No OneTemporary
Actions

Size

89 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web.ex b/lib/pleroma/web.ex
	index d26931af9..5761e3b38 100644
	--- a/lib/pleroma/web.ex
	+++ b/lib/pleroma/web.ex
	@@ -1,234 +1,242 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web do
	@moduledoc """
	A module that keeps using definitions for controllers,
	views and so on.

	This can be used in your application as:

	use Pleroma.Web, :controller
	use Pleroma.Web, :view

	The definitions below will be executed for every view,
	controller, etc, so keep them short and clean, focused
	on imports, uses and aliases.

	Do NOT define functions inside the quoted expressions
	below.
	"""

	alias Pleroma.Helpers.AuthHelper
	alias Pleroma.Web.Plugs.EnsureAuthenticatedPlug
	alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	alias Pleroma.Web.Plugs.ExpectAuthenticatedCheckPlug
	alias Pleroma.Web.Plugs.ExpectPublicOrAuthenticatedCheckPlug
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.PlugHelper

	def controller do
	quote do
	use Phoenix.Controller, namespace: Pleroma.Web

	import Plug.Conn

	import Pleroma.Web.Gettext
	import Pleroma.Web.TranslationHelpers

	alias Pleroma.Web.Router.Helpers, as: Routes

	plug(:set_put_layout)

	defp set_put_layout(conn, _) do
	put_layout(conn, Pleroma.Config.get(:app_layout, "app.html"))
	end

	# Marks plugs intentionally skipped and blocks their execution if present in plugs chain
	defp skip_plug(conn, plug_modules) do
	plug_modules
	\|> List.wrap()
	\|> Enum.reduce(
	conn,
	fn plug_module, conn ->
	try do
	plug_module.skip_plug(conn)
	rescue
	UndefinedFunctionError ->
	raise "`#{plug_module}` is not skippable. Append `use Pleroma.Web, :plug` to its code."
	end
	end
	)
	end

	+ defp skip_auth(conn, _) do
	+ skip_plug(conn, [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug])
	+ end
	+
	+ defp skip_public_check(conn, _) do
	+ skip_plug(conn, EnsurePublicOrAuthenticatedPlug)
	+ end
	+
	# Executed just before actual controller action, invokes before-action hooks (callbacks)
	defp action(conn, params) do
	with %{halted: false} = conn <-
	maybe_drop_authentication_if_oauth_check_ignored(conn),
	%{halted: false} = conn <- maybe_perform_public_or_authenticated_check(conn),
	%{halted: false} = conn <- maybe_perform_authenticated_check(conn),
	%{halted: false} = conn <- maybe_halt_on_missing_oauth_scopes_check(conn) do
	super(conn, params)
	end
	end

	# For non-authenticated API actions, drops auth info if OAuth scopes check was ignored
	# (neither performed nor explicitly skipped)
	defp maybe_drop_authentication_if_oauth_check_ignored(conn) do
	if PlugHelper.plug_called?(conn, ExpectPublicOrAuthenticatedCheckPlug) and
	not PlugHelper.plug_called_or_skipped?(conn, OAuthScopesPlug) do
	AuthHelper.drop_auth_info(conn)
	else
	conn
	end
	end

	# Ensures instance is public -or- user is authenticated if such check was scheduled
	defp maybe_perform_public_or_authenticated_check(conn) do
	if PlugHelper.plug_called?(conn, ExpectPublicOrAuthenticatedCheckPlug) do
	EnsurePublicOrAuthenticatedPlug.call(conn, %{})
	else
	conn
	end
	end

	# Ensures user is authenticated if such check was scheduled
	# Note: runs prior to action even if it was already executed earlier in plug chain
	# (since OAuthScopesPlug has option of proceeding unauthenticated)
	defp maybe_perform_authenticated_check(conn) do
	if PlugHelper.plug_called?(conn, ExpectAuthenticatedCheckPlug) do
	EnsureAuthenticatedPlug.call(conn, %{})
	else
	conn
	end
	end

	# Halts if authenticated API action neither performs nor explicitly skips OAuth scopes check
	defp maybe_halt_on_missing_oauth_scopes_check(conn) do
	if PlugHelper.plug_called?(conn, ExpectAuthenticatedCheckPlug) and
	not PlugHelper.plug_called_or_skipped?(conn, OAuthScopesPlug) do
	conn
	\|> render_error(
	:forbidden,
	"Security violation: OAuth scopes check was neither handled nor explicitly skipped."
	)
	\|> halt()
	else
	conn
	end
	end
	end
	end

	def view do
	quote do
	use Phoenix.View,
	root: "lib/pleroma/web/templates",
	namespace: Pleroma.Web

	# Import convenience functions from controllers
	import Phoenix.Controller, only: [get_csrf_token: 0, get_flash: 2, view_module: 1]

	import Pleroma.Web.ErrorHelpers
	import Pleroma.Web.Gettext

	alias Pleroma.Web.Router.Helpers, as: Routes

	require Logger

	@doc "Same as `render/3` but wrapped in a rescue block"
	def safe_render(view, template, assigns \\ %{}) do
	Phoenix.View.render(view, template, assigns)
	rescue
	error ->
	Logger.error(
	"#{__MODULE__} failed to render #{inspect({view, template})}\n" <>
	Exception.format(:error, error, __STACKTRACE__)
	)

	nil
	end

	@doc """
	Same as `render_many/4` but wrapped in rescue block.
	"""
	def safe_render_many(collection, view, template, assigns \\ %{}) do
	Enum.map(collection, fn resource ->
	as = Map.get(assigns, :as) \|\| view.__resource__
	assigns = Map.put(assigns, as, resource)
	safe_render(view, template, assigns)
	end)
	\|> Enum.filter(& &1)
	end
	end
	end

	def router do
	quote do
	use Phoenix.Router
	# credo:disable-for-next-line Credo.Check.Consistency.MultiAliasImportRequireUse
	import Plug.Conn
	import Phoenix.Controller
	end
	end

	def channel do
	quote do
	# credo:disable-for-next-line Credo.Check.Consistency.MultiAliasImportRequireUse
	import Phoenix.Channel
	import Pleroma.Web.Gettext
	end
	end

	def plug do
	quote do
	@behaviour Pleroma.Web.Plug
	@behaviour Plug

	@doc """
	Marks a plug intentionally skipped and blocks its execution if it's present in plugs chain.
	"""
	def skip_plug(conn) do
	PlugHelper.append_to_private_list(
	conn,
	PlugHelper.skipped_plugs_list_id(),
	__MODULE__
	)
	end

	@impl Plug
	@doc """
	Before-plug hook that
	* ensures the plug is not skipped
	* processes `:if_func` / `:unless_func` functional pre-run conditions
	* adds plug to the list of called plugs and calls `perform/2` if checks are passed

	Note: multiple invocations of the same plug (with different or same options) are allowed.
	"""
	def call(%Plug.Conn{} = conn, options) do
	if PlugHelper.plug_skipped?(conn, __MODULE__) \|\|
	(options[:if_func] && !options[:if_func].(conn)) \|\|
	(options[:unless_func] && options[:unless_func].(conn)) do
	conn
	else
	conn =
	PlugHelper.append_to_private_list(
	conn,
	PlugHelper.called_plugs_list_id(),
	__MODULE__
	)

	apply(__MODULE__, :perform, [conn, options])
	end
	end
	end
	end

	@doc """
	When used, dispatch to the appropriate controller/view/etc.
	"""
	defmacro __using__(which) when is_atom(which) do
	apply(__MODULE__, which, [])
	end
	end
	diff --git a/lib/pleroma/web/masto_fe_controller.ex b/lib/pleroma/web/masto_fe_controller.ex
	index e788ab37a..d2460f51d 100644
	--- a/lib/pleroma/web/masto_fe_controller.ex
	+++ b/lib/pleroma/web/masto_fe_controller.ex
	@@ -1,65 +1,61 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastoFEController do
	use Pleroma.Web, :controller

	alias Pleroma.User
	alias Pleroma.Web.MastodonAPI.AuthController
	alias Pleroma.Web.OAuth.Token
	- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :put_settings)

	# Note: :index action handles attempt of unauthenticated access to private instance with redirect
	- plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action == :index)
	+ plug(:skip_public_check when action == :index)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read"], fallback: :proceed_unauthenticated}
	when action == :index
	)

	- plug(
	- :skip_plug,
	- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :manifest
	- )
	+ plug(:skip_auth when action == :manifest)

	@doc "GET /web/*path"
	def index(conn, _params) do
	with %{assigns: %{user: %User{} = user, token: %Token{app_id: token_app_id} = token}} <- conn,
	{:ok, %{id: ^token_app_id}} <- AuthController.local_mastofe_app() do
	conn
	\|> put_layout(false)
	\|> render("index.html",
	token: token.token,
	user: user,
	custom_emojis: Pleroma.Emoji.get_all()
	)
	else
	_ ->
	conn
	\|> put_session(:return_to, conn.request_path)
	\|> redirect(to: "/web/login")
	end
	end

	@doc "GET /web/manifest.json"
	def manifest(conn, _params) do
	render(conn, "manifest.json")
	end

	@doc "PUT /api/web/settings: Backend-obscure settings blob for MastoFE, don't parse/reuse elsewhere"
	def put_settings(%{assigns: %{user: user}} = conn, %{"data" => settings} = _params) do
	with {:ok, _} <- User.mastodon_settings_update(user, settings) do
	json(conn, %{})
	else
	e ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: inspect(e)})
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	index 4cc3645d4..5fcbffc34 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	@@ -1,486 +1,485 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [
	add_link_headers: 2,
	assign_account_by_id: 2,
	embed_relationships?: 1,
	json_response: 3
	]

	alias Pleroma.Maps
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.ListView
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	alias Pleroma.Web.MastodonAPI.MastodonAPIController
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.OAuth.OAuthController
	- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter
	alias Pleroma.Web.TwitterAPI.TwitterAPI
	alias Pleroma.Web.Utils.Params

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	- plug(:skip_plug, [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :create)
	+ plug(:skip_auth when action == :create)

	- plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action in [:show, :statuses])
	+ plug(:skip_public_check when action in [:show, :statuses])

	plug(
	OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["read:accounts"]}
	when action in [:show, :followers, :following]
	)

	plug(
	OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["read:statuses"]}
	when action == :statuses
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:accounts"]}
	when action in [:verify_credentials, :endorsements, :identity_proofs]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :update_credentials)

	plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :lists)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "read:blocks"]} when action == :blocks
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:blocks"]} when action in [:block, :unblock]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:follows"]} when action == :relationships)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]} when action in [:follow_by_uri, :follow, :unfollow]
	)

	plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)

	plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])

	@relationship_actions [:follow, :unfollow]
	@needs_account ~W(followers following lists follow unfollow mute unmute block unblock)a

	plug(
	RateLimiter,
	[name: :relation_id_action, params: [:id, :uri]] when action in @relationship_actions
	)

	plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
	plug(RateLimiter, [name: :app_account_creation] when action == :create)
	plug(:assign_account_by_id when action in @needs_account)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AccountOperation

	@doc "POST /api/v1/accounts"
	def create(%{assigns: %{app: app}, body_params: params} = conn, _params) do
	with :ok <- validate_email_param(params),
	:ok <- TwitterAPI.validate_captcha(app, params),
	{:ok, user} <- TwitterAPI.register_user(params),
	{_, {:ok, token}} <-
	{:login, OAuthController.login(user, app, app.scopes)} do
	OAuthController.after_token_exchange(conn, %{user: user, token: token})
	else
	{:login, {:account_status, :confirmation_pending}} ->
	json_response(conn, :ok, %{
	message: "You have been registered. Please check your email for further instructions.",
	identifier: "missing_confirmed_email"
	})

	{:login, {:account_status, :approval_pending}} ->
	json_response(conn, :ok, %{
	message:
	"You have been registered. You'll be able to log in once your account is approved.",
	identifier: "awaiting_approval"
	})

	{:login, _} ->
	json_response(conn, :ok, %{
	message:
	"You have been registered. Some post-registration steps may be pending. " <>
	"Please log in manually.",
	identifier: "manual_login_required"
	})

	{:error, error} ->
	json_response(conn, :bad_request, %{error: error})
	end
	end

	def create(%{assigns: %{app: _app}} = conn, _) do
	render_error(conn, :bad_request, "Missing parameters")
	end

	def create(conn, _) do
	render_error(conn, :forbidden, "Invalid credentials")
	end

	defp validate_email_param(%{email: email}) when not is_nil(email), do: :ok

	defp validate_email_param(_) do
	case Pleroma.Config.get([:instance, :account_activation_required]) do
	true -> {:error, dgettext("errors", "Missing parameter: %{name}", name: "email")}
	_ -> :ok
	end
	end

	@doc "GET /api/v1/accounts/verify_credentials"
	def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	chat_token = Phoenix.Token.sign(conn, "user socket", user.id)

	render(conn, "show.json",
	user: user,
	for: user,
	with_pleroma_settings: true,
	with_chat_token: chat_token
	)
	end

	@doc "PATCH /api/v1/accounts/update_credentials"
	def update_credentials(%{assigns: %{user: user}, body_params: params} = conn, _params) do
	params =
	params
	\|> Enum.filter(fn {_, value} -> not is_nil(value) end)
	\|> Enum.into(%{})

	# We use an empty string as a special value to reset
	# avatars, banners, backgrounds
	user_image_value = fn
	"" -> {:ok, nil}
	value -> {:ok, value}
	end

	user_params =
	[
	:no_rich_text,
	:hide_followers_count,
	:hide_follows_count,
	:hide_followers,
	:hide_follows,
	:hide_favorites,
	:show_role,
	:skip_thread_containment,
	:allow_following_move,
	:also_known_as,
	:accepts_chat_messages
	]
	\|> Enum.reduce(%{}, fn key, acc ->
	Maps.put_if_present(acc, key, params[key], &{:ok, Params.truthy_param?(&1)})
	end)
	\|> Maps.put_if_present(:name, params[:display_name])
	\|> Maps.put_if_present(:bio, params[:note])
	\|> Maps.put_if_present(:raw_bio, params[:note])
	\|> Maps.put_if_present(:avatar, params[:avatar], user_image_value)
	\|> Maps.put_if_present(:banner, params[:header], user_image_value)
	\|> Maps.put_if_present(:background, params[:pleroma_background_image], user_image_value)
	\|> Maps.put_if_present(
	:raw_fields,
	params[:fields_attributes],
	&{:ok, normalize_fields_attributes(&1)}
	)
	\|> Maps.put_if_present(:pleroma_settings_store, params[:pleroma_settings_store])
	\|> Maps.put_if_present(:default_scope, params[:default_scope])
	\|> Maps.put_if_present(:default_scope, params["source"]["privacy"])
	\|> Maps.put_if_present(:actor_type, params[:bot], fn bot ->
	if bot, do: {:ok, "Service"}, else: {:ok, "Person"}
	end)
	\|> Maps.put_if_present(:actor_type, params[:actor_type])
	\|> Maps.put_if_present(:also_known_as, params[:also_known_as])
	# Note: param name is indeed :locked (not an error)
	\|> Maps.put_if_present(:is_locked, params[:locked])
	# Note: param name is indeed :discoverable (not an error)
	\|> Maps.put_if_present(:is_discoverable, params[:discoverable])

	# What happens here:
	#
	# We want to update the user through the pipeline, but the ActivityPub
	# update information is not quite enough for this, because this also
	# contains local settings that don't federate and don't even appear
	# in the Update activity.
	#
	# So we first build the normal local changeset, then apply it to the
	# user data, but don't persist it. With this, we generate the object
	# data for our update activity. We feed this and the changeset as meta
	# inforation into the pipeline, where they will be properly updated and
	# federated.
	with changeset <- User.update_changeset(user, user_params),
	{:ok, unpersisted_user} <- Ecto.Changeset.apply_action(changeset, :update),
	updated_object <-
	Pleroma.Web.ActivityPub.UserView.render("user.json", user: unpersisted_user)
	\|> Map.delete("@context"),
	{:ok, update_data, []} <- Builder.update(user, updated_object),
	{:ok, _update, _} <-
	Pipeline.common_pipeline(update_data,
	local: true,
	user_update_changeset: changeset
	) do
	render(conn, "show.json",
	user: unpersisted_user,
	for: unpersisted_user,
	with_pleroma_settings: true
	)
	else
	_e -> render_error(conn, :forbidden, "Invalid request")
	end
	end

	defp normalize_fields_attributes(fields) do
	if Enum.all?(fields, &is_tuple/1) do
	Enum.map(fields, fn {_, v} -> v end)
	else
	Enum.map(fields, fn
	%{} = field -> %{"name" => field.name, "value" => field.value}
	field -> field
	end)
	end
	end

	@doc "GET /api/v1/accounts/relationships"
	def relationships(%{assigns: %{user: user}} = conn, %{id: id}) do
	targets = User.get_all_by_ids(List.wrap(id))

	render(conn, "relationships.json", user: user, targets: targets)
	end

	# Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])

	@doc "GET /api/v1/accounts/:id"
	def show(%{assigns: %{user: for_user}} = conn, %{id: nickname_or_id} = params) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
	:visible <- User.visible_for(user, for_user) do
	render(conn, "show.json",
	user: user,
	for: for_user,
	embed_relationships: embed_relationships?(params)
	)
	else
	error -> user_visibility_error(conn, error)
	end
	end

	@doc "GET /api/v1/accounts/:id/statuses"
	def statuses(%{assigns: %{user: reading_user}} = conn, params) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(params.id, for: reading_user),
	:visible <- User.visible_for(user, reading_user) do
	params =
	params
	\|> Map.delete(:tagged)
	\|> Map.put(:tag, params[:tagged])

	activities = ActivityPub.fetch_user_activities(user, reading_user, params)

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json",
	activities: activities,
	for: reading_user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	error -> user_visibility_error(conn, error)
	end
	end

	defp user_visibility_error(conn, error) do
	case error do
	:restrict_unauthenticated ->
	render_error(conn, :unauthorized, "This API requires an authenticated user")

	_ ->
	render_error(conn, :not_found, "Can't find user")
	end
	end

	@doc "GET /api/v1/accounts/:id/followers"
	def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
	params =
	params
	\|> Enum.map(fn {key, value} -> {to_string(key), value} end)
	\|> Enum.into(%{})

	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_followers(user, params)
	user.hide_followers -> []
	true -> MastodonAPI.get_followers(user, params)
	end

	conn
	\|> add_link_headers(followers)
	# https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
	\|> render("index.json",
	for: for_user,
	users: followers,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/accounts/:id/following"
	def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
	params =
	params
	\|> Enum.map(fn {key, value} -> {to_string(key), value} end)
	\|> Enum.into(%{})

	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_friends(user, params)
	user.hide_follows -> []
	true -> MastodonAPI.get_friends(user, params)
	end

	conn
	\|> add_link_headers(followers)
	# https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
	\|> render("index.json",
	for: for_user,
	users: followers,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/accounts/:id/lists"
	def lists(%{assigns: %{user: user, account: account}} = conn, _params) do
	lists = Pleroma.List.get_lists_account_belongs(user, account)

	conn
	\|> put_view(ListView)
	\|> render("index.json", lists: lists)
	end

	@doc "POST /api/v1/accounts/:id/follow"
	def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not follow yourself"}
	end

	def follow(%{body_params: params, assigns: %{user: follower, account: followed}} = conn, _) do
	with {:ok, follower} <- MastodonAPI.follow(follower, followed, params) do
	render(conn, "relationship.json", user: follower, target: followed)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unfollow"
	def unfollow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not unfollow yourself"}
	end

	def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.unfollow(follower, followed) do
	render(conn, "relationship.json", user: follower, target: followed)
	end
	end

	@doc "POST /api/v1/accounts/:id/mute"
	def mute(%{assigns: %{user: muter, account: muted}, body_params: params} = conn, _params) do
	with {:ok, _user_relationships} <- User.mute(muter, muted, params) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unmute"
	def unmute(%{assigns: %{user: muter, account: muted}} = conn, _params) do
	with {:ok, _user_relationships} <- User.unmute(muter, muted) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/block"
	def block(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _activity} <- CommonAPI.block(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unblock"
	def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _activity} <- CommonAPI.unblock(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/follows"
	def follow_by_uri(%{body_params: %{uri: uri}} = conn, _) do
	case User.get_cached_by_nickname(uri) do
	%User{} = user ->
	conn
	\|> assign(:account, user)
	\|> follow(%{})

	nil ->
	{:error, :not_found}
	end
	end

	@doc "GET /api/v1/mutes"
	def mutes(%{assigns: %{user: user}} = conn, params) do
	users =
	user
	\|> User.muted_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Pagination.fetch_paginated(Map.put(params, :skip_order, true))

	conn
	\|> add_link_headers(users)
	\|> render("index.json",
	users: users,
	for: user,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/blocks"
	def blocks(%{assigns: %{user: user}} = conn, params) do
	users =
	user
	\|> User.blocked_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Pagination.fetch_paginated(Map.put(params, :skip_order, true))

	conn
	\|> add_link_headers(users)
	\|> render("index.json", users: users, for: user, as: :user)
	end

	@doc "GET /api/v1/endorsements"
	def endorsements(conn, params), do: MastodonAPIController.empty_array(conn, params)

	@doc "GET /api/v1/identity_proofs"
	def identity_proofs(conn, params), do: MastodonAPIController.empty_array(conn, params)
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/app_controller.ex b/lib/pleroma/web/mastodon_api/controllers/app_controller.ex
	index dd3b39c77..a95cc52fd 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/app_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/app_controller.ex
	@@ -1,59 +1,53 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AppController do
	@moduledoc """
	Controller for supporting app-related actions.
	If authentication is an option, app tokens (user-unbound) must be supported.
	"""

	use Pleroma.Web, :controller

	alias Pleroma.Repo
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Scopes
	alias Pleroma.Web.OAuth.Token
	- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	- alias Pleroma.Web.Plugs.OAuthScopesPlug

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	- plug(
	- :skip_plug,
	- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug]
	- when action in [:create, :verify_credentials]
	- )
	+ plug(:skip_auth when action in [:create, :verify_credentials])

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	@local_mastodon_name "Mastodon-Local"

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AppOperation

	@doc "POST /api/v1/apps"
	def create(%{body_params: params} = conn, _params) do
	scopes = Scopes.fetch_scopes(params, ["read"])

	app_attrs =
	params
	\|> Map.take([:client_name, :redirect_uris, :website])
	\|> Map.put(:scopes, scopes)

	with cs <- App.register_changeset(%App{}, app_attrs),
	false <- cs.changes[:client_name] == @local_mastodon_name,
	{:ok, app} <- Repo.insert(cs) do
	render(conn, "show.json", app: app)
	end
	end

	@doc """
	GET /api/v1/apps/verify_credentials
	Gets compact non-secret representation of the app. Supports app tokens and user tokens.
	"""
	def verify_credentials(%{assigns: %{token: %Token{} = token}} = conn, _) do
	with %{app: %App{} = app} <- Repo.preload(token, :app) do
	render(conn, "compact_non_secret.json", app: app)
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/custom_emoji_controller.ex b/lib/pleroma/web/mastodon_api/controllers/custom_emoji_controller.ex
	index d7e18dc92..31b647755 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/custom_emoji_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/custom_emoji_controller.ex
	@@ -1,21 +1,17 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.CustomEmojiController do
	use Pleroma.Web, :controller

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	- plug(
	- :skip_plug,
	- [Pleroma.Web.Plugs.OAuthScopesPlug, Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug]
	- when action == :index
	- )
	+ plug(:skip_auth when action == :index)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.CustomEmojiOperation

	def index(conn, _params) do
	render(conn, "index.json", custom_emojis: Pleroma.Emoji.get_all())
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/instance_controller.ex b/lib/pleroma/web/mastodon_api/controllers/instance_controller.ex
	index c7a5267d4..5376e4594 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/instance_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/instance_controller.ex
	@@ -1,27 +1,23 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.InstanceController do
	use Pleroma.Web, :controller

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	- plug(
	- :skip_plug,
	- [Pleroma.Web.Plugs.OAuthScopesPlug, Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug]
	- when action in [:show, :peers]
	- )
	+ plug(:skip_auth when action in [:show, :peers])

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.InstanceOperation

	@doc "GET /api/v1/instance"
	def show(conn, _params) do
	render(conn, "show.json")
	end

	@doc "GET /api/v1/instance/peers"
	def peers(conn, _params) do
	json(conn, Pleroma.Stats.get_peers())
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	index a1bcc91d9..a0f79f377 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	@@ -1,35 +1,31 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
	@moduledoc """
	Contains stubs for unimplemented Mastodon API endpoints.

	Note: instead of routing directly to this controller's action,
	it's preferable to define an action in relevant (non-generic) controller,
	set up OAuth rules for it and call this controller's function from it.
	"""

	use Pleroma.Web, :controller

	require Logger

	- plug(
	- :skip_plug,
	- [Pleroma.Web.Plugs.OAuthScopesPlug, Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug]
	- when action in [:empty_array, :empty_object]
	- )
	+ plug(:skip_auth when action in [:empty_array, :empty_object])

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	def empty_array(conn, _) do
	Logger.debug("Unimplemented, returning an empty array (list)")
	json(conn, [])
	end

	def empty_object(conn, _) do
	Logger.debug("Unimplemented, returning an empty object (map)")
	json(conn, %{})
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	index 724dc5c5d..2eff4d9d0 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	@@ -1,445 +1,442 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.StatusController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [try_render: 3, add_link_headers: 2]

	require Ecto.Query

	alias Pleroma.Activity
	alias Pleroma.Bookmark
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.ScheduledActivityView
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	- plug(
	- :skip_plug,
	- Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug when action in [:index, :show]
	- )
	+ plug(:skip_public_check when action in [:index, :show])

	@unauthenticated_access %{fallback: :proceed_unauthenticated, scopes: []}

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:statuses"]}
	when action in [
	:index,
	:show,
	:card,
	:context
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:statuses"]}
	when action in [
	:create,
	:delete,
	:reblog,
	:unreblog
	]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:favourites"]} when action == :favourites)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:favourites"]} when action in [:favourite, :unfavourite]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:mutes"]} when action in [:mute_conversation, :unmute_conversation]
	)

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:accounts"]}
	when action in [:favourited_by, :reblogged_by]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action in [:pin, :unpin])

	# Note: scope not present in Mastodon: read:bookmarks
	plug(OAuthScopesPlug, %{scopes: ["read:bookmarks"]} when action == :bookmarks)

	# Note: scope not present in Mastodon: write:bookmarks
	plug(
	OAuthScopesPlug,
	%{scopes: ["write:bookmarks"]} when action in [:bookmark, :unbookmark]
	)

	@rate_limited_status_actions ~w(reblog unreblog favourite unfavourite create delete)a

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: [:id]]
	when action in ~w(reblog unreblog)a
	)

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:fav_unfav", params: [:id]]
	when action in ~w(favourite unfavourite)a
	)

	plug(RateLimiter, [name: :statuses_actions] when action in @rate_limited_status_actions)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.StatusOperation

	@doc """
	GET `/api/v1/statuses?ids[]=1&ids[]=2`

	`ids` query param is required
	"""
	def index(%{assigns: %{user: user}} = conn, %{ids: ids} = params) do
	limit = 100

	activities =
	ids
	\|> Enum.take(limit)
	\|> Activity.all_by_ids_with_object()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))

	render(conn, "index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	end

	@doc """
	POST /api/v1/statuses
	"""
	# Creates a scheduled status when `scheduled_at` param is present and it's far enough
	def create(
	%{
	assigns: %{user: user},
	body_params: %{status: _, scheduled_at: scheduled_at} = params
	} = conn,
	_
	)
	when not is_nil(scheduled_at) do
	params =
	Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	\|> put_application(conn)

	attrs = %{
	params: Map.new(params, fn {key, value} -> {to_string(key), value} end),
	scheduled_at: scheduled_at
	}

	with {:far_enough, true} <- {:far_enough, ScheduledActivity.far_enough?(scheduled_at)},
	{:ok, scheduled_activity} <- ScheduledActivity.create(user, attrs) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", scheduled_activity: scheduled_activity)
	else
	{:far_enough, _} ->
	params = Map.drop(params, [:scheduled_at])
	create(%Plug.Conn{conn \| body_params: params}, %{})

	error ->
	error
	end
	end

	# Creates a regular status
	def create(%{assigns: %{user: user}, body_params: %{status: _} = params} = conn, _) do
	params =
	Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	\|> put_application(conn)

	with {:ok, activity} <- CommonAPI.post(user, params) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	as: :activity,
	with_direct_conversation_id: true
	)
	else
	{:error, {:reject, message}} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	def create(%{assigns: %{user: _user}, body_params: %{media_ids: _} = params} = conn, _) do
	params = Map.put(params, :status, "")
	create(%Plug.Conn{conn \| body_params: params}, %{})
	end

	@doc "GET /api/v1/statuses/:id"
	def show(%{assigns: %{user: user}} = conn, %{id: id} = params) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "DELETE /api/v1/statuses/:id"
	def delete(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_source: true
	)
	else
	_e -> {:error, :not_found}
	end
	end

	@doc "POST /api/v1/statuses/:id/reblog"
	def reblog(%{assigns: %{user: user}, body_params: params} = conn, %{id: ap_id_or_id}) do
	with {:ok, announce} <- CommonAPI.repeat(ap_id_or_id, user, params),
	%Activity{} = announce <- Activity.normalize(announce.data) do
	try_render(conn, "show.json", %{activity: announce, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/unreblog"
	def unreblog(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	with {:ok, _unannounce} <- CommonAPI.unrepeat(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", %{activity: activity, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/favourite"
	def favourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	with {:ok, _fav} <- CommonAPI.favorite(user, activity_id),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unfavourite"
	def unfavourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	with {:ok, _unfav} <- CommonAPI.unfavorite(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/pin"
	def pin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
	with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	{:error, :pinned_statuses_limit_reached} ->
	{:error, "You have already pinned the maximum number of statuses"}

	{:error, :ownership_error} ->
	{:error, :unprocessable_entity, "Someone else's status cannot be pinned"}

	{:error, :visibility_error} ->
	{:error, :unprocessable_entity, "Non-public status cannot be pinned"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/unpin"
	def unpin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
	with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/bookmark"
	def bookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.create(user.id, activity.id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unbookmark"
	def unbookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.destroy(user.id, activity.id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/mute"
	def mute_conversation(%{assigns: %{user: user}, body_params: params} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	{:ok, activity} <- CommonAPI.add_mute(user, activity, params) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unmute"
	def unmute_conversation(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	{:ok, activity} <- CommonAPI.remove_mute(user, activity) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "GET /api/v1/statuses/:id/card"
	@deprecated "https://github.com/tootsuite/mastodon/pull/11213"
	def card(%{assigns: %{user: user}} = conn, %{id: status_id}) do
	with %Activity{} = activity <- Activity.get_by_id(status_id),
	true <- Visibility.visible_for_user?(activity, user) do
	data = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
	render(conn, "card.json", data)
	else
	_ -> render_error(conn, :not_found, "Record not found")
	end
	end

	@doc "GET /api/v1/statuses/:id/favourited_by"
	def favourited_by(%{assigns: %{user: user}} = conn, %{id: id}) do
	with true <- Pleroma.Config.get([:instance, :show_reactions]),
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"likes" => likes}} <- Object.normalize(activity, fetch: false) do
	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^likes)
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/reblogged_by"
	def reblogged_by(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"announcements" => announces, "id" => ap_id}} <-
	Object.normalize(activity, fetch: false) do
	announces =
	"Announce"
	\|> Activity.Queries.by_type()
	\|> Ecto.Query.where([a], a.actor in ^announces)
	# this is to use the index
	\|> Activity.Queries.by_object_id(ap_id)
	\|> Repo.all()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))
	\|> Enum.map(& &1.actor)
	\|> Enum.uniq()

	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^announces)
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/context"
	def context(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id(id) do
	activities =
	ActivityPub.fetch_activities_for_context(activity.data["context"], %{
	blocking_user: user,
	user: user,
	exclude_id: activity.id
	})

	render(conn, "context.json", activity: activity, activities: activities, user: user)
	end
	end

	@doc "GET /api/v1/favourites"
	def favourites(%{assigns: %{user: %User{} = user}} = conn, params) do
	activities = ActivityPub.fetch_favourites(user, params)

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	@doc "GET /api/v1/bookmarks"
	def bookmarks(%{assigns: %{user: user}} = conn, params) do
	user = User.get_cached_by_id(user.id)

	bookmarks =
	user.id
	\|> Bookmark.for_user_query()
	\|> Pleroma.Pagination.fetch_paginated(params)

	activities =
	bookmarks
	\|> Enum.map(fn b -> Map.put(b.activity, :bookmark, Map.delete(b, :activity)) end)

	conn
	\|> add_link_headers(bookmarks)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	defp put_application(params, %{assigns: %{token: %Token{user: %User{} = user} = token}} = _conn) do
	if user.disclose_client do
	%{client_name: client_name, website: website} = Repo.preload(token, :app).app
	Map.put(params, :generator, %{type: "Application", name: client_name, url: website})
	else
	Map.put(params, :generator, nil)
	end
	end

	defp put_application(params, _), do: Map.put(params, :generator, nil)
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex b/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
	index 845f546d4..4b49b74ca 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
	@@ -1,207 +1,206 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.TimelineController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [add_link_headers: 2, add_link_headers: 3]

	alias Pleroma.Config
	alias Pleroma.Pagination
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter

	plug(Pleroma.Web.ApiSpec.CastAndValidate)
	- plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action in [:public, :hashtag])
	+ plug(:skip_public_check when action in [:public, :hashtag])

	# TODO: Replace with a macro when there is a Phoenix release with the following commit in it:
	# https://github.com/phoenixframework/phoenix/commit/2e8c63c01fec4dde5467dbbbf9705ff9e780735e

	plug(RateLimiter, [name: :timeline, bucket_name: :direct_timeline] when action == :direct)
	plug(RateLimiter, [name: :timeline, bucket_name: :public_timeline] when action == :public)
	plug(RateLimiter, [name: :timeline, bucket_name: :home_timeline] when action == :home)
	plug(RateLimiter, [name: :timeline, bucket_name: :hashtag_timeline] when action == :hashtag)
	plug(RateLimiter, [name: :timeline, bucket_name: :list_timeline] when action == :list)

	plug(OAuthScopesPlug, %{scopes: ["read:statuses"]} when action in [:home, :direct])
	plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :list)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:statuses"], fallback: :proceed_unauthenticated}
	when action in [:public, :hashtag]
	)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.TimelineOperation

	# GET /api/v1/timelines/home
	def home(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put(:type, ["Create", "Announce"])
	\|> Map.put(:blocking_user, user)
	\|> Map.put(:muting_user, user)
	\|> Map.put(:reply_filtering_user, user)
	\|> Map.put(:announce_filtering_user, user)
	\|> Map.put(:user, user)
	\|> Map.put(:local_only, params[:local])
	\|> Map.delete(:local)

	activities =
	[user.ap_id \| User.following(user)]
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	end

	# GET /api/v1/timelines/direct
	def direct(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put(:type, "Create")
	\|> Map.put(:blocking_user, user)
	\|> Map.put(:user, user)
	\|> Map.put(:visibility, "direct")

	activities =
	[user.ap_id]
	\|> ActivityPub.fetch_activities_query(params)
	\|> Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	defp restrict_unauthenticated?(true = _local_only) do
	Config.restrict_unauthenticated_access?(:timelines, :local)
	end

	defp restrict_unauthenticated?(_) do
	Config.restrict_unauthenticated_access?(:timelines, :federated)
	end

	# GET /api/v1/timelines/public
	def public(%{assigns: %{user: user}} = conn, params) do
	local_only = params[:local]

	if is_nil(user) and restrict_unauthenticated?(local_only) do
	fail_on_bad_auth(conn)
	else
	activities =
	params
	\|> Map.put(:type, ["Create"])
	\|> Map.put(:local_only, local_only)
	\|> Map.put(:blocking_user, user)
	\|> Map.put(:muting_user, user)
	\|> Map.put(:reply_filtering_user, user)
	\|> Map.put(:instance, params[:instance])
	\|> ActivityPub.fetch_public_activities()

	conn
	\|> add_link_headers(activities, %{"local" => local_only})
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	end
	end

	defp fail_on_bad_auth(conn) do
	render_error(conn, :unauthorized, "authorization required for timeline view")
	end

	defp hashtag_fetching(params, user, local_only) do
	# Note: not sanitizing tag options at this stage (may be mix-cased, have duplicates etc.)
	tags_any =
	[params[:tag], params[:any]]
	\|> List.flatten()
	\|> Enum.filter(& &1)

	tag_all = Map.get(params, :all, [])
	tag_reject = Map.get(params, :none, [])

	params
	\|> Map.put(:type, "Create")
	\|> Map.put(:local_only, local_only)
	\|> Map.put(:blocking_user, user)
	\|> Map.put(:muting_user, user)
	\|> Map.put(:user, user)
	\|> Map.put(:tag, tags_any)
	\|> Map.put(:tag_all, tag_all)
	\|> Map.put(:tag_reject, tag_reject)
	\|> ActivityPub.fetch_public_activities()
	end

	# GET /api/v1/timelines/tag/:tag
	def hashtag(%{assigns: %{user: user}} = conn, params) do
	local_only = params[:local]

	if is_nil(user) and restrict_unauthenticated?(local_only) do
	fail_on_bad_auth(conn)
	else
	activities = hashtag_fetching(params, user, local_only)

	conn
	\|> add_link_headers(activities, %{"local" => local_only})
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	end
	end

	# GET /api/v1/timelines/list/:list_id
	def list(%{assigns: %{user: user}} = conn, %{list_id: id} = params) do
	with %Pleroma.List{title: _title, following: following} <- Pleroma.List.get(id, user) do
	params =
	params
	\|> Map.put(:type, "Create")
	\|> Map.put(:blocking_user, user)
	\|> Map.put(:user, user)
	\|> Map.put(:muting_user, user)
	\|> Map.put(:local_only, params[:local])

	# we must filter the following list for the user to avoid leaking statuses the user
	# does not actually have permission to see (for more info, peruse security issue #270).

	user_following = User.following(user)

	activities =
	following
	\|> Enum.filter(fn x -> x in user_following end)
	\|> ActivityPub.fetch_activities_bounded(following, params)
	\|> Enum.reverse()

	render(conn, "index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_e -> render_error(conn, :forbidden, "Error.")
	end
	end
	end
	diff --git a/lib/pleroma/web/o_auth/o_auth_controller.ex b/lib/pleroma/web/o_auth/o_auth_controller.ex
	index 6951e0253..247d8399c 100644
	--- a/lib/pleroma/web/o_auth/o_auth_controller.ex
	+++ b/lib/pleroma/web/o_auth/o_auth_controller.ex
	@@ -1,639 +1,636 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthController do
	use Pleroma.Web, :controller

	alias Pleroma.Helpers.AuthHelper
	alias Pleroma.Helpers.UriHelper
	alias Pleroma.Maps
	alias Pleroma.MFA
	alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.Auth.WrapperAuthenticator, as: Authenticator
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.MFAController
	alias Pleroma.Web.OAuth.MFAView
	alias Pleroma.Web.OAuth.OAuthView
	alias Pleroma.Web.OAuth.Scopes
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.OAuth.Token.Strategy.RefreshToken
	alias Pleroma.Web.OAuth.Token.Strategy.Revoke, as: RevokeToken
	alias Pleroma.Web.Plugs.RateLimiter
	alias Pleroma.Web.Utils.Params

	require Logger

	if Pleroma.Config.oauth_consumer_enabled?(), do: plug(Ueberauth)

	plug(:fetch_session)
	plug(:fetch_flash)

	- plug(:skip_plug, [
	- Pleroma.Web.Plugs.OAuthScopesPlug,
	- Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	- ])
	+ plug(:skip_auth)

	plug(RateLimiter, [name: :authentication] when action == :create_authorization)

	action_fallback(Pleroma.Web.OAuth.FallbackController)

	@oob_token_redirect_uri "urn:ietf:wg:oauth:2.0:oob"

	# Note: this definition is only called from error-handling methods with `conn.params` as 2nd arg
	def authorize(%Plug.Conn{} = conn, %{"authorization" => _} = params) do
	{auth_attrs, params} = Map.pop(params, "authorization")
	authorize(conn, Map.merge(params, auth_attrs))
	end

	def authorize(%Plug.Conn{assigns: %{token: %Token{}}} = conn, %{"force_login" => _} = params) do
	if Params.truthy_param?(params["force_login"]) do
	do_authorize(conn, params)
	else
	handle_existing_authorization(conn, params)
	end
	end

	# Note: the token is set in oauth_plug, but the token and client do not always go together.
	# For example, MastodonFE's token is set if user requests with another client,
	# after user already authorized to MastodonFE.
	# So we have to check client and token.
	def authorize(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{"client_id" => client_id} = params
	) do
	with %Token{} = t <- Repo.get_by(Token, token: token.token) \|> Repo.preload(:app),
	^client_id <- t.app.client_id do
	handle_existing_authorization(conn, params)
	else
	_ -> do_authorize(conn, params)
	end
	end

	def authorize(%Plug.Conn{} = conn, params), do: do_authorize(conn, params)

	defp do_authorize(%Plug.Conn{} = conn, params) do
	app = Repo.get_by(App, client_id: params["client_id"])
	available_scopes = (app && app.scopes) \|\| []
	scopes = Scopes.fetch_scopes(params, available_scopes)

	user =
	with %{assigns: %{user: %User{} = user}} <- conn do
	user
	else
	_ -> nil
	end

	scopes =
	if scopes == [] do
	available_scopes
	else
	scopes
	end

	# Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template
	render(conn, Authenticator.auth_template(), %{
	user: user,
	app: app && Map.delete(app, :client_secret),
	response_type: params["response_type"],
	client_id: params["client_id"],
	available_scopes: available_scopes,
	scopes: scopes,
	redirect_uri: params["redirect_uri"],
	state: params["state"],
	params: params
	})
	end

	defp handle_existing_authorization(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{"redirect_uri" => @oob_token_redirect_uri}
	) do
	render(conn, "oob_token_exists.html", %{token: token})
	end

	defp handle_existing_authorization(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{} = params
	) do
	app = Repo.preload(token, :app).app

	redirect_uri =
	if is_binary(params["redirect_uri"]) do
	params["redirect_uri"]
	else
	default_redirect_uri(app)
	end

	if redirect_uri in String.split(app.redirect_uris) do
	redirect_uri = redirect_uri(conn, redirect_uri)
	url_params = %{access_token: token.token}
	url_params = Maps.put_if_present(url_params, :state, params["state"])
	url = UriHelper.modify_uri_params(redirect_uri, url_params)
	redirect(conn, external: url)
	else
	conn
	\|> put_flash(:error, dgettext("errors", "Unlisted redirect_uri."))
	\|> redirect(external: redirect_uri(conn, redirect_uri))
	end
	end

	def create_authorization(_, _, opts \\ [])

	def create_authorization(%Plug.Conn{assigns: %{user: %User{} = user}} = conn, params, []) do
	create_authorization(conn, params, user: user)
	end

	def create_authorization(%Plug.Conn{} = conn, %{"authorization" => _} = params, opts) do
	with {:ok, auth, user} <- do_create_authorization(conn, params, opts[:user]),
	{:mfa_required, _, _, false} <- {:mfa_required, user, auth, MFA.require?(user)} do
	after_create_authorization(conn, auth, params)
	else
	error ->
	handle_create_authorization_error(conn, error, params)
	end
	end

	def after_create_authorization(%Plug.Conn{} = conn, %Authorization{} = auth, %{
	"authorization" => %{"redirect_uri" => @oob_token_redirect_uri}
	}) do
	# Enforcing the view to reuse the template when calling from other controllers
	conn
	\|> put_view(OAuthView)
	\|> render("oob_authorization_created.html", %{auth: auth})
	end

	def after_create_authorization(%Plug.Conn{} = conn, %Authorization{} = auth, %{
	"authorization" => %{"redirect_uri" => redirect_uri} = auth_attrs
	}) do
	app = Repo.preload(auth, :app).app

	# An extra safety measure before we redirect (also done in `do_create_authorization/2`)
	if redirect_uri in String.split(app.redirect_uris) do
	redirect_uri = redirect_uri(conn, redirect_uri)
	url_params = %{code: auth.token}
	url_params = Maps.put_if_present(url_params, :state, auth_attrs["state"])
	url = UriHelper.modify_uri_params(redirect_uri, url_params)
	redirect(conn, external: url)
	else
	conn
	\|> put_flash(:error, dgettext("errors", "Unlisted redirect_uri."))
	\|> redirect(external: redirect_uri(conn, redirect_uri))
	end
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:error, scopes_issue},
	%{"authorization" => _} = params
	)
	when scopes_issue in [:unsupported_scopes, :missing_scopes] do
	# Per https://github.com/tootsuite/mastodon/blob/
	# 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L39
	conn
	\|> put_flash(:error, dgettext("errors", "This action is outside the authorized scopes"))
	\|> put_status(:unauthorized)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :confirmation_pending},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Your login is missing a confirmed e-mail address"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:mfa_required, user, auth, _},
	params
	) do
	{:ok, token} = MFA.Token.create(user, auth)

	data = %{
	"mfa_token" => token.token,
	"redirect_uri" => params["authorization"]["redirect_uri"],
	"state" => params["authorization"]["state"]
	}

	MFAController.show(conn, data)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :password_reset_pending},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Password reset is required"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :deactivated},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Your account is currently disabled"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(%Plug.Conn{} = conn, error, %{"authorization" => _}) do
	Authenticator.handle_error(conn, error)
	end

	@doc "Renew access_token with refresh_token"
	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "refresh_token", "refresh_token" => token} = _params
	) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	{:ok, %{user: user} = token} <- Token.get_by_refresh_token(app, token),
	{:ok, token} <- RefreshToken.grant(token) do
	after_token_exchange(conn, %{user: user, token: token})
	else
	_error -> render_invalid_credentials_error(conn)
	end
	end

	def token_exchange(%Plug.Conn{} = conn, %{"grant_type" => "authorization_code"} = params) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	fixed_token = Token.Utils.fix_padding(params["code"]),
	{:ok, auth} <- Authorization.get_by_token(app, fixed_token),
	%User{} = user <- User.get_cached_by_id(auth.user_id),
	{:ok, token} <- Token.exchange_token(app, auth) do
	after_token_exchange(conn, %{user: user, token: token})
	else
	error ->
	handle_token_exchange_error(conn, error)
	end
	end

	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "password"} = params
	) do
	with {:ok, %User{} = user} <- Authenticator.get_user(conn),
	{:ok, app} <- Token.Utils.fetch_app(conn),
	requested_scopes <- Scopes.fetch_scopes(params, app.scopes),
	{:ok, token} <- login(user, app, requested_scopes) do
	after_token_exchange(conn, %{user: user, token: token})
	else
	error ->
	handle_token_exchange_error(conn, error)
	end
	end

	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "password", "name" => name, "password" => _password} = params
	) do
	params =
	params
	\|> Map.delete("name")
	\|> Map.put("username", name)

	token_exchange(conn, params)
	end

	def token_exchange(%Plug.Conn{} = conn, %{"grant_type" => "client_credentials"} = _params) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	{:ok, auth} <- Authorization.create_authorization(app, %User{}),
	{:ok, token} <- Token.exchange_token(app, auth) do
	after_token_exchange(conn, %{token: token})
	else
	_error ->
	handle_token_exchange_error(conn, :invalid_credentails)
	end
	end

	# Bad request
	def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params)

	def after_token_exchange(%Plug.Conn{} = conn, %{token: token} = view_params) do
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> json(OAuthView.render("token.json", view_params))
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:mfa_required, user, auth, _}) do
	conn
	\|> put_status(:forbidden)
	\|> json(build_and_response_mfa_token(user, auth))
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:account_status, :deactivated}) do
	render_error(
	conn,
	:forbidden,
	"Your account is currently disabled",
	%{},
	"account_is_disabled"
	)
	end

	defp handle_token_exchange_error(
	%Plug.Conn{} = conn,
	{:account_status, :password_reset_pending}
	) do
	render_error(
	conn,
	:forbidden,
	"Password reset is required",
	%{},
	"password_reset_required"
	)
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:account_status, :confirmation_pending}) do
	render_error(
	conn,
	:forbidden,
	"Your login is missing a confirmed e-mail address",
	%{},
	"missing_confirmed_email"
	)
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:account_status, :approval_pending}) do
	render_error(
	conn,
	:forbidden,
	"Your account is awaiting approval.",
	%{},
	"awaiting_approval"
	)
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, _error) do
	render_invalid_credentials_error(conn)
	end

	def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do
	with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token),
	{:ok, oauth_token} <- RevokeToken.revoke(oauth_token) do
	conn =
	with session_token = AuthHelper.get_session_token(conn),
	%Token{token: ^session_token} <- oauth_token do
	AuthHelper.delete_session_token(conn)
	else
	_ -> conn
	end

	json(conn, %{})
	else
	_error ->
	# RFC 7009: invalid tokens [in the request] do not cause an error response
	json(conn, %{})
	end
	end

	def token_revoke(%Plug.Conn{} = conn, params), do: bad_request(conn, params)

	# Response for bad request
	defp bad_request(%Plug.Conn{} = conn, _) do
	render_error(conn, :internal_server_error, "Bad request")
	end

	@doc "Prepares OAuth request to provider for Ueberauth"
	def prepare_request(%Plug.Conn{} = conn, %{
	"provider" => provider,
	"authorization" => auth_attrs
	}) do
	scope =
	auth_attrs
	\|> Scopes.fetch_scopes([])
	\|> Scopes.to_string()

	state =
	auth_attrs
	\|> Map.delete("scopes")
	\|> Map.put("scope", scope)
	\|> Jason.encode!()

	params =
	auth_attrs
	\|> Map.drop(~w(scope scopes client_id redirect_uri))
	\|> Map.put("state", state)

	# Handing the request to Ueberauth
	redirect(conn, to: Routes.o_auth_path(conn, :request, provider, params))
	end

	def request(%Plug.Conn{} = conn, params) do
	message =
	if params["provider"] do
	dgettext("errors", "Unsupported OAuth provider: %{provider}.",
	provider: params["provider"]
	)
	else
	dgettext("errors", "Bad OAuth request.")
	end

	conn
	\|> put_flash(:error, message)
	\|> redirect(to: "/")
	end

	def callback(%Plug.Conn{assigns: %{ueberauth_failure: failure}} = conn, params) do
	params = callback_params(params)
	messages = for e <- Map.get(failure, :errors, []), do: e.message
	message = Enum.join(messages, "; ")

	conn
	\|> put_flash(
	:error,
	dgettext("errors", "Failed to authenticate: %{message}.", message: message)
	)
	\|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	end

	def callback(%Plug.Conn{} = conn, params) do
	params = callback_params(params)

	with {:ok, registration} <- Authenticator.get_registration(conn) do
	auth_attrs = Map.take(params, ~w(client_id redirect_uri scope scopes state))

	case Repo.get_assoc(registration, :user) do
	{:ok, user} ->
	create_authorization(conn, %{"authorization" => auth_attrs}, user: user)

	_ ->
	registration_params =
	Map.merge(auth_attrs, %{
	"nickname" => Registration.nickname(registration),
	"email" => Registration.email(registration)
	})

	conn
	\|> put_session_registration_id(registration.id)
	\|> registration_details(%{"authorization" => registration_params})
	end
	else
	error ->
	Logger.debug(inspect(["OAUTH_ERROR", error, conn.assigns]))

	conn
	\|> put_flash(:error, dgettext("errors", "Failed to set up user account."))
	\|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	end
	end

	defp callback_params(%{"state" => state} = params) do
	Map.merge(params, Jason.decode!(state))
	end

	def registration_details(%Plug.Conn{} = conn, %{"authorization" => auth_attrs}) do
	render(conn, "register.html", %{
	client_id: auth_attrs["client_id"],
	redirect_uri: auth_attrs["redirect_uri"],
	state: auth_attrs["state"],
	scopes: Scopes.fetch_scopes(auth_attrs, []),
	nickname: auth_attrs["nickname"],
	email: auth_attrs["email"]
	})
	end

	def register(%Plug.Conn{} = conn, %{"authorization" => _, "op" => "connect"} = params) do
	with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	%Registration{} = registration <- Repo.get(Registration, registration_id),
	{_, {:ok, auth, _user}} <-
	{:create_authorization, do_create_authorization(conn, params)},
	%User{} = user <- Repo.preload(auth, :user).user,
	{:ok, _updated_registration} <- Registration.bind_to_user(registration, user) do
	conn
	\|> put_session_registration_id(nil)
	\|> after_create_authorization(auth, params)
	else
	{:create_authorization, error} ->
	{:register, handle_create_authorization_error(conn, error, params)}

	_ ->
	{:register, :generic_error}
	end
	end

	def register(%Plug.Conn{} = conn, %{"authorization" => _, "op" => "register"} = params) do
	with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	%Registration{} = registration <- Repo.get(Registration, registration_id),
	{:ok, user} <- Authenticator.create_from_registration(conn, registration) do
	conn
	\|> put_session_registration_id(nil)
	\|> create_authorization(
	params,
	user: user
	)
	else
	{:error, changeset} ->
	message =
	Enum.map(changeset.errors, fn {field, {error, _}} ->
	"#{field} #{error}"
	end)
	\|> Enum.join("; ")

	message =
	String.replace(
	message,
	"ap_id has already been taken",
	"nickname has already been taken"
	)

	conn
	\|> put_status(:forbidden)
	\|> put_flash(:error, "Error: #{message}.")
	\|> registration_details(params)

	_ ->
	{:register, :generic_error}
	end
	end

	defp do_create_authorization(conn, auth_attrs, user \\ nil)

	defp do_create_authorization(
	%Plug.Conn{} = conn,
	%{
	"authorization" =>
	%{
	"client_id" => client_id,
	"redirect_uri" => redirect_uri
	} = auth_attrs
	},
	user
	) do
	with {_, {:ok, %User{} = user}} <-
	{:get_user, (user && {:ok, user}) \|\| Authenticator.get_user(conn)},
	%App{} = app <- Repo.get_by(App, client_id: client_id),
	true <- redirect_uri in String.split(app.redirect_uris),
	requested_scopes <- Scopes.fetch_scopes(auth_attrs, app.scopes),
	{:ok, auth} <- do_create_authorization(user, app, requested_scopes) do
	{:ok, auth, user}
	end
	end

	defp do_create_authorization(%User{} = user, %App{} = app, requested_scopes)
	when is_list(requested_scopes) do
	with {:account_status, :active} <- {:account_status, User.account_status(user)},
	{:ok, scopes} <- validate_scopes(app, requested_scopes),
	{:ok, auth} <- Authorization.create_authorization(app, user, scopes) do
	{:ok, auth}
	end
	end

	# Note: intended to be a private function but opened for AccountController that logs in on signup
	@doc "If checks pass, creates authorization and token for given user, app and requested scopes."
	def login(%User{} = user, %App{} = app, requested_scopes) when is_list(requested_scopes) do
	with {:ok, auth} <- do_create_authorization(user, app, requested_scopes),
	{:mfa_required, _, _, false} <- {:mfa_required, user, auth, MFA.require?(user)},
	{:ok, token} <- Token.exchange_token(app, auth) do
	{:ok, token}
	end
	end

	# Special case: Local MastodonFE
	defp redirect_uri(%Plug.Conn{} = conn, "."), do: Routes.auth_url(conn, :login)

	defp redirect_uri(%Plug.Conn{}, redirect_uri), do: redirect_uri

	defp get_session_registration_id(%Plug.Conn{} = conn), do: get_session(conn, :registration_id)

	defp put_session_registration_id(%Plug.Conn{} = conn, registration_id),
	do: put_session(conn, :registration_id, registration_id)

	defp build_and_response_mfa_token(user, auth) do
	with {:ok, token} <- MFA.Token.create(user, auth) do
	MFAView.render("mfa_response.json", %{token: token, user: user})
	end
	end

	@spec validate_scopes(App.t(), map() \| list()) ::
	{:ok, list()} \| {:error, :missing_scopes \| :unsupported_scopes}
	defp validate_scopes(%App{} = app, params) when is_map(params) do
	requested_scopes = Scopes.fetch_scopes(params, app.scopes)
	validate_scopes(app, requested_scopes)
	end

	defp validate_scopes(%App{} = app, requested_scopes) when is_list(requested_scopes) do
	Scopes.validate(requested_scopes, app.scopes)
	end

	def default_redirect_uri(%App{} = app) do
	app.redirect_uris
	\|> String.split()
	\|> Enum.at(0)
	end

	defp render_invalid_credentials_error(conn) do
	render_error(conn, :bad_request, "Invalid credentials")
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/account_controller.ex b/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
	index 6e01c5497..8e4d3e7f7 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
	@@ -1,114 +1,110 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.AccountController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [json_response: 3, add_link_headers: 2, assign_account_by_id: 2]

	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.MastodonAPI.StatusView
	- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter

	require Pleroma.Constants

	plug(
	Majic.Plug,
	[pool: Pleroma.MajicPool] when action in [:update_avatar, :update_background, :update_banner]
	)

	plug(
	OpenApiSpex.Plug.PutApiSpec,
	[module: Pleroma.Web.ApiSpec] when action == :confirmation_resend
	)

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	- plug(
	- :skip_plug,
	- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :confirmation_resend
	- )
	+ plug(:skip_auth when action == :confirmation_resend)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]} when action in [:subscribe, :unsubscribe]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:favourites"], fallback: :proceed_unauthenticated} when action == :favourites
	)

	plug(RateLimiter, [name: :account_confirmation_resend] when action == :confirmation_resend)

	plug(:assign_account_by_id when action in [:favourites, :subscribe, :unsubscribe])

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaAccountOperation

	@doc "POST /api/v1/pleroma/accounts/confirmation_resend"
	def confirmation_resend(conn, params) do
	nickname_or_email = params[:email] \|\| params[:nickname]

	with %User{} = user <- User.get_by_nickname_or_email(nickname_or_email),
	{:ok, _} <- User.maybe_send_confirmation_email(user) do
	json_response(conn, :no_content, "")
	end
	end

	@doc "GET /api/v1/pleroma/accounts/:id/favourites"
	def favourites(%{assigns: %{account: %{hide_favorites: true}}} = conn, _params) do
	render_error(conn, :forbidden, "Can't get favorites")
	end

	def favourites(%{assigns: %{user: for_user, account: user}} = conn, params) do
	params =
	params
	\|> Map.put(:type, "Create")
	\|> Map.put(:favorited_by, user.ap_id)
	\|> Map.put(:blocking_user, for_user)

	recipients =
	if for_user do
	[Pleroma.Constants.as_public()] ++ [for_user.ap_id \| User.following(for_user)]
	else
	[Pleroma.Constants.as_public()]
	end

	activities =
	recipients
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json",
	activities: activities,
	for: for_user,
	as: :activity
	)
	end

	@doc "POST /api/v1/pleroma/accounts/:id/subscribe"
	def subscribe(%{assigns: %{user: user, account: subscription_target}} = conn, _params) do
	with {:ok, _subscription} <- User.subscribe(user, subscription_target) do
	render(conn, "relationship.json", user: user, target: subscription_target)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/pleroma/accounts/:id/unsubscribe"
	def unsubscribe(%{assigns: %{user: user, account: subscription_target}} = conn, _params) do
	with {:ok, _subscription} <- User.unsubscribe(user, subscription_target) do
	render(conn, "relationship.json", user: user, target: subscription_target)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
	index d0f677d3c..1ea44f347 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
	@@ -1,234 +1,230 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
	use Pleroma.Web, :controller

	alias Pleroma.Emoji.Pack

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	plug(
	Pleroma.Web.Plugs.OAuthScopesPlug,
	%{scopes: ["admin:write"]}
	when action in [
	:import_from_filesystem,
	:remote,
	:download,
	:create,
	:update,
	:delete
	]
	)

	- @skip_plugs [
	- Pleroma.Web.Plugs.OAuthScopesPlug,
	- Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	- ]
	- plug(:skip_plug, @skip_plugs when action in [:index, :archive, :show])
	+ plug(:skip_auth when action in [:index, :archive, :show])

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaEmojiPackOperation

	def remote(conn, params) do
	with {:ok, packs} <-
	Pack.list_remote(url: params.url, page_size: params.page_size, page: params.page) do
	json(conn, packs)
	else
	{:error, :not_shareable} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "The requested instance does not support sharing emoji packs"})
	end
	end

	def index(conn, params) do
	emoji_path =
	[:instance, :static_dir]
	\|> Pleroma.Config.get!()
	\|> Path.join("emoji")

	with {:ok, packs, count} <- Pack.list_local(page: params.page, page_size: params.page_size) do
	json(conn, %{packs: packs, count: count})
	else
	{:error, :create_dir, e} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "Failed to create the emoji pack directory at #{emoji_path}: #{e}"})

	{:error, :ls, e} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{
	error: "Failed to get the contents of the emoji pack directory at #{emoji_path}: #{e}"
	})
	end
	end

	def show(conn, %{name: name, page: page, page_size: page_size}) do
	name = String.trim(name)

	with {:ok, pack} <- Pack.show(name: name, page: page, page_size: page_size) do
	json(conn, pack)
	else
	{:error, :enoent} ->
	conn
	\|> put_status(:not_found)
	\|> json(%{error: "Pack #{name} does not exist"})

	{:error, :empty_values} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "pack name cannot be empty"})

	{:error, error} ->
	error_message =
	add_posix_error(
	"Failed to get the contents of the `#{name}` pack.",
	error
	)

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error_message})
	end
	end

	def archive(conn, %{name: name}) do
	with {:ok, archive} <- Pack.get_archive(name) do
	send_download(conn, {:binary, archive}, filename: "#{name}.zip")
	else
	{:error, :cant_download} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{
	error:
	"Pack #{name} cannot be downloaded from this instance, either pack sharing was disabled for this pack or some files are missing"
	})

	{:error, :enoent} ->
	conn
	\|> put_status(:not_found)
	\|> json(%{error: "Pack #{name} does not exist"})
	end
	end

	def download(%{body_params: %{url: url, name: name} = params} = conn, _) do
	with {:ok, _pack} <- Pack.download(name, url, params[:as]) do
	json(conn, "ok")
	else
	{:error, :not_shareable} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "The requested instance does not support sharing emoji packs"})

	{:error, :invalid_checksum} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "SHA256 for the pack doesn't match the one sent by the server"})

	{:error, error} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error})
	end
	end

	def create(conn, %{name: name}) do
	name = String.trim(name)

	with {:ok, _pack} <- Pack.create(name) do
	json(conn, "ok")
	else
	{:error, :eexist} ->
	conn
	\|> put_status(:conflict)
	\|> json(%{error: "A pack named \"#{name}\" already exists"})

	{:error, :empty_values} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "pack name cannot be empty"})

	{:error, error} ->
	error_message =
	add_posix_error(
	"Unexpected error occurred while creating pack.",
	error
	)

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error_message})
	end
	end

	def delete(conn, %{name: name}) do
	name = String.trim(name)

	with {:ok, deleted} when deleted != [] <- Pack.delete(name) do
	json(conn, "ok")
	else
	{:ok, []} ->
	conn
	\|> put_status(:not_found)
	\|> json(%{error: "Pack #{name} does not exist"})

	{:error, :empty_values} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "pack name cannot be empty"})

	{:error, error, _} ->
	error_message = add_posix_error("Couldn't delete the `#{name}` pack", error)

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error_message})
	end
	end

	def update(%{body_params: %{metadata: metadata}} = conn, %{name: name}) do
	with {:ok, pack} <- Pack.update_metadata(name, metadata) do
	json(conn, pack.pack)
	else
	{:error, :incomplete} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "The fallback archive does not have all files specified in pack.json"})

	{:error, error} ->
	error_message =
	add_posix_error(
	"Unexpected error occurred while updating pack metadata.",
	error
	)

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error_message})
	end
	end

	def import_from_filesystem(conn, _params) do
	with {:ok, names} <- Pack.import_from_filesystem() do
	json(conn, names)
	else
	{:error, :no_read_write} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "Error: emoji pack directory must be writable"})

	{:error, _} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "Error accessing emoji pack directory"})
	end
	end

	defp add_posix_error(msg, error) do
	[msg, Pleroma.Utils.posix_error_message(error)]
	\|> Enum.join(" ")
	\|> String.trim()
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/controller.ex b/lib/pleroma/web/twitter_api/controller.ex
	index e32713311..1e78ff2c1 100644
	--- a/lib/pleroma/web/twitter_api/controller.ex
	+++ b/lib/pleroma/web/twitter_api/controller.ex
	@@ -1,64 +1,59 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.TwitterAPI.Controller do
	use Pleroma.Web, :controller

	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token
	- alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.TwitterAPI.TokenView

	require Logger

	- plug(
	- :skip_plug,
	- [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :confirm_email
	- )
	-
	+ plug(:skip_auth when action == :confirm_email)
	plug(:skip_plug, OAuthScopesPlug when action in [:oauth_tokens, :revoke_token])

	action_fallback(:errors)

	def confirm_email(conn, %{"user_id" => uid, "token" => token}) do
	with %User{} = user <- User.get_cached_by_id(uid),
	true <- user.local and !user.is_confirmed and user.confirmation_token == token,
	{:ok, _} <- User.confirm(user) do
	redirect(conn, to: "/")
	end
	end

	def oauth_tokens(%{assigns: %{user: user}} = conn, _params) do
	with oauth_tokens <- Token.get_user_tokens(user) do
	conn
	\|> put_view(TokenView)
	\|> render("index.json", %{tokens: oauth_tokens})
	end
	end

	def revoke_token(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	Token.delete_user_token(user, id)

	json_reply(conn, 201, "")
	end

	defp errors(conn, {:param_cast, _}) do
	conn
	\|> put_status(400)
	\|> json("Invalid parameters")
	end

	defp errors(conn, _) do
	conn
	\|> put_status(500)
	\|> json("Something went wrong")
	end

	defp json_reply(conn, status, json) do
	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(status, json)
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Sep 19, 3:01 AM (18 h, 54 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1768701
Default Alt Text: (89 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions