be greater than options count", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "Am I cute?",
	"poll" => %{"options" => ["Yes", "No"], "expires_in" => 20}
	})

	object = Object.normalize(activity)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> post("/api/v1/polls/#{object.id}/votes", %{"choices" => [2]})

	assert json_response(conn, 422) == %{"error" => "Invalid indices"}
	end

	test "returns 404 error when object is not exist", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/polls/1/votes", %{"choices" => [0]})

	assert json_response(conn, 404) == %{"error" => "Record not found"}
	end

	test "returns 404 when poll is private and not available for user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "Am I cute?",
	"poll" => %{"options" => ["Yes", "No"], "expires_in" => 20},
	"visibility" => "private"
	})

	object = Object.normalize(activity)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> post("/api/v1/polls/#{object.id}/votes", %{"choices" => [0]})

	assert json_response(conn, 404) == %{"error" => "Record not found"}
	end
	end

	describe "POST /auth/password, with valid parameters" do
	setup %{conn: conn} do
	user = insert(:user)
	conn = post(conn, "/auth/password?email=#{user.email}")
	%{conn: conn, user: user}
	end

	test "it returns 204", %{conn: conn} do
	assert json_response(conn, :no_content)
	end

	test "it creates a PasswordResetToken record for user", %{user: user} do
	token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
	assert token_record
	end

	test "it sends an email to user", %{user: user} do
	ObanHelpers.perform_all()
	token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)

	email = Pleroma.Emails.UserEmail.password_reset_email(user, token_record.token)
	notify_email = Config.get([:instance, :notify_email])
	instance_name = Config.get([:instance, :name])

	assert_email_sent(
	from: {instance_name, notify_email},
	to: {user.name, user.email},
	html_body: email.html_body
	)
	end
	end

	describe "POST /auth/password, with invalid parameters" do
	setup do
	user = insert(:user)
	{:ok, user: user}
	end

	test "it returns 404 when user is not found", %{conn: conn, user: user} do
	conn = post(conn, "/auth/password?email=nonexisting_#{user.email}")
	assert conn.status == 404
	assert conn.resp_body == ""
	end

	test "it returns 400 when user is not local", %{conn: conn, user: user} do
	{:ok, user} = Repo.update(Changeset.change(user, local: false))
	conn = post(conn, "/auth/password?email=#{user.email}")
	assert conn.status == 400
	assert conn.resp_body == ""
	end
	end

	describe "GET /api/v1/suggestions" do
	setup do
	user = insert(:user)
	other_user = insert(:user)
	host = Config.get([Pleroma.Web.Endpoint, :url, :host])
	url500 = "http://test500?#{host}&#{user.nickname}"
	url200 = "http://test200?#{host}&#{user.nickname}"

	mock(fn
	%{method: :get, url: ^url500} ->
	%Tesla.Env{status: 500, body: "bad request"}

	%{method: :get, url: ^url200} ->
	%Tesla.Env{
	status: 200,
	body:
	~s([{"acct":"yj455","avatar":"https://social.heldscal.la/avatar/201.jpeg","avatar_static":"https://social.heldscal.la/avatar/s/201.jpeg"}, {"acct":"#{
	other_user.ap_id
	}","avatar":"https://social.heldscal.la/avatar/202.jpeg","avatar_static":"https://social.heldscal.la/avatar/s/202.jpeg"}])
	}
	end)

	[user: user, other_user: other_user]
	end

	clear_config(:suggestions)

	test "returns empty result when suggestions disabled", %{conn: conn, user: user} do
	Config.put([:suggestions, :enabled], false)

	res =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/suggestions")
	\|> json_response(200)

	assert res == []
	end

	test "returns error", %{conn: conn, user: user} do
	Config.put([:suggestions, :enabled], true)
	Config.put([:suggestions, :third_party_engine], "http://test500?{{host}}&{{user}}")

	assert capture_log(fn ->
	res =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/suggestions")
	\|> json_response(500)

	assert res == "Something went wrong"
	end) =~ "Could not retrieve suggestions"
	end

	test "returns suggestions", %{conn: conn, user: user, other_user: other_user} do
	Config.put([:suggestions, :enabled], true)
	Config.put([:suggestions, :third_party_engine], "http://test200?{{host}}&{{user}}")

	res =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/suggestions")
	\|> json_response(200)

	assert res == [
	%{
	"acct" => "yj455",
	"avatar" => "https://social.heldscal.la/avatar/201.jpeg",
	"avatar_static" => "https://social.heldscal.la/avatar/s/201.jpeg",
	"id" => 0
	},
	%{
	"acct" => other_user.ap_id,
	"avatar" => "https://social.heldscal.la/avatar/202.jpeg",
	"avatar_static" => "https://social.heldscal.la/avatar/s/202.jpeg",
	"id" => other_user.id
	}
	]
	end
	end

	describe "PUT /api/v1/media/:id" do
	setup do
	actor = insert(:user)

	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, %Object{} = object} =
	ActivityPub.upload(
	file,
	actor: User.ap_id(actor),
	description: "test-m"
	)

	[actor: actor, object: object]
	end

	test "updates name of media", %{conn: conn, actor: actor, object: object} do
	media =
	conn
	\|> assign(:user, actor)
	\|> put("/api/v1/media/#{object.id}", %{"description" => "test-media"})
	\|> json_response(:ok)

	assert media["description"] == "test-media"
	assert refresh_record(object).data["name"] == "test-media"
	end

	test "returns error wheb request is bad", %{conn: conn, actor: actor, object: object} do
	media =
	conn
	\|> assign(:user, actor)
	\|> put("/api/v1/media/#{object.id}", %{})
	\|> json_response(400)

	assert media == %{"error" => "bad_request"}
	end
	end

	describe "DELETE /auth/sign_out" do
	test "redirect to root page", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> delete("/auth/sign_out")

	assert conn.status == 302
	assert redirected_to(conn) == "/"
	end
	end

	describe "empty_array, stubs for mastodon api" do
	test "GET /api/v1/accounts/:id/identity_proofs", %{conn: conn} do
	user = insert(:user)

	res =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/#{user.id}/identity_proofs")
	\|> json_response(200)

	assert res == []
	end

	test "GET /api/v1/endorsements", %{conn: conn} do
	user = insert(:user)

	res =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/endorsements")
	\|> json_response(200)

	assert res == []
	end

	test "GET /api/v1/trends", %{conn: conn} do
	user = insert(:user)

	res =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/trends")
	\|> json_response(200)

	assert res == []
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sun, Aug 30, 12:20 AM (1 d, 15 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1737637
Default Alt Text: (113 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions