No OneTemporary
Actions

Size

91 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	index 28727d619..b624d4255 100644
	--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	@@ -1,543 +1,546 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubController do
	use Pleroma.Web, :controller

	alias Pleroma.Activity
	alias Pleroma.Delivery
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	alias Pleroma.Plugs.EnsureAuthenticatedPlug
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.InternalFetchActor
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	+ alias Pleroma.Web.ControllerHelper
	alias Pleroma.Web.Endpoint
	alias Pleroma.Web.FederatingPlug
	alias Pleroma.Web.Federator

	require Logger

	action_fallback(:errors)

	@federating_only_actions [:internal_fetch, :relay, :relay_following, :relay_followers]

	plug(FederatingPlug when action in @federating_only_actions)

	plug(
	EnsureAuthenticatedPlug,
	[unless_func: &FederatingPlug.federating?/1] when action not in @federating_only_actions
	)

	# Note: :following and :followers must be served even without authentication (as via :api)
	plug(
	EnsureAuthenticatedPlug
	when action in [:read_inbox, :update_outbox, :whoami, :upload_media]
	)

	plug(
	Pleroma.Plugs.Cache,
	[query_params: false, tracking_fun: &__MODULE__.track_object_fetch/2]
	when action in [:activity, :object]
	)

	plug(:set_requester_reachable when action in [:inbox])
	plug(:relay_active? when action in [:relay])

	defp relay_active?(conn, _) do
	if Pleroma.Config.get([:instance, :allow_relay]) do
	conn
	else
	conn
	\|> render_error(:not_found, "not found")
	\|> halt()
	end
	end

	def user(conn, %{"nickname" => nickname}) do
	with %User{local: true} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	else
	nil -> {:error, :not_found}
	%{local: false} -> {:error, :not_found}
	end
	end

	def object(conn, _) do
	with ap_id <- Endpoint.url() <> conn.request_path,
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(object)} do
	conn
	\|> assign(:tracking_fun_data, object.id)
	\|> set_cache_ttl_for(object)
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(ObjectView)
	\|> render("object.json", object: object)
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	def track_object_fetch(conn, nil), do: conn

	def track_object_fetch(conn, object_id) do
	with %{assigns: %{user: %User{id: user_id}}} <- conn do
	Delivery.create(object_id, user_id)
	end

	conn
	end

	def activity(conn, _params) do
	with ap_id <- Endpoint.url() <> conn.request_path,
	%Activity{} = activity <- Activity.normalize(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(activity)} do
	conn
	\|> maybe_set_tracking_data(activity)
	\|> set_cache_ttl_for(activity)
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(ObjectView)
	\|> render("object.json", object: activity)
	else
	{:public?, false} -> {:error, :not_found}
	nil -> {:error, :not_found}
	end
	end

	defp maybe_set_tracking_data(conn, %Activity{data: %{"type" => "Create"}} = activity) do
	object_id = Object.normalize(activity).id
	assign(conn, :tracking_fun_data, object_id)
	end

	defp maybe_set_tracking_data(conn, _activity), do: conn

	defp set_cache_ttl_for(conn, %Activity{object: object}) do
	set_cache_ttl_for(conn, object)
	end

	defp set_cache_ttl_for(conn, entity) do
	ttl =
	case entity do
	%Object{data: %{"type" => "Question"}} ->
	Pleroma.Config.get([:web_cache_ttl, :activity_pub_question])

	%Object{} ->
	Pleroma.Config.get([:web_cache_ttl, :activity_pub])

	_ ->
	nil
	end

	assign(conn, :cache_ttl, ttl)
	end

	# GET /relay/following
	def relay_following(conn, _params) do
	with %{halted: false} = conn <- FederatingPlug.call(conn, []) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: Relay.get_actor()})
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
	{:show_follows, true} <-
	{:show_follows, (for_user && for_user == user) \|\| !user.hide_follows} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: user, page: page, for: for_user})
	else
	{:show_follows, _} ->
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> send_resp(403, "")
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: user, for: for_user})
	end
	end

	# GET /relay/followers
	def relay_followers(conn, _params) do
	with %{halted: false} = conn <- FederatingPlug.call(conn, []) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: Relay.get_actor()})
	end
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
	{:show_followers, true} <-
	{:show_followers, (for_user && for_user == user) \|\| !user.hide_followers} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: user, page: page, for: for_user})
	else
	{:show_followers, _} ->
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> send_resp(403, "")
	end
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: user, for: for_user})
	end
	end

	def outbox(
	%{assigns: %{user: for_user}} = conn,
	%{"nickname" => nickname, "page" => page?} = params
	)
	when page? in [true, "true"] do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	activities =
	if params["max_id"] do
	ActivityPub.fetch_user_activities(user, for_user, %{
	"max_id" => params["max_id"],
	# This is a hack because postgres generates inefficient queries when filtering by
	# 'Answer', poll votes will be hidden by the visibility filter in this case anyway
	"include_poll_votes" => true,
	"limit" => 10
	})
	else
	ActivityPub.fetch_user_activities(user, for_user, %{
	"limit" => 10,
	"include_poll_votes" => true
	})
	end

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection_page.json", %{
	activities: activities,
	+ pagination: ControllerHelper.get_pagination_fields(conn, activities, %{"limit" => "10"}),
	iri: "#{user.ap_id}/outbox"
	})
	end
	end

	def outbox(conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection.json", %{iri: "#{user.ap_id}/outbox"})
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, %{"nickname" => nickname} = params) do
	with %User{} = recipient <- User.get_cached_by_nickname(nickname),
	{:ok, %User{} = actor} <- User.get_or_fetch_by_ap_id(params["actor"]),
	true <- Utils.recipient_in_message(recipient, actor, params),
	params <- Utils.maybe_splice_recipient(recipient.ap_id, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end

	# POST /relay/inbox -or- POST /internal/fetch/inbox
	def inbox(conn, params) do
	if params["type"] == "Create" && FederatingPlug.federating?() do
	post_inbox_relayed_create(conn, params)
	else
	post_inbox_fallback(conn, params)
	end
	end

	defp post_inbox_relayed_create(conn, params) do
	Logger.debug(
	"Signature missing or not from author, relayed Create message, fetching object from source"
	)

	Fetcher.fetch_object_from_id(params["object"]["id"])

	json(conn, "ok")
	end

	defp post_inbox_fallback(conn, params) do
	headers = Enum.into(conn.req_headers, %{})

	if headers["signature"] && params["actor"] &&
	String.contains?(headers["signature"], params["actor"]) do
	Logger.debug(
	"Signature validation error for: #{params["actor"]}, make sure you are forwarding the HTTP Host header!"
	)

	Logger.debug(inspect(conn.req_headers))
	end

	conn
	\|> put_status(:bad_request)
	\|> json(dgettext("errors", "error"))
	end

	defp represent_service_actor(%User{} = user, conn) do
	with {:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	else
	nil -> {:error, :not_found}
	end
	end

	defp represent_service_actor(nil, _), do: {:error, :not_found}

	def relay(conn, _params) do
	Relay.get_actor()
	\|> represent_service_actor(conn)
	end

	def internal_fetch(conn, _params) do
	InternalFetchActor.get_actor()
	\|> represent_service_actor(conn)
	end

	@doc "Returns the authenticated user's ActivityPub User object or a 404 Not Found if non-authenticated"
	def whoami(%{assigns: %{user: %User{} = user}} = conn, _params) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	end

	def read_inbox(
	%{assigns: %{user: %User{nickname: nickname} = user}} = conn,
	%{"nickname" => nickname, "page" => page?} = params
	)
	when page? in [true, "true"] do
	activities =
	if params["max_id"] do
	ActivityPub.fetch_activities([user.ap_id \| User.following(user)], %{
	"max_id" => params["max_id"],
	"limit" => 10
	})
	else
	ActivityPub.fetch_activities([user.ap_id \| User.following(user)], %{"limit" => 10})
	end

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection_page.json", %{
	activities: activities,
	+ pagination: ControllerHelper.get_pagination_fields(conn, activities, %{"limit" => "10"}),
	iri: "#{user.ap_id}/inbox"
	})
	end

	def read_inbox(%{assigns: %{user: %User{nickname: nickname} = user}} = conn, %{
	"nickname" => nickname
	}) do
	with {:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection.json", %{iri: "#{user.ap_id}/inbox"})
	end
	end

	def read_inbox(%{assigns: %{user: %User{nickname: as_nickname}}} = conn, %{
	"nickname" => nickname
	}) do
	err =
	dgettext("errors", "can't read inbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: as_nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end

	defp handle_user_activity(
	%User{} = user,
	%{"type" => "Create", "object" => %{"type" => "Note"}} = params
	) do
	object =
	params["object"]
	\|> Map.merge(Map.take(params, ["to", "cc"]))
	\|> Map.put("attributedTo", user.ap_id())
	\|> Transmogrifier.fix_object()

	ActivityPub.create(%{
	to: params["to"],
	actor: user,
	context: object["context"],
	object: object,
	additional: Map.take(params, ["cc"])
	})
	end

	defp handle_user_activity(%User{} = user, %{"type" => "Delete"} = params) do
	with %Object{} = object <- Object.normalize(params["object"]),
	true <- user.is_moderator \|\| user.ap_id == object.data["actor"],
	{:ok, delete_data, _} <- Builder.delete(user, object.data["id"]),
	{:ok, delete, _} <- Pipeline.common_pipeline(delete_data, local: true) do
	{:ok, delete}
	else
	_ -> {:error, dgettext("errors", "Can't delete object")}
	end
	end

	defp handle_user_activity(%User{} = user, %{"type" => "Like"} = params) do
	with %Object{} = object <- Object.normalize(params["object"]),
	{_, {:ok, like_object, meta}} <- {:build_object, Builder.like(user, object)},
	{_, {:ok, %Activity{} = activity, _meta}} <-
	{:common_pipeline,
	Pipeline.common_pipeline(like_object, Keyword.put(meta, :local, true))} do
	{:ok, activity}
	else
	_ -> {:error, dgettext("errors", "Can't like object")}
	end
	end

	defp handle_user_activity(_, _) do
	{:error, dgettext("errors", "Unhandled activity type")}
	end

	def update_outbox(
	%{assigns: %{user: %User{nickname: nickname} = user}} = conn,
	%{"nickname" => nickname} = params
	) do
	actor = user.ap_id()

	params =
	params
	\|> Map.drop(["id"])
	\|> Map.put("actor", actor)
	\|> Transmogrifier.fix_addressing()

	with {:ok, %Activity{} = activity} <- handle_user_activity(user, params) do
	conn
	\|> put_status(:created)
	\|> put_resp_header("location", activity.data["id"])
	\|> json(activity.data)
	else
	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(message)
	end
	end

	def update_outbox(%{assigns: %{user: %User{} = user}} = conn, %{"nickname" => nickname}) do
	err =
	dgettext("errors", "can't update outbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: user.nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end

	defp errors(conn, {:error, :not_found}) do
	conn
	\|> put_status(:not_found)
	\|> json(dgettext("errors", "Not found"))
	end

	defp errors(conn, _e) do
	conn
	\|> put_status(:internal_server_error)
	\|> json(dgettext("errors", "error"))
	end

	defp set_requester_reachable(%Plug.Conn{} = conn, _) do
	with actor <- conn.params["actor"],
	true <- is_binary(actor) do
	Pleroma.Instances.set_reachable(actor)
	end

	conn
	end

	defp ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	{:ok, new_user} = User.ensure_keys_present(user)

	for_user =
	if new_user != user and match?(%User{}, for_user) do
	User.get_cached_by_nickname(for_user.nickname)
	else
	for_user
	end

	{new_user, for_user}
	end

	# TODO: Add support for "object" field
	@doc """
	Endpoint based on <https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload>

	Parameters:
	- (required) `file`: data of the media
	- (optionnal) `description`: description of the media, intended for accessibility

	Response:
	- HTTP Code: 201 Created
	- HTTP Body: ActivityPub object to be inserted into another's `attachment` field
	"""
	def upload_media(%{assigns: %{user: %User{} = user}} = conn, %{"file" => file} = data) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, "description")
	) do
	Logger.debug(inspect(object))

	conn
	\|> put_status(:created)
	\|> json(object.data)
	end
	end
	end
	diff --git a/lib/pleroma/web/activity_pub/views/user_view.ex b/lib/pleroma/web/activity_pub/views/user_view.ex
	index 34590b16d..4a02b09a1 100644
	--- a/lib/pleroma/web/activity_pub/views/user_view.ex
	+++ b/lib/pleroma/web/activity_pub/views/user_view.ex
	@@ -1,285 +1,275 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.UserView do
	use Pleroma.Web, :view

	alias Pleroma.Keys
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.Endpoint
	alias Pleroma.Web.Router.Helpers

	import Ecto.Query

	def render("endpoints.json", %{user: %User{nickname: nil, local: true} = _user}) do
	%{"sharedInbox" => Helpers.activity_pub_url(Endpoint, :inbox)}
	end

	def render("endpoints.json", %{user: %User{local: true} = _user}) do
	%{
	"oauthAuthorizationEndpoint" => Helpers.o_auth_url(Endpoint, :authorize),
	"oauthRegistrationEndpoint" => Helpers.app_url(Endpoint, :create),
	"oauthTokenEndpoint" => Helpers.o_auth_url(Endpoint, :token_exchange),
	"sharedInbox" => Helpers.activity_pub_url(Endpoint, :inbox),
	"uploadMedia" => Helpers.activity_pub_url(Endpoint, :upload_media)
	}
	end

	def render("endpoints.json", _), do: %{}

	def render("service.json", %{user: user}) do
	{:ok, user} = User.ensure_keys_present(user)
	{:ok, _, public_key} = Keys.keys_from_pem(user.keys)
	public_key = :public_key.pem_entry_encode(:SubjectPublicKeyInfo, public_key)
	public_key = :public_key.pem_encode([public_key])

	endpoints = render("endpoints.json", %{user: user})

	%{
	"id" => user.ap_id,
	"type" => "Application",
	"following" => "#{user.ap_id}/following",
	"followers" => "#{user.ap_id}/followers",
	"inbox" => "#{user.ap_id}/inbox",
	"name" => "Pleroma",
	"summary" =>
	"An internal service actor for this Pleroma instance. No user-serviceable parts inside.",
	"url" => user.ap_id,
	"manuallyApprovesFollowers" => false,
	"publicKey" => %{
	"id" => "#{user.ap_id}#main-key",
	"owner" => user.ap_id,
	"publicKeyPem" => public_key
	},
	"endpoints" => endpoints,
	"invisible" => User.invisible?(user)
	}
	\|> Map.merge(Utils.make_json_ld_header())
	end

	# the instance itself is not a Person, but instead an Application
	def render("user.json", %{user: %User{nickname: nil} = user}),
	do: render("service.json", %{user: user})

	def render("user.json", %{user: %User{nickname: "internal." <> _} = user}),
	do: render("service.json", %{user: user}) \|> Map.put("preferredUsername", user.nickname)

	def render("user.json", %{user: user}) do
	{:ok, user} = User.ensure_keys_present(user)
	{:ok, _, public_key} = Keys.keys_from_pem(user.keys)
	public_key = :public_key.pem_entry_encode(:SubjectPublicKeyInfo, public_key)
	public_key = :public_key.pem_encode([public_key])
	user = User.sanitize_html(user)

	endpoints = render("endpoints.json", %{user: user})

	emoji_tags = Transmogrifier.take_emoji_tags(user)

	fields = Enum.map(user.fields, &Map.put(&1, "type", "PropertyValue"))

	%{
	"id" => user.ap_id,
	"type" => user.actor_type,
	"following" => "#{user.ap_id}/following",
	"followers" => "#{user.ap_id}/followers",
	"inbox" => "#{user.ap_id}/inbox",
	"outbox" => "#{user.ap_id}/outbox",
	"preferredUsername" => user.nickname,
	"name" => user.name,
	"summary" => user.bio,
	"url" => user.ap_id,
	"manuallyApprovesFollowers" => user.locked,
	"publicKey" => %{
	"id" => "#{user.ap_id}#main-key",
	"owner" => user.ap_id,
	"publicKeyPem" => public_key
	},
	"endpoints" => endpoints,
	"attachment" => fields,
	"tag" => emoji_tags,
	"discoverable" => user.discoverable
	}
	\|> Map.merge(maybe_make_image(&User.avatar_url/2, "icon", user))
	\|> Map.merge(maybe_make_image(&User.banner_url/2, "image", user))
	\|> Map.merge(Utils.make_json_ld_header())
	end

	def render("following.json", %{user: user, page: page} = opts) do
	showing_items = (opts[:for] && opts[:for] == user) \|\| !user.hide_follows
	showing_count = showing_items \|\| !user.hide_follows_count

	query = User.get_friends_query(user)
	query = from(user in query, select: [:ap_id])
	following = Repo.all(query)

	total =
	if showing_count do
	length(following)
	else
	0
	end

	collection(following, "#{user.ap_id}/following", page, showing_items, total)
	\|> Map.merge(Utils.make_json_ld_header())
	end

	def render("following.json", %{user: user} = opts) do
	showing_items = (opts[:for] && opts[:for] == user) \|\| !user.hide_follows
	showing_count = showing_items \|\| !user.hide_follows_count

	query = User.get_friends_query(user)
	query = from(user in query, select: [:ap_id])
	following = Repo.all(query)

	total =
	if showing_count do
	length(following)
	else
	0
	end

	%{
	"id" => "#{user.ap_id}/following",
	"type" => "OrderedCollection",
	"totalItems" => total,
	"first" =>
	if showing_items do
	collection(following, "#{user.ap_id}/following", 1, !user.hide_follows)
	else
	"#{user.ap_id}/following?page=1"
	end
	}
	\|> Map.merge(Utils.make_json_ld_header())
	end

	def render("followers.json", %{user: user, page: page} = opts) do
	showing_items = (opts[:for] && opts[:for] == user) \|\| !user.hide_followers
	showing_count = showing_items \|\| !user.hide_followers_count

	query = User.get_followers_query(user)
	query = from(user in query, select: [:ap_id])
	followers = Repo.all(query)

	total =
	if showing_count do
	length(followers)
	else
	0
	end

	collection(followers, "#{user.ap_id}/followers", page, showing_items, total)
	\|> Map.merge(Utils.make_json_ld_header())
	end

	def render("followers.json", %{user: user} = opts) do
	showing_items = (opts[:for] && opts[:for] == user) \|\| !user.hide_followers
	showing_count = showing_items \|\| !user.hide_followers_count

	query = User.get_followers_query(user)
	query = from(user in query, select: [:ap_id])
	followers = Repo.all(query)

	total =
	if showing_count do
	length(followers)
	else
	0
	end

	%{
	"id" => "#{user.ap_id}/followers",
	"type" => "OrderedCollection",
	"first" =>
	if showing_items do
	collection(followers, "#{user.ap_id}/followers", 1, showing_items, total)
	else
	"#{user.ap_id}/followers?page=1"
	end
	}
	\|> maybe_put_total_items(showing_count, total)
	\|> Map.merge(Utils.make_json_ld_header())
	end

	def render("activity_collection.json", %{iri: iri}) do
	%{
	"id" => iri,
	"type" => "OrderedCollection",
	"first" => "#{iri}?page=true"
	}
	\|> Map.merge(Utils.make_json_ld_header())
	end

	- def render("activity_collection_page.json", %{activities: activities, iri: iri}) do
	- # this is sorted chronologically, so first activity is the newest (max)
	- {max_id, min_id, collection} =
	- if length(activities) > 0 do
	- {
	- Enum.at(activities, 0).id,
	- Enum.at(Enum.reverse(activities), 0).id,
	- Enum.map(activities, fn act ->
	- {:ok, data} = Transmogrifier.prepare_outgoing(act.data)
	- data
	- end)
	- }
	- else
	- {
	- 0,
	- 0,
	- []
	- }
	- end
	+ def render("activity_collection_page.json", %{
	+ activities: activities,
	+ iri: iri,
	+ pagination: pagination
	+ }) do
	+ collection =
	+ Enum.map(activities, fn activity ->
	+ {:ok, data} = Transmogrifier.prepare_outgoing(activity.data)
	+ data
	+ end)

	%{
	- "id" => "#{iri}?max_id=#{max_id}&page=true",
	"type" => "OrderedCollectionPage",
	"partOf" => iri,
	- "orderedItems" => collection,
	- "next" => "#{iri}?max_id=#{min_id}&page=true"
	+ "orderedItems" => collection
	}
	\|> Map.merge(Utils.make_json_ld_header())
	+ \|> Map.merge(pagination)
	end

	defp maybe_put_total_items(map, false, _total), do: map

	defp maybe_put_total_items(map, true, total) do
	Map.put(map, "totalItems", total)
	end

	def collection(collection, iri, page, show_items \\ true, total \\ nil) do
	offset = (page - 1) * 10
	items = Enum.slice(collection, offset, 10)
	items = Enum.map(items, fn user -> user.ap_id end)
	total = total \|\| length(collection)

	map = %{
	"id" => "#{iri}?page=#{page}",
	"type" => "OrderedCollectionPage",
	"partOf" => iri,
	"totalItems" => total,
	"orderedItems" => if(show_items, do: items, else: [])
	}

	if offset < total do
	Map.put(map, "next", "#{iri}?page=#{page + 1}")
	else
	map
	end
	end

	defp maybe_make_image(func, key, user) do
	if image = func.(user, no_default: true) do
	%{
	key => %{
	"type" => "Image",
	"url" => image
	}
	}
	else
	%{}
	end
	end
	end
	diff --git a/lib/pleroma/web/controller_helper.ex b/lib/pleroma/web/controller_helper.ex
	index 5a1316a5f..2d35bb56c 100644
	--- a/lib/pleroma/web/controller_helper.ex
	+++ b/lib/pleroma/web/controller_helper.ex
	@@ -1,119 +1,131 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ControllerHelper do
	use Pleroma.Web, :controller

	+ alias Pleroma.Pagination
	+
	# As in Mastodon API, per https://api.rubyonrails.org/classes/ActiveModel/Type/Boolean.html
	@falsy_param_values [false, 0, "0", "f", "F", "false", "False", "FALSE", "off", "OFF"]

	def explicitly_falsy_param?(value), do: value in @falsy_param_values

	# Note: `nil` and `""` are considered falsy values in Pleroma
	def falsy_param?(value),
	do: explicitly_falsy_param?(value) or value in [nil, ""]

	def truthy_param?(value), do: not falsy_param?(value)

	def json_response(conn, status, json) do
	conn
	\|> put_status(status)
	\|> json(json)
	end

	@spec fetch_integer_param(map(), String.t(), integer() \| nil) :: integer() \| nil
	def fetch_integer_param(params, name, default \\ nil) do
	params
	\|> Map.get(name, default)
	\|> param_to_integer(default)
	end

	defp param_to_integer(val, _) when is_integer(val), do: val

	defp param_to_integer(val, default) when is_binary(val) do
	case Integer.parse(val) do
	{res, _} -> res
	_ -> default
	end
	end

	defp param_to_integer(_, default), do: default

	def add_link_headers(conn, activities, extra_params \\ %{})

	def add_link_headers(%{assigns: %{skip_link_headers: true}} = conn, _activities, _extra_params),
	do: conn

	def add_link_headers(conn, activities, extra_params) do
	+ case get_pagination_fields(conn, activities, extra_params) do
	+ %{"next" => next_url, "prev" => prev_url} ->
	+ put_resp_header(conn, "link", "<#{next_url}>; rel=\"next\", <#{prev_url}>; rel=\"prev\"")
	+
	+ _ ->
	+ conn
	+ end
	+ end
	+
	+ def get_pagination_fields(conn, activities, extra_params \\ %{}) do
	case List.last(activities) do
	%{id: max_id} ->
	params =
	conn.params
	\|> Map.drop(Map.keys(conn.path_params))
	\|> Map.drop(["since_id", "max_id", "min_id"])
	\|> Map.merge(extra_params)

	- limit =
	- params
	- \|> Map.get("limit", "20")
	- \|> String.to_integer()
	-
	min_id =
	- if length(activities) <= limit do
	- activities
	- \|> List.first()
	- \|> Map.get(:id)
	- else
	- activities
	- \|> Enum.at(limit * -1)
	- \|> Map.get(:id)
	- end
	-
	- next_url = current_url(conn, Map.merge(params, %{max_id: max_id}))
	- prev_url = current_url(conn, Map.merge(params, %{min_id: min_id}))
	-
	- put_resp_header(conn, "link", "<#{next_url}>; rel=\"next\", <#{prev_url}>; rel=\"prev\"")
	+ activities
	+ \|> List.first()
	+ \|> Map.get(:id)
	+
	+ fields = %{
	+ "next" => current_url(conn, Map.put(params, :max_id, max_id)),
	+ "prev" => current_url(conn, Map.put(params, :min_id, min_id))
	+ }
	+
	+ # Generating an `id` without already present pagination keys would
	+ # need a query-restriction with an `q.id >= ^id` or `q.id <= ^id`
	+ # instead of the `q.id > ^min_id` and `q.id < ^max_id`.
	+ # This is because we only have ids present inside of the page, while
	+ # `min_id`, `since_id` and `max_id` requires to know one outside of it.
	+ if Map.take(conn.params, Pagination.page_keys() -- ["limit", "order"]) != [] do
	+ Map.put(fields, "id", current_url(conn, conn.params))
	+ else
	+ fields
	+ end

	_ ->
	- conn
	+ %{}
	end
	end

	def assign_account_by_id(conn, _) do
	# TODO: use `conn.params[:id]` only after moving to OpenAPI
	case Pleroma.User.get_cached_by_id(conn.params[:id] \|\| conn.params["id"]) do
	%Pleroma.User{} = account -> assign(conn, :account, account)
	nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) \|> halt()
	end
	end

	def try_render(conn, target, params) when is_binary(target) do
	case render(conn, target, params) do
	nil -> render_error(conn, :not_implemented, "Can't display this activity")
	res -> res
	end
	end

	def try_render(conn, _, _) do
	render_error(conn, :not_implemented, "Can't display this activity")
	end

	@spec put_if_exist(map(), atom() \| String.t(), any) :: map()
	def put_if_exist(map, _key, nil), do: map

	def put_if_exist(map, key, value), do: Map.put(map, key, value)

	@doc """
	Returns true if request specifies to include embedded relationships in account objects.
	May only be used in selected account-related endpoints; has no effect for status- or
	notification-related endpoints.
	"""
	# Intended for PleromaFE: https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838
	def embed_relationships?(params) do
	# To do once OpenAPI transition mess is over: just `truthy_param?(params[:with_relationships])`
	params
	\|> Map.get(:with_relationships, params["with_relationships"])
	\|> truthy_param?()
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex b/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
	index 958567510..c852082a5 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
	@@ -1,208 +1,206 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.TimelineController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [add_link_headers: 2, add_link_headers: 3]

	alias Pleroma.Pagination
	alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.Plugs.RateLimiter
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub

	plug(Pleroma.Web.ApiSpec.CastAndValidate)
	plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action in [:public, :hashtag])

	# TODO: Replace with a macro when there is a Phoenix release with the following commit in it:
	# https://github.com/phoenixframework/phoenix/commit/2e8c63c01fec4dde5467dbbbf9705ff9e780735e

	plug(RateLimiter, [name: :timeline, bucket_name: :direct_timeline] when action == :direct)
	plug(RateLimiter, [name: :timeline, bucket_name: :public_timeline] when action == :public)
	plug(RateLimiter, [name: :timeline, bucket_name: :home_timeline] when action == :home)
	plug(RateLimiter, [name: :timeline, bucket_name: :hashtag_timeline] when action == :hashtag)
	plug(RateLimiter, [name: :timeline, bucket_name: :list_timeline] when action == :list)

	plug(OAuthScopesPlug, %{scopes: ["read:statuses"]} when action in [:home, :direct])
	plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :list)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:statuses"], fallback: :proceed_unauthenticated}
	when action in [:public, :hashtag]
	)

	plug(:put_view, Pleroma.Web.MastodonAPI.StatusView)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.TimelineOperation

	# GET /api/v1/timelines/home
	def home(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.new(fn {key, value} -> {to_string(key), value} end)
	\|> Map.put("type", ["Create", "Announce"])
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("reply_filtering_user", user)
	\|> Map.put("user", user)

	- recipients = [user.ap_id \| User.following(user)]
	-
	activities =
	- recipients
	+ [user.ap_id \| User.following(user)]
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	# GET /api/v1/timelines/direct
	def direct(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.new(fn {key, value} -> {to_string(key), value} end)
	\|> Map.put("type", "Create")
	\|> Map.put("blocking_user", user)
	\|> Map.put("user", user)
	\|> Map.put(:visibility, "direct")

	activities =
	[user.ap_id]
	\|> ActivityPub.fetch_activities_query(params)
	\|> Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	# GET /api/v1/timelines/public
	def public(%{assigns: %{user: user}} = conn, params) do
	params = Map.new(params, fn {key, value} -> {to_string(key), value} end)

	local_only = params["local"]

	cfg_key =
	if local_only do
	:local
	else
	:federated
	end

	restrict? = Pleroma.Config.get([:restrict_unauthenticated, :timelines, cfg_key])

	if restrict? and is_nil(user) do
	render_error(conn, :unauthorized, "authorization required for timeline view")
	else
	activities =
	params
	\|> Map.put("type", ["Create", "Announce"])
	\|> Map.put("local_only", local_only)
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("reply_filtering_user", user)
	\|> ActivityPub.fetch_public_activities()

	conn
	\|> add_link_headers(activities, %{"local" => local_only})
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end
	end

	defp hashtag_fetching(params, user, local_only) do
	tags =
	[params["tag"], params["any"]]
	\|> List.flatten()
	\|> Enum.uniq()
	\|> Enum.filter(& &1)
	\|> Enum.map(&String.downcase(&1))

	tag_all =
	params
	\|> Map.get("all", [])
	\|> Enum.map(&String.downcase(&1))

	tag_reject =
	params
	\|> Map.get("none", [])
	\|> Enum.map(&String.downcase(&1))

	_activities =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("local_only", local_only)
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("user", user)
	\|> Map.put("tag", tags)
	\|> Map.put("tag_all", tag_all)
	\|> Map.put("tag_reject", tag_reject)
	\|> ActivityPub.fetch_public_activities()
	end

	# GET /api/v1/timelines/tag/:tag
	def hashtag(%{assigns: %{user: user}} = conn, params) do
	params = Map.new(params, fn {key, value} -> {to_string(key), value} end)
	local_only = params["local"]
	activities = hashtag_fetching(params, user, local_only)

	conn
	\|> add_link_headers(activities, %{"local" => local_only})
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	# GET /api/v1/timelines/list/:list_id
	def list(%{assigns: %{user: user}} = conn, %{list_id: id} = params) do
	with %Pleroma.List{title: _title, following: following} <- Pleroma.List.get(id, user) do
	params =
	params
	\|> Map.new(fn {key, value} -> {to_string(key), value} end)
	\|> Map.put("type", "Create")
	\|> Map.put("blocking_user", user)
	\|> Map.put("user", user)
	\|> Map.put("muting_user", user)

	# we must filter the following list for the user to avoid leaking statuses the user
	# does not actually have permission to see (for more info, peruse security issue #270).

	user_following = User.following(user)

	activities =
	following
	\|> Enum.filter(fn x -> x in user_following end)
	\|> ActivityPub.fetch_activities_bounded(following, params)
	\|> Enum.reverse()

	render(conn, "index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	else
	_e -> render_error(conn, :forbidden, "Error.")
	end
	end
	end
	diff --git a/test/web/activity_pub/activity_pub_controller_test.exs b/test/web/activity_pub/activity_pub_controller_test.exs
	index 24edab41a..3f48553c9 100644
	--- a/test/web/activity_pub/activity_pub_controller_test.exs
	+++ b/test/web/activity_pub/activity_pub_controller_test.exs
	@@ -1,1445 +1,1491 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
	use Pleroma.Web.ConnCase
	use Oban.Testing, repo: Pleroma.Repo

	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Delivery
	alias Pleroma.Instances
	alias Pleroma.Object
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.Endpoint
	alias Pleroma.Workers.ReceiverWorker

	import Pleroma.Factory

	require Pleroma.Constants

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	setup do: clear_config([:instance, :federating], true)

	describe "/relay" do
	setup do: clear_config([:instance, :allow_relay])

	test "with the relay active, it returns the relay user", %{conn: conn} do
	res =
	conn
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(200)

	assert res["id"] =~ "/relay"
	end

	test "with the relay disabled, it returns 404", %{conn: conn} do
	Config.put([:instance, :allow_relay], false)

	conn
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(404)
	end

	test "on non-federating instance, it returns 404", %{conn: conn} do
	Config.put([:instance, :federating], false)
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(404)
	end
	end

	describe "/internal/fetch" do
	test "it returns the internal fetch user", %{conn: conn} do
	res =
	conn
	\|> get(activity_pub_path(conn, :internal_fetch))
	\|> json_response(200)

	assert res["id"] =~ "/fetch"
	end

	test "on non-federating instance, it returns 404", %{conn: conn} do
	Config.put([:instance, :federating], false)
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> get(activity_pub_path(conn, :internal_fetch))
	\|> json_response(404)
	end
	end

	describe "/users/:nickname" do
	test "it returns a json representation of the user with accept application/json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns a json representation of the user with accept application/activity+json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns a json representation of the user with accept application/ld+json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header(
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns 404 for remote users", %{
	conn: conn
	} do
	user = insert(:user, local: false, nickname: "remoteuser@example.com")

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/#{user.nickname}.json")

	assert json_response(conn, 404)
	end

	test "it returns error when user is not found", %{conn: conn} do
	response =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/jimm")
	\|> json_response(404)

	assert response == "Not found"
	end

	test "it requires authentication if instance is NOT federating", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	put_req_header(
	conn,
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)

	ensure_federating_or_authenticated(conn, "/users/#{user.nickname}.json", user)
	end
	end

	describe "mastodon compatibility routes" do
	test "it returns a json representation of the object with accept application/json", %{
	conn: conn
	} do
	{:ok, object} =
	%{
	"type" => "Note",
	"content" => "hey",
	"id" => Endpoint.url() <> "/users/raymoo/statuses/999999999",
	"actor" => Endpoint.url() <> "/users/raymoo",
	"to" => [Pleroma.Constants.as_public()]
	}
	\|> Object.create()

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/raymoo/statuses/999999999")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: object})
	end

	test "it returns a json representation of the activity with accept application/json", %{
	conn: conn
	} do
	{:ok, object} =
	%{
	"type" => "Note",
	"content" => "hey",
	"id" => Endpoint.url() <> "/users/raymoo/statuses/999999999",
	"actor" => Endpoint.url() <> "/users/raymoo",
	"to" => [Pleroma.Constants.as_public()]
	}
	\|> Object.create()

	{:ok, activity, _} =
	%{
	"id" => object.data["id"] <> "/activity",
	"type" => "Create",
	"object" => object.data["id"],
	"actor" => object.data["actor"],
	"to" => object.data["to"]
	}
	\|> ActivityPub.persist(local: true)

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/raymoo/statuses/999999999/activity")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
	end
	end

	describe "/objects/:uuid" do
	test "it returns a json representation of the object with accept application/json", %{
	conn: conn
	} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns a json representation of the object with accept application/activity+json",
	%{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns a json representation of the object with accept application/ld+json", %{
	conn: conn
	} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header(
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns 404 for non-public messages", %{conn: conn} do
	note = insert(:direct_note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end

	test "it returns 404 for tombstone objects", %{conn: conn} do
	tombstone = insert(:tombstone)
	uuid = String.split(tombstone.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end

	test "it caches a response", %{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok) == json_response(conn2, :ok)
	assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
	end

	test "cached purged after object deletion", %{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	Object.delete(note)

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert "Not found" == json_response(conn2, :not_found)
	end

	test "it requires authentication if instance is NOT federating", %{
	conn: conn
	} do
	user = insert(:user)
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn = put_req_header(conn, "accept", "application/activity+json")

	ensure_federating_or_authenticated(conn, "/objects/#{uuid}", user)
	end
	end

	describe "/activities/:uuid" do
	test "it returns a json representation of the activity", %{conn: conn} do
	activity = insert(:note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
	end

	test "it returns 404 for non-public activities", %{conn: conn} do
	activity = insert(:direct_note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 404)
	end

	test "it caches a response", %{conn: conn} do
	activity = insert(:note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok) == json_response(conn2, :ok)
	assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
	end

	test "cached purged after activity deletion", %{conn: conn} do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "cofe"})

	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	Activity.delete_all_by_object_ap_id(activity.object.data["id"])

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert "Not found" == json_response(conn2, :not_found)
	end

	test "it requires authentication if instance is NOT federating", %{
	conn: conn
	} do
	user = insert(:user)
	activity = insert(:note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn = put_req_header(conn, "accept", "application/activity+json")

	ensure_federating_or_authenticated(conn, "/activities/#{uuid}", user)
	end
	end

	describe "/inbox" do
	test "it inserts an incoming activity into the database", %{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Poison.decode!()

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	@tag capture_log: true
	test "it inserts an incoming activity into the database" <>
	"even if we can't fetch the user but have it in our db",
	%{conn: conn} do
	user =
	insert(:user,
	ap_id: "https://mastodon.example.org/users/raymoo",
	ap_enabled: true,
	local: false,
	last_refreshed_at: nil
	)

	data =
	File.read!("test/fixtures/mastodon-post-activity.json")
	\|> Poison.decode!()
	\|> Map.put("actor", user.ap_id)
	\|> put_in(["object", "attridbutedTo"], user.ap_id)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it clears `unreachable` federation status of the sender", %{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Poison.decode!()

	sender_url = data["actor"]
	Instances.set_consistently_unreachable(sender_url)
	refute Instances.reachable?(sender_url)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)
	assert Instances.reachable?(sender_url)
	end

	test "accept follow activity", %{conn: conn} do
	Pleroma.Config.put([:instance, :federating], true)
	relay = Relay.get_actor()

	assert {:ok, %Activity{} = activity} = Relay.follow("https://relay.mastodon.host/actor")

	followed_relay = Pleroma.User.get_by_ap_id("https://relay.mastodon.host/actor")
	relay = refresh_record(relay)

	accept =
	File.read!("test/fixtures/relay/accept-follow.json")
	\|> String.replace("{{ap_id}}", relay.ap_id)
	\|> String.replace("{{activity_id}}", activity.data["id"])

	assert "ok" ==
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", accept)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))

	assert Pleroma.FollowingRelationship.following?(
	relay,
	followed_relay
	)

	Mix.shell(Mix.Shell.Process)

	on_exit(fn ->
	Mix.shell(Mix.Shell.IO)
	end)

	:ok = Mix.Tasks.Pleroma.Relay.run(["list"])
	assert_receive {:mix_shell, :info, ["relay.mastodon.host"]}
	end

	test "without valid signature, " <>
	"it only accepts Create activities and requires enabled federation",
	%{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Poison.decode!()
	non_create_data = File.read!("test/fixtures/mastodon-announce.json") \|> Poison.decode!()

	conn = put_req_header(conn, "content-type", "application/activity+json")

	Config.put([:instance, :federating], false)

	conn
	\|> post("/inbox", data)
	\|> json_response(403)

	conn
	\|> post("/inbox", non_create_data)
	\|> json_response(403)

	Config.put([:instance, :federating], true)

	ret_conn = post(conn, "/inbox", data)
	assert "ok" == json_response(ret_conn, 200)

	conn
	\|> post("/inbox", non_create_data)
	\|> json_response(400)
	end
	end

	describe "/users/:nickname/inbox" do
	setup do
	data =
	File.read!("test/fixtures/mastodon-post-activity.json")
	\|> Poison.decode!()

	[data: data]
	end

	test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
	user = insert(:user)
	data = Map.put(data, "bcc", [user.ap_id])

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	Map.put(data, "to", user.ap_id)
	\|> Map.delete("cc")

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	Map.put(data, "cc", user.ap_id)
	\|> Map.delete("to")

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	%Activity{} = activity = Activity.get_by_ap_id(data["id"])
	assert user.ap_id in activity.recipients
	end

	test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	Map.put(data, "bcc", user.ap_id)
	\|> Map.delete("to")
	\|> Map.delete("cc")

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts announces with to as string instead of array", %{conn: conn} do
	user = insert(:user)

	data = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"actor" => "http://mastodon.example.org/users/admin",
	"id" => "http://mastodon.example.org/users/admin/statuses/19512778738411822/activity",
	"object" => "https://mastodon.social/users/emelie/statuses/101849165031453009",
	"to" => "https://www.w3.org/ns/activitystreams#Public",
	"cc" => [user.ap_id],
	"type" => "Announce"
	}

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	%Activity{} = activity = Activity.get_by_ap_id(data["id"])
	assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
	end

	test "it accepts messages from actors that are followed by the user", %{
	conn: conn,
	data: data
	} do
	recipient = insert(:user)
	actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})

	{:ok, recipient} = User.follow(recipient, actor)

	object =
	data["object"]
	\|> Map.put("attributedTo", actor.ap_id)

	data =
	data
	\|> Map.put("actor", actor.ap_id)
	\|> Map.put("object", object)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{recipient.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it rejects reads from other users", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/inbox")

	assert json_response(conn, 403)
	end

	test "it returns a note activity in a collection", %{conn: conn} do
	note_activity = insert(:direct_note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/inbox?page=true")

	assert response(conn, 200) =~ note_object.data["content"]
	end

	test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
	user = insert(:user)
	data = Map.put(data, "bcc", [user.ap_id])

	sender_host = URI.parse(data["actor"]).host
	Instances.set_consistently_unreachable(sender_host)
	refute Instances.reachable?(sender_host)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	assert Instances.reachable?(sender_host)
	end

	test "it removes all follower collections but actor's", %{conn: conn} do
	[actor, recipient] = insert_pair(:user)

	data =
	File.read!("test/fixtures/activitypub-client-post-activity.json")
	\|> Poison.decode!()

	object = Map.put(data["object"], "attributedTo", actor.ap_id)

	data =
	data
	\|> Map.put("id", Utils.generate_object_id())
	\|> Map.put("actor", actor.ap_id)
	\|> Map.put("object", object)
	\|> Map.put("cc", [
	recipient.follower_address,
	actor.follower_address
	])
	\|> Map.put("to", [
	recipient.ap_id,
	recipient.follower_address,
	"https://www.w3.org/ns/activitystreams#Public"
	])

	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{recipient.nickname}/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))

	activity = Activity.get_by_ap_id(data["id"])

	assert activity.id
	assert actor.follower_address in activity.recipients
	assert actor.follower_address in activity.data["cc"]

	refute recipient.follower_address in activity.recipients
	refute recipient.follower_address in activity.data["cc"]
	refute recipient.follower_address in activity.data["to"]
	end

	test "it requires authentication", %{conn: conn} do
	user = insert(:user)
	conn = put_req_header(conn, "accept", "application/activity+json")

	ret_conn = get(conn, "/users/#{user.nickname}/inbox")
	assert json_response(ret_conn, 403)

	ret_conn =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/inbox")

	assert json_response(ret_conn, 200)
	end
	end

	describe "GET /users/:nickname/outbox" do
	+ test "it paginates correctly", %{conn: conn} do
	+ user = insert(:user)
	+ conn = assign(conn, :user, user)
	+ outbox_endpoint = user.ap_id <> "/outbox"
	+
	+ _posts =
	+ for i <- 0..15 do
	+ {:ok, activity} = CommonAPI.post(user, %{status: "post #{i}"})
	+ activity
	+ end
	+
	+ result =
	+ conn
	+ \|> put_req_header("accept", "application/activity+json")
	+ \|> get(outbox_endpoint <> "?page=true")
	+ \|> json_response(200)
	+
	+ result_ids = Enum.map(result["orderedItems"], fn x -> x["id"] end)
	+ assert length(result["orderedItems"]) == 10
	+ assert length(result_ids) == 10
	+ assert result["next"]
	+ assert String.starts_with?(result["next"], outbox_endpoint)
	+
	+ result_next =
	+ conn
	+ \|> put_req_header("accept", "application/activity+json")
	+ \|> get(result["next"])
	+ \|> json_response(200)
	+
	+ result_next_ids = Enum.map(result_next["orderedItems"], fn x -> x["id"] end)
	+ assert length(result_next["orderedItems"]) == 6
	+ assert length(result_next_ids) == 6
	+ refute Enum.find(result_next_ids, fn x -> x in result_ids end)
	+ refute Enum.find(result_ids, fn x -> x in result_next_ids end)
	+ assert String.starts_with?(result["id"], outbox_endpoint)
	+
	+ result_next_again =
	+ conn
	+ \|> put_req_header("accept", "application/activity+json")
	+ \|> get(result_next["id"])
	+ \|> json_response(200)
	+
	+ assert result_next == result_next_again
	+ end
	+
	test "it returns 200 even if there're no activities", %{conn: conn} do
	user = insert(:user)
	+ outbox_endpoint = user.ap_id <> "/outbox"

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	- \|> get("/users/#{user.nickname}/outbox")
	+ \|> get(outbox_endpoint)

	result = json_response(conn, 200)
	- assert user.ap_id <> "/outbox" == result["id"]
	+ assert outbox_endpoint == result["id"]
	end

	test "it returns a note activity in a collection", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")

	assert response(conn, 200) =~ note_object.data["content"]
	end

	test "it returns an announce activity in a collection", %{conn: conn} do
	announce_activity = insert(:announce_activity)
	user = User.get_cached_by_ap_id(announce_activity.data["actor"])

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")

	assert response(conn, 200) =~ announce_activity.data["object"]
	end

	test "it requires authentication if instance is NOT federating", %{
	conn: conn
	} do
	user = insert(:user)
	conn = put_req_header(conn, "accept", "application/activity+json")

	ensure_federating_or_authenticated(conn, "/users/#{user.nickname}/outbox", user)
	end
	end

	describe "POST /users/:nickname/outbox (C2S)" do
	setup do
	[
	activity: %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"type" => "Create",
	"object" => %{"type" => "Note", "content" => "AP C2S test"},
	"to" => "https://www.w3.org/ns/activitystreams#Public",
	"cc" => []
	}
	]
	end

	test "it rejects posts from other users / unauthenticated users", %{
	conn: conn,
	activity: activity
	} do
	user = insert(:user)
	other_user = insert(:user)
	conn = put_req_header(conn, "content-type", "application/activity+json")

	conn
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(403)

	conn
	\|> assign(:user, other_user)
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(403)
	end

	test "it inserts an incoming create activity into the database", %{
	conn: conn,
	activity: activity
	} do
	user = insert(:user)

	result =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(201)

	assert Activity.get_by_ap_id(result["id"])
	assert result["object"]
	assert %Object{data: object} = Object.normalize(result["object"])
	assert object["content"] == activity["object"]["content"]
	end

	test "it rejects anything beyond 'Note' creations", %{conn: conn, activity: activity} do
	user = insert(:user)

	activity =
	activity
	\|> put_in(["object", "type"], "Benis")

	_result =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(400)
	end

	test "it inserts an incoming sensitive activity into the database", %{
	conn: conn,
	activity: activity
	} do
	user = insert(:user)
	conn = assign(conn, :user, user)
	object = Map.put(activity["object"], "sensitive", true)
	activity = Map.put(activity, "object", object)

	response =
	conn
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(201)

	assert Activity.get_by_ap_id(response["id"])
	assert response["object"]
	assert %Object{data: response_object} = Object.normalize(response["object"])
	assert response_object["sensitive"] == true
	assert response_object["content"] == activity["object"]["content"]

	representation =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get(response["id"])
	\|> json_response(200)

	assert representation["object"]["sensitive"] == true
	end

	test "it rejects an incoming activity with bogus type", %{conn: conn, activity: activity} do
	user = insert(:user)
	activity = Map.put(activity, "type", "BadType")

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)

	assert json_response(conn, 400)
	end

	test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	data = %{
	type: "Delete",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)
	assert Activity.get_by_ap_id(result["id"])

	assert object = Object.get_by_ap_id(note_object.data["id"])
	assert object.data["type"] == "Tombstone"
	end

	test "it rejects delete activity of object from other actor", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = insert(:user)

	data = %{
	type: "Delete",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	assert json_response(conn, 400)
	end

	test "it increases like count when receiving a like action", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	data = %{
	type: "Like",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)
	assert Activity.get_by_ap_id(result["id"])

	assert object = Object.get_by_ap_id(note_object.data["id"])
	assert object.data["like_count"] == 1
	end
	end

	describe "/relay/followers" do
	test "it returns relay followers", %{conn: conn} do
	relay_actor = Relay.get_actor()
	user = insert(:user)
	User.follow(user, relay_actor)

	result =
	conn
	\|> get("/relay/followers")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user.ap_id]
	end

	test "on non-federating instance, it returns 404", %{conn: conn} do
	Config.put([:instance, :federating], false)
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> get("/relay/followers")
	\|> json_response(404)
	end
	end

	describe "/relay/following" do
	test "it returns relay following", %{conn: conn} do
	result =
	conn
	\|> get("/relay/following")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == []
	end

	test "on non-federating instance, it returns 404", %{conn: conn} do
	Config.put([:instance, :federating], false)
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> get("/relay/following")
	\|> json_response(404)
	end
	end

	describe "/users/:nickname/followers" do
	test "it returns the followers in a collection", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	\|> assign(:user, user_two)
	\|> get("/users/#{user_two.nickname}/followers")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user.ap_id]
	end

	test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, hide_followers: true)
	User.follow(user, user_two)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user_two.nickname}/followers")
	\|> json_response(200)

	assert is_binary(result["first"])
	end

	test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
	%{conn: conn} do
	user = insert(:user)
	other_user = insert(:user, hide_followers: true)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{other_user.nickname}/followers?page=1")

	assert result.status == 403
	assert result.resp_body == ""
	end

	test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
	%{conn: conn} do
	user = insert(:user, hide_followers: true)
	other_user = insert(:user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers?page=1")
	\|> json_response(200)

	assert result["totalItems"] == 1
	assert result["orderedItems"] == [other_user.ap_id]
	end

	test "it works for more than 10 users", %{conn: conn} do
	user = insert(:user)

	Enum.each(1..15, fn _ ->
	other_user = insert(:user)
	User.follow(other_user, user)
	end)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers")
	\|> json_response(200)

	assert length(result["first"]["orderedItems"]) == 10
	assert result["first"]["totalItems"] == 15
	assert result["totalItems"] == 15

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers?page=2")
	\|> json_response(200)

	assert length(result["orderedItems"]) == 5
	assert result["totalItems"] == 15
	end

	test "does not require authentication", %{conn: conn} do
	user = insert(:user)

	conn
	\|> get("/users/#{user.nickname}/followers")
	\|> json_response(200)
	end
	end

	describe "/users/:nickname/following" do
	test "it returns the following in a collection", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user_two.ap_id]
	end

	test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, hide_follows: true)
	User.follow(user, user_two)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user_two.nickname}/following")
	\|> json_response(200)

	assert is_binary(result["first"])
	end

	test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
	%{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, hide_follows: true)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user_two.nickname}/following?page=1")

	assert result.status == 403
	assert result.resp_body == ""
	end

	test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
	%{conn: conn} do
	user = insert(:user, hide_follows: true)
	other_user = insert(:user)
	{:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following?page=1")
	\|> json_response(200)

	assert result["totalItems"] == 1
	assert result["orderedItems"] == [other_user.ap_id]
	end

	test "it works for more than 10 users", %{conn: conn} do
	user = insert(:user)

	Enum.each(1..15, fn _ ->
	user = User.get_cached_by_id(user.id)
	other_user = insert(:user)
	User.follow(user, other_user)
	end)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	assert length(result["first"]["orderedItems"]) == 10
	assert result["first"]["totalItems"] == 15
	assert result["totalItems"] == 15

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following?page=2")
	\|> json_response(200)

	assert length(result["orderedItems"]) == 5
	assert result["totalItems"] == 15
	end

	test "does not require authentication", %{conn: conn} do
	user = insert(:user)

	conn
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)
	end
	end

	describe "delivery tracking" do
	test "it tracks a signed object fetch", %{conn: conn} do
	user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity)

	object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(object_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	end

	test "it tracks a signed activity fetch", %{conn: conn} do
	user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity)

	activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(activity_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	end

	test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
	user = insert(:user, local: false)
	other_user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity)

	object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(object_path)
	\|> json_response(200)

	build_conn()
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, other_user)
	\|> get(object_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	assert Delivery.get(object.id, other_user.id)
	end

	test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
	user = insert(:user, local: false)
	other_user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity)

	activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(activity_path)
	\|> json_response(200)

	build_conn()
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, other_user)
	\|> get(activity_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	assert Delivery.get(object.id, other_user.id)
	end
	end

	describe "Additional ActivityPub C2S endpoints" do
	test "GET /api/ap/whoami", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/ap/whoami")

	user = User.get_cached_by_id(user.id)

	assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)

	conn
	\|> get("/api/ap/whoami")
	\|> json_response(403)
	end

	setup do: clear_config([:media_proxy])
	setup do: clear_config([Pleroma.Upload])

	test "POST /api/ap/upload_media", %{conn: conn} do
	user = insert(:user)

	desc = "Description of the image"

	image = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	object =
	conn
	\|> assign(:user, user)
	\|> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
	\|> json_response(:created)

	assert object["name"] == desc
	assert object["type"] == "Document"
	assert object["actor"] == user.ap_id
	assert [%{"href" => object_href, "mediaType" => object_mediatype}] = object["url"]
	assert is_binary(object_href)
	assert object_mediatype == "image/jpeg"

	activity_request = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"type" => "Create",
	"object" => %{
	"type" => "Note",
	"content" => "AP C2S test, attachment",
	"attachment" => [object]
	},
	"to" => "https://www.w3.org/ns/activitystreams#Public",
	"cc" => []
	}

	activity_response =
	conn
	\|> assign(:user, user)
	\|> post("/users/#{user.nickname}/outbox", activity_request)
	\|> json_response(:created)

	assert activity_response["id"]
	assert activity_response["object"]
	assert activity_response["actor"] == user.ap_id

	assert %Object{data: %{"attachment" => [attachment]}} =
	Object.normalize(activity_response["object"])

	assert attachment["type"] == "Document"
	assert attachment["name"] == desc

	assert [
	%{
	"href" => ^object_href,
	"type" => "Link",
	"mediaType" => ^object_mediatype
	}
	] = attachment["url"]

	# Fails if unauthenticated
	conn
	\|> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
	\|> json_response(403)
	end
	end
	end
	diff --git a/test/web/activity_pub/views/user_view_test.exs b/test/web/activity_pub/views/user_view_test.exs
	index 20b0f223c..bec15a996 100644
	--- a/test/web/activity_pub/views/user_view_test.exs
	+++ b/test/web/activity_pub/views/user_view_test.exs
	@@ -1,192 +1,161 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.UserViewTest do
	use Pleroma.DataCase
	import Pleroma.Factory

	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.CommonAPI

	test "Renders a user, including the public key" do
	user = insert(:user)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})

	assert result["id"] == user.ap_id
	assert result["preferredUsername"] == user.nickname

	assert String.contains?(result["publicKey"]["publicKeyPem"], "BEGIN PUBLIC KEY")
	end

	test "Renders profile fields" do
	fields = [
	%{"name" => "foo", "value" => "bar"}
	]

	{:ok, user} =
	insert(:user)
	\|> User.update_changeset(%{fields: fields})
	\|> User.update_and_set_cache()

	assert %{
	"attachment" => [%{"name" => "foo", "type" => "PropertyValue", "value" => "bar"}]
	} = UserView.render("user.json", %{user: user})
	end

	test "Renders with emoji tags" do
	user = insert(:user, emoji: %{"bib" => "/test"})

	assert %{
	"tag" => [
	%{
	"icon" => %{"type" => "Image", "url" => "/test"},
	"id" => "/test",
	"name" => ":bib:",
	"type" => "Emoji",
	"updated" => "1970-01-01T00:00:00Z"
	}
	]
	} = UserView.render("user.json", %{user: user})
	end

	test "Does not add an avatar image if the user hasn't set one" do
	user = insert(:user)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})
	refute result["icon"]
	refute result["image"]

	user =
	insert(:user,
	avatar: %{"url" => [%{"href" => "https://someurl"}]},
	banner: %{"url" => [%{"href" => "https://somebanner"}]}
	)

	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})
	assert result["icon"]["url"] == "https://someurl"
	assert result["image"]["url"] == "https://somebanner"
	end

	test "renders an invisible user with the invisible property set to true" do
	user = insert(:user, invisible: true)

	assert %{"invisible" => true} = UserView.render("service.json", %{user: user})
	end

	describe "endpoints" do
	test "local users have a usable endpoints structure" do
	user = insert(:user)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})

	assert result["id"] == user.ap_id

	%{
	"sharedInbox" => _,
	"oauthAuthorizationEndpoint" => _,
	"oauthRegistrationEndpoint" => _,
	"oauthTokenEndpoint" => _
	} = result["endpoints"]
	end

	test "remote users have an empty endpoints structure" do
	user = insert(:user, local: false)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})

	assert result["id"] == user.ap_id
	assert result["endpoints"] == %{}
	end

	test "instance users do not expose oAuth endpoints" do
	user = insert(:user, nickname: nil, local: true)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})

	refute result["endpoints"]["oauthAuthorizationEndpoint"]
	refute result["endpoints"]["oauthRegistrationEndpoint"]
	refute result["endpoints"]["oauthTokenEndpoint"]
	end
	end

	describe "followers" do
	test "sets totalItems to zero when followers are hidden" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
	assert %{"totalItems" => 1} = UserView.render("followers.json", %{user: user})
	user = Map.merge(user, %{hide_followers_count: true, hide_followers: true})
	refute UserView.render("followers.json", %{user: user}) \|> Map.has_key?("totalItems")
	end

	test "sets correct totalItems when followers are hidden but the follower counter is not" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
	assert %{"totalItems" => 1} = UserView.render("followers.json", %{user: user})
	user = Map.merge(user, %{hide_followers_count: false, hide_followers: true})
	assert %{"totalItems" => 1} = UserView.render("followers.json", %{user: user})
	end
	end

	describe "following" do
	test "sets totalItems to zero when follows are hidden" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
	assert %{"totalItems" => 1} = UserView.render("following.json", %{user: user})
	user = Map.merge(user, %{hide_follows_count: true, hide_follows: true})
	assert %{"totalItems" => 0} = UserView.render("following.json", %{user: user})
	end

	test "sets correct totalItems when follows are hidden but the follow counter is not" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
	assert %{"totalItems" => 1} = UserView.render("following.json", %{user: user})
	user = Map.merge(user, %{hide_follows_count: false, hide_follows: true})
	assert %{"totalItems" => 1} = UserView.render("following.json", %{user: user})
	end
	end
	-
	- test "activity collection page aginates correctly" do
	- user = insert(:user)
	-
	- posts =
	- for i <- 0..25 do
	- {:ok, activity} = CommonAPI.post(user, %{status: "post #{i}"})
	- activity
	- end
	-
	- # outbox sorts chronologically, newest first, with ten per page
	- posts = Enum.reverse(posts)
	-
	- %{"next" => next_url} =
	- UserView.render("activity_collection_page.json", %{
	- iri: "#{user.ap_id}/outbox",
	- activities: Enum.take(posts, 10)
	- })
	-
	- next_id = Enum.at(posts, 9).id
	- assert next_url =~ next_id
	-
	- %{"next" => next_url} =
	- UserView.render("activity_collection_page.json", %{
	- iri: "#{user.ap_id}/outbox",
	- activities: Enum.take(Enum.drop(posts, 10), 10)
	- })
	-
	- next_id = Enum.at(posts, 19).id
	- assert next_url =~ next_id
	- end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Sep 19, 3:26 AM (1 d, 1 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1768769
Default Alt Text: (91 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions