No OneTemporary
Actions

Size

125 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/plugs/ensure_authenticated_plug.ex b/lib/pleroma/plugs/ensure_authenticated_plug.ex
	index c84ea2e9e..18dd35c4f 100644
	--- a/lib/pleroma/plugs/ensure_authenticated_plug.ex
	+++ b/lib/pleroma/plugs/ensure_authenticated_plug.ex
	@@ -1,35 +1,50 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Plugs.EnsureAuthenticatedPlug do
	import Plug.Conn
	import Pleroma.Web.TranslationHelpers
	alias Pleroma.User

	def init(options) do
	options
	end

	def call(
	%{
	assigns: %{
	auth_credentials: %{password: _},
	user: %User{multi_factor_authentication_settings: %{enabled: true}}
	}
	} = conn,
	_
	) do
	conn
	\|> render_error(:forbidden, "Two-factor authentication enabled, you must use a access token.")
	- \|> halt
	+ \|> halt()
	end

	def call(%{assigns: %{user: %User{}}} = conn, _), do: conn

	- def call(conn, _) do
	+ def call(conn, options) do
	+ perform =
	+ cond do
	+ options[:if_func] -> options[:if_func].()
	+ options[:unless_func] -> !options[:unless_func].()
	+ true -> true
	+ end
	+
	+ if perform do
	+ fail(conn)
	+ else
	+ conn
	+ end
	+ end
	+
	+ def fail(conn) do
	conn
	\|> render_error(:forbidden, "Invalid credentials.")
	- \|> halt
	+ \|> halt()
	end
	end
	diff --git a/lib/pleroma/plugs/federating_plug.ex b/lib/pleroma/plugs/federating_plug.ex
	index c6d622ce4..7d947339f 100644
	--- a/lib/pleroma/plugs/federating_plug.ex
	+++ b/lib/pleroma/plugs/federating_plug.ex
	@@ -1,29 +1,29 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.FederatingPlug do
	import Plug.Conn

	def init(options) do
	options
	end

	def call(conn, _opts) do
	if federating?() do
	conn
	else
	fail(conn)
	end
	end

	def federating?, do: Pleroma.Config.get([:instance, :federating])

	- def fail(conn) do
	+ defp fail(conn) do
	conn
	\|> put_status(404)
	\|> Phoenix.Controller.put_view(Pleroma.Web.ErrorView)
	\|> Phoenix.Controller.render("404.json")
	\|> halt()
	end
	end
	diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	index 525e61360..8b9eb4a2c 100644
	--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	@@ -1,538 +1,532 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubController do
	use Pleroma.Web, :controller

	alias Pleroma.Activity
	alias Pleroma.Delivery
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	+ alias Pleroma.Plugs.EnsureAuthenticatedPlug
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.InternalFetchActor
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.FederatingPlug
	alias Pleroma.Web.Federator

	require Logger

	action_fallback(:errors)

	- # Note: some of the following actions (like :update_inbox) may be server-to-server as well
	- @client_to_server_actions [
	- :whoami,
	- :read_inbox,
	- :outbox,
	- :update_outbox,
	- :upload_media,
	- :followers,
	- :following
	- ]
	+ @federating_only_actions [:internal_fetch, :relay, :relay_following, :relay_followers]

	- plug(FederatingPlug when action not in @client_to_server_actions)
	+ plug(FederatingPlug when action in @federating_only_actions)
	+
	+ plug(
	+ EnsureAuthenticatedPlug,
	+ [unless_func: &FederatingPlug.federating?/0] when action not in @federating_only_actions
	+ )
	+
	+ plug(
	+ EnsureAuthenticatedPlug
	+ when action in [:read_inbox, :update_outbox, :whoami, :upload_media, :following, :followers]
	+ )

	plug(
	Pleroma.Plugs.Cache,
	[query_params: false, tracking_fun: &__MODULE__.track_object_fetch/2]
	when action in [:activity, :object]
	)

	plug(:set_requester_reachable when action in [:inbox])
	plug(:relay_active? when action in [:relay])

	- def relay_active?(conn, _) do
	+ defp relay_active?(conn, _) do
	if Pleroma.Config.get([:instance, :allow_relay]) do
	conn
	else
	conn
	\|> render_error(:not_found, "not found")
	\|> halt()
	end
	end

	def user(conn, %{"nickname" => nickname}) do
	with %User{local: true} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	else
	nil -> {:error, :not_found}
	%{local: false} -> {:error, :not_found}
	end
	end

	def object(conn, %{"uuid" => uuid}) do
	with ap_id <- o_status_url(conn, :object, uuid),
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(object)} do
	conn
	\|> assign(:tracking_fun_data, object.id)
	\|> set_cache_ttl_for(object)
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(ObjectView)
	\|> render("object.json", object: object)
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	def track_object_fetch(conn, nil), do: conn

	def track_object_fetch(conn, object_id) do
	with %{assigns: %{user: %User{id: user_id}}} <- conn do
	Delivery.create(object_id, user_id)
	end

	conn
	end

	def activity(conn, %{"uuid" => uuid}) do
	with ap_id <- o_status_url(conn, :activity, uuid),
	%Activity{} = activity <- Activity.normalize(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(activity)} do
	conn
	\|> maybe_set_tracking_data(activity)
	\|> set_cache_ttl_for(activity)
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(ObjectView)
	\|> render("object.json", object: activity)
	else
	{:public?, false} -> {:error, :not_found}
	nil -> {:error, :not_found}
	end
	end

	defp maybe_set_tracking_data(conn, %Activity{data: %{"type" => "Create"}} = activity) do
	object_id = Object.normalize(activity).id
	assign(conn, :tracking_fun_data, object_id)
	end

	defp maybe_set_tracking_data(conn, _activity), do: conn

	defp set_cache_ttl_for(conn, %Activity{object: object}) do
	set_cache_ttl_for(conn, object)
	end

	defp set_cache_ttl_for(conn, entity) do
	ttl =
	case entity do
	%Object{data: %{"type" => "Question"}} ->
	Pleroma.Config.get([:web_cache_ttl, :activity_pub_question])

	%Object{} ->
	Pleroma.Config.get([:web_cache_ttl, :activity_pub])

	_ ->
	nil
	end

	assign(conn, :cache_ttl, ttl)
	end

	# GET /relay/following
	- def following(%{assigns: %{relay: true}} = conn, _params) do
	- if FederatingPlug.federating?() do
	+ def relay_following(conn, _params) do
	+ with %{halted: false} = conn <- FederatingPlug.call(conn, []) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: Relay.get_actor()})
	- else
	- FederatingPlug.fail(conn)
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
	{:show_follows, true} <-
	{:show_follows, (for_user && for_user == user) \|\| !user.hide_follows} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: user, page: page, for: for_user})
	else
	{:show_follows, _} ->
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> send_resp(403, "")
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: user, for: for_user})
	end
	end

	# GET /relay/followers
	- def followers(%{assigns: %{relay: true}} = conn, _params) do
	- if FederatingPlug.federating?() do
	+ def relay_followers(conn, _params) do
	+ with %{halted: false} = conn <- FederatingPlug.call(conn, []) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: Relay.get_actor()})
	- else
	- FederatingPlug.fail(conn)
	end
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
	{:show_followers, true} <-
	{:show_followers, (for_user && for_user == user) \|\| !user.hide_followers} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: user, page: page, for: for_user})
	else
	{:show_followers, _} ->
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> send_resp(403, "")
	end
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: user, for: for_user})
	end
	end

	- def outbox(conn, %{"nickname" => nickname, "page" => page?} = params)
	+ def outbox(
	+ %{assigns: %{user: for_user}} = conn,
	+ %{"nickname" => nickname, "page" => page?} = params
	+ )
	when page? in [true, "true"] do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	activities =
	if params["max_id"] do
	- ActivityPub.fetch_user_activities(user, nil, %{
	+ ActivityPub.fetch_user_activities(user, for_user, %{
	"max_id" => params["max_id"],
	# This is a hack because postgres generates inefficient queries when filtering by
	# 'Answer', poll votes will be hidden by the visibility filter in this case anyway
	"include_poll_votes" => true,
	"limit" => 10
	})
	else
	- ActivityPub.fetch_user_activities(user, nil, %{
	+ ActivityPub.fetch_user_activities(user, for_user, %{
	"limit" => 10,
	"include_poll_votes" => true
	})
	end

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection_page.json", %{
	activities: activities,
	iri: "#{user.ap_id}/outbox"
	})
	end
	end

	def outbox(conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection.json", %{iri: "#{user.ap_id}/outbox"})
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, %{"nickname" => nickname} = params) do
	with %User{} = recipient <- User.get_cached_by_nickname(nickname),
	{:ok, %User{} = actor} <- User.get_or_fetch_by_ap_id(params["actor"]),
	true <- Utils.recipient_in_message(recipient, actor, params),
	params <- Utils.maybe_splice_recipient(recipient.ap_id, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end

	# POST /relay/inbox -or- POST /internal/fetch/inbox
	def inbox(conn, params) do
	if params["type"] == "Create" && FederatingPlug.federating?() do
	post_inbox_relayed_create(conn, params)
	else
	post_inbox_fallback(conn, params)
	end
	end

	defp post_inbox_relayed_create(conn, params) do
	Logger.debug(
	"Signature missing or not from author, relayed Create message, fetching object from source"
	)

	Fetcher.fetch_object_from_id(params["object"]["id"])

	json(conn, "ok")
	end

	defp post_inbox_fallback(conn, params) do
	headers = Enum.into(conn.req_headers, %{})

	- if String.contains?(headers["signature"], params["actor"]) do
	+ if headers["signature"] && params["actor"] &&
	+ String.contains?(headers["signature"], params["actor"]) do
	Logger.debug(
	"Signature validation error for: #{params["actor"]}, make sure you are forwarding the HTTP Host header!"
	)

	Logger.debug(inspect(conn.req_headers))
	end

	- json(conn, dgettext("errors", "error"))
	+ conn
	+ \|> put_status(:bad_request)
	+ \|> json(dgettext("errors", "error"))
	end

	defp represent_service_actor(%User{} = user, conn) do
	with {:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	else
	nil -> {:error, :not_found}
	end
	end

	defp represent_service_actor(nil, _), do: {:error, :not_found}

	def relay(conn, _params) do
	Relay.get_actor()
	\|> represent_service_actor(conn)
	end

	def internal_fetch(conn, _params) do
	InternalFetchActor.get_actor()
	\|> represent_service_actor(conn)
	end

	@doc "Returns the authenticated user's ActivityPub User object or a 404 Not Found if non-authenticated"
	def whoami(%{assigns: %{user: %User{} = user}} = conn, _params) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	end

	- def whoami(_conn, _params), do: {:error, :not_found}
	-
	def read_inbox(
	%{assigns: %{user: %User{nickname: nickname} = user}} = conn,
	%{"nickname" => nickname, "page" => page?} = params
	)
	when page? in [true, "true"] do
	activities =
	if params["max_id"] do
	ActivityPub.fetch_activities([user.ap_id \| User.following(user)], %{
	"max_id" => params["max_id"],
	"limit" => 10
	})
	else
	ActivityPub.fetch_activities([user.ap_id \| User.following(user)], %{"limit" => 10})
	end

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection_page.json", %{
	activities: activities,
	iri: "#{user.ap_id}/inbox"
	})
	end

	def read_inbox(%{assigns: %{user: %User{nickname: nickname} = user}} = conn, %{
	"nickname" => nickname
	}) do
	with {:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection.json", %{iri: "#{user.ap_id}/inbox"})
	end
	end

	- def read_inbox(%{assigns: %{user: nil}} = conn, %{"nickname" => nickname}) do
	- err = dgettext("errors", "can't read inbox of %{nickname}", nickname: nickname)
	-
	- conn
	- \|> put_status(:forbidden)
	- \|> json(err)
	- end
	-
	def read_inbox(%{assigns: %{user: %User{nickname: as_nickname}}} = conn, %{
	"nickname" => nickname
	}) do
	err =
	dgettext("errors", "can't read inbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: as_nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end

	- def handle_user_activity(%User{} = user, %{"type" => "Create"} = params) do
	+ defp handle_user_activity(%User{} = user, %{"type" => "Create"} = params) do
	object =
	params["object"]
	\|> Map.merge(Map.take(params, ["to", "cc"]))
	\|> Map.put("attributedTo", user.ap_id())
	\|> Transmogrifier.fix_object()

	ActivityPub.create(%{
	to: params["to"],
	actor: user,
	context: object["context"],
	object: object,
	additional: Map.take(params, ["cc"])
	})
	end

	- def handle_user_activity(%User{} = user, %{"type" => "Delete"} = params) do
	+ defp handle_user_activity(%User{} = user, %{"type" => "Delete"} = params) do
	with %Object{} = object <- Object.normalize(params["object"]),
	true <- user.is_moderator \|\| user.ap_id == object.data["actor"],
	{:ok, delete} <- ActivityPub.delete(object) do
	{:ok, delete}
	else
	_ -> {:error, dgettext("errors", "Can't delete object")}
	end
	end

	- def handle_user_activity(%User{} = user, %{"type" => "Like"} = params) do
	+ defp handle_user_activity(%User{} = user, %{"type" => "Like"} = params) do
	with %Object{} = object <- Object.normalize(params["object"]),
	{:ok, activity, _object} <- ActivityPub.like(user, object) do
	{:ok, activity}
	else
	_ -> {:error, dgettext("errors", "Can't like object")}
	end
	end

	- def handle_user_activity(_, _) do
	+ defp handle_user_activity(_, _) do
	{:error, dgettext("errors", "Unhandled activity type")}
	end

	def update_outbox(
	%{assigns: %{user: %User{nickname: nickname} = user}} = conn,
	%{"nickname" => nickname} = params
	) do
	actor = user.ap_id()

	params =
	params
	\|> Map.drop(["id"])
	\|> Map.put("actor", actor)
	\|> Transmogrifier.fix_addressing()

	with {:ok, %Activity{} = activity} <- handle_user_activity(user, params) do
	conn
	\|> put_status(:created)
	\|> put_resp_header("location", activity.data["id"])
	\|> json(activity.data)
	else
	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(message)
	end
	end

	def update_outbox(%{assigns: %{user: %User{} = user}} = conn, %{"nickname" => nickname}) do
	err =
	dgettext("errors", "can't update outbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: user.nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end

	- def errors(conn, {:error, :not_found}) do
	+ defp errors(conn, {:error, :not_found}) do
	conn
	\|> put_status(:not_found)
	\|> json(dgettext("errors", "Not found"))
	end

	- def errors(conn, _e) do
	+ defp errors(conn, _e) do
	conn
	\|> put_status(:internal_server_error)
	\|> json(dgettext("errors", "error"))
	end

	defp set_requester_reachable(%Plug.Conn{} = conn, _) do
	with actor <- conn.params["actor"],
	true <- is_binary(actor) do
	Pleroma.Instances.set_reachable(actor)
	end

	conn
	end

	defp ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	{:ok, new_user} = User.ensure_keys_present(user)

	for_user =
	if new_user != user and match?(%User{}, for_user) do
	User.get_cached_by_nickname(for_user.nickname)
	else
	for_user
	end

	{new_user, for_user}
	end

	# TODO: Add support for "object" field
	@doc """
	Endpoint based on <https://www.w3.org/wiki/SocialCG/ActivityPub/MediaUpload>

	Parameters:
	- (required) `file`: data of the media
	- (optionnal) `description`: description of the media, intended for accessibility

	Response:
	- HTTP Code: 201 Created
	- HTTP Body: ActivityPub object to be inserted into another's `attachment` field
	"""
	def upload_media(%{assigns: %{user: %User{} = user}} = conn, %{"file" => file} = data) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, "description")
	) do
	Logger.debug(inspect(object))

	conn
	\|> put_status(:created)
	\|> json(object.data)
	end
	end
	end
	diff --git a/lib/pleroma/web/feed/user_controller.ex b/lib/pleroma/web/feed/user_controller.ex
	index 59aabb549..9ba602d9f 100644
	--- a/lib/pleroma/web/feed/user_controller.ex
	+++ b/lib/pleroma/web/feed/user_controller.ex
	@@ -1,67 +1,72 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Feed.UserController do
	use Pleroma.Web, :controller

	alias Fallback.RedirectController
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.ActivityPubController
	alias Pleroma.Web.Feed.FeedView

	import Pleroma.Web.ControllerHelper, only: [put_in_if_exist: 3]

	plug(Pleroma.Plugs.SetFormatPlug when action in [:feed_redirect])

	action_fallback(:errors)

	def feed_redirect(%{assigns: %{format: "html"}} = conn, %{"nickname" => nickname}) do
	with {_, %User{} = user} <- {:fetch_user, User.get_cached_by_nickname_or_id(nickname)} do
	RedirectController.redirector_with_meta(conn, %{user: user})
	end
	end

	def feed_redirect(%{assigns: %{format: format}} = conn, _params)
	when format in ["json", "activity+json"] do
	- ActivityPubController.call(conn, :user)
	+ with %{halted: false} = conn <-
	+ Pleroma.Plugs.EnsureAuthenticatedPlug.call(conn,
	+ unless_func: &Pleroma.Web.FederatingPlug.federating?/0
	+ ) do
	+ ActivityPubController.call(conn, :user)
	+ end
	end

	def feed_redirect(conn, %{"nickname" => nickname}) do
	with {_, %User{} = user} <- {:fetch_user, User.get_cached_by_nickname(nickname)} do
	redirect(conn, external: "#{user_feed_url(conn, :feed, user.nickname)}.atom")
	end
	end

	def feed(conn, %{"nickname" => nickname} = params) do
	with {_, %User{} = user} <- {:fetch_user, User.get_cached_by_nickname(nickname)} do
	activities =
	%{
	"type" => ["Create"],
	"actor_id" => user.ap_id
	}
	\|> put_in_if_exist("max_id", params["max_id"])
	\|> ActivityPub.fetch_public_activities()

	conn
	\|> put_resp_content_type("application/atom+xml")
	\|> put_view(FeedView)
	\|> render("user.xml",
	user: user,
	activities: activities,
	feed_config: Pleroma.Config.get([:feed])
	)
	end
	end

	def errors(conn, {:error, :not_found}) do
	render_error(conn, :not_found, "Not found")
	end

	def errors(conn, {:fetch_user, nil}), do: errors(conn, {:error, :not_found})

	def errors(conn, _) do
	render_error(conn, :internal_server_error, "Something went wrong")
	end
	end
	diff --git a/lib/pleroma/web/ostatus/ostatus_controller.ex b/lib/pleroma/web/ostatus/ostatus_controller.ex
	index e3f42b5c4..6fd3cfce5 100644
	--- a/lib/pleroma/web/ostatus/ostatus_controller.ex
	+++ b/lib/pleroma/web/ostatus/ostatus_controller.ex
	@@ -1,149 +1,151 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OStatus.OStatusController do
	use Pleroma.Web, :controller

	alias Fallback.RedirectController
	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.Plugs.RateLimiter
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPubController
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.Endpoint
	alias Pleroma.Web.Metadata.PlayerView
	alias Pleroma.Web.Router

	- plug(Pleroma.Web.FederatingPlug)
	+ plug(Pleroma.Plugs.EnsureAuthenticatedPlug,
	+ unless_func: &Pleroma.Web.FederatingPlug.federating?/0
	+ )

	plug(
	RateLimiter,
	[name: :ap_routes, params: ["uuid"]] when action in [:object, :activity]
	)

	plug(
	Pleroma.Plugs.SetFormatPlug
	when action in [:object, :activity, :notice]
	)

	action_fallback(:errors)

	def object(%{assigns: %{format: format}} = conn, %{"uuid" => _uuid})
	when format in ["json", "activity+json"] do
	ActivityPubController.call(conn, :object)
	end

	def object(%{assigns: %{format: format}} = conn, %{"uuid" => uuid}) do
	with id <- o_status_url(conn, :object, uuid),
	{_, %Activity{} = activity} <-
	{:activity, Activity.get_create_by_object_ap_id_with_object(id)},
	{_, true} <- {:public?, Visibility.is_public?(activity)} do
	case format do
	_ -> redirect(conn, to: "/notice/#{activity.id}")
	end
	else
	reason when reason in [{:public?, false}, {:activity, nil}] ->
	{:error, :not_found}

	e ->
	e
	end
	end

	def activity(%{assigns: %{format: format}} = conn, %{"uuid" => _uuid})
	when format in ["json", "activity+json"] do
	ActivityPubController.call(conn, :activity)
	end

	def activity(%{assigns: %{format: format}} = conn, %{"uuid" => uuid}) do
	with id <- o_status_url(conn, :activity, uuid),
	{_, %Activity{} = activity} <- {:activity, Activity.normalize(id)},
	{_, true} <- {:public?, Visibility.is_public?(activity)} do
	case format do
	_ -> redirect(conn, to: "/notice/#{activity.id}")
	end
	else
	reason when reason in [{:public?, false}, {:activity, nil}] ->
	{:error, :not_found}

	e ->
	e
	end
	end

	def notice(%{assigns: %{format: format}} = conn, %{"id" => id}) do
	with {_, %Activity{} = activity} <- {:activity, Activity.get_by_id_with_object(id)},
	{_, true} <- {:public?, Visibility.is_public?(activity)},
	%User{} = user <- User.get_cached_by_ap_id(activity.data["actor"]) do
	cond do
	format in ["json", "activity+json"] ->
	if activity.local do
	%{data: %{"id" => redirect_url}} = Object.normalize(activity)
	redirect(conn, external: redirect_url)
	else
	{:error, :not_found}
	end

	activity.data["type"] == "Create" ->
	%Object{} = object = Object.normalize(activity)

	RedirectController.redirector_with_meta(
	conn,
	%{
	activity_id: activity.id,
	object: object,
	url: Router.Helpers.o_status_url(Endpoint, :notice, activity.id),
	user: user
	}
	)

	true ->
	RedirectController.redirector(conn, nil)
	end
	else
	reason when reason in [{:public?, false}, {:activity, nil}] ->
	conn
	\|> put_status(404)
	\|> RedirectController.redirector(nil, 404)

	e ->
	e
	end
	end

	# Returns an HTML embedded <audio> or <video> player suitable for embed iframes.
	def notice_player(conn, %{"id" => id}) do
	with %Activity{data: %{"type" => "Create"}} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.is_public?(activity),
	%Object{} = object <- Object.normalize(activity),
	%{data: %{"attachment" => [%{"url" => [url \| _]} \| _]}} <- object,
	true <- String.starts_with?(url["mediaType"], ["audio", "video"]) do
	conn
	\|> put_layout(:metadata_player)
	\|> put_resp_header("x-frame-options", "ALLOW")
	\|> put_resp_header(
	"content-security-policy",
	"default-src 'none';style-src 'self' 'unsafe-inline';img-src 'self' data: https:; media-src 'self' https:;"
	)
	\|> put_view(PlayerView)
	\|> render("player.html", url)
	else
	_error ->
	conn
	\|> put_status(404)
	\|> RedirectController.redirector(nil, 404)
	end
	end

	- def errors(conn, {:error, :not_found}) do
	+ defp errors(conn, {:error, :not_found}) do
	render_error(conn, :not_found, "Not found")
	end

	- def errors(conn, {:fetch_user, nil}), do: errors(conn, {:error, :not_found})
	+ defp errors(conn, {:fetch_user, nil}), do: errors(conn, {:error, :not_found})

	- def errors(conn, _) do
	+ defp errors(conn, _) do
	render_error(conn, :internal_server_error, "Something went wrong")
	end
	end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 2308448aa..79c824851 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,689 +1,688 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router

	pipeline :browser do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	end

	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	end

	pipeline :api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :authenticated_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :admin_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.AdminSecretAuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.UserIsAdminPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :mastodon_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :pleroma_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :well_known do
	plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	pipeline :http_signature do
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", PasswordController, :reset, as: :reset_password)
	post("/password_reset", PasswordController, :do_reset, as: :reset_password)
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	get("/healthcheck", UtilController, :healthcheck)
	end

	scope "/api/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	scope "/api/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:admin_api)

	post("/users/follow", AdminAPIController, :user_follow)
	post("/users/unfollow", AdminAPIController, :user_unfollow)

	put("/users/disable_mfa", AdminAPIController, :disable_mfa)
	delete("/users", AdminAPIController, :user_delete)
	post("/users", AdminAPIController, :users_create)
	patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
	patch("/users/activate", AdminAPIController, :user_activate)
	patch("/users/deactivate", AdminAPIController, :user_deactivate)
	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)

	get("/users/:nickname/permission_group", AdminAPIController, :right_get)
	get("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_get)

	post("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_add)

	delete(
	"/users/:nickname/permission_group/:permission_group",
	AdminAPIController,
	:right_delete
	)

	post("/users/permission_group/:permission_group", AdminAPIController, :right_add_multiple)

	delete(
	"/users/permission_group/:permission_group",
	AdminAPIController,
	:right_delete_multiple
	)

	get("/relay", AdminAPIController, :relay_list)
	post("/relay", AdminAPIController, :relay_follow)
	delete("/relay", AdminAPIController, :relay_unfollow)

	post("/users/invite_token", AdminAPIController, :create_invite_token)
	get("/users/invites", AdminAPIController, :invites)
	post("/users/revoke_invite", AdminAPIController, :revoke_invite)
	post("/users/email_invite", AdminAPIController, :email_invite)

	get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)
	patch("/users/force_password_reset", AdminAPIController, :force_password_reset)

	get("/users", AdminAPIController, :list_users)
	get("/users/:nickname", AdminAPIController, :user_show)
	get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)

	get("/instances/:instance/statuses", AdminAPIController, :list_instance_statuses)

	patch("/users/confirm_email", AdminAPIController, :confirm_email)
	patch("/users/resend_confirmation_email", AdminAPIController, :resend_confirmation_email)

	get("/reports", AdminAPIController, :list_reports)
	get("/grouped_reports", AdminAPIController, :list_grouped_reports)
	get("/reports/:id", AdminAPIController, :report_show)
	patch("/reports", AdminAPIController, :reports_update)
	post("/reports/:id/notes", AdminAPIController, :report_notes_create)
	delete("/reports/:report_id/notes/:id", AdminAPIController, :report_notes_delete)

	put("/statuses/:id", AdminAPIController, :status_update)
	delete("/statuses/:id", AdminAPIController, :status_delete)
	get("/statuses", AdminAPIController, :list_statuses)

	get("/config", AdminAPIController, :config_show)
	post("/config", AdminAPIController, :config_update)
	get("/config/descriptions", AdminAPIController, :config_descriptions)
	get("/restart", AdminAPIController, :restart)

	get("/moderation_log", AdminAPIController, :list_log)

	post("/reload_emoji", AdminAPIController, :reload_emoji)
	get("/stats", AdminAPIController, :stats)
	end

	scope "/api/pleroma/emoji", Pleroma.Web.PleromaAPI do
	scope "/packs" do
	# Modifying packs
	pipe_through(:admin_api)

	post("/import_from_fs", EmojiAPIController, :import_from_fs)

	post("/:pack_name/update_file", EmojiAPIController, :update_file)
	post("/:pack_name/update_metadata", EmojiAPIController, :update_metadata)
	put("/:name", EmojiAPIController, :create)
	delete("/:name", EmojiAPIController, :delete)
	post("/download_from", EmojiAPIController, :download_from)
	post("/list_from", EmojiAPIController, :list_from)
	end

	scope "/packs" do
	# Pack info / downloading
	get("/", EmojiAPIController, :list_packs)
	get("/:name/download_shared/", EmojiAPIController, :download_shared)
	end
	end

	scope "/", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_html)

	post("/main/ostatus", UtilController, :remote_subscribe)
	get("/ostatus_subscribe", RemoteFollowController, :follow)

	post("/ostatus_subscribe", RemoteFollowController, :do_follow)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:authenticated_api)

	post("/change_email", UtilController, :change_email)
	post("/change_password", UtilController, :change_password)
	post("/delete_account", UtilController, :delete_account)
	put("/notification_settings", UtilController, :update_notificaton_settings)
	post("/disable_account", UtilController, :disable_account)

	post("/blocks_import", UtilController, :blocks_import)
	post("/follow_import", UtilController, :follow_import)
	end

	scope "/api/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:authenticated_api)

	get("/accounts/mfa", TwoFactorAuthenticationController, :settings)
	get("/accounts/mfa/backup_codes", TwoFactorAuthenticationController, :backup_codes)
	get("/accounts/mfa/setup/:method", TwoFactorAuthenticationController, :setup)
	post("/accounts/mfa/confirm/:method", TwoFactorAuthenticationController, :confirm)
	delete("/accounts/mfa/:method", TwoFactorAuthenticationController, :disable)
	end

	scope "/oauth", Pleroma.Web.OAuth do
	scope [] do
	pipe_through(:oauth)
	get("/authorize", OAuthController, :authorize)
	end

	post("/authorize", OAuthController, :create_authorization)
	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	get("/registration_details", OAuthController, :registration_details)

	post("/mfa/challenge", MFAController, :challenge)
	post("/mfa/verify", MFAController, :verify, as: :mfa_verify)
	get("/mfa", MFAController, :show)

	scope [] do
	pipe_through(:browser)

	get("/prepare_request", OAuthController, :prepare_request)
	get("/:provider", OAuthController, :request)
	get("/:provider/callback", OAuthController, :callback)
	post("/register", OAuthController, :register)
	end
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)

	get("/statuses/:id/reactions/:emoji", PleromaAPIController, :emoji_reactions_by)
	get("/statuses/:id/reactions", PleromaAPIController, :emoji_reactions_by)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	scope [] do
	pipe_through(:authenticated_api)

	get("/conversations/:id/statuses", PleromaAPIController, :conversation_statuses)
	get("/conversations/:id", PleromaAPIController, :conversation)
	post("/conversations/read", PleromaAPIController, :read_conversations)
	end

	scope [] do
	pipe_through(:authenticated_api)

	patch("/conversations/:id", PleromaAPIController, :update_conversation)
	put("/statuses/:id/reactions/:emoji", PleromaAPIController, :react_with_emoji)
	delete("/statuses/:id/reactions/:emoji", PleromaAPIController, :unreact_with_emoji)
	post("/notifications/read", PleromaAPIController, :read_notification)

	patch("/accounts/update_avatar", AccountController, :update_avatar)
	patch("/accounts/update_banner", AccountController, :update_banner)
	patch("/accounts/update_background", AccountController, :update_background)

	get("/mascot", MascotController, :show)
	put("/mascot", MascotController, :update)

	post("/scrobble", ScrobbleController, :new_scrobble)
	end

	scope [] do
	pipe_through(:api)
	get("/accounts/:id/favourites", AccountController, :favourites)
	end

	scope [] do
	pipe_through(:authenticated_api)

	post("/accounts/:id/subscribe", AccountController, :subscribe)
	post("/accounts/:id/unsubscribe", AccountController, :unsubscribe)
	end

	post("/accounts/confirmation_resend", AccountController, :confirmation_resend)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)
	get("/accounts/:id/scrobbles", ScrobbleController, :user_scrobbles)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	get("/accounts/verify_credentials", AccountController, :verify_credentials)

	get("/accounts/relationships", AccountController, :relationships)

	get("/accounts/:id/lists", AccountController, :lists)
	get("/accounts/:id/identity_proofs", MastodonAPIController, :empty_array)

	get("/follow_requests", FollowRequestController, :index)
	get("/blocks", AccountController, :blocks)
	get("/mutes", AccountController, :mutes)

	get("/timelines/home", TimelineController, :home)
	get("/timelines/direct", TimelineController, :direct)

	get("/favourites", StatusController, :favourites)
	get("/bookmarks", StatusController, :bookmarks)

	get("/notifications", NotificationController, :index)
	get("/notifications/:id", NotificationController, :show)
	post("/notifications/clear", NotificationController, :clear)
	post("/notifications/dismiss", NotificationController, :dismiss)
	delete("/notifications/destroy_multiple", NotificationController, :destroy_multiple)

	get("/scheduled_statuses", ScheduledActivityController, :index)
	get("/scheduled_statuses/:id", ScheduledActivityController, :show)

	get("/lists", ListController, :index)
	get("/lists/:id", ListController, :show)
	get("/lists/:id/accounts", ListController, :list_accounts)

	get("/domain_blocks", DomainBlockController, :index)

	get("/filters", FilterController, :index)

	get("/suggestions", SuggestionController, :index)

	get("/conversations", ConversationController, :index)
	post("/conversations/:id/read", ConversationController, :read)

	get("/endorsements", AccountController, :endorsements)

	patch("/accounts/update_credentials", AccountController, :update_credentials)

	post("/statuses", StatusController, :create)
	delete("/statuses/:id", StatusController, :delete)

	post("/statuses/:id/reblog", StatusController, :reblog)
	post("/statuses/:id/unreblog", StatusController, :unreblog)
	post("/statuses/:id/favourite", StatusController, :favourite)
	post("/statuses/:id/unfavourite", StatusController, :unfavourite)
	post("/statuses/:id/pin", StatusController, :pin)
	post("/statuses/:id/unpin", StatusController, :unpin)
	post("/statuses/:id/bookmark", StatusController, :bookmark)
	post("/statuses/:id/unbookmark", StatusController, :unbookmark)
	post("/statuses/:id/mute", StatusController, :mute_conversation)
	post("/statuses/:id/unmute", StatusController, :unmute_conversation)

	put("/scheduled_statuses/:id", ScheduledActivityController, :update)
	delete("/scheduled_statuses/:id", ScheduledActivityController, :delete)

	post("/polls/:id/votes", PollController, :vote)

	post("/media", MediaController, :create)
	put("/media/:id", MediaController, :update)

	delete("/lists/:id", ListController, :delete)
	post("/lists", ListController, :create)
	put("/lists/:id", ListController, :update)

	post("/lists/:id/accounts", ListController, :add_to_list)
	delete("/lists/:id/accounts", ListController, :remove_from_list)

	post("/filters", FilterController, :create)
	get("/filters/:id", FilterController, :show)
	put("/filters/:id", FilterController, :update)
	delete("/filters/:id", FilterController, :delete)

	post("/reports", ReportController, :create)

	post("/follows", AccountController, :follows)
	post("/accounts/:id/follow", AccountController, :follow)
	post("/accounts/:id/unfollow", AccountController, :unfollow)
	post("/accounts/:id/block", AccountController, :block)
	post("/accounts/:id/unblock", AccountController, :unblock)
	post("/accounts/:id/mute", AccountController, :mute)
	post("/accounts/:id/unmute", AccountController, :unmute)

	post("/follow_requests/:id/authorize", FollowRequestController, :authorize)
	post("/follow_requests/:id/reject", FollowRequestController, :reject)

	post("/domain_blocks", DomainBlockController, :create)
	delete("/domain_blocks", DomainBlockController, :delete)

	post("/push/subscription", SubscriptionController, :create)
	get("/push/subscription", SubscriptionController, :get)
	put("/push/subscription", SubscriptionController, :update)
	delete("/push/subscription", SubscriptionController, :delete)

	get("/markers", MarkerController, :index)
	post("/markers", MarkerController, :upsert)
	end

	scope "/api/web", Pleroma.Web do
	pipe_through(:authenticated_api)

	put("/settings", MastoFEController, :put_settings)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	post("/accounts", AccountController, :create)
	get("/accounts/search", SearchController, :account_search)

	get("/instance", InstanceController, :show)
	get("/instance/peers", InstanceController, :peers)

	post("/apps", AppController, :create)
	get("/apps/verify_credentials", AppController, :verify_credentials)

	get("/statuses/:id/card", StatusController, :card)
	get("/statuses/:id/favourited_by", StatusController, :favourited_by)
	get("/statuses/:id/reblogged_by", StatusController, :reblogged_by)

	get("/custom_emojis", CustomEmojiController, :index)

	get("/trends", MastodonAPIController, :empty_array)

	get("/timelines/public", TimelineController, :public)
	get("/timelines/tag/:tag", TimelineController, :hashtag)
	get("/timelines/list/:list_id", TimelineController, :list)

	get("/statuses", StatusController, :index)
	get("/statuses/:id", StatusController, :show)
	get("/statuses/:id/context", StatusController, :context)

	get("/polls/:id", PollController, :show)

	get("/accounts/:id/statuses", AccountController, :statuses)
	get("/accounts/:id/followers", AccountController, :followers)
	get("/accounts/:id/following", AccountController, :following)
	get("/accounts/:id", AccountController, :show)

	get("/search", SearchController, :search)
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	pipe_through(:api)
	get("/search", SearchController, :search2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	get("/help/test", TwitterAPI.UtilController, :help_test)
	post("/help/test", TwitterAPI.UtilController, :help_test)
	get("/statusnet/config", TwitterAPI.UtilController, :config)
	get("/statusnet/version", TwitterAPI.UtilController, :version)
	get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	get(
	"/account/confirm_email/:user_id/:token",
	TwitterAPI.Controller,
	:confirm_email,
	as: :confirm_email
	)
	end

	scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	pipe_through(:authenticated_api)

	get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)

	post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read)
	end

	pipeline :ap_service_actor do
	plug(:accepts, ["activity+json", "json"])
	end

	pipeline :ostatus do
	plug(:accepts, ["html", "xml", "atom", "activity+json", "json"])
	plug(Pleroma.Plugs.StaticFEPlug)
	end

	pipeline :oembed do
	plug(:accepts, ["json", "xml"])
	end

	scope "/", Pleroma.Web do
	pipe_through(:ostatus)
	pipe_through(:http_signature)

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)

	get("/users/:nickname/feed", Feed.UserController, :feed, as: :user_feed)
	get("/users/:nickname", Feed.UserController, :feed_redirect, as: :user_feed)

	get("/tags/:tag", Feed.TagController, :feed, as: :tag_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through(:browser)
	get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)
	end

	# Server to Server (S2S) AP interactions
	pipeline :activitypub do
	plug(:accepts, ["activity+json", "json"])
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	# XXX: not really ostatus
	pipe_through(:ostatus)

	get("/users/:nickname/outbox", ActivityPubController, :outbox)
	end

	# Client to Server (C2S) AP interactions
	pipeline :activitypub_client do
	plug(:accepts, ["activity+json", "json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	- # Note: propagate _any_ updates to `@client_to_server_actions` in `ActivityPubController`
	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	get("/api/ap/whoami", ActivityPubController, :whoami)
	get("/users/:nickname/inbox", ActivityPubController, :read_inbox)

	post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	post("/api/ap/upload_media", ActivityPubController, :upload_media)

	get("/users/:nickname/followers", ActivityPubController, :followers)
	get("/users/:nickname/following", ActivityPubController, :following)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through(:activitypub)
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :relay)

	scope [] do
	pipe_through(:http_signature)
	post("/inbox", ActivityPubController, :inbox)
	end

	- get("/following", ActivityPubController, :following, assigns: %{relay: true})
	- get("/followers", ActivityPubController, :followers, assigns: %{relay: true})
	+ get("/following", ActivityPubController, :relay_following)
	+ get("/followers", ActivityPubController, :relay_followers)
	end

	scope "/internal/fetch", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :internal_fetch)
	post("/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web do
	pipe_through(:api)

	get("/web/manifest.json", MastoFEController, :manifest)
	end

	scope "/", Pleroma.Web do
	pipe_through(:mastodon_html)

	get("/web/login", MastodonAPI.AuthController, :login)
	delete("/auth/sign_out", MastodonAPI.AuthController, :logout)

	post("/auth/password", MastodonAPI.AuthController, :password_reset)

	get("/web/*path", MastoFEController, :index)
	end

	pipeline :remote_media do
	end

	scope "/proxy/", Pleroma.Web.MediaProxy do
	pipe_through(:remote_media)

	get("/:sig/:url", MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxyController, :remote)
	end

	if Pleroma.Config.get(:env) == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	scope "/", Pleroma.Web.MongooseIM do
	get("/user_exists", MongooseIMController, :user_exists)
	get("/check_password", MongooseIMController, :check_password)
	end

	scope "/", Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	get("/api*path", RedirectController, :api_not_implemented)
	get("/*path", RedirectController, :redirector)

	options("/*path", RedirectController, :empty)
	end
	end
	diff --git a/test/plugs/ensure_authenticated_plug_test.exs b/test/plugs/ensure_authenticated_plug_test.exs
	index 803ed8518..beac33b16 100644
	--- a/test/plugs/ensure_authenticated_plug_test.exs
	+++ b/test/plugs/ensure_authenticated_plug_test.exs
	@@ -1,56 +1,94 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Plugs.EnsureAuthenticatedPlugTest do
	use Pleroma.Web.ConnCase, async: true

	alias Pleroma.Plugs.EnsureAuthenticatedPlug
	alias Pleroma.User

	- test "it halts if no user is assigned", %{conn: conn} do
	- conn =
	- conn
	- \|> EnsureAuthenticatedPlug.call(%{})
	+ describe "without :if_func / :unless_func options" do
	+ test "it halts if user is NOT assigned", %{conn: conn} do
	+ conn = EnsureAuthenticatedPlug.call(conn, %{})

	- assert conn.status == 403
	- assert conn.halted == true
	+ assert conn.status == 403
	+ assert conn.halted == true
	+ end
	+
	+ test "it continues if a user is assigned", %{conn: conn} do
	+ conn = assign(conn, :user, %User{})
	+ ret_conn = EnsureAuthenticatedPlug.call(conn, %{})
	+
	+ assert ret_conn == conn
	+ end
	end

	test "it halts if user is assigned and MFA enabled", %{conn: conn} do
	conn =
	conn
	\|> assign(:user, %User{multi_factor_authentication_settings: %{enabled: true}})
	\|> assign(:auth_credentials, %{password: "xd-42"})
	\|> EnsureAuthenticatedPlug.call(%{})

	assert conn.status == 403
	assert conn.halted == true

	assert conn.resp_body ==
	"{\"error\":\"Two-factor authentication enabled, you must use a access token.\"}"
	end

	test "it continues if user is assigned and MFA disabled", %{conn: conn} do
	conn =
	conn
	\|> assign(:user, %User{multi_factor_authentication_settings: %{enabled: false}})
	\|> assign(:auth_credentials, %{password: "xd-42"})
	\|> EnsureAuthenticatedPlug.call(%{})

	refute conn.status == 403
	refute conn.halted
	end

	- test "it continues if a user is assigned", %{conn: conn} do
	- conn =
	- conn
	- \|> assign(:user, %User{})
	+ describe "with :if_func / :unless_func options" do
	+ setup do
	+ %{
	+ true_fn: fn -> true end,
	+ false_fn: fn -> false end
	+ }
	+ end

	- ret_conn =
	- conn
	- \|> EnsureAuthenticatedPlug.call(%{})
	+ test "it continues if a user is assigned", %{conn: conn, true_fn: true_fn, false_fn: false_fn} do
	+ conn = assign(conn, :user, %User{})
	+ assert EnsureAuthenticatedPlug.call(conn, if_func: true_fn) == conn
	+ assert EnsureAuthenticatedPlug.call(conn, if_func: false_fn) == conn
	+ assert EnsureAuthenticatedPlug.call(conn, unless_func: true_fn) == conn
	+ assert EnsureAuthenticatedPlug.call(conn, unless_func: false_fn) == conn
	+ end
	+
	+ test "it continues if a user is NOT assigned but :if_func evaluates to `false`",
	+ %{conn: conn, false_fn: false_fn} do
	+ assert EnsureAuthenticatedPlug.call(conn, if_func: false_fn) == conn
	+ end
	+
	+ test "it continues if a user is NOT assigned but :unless_func evaluates to `true`",
	+ %{conn: conn, true_fn: true_fn} do
	+ assert EnsureAuthenticatedPlug.call(conn, unless_func: true_fn) == conn
	+ end
	+
	+ test "it halts if a user is NOT assigned and :if_func evaluates to `true`",
	+ %{conn: conn, true_fn: true_fn} do
	+ conn = EnsureAuthenticatedPlug.call(conn, if_func: true_fn)
	+
	+ assert conn.status == 403
	+ assert conn.halted == true
	+ end
	+
	+ test "it halts if a user is NOT assigned and :unless_func evaluates to `false`",
	+ %{conn: conn, false_fn: false_fn} do
	+ conn = EnsureAuthenticatedPlug.call(conn, unless_func: false_fn)

	- assert ret_conn == conn
	+ assert conn.status == 403
	+ assert conn.halted == true
	+ end
	end
	end
	diff --git a/test/support/conn_case.ex b/test/support/conn_case.ex
	index 0f2e81f9e..d6595f971 100644
	--- a/test/support/conn_case.ex
	+++ b/test/support/conn_case.ex
	@@ -1,69 +1,88 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ConnCase do
	@moduledoc """
	This module defines the test case to be used by
	tests that require setting up a connection.

	Such tests rely on `Phoenix.ConnTest` and also
	import other functionality to make it easier
	to build common datastructures and query the data layer.

	Finally, if the test case interacts with the database,
	it cannot be async. For this reason, every test runs
	inside a transaction which is reset at the beginning
	of the test unless the test case is marked as async.
	"""

	use ExUnit.CaseTemplate

	using do
	quote do
	# Import conveniences for testing with connections
	use Phoenix.ConnTest
	use Pleroma.Tests.Helpers
	import Pleroma.Web.Router.Helpers

	# The default endpoint for testing
	@endpoint Pleroma.Web.Endpoint

	# Sets up OAuth access with specified scopes
	defp oauth_access(scopes, opts \\ []) do
	user =
	Keyword.get_lazy(opts, :user, fn ->
	Pleroma.Factory.insert(:user)
	end)

	token =
	Keyword.get_lazy(opts, :oauth_token, fn ->
	Pleroma.Factory.insert(:oauth_token, user: user, scopes: scopes)
	end)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> assign(:token, token)

	%{user: user, token: token, conn: conn}
	end
	+
	+ defp ensure_federating_or_authenticated(conn, url, user) do
	+ Pleroma.Config.put([:instance, :federating], false)
	+
	+ conn
	+ \|> get(url)
	+ \|> response(403)
	+
	+ conn
	+ \|> assign(:user, user)
	+ \|> get(url)
	+ \|> response(200)
	+
	+ Pleroma.Config.put([:instance, :federating], true)
	+
	+ conn
	+ \|> get(url)
	+ \|> response(200)
	+ end
	end
	end

	setup tags do
	Cachex.clear(:user_cache)
	Cachex.clear(:object_cache)
	:ok = Ecto.Adapters.SQL.Sandbox.checkout(Pleroma.Repo)

	unless tags[:async] do
	Ecto.Adapters.SQL.Sandbox.mode(Pleroma.Repo, {:shared, self()})
	end

	if tags[:needs_streamer] do
	start_supervised(Pleroma.Web.Streamer.supervisor())
	end

	{:ok, conn: Phoenix.ConnTest.build_conn()}
	end
	end
	diff --git a/test/web/activity_pub/activity_pub_controller_test.exs b/test/web/activity_pub/activity_pub_controller_test.exs
	index 04800b7ea..a939d0beb 100644
	--- a/test/web/activity_pub/activity_pub_controller_test.exs
	+++ b/test/web/activity_pub/activity_pub_controller_test.exs
	@@ -1,1113 +1,1221 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
	use Pleroma.Web.ConnCase
	use Oban.Testing, repo: Pleroma.Repo

	import Pleroma.Factory
	alias Pleroma.Activity
	+ alias Pleroma.Config
	alias Pleroma.Delivery
	alias Pleroma.Instances
	alias Pleroma.Object
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Workers.ReceiverWorker

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	- clear_config_all([:instance, :federating]) do
	- Pleroma.Config.put([:instance, :federating], true)
	+ clear_config([:instance, :federating]) do
	+ Config.put([:instance, :federating], true)
	end

	describe "/relay" do
	clear_config([:instance, :allow_relay])

	test "with the relay active, it returns the relay user", %{conn: conn} do
	res =
	conn
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(200)

	assert res["id"] =~ "/relay"
	end

	test "with the relay disabled, it returns 404", %{conn: conn} do
	- Pleroma.Config.put([:instance, :allow_relay], false)
	+ Config.put([:instance, :allow_relay], false)

	conn
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(404)
	- \|> assert
	+ end
	+
	+ test "on non-federating instance, it returns 404", %{conn: conn} do
	+ Config.put([:instance, :federating], false)
	+ user = insert(:user)
	+
	+ conn
	+ \|> assign(:user, user)
	+ \|> get(activity_pub_path(conn, :relay))
	+ \|> json_response(404)
	end
	end

	describe "/internal/fetch" do
	test "it returns the internal fetch user", %{conn: conn} do
	res =
	conn
	\|> get(activity_pub_path(conn, :internal_fetch))
	\|> json_response(200)

	assert res["id"] =~ "/fetch"
	end
	+
	+ test "on non-federating instance, it returns 404", %{conn: conn} do
	+ Config.put([:instance, :federating], false)
	+ user = insert(:user)
	+
	+ conn
	+ \|> assign(:user, user)
	+ \|> get(activity_pub_path(conn, :internal_fetch))
	+ \|> json_response(404)
	+ end
	end

	describe "/users/:nickname" do
	test "it returns a json representation of the user with accept application/json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns a json representation of the user with accept application/activity+json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns a json representation of the user with accept application/ld+json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header(
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns 404 for remote users", %{
	conn: conn
	} do
	user = insert(:user, local: false, nickname: "remoteuser@example.com")

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/#{user.nickname}.json")

	assert json_response(conn, 404)
	end
	+
	+ test "it returns error when user is not found", %{conn: conn} do
	+ response =
	+ conn
	+ \|> put_req_header("accept", "application/json")
	+ \|> get("/users/jimm")
	+ \|> json_response(404)
	+
	+ assert response == "Not found"
	+ end
	+
	+ test "it requires authentication if instance is NOT federating", %{
	+ conn: conn
	+ } do
	+ user = insert(:user)
	+
	+ conn =
	+ put_req_header(
	+ conn,
	+ "accept",
	+ "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	+ )
	+
	+ ensure_federating_or_authenticated(conn, "/users/#{user.nickname}.json", user)
	+ end
	end

	- describe "/object/:uuid" do
	+ describe "/objects/:uuid" do
	test "it returns a json representation of the object with accept application/json", %{
	conn: conn
	} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns a json representation of the object with accept application/activity+json",
	%{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns a json representation of the object with accept application/ld+json", %{
	conn: conn
	} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header(
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns 404 for non-public messages", %{conn: conn} do
	note = insert(:direct_note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end

	test "it returns 404 for tombstone objects", %{conn: conn} do
	tombstone = insert(:tombstone)
	uuid = String.split(tombstone.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end

	test "it caches a response", %{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok) == json_response(conn2, :ok)
	assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
	end

	test "cached purged after object deletion", %{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	Object.delete(note)

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert "Not found" == json_response(conn2, :not_found)
	end
	+
	+ test "it requires authentication if instance is NOT federating", %{
	+ conn: conn
	+ } do
	+ user = insert(:user)
	+ note = insert(:note)
	+ uuid = String.split(note.data["id"], "/") \|> List.last()
	+
	+ conn = put_req_header(conn, "accept", "application/activity+json")
	+
	+ ensure_federating_or_authenticated(conn, "/objects/#{uuid}", user)
	+ end
	end

	describe "/activities/:uuid" do
	test "it returns a json representation of the activity", %{conn: conn} do
	activity = insert(:note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
	end

	test "it returns 404 for non-public activities", %{conn: conn} do
	activity = insert(:direct_note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 404)
	end

	test "it caches a response", %{conn: conn} do
	activity = insert(:note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok) == json_response(conn2, :ok)
	assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
	end

	test "cached purged after activity deletion", %{conn: conn} do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{"status" => "cofe"})

	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	Activity.delete_all_by_object_ap_id(activity.object.data["id"])

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert "Not found" == json_response(conn2, :not_found)
	end
	+
	+ test "it requires authentication if instance is NOT federating", %{
	+ conn: conn
	+ } do
	+ user = insert(:user)
	+ activity = insert(:note_activity)
	+ uuid = String.split(activity.data["id"], "/") \|> List.last()
	+
	+ conn = put_req_header(conn, "accept", "application/activity+json")
	+
	+ ensure_federating_or_authenticated(conn, "/activities/#{uuid}", user)
	+ end
	end

	describe "/inbox" do
	test "it inserts an incoming activity into the database", %{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Poison.decode!()

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it clears `unreachable` federation status of the sender", %{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Poison.decode!()

	sender_url = data["actor"]
	Instances.set_consistently_unreachable(sender_url)
	refute Instances.reachable?(sender_url)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)
	assert Instances.reachable?(sender_url)
	end
	+
	+ test "without valid signature, " <>
	+ "it only accepts Create activities and requires enabled federation",
	+ %{conn: conn} do
	+ data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Poison.decode!()
	+ non_create_data = File.read!("test/fixtures/mastodon-announce.json") \|> Poison.decode!()
	+
	+ conn = put_req_header(conn, "content-type", "application/activity+json")
	+
	+ Config.put([:instance, :federating], false)
	+
	+ conn
	+ \|> post("/inbox", data)
	+ \|> json_response(403)
	+
	+ conn
	+ \|> post("/inbox", non_create_data)
	+ \|> json_response(403)
	+
	+ Config.put([:instance, :federating], true)
	+
	+ ret_conn = post(conn, "/inbox", data)
	+ assert "ok" == json_response(ret_conn, 200)
	+
	+ conn
	+ \|> post("/inbox", non_create_data)
	+ \|> json_response(400)
	+ end
	end

	describe "/users/:nickname/inbox" do
	setup do
	data =
	File.read!("test/fixtures/mastodon-post-activity.json")
	\|> Poison.decode!()

	[data: data]
	end

	test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
	user = insert(:user)
	data = Map.put(data, "bcc", [user.ap_id])

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	Map.put(data, "to", user.ap_id)
	\|> Map.delete("cc")

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	Map.put(data, "cc", user.ap_id)
	\|> Map.delete("to")

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	%Activity{} = activity = Activity.get_by_ap_id(data["id"])
	assert user.ap_id in activity.recipients
	end

	test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	Map.put(data, "bcc", user.ap_id)
	\|> Map.delete("to")
	\|> Map.delete("cc")

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts announces with to as string instead of array", %{conn: conn} do
	user = insert(:user)

	data = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"actor" => "http://mastodon.example.org/users/admin",
	"id" => "http://mastodon.example.org/users/admin/statuses/19512778738411822/activity",
	"object" => "https://mastodon.social/users/emelie/statuses/101849165031453009",
	"to" => "https://www.w3.org/ns/activitystreams#Public",
	"cc" => [user.ap_id],
	"type" => "Announce"
	}

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	%Activity{} = activity = Activity.get_by_ap_id(data["id"])
	assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
	end

	test "it accepts messages from actors that are followed by the user", %{
	conn: conn,
	data: data
	} do
	recipient = insert(:user)
	actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})

	{:ok, recipient} = User.follow(recipient, actor)

	object =
	data["object"]
	\|> Map.put("attributedTo", actor.ap_id)

	data =
	data
	\|> Map.put("actor", actor.ap_id)
	\|> Map.put("object", object)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{recipient.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it rejects reads from other users", %{conn: conn} do
	user = insert(:user)
	- otheruser = insert(:user)
	-
	- conn =
	- conn
	- \|> assign(:user, otheruser)
	- \|> put_req_header("accept", "application/activity+json")
	- \|> get("/users/#{user.nickname}/inbox")
	-
	- assert json_response(conn, 403)
	- end
	-
	- test "it doesn't crash without an authenticated user", %{conn: conn} do
	- user = insert(:user)
	+ other_user = insert(:user)

	conn =
	conn
	+ \|> assign(:user, other_user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/inbox")

	assert json_response(conn, 403)
	end

	test "it returns a note activity in a collection", %{conn: conn} do
	note_activity = insert(:direct_note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/inbox?page=true")

	assert response(conn, 200) =~ note_object.data["content"]
	end

	test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
	user = insert(:user)
	data = Map.put(data, "bcc", [user.ap_id])

	sender_host = URI.parse(data["actor"]).host
	Instances.set_consistently_unreachable(sender_host)
	refute Instances.reachable?(sender_host)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	assert Instances.reachable?(sender_host)
	end

	test "it removes all follower collections but actor's", %{conn: conn} do
	[actor, recipient] = insert_pair(:user)

	data =
	File.read!("test/fixtures/activitypub-client-post-activity.json")
	\|> Poison.decode!()

	object = Map.put(data["object"], "attributedTo", actor.ap_id)

	data =
	data
	\|> Map.put("id", Utils.generate_object_id())
	\|> Map.put("actor", actor.ap_id)
	\|> Map.put("object", object)
	\|> Map.put("cc", [
	recipient.follower_address,
	actor.follower_address
	])
	\|> Map.put("to", [
	recipient.ap_id,
	recipient.follower_address,
	"https://www.w3.org/ns/activitystreams#Public"
	])

	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{recipient.nickname}/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))

	activity = Activity.get_by_ap_id(data["id"])

	assert activity.id
	assert actor.follower_address in activity.recipients
	assert actor.follower_address in activity.data["cc"]

	refute recipient.follower_address in activity.recipients
	refute recipient.follower_address in activity.data["cc"]
	refute recipient.follower_address in activity.data["to"]
	end
	+
	+ test "it requires authentication", %{conn: conn} do
	+ user = insert(:user)
	+ conn = put_req_header(conn, "accept", "application/activity+json")
	+
	+ ret_conn = get(conn, "/users/#{user.nickname}/inbox")
	+ assert json_response(ret_conn, 403)
	+
	+ ret_conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/users/#{user.nickname}/inbox")
	+
	+ assert json_response(ret_conn, 200)
	+ end
	end

	describe "GET /users/:nickname/outbox" do
	- test "it will not bomb when there is no activity", %{conn: conn} do
	+ test "it returns 200 even if there're no activities", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	+ \|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox")

	result = json_response(conn, 200)
	assert user.ap_id <> "/outbox" == result["id"]
	end

	test "it returns a note activity in a collection", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	conn =
	conn
	+ \|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")

	assert response(conn, 200) =~ note_object.data["content"]
	end

	test "it returns an announce activity in a collection", %{conn: conn} do
	announce_activity = insert(:announce_activity)
	user = User.get_cached_by_ap_id(announce_activity.data["actor"])

	conn =
	conn
	+ \|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")

	assert response(conn, 200) =~ announce_activity.data["object"]
	end
	+
	+ test "it requires authentication if instance is NOT federating", %{
	+ conn: conn
	+ } do
	+ user = insert(:user)
	+ conn = put_req_header(conn, "accept", "application/activity+json")
	+
	+ ensure_federating_or_authenticated(conn, "/users/#{user.nickname}/outbox", user)
	+ end
	end

	describe "POST /users/:nickname/outbox" do
	- test "it rejects posts from other users", %{conn: conn} do
	+ test "it rejects posts from other users / unauuthenticated users", %{conn: conn} do
	data = File.read!("test/fixtures/activitypub-client-post-activity.json") \|> Poison.decode!()
	user = insert(:user)
	- otheruser = insert(:user)
	+ other_user = insert(:user)
	+ conn = put_req_header(conn, "content-type", "application/activity+json")

	- conn =
	- conn
	- \|> assign(:user, otheruser)
	- \|> put_req_header("content-type", "application/activity+json")
	- \|> post("/users/#{user.nickname}/outbox", data)
	+ conn
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+ \|> json_response(403)

	- assert json_response(conn, 403)
	+ conn
	+ \|> assign(:user, other_user)
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+ \|> json_response(403)
	end

	test "it inserts an incoming create activity into the database", %{conn: conn} do
	data = File.read!("test/fixtures/activitypub-client-post-activity.json") \|> Poison.decode!()
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)

	assert Activity.get_by_ap_id(result["id"])
	end

	test "it rejects an incoming activity with bogus type", %{conn: conn} do
	data = File.read!("test/fixtures/activitypub-client-post-activity.json") \|> Poison.decode!()
	user = insert(:user)

	data =
	data
	\|> Map.put("type", "BadType")

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	assert json_response(conn, 400)
	end

	test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	data = %{
	type: "Delete",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)
	assert Activity.get_by_ap_id(result["id"])

	assert object = Object.get_by_ap_id(note_object.data["id"])
	assert object.data["type"] == "Tombstone"
	end

	test "it rejects delete activity of object from other actor", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = insert(:user)

	data = %{
	type: "Delete",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	assert json_response(conn, 400)
	end

	test "it increases like count when receiving a like action", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	data = %{
	type: "Like",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)
	assert Activity.get_by_ap_id(result["id"])

	assert object = Object.get_by_ap_id(note_object.data["id"])
	assert object.data["like_count"] == 1
	end
	end

	describe "/relay/followers" do
	test "it returns relay followers", %{conn: conn} do
	relay_actor = Relay.get_actor()
	user = insert(:user)
	User.follow(user, relay_actor)

	result =
	conn
	- \|> assign(:relay, true)
	\|> get("/relay/followers")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user.ap_id]
	end
	+
	+ test "on non-federating instance, it returns 404", %{conn: conn} do
	+ Config.put([:instance, :federating], false)
	+ user = insert(:user)
	+
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/relay/followers")
	+ \|> json_response(404)
	+ end
	end

	describe "/relay/following" do
	test "it returns relay following", %{conn: conn} do
	result =
	conn
	- \|> assign(:relay, true)
	\|> get("/relay/following")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == []
	end
	+
	+ test "on non-federating instance, it returns 404", %{conn: conn} do
	+ Config.put([:instance, :federating], false)
	+ user = insert(:user)
	+
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/relay/following")
	+ \|> json_response(404)
	+ end
	end

	describe "/users/:nickname/followers" do
	test "it returns the followers in a collection", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	+ \|> assign(:user, user_two)
	\|> get("/users/#{user_two.nickname}/followers")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user.ap_id]
	end

	test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, hide_followers: true)
	User.follow(user, user_two)

	result =
	conn
	+ \|> assign(:user, user)
	\|> get("/users/#{user_two.nickname}/followers")
	\|> json_response(200)

	assert is_binary(result["first"])
	end

	- test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is not authenticated",
	+ test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
	%{conn: conn} do
	- user = insert(:user, hide_followers: true)
	+ user = insert(:user)
	+ other_user = insert(:user, hide_followers: true)

	result =
	conn
	- \|> get("/users/#{user.nickname}/followers?page=1")
	+ \|> assign(:user, user)
	+ \|> get("/users/#{other_user.nickname}/followers?page=1")

	assert result.status == 403
	assert result.resp_body == ""
	end

	test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
	%{conn: conn} do
	user = insert(:user, hide_followers: true)
	other_user = insert(:user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers?page=1")
	\|> json_response(200)

	assert result["totalItems"] == 1
	assert result["orderedItems"] == [other_user.ap_id]
	end

	test "it works for more than 10 users", %{conn: conn} do
	user = insert(:user)

	Enum.each(1..15, fn _ ->
	other_user = insert(:user)
	User.follow(other_user, user)
	end)

	result =
	conn
	+ \|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers")
	\|> json_response(200)

	assert length(result["first"]["orderedItems"]) == 10
	assert result["first"]["totalItems"] == 15
	assert result["totalItems"] == 15

	result =
	conn
	+ \|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers?page=2")
	\|> json_response(200)

	assert length(result["orderedItems"]) == 5
	assert result["totalItems"] == 15
	end
	+
	+ test "returns 403 if requester is not logged in", %{conn: conn} do
	+ user = insert(:user)
	+
	+ conn
	+ \|> get("/users/#{user.nickname}/followers")
	+ \|> json_response(403)
	+ end
	end

	describe "/users/:nickname/following" do
	test "it returns the following in a collection", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	+ \|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user_two.ap_id]
	end

	test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
	- user = insert(:user, hide_follows: true)
	- user_two = insert(:user)
	+ user = insert(:user)
	+ user_two = insert(:user, hide_follows: true)
	User.follow(user, user_two)

	result =
	conn
	- \|> get("/users/#{user.nickname}/following")
	+ \|> assign(:user, user)
	+ \|> get("/users/#{user_two.nickname}/following")
	\|> json_response(200)

	assert is_binary(result["first"])
	end

	- test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is not authenticated",
	+ test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
	%{conn: conn} do
	- user = insert(:user, hide_follows: true)
	+ user = insert(:user)
	+ user_two = insert(:user, hide_follows: true)

	result =
	conn
	- \|> get("/users/#{user.nickname}/following?page=1")
	+ \|> assign(:user, user)
	+ \|> get("/users/#{user_two.nickname}/following?page=1")

	assert result.status == 403
	assert result.resp_body == ""
	end

	test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
	%{conn: conn} do
	user = insert(:user, hide_follows: true)
	other_user = insert(:user)
	{:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following?page=1")
	\|> json_response(200)

	assert result["totalItems"] == 1
	assert result["orderedItems"] == [other_user.ap_id]
	end

	test "it works for more than 10 users", %{conn: conn} do
	user = insert(:user)

	Enum.each(1..15, fn _ ->
	user = User.get_cached_by_id(user.id)
	other_user = insert(:user)
	User.follow(user, other_user)
	end)

	result =
	conn
	+ \|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	assert length(result["first"]["orderedItems"]) == 10
	assert result["first"]["totalItems"] == 15
	assert result["totalItems"] == 15

	result =
	conn
	+ \|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following?page=2")
	\|> json_response(200)

	assert length(result["orderedItems"]) == 5
	assert result["totalItems"] == 15
	end
	+
	+ test "returns 403 if requester is not logged in", %{conn: conn} do
	+ user = insert(:user)
	+
	+ conn
	+ \|> get("/users/#{user.nickname}/following")
	+ \|> json_response(403)
	+ end
	end

	describe "delivery tracking" do
	test "it tracks a signed object fetch", %{conn: conn} do
	user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity)

	object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(object_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	end

	test "it tracks a signed activity fetch", %{conn: conn} do
	user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity)

	activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(activity_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	end

	test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
	user = insert(:user, local: false)
	other_user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity)

	object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(object_path)
	\|> json_response(200)

	build_conn()
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, other_user)
	\|> get(object_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	assert Delivery.get(object.id, other_user.id)
	end

	test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
	user = insert(:user, local: false)
	other_user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity)

	activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(activity_path)
	\|> json_response(200)

	build_conn()
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, other_user)
	\|> get(activity_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	assert Delivery.get(object.id, other_user.id)
	end
	end

	describe "Additional ActivityPub C2S endpoints" do
	- test "/api/ap/whoami", %{conn: conn} do
	+ test "GET /api/ap/whoami", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/ap/whoami")

	user = User.get_cached_by_id(user.id)

	assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)
	+
	+ conn
	+ \|> get("/api/ap/whoami")
	+ \|> json_response(403)
	end

	clear_config([:media_proxy])
	clear_config([Pleroma.Upload])

	- test "uploadMedia", %{conn: conn} do
	+ test "POST /api/ap/upload_media", %{conn: conn} do
	user = insert(:user)

	desc = "Description of the image"

	image = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/ap/upload_media", %{"file" => image, "description" => desc})

	assert object = json_response(conn, :created)
	assert object["name"] == desc
	assert object["type"] == "Document"
	assert object["actor"] == user.ap_id
	- end
	- end
	-
	- describe "when instance is not federating," do
	- clear_config([:instance, :federating]) do
	- Pleroma.Config.put([:instance, :federating], false)
	- end
	-
	- test "returns 404 for GET routes", %{conn: conn} do
	- user = insert(:user)
	- conn = put_req_header(conn, "accept", "application/json")
	-
	- get_uris = [
	- "/users/#{user.nickname}",
	- "/internal/fetch",
	- "/relay",
	- "/relay/following",
	- "/relay/followers"
	- ]
	-
	- for get_uri <- get_uris do
	- conn
	- \|> get(get_uri)
	- \|> json_response(404)

	- conn
	- \|> assign(:user, user)
	- \|> get(get_uri)
	- \|> json_response(404)
	- end
	- end
	-
	- test "returns 404 for activity-related POST routes", %{conn: conn} do
	- user = insert(:user)
	-
	- conn =
	- conn
	- \|> assign(:valid_signature, true)
	- \|> put_req_header("content-type", "application/activity+json")
	-
	- post_activity_data =
	- "test/fixtures/mastodon-post-activity.json"
	- \|> File.read!()
	- \|> Poison.decode!()
	-
	- post_activity_uris = [
	- "/inbox",
	- "/relay/inbox",
	- "/users/#{user.nickname}/inbox"
	- ]
	-
	- for post_activity_uri <- post_activity_uris do
	- conn
	- \|> post(post_activity_uri, post_activity_data)
	- \|> json_response(404)
	-
	- conn
	- \|> assign(:user, user)
	- \|> post(post_activity_uri, post_activity_data)
	- \|> json_response(404)
	- end
	+ conn
	+ \|> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
	+ \|> json_response(403)
	end
	end
	end
	diff --git a/test/web/feed/user_controller_test.exs b/test/web/feed/user_controller_test.exs
	index 00712ab5a..00c50f003 100644
	--- a/test/web/feed/user_controller_test.exs
	+++ b/test/web/feed/user_controller_test.exs
	@@ -1,288 +1,137 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Feed.UserControllerTest do
	use Pleroma.Web.ConnCase

	import Pleroma.Factory
	import SweetXml

	alias Pleroma.Config
	alias Pleroma.Object
	alias Pleroma.User

	- clear_config_all([:instance, :federating]) do
	+ clear_config([:instance, :federating]) do
	Config.put([:instance, :federating], true)
	end

	describe "feed" do
	clear_config([:feed])

	test "gets a feed", %{conn: conn} do
	Config.put(
	[:feed, :post_title],
	%{max_length: 10, omission: "..."}
	)

	activity = insert(:note_activity)

	note =
	insert(:note,
	data: %{
	"content" => "This is :moominmamma: note ",
	"attachment" => [
	%{
	"url" => [
	%{"mediaType" => "image/png", "href" => "https://pleroma.gov/image.png"}
	]
	}
	],
	"inReplyTo" => activity.data["id"]
	}
	)

	note_activity = insert(:note_activity, note: note)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	note2 =
	insert(:note,
	user: user,
	data: %{
	"content" => "42 This is :moominmamma: note ",
	"inReplyTo" => activity.data["id"]
	}
	)

	_note_activity2 = insert(:note_activity, note: note2)
	object = Object.normalize(note_activity)

	resp =
	conn
	\|> put_req_header("content-type", "application/atom+xml")
	\|> get(user_feed_path(conn, :feed, user.nickname))
	\|> response(200)

	activity_titles =
	resp
	\|> SweetXml.parse()
	\|> SweetXml.xpath(~x"//entry/title/text()"l)

	assert activity_titles == ['42 This...', 'This is...']
	assert resp =~ object.data["content"]
	end

	test "returns 404 for a missing feed", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/atom+xml")
	\|> get(user_feed_path(conn, :feed, "nonexisting"))

	assert response(conn, 404)
	end
	end

	+ # Note: see ActivityPubControllerTest for JSON format tests
	describe "feed_redirect" do
	- test "undefined format. it redirects to feed", %{conn: conn} do
	- note_activity = insert(:note_activity)
	- user = User.get_cached_by_ap_id(note_activity.data["actor"])
	-
	- response =
	- conn
	- \|> put_req_header("accept", "application/xml")
	- \|> get("/users/#{user.nickname}")
	- \|> response(302)
	-
	- assert response ==
	- "<html><body>You are being <a href=\"#{Pleroma.Web.base_url()}/users/#{
	- user.nickname
	- }/feed.atom\">redirected</a>.</body></html>"
	- end
	-
	- test "undefined format. it returns error when user not found", %{conn: conn} do
	- response =
	- conn
	- \|> put_req_header("accept", "application/xml")
	- \|> get(user_feed_path(conn, :feed, "jimm"))
	- \|> response(404)
	-
	- assert response == ~S({"error":"Not found"})
	- end
	-
	- test "activity+json format. it redirects on actual feed of user", %{conn: conn} do
	- note_activity = insert(:note_activity)
	- user = User.get_cached_by_ap_id(note_activity.data["actor"])
	-
	- response =
	- conn
	- \|> put_req_header("accept", "application/activity+json")
	- \|> get("/users/#{user.nickname}")
	- \|> json_response(200)
	-
	- assert response["endpoints"] == %{
	- "oauthAuthorizationEndpoint" => "#{Pleroma.Web.base_url()}/oauth/authorize",
	- "oauthRegistrationEndpoint" => "#{Pleroma.Web.base_url()}/api/v1/apps",
	- "oauthTokenEndpoint" => "#{Pleroma.Web.base_url()}/oauth/token",
	- "sharedInbox" => "#{Pleroma.Web.base_url()}/inbox",
	- "uploadMedia" => "#{Pleroma.Web.base_url()}/api/ap/upload_media"
	- }
	-
	- assert response["@context"] == [
	- "https://www.w3.org/ns/activitystreams",
	- "http://localhost:4001/schemas/litepub-0.1.jsonld",
	- %{"@language" => "und"}
	- ]
	-
	- assert Map.take(response, [
	- "followers",
	- "following",
	- "id",
	- "inbox",
	- "manuallyApprovesFollowers",
	- "name",
	- "outbox",
	- "preferredUsername",
	- "summary",
	- "tag",
	- "type",
	- "url"
	- ]) == %{
	- "followers" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}/followers",
	- "following" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}/following",
	- "id" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}",
	- "inbox" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}/inbox",
	- "manuallyApprovesFollowers" => false,
	- "name" => user.name,
	- "outbox" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}/outbox",
	- "preferredUsername" => user.nickname,
	- "summary" => user.bio,
	- "tag" => [],
	- "type" => "Person",
	- "url" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}"
	- }
	- end
	-
	- test "activity+json format. it returns error whe use not found", %{conn: conn} do
	- response =
	- conn
	- \|> put_req_header("accept", "application/activity+json")
	- \|> get("/users/jimm")
	- \|> json_response(404)
	-
	- assert response == "Not found"
	- end
	-
	- test "json format. it redirects on actual feed of user", %{conn: conn} do
	- note_activity = insert(:note_activity)
	- user = User.get_cached_by_ap_id(note_activity.data["actor"])
	-
	- response =
	- conn
	- \|> put_req_header("accept", "application/json")
	- \|> get("/users/#{user.nickname}")
	- \|> json_response(200)
	-
	- assert response["endpoints"] == %{
	- "oauthAuthorizationEndpoint" => "#{Pleroma.Web.base_url()}/oauth/authorize",
	- "oauthRegistrationEndpoint" => "#{Pleroma.Web.base_url()}/api/v1/apps",
	- "oauthTokenEndpoint" => "#{Pleroma.Web.base_url()}/oauth/token",
	- "sharedInbox" => "#{Pleroma.Web.base_url()}/inbox",
	- "uploadMedia" => "#{Pleroma.Web.base_url()}/api/ap/upload_media"
	- }
	-
	- assert response["@context"] == [
	- "https://www.w3.org/ns/activitystreams",
	- "http://localhost:4001/schemas/litepub-0.1.jsonld",
	- %{"@language" => "und"}
	- ]
	-
	- assert Map.take(response, [
	- "followers",
	- "following",
	- "id",
	- "inbox",
	- "manuallyApprovesFollowers",
	- "name",
	- "outbox",
	- "preferredUsername",
	- "summary",
	- "tag",
	- "type",
	- "url"
	- ]) == %{
	- "followers" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}/followers",
	- "following" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}/following",
	- "id" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}",
	- "inbox" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}/inbox",
	- "manuallyApprovesFollowers" => false,
	- "name" => user.name,
	- "outbox" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}/outbox",
	- "preferredUsername" => user.nickname,
	- "summary" => user.bio,
	- "tag" => [],
	- "type" => "Person",
	- "url" => "#{Pleroma.Web.base_url()}/users/#{user.nickname}"
	- }
	- end
	-
	- test "json format. it returns error whe use not found", %{conn: conn} do
	- response =
	- conn
	- \|> put_req_header("accept", "application/json")
	- \|> get("/users/jimm")
	- \|> json_response(404)
	-
	- assert response == "Not found"
	- end
	-
	- test "html format. it redirects on actual feed of user", %{conn: conn} do
	+ test "with html format, it redirects to user feed", %{conn: conn} do
	note_activity = insert(:note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	response =
	conn
	\|> get("/users/#{user.nickname}")
	\|> response(200)

	assert response ==
	Fallback.RedirectController.redirector_with_meta(
	conn,
	%{user: user}
	).resp_body
	end

	- test "html format. it returns error when user not found", %{conn: conn} do
	+ test "with html format, it returns error when user is not found", %{conn: conn} do
	response =
	conn
	\|> get("/users/jimm")
	\|> json_response(404)

	assert response == %{"error" => "Not found"}
	end
	- end

	- describe "feed_redirect (depending on federation enabled state)" do
	- setup %{conn: conn} do
	- user = insert(:user)
	- conn = put_req_header(conn, "accept", "application/json")
	-
	- %{conn: conn, user: user}
	- end
	-
	- clear_config([:instance, :federating])
	+ test "with non-html / non-json format, it redirects to user feed in atom format", %{
	+ conn: conn
	+ } do
	+ note_activity = insert(:note_activity)
	+ user = User.get_cached_by_ap_id(note_activity.data["actor"])

	- test "renders if instance is federating", %{conn: conn, user: user} do
	- Config.put([:instance, :federating], true)
	+ conn =
	+ conn
	+ \|> put_req_header("accept", "application/xml")
	+ \|> get("/users/#{user.nickname}")

	- conn = get(conn, "/users/#{user.nickname}")
	- assert json_response(conn, 200)
	+ assert conn.status == 302
	+ assert redirected_to(conn) == "#{Pleroma.Web.base_url()}/users/#{user.nickname}/feed.atom"
	end

	- test "renders 404 if instance is NOT federating", %{conn: conn, user: user} do
	- Config.put([:instance, :federating], false)
	+ test "with non-html / non-json format, it returns error when user is not found", %{conn: conn} do
	+ response =
	+ conn
	+ \|> put_req_header("accept", "application/xml")
	+ \|> get(user_feed_path(conn, :feed, "jimm"))
	+ \|> response(404)

	- conn = get(conn, "/users/#{user.nickname}")
	- assert json_response(conn, 404)
	+ assert response == ~S({"error":"Not found"})
	end
	end
	end
	diff --git a/test/web/media_proxy/media_proxy_controller_test.exs b/test/web/media_proxy/media_proxy_controller_test.exs
	index f035dfeee..7ac7e4af1 100644
	--- a/test/web/media_proxy/media_proxy_controller_test.exs
	+++ b/test/web/media_proxy/media_proxy_controller_test.exs
	@@ -1,70 +1,69 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MediaProxy.MediaProxyControllerTest do
	use Pleroma.Web.ConnCase
	import Mock
	alias Pleroma.Config

	clear_config(:media_proxy)
	clear_config([Pleroma.Web.Endpoint, :secret_key_base])

	test "it returns 404 when MediaProxy disabled", %{conn: conn} do
	Config.put([:media_proxy, :enabled], false)

	assert %Plug.Conn{
	status: 404,
	resp_body: "Not Found"
	} = get(conn, "/proxy/hhgfh/eeeee")

	assert %Plug.Conn{
	status: 404,
	resp_body: "Not Found"
	} = get(conn, "/proxy/hhgfh/eeee/fff")
	end

	test "it returns 403 when signature invalidated", %{conn: conn} do
	Config.put([:media_proxy, :enabled], true)
	Config.put([Pleroma.Web.Endpoint, :secret_key_base], "00000000000")
	path = URI.parse(Pleroma.Web.MediaProxy.encode_url("https://google.fn")).path
	Config.put([Pleroma.Web.Endpoint, :secret_key_base], "000")

	assert %Plug.Conn{
	status: 403,
	resp_body: "Forbidden"
	} = get(conn, path)

	assert %Plug.Conn{
	status: 403,
	resp_body: "Forbidden"
	} = get(conn, "/proxy/hhgfh/eeee")

	assert %Plug.Conn{
	status: 403,
	resp_body: "Forbidden"
	} = get(conn, "/proxy/hhgfh/eeee/fff")
	end

	test "redirects on valid url when filename invalidated", %{conn: conn} do
	Config.put([:media_proxy, :enabled], true)
	Config.put([Pleroma.Web.Endpoint, :secret_key_base], "00000000000")
	url = Pleroma.Web.MediaProxy.encode_url("https://google.fn/test.png")
	invalid_url = String.replace(url, "test.png", "test-file.png")
	response = get(conn, invalid_url)
	- html = "<html><body>You are being <a href=\"#{url}\">redirected</a>.</body></html>"
	assert response.status == 302
	- assert response.resp_body == html
	+ assert redirected_to(response) == url
	end

	test "it performs ReverseProxy.call when signature valid", %{conn: conn} do
	Config.put([:media_proxy, :enabled], true)
	Config.put([Pleroma.Web.Endpoint, :secret_key_base], "00000000000")
	url = Pleroma.Web.MediaProxy.encode_url("https://google.fn/test.png")

	with_mock Pleroma.ReverseProxy,
	call: fn _conn, _url, _opts -> %Plug.Conn{status: :success} end do
	assert %Plug.Conn{status: :success} = get(conn, url)
	end
	end
	end
	diff --git a/test/web/ostatus/ostatus_controller_test.exs b/test/web/ostatus/ostatus_controller_test.exs
	index 725ab1785..3b84358e4 100644
	--- a/test/web/ostatus/ostatus_controller_test.exs
	+++ b/test/web/ostatus/ostatus_controller_test.exs
	@@ -1,309 +1,295 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OStatus.OStatusControllerTest do
	use Pleroma.Web.ConnCase

	import Pleroma.Factory

	+ alias Pleroma.Config
	alias Pleroma.Object
	alias Pleroma.User
	alias Pleroma.Web.CommonAPI

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	- clear_config_all([:instance, :federating]) do
	- Pleroma.Config.put([:instance, :federating], true)
	+ clear_config([:instance, :federating]) do
	+ Config.put([:instance, :federating], true)
	end

	- describe "GET object/2" do
	+ # Note: see ActivityPubControllerTest for JSON format tests
	+ describe "GET /objects/:uuid (text/html)" do
	+ setup %{conn: conn} do
	+ conn = put_req_header(conn, "accept", "text/html")
	+ %{conn: conn}
	+ end
	+
	test "redirects to /notice/id for html format", %{conn: conn} do
	note_activity = insert(:note_activity)
	object = Object.normalize(note_activity)
	[_, uuid] = hd(Regex.scan(~r/.+\/([\w-]+)$/, object.data["id"]))
	url = "/objects/#{uuid}"

	- conn =
	- conn
	- \|> put_req_header("accept", "text/html")
	- \|> get(url)
	-
	+ conn = get(conn, url)
	assert redirected_to(conn) == "/notice/#{note_activity.id}"
	end

	test "404s on private objects", %{conn: conn} do
	note_activity = insert(:direct_note_activity)
	object = Object.normalize(note_activity)
	[_, uuid] = hd(Regex.scan(~r/.+\/([\w-]+)$/, object.data["id"]))

	conn
	\|> get("/objects/#{uuid}")
	\|> response(404)
	end

	- test "404s on nonexisting objects", %{conn: conn} do
	+ test "404s on non-existing objects", %{conn: conn} do
	conn
	\|> get("/objects/123")
	\|> response(404)
	end
	end

	- describe "GET activity/2" do
	+ # Note: see ActivityPubControllerTest for JSON format tests
	+ describe "GET /activities/:uuid (text/html)" do
	+ setup %{conn: conn} do
	+ conn = put_req_header(conn, "accept", "text/html")
	+ %{conn: conn}
	+ end
	+
	test "redirects to /notice/id for html format", %{conn: conn} do
	note_activity = insert(:note_activity)
	[_, uuid] = hd(Regex.scan(~r/.+\/([\w-]+)$/, note_activity.data["id"]))

	- conn =
	- conn
	- \|> put_req_header("accept", "text/html")
	- \|> get("/activities/#{uuid}")
	-
	+ conn = get(conn, "/activities/#{uuid}")
	assert redirected_to(conn) == "/notice/#{note_activity.id}"
	end

	test "404s on private activities", %{conn: conn} do
	note_activity = insert(:direct_note_activity)
	[_, uuid] = hd(Regex.scan(~r/.+\/([\w-]+)$/, note_activity.data["id"]))

	conn
	\|> get("/activities/#{uuid}")
	\|> response(404)
	end

	test "404s on nonexistent activities", %{conn: conn} do
	conn
	\|> get("/activities/123")
	\|> response(404)
	end
	-
	- test "gets an activity in AS2 format", %{conn: conn} do
	- note_activity = insert(:note_activity)
	- [_, uuid] = hd(Regex.scan(~r/.+\/([\w-]+)$/, note_activity.data["id"]))
	- url = "/activities/#{uuid}"
	-
	- conn =
	- conn
	- \|> put_req_header("accept", "application/activity+json")
	- \|> get(url)
	-
	- assert json_response(conn, 200)
	- end
	end

	describe "GET notice/2" do
	test "redirects to a proper object URL when json requested and the object is local", %{
	conn: conn
	} do
	note_activity = insert(:note_activity)
	expected_redirect_url = Object.normalize(note_activity).data["id"]

	redirect_url =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/notice/#{note_activity.id}")
	\|> redirected_to()

	assert redirect_url == expected_redirect_url
	end

	test "returns a 404 on remote notice when json requested", %{conn: conn} do
	note_activity = insert(:note_activity, local: false)

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/notice/#{note_activity.id}")
	\|> response(404)
	end

	test "500s when actor not found", %{conn: conn} do
	note_activity = insert(:note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])
	User.invalidate_cache(user)
	Pleroma.Repo.delete(user)

	conn =
	conn
	\|> get("/notice/#{note_activity.id}")

	assert response(conn, 500) == ~S({"error":"Something went wrong"})
	end

	test "render html for redirect for html format", %{conn: conn} do
	note_activity = insert(:note_activity)

	resp =
	conn
	\|> put_req_header("accept", "text/html")
	\|> get("/notice/#{note_activity.id}")
	\|> response(200)

	assert resp =~
	"<meta content=\"#{Pleroma.Web.base_url()}/notice/#{note_activity.id}\" property=\"og:url\">"

	user = insert(:user)

	{:ok, like_activity, _} = CommonAPI.favorite(note_activity.id, user)

	assert like_activity.data["type"] == "Like"

	resp =
	conn
	\|> put_req_header("accept", "text/html")
	\|> get("/notice/#{like_activity.id}")
	\|> response(200)

	assert resp =~ "<!--server-generated-meta-->"
	end

	test "404s a private notice", %{conn: conn} do
	note_activity = insert(:direct_note_activity)
	url = "/notice/#{note_activity.id}"

	conn =
	conn
	\|> get(url)

	assert response(conn, 404)
	end

	- test "404s a nonexisting notice", %{conn: conn} do
	+ test "404s a non-existing notice", %{conn: conn} do
	url = "/notice/123"

	conn =
	conn
	\|> get(url)

	assert response(conn, 404)
	end
	+
	+ test "it requires authentication if instance is NOT federating", %{
	+ conn: conn
	+ } do
	+ user = insert(:user)
	+ note_activity = insert(:note_activity)
	+
	+ conn = put_req_header(conn, "accept", "text/html")
	+
	+ ensure_federating_or_authenticated(conn, "/notice/#{note_activity.id}", user)
	+ end
	end

	describe "GET /notice/:id/embed_player" do
	- test "render embed player", %{conn: conn} do
	+ setup do
	note_activity = insert(:note_activity)
	object = Pleroma.Object.normalize(note_activity)

	object_data =
	Map.put(object.data, "attachment", [
	%{
	"url" => [
	%{
	"href" =>
	"https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4",
	"mediaType" => "video/mp4",
	"type" => "Link"
	}
	]
	}
	])

	object
	\|> Ecto.Changeset.change(data: object_data)
	\|> Pleroma.Repo.update()

	- conn =
	- conn
	- \|> get("/notice/#{note_activity.id}/embed_player")
	+ %{note_activity: note_activity}
	+ end
	+
	+ test "renders embed player", %{conn: conn, note_activity: note_activity} do
	+ conn = get(conn, "/notice/#{note_activity.id}/embed_player")

	assert Plug.Conn.get_resp_header(conn, "x-frame-options") == ["ALLOW"]

	assert Plug.Conn.get_resp_header(
	conn,
	"content-security-policy"
	) == [
	"default-src 'none';style-src 'self' 'unsafe-inline';img-src 'self' data: https:; media-src 'self' https:;"
	]

	assert response(conn, 200) =~
	"<video controls loop><source src=\"https://peertube.moe/static/webseed/df5f464b-be8d-46fb-ad81-2d4c2d1630e3-480.mp4\" type=\"video/mp4\">Your browser does not support video/mp4 playback.</video>"
	end

	test "404s when activity isn't create", %{conn: conn} do
	note_activity = insert(:note_activity, data_attrs: %{"type" => "Like"})

	assert conn
	\|> get("/notice/#{note_activity.id}/embed_player")
	\|> response(404)
	end

	test "404s when activity is direct message", %{conn: conn} do
	note_activity = insert(:note_activity, data_attrs: %{"directMessage" => true})

	assert conn
	\|> get("/notice/#{note_activity.id}/embed_player")
	\|> response(404)
	end

	test "404s when attachment is empty", %{conn: conn} do
	note_activity = insert(:note_activity)
	object = Pleroma.Object.normalize(note_activity)
	object_data = Map.put(object.data, "attachment", [])

	object
	\|> Ecto.Changeset.change(data: object_data)
	\|> Pleroma.Repo.update()

	assert conn
	\|> get("/notice/#{note_activity.id}/embed_player")
	\|> response(404)
	end

	test "404s when attachment isn't audio or video", %{conn: conn} do
	note_activity = insert(:note_activity)
	object = Pleroma.Object.normalize(note_activity)

	object_data =
	Map.put(object.data, "attachment", [
	%{
	"url" => [
	%{
	"href" => "https://peertube.moe/static/webseed/480.jpg",
	"mediaType" => "image/jpg",
	"type" => "Link"
	}
	]
	}
	])

	object
	\|> Ecto.Changeset.change(data: object_data)
	\|> Pleroma.Repo.update()

	- assert conn
	- \|> get("/notice/#{note_activity.id}/embed_player")
	- \|> response(404)
	- end
	- end
	-
	- describe "when instance is not federating," do
	- clear_config([:instance, :federating]) do
	- Pleroma.Config.put([:instance, :federating], false)
	+ conn
	+ \|> get("/notice/#{note_activity.id}/embed_player")
	+ \|> response(404)
	end

	- test "returns 404 for GET routes", %{conn: conn} do
	- conn = put_req_header(conn, "accept", "application/json")
	-
	- note_activity = insert(:note_activity, local: true)
	- [_, activity_uuid] = hd(Regex.scan(~r/.+\/([\w-]+)$/, note_activity.data["id"]))
	-
	- object = Object.normalize(note_activity)
	- [_, object_uuid] = hd(Regex.scan(~r/.+\/([\w-]+)$/, object.data["id"]))
	-
	- get_uris = [
	- "/activities/#{activity_uuid}",
	- "/objects/#{object_uuid}",
	- "/notice/#{note_activity.id}",
	- "/notice/#{note_activity.id}/embed_player"
	- ]
	+ test "it requires authentication if instance is NOT federating", %{
	+ conn: conn,
	+ note_activity: note_activity
	+ } do
	+ user = insert(:user)
	+ conn = put_req_header(conn, "accept", "text/html")

	- for get_uri <- get_uris do
	- conn
	- \|> get(get_uri)
	- \|> json_response(404)
	- end
	+ ensure_federating_or_authenticated(conn, "/notice/#{note_activity.id}/embed_player", user)
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Fri, Oct 9, 5:22 AM (1 d, 9 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1784464
Default Alt Text: (125 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions