No OneTemporary
Actions

Authored By

Unknown

Size

542 KB

Referenced Files

None

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/changelog.d/ap-c2s-interaction-perms.fix b/changelog.d/ap-c2s-interaction-perms.fix
	new file mode 100644
	index 000000000..18caf9b2f
	--- /dev/null
	+++ b/changelog.d/ap-c2s-interaction-perms.fix
	@@ -0,0 +1 @@
	+AP C2S: Reject interactions with statuses not visible to Actor
	diff --git a/changelog.d/mastoapi-interaction-perms.fix b/changelog.d/mastoapi-interaction-perms.fix
	new file mode 100644
	index 000000000..857d59400
	--- /dev/null
	+++ b/changelog.d/mastoapi-interaction-perms.fix
	@@ -0,0 +1 @@
	+MastodonAPI: Reject interactions with statuses not visible to user
	diff --git a/changelog.d/view-internals-leaks.fix b/changelog.d/view-internals-leaks.fix
	new file mode 100644
	index 000000000..a1a09afe1
	--- /dev/null
	+++ b/changelog.d/view-internals-leaks.fix
	@@ -0,0 +1 @@
	+ObjectView: Do not leak unsanitized internal representation of non-Create/non-Undo Activities on fetches
	diff --git a/lib/pleroma/constants.ex b/lib/pleroma/constants.ex
	index f02607273..c0411edbf 100644
	--- a/lib/pleroma/constants.ex
	+++ b/lib/pleroma/constants.ex
	@@ -1,158 +1,159 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Constants do
	use Const

	const(as_public, do: "https://www.w3.org/ns/activitystreams#Public")

	const(object_internal_fields,
	do: [
	"reactions",
	"reaction_count",
	"likes",
	"like_count",
	"announcements",
	"announcement_count",
	"emoji",
	"context_id",
	"deleted_activity_id",
	"pleroma_internal",
	"generator",
	"rules",
	- "language"
	+ "language",
	+ "voters"
	]
	)

	const(static_only_files,
	do:
	~w(index.html robots.txt static static-fe finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc embed.js embed.css)
	)

	const(status_updatable_fields,
	do: [
	"source",
	"tag",
	"updated",
	"emoji",
	"content",
	"contentMap",
	"summary",
	"sensitive",
	"attachment",
	"generator",
	"language"
	]
	)

	const(status_object_types,
	do: [
	"Note",
	"Question",
	"Audio",
	"Video",
	"Event",
	"Article",
	"Page"
	]
	)

	const(updatable_object_types,
	do: [
	"Note",
	"Question",
	"Audio",
	"Video",
	"Event",
	"Article",
	"Page"
	]
	)

	const(actor_types,
	do: [
	"Application",
	"Group",
	"Organization",
	"Person",
	"Service"
	]
	)

	const(allowed_user_actor_types,
	do: [
	"Person",
	"Service",
	"Group"
	]
	)

	const(activity_types,
	do: [
	"Block",
	"Create",
	"Update",
	"Delete",
	"Follow",
	"Accept",
	"Reject",
	"Add",
	"Remove",
	"Like",
	"Dislike",
	"Announce",
	"Undo",
	"Flag",
	"EmojiReact",
	"Listen"
	]
	)

	const(allowed_activity_types_from_strangers,
	do: [
	"Block",
	"Create",
	"Flag",
	"Follow",
	"Like",
	"Dislike",
	"EmojiReact",
	"Announce"
	]
	)

	const(object_types,
	do: ~w[Event Question Answer Audio Video Image Article Note Page ChatMessage]
	)

	# basic regex, just there to weed out potential mistakes
	# https://datatracker.ietf.org/doc/html/rfc2045#section-5.1
	const(mime_regex,
	do: ~r/^[^[:cntrl:] ()<>@,;:\\"\/\[\]?=]+\/[^[:cntrl:] ()<>@,;:\\"\/\[\]?=]+(; .*)?$/
	)

	# List of allowed chars in the path segment of a URI
	# unreserved, sub-delims, ":", "@" and "/" allowed as the separator in path
	# https://datatracker.ietf.org/doc/html/rfc3986
	const(uri_path_allowed_reserved_chars,
	do: ~c"!$&'()*+,;=/:@"
	)

	const(upload_object_types, do: ["Document", "Image"])

	const(activity_json_canonical_mime_type,
	do: "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)

	const(activity_json_mime_types,
	do: [
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"",
	"application/activity+json"
	]
	)

	const(public_streams,
	do: ["public", "public:local", "public:media", "public:local:media"]
	)
	end
	diff --git a/lib/pleroma/object.ex b/lib/pleroma/object.ex
	index 77dfda851..20e5bfb5c 100644
	--- a/lib/pleroma/object.ex
	+++ b/lib/pleroma/object.ex
	@@ -1,486 +1,483 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Object do
	use Ecto.Schema

	import Ecto.Query
	import Ecto.Changeset

	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Hashtag
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	alias Pleroma.ObjectTombstone
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Workers.AttachmentsCleanupWorker

	require Logger

	@type t() :: %__MODULE__{}

	@derive {Jason.Encoder, only: [:data]}

	@cachex Pleroma.Config.get([:cachex, :provider], Cachex)

	schema "objects" do
	field(:data, :map)

	many_to_many(:hashtags, Hashtag, join_through: "hashtags_objects", on_replace: :delete)

	timestamps()
	end

	def with_joined_activity(query, activity_type \\ "Create", join_type \\ :inner) do
	object_position = Map.get(query.aliases, :object, 0)

	join(query, join_type, [{object, object_position}], a in Activity,
	on:
	fragment(
	"associated_object_id(?) = (? ->> 'id') AND (?->>'type' = ?) ",
	a.data,
	object.data,
	a.data,
	^activity_type
	),
	as: :object_activity
	)
	end

	def create(data) do
	%Object{}
	\|> Object.change(%{data: data})
	\|> Repo.insert()
	end

	def change(struct, params \\ %{}) do
	struct
	\|> cast(params, [:data])
	\|> validate_required([:data])
	\|> unique_constraint(:ap_id, name: :objects_unique_apid_index)
	# Expecting `maybe_handle_hashtags_change/1` to run last:
	\|> maybe_handle_hashtags_change(struct)
	end

	# Note: not checking activity type (assuming non-legacy objects are associated with Create act.)
	defp maybe_handle_hashtags_change(changeset, struct) do
	with %Ecto.Changeset{valid?: true} <- changeset,
	data_hashtags_change = get_change(changeset, :data),
	{_, true} <- {:changed, hashtags_changed?(struct, data_hashtags_change)},
	{:ok, hashtag_records} <-
	data_hashtags_change
	\|> object_data_hashtags()
	\|> Hashtag.get_or_create_by_names() do
	put_assoc(changeset, :hashtags, hashtag_records)
	else
	%{valid?: false} ->
	changeset

	{:changed, false} ->
	changeset

	{:error, _} ->
	validate_change(changeset, :data, fn _, _ ->
	[data: "error referencing hashtags"]
	end)
	end
	end

	defp hashtags_changed?(%Object{} = struct, %{"tag" => _} = data) do
	Enum.sort(embedded_hashtags(struct)) !=
	Enum.sort(object_data_hashtags(data))
	end

	defp hashtags_changed?(_, _), do: false

	def get_by_id(nil), do: nil
	def get_by_id(id), do: Repo.get(Object, id)

	def get_by_ap_id(nil), do: nil

	def get_by_ap_id(ap_id) do
	Repo.one(from(object in Object, where: fragment("(?)->>'id' = ?", object.data, ^ap_id)))
	end

	@doc """
	Get a single attachment by it's name and href
	"""
	@spec get_attachment_by_name_and_href(String.t(), String.t()) :: Object.t() \| nil
	def get_attachment_by_name_and_href(name, href) do
	query =
	from(o in Object,
	where: fragment("(?)->>'name' = ?", o.data, ^name),
	where: fragment("(?)->>'href' = ?", o.data, ^href)
	)

	Repo.one(query)
	end

	defp warn_on_no_object_preloaded(ap_id) do
	"Object.normalize() called without preloaded object (#{inspect(ap_id)}). Consider preloading the object"
	\|> Logger.debug()

	Logger.debug("Backtrace: #{inspect(Process.info(:erlang.self(), :current_stacktrace))}")
	end

	- def normalize(_, options \\ [fetch: false, id_only: false])
	+ def normalize(_, options \\ [fetch: false])

	# If we pass an Activity to Object.normalize(), we can try to use the preloaded object.
	# Use this whenever possible, especially when walking graphs in an O(N) loop!
	def normalize(%Object{} = object, _), do: object
	def normalize(%Activity{object: %Object{} = object}, _), do: object

	# A hack for fake activities
	def normalize(%Activity{data: %{"object" => %{"fake" => true} = data}}, _) do
	%Object{id: "pleroma:fake_object_id", data: data}
	end

	# No preloaded object
	def normalize(%Activity{data: %{"object" => %{"id" => ap_id}}}, options) do
	warn_on_no_object_preloaded(ap_id)
	normalize(ap_id, options)
	end

	# No preloaded object
	def normalize(%Activity{data: %{"object" => ap_id}}, options) do
	warn_on_no_object_preloaded(ap_id)
	normalize(ap_id, options)
	end

	# Old way, try fetching the object through cache.
	def normalize(%{"id" => ap_id}, options), do: normalize(ap_id, options)

	def normalize(ap_id, options) when is_binary(ap_id) do
	cond do
	- Keyword.get(options, :id_only) ->
	- ap_id
	-
	Keyword.get(options, :fetch) ->
	case Fetcher.fetch_object_from_id(ap_id, options) do
	{:ok, object} -> object
	_ -> nil
	end

	true ->
	get_cached_by_ap_id(ap_id)
	end
	end

	def normalize(_, _), do: nil

	# Owned objects can only be accessed by their owner
	def authorize_access(%Object{data: %{"actor" => actor}}, %User{ap_id: ap_id}) do
	if actor == ap_id do
	:ok
	else
	{:error, :forbidden}
	end
	end

	# Legacy objects can be accessed by anybody
	def authorize_access(%Object{}, %User{}), do: :ok

	@spec get_cached_by_ap_id(String.t()) :: Object.t() \| nil
	def get_cached_by_ap_id(ap_id) do
	key = "object:#{ap_id}"

	with {:ok, nil} <- @cachex.get(:object_cache, key),
	object when not is_nil(object) <- get_by_ap_id(ap_id),
	{:ok, true} <- @cachex.put(:object_cache, key, object) do
	object
	else
	{:ok, object} -> object
	nil -> nil
	end
	end

	def make_tombstone(%Object{data: %{"id" => id, "type" => type}}, deleted \\ DateTime.utc_now()) do
	%ObjectTombstone{
	id: id,
	formerType: type,
	deleted: deleted
	}
	\|> Map.from_struct()
	end

	def swap_object_with_tombstone(object) do
	tombstone = make_tombstone(object)

	with {:ok, object} <-
	object
	\|> Object.change(%{data: tombstone})
	\|> Repo.update() do
	Hashtag.unlink(object)
	{:ok, object}
	end
	end

	def delete(%Object{data: %{"id" => id}} = object) do
	with {:ok, _obj} = swap_object_with_tombstone(object),
	deleted_activity = Activity.delete_all_by_object_ap_id(id),
	{:ok, _} <- invalid_object_cache(object) do
	cleanup_attachments(
	Config.get([:instance, :cleanup_attachments]),
	object
	)

	{:ok, object, deleted_activity}
	end
	end

	@spec cleanup_attachments(boolean(), Object.t()) ::
	{:ok, Oban.Job.t() \| nil}
	def cleanup_attachments(true, %Object{} = object) do
	AttachmentsCleanupWorker.new(%{"op" => "cleanup_attachments", "object" => object})
	\|> Oban.insert()
	end

	def cleanup_attachments(_, _), do: {:ok, nil}

	def prune(%Object{data: %{"id" => _id}} = object) do
	with {:ok, object} <- Repo.delete(object),
	{:ok, _} <- invalid_object_cache(object) do
	{:ok, object}
	end
	end

	def invalid_object_cache(%Object{data: %{"id" => id}}) do
	with {:ok, true} <- @cachex.del(:object_cache, "object:#{id}") do
	@cachex.del(:web_resp_cache, URI.parse(id).path)
	end
	end

	def set_cache(%Object{data: %{"id" => ap_id}} = object) do
	@cachex.put(:object_cache, "object:#{ap_id}", object)
	{:ok, object}
	end

	def update_and_set_cache(changeset) do
	with {:ok, object} <- Repo.update(changeset) do
	set_cache(object)
	end
	end

	def increase_replies_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{repliesCount}',
	(coalesce((?->>'repliesCount')::int, 0) + 1)::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	defp poll_is_multiple?(%Object{data: %{"anyOf" => [_ \| _]}}), do: true

	defp poll_is_multiple?(_), do: false

	def decrease_replies_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{repliesCount}',
	(greatest(0, (?->>'repliesCount')::int - 1))::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	def increase_quotes_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{quotesCount}',
	(coalesce((?->>'quotesCount')::int, 0) + 1)::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	def decrease_quotes_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{quotesCount}',
	(greatest(0, (?->>'quotesCount')::int - 1))::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	def increase_vote_count(ap_id, name, actor) do
	with %Object{} = object <- Object.normalize(ap_id, fetch: false),
	"Question" <- object.data["type"] do
	key = if poll_is_multiple?(object), do: "anyOf", else: "oneOf"

	options =
	object.data[key]
	\|> Enum.map(fn
	%{"name" => ^name} = option ->
	Kernel.update_in(option["replies"]["totalItems"], &(&1 + 1))

	option ->
	option
	end)

	voters = [actor \| object.data["voters"] \|\| []] \|> Enum.uniq()

	data =
	object.data
	\|> Map.put(key, options)
	\|> Map.put("voters", voters)

	object
	\|> Object.change(%{data: data})
	\|> update_and_set_cache()
	else
	_ -> :noop
	end
	end

	@doc "Updates data field of an object"
	def update_data(%Object{data: data} = object, attrs \\ %{}) do
	object
	\|> Object.change(%{data: Map.merge(data \|\| %{}, attrs)})
	\|> Repo.update()
	end

	def local?(%Object{data: %{"id" => id}}) do
	String.starts_with?(id, Pleroma.Web.Endpoint.url() <> "/")
	end

	def replies(object, opts \\ []) do
	object = Object.normalize(object, fetch: false)

	query =
	Object
	\|> where(
	[o],
	fragment("(?)->>'inReplyTo' = ?", o.data, ^object.data["id"])
	)
	\|> order_by([o], asc: o.id)

	if opts[:self_only] do
	actor = object.data["actor"]
	where(query, [o], fragment("(?)->>'actor' = ?", o.data, ^actor))
	else
	query
	end
	end

	def self_replies(object, opts \\ []),
	do: replies(object, Keyword.put(opts, :self_only, true))

	def tags(%Object{data: %{"tag" => tags}}) when is_list(tags), do: tags

	def tags(_), do: []

	def hashtags(%Object{} = object) do
	# Note: always using embedded hashtags regardless whether they are migrated to hashtags table
	# (embedded hashtags stay in sync anyways, and we avoid extra joins and preload hassle)
	embedded_hashtags(object)
	end

	def embedded_hashtags(%Object{data: data}) do
	object_data_hashtags(data)
	end

	def embedded_hashtags(_), do: []

	def object_data_hashtags(%{"tag" => tags}) when is_list(tags) do
	tags
	\|> Enum.filter(fn
	%{"type" => "Hashtag"} = data -> Map.has_key?(data, "name")
	plain_text when is_bitstring(plain_text) -> true
	_ -> false
	end)
	\|> Enum.map(fn
	%{"name" => "#" <> hashtag} -> String.downcase(hashtag)
	%{"name" => hashtag} -> String.downcase(hashtag)
	hashtag when is_bitstring(hashtag) -> String.downcase(hashtag)
	end)
	\|> Enum.uniq()
	# Note: "" elements (plain text) might occur in `data.tag` for incoming objects
	\|> Enum.filter(&(&1 not in [nil, ""]))
	end

	def object_data_hashtags(_), do: []

	def get_emoji_reactions(object) do
	reactions = object.data["reactions"]

	if is_list(reactions) or is_map(reactions) do
	reactions
	\|> Enum.map(fn
	[_emoji, users, _maybe_url] = item when is_list(users) ->
	item

	[emoji, users] when is_list(users) ->
	[emoji, users, nil]

	# This case is here to process the Map situation, which will happen
	# only with the legacy two-value format.
	{emoji, users} when is_list(users) ->
	[emoji, users, nil]

	_ ->
	nil
	end)
	\|> Enum.reject(&is_nil/1)
	else
	[]
	end
	end
	end
	diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	index daf0d38e6..df5fcf9f6 100644
	--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	@@ -1,575 +1,613 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubController do
	use Pleroma.Web, :controller

	alias Pleroma.Activity
	alias Pleroma.Delivery
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.InternalFetchActor
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.ControllerHelper
	alias Pleroma.Web.Endpoint
	alias Pleroma.Web.Federator
	alias Pleroma.Web.Plugs.EnsureAuthenticatedPlug
	alias Pleroma.Web.Plugs.FederatingPlug

	require Logger

	action_fallback(:errors)

	@federating_only_actions [:internal_fetch, :relay, :relay_following, :relay_followers]

	plug(FederatingPlug when action in @federating_only_actions)

	plug(
	EnsureAuthenticatedPlug,
	[unless_func: &FederatingPlug.federating?/1] when action not in @federating_only_actions
	)

	# Note: :following and :followers must be served even without authentication (as via :api)
	plug(
	EnsureAuthenticatedPlug
	when action in [:read_inbox, :update_outbox, :whoami, :upload_media]
	)

	plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:upload_media])

	plug(
	Pleroma.Web.Plugs.Cache,
	[query_params: false, tracking_fun: &__MODULE__.track_object_fetch/2]
	when action in [:activity, :object]
	)

	plug(:log_inbox_metadata when action in [:inbox])
	plug(:relay_active? when action in [:relay])

	defp relay_active?(conn, _) do
	if Pleroma.Config.get([:instance, :allow_relay]) do
	conn
	else
	conn
	\|> render_error(:not_found, "not found")
	\|> halt()
	end
	end

	def user(conn, %{"nickname" => nickname}) do
	with %User{local: true} = user <- User.get_cached_by_nickname(nickname) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	else
	nil -> {:error, :not_found}
	%{local: false} -> {:error, :not_found}
	end
	end

	def object(%{assigns: assigns} = conn, _) do
	with ap_id <- Endpoint.url() <> conn.request_path,
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	user <- Map.get(assigns, :user, nil),
	{_, true} <- {:visible?, Visibility.visible_for_user?(object, user)} do
	conn
	\|> maybe_skip_cache(user)
	\|> assign(:tracking_fun_data, object.id)
	\|> set_cache_ttl_for(object)
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(ObjectView)
	\|> render("object.json", object: object)
	else
	{:visible?, false} -> {:error, :not_found}
	nil -> {:error, :not_found}
	end
	end

	def track_object_fetch(conn, nil), do: conn

	def track_object_fetch(conn, object_id) do
	with %{assigns: %{user: %User{id: user_id}}} <- conn do
	Delivery.create(object_id, user_id)
	end

	conn
	end

	def activity(%{assigns: assigns} = conn, _) do
	with ap_id <- Endpoint.url() <> conn.request_path,
	%Activity{} = activity <- Activity.normalize(ap_id),
	{_, true} <- {:local?, activity.local},
	user <- Map.get(assigns, :user, nil),
	{_, true} <- {:visible?, Visibility.visible_for_user?(activity, user)} do
	conn
	\|> maybe_skip_cache(user)
	\|> maybe_set_tracking_data(activity)
	\|> set_cache_ttl_for(activity)
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(ObjectView)
	\|> render("object.json", object: activity)
	else
	{:visible?, false} -> {:error, :not_found}
	{:local?, false} -> {:error, :not_found}
	nil -> {:error, :not_found}
	end
	end

	defp maybe_set_tracking_data(conn, %Activity{data: %{"type" => "Create"}} = activity) do
	object_id = Object.normalize(activity, fetch: false).id
	assign(conn, :tracking_fun_data, object_id)
	end

	defp maybe_set_tracking_data(conn, _activity), do: conn

	defp set_cache_ttl_for(conn, %Activity{object: object}) do
	set_cache_ttl_for(conn, object)
	end

	defp set_cache_ttl_for(conn, entity) do
	ttl =
	case entity do
	%Object{data: %{"type" => "Question"}} ->
	Pleroma.Config.get([:web_cache_ttl, :activity_pub_question])

	%Object{} ->
	Pleroma.Config.get([:web_cache_ttl, :activity_pub])

	_ ->
	nil
	end

	assign(conn, :cache_ttl, ttl)
	end

	def maybe_skip_cache(conn, user) do
	if user do
	conn
	\|> assign(:skip_cache, true)
	else
	conn
	end
	end

	# GET /relay/following
	def relay_following(conn, _params) do
	with %{halted: false} = conn <- FederatingPlug.call(conn, []) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: Relay.get_actor()})
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:show_follows, true} <-
	{:show_follows, (for_user && for_user == user) \|\| !user.hide_follows} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: user, page: page, for: for_user})
	else
	{:show_follows, _} ->
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> send_resp(403, "")
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("following.json", %{user: user, for: for_user})
	end
	end

	# GET /relay/followers
	def relay_followers(conn, _params) do
	with %{halted: false} = conn <- FederatingPlug.call(conn, []) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: Relay.get_actor()})
	end
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:show_followers, true} <-
	{:show_followers, (for_user && for_user == user) \|\| !user.hide_followers} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: user, page: page, for: for_user})
	else
	{:show_followers, _} ->
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> send_resp(403, "")
	end
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("followers.json", %{user: user, for: for_user})
	end
	end

	def outbox(
	%{assigns: %{user: for_user}} = conn,
	%{"nickname" => nickname, "page" => page?} = params
	)
	when page? in [true, "true"] do
	with %User{} = user <- User.get_cached_by_nickname(nickname) do
	# "include_poll_votes" is a hack because postgres generates inefficient
	# queries when filtering by 'Answer', poll votes will be hidden by the
	# visibility filter in this case anyway
	params =
	params
	\|> Map.drop(["nickname", "page"])
	\|> Map.put("include_poll_votes", true)
	\|> Map.new(fn {k, v} -> {String.to_existing_atom(k), v} end)

	activities = ActivityPub.fetch_user_activities(user, for_user, params)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection_page.json", %{
	activities: activities,
	pagination: ControllerHelper.get_pagination_fields(conn, activities),
	iri: "#{user.ap_id}/outbox"
	})
	end
	end

	def outbox(conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection.json", %{iri: "#{user.ap_id}/outbox"})
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, %{"nickname" => nickname} = params) do
	with {:recipient_exists, %User{} = recipient} <-
	{:recipient_exists, User.get_cached_by_nickname(nickname)},
	{:sender_exists, {:ok, %User{} = actor}} <-
	{:sender_exists, User.get_or_fetch_by_ap_id(params["actor"])},
	{:recipient_active, true} <- {:recipient_active, recipient.is_active},
	{:sender_active, true} <- {:sender_active, actor.is_active},
	true <- Utils.recipient_in_message(recipient, actor, params),
	params <- Utils.maybe_splice_recipient(recipient.ap_id, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	else
	{:recipient_exists, _} ->
	conn
	\|> put_status(:not_found)
	\|> json("User does not exist")

	{:sender_exists, _} ->
	conn
	\|> put_status(:not_found)
	\|> json("Sender does not exist")

	{:recipient_active, _} ->
	conn
	\|> put_status(:not_found)
	\|> json("User deactivated")

	{:sender_active, _} ->
	conn
	\|> put_status(:not_found)
	\|> json("Sender deactivated")

	_ ->
	conn
	\|> put_status(:bad_request)
	\|> json("Invalid request.")
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end

	def inbox(%{assigns: %{valid_signature: false}} = conn, params) do
	Federator.incoming_ap_doc(%{
	method: conn.method,
	req_headers: conn.req_headers,
	request_path: conn.request_path,
	params: params,
	query_string: conn.query_string
	})

	json(conn, "ok")
	end

	# POST /relay/inbox -or- POST /internal/fetch/inbox
	def inbox(conn, %{"type" => "Create"} = params) do
	if FederatingPlug.federating?() do
	post_inbox_relayed_create(conn, params)
	else
	conn
	\|> put_status(403)
	\|> json("Not federating")
	end
	end

	def inbox(conn, _params) do
	conn
	\|> put_status(:bad_request)
	\|> json("error, missing HTTP Signature")
	end

	defp post_inbox_relayed_create(conn, params) do
	Logger.debug(
	"Signature missing or not from author, relayed Create message, fetching object from source"
	)

	Fetcher.fetch_object_from_id(params["object"]["id"])

	json(conn, "ok")
	end

	defp represent_service_actor(%User{} = user, conn) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	end

	defp represent_service_actor(nil, _), do: {:error, :not_found}

	def relay(conn, _params) do
	Relay.get_actor()
	\|> represent_service_actor(conn)
	end

	def internal_fetch(conn, _params) do
	InternalFetchActor.get_actor()
	\|> represent_service_actor(conn)
	end

	@doc "Returns the authenticated user's ActivityPub User object or a 404 Not Found if non-authenticated"
	def whoami(%{assigns: %{user: %User{} = user}} = conn, _params) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("user.json", %{user: user})
	end

	def read_inbox(
	%{assigns: %{user: %User{nickname: nickname} = user}} = conn,
	%{"nickname" => nickname, "page" => page?} = params
	)
	when page? in [true, "true"] do
	params =
	params
	\|> Map.drop(["nickname", "page"])
	\|> Map.put("blocking_user", user)
	\|> Map.put("user", user)
	\|> Map.new(fn {k, v} -> {String.to_existing_atom(k), v} end)

	activities =
	[user.ap_id \| User.following(user)]
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection_page.json", %{
	activities: activities,
	pagination: ControllerHelper.get_pagination_fields(conn, activities),
	iri: "#{user.ap_id}/inbox"
	})
	end

	def read_inbox(%{assigns: %{user: %User{nickname: nickname} = user}} = conn, %{
	"nickname" => nickname
	}) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> put_view(UserView)
	\|> render("activity_collection.json", %{iri: "#{user.ap_id}/inbox"})
	end

	def read_inbox(%{assigns: %{user: %User{nickname: as_nickname}}} = conn, %{
	"nickname" => nickname
	}) do
	err =
	dgettext("errors", "can't read inbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: as_nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end

	defp fix_user_message(%User{ap_id: actor}, %{"type" => "Create", "object" => object} = activity)
	when is_map(object) do
	length =
	[object["content"], object["summary"], object["name"]]
	\|> Enum.filter(&is_binary(&1))
	\|> Enum.join("")
	\|> String.length()

	limit = Pleroma.Config.get([:instance, :limit])

	if length < limit do
	object =
	object
	\|> Transmogrifier.strip_internal_fields()
	\|> Map.put("attributedTo", actor)
	\|> Map.put("actor", actor)
	\|> Map.put("id", Utils.generate_object_id())

	{:ok, Map.put(activity, "object", object)}
	else
	{:error,
	dgettext(
	"errors",
	"Character limit (%{limit} characters) exceeded, contains %{length} characters",
	limit: limit,
	length: length
	)}
	end
	end

	defp fix_user_message(
	%User{ap_id: actor} = user,
	%{"type" => "Delete", "object" => object} = activity
	) do
	with {_, %Object{data: object_data}} <- {:normalize, Object.normalize(object, fetch: false)},
	{_, true} <- {:permission, user.is_moderator \|\| actor == object_data["actor"]} do
	{:ok, activity}
	else
	{:normalize, _} ->
	{:error, "No such object found"}

	{:permission, _} ->
	{:forbidden, "You can't delete this object"}
	end
	end

	defp fix_user_message(%User{}, activity) do
	{:ok, activity}
	end

	+ # We currently lack a Flag ObjectValidator since both CommonAPI and Transmogrifier
	+ # both send it straight to ActivityPub.flag and C2S currently has to go through
	+ # the normal pipeline which requires an ObjectValidator.
	+ # TODO: Add a Flag Activity ObjectValidator
	+ defp check_allowed_action(_, %{"type" => "Flag"}) do
	+ {:error, "Flag activities aren't currently supported in C2S"}
	+ end
	+
	+ # It would respond with 201 and silently fail with:
	+ # Could not decode featured collection at fetch #{user.ap_id} \
	+ # {:error, "Trying to fetch local resource"}
	+ defp check_allowed_action(%{ap_id: ap_id}, %{"type" => "Update", "object" => %{"id" => ap_id}}),
	+ do: {:error, "Updating profile is not currently supported in C2S"}
	+
	+ defp check_allowed_action(_, activity), do: {:ok, activity}
	+
	+ defp validate_visibility(%User{} = user, %{"type" => type, "object" => object} = activity) do
	+ with {_, %Object{} = normalized_object} <-
	+ {:normalize, Object.normalize(object, fetch: false)},
	+ {_, true} <- {:visibility, Visibility.visible_for_user?(normalized_object, user)} do
	+ {:ok, activity}
	+ else
	+ {:normalize, _} ->
	+ if type in ["Create", "Listen"] do
	+ # Creating new object via C2S; user is local and authenticated
	+ # via the :authenticate Plug pipeline.
	+ {:ok, activity}
	+ else
	+ {:error, "No such object found"}
	+ end
	+
	+ {:visibility, _} ->
	+ {:forbidden, "You can't interact with this object"}
	+ end
	+ end
	+
	def update_outbox(
	%{assigns: %{user: %User{nickname: nickname, ap_id: actor} = user}} = conn,
	%{"nickname" => nickname} = params
	) do
	params =
	params
	\|> Map.drop(["nickname"])
	\|> Map.put("id", Utils.generate_activity_id())
	\|> Map.put("actor", actor)

	with {:ok, params} <- fix_user_message(user, params),
	+ {:ok, params} <- check_allowed_action(user, params),
	+ {:ok, params} <- validate_visibility(user, params),
	{:ok, activity, _} <- Pipeline.common_pipeline(params, local: true),
	%Activity{data: activity_data} <- Activity.normalize(activity) do
	conn
	\|> put_status(:created)
	\|> put_resp_header("location", activity_data["id"])
	\|> json(activity_data)
	else
	{:forbidden, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(message)

	{:error, message} when is_binary(message) ->
	conn
	\|> put_status(:bad_request)
	\|> json(message)

	e ->
	Logger.warning(fn -> "AP C2S: #{inspect(e)}" end)

	conn
	\|> put_status(:bad_request)
	\|> json("Bad Request")
	end
	end

	def update_outbox(%{assigns: %{user: %User{} = user}} = conn, %{"nickname" => nickname}) do
	err =
	dgettext("errors", "can't update outbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: user.nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end

	defp errors(conn, {:error, :not_found}) do
	conn
	\|> put_status(:not_found)
	\|> json(dgettext("errors", "Not found"))
	end

	defp errors(conn, _e) do
	conn
	\|> put_status(:internal_server_error)
	\|> json(dgettext("errors", "error"))
	end

	defp log_inbox_metadata(%{params: %{"actor" => actor, "type" => type}} = conn, _) do
	Logger.metadata(actor: actor, type: type)
	conn
	end

	defp log_inbox_metadata(conn, _), do: conn

	def upload_media(%{assigns: %{user: %User{} = user}} = conn, %{"file" => file} = data) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, "description")
	) do
	Logger.debug(inspect(object))

	conn
	\|> put_status(:created)
	\|> json(object.data)
	end
	end

	def pinned(conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname) do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(UserView.render("featured.json", %{user: user}))
	end
	end
	end
	diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
	index a358f3925..8db01f9e7 100644
	--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
	+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
	@@ -1,1094 +1,1115 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.Transmogrifier do
	@moduledoc """
	A module to handle coding from internal to wire ActivityPub and back.
	"""
	@behaviour Pleroma.Web.ActivityPub.Transmogrifier.API
	alias Pleroma.Activity
	alias Pleroma.EctoType.ActivityPub.ObjectValidators
	alias Pleroma.Maps
	alias Pleroma.Object
	alias Pleroma.Object.Containment
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.ObjectValidator
	alias Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.Federator

	import Ecto.Query
	import Pleroma.Web.Utils.Guards, only: [not_empty_string: 1]

	require Pleroma.Constants

	@doc """
	Modifies an incoming AP object (mastodon format) to our internal format.
	"""
	def fix_object(object, options \\ []) do
	object
	\|> strip_internal_fields()
	\|> fix_actor()
	\|> fix_url()
	\|> fix_attachments()
	\|> fix_context()
	\|> fix_in_reply_to(options)
	\|> fix_emoji()
	\|> fix_tag()
	\|> fix_content_map()
	\|> fix_addressing()
	\|> fix_summary()
	\|> fix_history(&fix_object/1)
	end

	defp maybe_fix_object(%{"attributedTo" => _} = object), do: fix_object(object)
	defp maybe_fix_object(object), do: object

	defp fix_history(%{"formerRepresentations" => %{"orderedItems" => list}} = obj, fix_fun)
	when is_list(list) do
	update_in(obj["formerRepresentations"]["orderedItems"], fn h -> Enum.map(h, fix_fun) end)
	end

	defp fix_history(obj, _), do: obj

	defp fix_recursive(obj, fun) do
	# unlike Erlang, Elixir does not support recursive inline functions
	# which would allow us to avoid reconstructing this on every recursion
	rec_fun = fn
	obj when is_map(obj) -> fix_recursive(obj, fun)
	# there may be simple AP IDs in history (or object field)
	obj -> obj
	end

	obj
	\|> fun.()
	\|> fix_history(rec_fun)
	\|> then(fn
	%{"object" => object} = doc when is_map(object) ->
	update_in(doc["object"], rec_fun)

	apdoc ->
	apdoc
	end)
	end

	def fix_summary(%{"summary" => nil} = object) do
	Map.put(object, "summary", "")
	end

	def fix_summary(%{"summary" => _} = object) do
	# summary is present, nothing to do
	object
	end

	def fix_summary(object), do: Map.put(object, "summary", "")

	def fix_addressing_list(map, field) do
	addrs = map[field]

	cond do
	is_list(addrs) ->
	Map.put(map, field, Enum.filter(addrs, &is_binary/1))

	is_binary(addrs) ->
	Map.put(map, field, [addrs])

	true ->
	Map.put(map, field, [])
	end
	end

	@doc """
	Bovine compatibility
	https://codeberg.org/bovine/bovine/issues/53
	"""
	def fix_addressing_public(map, field) do
	addrs = Map.get(map, field, []) \|> List.wrap()

	Map.put(
	map,
	field,
	Enum.map(addrs, fn
	"Public" -> Pleroma.Constants.as_public()
	"as:Public" -> Pleroma.Constants.as_public()
	x -> x
	end)
	)
	end

	# if directMessage flag is set to true, leave the addressing alone
	def fix_explicit_addressing(%{"directMessage" => true} = object, _follower_collection),
	do: object

	def fix_explicit_addressing(%{"to" => to, "cc" => cc} = object, follower_collection) do
	explicit_mentions =
	Utils.determine_explicit_mentions(object) ++
	[Pleroma.Constants.as_public(), follower_collection]

	explicit_to = Enum.filter(to, fn x -> x in explicit_mentions end)
	explicit_cc = Enum.filter(to, fn x -> x not in explicit_mentions end)

	final_cc =
	(cc ++ explicit_cc)
	\|> Enum.filter(& &1)
	\|> Enum.reject(fn x -> String.ends_with?(x, "/followers") and x != follower_collection end)
	\|> Enum.uniq()

	object
	\|> Map.put("to", explicit_to)
	\|> Map.put("cc", final_cc)
	end

	# if as:Public is addressed, then make sure the followers collection is also addressed
	# so that the activities will be delivered to local users.
	def fix_implicit_addressing(%{"to" => to, "cc" => cc} = object, followers_collection) do
	recipients = to ++ cc

	if followers_collection not in recipients do
	cond do
	Pleroma.Constants.as_public() in cc ->
	to = to ++ [followers_collection]
	Map.put(object, "to", to)

	Pleroma.Constants.as_public() in to ->
	cc = cc ++ [followers_collection]
	Map.put(object, "cc", cc)

	true ->
	object
	end
	else
	object
	end
	end

	def fix_addressing(object) do
	{:ok, %User{follower_address: follower_collection}} =
	object
	\|> Containment.get_actor()
	\|> User.get_or_fetch_by_ap_id()

	object
	\|> fix_addressing_list("to")
	\|> fix_addressing_list("cc")
	\|> fix_addressing_list("bto")
	\|> fix_addressing_list("bcc")
	\|> fix_addressing_public("to")
	\|> fix_addressing_public("cc")
	\|> fix_addressing_public("bto")
	\|> fix_addressing_public("bcc")
	\|> fix_explicit_addressing(follower_collection)
	\|> fix_implicit_addressing(follower_collection)
	end

	def fix_actor(%{"attributedTo" => actor} = object) do
	actor = Containment.get_actor(%{"actor" => actor})

	# TODO: Remove actor field for Objects
	object
	\|> Map.put("actor", actor)
	\|> Map.put("attributedTo", actor)
	end

	def fix_in_reply_to(object, options \\ [])

	def fix_in_reply_to(%{"inReplyTo" => in_reply_to} = object, options)
	when not is_nil(in_reply_to) do
	in_reply_to_id = prepare_in_reply_to(in_reply_to)
	depth = (options[:depth] \|\| 0) + 1

	if Federator.allowed_thread_distance?(depth) do
	with {:ok, replied_object} <- get_obj_helper(in_reply_to_id, options),
	%Activity{} <- Activity.get_create_by_object_ap_id(replied_object.data["id"]) do
	object
	\|> Map.put("inReplyTo", replied_object.data["id"])
	\|> Map.put("context", replied_object.data["context"] \|\| object["conversation"])
	\|> Map.drop(["conversation", "inReplyToAtomUri"])
	else
	_ ->
	object
	end
	else
	object
	end
	end

	def fix_in_reply_to(object, _options), do: object

	def fix_quote_url_and_maybe_fetch(object, options \\ []) do
	quote_url =
	case CommonFixes.fix_quote_url(object) do
	%{"quoteUrl" => quote_url} -> quote_url
	_ -> nil
	end

	with {:quoting?, true} <- {:quoting?, not is_nil(quote_url)},
	{:ok, quoted_object} <- get_obj_helper(quote_url, options),
	%Activity{} <- Activity.get_create_by_object_ap_id(quoted_object.data["id"]) do
	Map.put(object, "quoteUrl", quoted_object.data["id"])
	else
	{:quoting?, _} ->
	object

	_ ->
	object
	end
	end

	defp prepare_in_reply_to(in_reply_to) do
	cond do
	is_bitstring(in_reply_to) ->
	in_reply_to

	is_map(in_reply_to) && is_bitstring(in_reply_to["id"]) ->
	in_reply_to["id"]

	is_list(in_reply_to) && is_bitstring(Enum.at(in_reply_to, 0)) ->
	Enum.at(in_reply_to, 0)

	true ->
	""
	end
	end

	def fix_context(object) do
	context = object["context"] \|\| object["conversation"] \|\| Utils.generate_context_id()

	object
	\|> Map.put("context", context)
	\|> Map.drop(["conversation"])
	end

	def fix_attachments(%{"attachment" => attachment} = object) when is_list(attachment) do
	attachments =
	Enum.map(attachment, fn data ->
	url =
	cond do
	is_list(data["url"]) -> List.first(data["url"])
	is_map(data["url"]) -> data["url"]
	true -> nil
	end

	media_type =
	cond do
	is_map(url) && url =~ Pleroma.Constants.mime_regex() ->
	url["mediaType"]

	is_bitstring(data["mediaType"]) && data["mediaType"] =~ Pleroma.Constants.mime_regex() ->
	data["mediaType"]

	is_bitstring(data["mimeType"]) && data["mimeType"] =~ Pleroma.Constants.mime_regex() ->
	data["mimeType"]

	true ->
	nil
	end

	href =
	cond do
	is_map(url) && is_binary(url["href"]) -> url["href"]
	is_binary(data["url"]) -> data["url"]
	is_binary(data["href"]) -> data["href"]
	true -> nil
	end

	if href do
	attachment_url =
	%{
	"href" => href,
	"type" => Map.get(url \|\| %{}, "type", "Link")
	}
	\|> Maps.put_if_present("mediaType", media_type)
	\|> Maps.put_if_present("width", (url \|\| %{})["width"] \|\| data["width"])
	\|> Maps.put_if_present("height", (url \|\| %{})["height"] \|\| data["height"])

	%{
	"url" => [attachment_url],
	"type" => data["type"] \|\| "Document"
	}
	\|> Maps.put_if_present("mediaType", media_type)
	\|> Maps.put_if_present("name", data["name"])
	\|> Maps.put_if_present("blurhash", data["blurhash"])
	else
	nil
	end
	end)
	\|> Enum.filter(& &1)

	Map.put(object, "attachment", attachments)
	end

	def fix_attachments(%{"attachment" => attachment} = object) when is_map(attachment) do
	object
	\|> Map.put("attachment", [attachment])
	\|> fix_attachments()
	end

	def fix_attachments(object), do: object

	def fix_url(%{"url" => url} = object) when is_map(url) do
	Map.put(object, "url", url["href"])
	end

	def fix_url(%{"url" => url} = object) when is_list(url) do
	first_element = Enum.at(url, 0)

	url_string =
	cond do
	is_bitstring(first_element) -> first_element
	is_map(first_element) -> first_element["href"] \|\| ""
	true -> ""
	end

	Map.put(object, "url", url_string)
	end

	def fix_url(object), do: object

	def fix_emoji(%{"tag" => tags} = object) when is_list(tags) do
	emoji =
	tags
	\|> Enum.filter(fn data -> is_map(data) and data["type"] == "Emoji" and data["icon"] end)
	\|> Enum.reduce(%{}, fn data, mapping ->
	name = String.trim(data["name"], ":")

	Map.put(mapping, name, data["icon"]["url"])
	end)

	Map.put(object, "emoji", emoji)
	end

	def fix_emoji(%{"tag" => %{"type" => "Emoji"} = tag} = object) do
	name = String.trim(tag["name"], ":")
	emoji = %{name => tag["icon"]["url"]}

	Map.put(object, "emoji", emoji)
	end

	def fix_emoji(object), do: object

	def fix_tag(%{"tag" => tag} = object) when is_list(tag) do
	tags =
	tag
	\|> Enum.filter(fn data -> data["type"] == "Hashtag" and data["name"] end)
	\|> Enum.map(fn
	%{"name" => "#" <> hashtag} -> String.downcase(hashtag)
	%{"name" => hashtag} -> String.downcase(hashtag)
	end)

	Map.put(object, "tag", tag ++ tags)
	end

	def fix_tag(%{"tag" => %{} = tag} = object) do
	object
	\|> Map.put("tag", [tag])
	\|> fix_tag
	end

	def fix_tag(object), do: object

	# prefer content over contentMap
	def fix_content_map(%{"content" => content} = object) when not_empty_string(content), do: object

	# content map usually only has one language so this will do for now.
	def fix_content_map(%{"contentMap" => content_map} = object) do
	content_groups = Map.to_list(content_map)
	{_, content} = Enum.at(content_groups, 0)

	Map.put(object, "content", content)
	end

	def fix_content_map(object), do: object

	defp fix_type(%{"type" => "Note", "inReplyTo" => reply_id, "name" => _} = object, options)
	when is_binary(reply_id) do
	options = Keyword.put(options, :fetch, true)

	with %Object{data: %{"type" => "Question"}} <- Object.normalize(reply_id, options) do
	Map.put(object, "type", "Answer")
	else
	_ -> object
	end
	end

	defp fix_type(object, _options), do: object

	# Reduce the object list to find the reported user.
	defp get_reported(objects) do
	Enum.reduce_while(objects, nil, fn ap_id, _ ->
	with %User{} = user <- User.get_cached_by_ap_id(ap_id) do
	{:halt, user}
	else
	_ -> {:cont, nil}
	end
	end)
	end

	def handle_incoming(data, options \\ []) do
	data
	\|> fix_recursive(&strip_internal_fields/1)
	\|> handle_incoming_normalized(options)
	end

	# Flag objects are placed ahead of the ID check because Mastodon 2.8 and earlier send them
	# with nil ID.
	defp handle_incoming_normalized(
	%{"type" => "Flag", "object" => objects, "actor" => actor} = data,
	_options
	) do
	with context <- data["context"] \|\| Utils.generate_context_id(),
	content <- data["content"] \|\| "",
	%User{} = actor <- User.get_cached_by_ap_id(actor),
	# Reduce the object list to find the reported user.
	%User{} = account <- get_reported(objects),
	# Remove the reported user from the object list.
	statuses <- Enum.filter(objects, fn ap_id -> ap_id != account.ap_id end) do
	%{
	actor: actor,
	context: context,
	account: account,
	statuses: statuses,
	content: content,
	additional: %{"cc" => [account.ap_id]}
	}
	\|> ActivityPub.flag()
	end
	end

	# disallow objects with bogus IDs
	defp handle_incoming_normalized(%{"id" => nil}, _options), do: :error
	defp handle_incoming_normalized(%{"id" => ""}, _options), do: :error
	# length of https:// = 8, should validate better, but good enough for now.
	defp handle_incoming_normalized(%{"id" => id}, _options)
	when is_binary(id) and byte_size(id) < 8,
	do: :error

	defp handle_incoming_normalized(
	%{"type" => "Listen", "object" => %{"type" => "Audio"} = object} = data,
	options
	) do
	actor = Containment.get_actor(data)

	data =
	Map.put(data, "actor", actor)
	\|> fix_addressing

	with {:ok, %User{} = user} <- User.get_or_fetch_by_ap_id(data["actor"]) do
	reply_depth = (options[:depth] \|\| 0) + 1
	options = Keyword.put(options, :depth, reply_depth)
	object = fix_object(object, options)

	params = %{
	to: data["to"],
	object: object,
	actor: user,
	context: nil,
	local: false,
	published: data["published"],
	additional: Map.take(data, ["cc", "id"])
	}

	ActivityPub.listen(params)
	else
	_e -> :error
	end
	end

	@misskey_reactions %{
	"like" => "👍",
	"love" => "❤️",
	"laugh" => "😆",
	"hmm" => "🤔",
	"surprise" => "😮",
	"congrats" => "🎉",
	"angry" => "💢",
	"confused" => "😥",
	"rip" => "😇",
	"pudding" => "🍮",
	"star" => "⭐"
	}

	# Rewrite misskey likes into EmojiReacts
	defp handle_incoming_normalized(
	%{
	"type" => "Like",
	"content" => content
	} = data,
	options
	)
	when is_binary(content) do
	data
	\|> Map.put("type", "EmojiReact")
	\|> handle_incoming_normalized(options)
	end

	defp handle_incoming_normalized(
	%{
	"type" => "Like",
	"_misskey_reaction" => reaction
	} = data,
	options
	) do
	data
	\|> Map.put("content", @misskey_reactions[reaction] \|\| reaction)
	\|> handle_incoming_normalized(options)
	end

	defp handle_incoming_normalized(
	%{"type" => "Create", "object" => %{"type" => objtype, "id" => obj_id}} = data,
	options
	)
	when objtype in ~w{Question Answer ChatMessage Audio Video Event Article Note Page Image} do
	fetch_options = Keyword.put(options, :depth, (options[:depth] \|\| 0) + 1)

	object =
	data["object"]
	\|> strip_internal_fields()
	\|> fix_type(fetch_options)
	\|> fix_in_reply_to(fetch_options)
	\|> fix_quote_url_and_maybe_fetch(fetch_options)

	data = Map.put(data, "object", object)
	options = Keyword.put(options, :local, false)

	with {:ok, %User{}} <- ObjectValidator.fetch_actor(data),
	nil <- Activity.get_create_by_object_ap_id(obj_id),
	{:ok, activity, _} <- Pipeline.common_pipeline(data, options) do
	{:ok, activity}
	else
	%Activity{} = activity -> {:ok, activity}
	e -> e
	end
	end

	defp handle_incoming_normalized(%{"type" => type} = data, _options)
	when type in ~w{Like EmojiReact Announce Add Remove} do
	with :ok <- ObjectValidator.fetch_actor_and_object(data),
	{:ok, activity, _meta} <-
	Pipeline.common_pipeline(data, local: false) do
	{:ok, activity}
	else
	e -> {:error, e}
	end
	end

	defp handle_incoming_normalized(
	%{"type" => type} = data,
	_options
	)
	when type in ~w{Update Block Follow Accept Reject} do
	fixed_obj = maybe_fix_object(data["object"])
	data = if fixed_obj != nil, do: %{data \| "object" => fixed_obj}, else: data

	with {:ok, %User{}} <- ObjectValidator.fetch_actor(data),
	{:ok, activity, _} <-
	Pipeline.common_pipeline(data, local: false) do
	{:ok, activity}
	end
	end

	defp handle_incoming_normalized(
	%{"type" => "Delete"} = data,
	_options
	) do
	with {:ok, activity, _} <-
	Pipeline.common_pipeline(data, local: false) do
	{:ok, activity}
	else
	{:error, {:validate, _}} = e ->
	# Check if we have a create activity for this
	with {:ok, object_id} <- ObjectValidators.ObjectID.cast(data["object"]),
	%Activity{data: %{"actor" => actor}} <-
	Activity.create_by_object_ap_id(object_id) \|> Repo.one(),
	# We have one, insert a tombstone and retry
	{:ok, tombstone_data, _} <- Builder.tombstone(actor, object_id),
	{:ok, _tombstone} <- Object.create(tombstone_data) do
	handle_incoming(data)
	else
	_ -> e
	end

	e ->
	{:error, e}
	end
	end

	defp handle_incoming_normalized(
	%{
	"type" => "Undo",
	"object" => %{"type" => "Follow", "object" => followed},
	"actor" => follower,
	"id" => id
	} = _data,
	_options
	) do
	with %User{local: true} = followed <- User.get_cached_by_ap_id(followed),
	{:ok, %User{} = follower} <- User.get_or_fetch_by_ap_id(follower),
	{:ok, activity} <- ActivityPub.unfollow(follower, followed, id, false) do
	User.unfollow(follower, followed)
	{:ok, activity}
	else
	_e -> :error
	end
	end

	defp handle_incoming_normalized(
	%{
	"type" => "Undo",
	"object" => %{"type" => type}
	} = data,
	_options
	)
	when type in ["Like", "EmojiReact", "Announce", "Block"] do
	with {:ok, activity, _} <- Pipeline.common_pipeline(data, local: false) do
	{:ok, activity}
	end
	end

	# For Undos that don't have the complete object attached, try to find it in our database.
	defp handle_incoming_normalized(
	%{
	"type" => "Undo",
	"object" => object
	} = activity,
	options
	)
	when is_binary(object) do
	with %Activity{data: data} <- Activity.get_by_ap_id(object) do
	activity
	\|> Map.put("object", data)
	\|> handle_incoming_normalized(options)
	else
	_e -> :error
	end
	end

	defp handle_incoming_normalized(
	%{
	"type" => "Move",
	"actor" => origin_actor,
	"object" => origin_actor,
	"target" => target_actor
	},
	_options
	) do
	with %User{} = origin_user <- User.get_cached_by_ap_id(origin_actor),
	{:ok, %User{} = target_user} <- User.get_or_fetch_by_ap_id(target_actor),
	true <- origin_actor in target_user.also_known_as do
	ActivityPub.move(origin_user, target_user, false)
	else
	_e -> :error
	end
	end

	# Rewrite dislikes into the thumbs down emoji
	defp handle_incoming_normalized(%{"type" => "Dislike"} = data, options) do
	data
	\|> Map.put("type", "EmojiReact")
	\|> Map.put("content", "👎")
	\|> handle_incoming_normalized(options)
	end

	defp handle_incoming_normalized(
	%{"type" => "Undo", "object" => %{"type" => "Dislike"}} = data,
	options
	) do
	data
	\|> put_in(["object", "type"], "EmojiReact")
	\|> put_in(["object", "content"], "👎")
	\|> handle_incoming_normalized(options)
	end

	defp handle_incoming_normalized(_, _), do: :error

	@spec get_obj_helper(String.t(), Keyword.t()) :: {:ok, Object.t()} \| nil
	def get_obj_helper(id, options \\ []) do
	options = Keyword.put(options, :fetch, true)

	case Object.normalize(id, options) do
	%Object{} = object -> {:ok, object}
	_ -> nil
	end
	end

	@spec get_embedded_obj_helper(String.t() \| Object.t(), User.t()) :: {:ok, Object.t()} \| nil
	def get_embedded_obj_helper(%{"attributedTo" => attributed_to, "id" => object_id} = data, %User{
	ap_id: ap_id
	})
	when attributed_to == ap_id do
	with {:ok, activity} <-
	handle_incoming(%{
	"type" => "Create",
	"to" => data["to"],
	"cc" => data["cc"],
	"actor" => attributed_to,
	"object" => data
	}) do
	{:ok, Object.normalize(activity, fetch: false)}
	else
	_ -> get_obj_helper(object_id)
	end
	end

	def get_embedded_obj_helper(object_id, _) do
	get_obj_helper(object_id)
	end

	def set_reply_to_uri(%{"inReplyTo" => in_reply_to} = object) when is_binary(in_reply_to) do
	with false <- String.starts_with?(in_reply_to, "http"),
	{:ok, %{data: replied_to_object}} <- get_obj_helper(in_reply_to) do
	Map.put(object, "inReplyTo", replied_to_object["external_url"] \|\| in_reply_to)
	else
	_e -> object
	end
	end

	def set_reply_to_uri(obj), do: obj

	@doc """
	Fedibird compatibility
	https://github.com/fedibird/mastodon/commit/dbd7ae6cf58a92ec67c512296b4daaea0d01e6ac
	"""
	def set_quote_url(%{"quoteUrl" => quote_url} = object) when is_binary(quote_url) do
	Map.put(object, "quoteUri", quote_url)
	end

	def set_quote_url(obj), do: obj

	@doc """
	Serialized Mastodon-compatible `replies` collection containing _self-replies_.
	Based on Mastodon's ActivityPub::NoteSerializer#replies.
	"""
	def set_replies(obj_data) do
	replies_uris =
	with limit when limit > 0 <-
	Pleroma.Config.get([:activitypub, :note_replies_output_limit], 0),
	%Object{} = object <- Object.get_cached_by_ap_id(obj_data["id"]) do
	object
	\|> Object.self_replies()
	\|> select([o], fragment("?->>'id'", o.data))
	\|> limit(^limit)
	\|> Repo.all()
	else
	_ -> []
	end

	set_replies(obj_data, replies_uris)
	end

	defp set_replies(obj, []) do
	obj
	end

	defp set_replies(obj, replies_uris) do
	replies_collection = %{
	"type" => "Collection",
	"items" => replies_uris
	}

	Map.merge(obj, %{"replies" => replies_collection})
	end

	def replies(%{"replies" => %{"first" => %{"items" => items}}}) when not is_nil(items) do
	items
	end

	def replies(%{"replies" => %{"items" => items}}) when not is_nil(items) do
	items
	end

	def replies(_), do: []

	# Prepares the object of an outgoing create activity.
	def prepare_object(object) do
	object
	\|> add_hashtags
	\|> add_mention_tags
	\|> add_emoji_tags
	\|> add_attributed_to
	\|> prepare_attachments
	\|> set_conversation
	\|> set_reply_to_uri
	\|> set_quote_url
	\|> set_replies
	\|> CommonFixes.maybe_add_content_map()
	\|> strip_internal_fields
	\|> strip_internal_tags
	\|> set_type
	\|> maybe_process_history
	end

	defp maybe_process_history(%{"formerRepresentations" => %{"orderedItems" => history}} = object) do
	processed_history =
	Enum.map(
	history,
	fn
	item when is_map(item) -> prepare_object(item)
	item -> item
	end
	)

	put_in(object, ["formerRepresentations", "orderedItems"], processed_history)
	end

	defp maybe_process_history(object) do
	object
	end

	# @doc
	# """
	# internal -> Mastodon
	# """

	def prepare_outgoing(%{"type" => activity_type, "object" => object_id} = data)
	when activity_type in ["Create", "Listen"] do
	object =
	object_id
	\|> Object.normalize(fetch: false)
	\|> Map.get(:data)

	data =
	data
	\|> Map.put("object", prepare_object(object))
	\|> Map.merge(Utils.make_json_ld_header(object))
	\|> Map.delete("bcc")

	{:ok, data}
	end

	def prepare_outgoing(%{"type" => "Update", "object" => %{"type" => objtype} = object} = data)
	when objtype in Pleroma.Constants.updatable_object_types() do
	data =
	data
	\|> Map.put("object", prepare_object(object))
	\|> Map.merge(Utils.make_json_ld_header(object))
	\|> Map.delete("bcc")

	{:ok, data}
	end

	+ def prepare_outgoing(%{"type" => "Update", "object" => %{"type" => objtype} = object} = data)
	+ when objtype in Pleroma.Constants.actor_types() do
	+ object =
	+ object
	+ \|> maybe_fix_user_object()
	+ \|> strip_internal_fields()
	+
	+ data =
	+ data
	+ \|> Map.put("object", object)
	+ \|> strip_internal_fields()
	+ \|> Map.merge(Utils.make_json_ld_header(object))
	+ \|> Map.delete("bcc")
	+
	+ {:ok, data}
	+ end
	+
	+ def prepare_outgoing(%{"type" => "Update", "object" => %{}} = data) do
	+ raise "Requested to serve an Update for non-updateable object type: #{inspect(data)}"
	+ end
	+
	def prepare_outgoing(%{"type" => "Announce", "actor" => ap_id, "object" => object_id} = data) do
	object =
	object_id
	\|> Object.normalize(fetch: false)

	data =
	if Visibility.private?(object) && object.data["actor"] == ap_id do
	data \|> Map.put("object", object \|> Map.get(:data) \|> prepare_object)
	else
	data \|> maybe_fix_object_url
	end

	data =
	data
	\|> strip_internal_fields
	\|> Map.merge(Utils.make_json_ld_header())
	\|> Map.delete("bcc")

	{:ok, data}
	end

	# Mastodon Accept/Reject requires a non-normalized object containing the actor URIs,
	# because of course it does.
	def prepare_outgoing(%{"type" => "Accept"} = data) do
	with follow_activity <- Activity.normalize(data["object"]) do
	object = %{
	"actor" => follow_activity.actor,
	"object" => follow_activity.data["object"],
	"id" => follow_activity.data["id"],
	"type" => "Follow"
	}

	data =
	data
	\|> Map.put("object", object)
	\|> Map.merge(Utils.make_json_ld_header())

	{:ok, data}
	end
	end

	def prepare_outgoing(%{"type" => "Reject"} = data) do
	with follow_activity <- Activity.normalize(data["object"]) do
	object = %{
	"actor" => follow_activity.actor,
	"object" => follow_activity.data["object"],
	"id" => follow_activity.data["id"],
	"type" => "Follow"
	}

	data =
	data
	\|> Map.put("object", object)
	\|> Map.merge(Utils.make_json_ld_header())

	{:ok, data}
	end
	end

	def prepare_outgoing(%{"type" => "Flag"} = data) do
	with {:ok, stripped_activity} <- Utils.strip_report_status_data(data),
	stripped_activity <- Utils.maybe_anonymize_reporter(stripped_activity),
	stripped_activity <- Map.merge(stripped_activity, Utils.make_json_ld_header()) do
	{:ok, stripped_activity}
	end
	end

	def prepare_outgoing(%{"type" => _type} = data) do
	data =
	data
	\|> strip_internal_fields
	\|> maybe_fix_object_url
	\|> Map.merge(Utils.make_json_ld_header(data))

	{:ok, data}
	end

	def maybe_fix_object_url(%{"object" => object} = data) when is_binary(object) do
	with false <- String.starts_with?(object, "http"),
	{:fetch, {:ok, relative_object}} <- {:fetch, get_obj_helper(object)},
	%{data: %{"external_url" => external_url}} when not is_nil(external_url) <-
	relative_object do
	Map.put(data, "object", external_url)
	else
	{:fetch, _} ->
	data

	_ ->
	data
	end
	end

	def maybe_fix_object_url(data), do: data

	def add_hashtags(object) do
	tags =
	(object["tag"] \|\| [])
	\|> Enum.map(fn
	# Expand internal representation tags into AS2 tags.
	tag when is_binary(tag) ->
	%{
	"href" => Pleroma.Web.Endpoint.url() <> "/tags/#{tag}",
	"name" => "##{tag}",
	"type" => "Hashtag"
	}

	# Do not process tags which are already AS2 tag objects.
	tag when is_map(tag) ->
	tag
	end)

	Map.put(object, "tag", tags)
	end

	# TODO These should be added on our side on insertion, it doesn't make much
	# sense to regenerate these all the time
	def add_mention_tags(object) do
	to = object["to"] \|\| []
	cc = object["cc"] \|\| []
	mentioned = User.get_users_from_set(to ++ cc, local_only: false)

	mentions = Enum.map(mentioned, &build_mention_tag/1)

	tags = object["tag"] \|\| []
	Map.put(object, "tag", tags ++ mentions)
	end

	defp build_mention_tag(%{ap_id: ap_id, nickname: nickname} = _) do
	%{"type" => "Mention", "href" => ap_id, "name" => "@#{nickname}"}
	end

	def take_emoji_tags(%User{emoji: emoji}) do
	emoji
	\|> Map.to_list()
	\|> Enum.map(&build_emoji_tag/1)
	end

	# TODO: we should probably send mtime instead of unix epoch time for updated
	def add_emoji_tags(%{"emoji" => emoji} = object) do
	tags = object["tag"] \|\| []

	out = Enum.map(emoji, &build_emoji_tag/1)

	Map.put(object, "tag", tags ++ out)
	end

	def add_emoji_tags(object), do: object

	def build_emoji_tag({name, url}) do
	url = URI.encode(url)

	%{
	"icon" => %{"url" => "#{url}", "type" => "Image"},
	"name" => ":" <> name <> ":",
	"type" => "Emoji",
	"updated" => "1970-01-01T00:00:00Z",
	"id" => url
	}
	end

	def set_conversation(object) do
	Map.put(object, "conversation", object["context"])
	end

	def set_type(%{"type" => "Answer"} = object) do
	Map.put(object, "type", "Note")
	end

	def set_type(object), do: object

	def add_attributed_to(object) do
	attributed_to = object["attributedTo"] \|\| object["actor"]
	Map.put(object, "attributedTo", attributed_to)
	end

	# TODO: Revisit this
	def prepare_attachments(%{"type" => "ChatMessage"} = object), do: object

	def prepare_attachments(object) do
	attachments =
	object
	\|> Map.get("attachment", [])
	\|> Enum.map(fn data ->
	[%{"mediaType" => media_type, "href" => href} = url \| _] = data["url"]

	%{
	"url" => href,
	"mediaType" => media_type,
	"name" => data["name"],
	"type" => "Document"
	}
	\|> Maps.put_if_present("width", url["width"])
	\|> Maps.put_if_present("height", url["height"])
	\|> Maps.put_if_present("blurhash", data["blurhash"])
	end)

	Map.put(object, "attachment", attachments)
	end

	def strip_internal_fields(object) do
	Map.drop(object, Pleroma.Constants.object_internal_fields())
	end

	defp strip_internal_tags(%{"tag" => tags} = object) do
	tags = Enum.filter(tags, fn x -> is_map(x) end)

	Map.put(object, "tag", tags)
	end

	defp strip_internal_tags(object), do: object

	def maybe_fix_user_url(%{"url" => url} = data) when is_map(url) do
	Map.put(data, "url", url["href"])
	end

	def maybe_fix_user_url(data), do: data

	def maybe_fix_user_object(data), do: maybe_fix_user_url(data)
	end
	diff --git a/lib/pleroma/web/activity_pub/views/object_view.ex b/lib/pleroma/web/activity_pub/views/object_view.ex
	index 13b5b2542..857410e43 100644
	--- a/lib/pleroma/web/activity_pub/views/object_view.ex
	+++ b/lib/pleroma/web/activity_pub/views/object_view.ex
	@@ -1,40 +1,22 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ObjectView do
	use Pleroma.Web, :view
	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.Web.ActivityPub.Transmogrifier

	def render("object.json", %{object: %Object{} = object}) do
	base = Pleroma.Web.ActivityPub.Utils.make_json_ld_header(object.data)

	additional = Transmogrifier.prepare_object(object.data)
	Map.merge(base, additional)
	end

	- def render("object.json", %{object: %Activity{data: %{"type" => activity_type}} = activity})
	- when activity_type in ["Create", "Listen"] do
	- base = Pleroma.Web.ActivityPub.Utils.make_json_ld_header(activity.data)
	- object = Object.normalize(activity, fetch: false)
	-
	- additional =
	- Transmogrifier.prepare_object(activity.data)
	- \|> Map.put("object", Transmogrifier.prepare_object(object.data))
	-
	- Map.merge(base, additional)
	- end
	-
	def render("object.json", %{object: %Activity{} = activity}) do
	- base = Pleroma.Web.ActivityPub.Utils.make_json_ld_header(activity.data)
	- object_id = Object.normalize(activity, id_only: true)
	-
	- additional =
	- Transmogrifier.prepare_object(activity.data)
	- \|> Map.put("object", object_id)
	-
	- Map.merge(base, additional)
	+ {:ok, ap_data} = Transmogrifier.prepare_outgoing(activity.data)
	+ ap_data
	end
	end
	diff --git a/lib/pleroma/web/api_spec/operations/emoji_reaction_operation.ex b/lib/pleroma/web/api_spec/operations/emoji_reaction_operation.ex
	index 8d6be89a7..f1ae0b261 100644
	--- a/lib/pleroma/web/api_spec/operations/emoji_reaction_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/emoji_reaction_operation.ex
	@@ -1,110 +1,113 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.EmojiReactionOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.Schemas.Account
	alias Pleroma.Web.ApiSpec.Schemas.ApiError
	+ alias Pleroma.Web.ApiSpec.Schemas.ApiNotFoundError
	alias Pleroma.Web.ApiSpec.Schemas.FlakeID
	alias Pleroma.Web.ApiSpec.Schemas.Status

	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	def index_operation do
	%Operation{
	tags: ["Emoji reactions"],
	summary:
	"Get an object of emoji to account mappings with accounts that reacted to the post",
	parameters: [
	Operation.parameter(:id, :path, FlakeID.schema(), "Status ID", required: true),
	Operation.parameter(:emoji, :path, :string, "Filter by a single unicode emoji",
	required: nil
	),
	Operation.parameter(
	:with_muted,
	:query,
	:boolean,
	"Include reactions from muted acccounts."
	)
	],
	security: [%{"oAuth" => ["read:statuses"]}],
	operationId: "EmojiReactionController.index",
	responses: %{
	- 200 => array_of_reactions_response()
	+ 200 => array_of_reactions_response(),
	+ 404 => Operation.response("Access denied", "application/json", ApiNotFoundError)
	}
	}
	end

	def create_operation do
	%Operation{
	tags: ["Emoji reactions"],
	summary: "React to a post with a unicode emoji",
	parameters: [
	Operation.parameter(:id, :path, FlakeID.schema(), "Status ID", required: true),
	Operation.parameter(:emoji, :path, :string, "A single character unicode emoji",
	required: true
	)
	],
	security: [%{"oAuth" => ["write:statuses"]}],
	operationId: "EmojiReactionController.create",
	responses: %{
	200 => Operation.response("Status", "application/json", Status),
	- 400 => Operation.response("Bad Request", "application/json", ApiError)
	+ 400 => Operation.response("Bad Request", "application/json", ApiError),
	+ 404 => Operation.response("Not Found", "application/json", ApiNotFoundError)
	}
	}
	end

	def delete_operation do
	%Operation{
	tags: ["Emoji reactions"],
	summary: "Remove a reaction to a post with a unicode emoji",
	parameters: [
	Operation.parameter(:id, :path, FlakeID.schema(), "Status ID", required: true),
	Operation.parameter(:emoji, :path, :string, "A single character unicode emoji",
	required: true
	)
	],
	security: [%{"oAuth" => ["write:statuses"]}],
	operationId: "EmojiReactionController.delete",
	responses: %{
	200 => Operation.response("Status", "application/json", Status)
	}
	}
	end

	defp array_of_reactions_response do
	Operation.response("Array of Emoji reactions", "application/json", %Schema{
	type: :array,
	items: emoji_reaction(),
	example: [emoji_reaction().example]
	})
	end

	defp emoji_reaction do
	%Schema{
	title: "EmojiReaction",
	type: :object,
	properties: %{
	name: %Schema{type: :string, description: "Emoji"},
	count: %Schema{type: :integer, description: "Count of reactions with this emoji"},
	me: %Schema{type: :boolean, description: "Did I react with this emoji?"},
	accounts: %Schema{
	type: :array,
	items: Account,
	description: "Array of accounts reacted with this emoji"
	}
	},
	example: %{
	"name" => "😱",
	"count" => 1,
	"me" => false,
	"accounts" => [Account.schema().example]
	}
	}
	end
	end
	diff --git a/lib/pleroma/web/api_spec/operations/report_operation.ex b/lib/pleroma/web/api_spec/operations/report_operation.ex
	index f5f88974c..c29598b3f 100644
	--- a/lib/pleroma/web/api_spec/operations/report_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/report_operation.ex
	@@ -1,89 +1,91 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.ReportOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.Helpers
	alias Pleroma.Web.ApiSpec.Schemas.ApiError
	+ alias Pleroma.Web.ApiSpec.Schemas.ApiNotFoundError
	alias Pleroma.Web.ApiSpec.Schemas.BooleanLike

	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	def create_operation do
	%Operation{
	tags: ["Reports"],
	summary: "File a report",
	description: "Report problematic users to your moderators",
	operationId: "ReportController.create",
	security: [%{"oAuth" => ["follow", "write:reports"]}],
	requestBody: Helpers.request_body("Parameters", create_request(), required: true),
	responses: %{
	200 => Operation.response("Report", "application/json", create_response()),
	- 400 => Operation.response("Report", "application/json", ApiError)
	+ 400 => Operation.response("Report", "application/json", ApiError),
	+ 404 => Operation.response("Report", "application/json", ApiNotFoundError)
	}
	}
	end

	defp create_request do
	%Schema{
	title: "ReportCreateRequest",
	description: "POST body for creating a report",
	type: :object,
	properties: %{
	account_id: %Schema{type: :string, description: "ID of the account to report"},
	status_ids: %Schema{
	type: :array,
	nullable: true,
	items: %Schema{type: :string},
	description: "Array of Statuses to attach to the report, for context"
	},
	comment: %Schema{
	type: :string,
	nullable: true,
	description: "Reason for the report"
	},
	forward: %Schema{
	allOf: [BooleanLike],
	nullable: true,
	default: false,
	description:
	"If the account is remote, should the report be forwarded to the remote admin?"
	},
	rule_ids: %Schema{
	type: :array,
	nullable: true,
	items: %Schema{type: :string},
	description: "Array of rules"
	}
	},
	required: [:account_id],
	example: %{
	"account_id" => "123",
	"status_ids" => ["1337"],
	"comment" => "bad status!",
	"forward" => "false",
	"rule_ids" => ["3"]
	}
	}
	end

	defp create_response do
	%Schema{
	title: "ReportResponse",
	type: :object,
	properties: %{
	id: %Schema{type: :string, description: "Report ID"},
	action_taken: %Schema{type: :boolean, description: "Is action taken?"}
	},
	example: %{
	"id" => "123",
	"action_taken" => false
	}
	}
	end
	end
	diff --git a/lib/pleroma/web/api_spec/operations/status_operation.ex b/lib/pleroma/web/api_spec/operations/status_operation.ex
	index fed37f51d..9b1478d2a 100644
	--- a/lib/pleroma/web/api_spec/operations/status_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/status_operation.ex
	@@ -1,909 +1,920 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.StatusOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.AccountOperation
	alias Pleroma.Web.ApiSpec.Schemas.Account
	alias Pleroma.Web.ApiSpec.Schemas.ApiError
	+ alias Pleroma.Web.ApiSpec.Schemas.ApiNotFoundError
	alias Pleroma.Web.ApiSpec.Schemas.Attachment
	alias Pleroma.Web.ApiSpec.Schemas.BooleanLike
	alias Pleroma.Web.ApiSpec.Schemas.Emoji
	alias Pleroma.Web.ApiSpec.Schemas.FlakeID
	alias Pleroma.Web.ApiSpec.Schemas.Poll
	alias Pleroma.Web.ApiSpec.Schemas.ScheduledStatus
	alias Pleroma.Web.ApiSpec.Schemas.Status
	alias Pleroma.Web.ApiSpec.Schemas.VisibilityScope

	import Pleroma.Web.ApiSpec.Helpers

	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	def index_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Multiple statuses",
	security: [%{"oAuth" => ["read:statuses"]}],
	parameters: [
	Operation.parameter(
	:id,
	:query,
	%Schema{type: :array, items: FlakeID},
	"Array of status IDs"
	),
	Operation.parameter(
	:ids,
	:query,
	%Schema{type: :array, items: FlakeID},
	"Deprecated, use `id` instead"
	),
	Operation.parameter(
	:with_muted,
	:query,
	BooleanLike.schema(),
	"Include reactions from muted acccounts."
	)
	],
	operationId: "StatusController.index",
	responses: %{
	200 => Operation.response("Array of Status", "application/json", array_of_statuses())
	}
	}
	end

	def create_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Publish new status",
	security: [%{"oAuth" => ["write:statuses"]}],
	description: "Post a new status",
	operationId: "StatusController.create",
	requestBody: request_body("Parameters", create_request(), required: true),
	responses: %{
	200 =>
	Operation.response(
	"Status. When `scheduled_at` is present, ScheduledStatus is returned instead",
	"application/json",
	%Schema{anyOf: [Status, ScheduledStatus]}
	),
	422 => Operation.response("Bad Request / MRF Rejection", "application/json", ApiError)
	}
	}
	end

	def show_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Status",
	description: "View information about a status",
	operationId: "StatusController.show",
	security: [%{"oAuth" => ["read:statuses"]}],
	parameters: [
	id_param(),
	Operation.parameter(
	:with_muted,
	:query,
	BooleanLike.schema(),
	"Include reactions from muted acccounts."
	)
	],
	responses: %{
	200 => status_response(),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def delete_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Delete",
	security: [%{"oAuth" => ["write:statuses"]}],
	description: "Delete one of your own statuses",
	operationId: "StatusController.delete",
	parameters: [id_param()],
	responses: %{
	200 => status_response(),
	403 => Operation.response("Forbidden", "application/json", ApiError),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def reblog_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Reblog",
	security: [%{"oAuth" => ["write:statuses"]}],
	description: "Share a status",
	operationId: "StatusController.reblog",
	parameters: [id_param()],
	requestBody:
	request_body("Parameters", %Schema{
	type: :object,
	properties: %{
	visibility: %Schema{allOf: [VisibilityScope]}
	}
	}),
	responses: %{
	200 => status_response(),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def unreblog_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Undo reblog",
	security: [%{"oAuth" => ["write:statuses"]}],
	description: "Undo a reshare of a status",
	operationId: "StatusController.unreblog",
	parameters: [id_param()],
	responses: %{
	200 => status_response(),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def favourite_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Favourite",
	security: [%{"oAuth" => ["write:favourites"]}],
	description: "Add a status to your favourites list",
	operationId: "StatusController.favourite",
	parameters: [id_param()],
	responses: %{
	200 => status_response(),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def unfavourite_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Undo favourite",
	security: [%{"oAuth" => ["write:favourites"]}],
	description: "Remove a status from your favourites list",
	operationId: "StatusController.unfavourite",
	parameters: [id_param()],
	responses: %{
	200 => status_response(),
	+ 400 => Operation.response("Error", "application/json", ApiError),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def pin_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Pin to profile",
	security: [%{"oAuth" => ["write:accounts"]}],
	description: "Feature one of your own public statuses at the top of your profile",
	operationId: "StatusController.pin",
	parameters: [id_param()],
	responses: %{
	200 => status_response(),
	400 =>
	Operation.response("Bad Request", "application/json", %Schema{
	allOf: [ApiError],
	title: "Unprocessable Entity",
	example: %{
	"error" => "You have already pinned the maximum number of statuses"
	}
	}),
	404 =>
	Operation.response("Not found", "application/json", %Schema{
	allOf: [ApiError],
	title: "Unprocessable Entity",
	example: %{
	"error" => "Record not found"
	}
	}),
	422 =>
	Operation.response(
	"Unprocessable Entity",
	"application/json",
	%Schema{
	allOf: [ApiError],
	title: "Unprocessable Entity",
	example: %{
	"error" => "Someone else's status cannot be pinned"
	}
	}
	)
	}
	}
	end

	def unpin_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Unpin from profile",
	security: [%{"oAuth" => ["write:accounts"]}],
	description: "Unfeature a status from the top of your profile",
	operationId: "StatusController.unpin",
	parameters: [id_param()],
	responses: %{
	200 => status_response(),
	400 =>
	Operation.response("Bad Request", "application/json", %Schema{
	allOf: [ApiError],
	title: "Unprocessable Entity",
	example: %{
	"error" => "You have already pinned the maximum number of statuses"
	}
	}),
	- 404 =>
	- Operation.response("Not found", "application/json", %Schema{
	- allOf: [ApiError],
	- title: "Unprocessable Entity",
	- example: %{
	- "error" => "Record not found"
	+ 404 => Operation.response("Not found", "application/json", ApiNotFoundError),
	+ 422 =>
	+ Operation.response(
	+ "Unprocessable Entity",
	+ "application/json",
	+ %Schema{
	+ allOf: [ApiError],
	+ title: "Unprocessable Entity",
	+ example: %{
	+ "error" => "Someone else's status cannot be unpinned"
	+ }
	}
	- })
	+ )
	}
	}
	end

	def bookmark_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Bookmark",
	security: [%{"oAuth" => ["write:bookmarks"]}],
	description: "Privately bookmark a status",
	operationId: "StatusController.bookmark",
	parameters: [id_param()],
	requestBody:
	request_body("Parameters", %Schema{
	title: "StatusUpdateRequest",
	type: :object,
	properties: %{
	folder_id: %Schema{
	nullable: true,
	allOf: [FlakeID],
	description: "ID of bookmarks folder, if any"
	}
	}
	}),
	responses: %{
	- 200 => status_response()
	+ 200 => status_response(),
	+ 404 => Operation.response("Not found", "application/json", ApiNotFoundError)
	}
	}
	end

	def unbookmark_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Undo bookmark",
	security: [%{"oAuth" => ["write:bookmarks"]}],
	description: "Remove a status from your private bookmarks",
	operationId: "StatusController.unbookmark",
	parameters: [id_param()],
	responses: %{
	- 200 => status_response()
	+ 200 => status_response(),
	+ 404 => Operation.response("Not found", "application/json", ApiNotFoundError)
	}
	}
	end

	def mute_conversation_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Mute conversation",
	security: [%{"oAuth" => ["write:mutes"]}],
	description: "Do not receive notifications for the thread that this status is part of.",
	operationId: "StatusController.mute_conversation",
	requestBody:
	request_body("Parameters", %Schema{
	type: :object,
	properties: %{
	expires_in: %Schema{
	type: :integer,
	nullable: true,
	description: "Expire the mute in `expires_in` seconds. Default 0 for infinity",
	default: 0
	}
	}
	}),
	parameters: [
	id_param(),
	Operation.parameter(
	:expires_in,
	:query,
	%Schema{type: :integer, default: 0},
	"Expire the mute in `expires_in` seconds. Default 0 for infinity"
	)
	],
	responses: %{
	200 => status_response(),
	- 400 => Operation.response("Error", "application/json", ApiError)
	+ 400 => Operation.response("Error", "application/json", ApiError),
	+ 404 => Operation.response("Not found", "application/json", ApiNotFoundError)
	}
	}
	end

	def unmute_conversation_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Unmute conversation",
	security: [%{"oAuth" => ["write:mutes"]}],
	description:
	"Start receiving notifications again for the thread that this status is part of",
	operationId: "StatusController.unmute_conversation",
	parameters: [id_param()],
	responses: %{
	200 => status_response(),
	- 400 => Operation.response("Error", "application/json", ApiError)
	+ 400 => Operation.response("Error", "application/json", ApiError),
	+ 404 => Operation.response("Not Found", "application/json", ApiNotFoundError)
	}
	}
	end

	def card_operation do
	%Operation{
	tags: ["Retrieve status information"],
	deprecated: true,
	summary: "Preview card",
	description: "Deprecated in favor of card property inlined on Status entity",
	operationId: "StatusController.card",
	parameters: [id_param()],
	security: [%{"oAuth" => ["read:statuses"]}],
	responses: %{
	200 =>
	Operation.response("Card", "application/json", %Schema{
	type: :object,
	nullable: true,
	properties: %{
	type: %Schema{type: :string, enum: ["link", "photo", "video", "rich"]},
	provider_name: %Schema{type: :string, nullable: true},
	provider_url: %Schema{type: :string, format: :uri},
	url: %Schema{type: :string, format: :uri},
	image: %Schema{type: :string, nullable: true, format: :uri},
	title: %Schema{type: :string},
	description: %Schema{type: :string}
	}
	})
	}
	}
	end

	def favourited_by_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Favourited by",
	description: "View who favourited a given status",
	operationId: "StatusController.favourited_by",
	security: [%{"oAuth" => ["read:accounts"]}],
	parameters: [id_param()],
	responses: %{
	200 =>
	Operation.response(
	"Array of Accounts",
	"application/json",
	AccountOperation.array_of_accounts()
	),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def reblogged_by_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Reblogged by",
	description: "View who reblogged a given status",
	operationId: "StatusController.reblogged_by",
	security: [%{"oAuth" => ["read:accounts"]}],
	parameters: [id_param()],
	responses: %{
	200 =>
	Operation.response(
	"Array of Accounts",
	"application/json",
	AccountOperation.array_of_accounts()
	),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def context_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Parent and child statuses",
	description: "View statuses above and below this status in the thread",
	operationId: "StatusController.context",
	security: [%{"oAuth" => ["read:statuses"]}],
	parameters: [id_param()],
	responses: %{
	200 => Operation.response("Context", "application/json", context())
	}
	}
	end

	def translate_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Translate status",
	description: "Translate status with an external API",
	operationId: "StatusController.translate",
	security: [%{"oAuth" => ["read:statuses"]}],
	parameters: [id_param()],
	requestBody:
	request_body(
	"Parameters",
	%Schema{
	type: :object,
	properties: %{
	lang: %Schema{
	type: :string,
	nullable: true,
	description: "Translation target language."
	}
	}
	},
	required: false
	),
	responses: %{
	200 => Operation.response("Translation", "application/json", translation()),
	400 => Operation.response("Error", "application/json", ApiError),
	404 => Operation.response("Error", "application/json", ApiError),
	503 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def favourites_operation do
	%Operation{
	tags: ["Timelines"],
	summary: "Favourited statuses",
	description:
	"Statuses the user has favourited. Please note that you have to use the link headers to paginate this. You can not build the query parameters yourself.",
	operationId: "StatusController.favourites",
	parameters: pagination_params(),
	security: [%{"oAuth" => ["read:favourites"]}],
	responses: %{
	200 => Operation.response("Array of Statuses", "application/json", array_of_statuses())
	}
	}
	end

	def bookmarks_operation do
	%Operation{
	tags: ["Timelines"],
	summary: "Bookmarked statuses",
	description: "Statuses the user has bookmarked",
	operationId: "StatusController.bookmarks",
	parameters: [
	Operation.parameter(
	:folder_id,
	:query,
	FlakeID.schema(),
	"If provided, only display bookmarks from given folder"
	)
	\| pagination_params()
	],
	security: [%{"oAuth" => ["read:bookmarks"]}],
	responses: %{
	200 => Operation.response("Array of Statuses", "application/json", array_of_statuses())
	}
	}
	end

	def show_history_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Status history",
	description: "View history of a status",
	operationId: "StatusController.show_history",
	security: [%{"oAuth" => ["read:statuses"]}],
	parameters: [
	id_param()
	],
	responses: %{
	200 => status_history_response(),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def show_source_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Status source",
	description: "View source of a status",
	operationId: "StatusController.show_source",
	security: [%{"oAuth" => ["read:statuses"]}],
	parameters: [
	id_param()
	],
	responses: %{
	200 => status_source_response(),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def update_operation do
	%Operation{
	tags: ["Status actions"],
	summary: "Update status",
	description: "Change the content of a status",
	operationId: "StatusController.update",
	security: [%{"oAuth" => ["write:statuses"]}],
	parameters: [
	id_param()
	],
	requestBody: request_body("Parameters", update_request(), required: true),
	responses: %{
	200 => status_response(),
	403 => Operation.response("Forbidden", "application/json", ApiError),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def quotes_operation do
	%Operation{
	tags: ["Retrieve status information"],
	summary: "Quoted by",
	description: "View quotes for a given status",
	operationId: "StatusController.quotes",
	parameters: [id_param() \| pagination_params()],
	security: [%{"oAuth" => ["read:statuses"]}],
	responses: %{
	200 =>
	Operation.response(
	"Array of Status",
	"application/json",
	array_of_statuses()
	),
	403 => Operation.response("Forbidden", "application/json", ApiError),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def array_of_statuses do
	%Schema{type: :array, items: Status, example: [Status.schema().example]}
	end

	defp create_request do
	%Schema{
	title: "StatusCreateRequest",
	type: :object,
	properties: %{
	status: %Schema{
	type: :string,
	nullable: true,
	description:
	"Text content of the status. If `media_ids` is provided, this becomes optional. Attaching a `poll` is optional while `status` is provided."
	},
	media_ids: %Schema{
	nullable: true,
	type: :array,
	items: %Schema{type: :string},
	description: "Array of Attachment ids to be attached as media."
	},
	poll: poll_params(),
	in_reply_to_id: %Schema{
	nullable: true,
	allOf: [FlakeID],
	description: "ID of the status being replied to, if status is a reply"
	},
	sensitive: %Schema{
	allOf: [BooleanLike],
	nullable: true,
	description: "Mark status and attached media as sensitive?"
	},
	spoiler_text: %Schema{
	type: :string,
	nullable: true,
	description:
	"Text to be shown as a warning or subject before the actual content. Statuses are generally collapsed behind this field."
	},
	scheduled_at: %Schema{
	type: :string,
	format: :"date-time",
	nullable: true,
	description:
	"ISO 8601 Datetime at which to schedule a status. Providing this parameter will cause ScheduledStatus to be returned instead of Status. Must be at least 5 minutes in the future."
	},
	language: %Schema{
	type: :string,
	nullable: true,
	description: "ISO 639 language code for this status."
	},
	visibility: %Schema{
	nullable: true,
	anyOf: [
	VisibilityScope,
	%Schema{type: :string, description: "`list:LIST_ID`", example: "LIST:123"}
	],
	description:
	"Visibility of the posted status. Besides standard MastoAPI values (`direct`, `private`, `unlisted` or `public`) it can be used to address a List by setting it to `list:LIST_ID`"
	},
	quoted_status_id: %Schema{
	nullable: true,
	allOf: [FlakeID],
	description: "ID of the status being quoted, if any"
	},
	# Pleroma-specific properties:
	preview: %Schema{
	allOf: [BooleanLike],
	nullable: true,
	description:
	"If set to `true` the post won't be actually posted, but the status entity would still be rendered back. This could be useful for previewing rich text/custom emoji, for example"
	},
	content_type: %Schema{
	type: :string,
	nullable: true,
	description:
	"The MIME type of the status, it is transformed into HTML by the backend. You can get the list of the supported MIME types with the nodeinfo endpoint."
	},
	to: %Schema{
	type: :array,
	nullable: true,
	items: %Schema{type: :string},
	description:
	"A list of nicknames (like `lain@soykaf.club` or `lain` on the local server) that will be used to determine who is going to be addressed by this post. Using this will disable the implicit addressing by mentioned names in the `status` body, only the people in the `to` list will be addressed. The normal rules for for post visibility are not affected by this and will still apply"
	},
	expires_in: %Schema{
	nullable: true,
	type: :integer,
	description:
	"The number of seconds the posted activity should expire in. When a posted activity expires it will be deleted from the server, and a delete request for it will be federated. This needs to be longer than an hour."
	},
	in_reply_to_conversation_id: %Schema{
	nullable: true,
	type: :string,
	description:
	"Will reply to a given conversation, addressing only the people who are part of the recipient set of that conversation. Sets the visibility to `direct`."
	},
	quote_id: %Schema{
	nullable: true,
	allOf: [FlakeID],
	description: "Deprecated in favor of `quoted_status_id`",
	deprecated: true
	}
	},
	example: %{
	"status" => "What time is it?",
	"sensitive" => "false",
	"poll" => %{
	"options" => ["Cofe", "Adventure"],
	"expires_in" => 420
	}
	}
	}
	end

	defp update_request do
	%Schema{
	title: "StatusUpdateRequest",
	type: :object,
	properties: %{
	status: %Schema{
	type: :string,
	nullable: true,
	description:
	"Text content of the status. If `media_ids` is provided, this becomes optional. Attaching a `poll` is optional while `status` is provided."
	},
	media_ids: %Schema{
	nullable: true,
	type: :array,
	items: %Schema{type: :string},
	description: "Array of Attachment ids to be attached as media."
	},
	poll: poll_params(),
	sensitive: %Schema{
	allOf: [BooleanLike],
	nullable: true,
	description: "Mark status and attached media as sensitive?"
	},
	spoiler_text: %Schema{
	type: :string,
	nullable: true,
	description:
	"Text to be shown as a warning or subject before the actual content. Statuses are generally collapsed behind this field."
	},
	content_type: %Schema{
	type: :string,
	nullable: true,
	description:
	"The MIME type of the status, it is transformed into HTML by the backend. You can get the list of the supported MIME types with the nodeinfo endpoint."
	},
	to: %Schema{
	type: :array,
	nullable: true,
	items: %Schema{type: :string},
	description:
	"A list of nicknames (like `lain@soykaf.club` or `lain` on the local server) that will be used to determine who is going to be addressed by this post. Using this will disable the implicit addressing by mentioned names in the `status` body, only the people in the `to` list will be addressed. The normal rules for for post visibility are not affected by this and will still apply"
	}
	},
	example: %{
	"status" => "What time is it?",
	"sensitive" => "false",
	"poll" => %{
	"options" => ["Cofe", "Adventure"],
	"expires_in" => 420
	}
	}
	}
	end

	def poll_params do
	%Schema{
	nullable: true,
	type: :object,
	required: [:options, :expires_in],
	properties: %{
	options: %Schema{
	type: :array,
	items: %Schema{type: :string},
	description: "Array of possible answers. Must be provided with `poll[expires_in]`."
	},
	expires_in: %Schema{
	type: :integer,
	nullable: true,
	description:
	"Duration the poll should be open, in seconds. Must be provided with `poll[options]`"
	},
	multiple: %Schema{
	allOf: [BooleanLike],
	nullable: true,
	description: "Allow multiple choices?"
	},
	hide_totals: %Schema{
	allOf: [BooleanLike],
	nullable: true,
	description: "Hide vote counts until the poll ends?"
	}
	}
	}
	end

	def id_param do
	Operation.parameter(:id, :path, FlakeID.schema(), "Status ID",
	example: "9umDrYheeY451cQnEe",
	required: true
	)
	end

	defp status_response do
	Operation.response("Status", "application/json", Status)
	end

	defp status_history_response do
	Operation.response(
	"Status History",
	"application/json",
	%Schema{
	title: "Status history",
	description: "Response schema for history of a status",
	type: :array,
	items: %Schema{
	type: :object,
	properties: %{
	account: %Schema{
	allOf: [Account],
	description: "The account that authored this status"
	},
	content: %Schema{
	type: :string,
	format: :html,
	description: "HTML-encoded status content"
	},
	sensitive: %Schema{
	type: :boolean,
	description: "Is this status marked as sensitive content?"
	},
	spoiler_text: %Schema{
	type: :string,
	description:
	"Subject or summary line, below which status content is collapsed until expanded"
	},
	created_at: %Schema{
	type: :string,
	format: "date-time",
	description: "The date when this status was created"
	},
	media_attachments: %Schema{
	type: :array,
	items: Attachment,
	description: "Media that is attached to this status"
	},
	emojis: %Schema{
	type: :array,
	items: Emoji,
	description: "Custom emoji to be used when rendering status content"
	},
	poll: %Schema{
	allOf: [Poll],
	nullable: true,
	description: "The poll attached to the status"
	}
	}
	}
	}
	)
	end

	defp status_source_response do
	Operation.response(
	"Status Source",
	"application/json",
	%Schema{
	type: :object,
	properties: %{
	id: FlakeID,
	text: %Schema{
	type: :string,
	description: "Raw source of status content"
	},
	spoiler_text: %Schema{
	type: :string,
	description:
	"Subject or summary line, below which status content is collapsed until expanded"
	},
	content_type: %Schema{
	type: :string,
	description: "The content type of the source"
	}
	}
	}
	)
	end

	defp context do
	%Schema{
	title: "StatusContext",
	description:
	"Represents the tree around a given status. Used for reconstructing threads of statuses.",
	type: :object,
	required: [:ancestors, :descendants],
	properties: %{
	ancestors: array_of_statuses(),
	descendants: array_of_statuses()
	},
	example: %{
	"ancestors" => [Status.schema().example],
	"descendants" => [Status.schema().example]
	}
	}
	end

	defp translation do
	%Schema{
	title: "StatusTranslation",
	description: "Represents status translation with related information.",
	type: :object,
	required: [:content, :detected_source_language, :provider],
	properties: %{
	content: %Schema{
	type: :string,
	description: "Translated status content"
	},
	detected_source_language: %Schema{
	type: :string,
	description: "Detected source language"
	},
	provider: %Schema{
	type: :string,
	description: "Translation provider service name"
	}
	},
	example: %{
	"content" => "Software für die nächste Generation der sozialen Medien.",
	"detected_source_language" => "en",
	"provider" => "Deepl"
	}
	}
	end
	end
	diff --git a/lib/pleroma/web/api_spec/schemas/api_not_found_error.ex b/lib/pleroma/web/api_spec/schemas/api_not_found_error.ex
	new file mode 100644
	index 000000000..48e7abdf8
	--- /dev/null
	+++ b/lib/pleroma/web/api_spec/schemas/api_not_found_error.ex
	@@ -0,0 +1,19 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.ApiSpec.Schemas.ApiNotFoundError do
	+ alias OpenApiSpex.Schema
	+
	+ require OpenApiSpex
	+
	+ OpenApiSpex.schema(%{
	+ title: "Not Found",
	+ description: "Response schema for 404 API errors",
	+ type: :object,
	+ properties: %{error: %Schema{type: :string}},
	+ example: %{
	+ "error" => "Record not found"
	+ }
	+ })
	+end
	diff --git a/lib/pleroma/web/common_api.ex b/lib/pleroma/web/common_api.ex
	index ae554d0b9..8e96ef5b6 100644
	--- a/lib/pleroma/web/common_api.ex
	+++ b/lib/pleroma/web/common_api.ex
	@@ -1,732 +1,783 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI do
	alias Pleroma.Activity
	alias Pleroma.Conversation.Participation
	alias Pleroma.Formatter
	alias Pleroma.ModerationLog
	alias Pleroma.Object
	alias Pleroma.Rule
	alias Pleroma.ThreadMute
	alias Pleroma.User
	alias Pleroma.UserRelationship
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI.ActivityDraft

	import Ecto.Query, only: [where: 3]
	import Pleroma.Web.Gettext
	import Pleroma.Web.CommonAPI.Utils

	require Pleroma.Constants
	require Logger

	@spec block(User.t(), User.t()) :: {:ok, Activity.t()} \| Pipeline.errors()
	def block(blocked, blocker, params \\ %{}) do
	with {:ok, block_data, meta} <- Builder.block(blocker, blocked, params),
	{:ok, block, _} <- Pipeline.common_pipeline(block_data, meta ++ [local: true]) do
	{:ok, block}
	end
	end

	@spec post_chat_message(User.t(), User.t(), String.t(), list()) ::
	{:ok, Activity.t()} \| Pipeline.errors()
	def post_chat_message(%User{} = user, %User{} = recipient, content, opts \\ []) do
	with maybe_attachment <- opts[:media_id] && Object.get_by_id(opts[:media_id]),
	:ok <- validate_chat_attachment_attribution(maybe_attachment, user),
	:ok <- validate_chat_content_length(content, !!maybe_attachment),
	{_, {:ok, chat_message_data, _meta}} <-
	{:build_object,
	Builder.chat_message(
	user,
	recipient.ap_id,
	content \|> format_chat_content,
	attachment: maybe_attachment
	)},
	{_, {:ok, create_activity_data, _meta}} <-
	{:build_create_activity, Builder.create(user, chat_message_data, [recipient.ap_id])},
	{_, {:ok, %Activity{} = activity, _meta}} <-
	{:common_pipeline,
	Pipeline.common_pipeline(create_activity_data,
	local: true,
	idempotency_key: opts[:idempotency_key]
	)} do
	{:ok, activity}
	else
	{:common_pipeline, e} -> e
	e -> e
	end
	end

	defp format_chat_content(nil), do: nil

	defp format_chat_content(content) do
	{text, _, _} =
	content
	\|> Formatter.html_escape("text/plain")
	\|> Formatter.linkify()
	\|> (fn {text, mentions, tags} ->
	{String.replace(text, ~r/\r?\n/, "<br>"), mentions, tags}
	end).()

	text
	end

	defp validate_chat_attachment_attribution(nil, _), do: :ok

	defp validate_chat_attachment_attribution(attachment, user) do
	with :ok <- Object.authorize_access(attachment, user) do
	:ok
	else
	e ->
	e
	end
	end

	defp validate_chat_content_length(_, true), do: :ok
	defp validate_chat_content_length(nil, false), do: {:error, :no_content}

	defp validate_chat_content_length(content, _) do
	if String.length(content) <= Pleroma.Config.get([:instance, :chat_limit]) do
	:ok
	else
	{:error, :content_too_long}
	end
	end

	@spec unblock(User.t(), User.t()) ::
	{:ok, Activity.t()} \| {:ok, :no_activity} \| Pipeline.errors() \| {:error, :not_blocking}
	def unblock(blocked, blocker) do
	with {_, %Activity{} = block} <- {:fetch_block, Utils.fetch_latest_block(blocker, blocked)},
	{:ok, unblock_data, _} <- Builder.undo(blocker, block),
	{:ok, unblock, _} <- Pipeline.common_pipeline(unblock_data, local: true) do
	{:ok, unblock}
	else
	{:fetch_block, nil} ->
	if User.blocks?(blocker, blocked) do
	User.unblock(blocker, blocked)
	{:ok, :no_activity}
	else
	{:error, :not_blocking}
	end

	e ->
	e
	end
	end

	@spec follow(User.t(), User.t()) ::
	{:ok, User.t(), User.t(), Activity.t() \| Object.t()}
	\| {:error, :rejected}
	\| Pipeline.errors()
	def follow(followed, follower) do
	timeout = Pleroma.Config.get([:activitypub, :follow_handshake_timeout])

	with {:ok, follow_data, _} <- Builder.follow(follower, followed),
	{:ok, activity, _} <- Pipeline.common_pipeline(follow_data, local: true),
	{:ok, follower, followed} <- User.wait_and_refresh(timeout, follower, followed) do
	if activity.data["state"] == "reject" do
	{:error, :rejected}
	else
	{:ok, followed, follower, activity}
	end
	end
	end

	@spec unfollow(User.t(), User.t()) :: {:ok, User.t()} \| {:error, any()}
	def unfollow(unfollowed, follower) do
	with {:ok, follower, _follow_activity} <- User.unfollow(follower, unfollowed),
	{:ok, _activity} <- ActivityPub.unfollow(follower, unfollowed),
	{:ok, _subscription} <- User.unsubscribe(follower, unfollowed),
	{:ok, _endorsement} <- User.unendorse(follower, unfollowed) do
	{:ok, follower}
	end
	end

	@spec accept_follow_request(User.t(), User.t()) :: {:ok, User.t()} \| Pipeline.errors()
	def accept_follow_request(follower, followed) do
	with %Activity{} = follow_activity <- Utils.fetch_latest_follow(follower, followed),
	{:ok, accept_data, _} <- Builder.accept(followed, follow_activity),
	{:ok, _activity, _} <- Pipeline.common_pipeline(accept_data, local: true) do
	{:ok, follower}
	end
	end

	@spec reject_follow_request(User.t(), User.t()) :: {:ok, User.t()} \| Pipeline.errors() \| nil
	def reject_follow_request(follower, followed) do
	with %Activity{} = follow_activity <- Utils.fetch_latest_follow(follower, followed),
	{:ok, reject_data, _} <- Builder.reject(followed, follow_activity),
	{:ok, _activity, _} <- Pipeline.common_pipeline(reject_data, local: true) do
	{:ok, follower}
	end
	end

	@spec delete(String.t(), User.t()) ::
	{:ok, Activity.t()} \| Pipeline.errors() \| {:error, :not_found \| String.t()}
	def delete(activity_id, user) do
	with {_, %Activity{data: %{"object" => _, "type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(activity_id, filter: [])},
	{_, {:ok, _}} <- {:cancel_jobs, maybe_cancel_jobs(activity)},
	{_, %Object{} = object, _} <-
	{:find_object, Object.normalize(activity, fetch: false), activity},
	true <- User.privileged?(user, :messages_delete) \|\| user.ap_id == object.data["actor"],
	{:ok, delete_data, _} <- Builder.delete(user, object.data["id"]),
	{:ok, delete, _} <- Pipeline.common_pipeline(delete_data, local: true) do
	if User.privileged?(user, :messages_delete) and user.ap_id != object.data["actor"] do
	action =
	if object.data["type"] == "ChatMessage" do
	"chat_message_delete"
	else
	"status_delete"
	end

	ModerationLog.insert_log(%{
	action: action,
	actor: user,
	subject_id: activity_id
	})
	end

	{:ok, delete}
	else
	{:find_activity, _} ->
	{:error, :not_found}

	{:find_object, nil, %Activity{data: %{"actor" => actor, "object" => object}}} ->
	# We have the create activity, but not the object, it was probably pruned.
	# Insert a tombstone and try again
	with {:ok, tombstone_data, _} <- Builder.tombstone(actor, object),
	{:ok, _tombstone} <- Object.create(tombstone_data) do
	delete(activity_id, user)
	else
	_ ->
	Logger.error(
	"Could not insert tombstone for missing object on deletion. Object is #{object}."
	)

	{:error, dgettext("errors", "Could not delete")}
	end

	_ ->
	{:error, dgettext("errors", "Could not delete")}
	end
	end

	@spec repeat(String.t(), User.t(), map()) :: {:ok, Activity.t()} \| {:error, :not_found}
	def repeat(id, user, params \\ %{}) do
	with %Activity{data: %{"type" => "Create"}} = activity <- Activity.get_by_id(id),
	object = %Object{} <- Object.normalize(activity, fetch: false),
	{_, nil} <- {:existing_announce, Utils.get_existing_announce(user.ap_id, object)},
	public = public_announce?(object, params),
	{:ok, announce, _} <- Builder.announce(user, object, public: public),
	{:ok, activity, _} <- Pipeline.common_pipeline(announce, local: true) do
	{:ok, activity}
	else
	{:existing_announce, %Activity{} = announce} ->
	{:ok, announce}

	_ ->
	{:error, :not_found}
	end
	end

	@spec unrepeat(String.t(), User.t()) :: {:ok, Activity.t()} \| {:error, :not_found \| String.t()}
	def unrepeat(id, user) do
	with {_, %Activity{data: %{"type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(id)},
	%Object{} = note <- Object.normalize(activity, fetch: false),
	%Activity{} = announce <- Utils.get_existing_announce(user.ap_id, note),
	{_, {:ok, _}} <- {:cancel_jobs, maybe_cancel_jobs(announce)},
	{:ok, undo, _} <- Builder.undo(user, announce),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	{:find_activity, _} -> {:error, :not_found}
	_ -> {:error, dgettext("errors", "Could not unrepeat")}
	end
	end

	@spec favorite(String.t(), User.t()) ::
	{:ok, Activity.t()} \| {:ok, :already_liked} \| {:error, :not_found \| String.t()}
	def favorite(id, %User{} = user) do
	case favorite_helper(user, id) do
	{:ok, _} = res ->
	res

	{:error, :not_found} = res ->
	res

	{:error, e} ->
	Logger.error("Could not favorite #{id}. Error: #{inspect(e, pretty: true)}")
	{:error, dgettext("errors", "Could not favorite")}
	end
	end

	defp favorite_helper(user, id) do
	with {_, %Activity{object: object}} <- {:find_object, Activity.get_by_id_with_object(id)},
	+ {_, true} <- {:visibility_error, activity_visible_to_actor(object, user)},
	{_, {:ok, like_object, meta}} <- {:build_object, Builder.like(user, object)},
	{_, {:ok, %Activity{} = activity, _meta}} <-
	{:common_pipeline,
	Pipeline.common_pipeline(like_object, Keyword.put(meta, :local, true))} do
	{:ok, activity}
	else
	{:find_object, _} ->
	{:error, :not_found}

	+ {:visibility_error, _} ->
	+ {:error, :not_found}
	+
	{:common_pipeline, {:error, {:validate, {:error, changeset}}}} = e ->
	if {:object, {"already liked by this actor", []}} in changeset.errors do
	{:ok, :already_liked}
	else
	{:error, e}
	end

	e ->
	{:error, e}
	end
	end

	@spec unfavorite(String.t(), User.t()) ::
	{:ok, Activity.t()} \| {:error, :not_found \| String.t()}
	def unfavorite(id, user) do
	with {_, %Activity{data: %{"type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(id)},
	%Object{} = note <- Object.normalize(activity, fetch: false),
	+ {_, true} <- {:visibility_error, activity_visible_to_actor(note, user)},
	%Activity{} = like <- Utils.get_existing_like(user.ap_id, note),
	{_, {:ok, _}} <- {:cancel_jobs, maybe_cancel_jobs(like)},
	{:ok, undo, _} <- Builder.undo(user, like),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	{:find_activity, _} -> {:error, :not_found}
	+ {:visibility_error, _} -> {:error, :not_found}
	_ -> {:error, dgettext("errors", "Could not unfavorite")}
	end
	end

	@spec react_with_emoji(String.t(), User.t(), String.t()) ::
	{:ok, Activity.t()} \| {:error, String.t()}
	def react_with_emoji(id, user, emoji) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	+ {_, true} <- {:visibility_error, activity_visible_to_actor(activity, user)},
	object <- Object.normalize(activity, fetch: false),
	{:ok, emoji_react, _} <- Builder.emoji_react(user, object, emoji),
	{:ok, activity, _} <- Pipeline.common_pipeline(emoji_react, local: true) do
	{:ok, activity}
	else
	+ {:visibility_error, _} ->
	+ {:error, :not_found}
	+
	_ ->
	{:error, dgettext("errors", "Could not add reaction emoji")}
	end
	end

	@spec unreact_with_emoji(String.t(), User.t(), String.t()) ::
	{:ok, Activity.t()} \| {:error, String.t()}
	def unreact_with_emoji(id, user, emoji) do
	with %Activity{} = reaction_activity <- Utils.get_latest_reaction(id, user, emoji),
	{_, {:ok, _}} <- {:cancel_jobs, maybe_cancel_jobs(reaction_activity)},
	{:ok, undo, _} <- Builder.undo(user, reaction_activity),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	_ ->
	{:error, dgettext("errors", "Could not remove reaction emoji")}
	end
	end

	@spec vote(Object.t(), User.t(), list()) :: {:ok, list(), Object.t()} \| Pipeline.errors()
	def vote(%Object{data: %{"type" => "Question"}} = object, %User{} = user, choices) do
	with :ok <- validate_not_author(object, user),
	:ok <- validate_existing_votes(user, object),
	{:ok, options, choices} <- normalize_and_validate_choices(choices, object) do
	answer_activities =
	Enum.map(choices, fn index ->
	{:ok, answer_object, _meta} =
	Builder.answer(user, object, Enum.at(options, index)["name"])

	{:ok, activity_data, _meta} = Builder.create(user, answer_object, [])

	{:ok, activity, _meta} =
	activity_data
	\|> Map.put("cc", answer_object["cc"])
	\|> Map.put("context", answer_object["context"])
	\|> Pipeline.common_pipeline(local: true)

	# TODO: Do preload of Pleroma.Object in Pipeline
	Activity.normalize(activity.data)
	end)

	object = Object.get_cached_by_ap_id(object.data["id"])
	{:ok, answer_activities, object}
	end
	end

	defp validate_not_author(%{data: %{"actor" => ap_id}}, %{ap_id: ap_id}),
	do: {:error, dgettext("errors", "Poll's author can't vote")}

	defp validate_not_author(_, _), do: :ok

	defp validate_existing_votes(%{ap_id: ap_id}, object) do
	if Utils.get_existing_votes(ap_id, object) == [] do
	:ok
	else
	{:error, dgettext("errors", "Already voted")}
	end
	end

	defp get_options_and_max_count(%{data: %{"anyOf" => any_of}})
	when is_list(any_of) and any_of != [],
	do: {any_of, Enum.count(any_of)}

	defp get_options_and_max_count(%{data: %{"oneOf" => one_of}})
	when is_list(one_of) and one_of != [],
	do: {one_of, 1}

	defp normalize_and_validate_choices(choices, object) do
	choices = Enum.map(choices, fn i -> if is_binary(i), do: String.to_integer(i), else: i end)
	{options, max_count} = get_options_and_max_count(object)
	count = Enum.count(options)

	with {_, true} <- {:valid_choice, Enum.all?(choices, &(&1 < count))},
	{_, true} <- {:count_check, Enum.count(choices) <= max_count} do
	{:ok, options, choices}
	else
	{:valid_choice, _} -> {:error, dgettext("errors", "Invalid indices")}
	{:count_check, _} -> {:error, dgettext("errors", "Too many choices")}
	end
	end

	defp public_announce?(_, %{visibility: visibility})
	when visibility in ~w{public unlisted private direct},
	do: visibility in ~w(public unlisted)

	defp public_announce?(object, _) do
	Visibility.public?(object)
	end

	@spec get_visibility(map(), map() \| nil, Participation.t() \| nil) ::
	{String.t() \| nil, String.t() \| nil}
	def get_visibility(_, _, %Participation{}), do: {"direct", "direct"}

	def get_visibility(%{visibility: visibility}, in_reply_to, _)
	when visibility in ~w{public local unlisted private direct},
	do: {visibility, get_replied_to_visibility(in_reply_to)}

	def get_visibility(%{visibility: "list:" <> list_id}, in_reply_to, _) do
	visibility = {:list, String.to_integer(list_id)}
	{visibility, get_replied_to_visibility(in_reply_to)}
	end

	def get_visibility(_, in_reply_to, _) when not is_nil(in_reply_to) do
	visibility = get_replied_to_visibility(in_reply_to)
	{visibility, visibility}
	end

	def get_visibility(_, in_reply_to, _), do: {"public", get_replied_to_visibility(in_reply_to)}

	@spec get_replied_to_visibility(Activity.t() \| nil) :: String.t() \| nil
	def get_replied_to_visibility(nil), do: nil

	def get_replied_to_visibility(activity) do
	with %Object{} = object <- Object.normalize(activity, fetch: false) do
	Visibility.get_visibility(object)
	end
	end

	@spec check_expiry_date({:ok, nil \| integer()} \| String.t()) ::
	{:ok, boolean() \| nil} \| {:error, String.t()}
	def check_expiry_date({:ok, nil} = res), do: res

	def check_expiry_date({:ok, in_seconds}) do
	expiry = DateTime.add(DateTime.utc_now(), in_seconds)

	if Pleroma.Workers.PurgeExpiredActivity.expires_late_enough?(expiry) do
	{:ok, expiry}
	else
	{:error, "Expiry date is too soon"}
	end
	end

	def check_expiry_date(expiry_str) do
	Ecto.Type.cast(:integer, expiry_str)
	\|> check_expiry_date()
	end

	@spec listen(User.t(), map()) :: {:ok, Activity.t()} \| {:error, any()}
	def listen(user, data) do
	with {:ok, draft} <- ActivityDraft.listen(user, data) do
	ActivityPub.listen(draft.changes)
	end
	end

	@spec post(User.t(), map()) :: {:ok, Activity.t()} \| {:error, any()}
	def post(user, %{status: _} = data) do
	with {:ok, draft} <- ActivityDraft.create(user, data) do
	ActivityPub.create(draft.changes, draft.preview?)
	end
	end

	@spec update(Activity.t(), User.t(), map()) :: {:ok, Activity.t()} \| {:error, nil}
	def update(orig_activity, %User{} = user, changes) do
	with orig_object <- Object.normalize(orig_activity),
	{:ok, new_object} <- make_update_data(user, orig_object, changes),
	{:ok, update_data, _} <- Builder.update(user, new_object),
	{:ok, update, _} <- Pipeline.common_pipeline(update_data, local: true) do
	{:ok, update}
	else
	_ -> {:error, nil}
	end
	end

	defp make_update_data(user, orig_object, changes) do
	kept_params = %{
	visibility: Visibility.get_visibility(orig_object),
	in_reply_to_id:
	with replied_id when is_binary(replied_id) <- orig_object.data["inReplyTo"],
	%Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(replied_id) do
	activity_id
	else
	_ -> nil
	end
	}

	params = Map.merge(changes, kept_params)

	with {:ok, draft} <- ActivityDraft.create(user, params) do
	change =
	Object.Updater.make_update_object_data(orig_object.data, draft.object, Utils.make_date())

	{:ok, change}
	else
	_ -> {:error, nil}
	end
	end

	@spec pin(String.t(), User.t()) :: {:ok, Activity.t()} \| Pipeline.errors()
	def pin(id, %User{} = user) do
	with %Activity{} = activity <- create_activity_by_id(id),
	+ true <- activity_visible_to_actor(activity, user),
	true <- activity_belongs_to_actor(activity, user.ap_id),
	true <- object_type_is_allowed_for_pin(activity.object),
	true <- activity_is_public(activity),
	{:ok, pin_data, _} <- Builder.pin(user, activity.object),
	{:ok, _pin, _} <-
	Pipeline.common_pipeline(pin_data,
	local: true,
	activity_id: id
	) do
	{:ok, activity}
	else
	{:error, {:side_effects, error}} -> error
	error -> error
	end
	end

	defp create_activity_by_id(id) do
	with nil <- Activity.create_by_id_with_object(id) do
	{:error, :not_found}
	end
	end

	defp activity_belongs_to_actor(%{actor: actor}, actor), do: true
	defp activity_belongs_to_actor(_, _), do: {:error, :ownership_error}

	+ defp activity_visible_to_actor(activity, %User{} = user) do
	+ if Visibility.visible_for_user?(activity, user) do
	+ true
	+ else
	+ {:error, :visibility_error}
	+ end
	+ end
	+
	defp object_type_is_allowed_for_pin(%{data: %{"type" => type}}) do
	with false <- type in ["Note", "Article", "Question"] do
	{:error, :not_allowed}
	end
	end

	defp activity_is_public(activity) do
	with false <- Visibility.public?(activity) do
	- {:error, :visibility_error}
	+ {:error, :non_public_error}
	end
	end

	@spec unpin(String.t(), User.t()) :: {:ok, Activity.t()} \| Pipeline.errors()
	def unpin(id, user) do
	+ # Order of visibility/belonging matters for MastoAPI responses.
	+ # post not visible -> 404
	+ # post visible, not owned -> 422
	with %Activity{} = activity <- create_activity_by_id(id),
	+ true <- activity_visible_to_actor(activity, user),
	+ true <- activity_belongs_to_actor(activity, user.ap_id),
	{:ok, unpin_data, _} <- Builder.unpin(user, activity.object),
	{:ok, _unpin, _} <-
	Pipeline.common_pipeline(unpin_data,
	local: true,
	activity_id: activity.id,
	expires_at: activity.data["expires_at"],
	featured_address: user.featured_address
	) do
	{:ok, activity}
	end
	end

	@spec add_mute(Activity.t(), User.t(), map()) :: {:ok, Activity.t()} \| {:error, String.t()}
	def add_mute(activity, user, params \\ %{}) do
	expires_in = Map.get(params, :expires_in, 0)

	- with {:ok, _} <- ThreadMute.add_mute(user.id, activity.data["context"]),
	+ with true <- activity_visible_to_actor(activity, user),
	+ {:ok, _} <- ThreadMute.add_mute(user.id, activity.data["context"]),
	_ <- Pleroma.Notification.mark_context_as_read(user, activity.data["context"]) do
	if expires_in > 0 do
	Pleroma.Workers.MuteExpireWorker.new(
	%{"op" => "unmute_conversation", "user_id" => user.id, "activity_id" => activity.id},
	schedule_in: expires_in
	)
	\|> Oban.insert()
	end

	{:ok, activity}
	else
	+ {:error, :visibility_error} -> {:error, :visibility_error}
	{:error, _} -> {:error, dgettext("errors", "conversation is already muted")}
	end
	end

	@spec remove_mute(Activity.t(), User.t()) :: {:ok, Activity.t()} \| {:error, any()}
	def remove_mute(%Activity{} = activity, %User{} = user) do
	- ThreadMute.remove_mute(user.id, activity.data["context"])
	- {:ok, activity}
	+ case activity_visible_to_actor(activity, user) do
	+ true ->
	+ ThreadMute.remove_mute(user.id, activity.data["context"])
	+ {:ok, activity}
	+
	+ error ->
	+ error
	+ end
	end

	@spec remove_mute(String.t(), String.t()) :: {:ok, Activity.t()} \| {:error, any()}
	def remove_mute(activity_id, user_id) do
	with {:user, %User{} = user} <- {:user, User.get_by_id(user_id)},
	{:activity, %Activity{} = activity} <- {:activity, Activity.get_by_id(activity_id)} do
	remove_mute(activity, user)
	else
	{what, result} = error ->
	Logger.warning(
	"CommonAPI.remove_mute/2 failed. #{what}: #{result}, user_id: #{user_id}, activity_id: #{activity_id}"
	)

	{:error, error}
	end
	end

	@spec thread_muted?(Activity.t(), User.t()) :: boolean()
	def thread_muted?(%{data: %{"context" => context}}, %User{id: user_id})
	when is_binary(context) do
	ThreadMute.exists?(user_id, context)
	end

	def thread_muted?(_, _), do: false

	@spec report(User.t(), map()) :: {:ok, Activity.t()} \| {:error, any()}
	def report(user, data) do
	with {:ok, account} <- get_reported_account(data.account_id),
	{:ok, {content_html, _, _}} <- make_report_content_html(data[:comment]),
	{:ok, statuses} <- get_report_statuses(account, data),
	+ true <- check_statuses_visibility(user, statuses),
	rules <- get_report_rules(Map.get(data, :rule_ids, nil)) do
	ActivityPub.flag(%{
	context: Utils.generate_context_id(),
	actor: user,
	account: account,
	statuses: statuses,
	content: content_html,
	forward: Map.get(data, :forward, false),
	rules: rules
	})
	+ else
	+ false ->
	+ {:error, :visibility_error}
	+
	+ error ->
	+ error
	end
	end

	+ defp check_statuses_visibility(user, statuses) when is_list(statuses) do
	+ visibility = for status <- statuses, do: Visibility.visible_for_user?(status, user)
	+
	+ case Enum.all?(visibility) do
	+ true -> true
	+ _ -> false
	+ end
	+ end
	+
	+ # There are no statuses associated with the report, pass!
	+ defp check_statuses_visibility(_, status) when status == nil, do: true
	+
	defp get_reported_account(account_id) do
	case User.get_cached_by_id(account_id) do
	%User{} = account -> {:ok, account}
	_ -> {:error, dgettext("errors", "Account not found")}
	end
	end

	defp get_report_rules(nil) do
	nil
	end

	defp get_report_rules(rule_ids) do
	rule_ids
	\|> Enum.filter(&Rule.exists?/1)
	end

	@spec update_report_state(String.t() \| [String.t()], String.t()) ::
	{:ok, any()} \| {:error, any()}
	def update_report_state(activity_ids, state) when is_list(activity_ids) do
	case Utils.update_report_state(activity_ids, state) do
	:ok -> {:ok, activity_ids}
	_ -> {:error, dgettext("errors", "Could not update state")}
	end
	end

	def update_report_state(activity_id, state) do
	with %Activity{} = activity <- Activity.get_by_id(activity_id, filter: []) do
	Utils.update_report_state(activity, state)
	else
	nil -> {:error, :not_found}
	end
	end

	@spec update_activity_scope(String.t(), map()) :: {:ok, any()} \| {:error, any()}
	def update_activity_scope(activity_id, opts \\ %{}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
	{:ok, activity} <- toggle_sensitive(activity, opts) do
	set_visibility(activity, opts)
	else
	nil -> {:error, :not_found}
	end
	end

	defp toggle_sensitive(activity, %{sensitive: sensitive}) when sensitive in ~w(true false) do
	toggle_sensitive(activity, %{sensitive: String.to_existing_atom(sensitive)})
	end

	defp toggle_sensitive(%Activity{object: object} = activity, %{sensitive: sensitive})
	when is_boolean(sensitive) do
	new_data = Map.put(object.data, "sensitive", sensitive)

	{:ok, object} =
	object
	\|> Object.change(%{data: new_data})
	\|> Object.update_and_set_cache()

	{:ok, Map.put(activity, :object, object)}
	end

	defp toggle_sensitive(activity, _), do: {:ok, activity}

	defp set_visibility(activity, %{visibility: visibility}) do
	Utils.update_activity_visibility(activity, visibility)
	end

	defp set_visibility(activity, _), do: {:ok, activity}

	@spec hide_reblogs(User.t(), User.t()) :: {:ok, any()} \| {:error, any()}
	def hide_reblogs(%User{} = target, %User{} = user) do
	UserRelationship.create_reblog_mute(user, target)
	end

	@spec show_reblogs(User.t(), User.t()) :: {:ok, any()} \| {:error, any()}
	def show_reblogs(%User{} = target, %User{} = user) do
	UserRelationship.delete_reblog_mute(user, target)
	end

	@spec get_user(String.t(), boolean()) :: User.t() \| nil
	def get_user(ap_id, fake_record_fallback \\ true) do
	cond do
	user = User.get_cached_by_ap_id(ap_id) ->
	user

	user = User.get_by_guessed_nickname(ap_id) ->
	user

	fake_record_fallback ->
	# TODO: refactor (fake records is never a good idea)
	User.error_user(ap_id)

	true ->
	nil
	end
	end

	defp maybe_cancel_jobs(%Activity{id: activity_id}) do
	Oban.Job
	\|> where([j], j.worker == "Pleroma.Workers.PublisherWorker")
	\|> where([j], j.args["op"] == "publish_one")
	\|> where([j], j.args["params"]["activity_id"] == ^activity_id)
	\|> Oban.cancel_all_jobs()
	end

	defp maybe_cancel_jobs(_), do: {:ok, 0}
	end
	diff --git a/lib/pleroma/web/common_api/activity_draft.ex b/lib/pleroma/web/common_api/activity_draft.ex
	index 8c7e42f3c..c0b98508c 100644
	--- a/lib/pleroma/web/common_api/activity_draft.ex
	+++ b/lib/pleroma/web/common_api/activity_draft.ex
	@@ -1,356 +1,368 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI.ActivityDraft do
	alias Pleroma.Activity
	alias Pleroma.Conversation.Participation
	alias Pleroma.Language.LanguageDetector
	alias Pleroma.Object
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.CommonAPI.Utils

	import Pleroma.EctoType.ActivityPub.ObjectValidators.LanguageCode,
	only: [good_locale_code?: 1]

	import Pleroma.Web.Gettext
	import Pleroma.Web.Utils.Guards, only: [not_empty_string: 1]

	@type t :: %__MODULE__{}

	defstruct valid?: true,
	errors: [],
	user: nil,
	params: %{},
	status: nil,
	summary: nil,
	full_payload: nil,
	attachments: [],
	in_reply_to: nil,
	in_reply_to_conversation: nil,
	quote_post: nil,
	visibility: nil,
	expires_at: nil,
	extra: nil,
	emoji: %{},
	content_html: nil,
	mentions: [],
	tags: [],
	to: [],
	cc: [],
	context: nil,
	sensitive: false,
	language: nil,
	object: nil,
	preview?: false,
	changes: %{}

	def new(user, params) do
	%__MODULE__{user: user}
	\|> put_params(params)
	end

	def create(user, params) do
	user
	\|> new(params)
	\|> status()
	\|> summary()
	\|> with_valid(&attachments/1)
	\|> full_payload()
	\|> expires_at()
	\|> poll()
	\|> with_valid(&in_reply_to/1)
	\|> with_valid(&in_reply_to_conversation/1)
	\|> with_valid(&quote_post/1)
	\|> with_valid(&visibility/1)
	\|> with_valid(&quoting_visibility/1)
	\|> content()
	\|> with_valid(&to_and_cc/1)
	\|> with_valid(&context/1)
	\|> with_valid(&language/1)
	\|> sensitive()
	\|> with_valid(&object/1)
	\|> preview?()
	\|> with_valid(&changes/1)
	\|> validate()
	end

	def listen(user, params) do
	user
	\|> new(params)
	\|> visibility()
	\|> to_and_cc()
	\|> context()
	\|> listen_object()
	\|> with_valid(&changes/1)
	\|> validate()
	end

	defp listen_object(draft) do
	object =
	draft.params
	\|> Map.take([:album, :artist, :title, :length])
	\|> Map.put(:externalLink, Map.get(draft.params, :external_link))
	\|> Map.new(fn {key, value} -> {to_string(key), value} end)
	\|> Map.put("type", "Audio")
	\|> Map.put("to", draft.to)
	\|> Map.put("cc", draft.cc)
	\|> Map.put("actor", draft.user.ap_id)

	%__MODULE__{draft \| object: object}
	end

	defp put_params(draft, params) do
	params = Map.put_new(params, :in_reply_to_status_id, params[:in_reply_to_id])
	%__MODULE__{draft \| params: params}
	end

	defp status(%{params: %{status: status}} = draft) do
	%__MODULE__{draft \| status: String.trim(status)}
	end

	defp summary(%{params: params} = draft) do
	%__MODULE__{draft \| summary: Map.get(params, :spoiler_text, "")}
	end

	defp full_payload(%{status: status, summary: summary} = draft) do
	full_payload = String.trim(status <> summary)

	case Utils.validate_character_limit(full_payload, draft.attachments) do
	:ok -> %__MODULE__{draft \| full_payload: full_payload}
	{:error, message} -> add_error(draft, message)
	end
	end

	defp attachments(%{params: params} = draft) do
	attachments = Utils.attachments_from_ids(params, draft.user)
	draft = %__MODULE__{draft \| attachments: attachments}

	case Utils.validate_attachments_count(attachments) do
	:ok -> draft
	{:error, message} -> add_error(draft, message)
	end
	end

	defp in_reply_to(%{params: %{in_reply_to_status_id: ""}} = draft), do: draft

	- defp in_reply_to(%{params: %{in_reply_to_status_id: :deleted}} = draft) do
	- add_error(draft, dgettext("errors", "Cannot reply to a deleted status"))
	- end
	-
	- defp in_reply_to(%{params: %{in_reply_to_status_id: id} = params} = draft) when is_binary(id) do
	- activity = Activity.get_by_id(id)
	-
	- params =
	- if is_nil(activity) do
	- # Deleted activities are returned as nil
	- Map.put(params, :in_reply_to_status_id, :deleted)
	- else
	- Map.put(params, :in_reply_to_status_id, activity)
	- end
	-
	- in_reply_to(%{draft \| params: params})
	+ defp in_reply_to(%{params: %{in_reply_to_status_id: id}} = draft) when is_binary(id) do
	+ # If a post was deleted all its activities (except the newly added Delete) are purged too,
	+ # thus lookup by Create db ID will yield nil just as if it never existed in the first place.
	+ #
	+ # We allow replying to Announce here, due to a Pleroma-FE quirk where if presented with
	+ # an Announce id it will render it as if it was just the normal referenced post, but
	+ # use the Announce id for replies in the in_reply_to_id key of a POST request to
	+ # /api/v1/statuses, or as an :id in /api/v1/statuses/:id/*.
	+ # TODO: Fix this quirk in FE and remove here and other affected places
	+ with %Activity{} = activity <- Activity.get_by_id(id),
	+ true <- Visibility.visible_for_user?(activity, draft.user),
	+ {_, type} when type in ["Create", "Announce"] <- {:type, activity.data["type"]} do
	+ %__MODULE__{draft \| in_reply_to: activity}
	+ else
	+ nil ->
	+ add_error(draft, dgettext("errors", "Cannot reply to a deleted status"))
	+
	+ false ->
	+ add_error(draft, dgettext("errors", "Record not found"))
	+
	+ {:type, type} ->
	+ add_error(
	+ draft,
	+ dgettext("errors", "Can only reply to posts, not %{type} activities",
	+ type: inspect(type)
	+ )
	+ )
	+ end
	end

	defp in_reply_to(%{params: %{in_reply_to_status_id: %Activity{} = in_reply_to}} = draft) do
	%__MODULE__{draft \| in_reply_to: in_reply_to}
	end

	defp in_reply_to(draft), do: draft

	defp quote_post(%{params: %{quoted_status_id: id}} = draft) when not_empty_string(id) do
	case Activity.get_by_id_with_object(id) do
	%Activity{} = activity ->
	%__MODULE__{draft \| quote_post: activity}

	_ ->
	draft
	end
	end

	defp quote_post(%{params: %{quote_id: id}} = draft) when not_empty_string(id) do
	quote_post(%{draft \| params: Map.put(draft.params, :quoted_status_id, id)})
	end

	defp quote_post(draft), do: draft

	defp in_reply_to_conversation(draft) do
	in_reply_to_conversation = Participation.get(draft.params[:in_reply_to_conversation_id])
	%__MODULE__{draft \| in_reply_to_conversation: in_reply_to_conversation}
	end

	defp visibility(%{params: params} = draft) do
	case CommonAPI.get_visibility(params, draft.in_reply_to, draft.in_reply_to_conversation) do
	{visibility, "direct"} when visibility != "direct" ->
	add_error(draft, dgettext("errors", "The message visibility must be direct"))

	{visibility, _} ->
	%__MODULE__{draft \| visibility: visibility}
	end
	end

	defp can_quote?(_draft, _object, visibility) when visibility in ~w(public unlisted local) do
	true
	end

	defp can_quote?(draft, object, "private") do
	draft.user.ap_id == object.data["actor"]
	end

	defp can_quote?(_, _, _) do
	false
	end

	defp quoting_visibility(%{quote_post: %Activity{}} = draft) do
	with %Object{} = object <- Object.normalize(draft.quote_post, fetch: false),
	true <- can_quote?(draft, object, Visibility.get_visibility(object)) do
	draft
	else
	_ -> add_error(draft, dgettext("errors", "Cannot quote private message"))
	end
	end

	defp quoting_visibility(draft), do: draft

	defp expires_at(draft) do
	case CommonAPI.check_expiry_date(draft.params[:expires_in]) do
	{:ok, expires_at} -> %__MODULE__{draft \| expires_at: expires_at}
	{:error, message} -> add_error(draft, message)
	end
	end

	defp poll(draft) do
	case Utils.make_poll_data(draft.params) do
	{:ok, {poll, poll_emoji}} ->
	%__MODULE__{draft \| extra: poll, emoji: Map.merge(draft.emoji, poll_emoji)}

	{:error, message} ->
	add_error(draft, message)
	end
	end

	defp content(%{mentions: mentions} = draft) do
	{content_html, mentioned_users, tags} = Utils.make_content_html(draft)

	mentioned_ap_ids =
	Enum.map(mentioned_users, fn {_, mentioned_user} -> mentioned_user.ap_id end)

	mentions =
	mentions
	\|> Kernel.++(mentioned_ap_ids)
	\|> Utils.get_addressed_users(draft.params[:to])

	%__MODULE__{draft \| content_html: content_html, mentions: mentions, tags: tags}
	end

	defp to_and_cc(draft) do
	{to, cc} = Utils.get_to_and_cc(draft)
	%__MODULE__{draft \| to: to, cc: cc}
	end

	defp context(draft) do
	context = Utils.make_context(draft.in_reply_to, draft.in_reply_to_conversation)
	%__MODULE__{draft \| context: context}
	end

	defp sensitive(draft) do
	sensitive = draft.params[:sensitive]
	%__MODULE__{draft \| sensitive: sensitive}
	end

	defp language(draft) do
	language =
	with language <- draft.params[:language],
	true <- good_locale_code?(language) do
	language
	else
	_ -> LanguageDetector.detect(draft.content_html <> " " <> draft.summary)
	end

	%__MODULE__{draft \| language: language}
	end

	defp object(draft) do
	emoji = Map.merge(Pleroma.Emoji.Formatter.get_emoji_map(draft.full_payload), draft.emoji)

	# Sometimes people create posts with subject containing emoji,
	# since subjects are usually copied this will result in a broken
	# subject when someone replies from an instance that does not have
	# the emoji or has it under different shortcode. This is an attempt
	# to mitigate this by copying emoji from inReplyTo if they are present
	# in the subject.
	summary_emoji =
	with %Activity{} <- draft.in_reply_to,
	%Object{data: %{"tag" => [_ \| _] = tag}} <- Object.normalize(draft.in_reply_to) do
	Enum.reduce(tag, %{}, fn
	%{"type" => "Emoji", "name" => name, "icon" => %{"url" => url}}, acc ->
	if String.contains?(draft.summary, name) do
	Map.put(acc, name, url)
	else
	acc
	end

	_, acc ->
	acc
	end)
	else
	_ -> %{}
	end

	emoji = Map.merge(emoji, summary_emoji)

	{:ok, note_data, _meta} = Builder.note(draft)

	object =
	note_data
	\|> Map.put("emoji", emoji)
	\|> Map.put("source", %{
	"content" => draft.status,
	"mediaType" => Utils.get_content_type(draft.params[:content_type])
	})
	\|> Map.put("generator", draft.params[:generator])
	\|> Map.put("language", draft.language)

	%__MODULE__{draft \| object: object}
	end

	defp preview?(draft) do
	preview? = Pleroma.Web.Utils.Params.truthy_param?(draft.params[:preview])
	%__MODULE__{draft \| preview?: preview?}
	end

	defp changes(draft) do
	direct? = draft.visibility == "direct"
	additional = %{"cc" => draft.cc, "directMessage" => direct?}

	additional =
	case draft.expires_at do
	%DateTime{} = expires_at -> Map.put(additional, "expires_at", expires_at)
	_ -> additional
	end

	changes =
	%{
	to: draft.to,
	actor: draft.user,
	context: draft.context,
	object: draft.object,
	additional: additional
	}
	\|> Utils.maybe_add_list_data(draft.user, draft.visibility)

	%__MODULE__{draft \| changes: changes}
	end

	defp with_valid(%{valid?: true} = draft, func), do: func.(draft)
	defp with_valid(draft, _func), do: draft

	defp add_error(draft, message) do
	%__MODULE__{draft \| valid?: false, errors: [message \| draft.errors]}
	end

	defp validate(%{valid?: true} = draft), do: {:ok, draft}
	defp validate(%{errors: [message \| _]}), do: {:error, message}
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/report_controller.ex b/lib/pleroma/web/mastodon_api/controllers/report_controller.ex
	index 3db80d728..e3496cac0 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/report_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/report_controller.ex
	@@ -1,21 +1,27 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.ReportController do
	use Pleroma.Web, :controller

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	plug(Pleroma.Web.ApiSpec.CastAndValidate)
	plug(Pleroma.Web.Plugs.OAuthScopesPlug, %{scopes: ["write:reports"]} when action == :create)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ReportOperation

	@doc "POST /api/v1/reports"
	def create(%{assigns: %{user: user}, body_params: params} = conn, _) do
	with {:ok, activity} <- Pleroma.Web.CommonAPI.report(user, params) do
	render(conn, "show.json", activity: activity)
	+ else
	+ {:error, :visibility_error} ->
	+ {:error, :not_found, "Record not found"}
	+
	+ error ->
	+ error
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	index 5b2cd50bc..db2b61b3c 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	@@ -1,685 +1,731 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.StatusController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [try_render: 3, add_link_headers: 2]

	require Ecto.Query
	require Pleroma.Constants

	alias Pleroma.Activity
	alias Pleroma.Bookmark
	alias Pleroma.BookmarkFolder
	alias Pleroma.Language.Translation
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.ScheduledActivityView
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter

	plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(:skip_public_check when action in [:index, :show])

	@unauthenticated_access %{fallback: :proceed_unauthenticated, scopes: []}

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:statuses"]}
	when action in [
	:index,
	:show,
	:context,
	:show_history,
	:show_source,
	:quotes
	]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:statuses"]} when action == :translate)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:statuses"]}
	when action in [
	:create,
	:delete,
	:reblog,
	:unreblog,
	:update
	]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:favourites"]} when action == :favourites)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:favourites"]} when action in [:favourite, :unfavourite]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:mutes"]} when action in [:mute_conversation, :unmute_conversation]
	)

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:accounts"]}
	when action in [:favourited_by, :reblogged_by]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action in [:pin, :unpin])

	# Note: scope not present in Mastodon: read:bookmarks
	plug(OAuthScopesPlug, %{scopes: ["read:bookmarks"]} when action == :bookmarks)

	# Note: scope not present in Mastodon: write:bookmarks
	plug(
	OAuthScopesPlug,
	%{scopes: ["write:bookmarks"]} when action in [:bookmark, :unbookmark]
	)

	@rate_limited_status_actions ~w(reblog unreblog favourite unfavourite create delete translate)a

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: [:id]]
	when action in ~w(reblog unreblog)a
	)

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:fav_unfav", params: [:id]]
	when action in ~w(favourite unfavourite)a
	)

	plug(RateLimiter, [name: :statuses_actions] when action in @rate_limited_status_actions)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.StatusOperation

	@doc """
	GET `/api/v1/statuses?ids[]=1&ids[]=2`

	`ids` query param is required
	"""
	def index(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} =
	conn,
	_
	) do
	ids = Map.get(params, :id, Map.get(params, :ids))
	limit = 100

	activities =
	ids
	\|> Enum.take(limit)
	\|> Activity.all_by_ids_with_object()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))

	render(conn, "index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	end

	@doc """
	POST /api/v1/statuses
	"""
	# Creates a scheduled status when `scheduled_at` param is present and it's far enough
	def create(
	%{
	assigns: %{user: user},
	private: %{
	open_api_spex: %{body_params: %{status: _, scheduled_at: scheduled_at} = params}
	}
	} = conn,
	_
	)
	when not is_nil(scheduled_at) do
	params =
	Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	\|> put_application(conn)

	attrs = %{
	params: Map.new(params, fn {key, value} -> {to_string(key), value} end),
	scheduled_at: scheduled_at
	}

	with {:far_enough, true} <- {:far_enough, ScheduledActivity.far_enough?(scheduled_at)},
	{:ok, scheduled_activity} <- ScheduledActivity.create(user, attrs) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", scheduled_activity: scheduled_activity)
	else
	{:far_enough, _} ->
	params = Map.drop(params, [:scheduled_at])

	put_in(
	conn,
	[Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
	params
	)
	\|> do_create

	error ->
	error
	end
	end

	# Creates a regular status
	def create(
	%{
	private: %{open_api_spex: %{body_params: %{status: _}}}
	} = conn,
	_
	) do
	do_create(conn)
	end

	def create(
	%{
	assigns: %{user: _user},
	private: %{open_api_spex: %{body_params: %{media_ids: _} = params}}
	} = conn,
	_
	) do
	params = Map.put(params, :status, "")

	put_in(
	conn,
	[Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
	params
	)
	\|> do_create
	end

	defp do_create(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn
	) do
	params =
	Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	\|> put_application(conn)

	with {:ok, activity} <- CommonAPI.post(user, params) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	as: :activity,
	with_direct_conversation_id: true
	)
	else
	{:error, {:reject, message}} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	@doc "GET /api/v1/statuses/:id/history"
	def show_history(
	%{assigns: assigns, private: %{open_api_spex: %{params: %{id: id} = params}}} = conn,
	_
	) do
	with user = assigns[:user],
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "history.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "GET /api/v1/statuses/:id/source"
	def show_source(%{assigns: assigns, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with user = assigns[:user],
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "source.json",
	activity: activity,
	for: user
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "PUT /api/v1/statuses/:id"
	def update(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: body_params, params: %{id: id} = params}}
	} = conn,
	_
	) do
	with {_, %Activity{}} = {_, activity} <- {:activity, Activity.get_by_id_with_object(id)},
	{_, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	{_, true} <- {:is_create, activity.data["type"] == "Create"},
	actor <- Activity.user_actor(activity),
	{_, true} <- {:own_status, actor.id == user.id},
	changes <- body_params \|> put_application(conn),
	{_, {:ok, _update_activity}} <- {:pipeline, CommonAPI.update(activity, user, changes)},
	{_, %Activity{}} = {_, activity} <- {:refetched, Activity.get_by_id_with_object(id)} do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	{:own_status, _} -> {:error, :forbidden}
	{:pipeline, _} -> {:error, :internal_server_error}
	_ -> {:error, :not_found}
	end
	end

	@doc "GET /api/v1/statuses/:id"
	def show(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id} = params}}} =
	conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "DELETE /api/v1/statuses/:id"
	def delete(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	+ # CommonAPI already checks whether user is allowed to delete
	{:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_source: true
	)
	else
	_e -> {:error, :not_found}
	end
	end

	@doc "POST /api/v1/statuses/:id/reblog"
	def reblog(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: params, params: %{id: ap_id_or_id}}}
	} = conn,
	_
	) do
	with {:ok, announce} <- CommonAPI.repeat(ap_id_or_id, user, params),
	+ # CommonAPI already checks whether user is allowed to reblog
	%Activity{} = announce <- Activity.normalize(announce.data) do
	try_render(conn, "show.json", %{activity: announce, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/unreblog"
	def unreblog(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	conn,
	_
	) do
	with {:ok, _unannounce} <- CommonAPI.unrepeat(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", %{activity: activity, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/favourite"
	def favourite(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	conn,
	_
	) do
	with {:ok, _fav} <- CommonAPI.favorite(activity_id, user),
	+ # CommonAPI already checks whether user is allowed to reblog
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unfavourite"
	def unfavourite(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	conn,
	_
	) do
	with {:ok, _unfav} <- CommonAPI.unfavorite(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/pin"
	def pin(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
	conn,
	_
	) do
	with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	+ # Order matters, if status is not owned by user and is not visible to user
	+ # return 404 just like other endpoints
	{:error, :pinned_statuses_limit_reached} ->
	{:error, "You have already pinned the maximum number of statuses"}

	{:error, :ownership_error} ->
	{:error, :unprocessable_entity, "Someone else's status cannot be pinned"}

	{:error, :visibility_error} ->
	+ {:error, :not_found, "Record not found"}
	+
	+ {:error, :non_public_error} ->
	{:error, :unprocessable_entity, "Non-public status cannot be pinned"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/unpin"
	def unpin(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
	conn,
	_
	) do
	+ # CommonAPI already checks whether user can unpin
	with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	+ else
	+ # Order matters, if status is not owned by user and is not visible to user
	+ # return 404 just like other endpoints
	+ {:error, :visibility_error} ->
	+ {:error, :not_found, "Record not found"}
	+
	+ {:error, :ownership_error} ->
	+ {:error, :unprocessable_entity, "Someone else's status cannot be unpinned"}
	+
	+ error ->
	+ error
	end
	end

	@doc "POST /api/v1/statuses/:id/bookmark"
	def bookmark(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: body_params, params: %{id: id}}}
	} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	folder_id <- Map.get(body_params, :folder_id, nil),
	folder_id <-
	if(folder_id && BookmarkFolder.belongs_to_user?(folder_id, user.id),
	do: folder_id,
	else: nil
	),
	{:ok, _bookmark} <- Bookmark.create(user.id, activity.id, folder_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	+ else
	+ false ->
	+ {:error, :not_found, "Record not found"}
	+
	+ error ->
	+ error
	end
	end

	@doc "POST /api/v1/statuses/:id/unbookmark"
	def unbookmark(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.destroy(user.id, activity.id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	+ else
	+ false ->
	+ {:error, :not_found, "Record not found"}
	+
	+ error ->
	+ error
	end
	end

	@doc "POST /api/v1/statuses/:id/mute"
	def mute_conversation(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: params, params: %{id: id}}}
	} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	+ # CommonAPI already checks whether user is allowed to mute
	{:ok, activity} <- CommonAPI.add_mute(activity, user, params) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	+ else
	+ {:error, :visibility_error} ->
	+ {:error, :not_found, "Record not found"}
	+
	+ error ->
	+ error
	end
	end

	@doc "POST /api/v1/statuses/:id/unmute"
	def unmute_conversation(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{params: %{id: id}}}
	} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	+ # CommonAPI already checks whether user is allowed to unmute
	{:ok, activity} <- CommonAPI.remove_mute(activity, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	+ else
	+ {:error, :visibility_error} ->
	+ {:error, :not_found, "Record not found"}
	+
	+ error ->
	+ error
	end
	end

	@doc "GET /api/v1/statuses/:id/favourited_by"
	def favourited_by(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	with true <- Pleroma.Config.get([:instance, :show_reactions]),
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"likes" => likes}} <- Object.normalize(activity, fetch: false) do
	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^likes)
	\|> Ecto.Query.order_by([u], fragment("array_position(?, ?)", ^likes, u.ap_id))
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/reblogged_by"
	def reblogged_by(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"announcements" => announces, "id" => ap_id}} <-
	Object.normalize(activity, fetch: false) do
	announces =
	"Announce"
	\|> Activity.Queries.by_type()
	\|> Ecto.Query.where([a], a.actor in ^announces)
	# this is to use the index
	\|> Activity.Queries.by_object_id(ap_id)
	\|> Repo.all()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))
	\|> Enum.map(& &1.actor)
	\|> Enum.uniq()

	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^announces)
	\|> Ecto.Query.order_by([u], fragment("array_position(?, ?)", ^announces, u.ap_id))
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/context"
	def context(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id(id) do
	activities =
	ActivityPub.fetch_activities_for_context(activity.data["context"], %{
	blocking_user: user,
	user: user,
	exclude_id: activity.id
	})

	render(conn, "context.json", activity: activity, activities: activities, user: user)
	end
	end

	@doc "POST /api/v1/statuses/:id/translate"
	def translate(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: params, params: %{id: status_id}}}
	} = conn,
	_
	) do
	with %Activity{object: object} <- Activity.get_by_id_with_object(status_id),
	{:visibility, visibility} when visibility in ["public", "unlisted"] <-
	{:visibility, Visibility.get_visibility(object)},
	{:language, language} when is_binary(language) <-
	{:language, Map.get(params, :lang) \|\| user.language},
	{:ok, result} <-
	Translation.translate(
	object.data["content"],
	object.data["language"],
	language
	) do
	render(conn, "translation.json", result)
	else
	{:language, nil} ->
	render_error(conn, :bad_request, "Language not specified")

	{:visibility, _} ->
	render_error(conn, :not_found, "Record not found")

	{:error, :not_found} ->
	render_error(conn, :not_found, "Translation service not configured")

	{:error, error} when error in [:unexpected_response, :quota_exceeded, :too_many_requests] ->
	render_error(conn, :service_unavailable, "Translation service not available")

	_ ->
	render_error(conn, :internal_server_error, "Translation failed")
	end
	end

	@doc "GET /api/v1/favourites"
	def favourites(
	%{assigns: %{user: %User{} = user}, private: %{open_api_spex: %{params: params}}} = conn,
	_
	) do
	activities = ActivityPub.fetch_favourites(user, params)

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	@doc "GET /api/v1/bookmarks"
	def bookmarks(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
	user = User.get_cached_by_id(user.id)
	folder_id = Map.get(params, :folder_id)

	bookmarks =
	user.id
	\|> Bookmark.for_user_query(folder_id)
	\|> Pleroma.Pagination.fetch_paginated(params)

	activities =
	bookmarks
	\|> Enum.map(fn b -> Map.put(b.activity, :bookmark, Map.delete(b, :activity)) end)

	conn
	\|> add_link_headers(bookmarks)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	@doc "GET /api/v1/statuses/:id/quotes"
	def quotes(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id} = params}}} =
	conn,
	_
	) do
	with %Activity{object: object} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	params =
	params
	\|> Map.put(:type, "Create")
	\|> Map.put(:blocking_user, user)
	\|> Map.put(:quote_url, object.data["id"])

	recipients =
	if user do
	[Pleroma.Constants.as_public()] ++ [user.ap_id \| User.following(user)]
	else
	[Pleroma.Constants.as_public()]
	end

	activities =
	recipients
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	else
	nil -> {:error, :not_found}
	false -> {:error, :not_found}
	end
	end

	defp put_application(params, %{assigns: %{token: %Token{user: %User{} = user} = token}} = _conn) do
	if user.disclose_client do
	%{client_name: client_name, website: website} = Repo.preload(token, :app).app
	Map.put(params, :generator, %{type: "Application", name: client_name, url: website})
	else
	Map.put(params, :generator, nil)
	end
	end

	defp put_application(params, _), do: Map.put(params, :generator, nil)
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
	index 662cc15d6..82abfce7f 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
	@@ -1,102 +1,107 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
	use Pleroma.Web, :controller

	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.User
	+ alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	plug(Pleroma.Web.ApiSpec.CastAndValidate)
	plug(OAuthScopesPlug, %{scopes: ["write:statuses"]} when action in [:create, :delete])

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:statuses"], fallback: :proceed_unauthenticated}
	when action == :index
	)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.EmojiReactionOperation

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	def index(%{assigns: %{user: user}} = conn, %{id: activity_id} = params) do
	with true <- Pleroma.Config.get([:instance, :show_reactions]),
	%Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
	+ {_, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{} = object <- Object.normalize(activity, fetch: false),
	reactions <- Object.get_emoji_reactions(object) do
	reactions =
	reactions
	\|> filter(params)
	\|> filter_allowed_users(user, Map.get(params, :with_muted, false))

	render(conn, "index.json", emoji_reactions: reactions, user: user)
	else
	+ {:visible, _} -> {:error, :not_found}
	_e -> json(conn, [])
	end
	end

	def filter_allowed_users(reactions, user, with_muted) do
	exclude_ap_ids =
	if is_nil(user) do
	[]
	else
	User.cached_blocked_users_ap_ids(user) ++
	if not with_muted, do: User.cached_muted_users_ap_ids(user), else: []
	end

	filter_emoji = fn emoji, users, url ->
	case Enum.reject(users, &(&1 in exclude_ap_ids)) do
	[] -> nil
	users -> {emoji, users, url}
	end
	end

	reactions
	\|> Stream.map(fn
	[emoji, users, url] when is_list(users) -> filter_emoji.(emoji, users, url)
	end)
	\|> Stream.reject(&is_nil/1)
	end

	defp filter(reactions, %{emoji: emoji}) when is_binary(emoji) do
	Enum.filter(reactions, fn [e, _, _] -> e == emoji end)
	end

	defp filter(reactions, _), do: reactions

	def create(%{assigns: %{user: user}} = conn, %{id: activity_id, emoji: emoji}) do
	emoji =
	emoji
	\|> Pleroma.Emoji.fully_qualify_emoji()
	\|> Pleroma.Emoji.maybe_quote()

	+ # CommonAPI checks if allowed to react
	with {:ok, _activity} <- CommonAPI.react_with_emoji(activity_id, user, emoji) do
	activity = Activity.get_by_id(activity_id)

	conn
	\|> put_view(StatusView)
	\|> render("show.json", activity: activity, for: user, as: :activity)
	end
	end

	def delete(%{assigns: %{user: user}} = conn, %{id: activity_id, emoji: emoji}) do
	emoji =
	emoji
	\|> Pleroma.Emoji.fully_qualify_emoji()
	\|> Pleroma.Emoji.maybe_quote()

	+ # CommonAPI checks only author can revoke reactions
	with {:ok, _activity} <- CommonAPI.unreact_with_emoji(activity_id, user, emoji) do
	activity = Activity.get_by_id(activity_id)

	conn
	\|> put_view(StatusView)
	\|> render("show.json", activity: activity, for: user, as: :activity)
	end
	end
	end
	diff --git a/test/pleroma/conversation/participation_test.exs b/test/pleroma/conversation/participation_test.exs
	index 697bdb7f9..f6fde1875 100644
	--- a/test/pleroma/conversation/participation_test.exs
	+++ b/test/pleroma/conversation/participation_test.exs
	@@ -1,374 +1,374 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Conversation.ParticipationTest do
	use Pleroma.DataCase, async: true
	import Pleroma.Factory
	alias Pleroma.Conversation
	alias Pleroma.Conversation.Participation
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.CommonAPI

	test "getting a participation will also preload things" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _activity} =
	CommonAPI.post(user, %{status: "Hey @#{other_user.nickname}.", visibility: "direct"})

	[participation] = Participation.for_user(user)

	participation = Participation.get(participation.id, preload: [:conversation])

	assert %Pleroma.Conversation{} = participation.conversation
	end

	test "for a new conversation or a reply, it doesn't mark the author's participation as unread" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _} =
	CommonAPI.post(user, %{status: "Hey @#{other_user.nickname}.", visibility: "direct"})

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	[%{read: true}] = Participation.for_user(user)
	[%{read: false} = participation] = Participation.for_user(other_user)
	assert Participation.unread_count(user) == 0
	assert Participation.unread_count(other_user) == 1

	{:ok, _} =
	CommonAPI.post(other_user, %{
	status: "Hey @#{user.nickname}.",
	visibility: "direct",
	in_reply_to_conversation_id: participation.id
	})

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	[%{read: false}] = Participation.for_user(user)
	[%{read: true}] = Participation.for_user(other_user)

	assert Participation.unread_count(user) == 1
	assert Participation.unread_count(other_user) == 0
	end

	test "for a new conversation, it sets the recipients of the participation" do
	user = insert(:user)
	other_user = insert(:user)
	third_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "Hey @#{other_user.nickname}.", visibility: "direct"})

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)
	[participation] = Participation.for_user(user)
	participation = Pleroma.Repo.preload(participation, :recipients)

	assert length(participation.recipients) == 2
	assert user in participation.recipients
	assert other_user in participation.recipients

	# Mentioning another user in the same conversation will not add a new recipients.

	{:ok, _activity} =
	CommonAPI.post(user, %{
	in_reply_to_status_id: activity.id,
	status: "Hey @#{third_user.nickname}.",
	visibility: "direct"
	})

	[participation] = Participation.for_user(user)
	participation = Pleroma.Repo.preload(participation, :recipients)

	assert length(participation.recipients) == 2
	end

	test "it creates a participation for a conversation and a user" do
	user = insert(:user)
	conversation = insert(:conversation)

	{:ok, %Participation{} = participation} =
	Participation.create_for_user_and_conversation(user, conversation)

	{:ok, participation} = time_travel(participation, -2)

	assert participation.user_id == user.id
	assert participation.conversation_id == conversation.id

	# Creating again returns the same participation
	{:ok, %Participation{} = participation_two} =
	Participation.create_for_user_and_conversation(user, conversation)

	assert participation.id == participation_two.id
	refute participation.updated_at == participation_two.updated_at
	end

	test "recreating an existing participations sets it to unread" do
	participation = insert(:participation, %{read: true})

	{:ok, participation} =
	Participation.create_for_user_and_conversation(
	participation.user,
	participation.conversation
	)

	refute participation.read
	end

	test "it marks a participation as read" do
	participation = insert(:participation, %{updated_at: ~N[2017-07-17 17:09:58], read: false})
	{:ok, updated_participation} = Participation.mark_as_read(participation)

	assert updated_participation.read
	assert :gt = NaiveDateTime.compare(updated_participation.updated_at, participation.updated_at)
	end

	test "it marks a participation as unread" do
	participation = insert(:participation, %{read: true})
	{:ok, participation} = Participation.mark_as_unread(participation)

	refute participation.read
	end

	test "it marks all the user's participations as read" do
	user = insert(:user)
	other_user = insert(:user)
	participation1 = insert(:participation, %{read: false, user: user})
	participation2 = insert(:participation, %{read: false, user: user})
	participation3 = insert(:participation, %{read: false, user: other_user})

	{:ok, _, [%{read: true}, %{read: true}]} = Participation.mark_all_as_read(user)

	assert Participation.get(participation1.id).read == true
	assert Participation.get(participation2.id).read == true
	assert Participation.get(participation3.id).read == false
	end

	test "gets all the participations for a user, ordered by updated at descending" do
	user = insert(:user)
	{:ok, activity_one} = CommonAPI.post(user, %{status: "x", visibility: "direct"})
	{:ok, activity_two} = CommonAPI.post(user, %{status: "x", visibility: "direct"})

	{:ok, activity_three} =
	CommonAPI.post(user, %{
	status: "x",
	visibility: "direct",
	in_reply_to_status_id: activity_one.id
	})

	# Offset participations because the accuracy of updated_at is down to a second

	for {activity, offset} <- [{activity_two, 1}, {activity_three, 2}] do
	conversation = Conversation.get_for_ap_id(activity.data["context"])
	participation = Participation.for_user_and_conversation(user, conversation)
	updated_at = NaiveDateTime.add(Map.get(participation, :updated_at), offset)

	Ecto.Changeset.change(participation, %{updated_at: updated_at})
	\|> Repo.update!()
	end

	assert [participation_one, participation_two] = Participation.for_user(user)

	object2 = Pleroma.Object.normalize(activity_two, fetch: false)
	object3 = Pleroma.Object.normalize(activity_three, fetch: false)

	user = Repo.get(Pleroma.User, user.id)

	assert participation_one.conversation.ap_id == object3.data["context"]
	assert participation_two.conversation.ap_id == object2.data["context"]
	assert participation_one.conversation.users == [user]

	# Pagination
	assert [participation_one] = Participation.for_user(user, %{"limit" => 1})

	assert participation_one.conversation.ap_id == object3.data["context"]

	# With last_activity_id
	assert [participation_one] =
	Participation.for_user_with_last_activity_id(user, %{"limit" => 1})

	assert participation_one.last_activity_id == activity_three.id
	end

	test "Doesn't die when the conversation gets empty" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
	[participation] = Participation.for_user_with_last_activity_id(user)

	assert participation.last_activity_id == activity.id

	{:ok, _} = CommonAPI.delete(activity.id, user)

	[] = Participation.for_user_with_last_activity_id(user)
	end

	test "it sets recipients, always keeping the owner of the participation even when not explicitly set" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
	[participation] = Participation.for_user_with_last_activity_id(user)

	participation = Repo.preload(participation, :recipients)
	user = User.get_cached_by_id(user.id)

	assert participation.recipients \|> length() == 1
	assert user in participation.recipients

	{:ok, participation} = Participation.set_recipients(participation, [other_user.id])

	assert participation.recipients \|> length() == 2
	assert user in participation.recipients
	assert other_user in participation.recipients
	end

	describe "blocking" do
	test "when the user blocks a recipient, the existing conversations with them are marked as read" do
	blocker = insert(:user)
	blocked = insert(:user)
	third_user = insert(:user)

	{:ok, _direct1} =
	CommonAPI.post(third_user, %{
	status: "Hi @#{blocker.nickname}",
	visibility: "direct"
	})

	{:ok, _direct2} =
	CommonAPI.post(third_user, %{
	status: "Hi @#{blocker.nickname}, @#{blocked.nickname}",
	visibility: "direct"
	})

	{:ok, _direct3} =
	CommonAPI.post(blocked, %{
	status: "Hi @#{blocker.nickname}",
	visibility: "direct"
	})

	{:ok, _direct4} =
	CommonAPI.post(blocked, %{
	status: "Hi @#{blocker.nickname}, @#{third_user.nickname}",
	visibility: "direct"
	})

	assert [%{read: false}, %{read: false}, %{read: false}, %{read: false}] =
	Participation.for_user(blocker)

	assert Participation.unread_count(blocker) == 4

	{:ok, _user_relationship} = User.block(blocker, blocked)

	# The conversations with the blocked user are marked as read
	assert [%{read: true}, %{read: true}, %{read: true}, %{read: false}] =
	Participation.for_user(blocker)

	assert Participation.unread_count(blocker) == 1

	# The conversation is not marked as read for the blocked user
	assert [_, _, %{read: false}] = Participation.for_user(blocked)
	assert Participation.unread_count(blocker) == 1

	# The conversation is not marked as read for the third user
	assert [%{read: false}, _, _] = Participation.for_user(third_user)
	assert Participation.unread_count(third_user) == 1
	end

	test "the new conversation with the blocked user is not marked as unread " do
	blocker = insert(:user)
	blocked = insert(:user)
	third_user = insert(:user)

	{:ok, _user_relationship} = User.block(blocker, blocked)

	# When the blocked user is the author
	{:ok, _direct1} =
	CommonAPI.post(blocked, %{
	status: "Hi @#{blocker.nickname}",
	visibility: "direct"
	})

	assert [%{read: true}] = Participation.for_user(blocker)
	assert Participation.unread_count(blocker) == 0

	# When the blocked user is a recipient
	{:ok, _direct2} =
	CommonAPI.post(third_user, %{
	status: "Hi @#{blocker.nickname}, @#{blocked.nickname}",
	visibility: "direct"
	})

	assert [%{read: true}, %{read: true}] = Participation.for_user(blocker)
	assert Participation.unread_count(blocker) == 0

	assert [%{read: false}, _] = Participation.for_user(blocked)
	assert Participation.unread_count(blocked) == 1
	end

	test "the conversation with the blocked user is not marked as unread on a reply" do
	blocker = insert(:user)
	blocked = insert(:user)
	third_user = insert(:user)

	{:ok, _direct1} =
	CommonAPI.post(blocker, %{
	status: "Hi @#{third_user.nickname}, @#{blocked.nickname}",
	visibility: "direct"
	})

	{:ok, _user_relationship} = User.block(blocker, blocked)
	assert [%{read: true}] = Participation.for_user(blocker)

	assert Participation.unread_count(blocker) == 0
	assert [blocked_participation] = Participation.for_user(blocked)

	# When it's a reply from the blocked user
	{:ok, _direct2} =
	CommonAPI.post(blocked, %{
	- status: "reply",
	+ status: "@#{third_user.nickname}, #{blocker.nickname} reply",
	visibility: "direct",
	in_reply_to_conversation_id: blocked_participation.id
	})

	assert [%{read: true}] = Participation.for_user(blocker)

	assert Participation.unread_count(blocker) == 0
	assert [third_user_participation] = Participation.for_user(third_user)

	# When it's a reply from the third user
	{:ok, _direct3} =
	CommonAPI.post(third_user, %{
	status: "reply",
	visibility: "direct",
	in_reply_to_conversation_id: third_user_participation.id
	})

	assert [%{read: true}] = Participation.for_user(blocker)
	assert Participation.unread_count(blocker) == 0

	# Marked as unread for the blocked user
	assert [%{read: false}] = Participation.for_user(blocked)

	assert Participation.unread_count(blocked) == 1
	end
	end

	test "deletes a conversation" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _activity} =
	CommonAPI.post(user, %{status: "Hey @#{other_user.nickname}.", visibility: "direct"})

	assert [participation] = Participation.for_user(other_user)
	assert {:ok, _} = Participation.delete(participation)
	assert [] == Participation.for_user(other_user)
	end
	end
	diff --git a/test/pleroma/conversation_test.exs b/test/pleroma/conversation_test.exs
	index 02b5de615..bc41165ed 100644
	--- a/test/pleroma/conversation_test.exs
	+++ b/test/pleroma/conversation_test.exs
	@@ -1,204 +1,208 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.ConversationTest do
	use Pleroma.DataCase
	alias Pleroma.Activity
	alias Pleroma.Conversation
	alias Pleroma.Object
	alias Pleroma.Web.CommonAPI

	import Pleroma.Factory

	setup_all do: clear_config([:instance, :federating], true)

	setup do
	Mox.stub_with(Pleroma.UnstubbedConfigMock, Pleroma.Test.StaticConfig)
	:ok
	end

	test "it goes through old direct conversations" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _activity} =
	CommonAPI.post(user, %{visibility: "direct", status: "hey @#{other_user.nickname}"})

	Pleroma.Tests.ObanHelpers.perform_all()

	Repo.delete_all(Conversation)
	Repo.delete_all(Conversation.Participation)

	refute Repo.one(Conversation)

	Conversation.bump_for_all_activities()

	assert Repo.one(Conversation)
	[participation, _p2] = Repo.all(Conversation.Participation)

	assert participation.read
	end

	test "it creates a conversation for given ap_id" do
	assert {:ok, %Conversation{} = conversation} =
	Conversation.create_for_ap_id("https://some_ap_id")

	# Inserting again returns the same
	assert {:ok, conversation_two} = Conversation.create_for_ap_id("https://some_ap_id")
	assert conversation_two.id == conversation.id
	end

	test "public posts don't create conversations" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "Hey"})

	object = Pleroma.Object.normalize(activity, fetch: false)
	context = object.data["context"]

	conversation = Conversation.get_for_ap_id(context)

	refute conversation
	end

	test "it creates or updates a conversation and participations for a given DM" do
	har = insert(:user)
	jafnhar = insert(:user, local: false)
	tridi = insert(:user)

	+ to = [har.nickname, jafnhar.nickname, tridi.nickname]
	+
	{:ok, activity} =
	- CommonAPI.post(har, %{status: "Hey @#{jafnhar.nickname}", visibility: "direct"})
	+ CommonAPI.post(har, %{status: "Hey @#{jafnhar.nickname}", visibility: "direct", to: to})

	object = Pleroma.Object.normalize(activity, fetch: false)
	context = object.data["context"]

	conversation =
	Conversation.get_for_ap_id(context)
	\|> Repo.preload(:participations)

	assert conversation

	assert Enum.find(conversation.participations, fn %{user_id: user_id} -> har.id == user_id end)

	assert Enum.find(conversation.participations, fn %{user_id: user_id} ->
	jafnhar.id == user_id
	end)

	{:ok, activity} =
	CommonAPI.post(jafnhar, %{
	status: "Hey @#{har.nickname}",
	visibility: "direct",
	- in_reply_to_status_id: activity.id
	+ in_reply_to_status_id: activity.id,
	+ to: to
	})

	object = Pleroma.Object.normalize(activity, fetch: false)
	context = object.data["context"]

	conversation_two =
	Conversation.get_for_ap_id(context)
	\|> Repo.preload(:participations)

	assert conversation_two.id == conversation.id

	assert Enum.find(conversation_two.participations, fn %{user_id: user_id} ->
	har.id == user_id
	end)

	assert Enum.find(conversation_two.participations, fn %{user_id: user_id} ->
	jafnhar.id == user_id
	end)

	{:ok, activity} =
	CommonAPI.post(tridi, %{
	status: "Hey @#{har.nickname}",
	visibility: "direct",
	- in_reply_to_status_id: activity.id
	+ in_reply_to_status_id: activity.id,
	+ to: to
	})

	object = Pleroma.Object.normalize(activity, fetch: false)
	context = object.data["context"]

	conversation_three =
	Conversation.get_for_ap_id(context)
	\|> Repo.preload([:participations, :users])

	assert conversation_three.id == conversation.id

	assert Enum.find(conversation_three.participations, fn %{user_id: user_id} ->
	har.id == user_id
	end)

	assert Enum.find(conversation_three.participations, fn %{user_id: user_id} ->
	jafnhar.id == user_id
	end)

	assert Enum.find(conversation_three.participations, fn %{user_id: user_id} ->
	tridi.id == user_id
	end)

	assert Enum.find(conversation_three.users, fn %{id: user_id} ->
	har.id == user_id
	end)

	assert Enum.find(conversation_three.users, fn %{id: user_id} ->
	jafnhar.id == user_id
	end)

	assert Enum.find(conversation_three.users, fn %{id: user_id} ->
	tridi.id == user_id
	end)
	end

	test "create_or_bump_for returns the conversation with participations" do
	har = insert(:user)
	jafnhar = insert(:user, local: false)

	{:ok, activity} =
	CommonAPI.post(har, %{status: "Hey @#{jafnhar.nickname}", visibility: "direct"})

	{:ok, conversation} = Conversation.create_or_bump_for(activity)

	assert length(conversation.participations) == 2

	{:ok, activity} =
	CommonAPI.post(har, %{status: "Hey @#{jafnhar.nickname}", visibility: "public"})

	assert {:error, _} = Conversation.create_or_bump_for(activity)
	end

	test "create_or_bump_for does not normalize objects before checking the activity type" do
	note = insert(:note)
	note_id = note.data["id"]
	Repo.delete(note)
	refute Object.get_by_ap_id(note_id)

	Tesla.Mock.mock(fn env ->
	case env.url do
	^note_id ->
	# TODO: add attributedTo and tag to the note factory
	body =
	note.data
	\|> Map.put("attributedTo", note.data["actor"])
	\|> Map.put("tag", [])
	\|> Jason.encode!()

	%Tesla.Env{status: 200, body: body}
	end
	end)

	undo = %Activity{
	id: "fake",
	data: %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"actor" => note.data["actor"],
	"to" => [note.data["actor"]],
	"object" => note_id,
	"type" => "Undo"
	}
	}

	Conversation.create_or_bump_for(undo)

	refute Object.get_by_ap_id(note_id)
	end
	end
	diff --git a/test/pleroma/web/activity_pub/activity_pub_controller_test.exs b/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
	index 2b8418dcd..bd84e0001 100644
	--- a/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
	+++ b/test/pleroma/web/activity_pub/activity_pub_controller_test.exs
	@@ -1,2246 +1,2564 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
	use Pleroma.Web.ConnCase
	use Oban.Testing, repo: Pleroma.Repo

	alias Pleroma.Activity
	alias Pleroma.Delivery
	alias Pleroma.Object
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.Endpoint
	alias Pleroma.Workers.ReceiverWorker

	import Pleroma.Factory

	require Pleroma.Constants

	setup do
	Mox.stub_with(Pleroma.UnstubbedConfigMock, Pleroma.Test.StaticConfig)
	:ok
	end

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	setup do: clear_config([:instance, :federating], true)

	describe "/relay" do
	setup do: clear_config([:instance, :allow_relay])

	test "with the relay active, it returns the relay user", %{conn: conn} do
	res =
	conn
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(200)

	assert res["id"] =~ "/relay"
	end

	test "with the relay disabled, it returns 404", %{conn: conn} do
	clear_config([:instance, :allow_relay], false)

	conn
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(404)
	end

	test "on non-federating instance, it returns 404", %{conn: conn} do
	clear_config([:instance, :federating], false)
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(404)
	end
	end

	describe "/internal/fetch" do
	test "it returns the internal fetch user", %{conn: conn} do
	res =
	conn
	\|> get(activity_pub_path(conn, :internal_fetch))
	\|> json_response(200)

	assert res["id"] =~ "/fetch"
	end

	test "on non-federating instance, it returns 404", %{conn: conn} do
	clear_config([:instance, :federating], false)
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> get(activity_pub_path(conn, :internal_fetch))
	\|> json_response(404)
	end
	end

	describe "/users/:nickname" do
	test "it returns a json representation of the user with accept application/json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns a json representation of the user with accept application/activity+json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns a json representation of the user with accept application/ld+json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header(
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns 404 for remote users", %{
	conn: conn
	} do
	user = insert(:user, local: false, nickname: "remoteuser@example.com")

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/#{user.nickname}.json")

	assert json_response(conn, 404)
	end

	test "it returns error when user is not found", %{conn: conn} do
	response =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/jimm")
	\|> json_response(404)

	assert response == "Not found"
	end
	end

	describe "mastodon compatibility routes" do
	test "it returns a json representation of the object with accept application/json", %{
	conn: conn
	} do
	{:ok, object} =
	%{
	"type" => "Note",
	"content" => "hey",
	"id" => Endpoint.url() <> "/users/raymoo/statuses/999999999",
	"actor" => Endpoint.url() <> "/users/raymoo",
	"to" => [Pleroma.Constants.as_public()]
	}
	\|> Object.create()

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/raymoo/statuses/999999999")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: object})
	end

	test "it returns a json representation of the activity with accept application/json", %{
	conn: conn
	} do
	{:ok, object} =
	%{
	"type" => "Note",
	"content" => "hey",
	"id" => Endpoint.url() <> "/users/raymoo/statuses/999999999",
	"actor" => Endpoint.url() <> "/users/raymoo",
	"to" => [Pleroma.Constants.as_public()]
	}
	\|> Object.create()

	{:ok, activity, _} =
	%{
	"id" => object.data["id"] <> "/activity",
	"type" => "Create",
	"object" => object.data["id"],
	"actor" => object.data["actor"],
	"to" => object.data["to"]
	}
	\|> ActivityPub.persist(local: true)

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/raymoo/statuses/999999999/activity")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
	end
	end

	describe "/objects/:uuid" do
	test "it doesn't return a local-only object", %{conn: conn} do
	user = insert(:user)
	{:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})

	assert Pleroma.Web.ActivityPub.Visibility.local_public?(post)

	object = Object.normalize(post, fetch: false)
	uuid = String.split(object.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end

	test "returns local-only objects when authenticated", %{conn: conn} do
	user = insert(:user)
	{:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})

	assert Pleroma.Web.ActivityPub.Visibility.local_public?(post)

	object = Object.normalize(post, fetch: false)
	uuid = String.split(object.data["id"], "/") \|> List.last()

	assert response =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(response, 200) == ObjectView.render("object.json", %{object: object})
	end

	test "does not return local-only objects for remote users", %{conn: conn} do
	user = insert(:user)
	reader = insert(:user, local: false)

	{:ok, post} =
	CommonAPI.post(user, %{status: "test @#{reader.nickname}", visibility: "local"})

	assert Pleroma.Web.ActivityPub.Visibility.local_public?(post)

	object = Object.normalize(post, fetch: false)
	uuid = String.split(object.data["id"], "/") \|> List.last()

	assert response =
	conn
	\|> assign(:user, reader)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	json_response(response, 404)
	end

	test "it returns a json representation of the object with accept application/json", %{
	conn: conn
	} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns a json representation of the object with accept application/activity+json",
	%{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns a json representation of the object with accept application/ld+json", %{
	conn: conn
	} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header(
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "does not cache authenticated response", %{conn: conn} do
	user = insert(:user)
	reader = insert(:user)

	{:ok, post} =
	CommonAPI.post(user, %{status: "test @#{reader.nickname}", visibility: "local"})

	object = Object.normalize(post, fetch: false)
	uuid = String.split(object.data["id"], "/") \|> List.last()

	assert response =
	conn
	\|> assign(:user, reader)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	json_response(response, 200)

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")
	\|> json_response(404)
	end

	test "it returns 404 for non-public messages", %{conn: conn} do
	note = insert(:direct_note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end

	test "returns visible non-public messages when authenticated", %{conn: conn} do
	note = insert(:direct_note)
	uuid = String.split(note.data["id"], "/") \|> List.last()
	user = User.get_by_ap_id(note.data["actor"])
	marisa = insert(:user)

	assert conn
	\|> assign(:user, marisa)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")
	\|> json_response(404)

	assert response =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")
	\|> json_response(200)

	assert response == ObjectView.render("object.json", %{object: note})
	end

	test "it returns 404 for tombstone objects", %{conn: conn} do
	tombstone = insert(:tombstone)
	uuid = String.split(tombstone.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end

	test "it caches a response", %{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok) == json_response(conn2, :ok)
	assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
	end

	test "cached purged after object deletion", %{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	Object.delete(note)

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert "Not found" == json_response(conn2, :not_found)
	end
	end

	describe "/activities/:uuid" do
	test "it doesn't return a local-only activity", %{conn: conn} do
	user = insert(:user)
	{:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})

	assert Pleroma.Web.ActivityPub.Visibility.local_public?(post)

	uuid = String.split(post.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 404)
	end

	test "returns local-only activities when authenticated", %{conn: conn} do
	user = insert(:user)
	{:ok, post} = CommonAPI.post(user, %{status: "test", visibility: "local"})

	assert Pleroma.Web.ActivityPub.Visibility.local_public?(post)

	uuid = String.split(post.data["id"], "/") \|> List.last()

	assert response =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(response, 200) == ObjectView.render("object.json", %{object: post})
	end

	test "it returns a json representation of the activity", %{conn: conn} do
	activity = insert(:note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
	end

	test "it returns 404 for non-public activities", %{conn: conn} do
	activity = insert(:direct_note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 404)
	end

	test "returns visible non-public messages when authenticated", %{conn: conn} do
	note = insert(:direct_note_activity)
	uuid = String.split(note.data["id"], "/") \|> List.last()
	user = User.get_by_ap_id(note.data["actor"])
	marisa = insert(:user)

	assert conn
	\|> assign(:user, marisa)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")
	\|> json_response(404)

	assert response =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")
	\|> json_response(200)

	assert response == ObjectView.render("object.json", %{object: note})
	end

	test "it caches a response", %{conn: conn} do
	activity = insert(:note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok) == json_response(conn2, :ok)
	assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
	end

	test "cached purged after activity deletion", %{conn: conn} do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "cofe"})

	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn1 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn1, :ok)
	assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))

	Activity.delete_all_by_object_ap_id(activity.object.data["id"])

	conn2 =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert "Not found" == json_response(conn2, :not_found)
	end
	end

	describe "/inbox" do
	test "it inserts an incoming activity into the database", %{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Jason.decode!()

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it inserts an incoming activity into the database" <>
	"even if we can't fetch the user but have it in our db",
	%{conn: conn} do
	user =
	insert(:user,
	ap_id: "https://mastodon.example.org/users/raymoo",
	local: false,
	last_refreshed_at: nil
	)

	data =
	File.read!("test/fixtures/mastodon-post-activity.json")
	\|> Jason.decode!()
	\|> Map.put("actor", user.ap_id)
	\|> put_in(["object", "attributedTo"], user.ap_id)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "accept follow activity", %{conn: conn} do
	clear_config([:instance, :federating], true)
	relay = Relay.get_actor()

	assert {:ok, %Activity{} = activity} = Relay.follow("https://relay.mastodon.host/actor")

	followed_relay = Pleroma.User.get_by_ap_id("https://relay.mastodon.host/actor")
	relay = refresh_record(relay)

	accept =
	File.read!("test/fixtures/relay/accept-follow.json")
	\|> String.replace("{{ap_id}}", relay.ap_id)
	\|> String.replace("{{activity_id}}", activity.data["id"])

	assert "ok" ==
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", accept)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))

	assert Pleroma.FollowingRelationship.following?(
	relay,
	followed_relay
	)

	Mix.shell(Mix.Shell.Process)

	on_exit(fn ->
	Mix.shell(Mix.Shell.IO)
	end)

	:ok = Mix.Tasks.Pleroma.Relay.run(["list"])
	assert_receive {:mix_shell, :info, ["https://relay.mastodon.host/actor"]}
	end

	test "without valid signature, " <>
	"it accepts Create activities and requires enabled federation",
	%{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Jason.decode!()
	non_create_data = File.read!("test/fixtures/mastodon-announce.json") \|> Jason.decode!()

	conn = put_req_header(conn, "content-type", "application/activity+json")

	clear_config([:instance, :federating], false)

	conn
	\|> post("/inbox", data)
	\|> json_response(403)

	conn
	\|> post("/inbox", non_create_data)
	\|> json_response(403)

	clear_config([:instance, :federating], true)

	ret_conn = post(conn, "/inbox", data)
	assert "ok" == json_response(ret_conn, 200)

	conn
	\|> post("/inbox", non_create_data)
	\|> json_response(400)
	end

	# When activity is delivered to the inbox and we cannot immediately verify signature
	# we capture all the params and process it later in the Oban job.
	# Once we begin processing it through Oban we risk fetching the actor to validate the
	# activity which just leads to inserting a new user to process a Delete not relevant to us.
	test "Activities of certain types from an unknown actor are discarded", %{conn: conn} do
	example_bad_types =
	Pleroma.Constants.activity_types() --
	Pleroma.Constants.allowed_activity_types_from_strangers()

	Enum.each(example_bad_types, fn bad_type ->
	params =
	%{
	"type" => bad_type,
	"actor" => "https://unknown.mastodon.instance/users/somebody"
	}
	\|> Jason.encode!()

	conn
	\|> assign(:valid_signature, false)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", params)
	\|> json_response(400)

	assert all_enqueued() == []
	end)
	end

	test "Unknown activity types are discarded", %{conn: conn} do
	unknown_types = ["Poke", "Read", "Dazzle"]

	Enum.each(unknown_types, fn bad_type ->
	params =
	%{
	"type" => bad_type,
	"actor" => "https://unknown.mastodon.instance/users/somebody"
	}
	\|> Jason.encode!()

	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", params)
	\|> json_response(400)

	assert all_enqueued() == []
	end)
	end

	test "accepts Add/Remove activities", %{conn: conn} do
	object_id = "c61d6733-e256-4fe1-ab13-1e369789423f"

	status =
	File.read!("test/fixtures/statuses/note.json")
	\|> String.replace("{{nickname}}", "lain")
	\|> String.replace("{{object_id}}", object_id)

	object_url = "https://example.com/objects/#{object_id}"

	user =
	File.read!("test/fixtures/users_mock/user.json")
	\|> String.replace("{{nickname}}", "lain")

	actor = "https://example.com/users/lain"

	Tesla.Mock.mock(fn
	%{
	method: :get,
	url: ^object_url
	} ->
	%Tesla.Env{
	status: 200,
	body: status,
	headers: [{"content-type", "application/activity+json"}]
	}

	%{
	method: :get,
	url: ^actor
	} ->
	%Tesla.Env{
	status: 200,
	body: user,
	headers: [{"content-type", "application/activity+json"}]
	}

	%{method: :get, url: "https://example.com/users/lain/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	body:
	"test/fixtures/users_mock/masto_featured.json"
	\|> File.read!()
	\|> String.replace("{{domain}}", "example.com")
	\|> String.replace("{{nickname}}", "lain"),
	headers: [{"content-type", "application/activity+json"}]
	}
	end)

	data = %{
	"id" => "https://example.com/objects/d61d6733-e256-4fe1-ab13-1e369789423f",
	"actor" => actor,
	"object" => object_url,
	"target" => "https://example.com/users/lain/collections/featured",
	"type" => "Add",
	"to" => [Pleroma.Constants.as_public()]
	}

	assert "ok" ==
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	user = User.get_cached_by_ap_id(data["actor"])
	assert user.pinned_objects[data["object"]]

	data = %{
	"id" => "https://example.com/objects/d61d6733-e256-4fe1-ab13-1e369789423d",
	"actor" => actor,
	"object" => object_url,
	"target" => "https://example.com/users/lain/collections/featured",
	"type" => "Remove",
	"to" => [Pleroma.Constants.as_public()]
	}

	assert "ok" ==
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	user = refresh_record(user)
	refute user.pinned_objects[data["object"]]
	end

	test "mastodon pin/unpin", %{conn: conn} do
	status_id = "105786274556060421"

	status =
	File.read!("test/fixtures/statuses/masto-note.json")
	\|> String.replace("{{nickname}}", "lain")
	\|> String.replace("{{status_id}}", status_id)

	status_url = "https://example.com/users/lain/statuses/#{status_id}"

	user =
	File.read!("test/fixtures/users_mock/user.json")
	\|> String.replace("{{nickname}}", "lain")

	actor = "https://example.com/users/lain"

	Tesla.Mock.mock(fn
	%{
	method: :get,
	url: ^status_url
	} ->
	%Tesla.Env{
	status: 200,
	body: status,
	headers: [{"content-type", "application/activity+json"}]
	}

	%{
	method: :get,
	url: ^actor
	} ->
	%Tesla.Env{
	status: 200,
	body: user,
	headers: [{"content-type", "application/activity+json"}]
	}

	%{method: :get, url: "https://example.com/users/lain/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	body:
	"test/fixtures/users_mock/masto_featured.json"
	\|> File.read!()
	\|> String.replace("{{domain}}", "example.com")
	\|> String.replace("{{nickname}}", "lain"),
	headers: [{"content-type", "application/activity+json"}]
	}
	end)

	data = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"actor" => actor,
	"object" => status_url,
	"target" => "https://example.com/users/lain/collections/featured",
	"type" => "Add"
	}

	assert "ok" ==
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_object_ap_id_with_object(data["object"])
	user = User.get_cached_by_ap_id(data["actor"])
	assert user.pinned_objects[data["object"]]

	data = %{
	"actor" => actor,
	"object" => status_url,
	"target" => "https://example.com/users/lain/collections/featured",
	"type" => "Remove"
	}

	assert "ok" ==
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_object_ap_id_with_object(data["object"])
	user = refresh_record(user)
	refute user.pinned_objects[data["object"]]
	end
	end

	describe "/users/:nickname/inbox" do
	setup do
	data =
	File.read!("test/fixtures/mastodon-post-activity.json")
	\|> Jason.decode!()

	[data: data]
	end

	test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	data
	\|> Map.put("bcc", [user.ap_id])
	\|> Kernel.put_in(["object", "bcc"], [user.ap_id])

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	data
	\|> Map.put("to", user.ap_id)
	\|> Map.put("cc", [])
	\|> Kernel.put_in(["object", "to"], user.ap_id)
	\|> Kernel.put_in(["object", "cc"], [])

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	data
	\|> Map.put("to", [])
	\|> Map.put("cc", user.ap_id)
	\|> Kernel.put_in(["object", "to"], [])
	\|> Kernel.put_in(["object", "cc"], user.ap_id)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	%Activity{} = activity = Activity.get_by_ap_id(data["id"])
	assert user.ap_id in activity.recipients
	end

	test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	data
	\|> Map.put("to", [])
	\|> Map.put("cc", [])
	\|> Map.put("bcc", user.ap_id)
	\|> Kernel.put_in(["object", "to"], [])
	\|> Kernel.put_in(["object", "cc"], [])
	\|> Kernel.put_in(["object", "bcc"], user.ap_id)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts announces with to as string instead of array", %{conn: conn} do
	user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "hey"})
	announcer = insert(:user, local: false)

	data = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"actor" => announcer.ap_id,
	"id" => "#{announcer.ap_id}/statuses/19512778738411822/activity",
	"object" => post.data["object"],
	"to" => "https://www.w3.org/ns/activitystreams#Public",
	"cc" => [user.ap_id],
	"type" => "Announce"
	}

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	%Activity{} = activity = Activity.get_by_ap_id(data["id"])
	assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
	end

	test "it accepts messages from actors that are followed by the user", %{
	conn: conn,
	data: data
	} do
	recipient = insert(:user)
	actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})

	{:ok, recipient, actor} = User.follow(recipient, actor)

	object =
	data["object"]
	\|> Map.put("attributedTo", actor.ap_id)

	data =
	data
	\|> Map.put("actor", actor.ap_id)
	\|> Map.put("object", object)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{recipient.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it rejects reads from other users", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/inbox")

	assert json_response(conn, 403)
	end

	test "it returns a note activity in a collection", %{conn: conn} do
	note_activity = insert(:direct_note_activity)
	note_object = Object.normalize(note_activity, fetch: false)
	user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/inbox?page=true")

	assert response(conn, 200) =~ note_object.data["content"]
	end

	test "it removes all follower collections but actor's", %{conn: conn} do
	[actor, recipient] = insert_pair(:user)

	to = [
	recipient.ap_id,
	recipient.follower_address,
	"https://www.w3.org/ns/activitystreams#Public"
	]

	cc = [recipient.follower_address, actor.follower_address]

	data = %{
	"@context" => ["https://www.w3.org/ns/activitystreams"],
	"type" => "Create",
	"id" => Utils.generate_activity_id(),
	"to" => to,
	"cc" => cc,
	"actor" => actor.ap_id,
	"object" => %{
	"type" => "Note",
	"to" => to,
	"cc" => cc,
	"content" => "It's a note",
	"attributedTo" => actor.ap_id,
	"id" => Utils.generate_object_id()
	}
	}

	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{recipient.nickname}/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))

	assert activity = Activity.get_by_ap_id(data["id"])

	assert activity.id
	assert actor.follower_address in activity.recipients
	assert actor.follower_address in activity.data["cc"]

	refute recipient.follower_address in activity.recipients
	refute recipient.follower_address in activity.data["cc"]
	refute recipient.follower_address in activity.data["to"]
	end

	test "it requires authentication", %{conn: conn} do
	user = insert(:user)
	conn = put_req_header(conn, "accept", "application/activity+json")

	ret_conn = get(conn, "/users/#{user.nickname}/inbox")
	assert json_response(ret_conn, 403)

	ret_conn =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/inbox")

	assert json_response(ret_conn, 200)
	end

	test "forwarded report", %{conn: conn} do
	admin = insert(:user, is_admin: true)
	actor = insert(:user, local: false)
	remote_domain = URI.parse(actor.ap_id).host
	reported_user = insert(:user)

	note = insert(:note_activity, user: reported_user)

	data = %{
	"@context" => [
	"https://www.w3.org/ns/activitystreams",
	"https://#{remote_domain}/schemas/litepub-0.1.jsonld",
	%{
	"@language" => "und"
	}
	],
	"actor" => actor.ap_id,
	# CC and TO might either not exist at all, or be empty. We should be able to handle either.
	# "cc" => [],
	"content" => "test",
	"context" => "context",
	"id" => "http://#{remote_domain}/activities/02be56cf-35e3-46b4-b2c6-47ae08dfee9e",
	"nickname" => reported_user.nickname,
	"object" => [
	reported_user.ap_id,
	%{
	"actor" => %{
	"actor_type" => "Person",
	"approval_pending" => false,
	"avatar" => "",
	"confirmation_pending" => false,
	"deactivated" => false,
	"display_name" => "test user",
	"id" => reported_user.id,
	"local" => false,
	"nickname" => reported_user.nickname,
	"registration_reason" => nil,
	"roles" => %{
	"admin" => false,
	"moderator" => false
	},
	"tags" => [],
	"url" => reported_user.ap_id
	},
	"content" => "",
	"id" => note.data["id"],
	"published" => note.data["published"],
	"type" => "Note"
	}
	],
	"published" => note.data["published"],
	"state" => "open",
	"to" => [],
	"type" => "Flag"
	}

	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{reported_user.nickname}/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))

	assert Pleroma.Repo.aggregate(Activity, :count, :id) == 2

	ObanHelpers.perform_all()

	Swoosh.TestAssertions.assert_email_sent(
	to: {admin.name, admin.email},
	html_body: ~r/Reported Account:/i
	)
	end

	test "forwarded report from mastodon", %{conn: conn} do
	admin = insert(:user, is_admin: true)
	actor = insert(:user, local: false)
	remote_domain = URI.parse(actor.ap_id).host
	remote_actor = "https://#{remote_domain}/actor"
	[reported_user, another] = insert_list(2, :user)

	note = insert(:note_activity, user: reported_user)

	Pleroma.Web.CommonAPI.favorite(note.id, another)

	mock_json_body =
	"test/fixtures/mastodon/application_actor.json"
	\|> File.read!()
	\|> String.replace("{{DOMAIN}}", remote_domain)

	Tesla.Mock.mock(fn %{url: ^remote_actor} ->
	%Tesla.Env{
	status: 200,
	body: mock_json_body,
	headers: [{"content-type", "application/activity+json"}]
	}
	end)

	data = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"actor" => remote_actor,
	"content" => "test report",
	"id" => "https://#{remote_domain}/e3b12fd1-948c-446e-b93b-a5e67edbe1d8",
	"object" => [
	reported_user.ap_id,
	note.data["object"]
	],
	"type" => "Flag"
	}

	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{reported_user.nickname}/inbox", data)
	\|> json_response(200)

	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))

	flag_activity = "Flag" \|> Pleroma.Activity.Queries.by_type() \|> Pleroma.Repo.one()
	reported_user_ap_id = reported_user.ap_id

	[^reported_user_ap_id, flag_data] = flag_activity.data["object"]

	Enum.each(~w(actor content id published type), &Map.has_key?(flag_data, &1))
	ObanHelpers.perform_all()

	Swoosh.TestAssertions.assert_email_sent(
	to: {admin.name, admin.email},
	html_body: ~r/#{note.data["object"]}/i
	)
	end

	test "it accepts an incoming Block", %{conn: conn, data: data} do
	user = insert(:user)

	data =
	data
	\|> Map.put("type", "Block")
	\|> Map.put("to", [user.ap_id])
	\|> Map.put("cc", [])
	\|> Map.put("object", user.ap_id)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it returns an error when receiving an activity sent to a deactivated user", %{
	conn: conn,
	data: data
	} do
	user = insert(:user)
	{:ok, _} = User.set_activation(user, false)

	data =
	data
	\|> Map.put("bcc", [user.ap_id])
	\|> Kernel.put_in(["object", "bcc"], [user.ap_id])

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "User deactivated" == json_response(conn, 404)
	end

	test "it returns an error when receiving an activity sent from a deactivated user", %{
	conn: conn,
	data: data
	} do
	sender = insert(:user)
	user = insert(:user)
	{:ok, _} = User.set_activation(sender, false)

	data =
	data
	\|> Map.put("bcc", [user.ap_id])
	\|> Map.put("actor", sender.ap_id)
	\|> Kernel.put_in(["object", "bcc"], [user.ap_id])

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "Sender deactivated" == json_response(conn, 404)
	end
	end

	describe "GET /users/:nickname/outbox" do
	setup do
	Mox.stub_with(Pleroma.StaticStubbedConfigMock, Pleroma.Config)
	:ok
	end

	test "it paginates correctly", %{conn: conn} do
	user = insert(:user)
	conn = assign(conn, :user, user)
	outbox_endpoint = user.ap_id <> "/outbox"

	_posts =
	for i <- 0..25 do
	{:ok, activity} = CommonAPI.post(user, %{status: "post #{i}"})
	activity
	end

	result =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get(outbox_endpoint <> "?page=true")
	\|> json_response(200)

	result_ids = Enum.map(result["orderedItems"], fn x -> x["id"] end)
	assert length(result["orderedItems"]) == 20
	assert length(result_ids) == 20
	assert result["next"]
	assert String.starts_with?(result["next"], outbox_endpoint)

	result_next =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get(result["next"])
	\|> json_response(200)

	result_next_ids = Enum.map(result_next["orderedItems"], fn x -> x["id"] end)
	assert length(result_next["orderedItems"]) == 6
	assert length(result_next_ids) == 6
	refute Enum.find(result_next_ids, fn x -> x in result_ids end)
	refute Enum.find(result_ids, fn x -> x in result_next_ids end)
	assert String.starts_with?(result["id"], outbox_endpoint)

	result_next_again =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get(result_next["id"])
	\|> json_response(200)

	assert result_next == result_next_again
	end

	test "it returns 200 even if there're no activities", %{conn: conn} do
	user = insert(:user)
	outbox_endpoint = user.ap_id <> "/outbox"

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get(outbox_endpoint)

	result = json_response(conn, 200)
	assert outbox_endpoint == result["id"]
	end

	test "it returns a local note activity when authenticated as local user", %{conn: conn} do
	user = insert(:user)
	reader = insert(:user)
	{:ok, note_activity} = CommonAPI.post(user, %{status: "mew mew", visibility: "local"})
	ap_id = note_activity.data["id"]

	resp =
	conn
	\|> assign(:user, reader)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")
	\|> json_response(200)

	assert %{"orderedItems" => [%{"id" => ^ap_id}]} = resp
	end

	test "it does not return a local note activity when unauthenticated", %{conn: conn} do
	user = insert(:user)
	{:ok, _note_activity} = CommonAPI.post(user, %{status: "mew mew", visibility: "local"})

	resp =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")
	\|> json_response(200)

	assert %{"orderedItems" => []} = resp
	end

	test "it does not return a local note activity when C2S API is disabled", %{conn: conn} do
	clear_config([:activitypub, :client_api_enabled], false)
	user = insert(:user)
	reader = insert(:user)
	{:ok, _note_activity} = CommonAPI.post(user, %{status: "mew mew", visibility: "local"})

	resp =
	conn
	\|> assign(:user, reader)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")
	\|> json_response(200)

	assert %{"orderedItems" => []} = resp
	end

	test "it returns a note activity in a collection", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity, fetch: false)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")

	assert response(conn, 200) =~ note_object.data["content"]
	end

	test "it returns an announce activity in a collection", %{conn: conn} do
	announce_activity = insert(:announce_activity)
	user = User.get_cached_by_ap_id(announce_activity.data["actor"])

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox?page=true")

	assert response(conn, 200) =~ announce_activity.data["object"]
	end

	test "It returns poll Answers when authenticated", %{conn: conn} do
	poller = insert(:user)
	voter = insert(:user)

	{:ok, activity} =
	CommonAPI.post(poller, %{
	status: "suya...",
	poll: %{options: ["suya", "suya.", "suya.."], expires_in: 10}
	})

	assert question = Object.normalize(activity, fetch: false)

	{:ok, [activity], _object} = CommonAPI.vote(question, voter, [1])

	assert outbox_get =
	conn
	\|> assign(:user, voter)
	\|> put_req_header("accept", "application/activity+json")
	\|> get(voter.ap_id <> "/outbox?page=true")
	\|> json_response(200)

	assert [answer_outbox] = outbox_get["orderedItems"]
	assert answer_outbox["id"] == activity.data["id"]
	end

	test "it works with authorized fetch forced when authenticated" do
	clear_config([:activitypub, :authorized_fetch_mode], true)

	user = insert(:user)
	outbox_endpoint = user.ap_id <> "/outbox"

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get(outbox_endpoint)

	assert json_response(conn, 200)
	end

	test "it fails with authorized fetch forced when unauthenticated", %{conn: conn} do
	clear_config([:activitypub, :authorized_fetch_mode], true)

	user = insert(:user)
	outbox_endpoint = user.ap_id <> "/outbox"

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get(outbox_endpoint)

	assert response(conn, 401)
	end
	end

	describe "POST /users/:nickname/outbox (C2S)" do
	setup do: clear_config([:instance, :limit])

	setup do
	[
	activity: %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"type" => "Create",
	"object" => %{
	"type" => "Note",
	"content" => "AP C2S test",
	"to" => "https://www.w3.org/ns/activitystreams#Public",
	"cc" => []
	}
	}
	]
	end

	test "it rejects posts from other users / unauthenticated users", %{
	conn: conn,
	activity: activity
	} do
	user = insert(:user)
	other_user = insert(:user)
	conn = put_req_header(conn, "content-type", "application/activity+json")

	conn
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(403)

	conn
	\|> assign(:user, other_user)
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(403)
	end

	test "it inserts an incoming create activity into the database", %{
	conn: conn,
	activity: activity
	} do
	user = insert(:user)

	result =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(201)

	assert Activity.get_by_ap_id(result["id"])
	assert result["object"]
	assert %Object{data: object} = Object.normalize(result["object"], fetch: false)
	assert object["content"] == activity["object"]["content"]
	end

	+ test "it inserts an incoming reply create activity into the database", %{conn: conn} do
	+ user = insert(:user)
	+ replying_user = insert(:user)
	+
	+ {:ok, activity} = CommonAPI.post(user, %{status: "cofe"})
	+
	+ data = %{
	+ type: "Create",
	+ object: %{
	+ to: [Pleroma.Constants.as_public(), user.ap_id],
	+ cc: [replying_user.follower_address],
	+ inReplyTo: activity.object.data["id"],
	+ content: "green tea",
	+ type: "Note"
	+ }
	+ }
	+
	+ result =
	+ conn
	+ \|> assign(:user, replying_user)
	+ \|> put_req_header("content-type", "application/activity+json")
	+ \|> post("/users/#{replying_user.nickname}/outbox", data)
	+ \|> json_response(201)
	+
	+ updated_object = Object.normalize(activity.object.data["id"], fetch: false)
	+
	+ assert Activity.get_by_ap_id(result["id"])
	+ assert result["object"]
	+ assert %Object{data: object} = Object.normalize(result["object"], fetch: false)
	+ assert object["content"] == data.object.content
	+ assert Pleroma.Web.ActivityPub.Visibility.public?(object)
	+ assert object["inReplyTo"] == activity.object.data["id"]
	+ assert updated_object.data["repliesCount"] == 1
	+ end
	+
	test "it rejects anything beyond 'Note' creations", %{conn: conn, activity: activity} do
	user = insert(:user)

	activity =
	activity
	\|> put_in(["object", "type"], "Benis")

	_result =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(400)
	end

	test "it inserts an incoming sensitive activity into the database", %{
	conn: conn,
	activity: activity
	} do
	user = insert(:user)
	conn = assign(conn, :user, user)
	object = Map.put(activity["object"], "sensitive", true)
	activity = Map.put(activity, "object", object)

	response =
	conn
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(201)

	assert Activity.get_by_ap_id(response["id"])
	assert response["object"]
	assert %Object{data: response_object} = Object.normalize(response["object"], fetch: false)
	assert response_object["sensitive"] == true
	assert response_object["content"] == activity["object"]["content"]

	representation =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get(response["id"])
	\|> json_response(200)

	assert representation["object"]["sensitive"] == true
	end

	test "it rejects an incoming activity with bogus type", %{conn: conn, activity: activity} do
	user = insert(:user)
	activity = Map.put(activity, "type", "BadType")

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)

	assert json_response(conn, 400)
	end

	test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity, fetch: false)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	data = %{
	"type" => "Delete",
	"object" => %{
	"id" => note_object.data["id"]
	}
	}

	result =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)
	\|> json_response(201)

	assert Activity.get_by_ap_id(result["id"])

	assert object = Object.get_by_ap_id(note_object.data["id"])
	assert object.data["type"] == "Tombstone"
	end

	test "it rejects delete activity of object from other actor", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity, fetch: false)
	user = insert(:user)

	data = %{
	type: "Delete",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	assert json_response(conn, 403)
	end

	test "it rejects update activity of object from other actor", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity, fetch: false)
	user = insert(:user)

	data = %{
	type: "Update",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	assert json_response(conn, 400)
	assert note_object == Object.normalize(note_activity, fetch: false)
	end

	+ test "it rejects Add to other user's collection", %{conn: conn} do
	+ user = insert(:user)
	+ target_user = insert(:user)
	+
	+ {:ok, activity} = CommonAPI.post(user, %{status: "Post"})
	+ object = Object.normalize(activity, fetch: false)
	+ object_id = object.data["id"]
	+
	+ data = %{
	+ type: "Add",
	+ target:
	+ "#{Pleroma.Web.Endpoint.url()}/users/#{target_user.nickname}/collections/featured",
	+ object: object_id
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> put_req_header("content-type", "application/activity+json")
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+
	+ assert json_response(conn, 400)
	+ end
	+
	+ test "it rejects Remove to other user's collection", %{conn: conn} do
	+ user = insert(:user)
	+ target_user = insert(:user)
	+
	+ {:ok, activity} = CommonAPI.post(user, %{status: "Post"})
	+ object = Object.normalize(activity, fetch: false)
	+ object_id = object.data["id"]
	+
	+ data = %{
	+ type: "Remove",
	+ target:
	+ "#{Pleroma.Web.Endpoint.url()}/users/#{target_user.nickname}/collections/featured",
	+ object: object_id
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> put_req_header("content-type", "application/activity+json")
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+
	+ assert json_response(conn, 400)
	+ end
	+
	+ test "it rejects updating Actor's profile", %{conn: conn} do
	+ user = insert(:user, local: true)
	+
	+ user_object = Pleroma.Web.ActivityPub.UserView.render("user.json", %{user: user})
	+ user_object_new = Map.put(user_object, "name", "lain")
	+
	+ data = %{
	+ type: "Update",
	+ object: user_object_new
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+
	+ updated_user_object = Pleroma.Web.ActivityPub.UserView.render("user.json", %{user: user})
	+
	+ assert updated_user_object == user_object
	+ assert json_response(conn, 400)
	+ end
	+
	+ # Actor publicKey tests are redundant with above test,
	+ # left here for the case that Updating Actors is ever supported
	+ test "it rejects updating Actor's publicKey", %{conn: conn} do
	+ user = insert(:user, local: true)
	+
	+ {:ok, pem} = Pleroma.Keys.generate_rsa_pem()
	+ {:ok, _, public_key} = Pleroma.Keys.keys_from_pem(pem)
	+ # Taken from UserView
	+ public_key = :public_key.pem_entry_encode(:SubjectPublicKeyInfo, public_key)
	+ public_key = :public_key.pem_encode([public_key])
	+
	+ user_object = Pleroma.Web.ActivityPub.UserView.render("user.json", %{user: user})
	+ user_object_public_key = Map.fetch!(user_object, "publicKey")
	+ user_object_public_key = Map.put(user_object_public_key, "publicKeyPem", public_key)
	+ user_object_new = Map.put(user_object, "publicKey", user_object_public_key)
	+
	+ refute user_object == user_object_new
	+
	+ data = %{
	+ type: "Update",
	+ object: user_object_new
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+
	+ new_user_object = Pleroma.Web.ActivityPub.UserView.render("user.json", %{user: user})
	+
	+ assert user_object == new_user_object
	+ assert json_response(conn, 400)
	+ end
	+
	+ test "it rejects updating Actor's publicKey of another user", %{conn: conn} do
	+ user = insert(:user)
	+ target_user = insert(:user, local: true)
	+
	+ {:ok, pem} = Pleroma.Keys.generate_rsa_pem()
	+ {:ok, _, public_key} = Pleroma.Keys.keys_from_pem(pem)
	+ # Taken from UserView
	+ public_key = :public_key.pem_entry_encode(:SubjectPublicKeyInfo, public_key)
	+ public_key = :public_key.pem_encode([public_key])
	+
	+ target_user_object =
	+ Pleroma.Web.ActivityPub.UserView.render("user.json", %{user: target_user})
	+
	+ target_user_object_public_key = Map.fetch!(target_user_object, "publicKey")
	+
	+ target_user_object_public_key =
	+ Map.put(target_user_object_public_key, "publicKeyPem", public_key)
	+
	+ target_user_object_new =
	+ Map.put(target_user_object, "publicKey", target_user_object_public_key)
	+
	+ refute target_user_object == target_user_object_new
	+
	+ data = %{
	+ type: "Update",
	+ object: target_user_object_new
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/users/#{target_user.nickname}/outbox", data)
	+
	+ new_target_user_object =
	+ Pleroma.Web.ActivityPub.UserView.render("user.json", %{user: target_user})
	+
	+ assert target_user_object == new_target_user_object
	+ assert json_response(conn, 403)
	+ end
	+
	+ test "it rejects creating Actors of type Application", %{conn: conn} do
	+ user = insert(:user, local: true)
	+
	+ data = %{
	+ type: "Create",
	+ object: %{
	+ type: "Application"
	+ }
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+
	+ assert json_response(conn, 400)
	+ end
	+
	+ test "it rejects creating Actors of type Person", %{conn: conn} do
	+ user = insert(:user, local: true)
	+
	+ data = %{
	+ type: "Create",
	+ object: %{
	+ type: "Person"
	+ }
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+
	+ assert json_response(conn, 400)
	+ end
	+
	+ test "it rejects creating Actors of type Service", %{conn: conn} do
	+ user = insert(:user, local: true)
	+
	+ data = %{
	+ type: "Create",
	+ object: %{
	+ type: "Service"
	+ }
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, user)
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/users/#{user.nickname}/outbox", data)
	+
	+ assert json_response(conn, 400)
	+ end
	+
	+ test "it rejects like activity to object invisible to actor", %{conn: conn} do
	+ user = insert(:user)
	+ stranger = insert(:user, local: true)
	+ {:ok, post} = CommonAPI.post(user, %{status: "cofe", visibility: "private"})
	+
	+ assert Pleroma.Web.ActivityPub.Visibility.private?(post)
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(post, stranger)
	+
	+ post_object = Object.normalize(post, fetch: false)
	+
	+ data = %{
	+ type: "Like",
	+ object: %{
	+ id: post_object.data["id"]
	+ }
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, stranger)
	+ \|> put_req_header("content-type", "application/activity+json")
	+ \|> post("/users/#{stranger.nickname}/outbox", data)
	+
	+ assert json_response(conn, 403)
	+ end
	+
	+ test "it rejects announce activity to object invisible to actor", %{conn: conn} do
	+ user = insert(:user)
	+ stranger = insert(:user, local: true)
	+ {:ok, post} = CommonAPI.post(user, %{status: "cofe", visibility: "private"})
	+
	+ assert Pleroma.Web.ActivityPub.Visibility.private?(post)
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(post, stranger)
	+
	+ post_object = Object.normalize(post, fetch: false)
	+
	+ data = %{
	+ type: "Announce",
	+ object: %{
	+ id: post_object.data["id"]
	+ }
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, stranger)
	+ \|> put_req_header("content-type", "application/activity+json")
	+ \|> post("/users/#{stranger.nickname}/outbox", data)
	+
	+ assert json_response(conn, 403)
	+ end
	+
	+ test "it rejects emojireact activity to object invisible to actor", %{conn: conn} do
	+ user = insert(:user)
	+ stranger = insert(:user, local: true)
	+ {:ok, post} = CommonAPI.post(user, %{status: "cofe", visibility: "private"})
	+
	+ assert Pleroma.Web.ActivityPub.Visibility.private?(post)
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(post, stranger)
	+
	+ post_object = Object.normalize(post, fetch: false)
	+
	+ data = %{
	+ type: "EmojiReact",
	+ object: %{
	+ id: post_object.data["id"]
	+ },
	+ content: "😀"
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:user, stranger)
	+ \|> put_req_header("content-type", "application/activity+json")
	+ \|> post("/users/#{stranger.nickname}/outbox", data)
	+
	+ assert json_response(conn, 403)
	+ end
	+
	test "it increases like count when receiving a like action", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity, fetch: false)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	data = %{
	type: "Like",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)
	assert Activity.get_by_ap_id(result["id"])

	assert object = Object.get_by_ap_id(note_object.data["id"])
	assert object.data["like_count"] == 1
	end

	test "it doesn't spreads faulty attributedTo or actor fields", %{
	conn: conn,
	activity: activity
	} do
	reimu = insert(:user, nickname: "reimu")
	cirno = insert(:user, nickname: "cirno")

	assert reimu.ap_id
	assert cirno.ap_id

	activity =
	activity
	\|> put_in(["object", "actor"], reimu.ap_id)
	\|> put_in(["object", "attributedTo"], reimu.ap_id)
	\|> put_in(["actor"], reimu.ap_id)
	\|> put_in(["attributedTo"], reimu.ap_id)

	_reimu_outbox =
	conn
	\|> assign(:user, cirno)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{reimu.nickname}/outbox", activity)
	\|> json_response(403)

	cirno_outbox =
	conn
	\|> assign(:user, cirno)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{cirno.nickname}/outbox", activity)
	\|> json_response(201)

	assert cirno_outbox["attributedTo"] == nil
	assert cirno_outbox["actor"] == cirno.ap_id

	assert cirno_object = Object.normalize(cirno_outbox["object"], fetch: false)
	assert cirno_object.data["actor"] == cirno.ap_id
	assert cirno_object.data["attributedTo"] == cirno.ap_id
	end

	test "Character limitation", %{conn: conn, activity: activity} do
	clear_config([:instance, :limit], 5)
	user = insert(:user)

	result =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", activity)
	\|> json_response(400)

	assert result == "Character limit (5 characters) exceeded, contains 11 characters"
	end
	end

	describe "/relay/followers" do
	test "it returns relay followers", %{conn: conn} do
	relay_actor = Relay.get_actor()
	user = insert(:user)
	User.follow(user, relay_actor)

	result =
	conn
	\|> get("/relay/followers")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user.ap_id]
	end

	test "on non-federating instance, it returns 404", %{conn: conn} do
	clear_config([:instance, :federating], false)
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> get("/relay/followers")
	\|> json_response(404)
	end
	end

	describe "/relay/following" do
	test "it returns relay following", %{conn: conn} do
	result =
	conn
	\|> get("/relay/following")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == []
	end

	test "on non-federating instance, it returns 404", %{conn: conn} do
	clear_config([:instance, :federating], false)
	user = insert(:user)

	conn
	\|> assign(:user, user)
	\|> get("/relay/following")
	\|> json_response(404)
	end
	end

	describe "/users/:nickname/followers" do
	test "it returns the followers in a collection", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	\|> assign(:user, user_two)
	\|> get("/users/#{user_two.nickname}/followers")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user.ap_id]
	end

	test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, hide_followers: true)
	User.follow(user, user_two)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user_two.nickname}/followers")
	\|> json_response(200)

	assert is_binary(result["first"])
	end

	test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
	%{conn: conn} do
	user = insert(:user)
	other_user = insert(:user, hide_followers: true)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{other_user.nickname}/followers?page=1")

	assert result.status == 403
	assert result.resp_body == ""
	end

	test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
	%{conn: conn} do
	user = insert(:user, hide_followers: true)
	other_user = insert(:user)
	{:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers?page=1")
	\|> json_response(200)

	assert result["totalItems"] == 1
	assert result["orderedItems"] == [other_user.ap_id]
	end

	test "it works for more than 10 users", %{conn: conn} do
	user = insert(:user)

	Enum.each(1..15, fn _ ->
	other_user = insert(:user)
	User.follow(other_user, user)
	end)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers")
	\|> json_response(200)

	assert length(result["first"]["orderedItems"]) == 10
	assert result["first"]["totalItems"] == 15
	assert result["totalItems"] == 15

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/followers?page=2")
	\|> json_response(200)

	assert length(result["orderedItems"]) == 5
	assert result["totalItems"] == 15
	end

	test "does not require authentication", %{conn: conn} do
	user = insert(:user)

	conn
	\|> get("/users/#{user.nickname}/followers")
	\|> json_response(200)
	end
	end

	describe "/users/:nickname/following" do
	test "it returns the following in a collection", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user_two.ap_id]
	end

	test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, hide_follows: true)
	User.follow(user, user_two)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user_two.nickname}/following")
	\|> json_response(200)

	assert is_binary(result["first"])
	end

	test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
	%{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, hide_follows: true)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user_two.nickname}/following?page=1")

	assert result.status == 403
	assert result.resp_body == ""
	end

	test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
	%{conn: conn} do
	user = insert(:user, hide_follows: true)
	other_user = insert(:user)
	{:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following?page=1")
	\|> json_response(200)

	assert result["totalItems"] == 1
	assert result["orderedItems"] == [other_user.ap_id]
	end

	test "it works for more than 10 users", %{conn: conn} do
	user = insert(:user)

	Enum.each(1..15, fn _ ->
	user = User.get_cached_by_id(user.id)
	other_user = insert(:user)
	User.follow(user, other_user)
	end)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	assert length(result["first"]["orderedItems"]) == 10
	assert result["first"]["totalItems"] == 15
	assert result["totalItems"] == 15

	result =
	conn
	\|> assign(:user, user)
	\|> get("/users/#{user.nickname}/following?page=2")
	\|> json_response(200)

	assert length(result["orderedItems"]) == 5
	assert result["totalItems"] == 15
	end

	test "does not require authentication", %{conn: conn} do
	user = insert(:user)

	conn
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)
	end
	end

	describe "delivery tracking" do
	test "it tracks a signed object fetch", %{conn: conn} do
	user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity, fetch: false)

	object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(object_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	end

	test "it tracks a signed activity fetch", %{conn: conn} do
	user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity, fetch: false)

	activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(activity_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	end

	test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
	user = insert(:user, local: false)
	other_user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity, fetch: false)

	object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(object_path)
	\|> json_response(200)

	build_conn()
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, other_user)
	\|> get(object_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	assert Delivery.get(object.id, other_user.id)
	end

	test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
	user = insert(:user, local: false)
	other_user = insert(:user, local: false)
	activity = insert(:note_activity)
	object = Object.normalize(activity, fetch: false)

	activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())

	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, user)
	\|> get(activity_path)
	\|> json_response(200)

	build_conn()
	\|> put_req_header("accept", "application/activity+json")
	\|> assign(:user, other_user)
	\|> get(activity_path)
	\|> json_response(200)

	assert Delivery.get(object.id, user.id)
	assert Delivery.get(object.id, other_user.id)
	end
	end

	describe "Additional ActivityPub C2S endpoints" do
	test "GET /api/ap/whoami", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/ap/whoami")

	user = User.get_cached_by_id(user.id)

	assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)

	conn
	\|> get("/api/ap/whoami")
	\|> json_response(403)
	end

	setup do: clear_config([:media_proxy])
	setup do: clear_config([Pleroma.Upload])

	test "POST /api/ap/upload_media", %{conn: conn} do
	user = insert(:user)

	desc = "Description of the image"

	image = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	object =
	conn
	\|> assign(:user, user)
	\|> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
	\|> json_response(:created)

	assert object["name"] == desc
	assert object["type"] == "Document"
	assert object["actor"] == user.ap_id
	assert [%{"href" => object_href, "mediaType" => object_mediatype}] = object["url"]
	assert is_binary(object_href)
	assert object_mediatype == "image/jpeg"
	assert String.ends_with?(object_href, ".jpg")

	activity_request = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"type" => "Create",
	"object" => %{
	"type" => "Note",
	"content" => "AP C2S test, attachment",
	"attachment" => [object],
	"to" => "https://www.w3.org/ns/activitystreams#Public",
	"cc" => []
	}
	}

	activity_response =
	conn
	\|> assign(:user, user)
	\|> post("/users/#{user.nickname}/outbox", activity_request)
	\|> json_response(:created)

	assert activity_response["id"]
	assert activity_response["object"]
	assert activity_response["actor"] == user.ap_id

	assert %Object{data: %{"attachment" => [attachment]}} =
	Object.normalize(activity_response["object"], fetch: false)

	assert attachment["type"] == "Document"
	assert attachment["name"] == desc

	assert [
	%{
	"href" => ^object_href,
	"type" => "Link",
	"mediaType" => ^object_mediatype
	}
	] = attachment["url"]

	# Fails if unauthenticated
	conn
	\|> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
	\|> json_response(403)
	end

	test "they don't work when C2S API is disabled", %{conn: conn} do
	clear_config([:activitypub, :client_api_enabled], false)

	user = insert(:user)

	assert conn
	\|> assign(:user, user)
	\|> get("/api/ap/whoami")
	\|> response(403)

	desc = "Description of the image"

	image = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	assert conn
	\|> assign(:user, user)
	\|> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
	\|> response(403)
	end
	end

	test "pinned collection", %{conn: conn} do
	clear_config([:instance, :max_pinned_statuses], 2)
	user = insert(:user)
	objects = insert_list(2, :note, user: user)

	Enum.reduce(objects, user, fn %{data: %{"id" => object_id}}, user ->
	{:ok, updated} = User.add_pinned_object_id(user, object_id)
	updated
	end)

	%{nickname: nickname, featured_address: featured_address, pinned_objects: pinned_objects} =
	refresh_record(user)

	%{"id" => ^featured_address, "orderedItems" => items, "totalItems" => 2} =
	conn
	\|> get("/users/#{nickname}/collections/featured")
	\|> json_response(200)

	object_ids = Enum.map(items, & &1["id"])

	assert Enum.all?(pinned_objects, fn {obj_id, _} ->
	obj_id in object_ids
	end)
	end
	end
	diff --git a/test/pleroma/web/activity_pub/transmogrifier_test.exs b/test/pleroma/web/activity_pub/transmogrifier_test.exs
	index f89e34a69..6dc4423fa 100644
	--- a/test/pleroma/web/activity_pub/transmogrifier_test.exs
	+++ b/test/pleroma/web/activity_pub/transmogrifier_test.exs
	@@ -1,979 +1,1103 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.TransmogrifierTest do
	use Oban.Testing, repo: Pleroma.Repo
	use Pleroma.DataCase

	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.User
	+ alias Pleroma.Web.ActivityPub.Builder
	+ alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Transmogrifier
	+ alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.AdminAPI.AccountView
	alias Pleroma.Web.CommonAPI

	import Mock
	import Pleroma.Factory
	import ExUnit.CaptureLog

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	setup do: clear_config([:instance, :max_remote_account_fields])

	describe "handle_incoming" do
	test "it works for incoming unfollows with an existing follow" do
	user = insert(:user)

	follow_data =
	File.read!("test/fixtures/mastodon-follow-activity.json")
	\|> Jason.decode!()
	\|> Map.put("object", user.ap_id)

	{:ok, %Activity{data: _, local: false}} = Transmogrifier.handle_incoming(follow_data)

	data =
	File.read!("test/fixtures/mastodon-unfollow-activity.json")
	\|> Jason.decode!()
	\|> Map.put("object", follow_data)

	{:ok, %Activity{data: data, local: false}} = Transmogrifier.handle_incoming(data)

	assert data["type"] == "Undo"
	assert data["object"]["type"] == "Follow"
	assert data["object"]["object"] == user.ap_id
	assert data["actor"] == "http://mastodon.example.org/users/admin"

	refute User.following?(User.get_cached_by_ap_id(data["actor"]), user)
	end

	test "it accepts Flag activities" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "test post"})
	object = Object.normalize(activity, fetch: false)

	note_obj = %{
	"type" => "Note",
	"id" => activity.object.data["id"],
	"content" => "test post",
	"published" => object.data["published"],
	"actor" => AccountView.render("show.json", %{user: user, skip_visibility_check: true})
	}

	message = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"cc" => [user.ap_id],
	"object" => [user.ap_id, activity.data["id"]],
	"type" => "Flag",
	"content" => "blocked AND reported!!!",
	"actor" => other_user.ap_id
	}

	assert {:ok, activity} = Transmogrifier.handle_incoming(message)

	assert activity.data["object"] == [user.ap_id, note_obj]
	assert activity.data["content"] == "blocked AND reported!!!"
	assert activity.data["actor"] == other_user.ap_id
	assert activity.data["cc"] == [user.ap_id]
	end

	test "it accepts Move activities" do
	old_user = insert(:user)
	new_user = insert(:user)

	message = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"type" => "Move",
	"actor" => old_user.ap_id,
	"object" => old_user.ap_id,
	"target" => new_user.ap_id
	}

	assert :error = Transmogrifier.handle_incoming(message)

	{:ok, _new_user} = User.update_and_set_cache(new_user, %{also_known_as: [old_user.ap_id]})

	assert {:ok, %Activity{} = activity} = Transmogrifier.handle_incoming(message)
	assert activity.actor == old_user.ap_id
	assert activity.data["actor"] == old_user.ap_id
	assert activity.data["object"] == old_user.ap_id
	assert activity.data["target"] == new_user.ap_id
	assert activity.data["type"] == "Move"
	end

	test "it fixes both the Create and object contexts in a reply" do
	insert(:user, ap_id: "https://mk.absturztau.be/users/8ozbzjs3o8")
	insert(:user, ap_id: "https://p.helene.moe/users/helene")

	create_activity =
	"test/fixtures/create-pleroma-reply-to-misskey-thread.json"
	\|> File.read!()
	\|> Jason.decode!()

	assert {:ok, %Activity{} = activity} = Transmogrifier.handle_incoming(create_activity)

	object = Object.normalize(activity, fetch: false)

	assert activity.data["context"] == object.data["context"]
	end

	test "it fixes the public scope addressing" do
	insert(:user,
	ap_id: "https://mymath.rocks/endpoints/SYn3cl_N4HAPfPHgo2x37XunLEmhV9LnxCggcYwyec0"
	)

	object =
	"test/fixtures/bovine-bogus-public-note.json"
	\|> File.read!()
	\|> Jason.decode!()

	message = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"type" => "Create",
	"actor" => "https://mymath.rocks/endpoints/SYn3cl_N4HAPfPHgo2x37XunLEmhV9LnxCggcYwyec0",
	"object" => object
	}

	assert {:ok, activity} = Transmogrifier.handle_incoming(message)

	object = Object.normalize(activity, fetch: false)
	assert "https://www.w3.org/ns/activitystreams#Public" in activity.data["to"]
	assert "https://www.w3.org/ns/activitystreams#Public" in object.data["to"]
	end

	test "it keeps link tags" do
	insert(:user, ap_id: "https://example.org/users/alice")

	message = File.read!("test/fixtures/fep-e232.json") \|> Jason.decode!()

	assert capture_log(fn ->
	assert {:ok, activity} = Transmogrifier.handle_incoming(message)
	object = Object.normalize(activity)
	assert [%{"type" => "Mention"}, %{"type" => "Link"}] = object.data["tag"]
	end) =~ "Object rejected while fetching"
	end

	test "it accepts quote posts" do
	insert(:user, ap_id: "https://misskey.io/users/7rkrarq81i")

	object = File.read!("test/fixtures/quote_post/misskey_quote_post.json") \|> Jason.decode!()

	message = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"type" => "Create",
	"actor" => "https://misskey.io/users/7rkrarq81i",
	"object" => object
	}

	assert {:ok, activity} = Transmogrifier.handle_incoming(message)

	# Object was created in the database
	object = Object.normalize(activity)
	assert object.data["quoteUrl"] == "https://misskey.io/notes/8vs6wxufd0"

	# It fetched the quoted post
	assert Object.normalize("https://misskey.io/notes/8vs6wxufd0")
	end

	test "doesn't allow remote edits to fake local likes" do
	# as a spot check for no internal fields getting injected
	now = DateTime.utc_now()
	pub_date = DateTime.to_iso8601(Timex.subtract(now, Timex.Duration.from_minutes(3)))
	edit_date = DateTime.to_iso8601(now)

	local_user = insert(:user)

	create_data = %{
	"type" => "Create",
	"id" => "http://mastodon.example.org/users/admin/statuses/2619539638/activity",
	"actor" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [],
	"object" => %{
	"type" => "Note",
	"id" => "http://mastodon.example.org/users/admin/statuses/2619539638",
	"attributedTo" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [],
	"published" => pub_date,
	"content" => "miaow",
	"likes" => [local_user.ap_id]
	}
	}

	update_data =
	create_data
	\|> Map.put("type", "Update")
	\|> Map.put("id", create_data["object"]["id"] <> "/update/1")
	\|> put_in(["object", "content"], "miaow :3")
	\|> put_in(["object", "updated"], edit_date)
	\|> put_in(["object", "formerRepresentations"], %{
	"type" => "OrderedCollection",
	"totalItems" => 1,
	"orderedItems" => [create_data["object"]]
	})

	{:ok, %Pleroma.Activity{} = activity} = Transmogrifier.handle_incoming(create_data)
	%Pleroma.Object{} = object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["content"] == "miaow"
	assert object.data["likes"] == []
	assert object.data["like_count"] == 0

	{:ok, %Pleroma.Activity{} = activity} = Transmogrifier.handle_incoming(update_data)
	%Pleroma.Object{} = object = Object.get_by_ap_id(activity.data["object"]["id"])
	assert object.data["content"] == "miaow :3"
	assert object.data["likes"] == []
	assert object.data["like_count"] == 0
	end

	test "strips internal fields from history items in edited notes" do
	now = DateTime.utc_now()
	pub_date = DateTime.to_iso8601(Timex.subtract(now, Timex.Duration.from_minutes(3)))
	edit_date = DateTime.to_iso8601(now)

	local_user = insert(:user)

	create_data = %{
	"type" => "Create",
	"id" => "http://mastodon.example.org/users/admin/statuses/2619539638/activity",
	"actor" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [],
	"object" => %{
	"type" => "Note",
	"id" => "http://mastodon.example.org/users/admin/statuses/2619539638",
	"attributedTo" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [],
	"published" => pub_date,
	"content" => "miaow",
	"likes" => [],
	"like_count" => 0
	}
	}

	update_data =
	create_data
	\|> Map.put("type", "Update")
	\|> Map.put("id", create_data["object"]["id"] <> "/update/1")
	\|> put_in(["object", "content"], "miaow :3")
	\|> put_in(["object", "updated"], edit_date)
	\|> put_in(["object", "formerRepresentations"], %{
	"type" => "OrderedCollection",
	"totalItems" => 1,
	"orderedItems" => [
	Map.merge(create_data["object"], %{
	"likes" => [local_user.ap_id],
	"like_count" => 1,
	"pleroma" => %{"internal_field" => "should_be_stripped"}
	})
	]
	})

	{:ok, %Pleroma.Activity{} = activity} = Transmogrifier.handle_incoming(create_data)
	%Pleroma.Object{} = object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["content"] == "miaow"
	assert object.data["likes"] == []
	assert object.data["like_count"] == 0

	{:ok, %Pleroma.Activity{} = activity} = Transmogrifier.handle_incoming(update_data)
	%Pleroma.Object{} = object = Object.get_by_ap_id(activity.data["object"]["id"])
	assert object.data["content"] == "miaow :3"
	assert object.data["likes"] == []
	assert object.data["like_count"] == 0

	# Check that internal fields are stripped from history items
	history_item = List.first(object.data["formerRepresentations"]["orderedItems"])
	assert history_item["likes"] == []
	assert history_item["like_count"] == 0
	refute Map.has_key?(history_item, "pleroma")
	end

	test "doesn't trip over remote likes in notes" do
	now = DateTime.utc_now()
	pub_date = DateTime.to_iso8601(Timex.subtract(now, Timex.Duration.from_minutes(3)))
	edit_date = DateTime.to_iso8601(now)

	create_data = %{
	"type" => "Create",
	"id" => "http://mastodon.example.org/users/admin/statuses/3409297097/activity",
	"actor" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [],
	"object" => %{
	"type" => "Note",
	"id" => "http://mastodon.example.org/users/admin/statuses/3409297097",
	"attributedTo" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [],
	"published" => pub_date,
	"content" => "miaow",
	"likes" => %{
	"id" => "http://mastodon.example.org/users/admin/statuses/3409297097/likes",
	"totalItems" => 0,
	"type" => "Collection"
	}
	}
	}

	update_data =
	create_data
	\|> Map.put("type", "Update")
	\|> Map.put("id", create_data["object"]["id"] <> "/update/1")
	\|> put_in(["object", "content"], "miaow :3")
	\|> put_in(["object", "updated"], edit_date)
	\|> put_in(["object", "likes", "totalItems"], 666)
	\|> put_in(["object", "formerRepresentations"], %{
	"type" => "OrderedCollection",
	"totalItems" => 1,
	"orderedItems" => [create_data["object"]]
	})

	{:ok, %Pleroma.Activity{} = activity} = Transmogrifier.handle_incoming(create_data)
	%Pleroma.Object{} = object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["content"] == "miaow"
	assert object.data["likes"] == []
	assert object.data["like_count"] == 0

	{:ok, %Pleroma.Activity{} = activity} = Transmogrifier.handle_incoming(update_data)
	%Pleroma.Object{} = object = Object.get_by_ap_id(activity.data["object"]["id"])
	assert object.data["content"] == "miaow :3"
	assert object.data["likes"] == []
	# in the future this should retain remote likes, but for now:
	assert object.data["like_count"] == 0
	end

	test "doesn't trip over remote likes in polls" do
	now = DateTime.utc_now()
	pub_date = DateTime.to_iso8601(Timex.subtract(now, Timex.Duration.from_minutes(3)))
	edit_date = DateTime.to_iso8601(now)

	create_data = %{
	"type" => "Create",
	"id" => "http://mastodon.example.org/users/admin/statuses/2471790073/activity",
	"actor" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [],
	"object" => %{
	"type" => "Question",
	"id" => "http://mastodon.example.org/users/admin/statuses/2471790073",
	"attributedTo" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [],
	"published" => pub_date,
	"content" => "vote!",
	"anyOf" => [
	%{
	"type" => "Note",
	"name" => "a",
	"replies" => %{
	"type" => "Collection",
	"totalItems" => 3
	}
	},
	%{
	"type" => "Note",
	"name" => "b",
	"replies" => %{
	"type" => "Collection",
	"totalItems" => 1
	}
	}
	],
	"likes" => %{
	"id" => "http://mastodon.example.org/users/admin/statuses/2471790073/likes",
	"totalItems" => 0,
	"type" => "Collection"
	}
	}
	}

	update_data =
	create_data
	\|> Map.put("type", "Update")
	\|> Map.put("id", create_data["object"]["id"] <> "/update/1")
	\|> put_in(["object", "content"], "vote now!")
	\|> put_in(["object", "updated"], edit_date)
	\|> put_in(["object", "likes", "totalItems"], 666)
	\|> put_in(["object", "formerRepresentations"], %{
	"type" => "OrderedCollection",
	"totalItems" => 1,
	"orderedItems" => [create_data["object"]]
	})

	{:ok, %Pleroma.Activity{} = activity} = Transmogrifier.handle_incoming(create_data)
	%Pleroma.Object{} = object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["content"] == "vote!"
	assert object.data["likes"] == []
	assert object.data["like_count"] == 0

	{:ok, %Pleroma.Activity{} = activity} = Transmogrifier.handle_incoming(update_data)
	%Pleroma.Object{} = object = Object.get_by_ap_id(activity.data["object"]["id"])
	assert object.data["content"] == "vote now!"
	assert object.data["likes"] == []
	# in the future this should retain remote likes, but for now:
	assert object.data["like_count"] == 0
	end
	end

	describe "prepare outgoing" do
	test "it inlines private announced objects" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "hey", visibility: "private"})

	{:ok, announce_activity} = CommonAPI.repeat(activity.id, user)

	{:ok, modified} = Transmogrifier.prepare_outgoing(announce_activity.data)

	assert modified["object"]["content"] == "hey"
	assert modified["object"]["actor"] == modified["object"]["attributedTo"]
	end

	test "it turns mentions into tags" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "hey, @#{other_user.nickname}, how are ya? #2hu"})

	with_mock Pleroma.Notification,
	get_notified_from_activity: fn _, _ -> [] end do
	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	object = modified["object"]

	expected_mention = %{
	"href" => other_user.ap_id,
	"name" => "@#{other_user.nickname}",
	"type" => "Mention"
	}

	expected_tag = %{
	"href" => Pleroma.Web.Endpoint.url() <> "/tags/2hu",
	"type" => "Hashtag",
	"name" => "#2hu"
	}

	refute called(Pleroma.Notification.get_notified_from_activity(:_, :_))
	assert Enum.member?(object["tag"], expected_tag)
	assert Enum.member?(object["tag"], expected_mention)
	end
	end

	test "it adds the json-ld context and the conversation property" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "hey"})
	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert modified["@context"] == Utils.make_json_ld_header()["@context"]

	assert modified["object"]["conversation"] == modified["context"]
	end

	test "it sets the 'attributedTo' property to the actor of the object if it doesn't have one" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "hey"})
	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert modified["object"]["actor"] == modified["object"]["attributedTo"]
	end

	test "it strips internal hashtag data" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "#2hu"})

	expected_tag = %{
	"href" => Pleroma.Web.Endpoint.url() <> "/tags/2hu",
	"type" => "Hashtag",
	"name" => "#2hu"
	}

	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert modified["object"]["tag"] == [expected_tag]
	end

	test "it strips internal fields" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "#2hu :firefox:",
	generator: %{type: "Application", name: "TestClient", url: "https://pleroma.social"}
	})

	# Ensure injected application data made it into the activity
	# as we don't have a Token to derive it from, otherwise it will
	# be nil and the test will pass
	assert %{
	type: "Application",
	name: "TestClient",
	url: "https://pleroma.social"
	} == activity.object.data["generator"]

	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert length(modified["object"]["tag"]) == 2

	assert is_nil(modified["object"]["emoji"])
	assert is_nil(modified["object"]["like_count"])
	assert is_nil(modified["object"]["announcements"])
	assert is_nil(modified["object"]["announcement_count"])
	assert is_nil(modified["object"]["generator"])
	+ assert is_nil(modified["object"]["rules"])
	+ assert is_nil(modified["object"]["language"])
	+ assert is_nil(modified["object"]["voters"])
	end

	test "it strips internal fields of article" do
	activity = insert(:article_activity)

	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert length(modified["object"]["tag"]) == 2

	assert is_nil(modified["object"]["emoji"])
	assert is_nil(modified["object"]["like_count"])
	assert is_nil(modified["object"]["announcements"])
	assert is_nil(modified["object"]["announcement_count"])
	assert is_nil(modified["object"]["likes"])
	end

	test "the directMessage flag is present" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "2hu :moominmamma:"})

	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert modified["directMessage"] == false

	{:ok, activity} = CommonAPI.post(user, %{status: "@#{other_user.nickname} :moominmamma:"})

	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert modified["directMessage"] == false

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "@#{other_user.nickname} :moominmamma:",
	visibility: "direct"
	})

	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert modified["directMessage"] == true
	end

	test "it strips BCC field" do
	user = insert(:user)
	{:ok, list} = Pleroma.List.create("foo", user)

	{:ok, activity} = CommonAPI.post(user, %{status: "foobar", visibility: "list:#{list.id}"})

	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert is_nil(modified["bcc"])
	end

	test "it can handle Listen activities" do
	listen_activity = insert(:listen)

	+ # This has an inlined object as in ObjectView
	{:ok, modified} = Transmogrifier.prepare_outgoing(listen_activity.data)

	assert modified["type"] == "Listen"

	user = insert(:user)

	{:ok, activity} = CommonAPI.listen(user, %{"title" => "lain radio episode 1"})

	- {:ok, _modified} = Transmogrifier.prepare_outgoing(activity.data)
	+ user_ap_id = user.ap_id
	+ activity_ap_id = activity.data["id"]
	+ activity_to = activity.data["to"]
	+ activity_cc = activity.data["cc"]
	+ object_ap_id = activity.data["object"]
	+ object_type = activity.object.data["type"]
	+
	+ # This does not have an inlined object
	+ {:ok, modified2} = Transmogrifier.prepare_outgoing(activity.data)
	+
	+ assert match?(
	+ %{
	+ "@context" => [_ \| _],
	+ "type" => "Listen",
	+ "actor" => ^user_ap_id,
	+ "to" => ^activity_to,
	+ "cc" => ^activity_cc,
	+ "context" => "http://localhost" <> _,
	+ "id" => ^activity_ap_id,
	+ "object" => %{
	+ "actor" => ^user_ap_id,
	+ "attributedTo" => ^user_ap_id,
	+ "id" => ^object_ap_id,
	+ "type" => ^object_type,
	+ "to" => ^activity_to,
	+ "cc" => ^activity_cc
	+ }
	+ },
	+ modified2
	+ )
	end

	test "custom emoji urls are URI encoded" do
	# :dinosaur: filename has a space -> dino walking.gif
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "everybody do the dinosaur :dinosaur:"})

	{:ok, prepared} = Transmogrifier.prepare_outgoing(activity.data)

	assert length(prepared["object"]["tag"]) == 1

	url = prepared["object"]["tag"] \|> List.first() \|> Map.get("icon") \|> Map.get("url")

	assert url == "http://localhost:4001/emoji/dino%20walking.gif"
	end

	test "Updates of Notes are handled" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "everybody do the dinosaur :dinosaur:"})
	{:ok, update} = CommonAPI.update(activity, user, %{status: "mew mew :blank:"})

	{:ok, prepared} = Transmogrifier.prepare_outgoing(update.data)

	assert %{
	"content" => "mew mew :blank:",
	"tag" => [%{"name" => ":blank:", "type" => "Emoji"}],
	"formerRepresentations" => %{
	"orderedItems" => [
	%{
	"content" => "everybody do the dinosaur :dinosaur:",
	"tag" => [%{"name" => ":dinosaur:", "type" => "Emoji"}]
	}
	]
	}
	} = prepared["object"]
	end

	+ test "Updates of Actors are handled" do
	+ user = insert(:user, local: true)
	+
	+ changeset = User.update_changeset(user, %{name: "new name"})
	+ {:ok, unpersisted_user} = Ecto.Changeset.apply_action(changeset, :update)
	+
	+ updated_object =
	+ UserView.render("user.json", user: unpersisted_user)
	+ \|> Map.delete("@context")
	+
	+ {:ok, update_data, []} = Builder.update(user, updated_object)
	+
	+ {:ok, activity, _} =
	+ Pipeline.common_pipeline(update_data,
	+ local: true,
	+ user_update_changeset: changeset
	+ )
	+
	+ assert {:ok, prepared} = Transmogrifier.prepare_outgoing(activity.data)
	+ assert prepared["type"] == "Update"
	+ assert prepared["@context"]
	+ assert prepared["object"]["type"] == user.actor_type
	+ end
	+
	+ test "Correctly handles Undo activities" do
	+ blocked = insert(:user)
	+ blocker = insert(:user, local: true)
	+
	+ blocked_ap_id = blocked.ap_id
	+ blocker_ap_id = blocker.ap_id
	+
	+ {:ok, %Activity{} = block_activity} = CommonAPI.block(blocked, blocker)
	+ {:ok, %Activity{} = undo_activity} = CommonAPI.unblock(blocked, blocker)
	+ {:ok, data} = Transmogrifier.prepare_outgoing(undo_activity.data)
	+
	+ block_ap_id = block_activity.data["id"]
	+ assert is_binary(block_ap_id)
	+
	+ assert match?(
	+ %{
	+ "@context" => [_ \| _],
	+ "type" => "Undo",
	+ "id" => "http://localhost" <> _,
	+ "actor" => ^blocker_ap_id,
	+ "object" => ^block_ap_id,
	+ "to" => [^blocked_ap_id],
	+ "cc" => [],
	+ "bto" => [],
	+ "bcc" => []
	+ },
	+ data
	+ )
	+ end
	+
	+ test "Correctly handles EmojiReact activities" do
	+ user = insert(:user, local: true)
	+ note_activity = insert(:note_activity)
	+
	+ user_ap_id = user.ap_id
	+ user_followers = user.follower_address
	+ note_author = note_activity.data["actor"]
	+ note_ap_id = note_activity.data["object"]
	+
	+ assert is_binary(note_author)
	+ assert is_binary(note_ap_id)
	+
	+ {:ok, react_activity} = CommonAPI.react_with_emoji(note_activity.id, user, "🐈")
	+ {:ok, data} = Transmogrifier.prepare_outgoing(react_activity.data)
	+
	+ assert match?(
	+ %{
	+ "@context" => [_ \| _],
	+ "type" => "EmojiReact",
	+ "actor" => ^user_ap_id,
	+ "to" => [^user_followers, ^note_author],
	+ "cc" => ["https://www.w3.org/ns/activitystreams#Public"],
	+ "bto" => [],
	+ "bcc" => [],
	+ "content" => "🐈",
	+ "context" => "2hu",
	+ "id" => "http://localhost" <> _,
	+ "object" => ^note_ap_id,
	+ "tag" => []
	+ },
	+ data
	+ )
	+ end
	+
	test "it prepares a quote post" do
	user = insert(:user)

	{:ok, quoted_post} = CommonAPI.post(user, %{status: "hey"})
	{:ok, quote_post} = CommonAPI.post(user, %{status: "hey", quoted_status_id: quoted_post.id})

	{:ok, modified} = Transmogrifier.prepare_outgoing(quote_post.data)

	%{data: %{"id" => quote_id}} = Object.normalize(quoted_post)

	assert modified["object"]["quoteUrl"] == quote_id
	assert modified["object"]["quoteUri"] == quote_id
	end

	test "it adds language of the object to its json-ld context" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "Cześć", language: "pl"})
	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.object.data)

	assert [_, _, %{"@language" => "pl"}] = modified["@context"]
	end

	test "it adds language of the object to Create activity json-ld context" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "Cześć", language: "pl"})
	{:ok, modified} = Transmogrifier.prepare_outgoing(activity.data)

	assert [_, _, %{"@language" => "pl"}] = modified["@context"]
	end

	test "it strips report data" do
	reporter = insert(:user)
	target_account = insert(:user)
	content = "foobar"
	{:ok, reported_activity} = CommonAPI.post(target_account, %{status: content})
	context = Utils.generate_context_id()

	object_ap_id = reported_activity.object.data["id"]

	assert {:ok, activity} =
	Pleroma.Web.ActivityPub.ActivityPub.flag(%{
	actor: reporter,
	context: context,
	account: target_account,
	statuses: [reported_activity],
	content: content
	})

	{:ok, data} = Transmogrifier.prepare_outgoing(activity.data)

	expected_data =
	activity.data
	\|> put_in(["object"], [target_account.ap_id, object_ap_id])
	\|> Map.put("actor", reporter.ap_id)
	\|> Map.merge(Utils.make_json_ld_header())

	assert data == expected_data
	end

	test "it strips report data and anonymize" do
	placeholder = insert(:user)

	reporter = insert(:user)
	target_account = insert(:user)
	content = "foobar"
	{:ok, reported_activity} = CommonAPI.post(target_account, %{status: content})
	context = Utils.generate_context_id()

	object_ap_id = reported_activity.object.data["id"]

	assert {:ok, activity} =
	Pleroma.Web.ActivityPub.ActivityPub.flag(%{
	actor: reporter,
	context: context,
	account: target_account,
	statuses: [reported_activity],
	content: content
	})

	clear_config([:activitypub, :anonymize_reporter], true)
	clear_config([:activitypub, :anonymize_reporter_local_nickname], placeholder.nickname)

	{:ok, data} = Transmogrifier.prepare_outgoing(activity.data)

	expected_data =
	activity.data
	\|> put_in(["object"], [target_account.ap_id, object_ap_id])
	\|> Map.put("actor", placeholder.ap_id)
	\|> Map.merge(Utils.make_json_ld_header())

	assert data == expected_data
	end
	end

	describe "actor rewriting" do
	test "it fixes the actor URL property to be a proper URI" do
	data = %{
	"url" => %{"href" => "http://example.com"}
	}

	rewritten = Transmogrifier.maybe_fix_user_object(data)
	assert rewritten["url"] == "http://example.com"
	end
	end

	describe "actor origin containment" do
	test "it rejects activities which reference objects with bogus origins" do
	data = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"id" => "http://mastodon.example.org/users/admin/activities/1234",
	"actor" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"object" => "https://info.pleroma.site/activity.json",
	"type" => "Announce"
	}

	assert capture_log(fn ->
	{:error, _} = Transmogrifier.handle_incoming(data)
	end) =~ "Object rejected while fetching"
	end

	test "it rejects activities which reference objects that have an incorrect attribution (variant 1)" do
	data = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"id" => "http://mastodon.example.org/users/admin/activities/1234",
	"actor" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"object" => "https://info.pleroma.site/activity2.json",
	"type" => "Announce"
	}

	assert capture_log(fn ->
	{:error, _} = Transmogrifier.handle_incoming(data)
	end) =~ "Object rejected while fetching"
	end

	test "it rejects activities which reference objects that have an incorrect attribution (variant 2)" do
	data = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"id" => "http://mastodon.example.org/users/admin/activities/1234",
	"actor" => "http://mastodon.example.org/users/admin",
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"object" => "https://info.pleroma.site/activity3.json",
	"type" => "Announce"
	}

	assert capture_log(fn ->
	{:error, _} = Transmogrifier.handle_incoming(data)
	end) =~ "Object rejected while fetching"
	end
	end

	describe "fix_explicit_addressing" do
	setup do
	user = insert(:user)
	[user: user]
	end

	test "moves non-explicitly mentioned actors to cc", %{user: user} do
	explicitly_mentioned_actors = [
	"https://pleroma.gold/users/user1",
	"https://pleroma.gold/user2"
	]

	object = %{
	"actor" => user.ap_id,
	"to" => explicitly_mentioned_actors ++ ["https://social.beepboop.ga/users/dirb"],
	"cc" => [],
	"tag" =>
	Enum.map(explicitly_mentioned_actors, fn href ->
	%{"type" => "Mention", "href" => href}
	end)
	}

	fixed_object = Transmogrifier.fix_explicit_addressing(object, user.follower_address)
	assert Enum.all?(explicitly_mentioned_actors, &(&1 in fixed_object["to"]))
	refute "https://social.beepboop.ga/users/dirb" in fixed_object["to"]
	assert "https://social.beepboop.ga/users/dirb" in fixed_object["cc"]
	end

	test "does not move actor's follower collection to cc", %{user: user} do
	object = %{
	"actor" => user.ap_id,
	"to" => [user.follower_address],
	"cc" => []
	}

	fixed_object = Transmogrifier.fix_explicit_addressing(object, user.follower_address)
	assert user.follower_address in fixed_object["to"]
	refute user.follower_address in fixed_object["cc"]
	end

	test "removes recipient's follower collection from cc", %{user: user} do
	recipient = insert(:user)

	object = %{
	"actor" => user.ap_id,
	"to" => [recipient.ap_id, "https://www.w3.org/ns/activitystreams#Public"],
	"cc" => [user.follower_address, recipient.follower_address]
	}

	fixed_object = Transmogrifier.fix_explicit_addressing(object, user.follower_address)

	assert user.follower_address in fixed_object["cc"]
	refute recipient.follower_address in fixed_object["cc"]
	refute recipient.follower_address in fixed_object["to"]
	end
	end

	describe "fix_summary/1" do
	test "returns fixed object" do
	assert Transmogrifier.fix_summary(%{"summary" => nil}) == %{"summary" => ""}
	assert Transmogrifier.fix_summary(%{"summary" => "ok"}) == %{"summary" => "ok"}
	assert Transmogrifier.fix_summary(%{}) == %{"summary" => ""}
	end
	end

	describe "fix_url/1" do
	test "fixes data for object when url is map" do
	object = %{
	"url" => %{
	"type" => "Link",
	"mimeType" => "video/mp4",
	"href" => "https://peede8d-46fb-ad81-2d4c2d1630e3-480.mp4"
	}
	}

	assert Transmogrifier.fix_url(object) == %{
	"url" => "https://peede8d-46fb-ad81-2d4c2d1630e3-480.mp4"
	}
	end

	test "returns non-modified object" do
	assert Transmogrifier.fix_url(%{"type" => "Text"}) == %{"type" => "Text"}
	end
	end

	describe "get_obj_helper/2" do
	test "returns nil when cannot normalize object" do
	assert capture_log(fn ->
	refute Transmogrifier.get_obj_helper("test-obj-id")
	end) =~ "Unsupported URI scheme"
	end

	test "returns {:ok, %Object{}} for success case" do
	assert {:ok, %Object{}} =
	Transmogrifier.get_obj_helper(
	"https://mstdn.io/users/mayuutann/statuses/99568293732299394"
	)
	end
	end

	describe "fix_attachments/1" do
	test "puts dimensions into attachment url field" do
	object = %{
	"attachment" => [
	%{
	"type" => "Document",
	"name" => "Hello world",
	"url" => "https://media.example.tld/1.jpg",
	"width" => 880,
	"height" => 960,
	"mediaType" => "image/jpeg",
	"blurhash" => "eTKL26+HDjcEIBVl;ds+K6t301W.t7nit7y1E,R:v}ai4nXSt7V@of"
	}
	]
	}

	expected = %{
	"attachment" => [
	%{
	"type" => "Document",
	"name" => "Hello world",
	"url" => [
	%{
	"type" => "Link",
	"mediaType" => "image/jpeg",
	"href" => "https://media.example.tld/1.jpg",
	"width" => 880,
	"height" => 960
	}
	],
	"mediaType" => "image/jpeg",
	"blurhash" => "eTKL26+HDjcEIBVl;ds+K6t301W.t7nit7y1E,R:v}ai4nXSt7V@of"
	}
	]
	}

	assert Transmogrifier.fix_attachments(object) == expected
	end
	end

	describe "prepare_object/1" do
	test "it processes history" do
	original = %{
	"formerRepresentations" => %{
	"orderedItems" => [
	%{
	"generator" => %{},
	"emoji" => %{"blobcat" => "http://localhost:4001/emoji/blobcat.png"}
	}
	]
	}
	}

	processed = Transmogrifier.prepare_object(original)

	history_item = Enum.at(processed["formerRepresentations"]["orderedItems"], 0)

	refute Map.has_key?(history_item, "generator")

	assert [%{"name" => ":blobcat:"}] = history_item["tag"]
	end

	test "it works when there is no or bad history" do
	original = %{
	"formerRepresentations" => %{
	"items" => [
	%{
	"generator" => %{},
	"emoji" => %{"blobcat" => "http://localhost:4001/emoji/blobcat.png"}
	}
	]
	}
	}

	processed = Transmogrifier.prepare_object(original)
	assert processed["formerRepresentations"] == original["formerRepresentations"]
	end

	test "it uses contentMap to specify post language" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "Cześć", language: "pl"})
	object = Transmogrifier.prepare_object(activity.object.data)

	assert %{"contentMap" => %{"pl" => "Cześć"}} = object
	end
	end
	end
	diff --git a/test/pleroma/web/activity_pub/views/object_view_test.exs b/test/pleroma/web/activity_pub/views/object_view_test.exs
	index 14258795f..cc276b4b7 100644
	--- a/test/pleroma/web/activity_pub/views/object_view_test.exs
	+++ b/test/pleroma/web/activity_pub/views/object_view_test.exs
	@@ -1,98 +1,117 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ObjectViewTest do
	use Pleroma.DataCase
	import Pleroma.Factory

	alias Pleroma.Object
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.CommonAPI

	test "renders a note object" do
	note = insert(:note)

	result = ObjectView.render("object.json", %{object: note})

	assert result["id"] == note.data["id"]
	assert result["to"] == note.data["to"]
	assert result["content"] == note.data["content"]
	assert result["type"] == "Note"
	assert result["@context"]
	end

	test "renders a note activity" do
	note = insert(:note_activity)
	object = Object.normalize(note, fetch: false)

	result = ObjectView.render("object.json", %{object: note})

	assert result["id"] == note.data["id"]
	assert result["to"] == note.data["to"]
	assert result["object"]["type"] == "Note"
	assert result["object"]["content"] == object.data["content"]
	assert result["type"] == "Create"
	assert result["@context"]
	end

	describe "note activity's `replies` collection rendering" do
	setup do: clear_config([:activitypub, :note_replies_output_limit], 5)

	test "renders `replies` collection for a note activity" do
	user = insert(:user)
	activity = insert(:note_activity, user: user)

	{:ok, self_reply1} =
	CommonAPI.post(user, %{status: "self-reply 1", in_reply_to_status_id: activity.id})

	replies_uris = [self_reply1.object.data["id"]]
	result = ObjectView.render("object.json", %{object: refresh_record(activity)})

	assert %{"type" => "Collection", "items" => ^replies_uris} =
	get_in(result, ["object", "replies"])
	end
	end

	test "renders a like activity" do
	note = insert(:note_activity)
	object = Object.normalize(note, fetch: false)
	user = insert(:user)

	{:ok, like_activity} = CommonAPI.favorite(note.id, user)

	result = ObjectView.render("object.json", %{object: like_activity})

	assert result["id"] == like_activity.data["id"]
	assert result["object"] == object.data["id"]
	assert result["type"] == "Like"
	end

	test "renders an announce activity" do
	note = insert(:note_activity)
	object = Object.normalize(note, fetch: false)
	user = insert(:user)

	{:ok, announce_activity} = CommonAPI.repeat(note.id, user)

	result = ObjectView.render("object.json", %{object: announce_activity})

	assert result["id"] == announce_activity.data["id"]
	assert result["object"] == object.data["id"]
	assert result["type"] == "Announce"
	end

	test "renders an undo announce activity" do
	note = insert(:note_activity)
	user = insert(:user)

	{:ok, announce} = CommonAPI.repeat(note.id, user)
	{:ok, undo} = CommonAPI.unrepeat(note.id, user)

	result = ObjectView.render("object.json", %{object: undo})

	assert result["id"] == undo.data["id"]
	assert result["object"] == announce.data["id"]
	assert result["type"] == "Undo"
	end
	+
	+ test "renders a listen activity" do
	+ audio = insert(:audio)
	+ user = insert(:user)
	+
	+ {:ok, listen_activity} = CommonAPI.listen(user, audio.data)
	+
	+ result = ObjectView.render("object.json", %{object: listen_activity})
	+
	+ assert result["id"] == listen_activity.data["id"]
	+ assert result["to"] == listen_activity.data["to"]
	+ assert result["type"] == "Listen"
	+ assert result["object"]["album"] == listen_activity.data["album"]
	+ assert result["object"]["artist"] == listen_activity.data["artist"]
	+ assert result["object"]["length"] == listen_activity.data["length"]
	+ assert result["object"]["title"] == listen_activity.data["title"]
	+ assert result["object"]["type"] == "Audio"
	+ assert result["@context"]
	+ end
	end
	diff --git a/test/pleroma/web/common_api_test.exs b/test/pleroma/web/common_api_test.exs
	index 9fc132610..52829b734 100644
	--- a/test/pleroma/web/common_api_test.exs
	+++ b/test/pleroma/web/common_api_test.exs
	@@ -1,2162 +1,2203 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPITest do
	use Oban.Testing, repo: Pleroma.Repo
	use Pleroma.DataCase, async: false

	alias Pleroma.Activity
	alias Pleroma.Chat
	alias Pleroma.Conversation.Participation
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.Rule
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.UnstubbedConfigMock, as: ConfigMock
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.AdminAPI.AccountView
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Workers.PollWorker

	import Ecto.Query, only: [from: 2, where: 3]
	import Mock
	import Mox
	import Pleroma.Factory

	require Pleroma.Activity.Queries
	require Pleroma.Constants

	defp get_announces_of_object(%{data: %{"id" => id}} = _object) do
	Pleroma.Activity.Queries.by_type("Announce")
	\|> Pleroma.Activity.Queries.by_object_id(id)
	\|> Pleroma.Repo.all()
	end

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	setup do
	ConfigMock
	\|> stub_with(Pleroma.Test.StaticConfig)

	:ok
	end

	setup do: clear_config([:instance, :safe_dm_mentions])
	setup do: clear_config([:instance, :limit])
	setup do: clear_config([:instance, :max_pinned_statuses])

	describe "posting polls" do
	test "it posts a poll" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "who is the best",
	poll: %{expires_in: 600, options: ["reimu", "marisa"]}
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["type"] == "Question"
	assert object.data["oneOf"] \|> length() == 2

	assert_enqueued(
	worker: PollWorker,
	args: %{op: "poll_end", activity_id: activity.id},
	scheduled_at: NaiveDateTime.from_iso8601!(object.data["closed"])
	)
	end
	end

	describe "blocking" do
	setup do
	blocker = insert(:user)
	blocked = insert(:user, local: false)
	CommonAPI.follow(blocked, blocker)
	CommonAPI.follow(blocker, blocked)
	CommonAPI.accept_follow_request(blocker, blocked)
	CommonAPI.accept_follow_request(blocked, blocked)
	%{blocker: blocker, blocked: blocked}
	end

	test "it blocks and federates", %{blocker: blocker, blocked: blocked} do
	clear_config([:instance, :federating], true)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert User.get_follow_state(blocker, blocked) == :follow_accept
	refute is_nil(Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(blocker, blocked))

	assert {:ok, block} = CommonAPI.block(blocked, blocker)

	assert block.local
	assert User.blocks?(blocker, blocked)
	refute User.following?(blocker, blocked)
	refute User.following?(blocked, blocker)

	refute User.get_follow_state(blocker, blocked)

	assert %{data: %{"state" => "reject"}} =
	Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(blocker, blocked)

	assert called(Pleroma.Web.Federator.publish(block))
	end
	end

	test "add expiring block", %{blocker: blocker, blocked: blocked} do
	{:ok, _} = CommonAPI.block(blocked, blocker, %{expires_in: 60})
	assert User.blocks?(blocker, blocked)

	worker = Pleroma.Workers.MuteExpireWorker
	args = %{"op" => "unblock_user", "blocker_id" => blocker.id, "blocked_id" => blocked.id}

	assert :ok = perform_job(worker, args)
	refute User.blocks?(blocker, blocked)
	end

	test "it blocks and does not federate if outgoing blocks are disabled", %{
	blocker: blocker,
	blocked: blocked
	} do
	clear_config([:instance, :federating], true)
	clear_config([:activitypub, :outgoing_blocks], false)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert {:ok, block} = CommonAPI.block(blocked, blocker)

	assert block.local
	assert User.blocks?(blocker, blocked)
	refute User.following?(blocker, blocked)
	refute User.following?(blocked, blocker)

	refute called(Pleroma.Web.Federator.publish(block))
	end
	end
	end

	describe "posting chat messages" do
	setup do: clear_config([:instance, :chat_limit])

	test "it posts a self-chat" do
	author = insert(:user)
	recipient = author

	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"remember to buy milk when milk truk arive"
	)

	assert activity.data["type"] == "Create"
	end

	test "it posts a chat message without content but with an attachment" do
	author = insert(:user)
	recipient = insert(:user)

	file = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, upload} = ActivityPub.upload(file, actor: author.ap_id)

	with_mocks([
	{
	Pleroma.Web.Streamer,
	[],
	[
	stream: fn _, _ ->
	nil
	end
	]
	},
	{
	Pleroma.Web.Push,
	[],
	[
	send: fn _ -> nil end
	]
	}
	]) do
	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	nil,
	media_id: upload.id
	)

	notification =
	Notification.for_user_and_activity(recipient, activity)
	\|> Repo.preload(:activity)

	assert called(Pleroma.Web.Push.send(notification))
	assert called(Pleroma.Web.Streamer.stream(["user", "user:notification"], notification))
	assert called(Pleroma.Web.Streamer.stream(["user", "user:pleroma_chat"], :_))

	assert activity
	end
	end

	test "it adds html newlines" do
	author = insert(:user)
	recipient = insert(:user)

	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"uguu\nuguuu"
	)

	assert other_user.ap_id not in activity.recipients

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == "uguu<br/>uguuu"
	end

	test "it linkifies" do
	author = insert(:user)
	recipient = insert(:user)

	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"https://example.org is the site of @#{other_user.nickname} #2hu"
	)

	assert other_user.ap_id not in activity.recipients

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] ==
	"<a href=\"https://example.org\" rel=\"ugc\">https://example.org</a> is the site of <span class=\"h-card\"><a class=\"u-url mention\" data-user=\"#{other_user.id}\" href=\"#{other_user.ap_id}\" rel=\"ugc\">@<span>#{other_user.nickname}</span></a></span> <a class=\"hashtag\" data-tag=\"2hu\" href=\"http://localhost:4001/tag/2hu\">#2hu</a>"
	end

	test "it posts a chat message" do
	author = insert(:user)
	recipient = insert(:user)

	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"a test message <script>alert('uuu')</script> :firefox:"
	)

	assert activity.data["type"] == "Create"
	assert activity.local
	object = Object.normalize(activity, fetch: false)

	assert object.data["type"] == "ChatMessage"
	assert object.data["to"] == [recipient.ap_id]

	assert object.data["content"] ==
	"a test message <script>alert('uuu')</script> :firefox:"

	assert object.data["emoji"] == %{
	"firefox" => "http://localhost:4001/emoji/Firefox.gif"
	}

	assert Chat.get(author.id, recipient.ap_id)
	assert Chat.get(recipient.id, author.ap_id)

	assert :ok == Pleroma.Web.Federator.perform(:publish, activity)
	end

	test "it reject messages over the local limit" do
	clear_config([:instance, :chat_limit], 2)

	author = insert(:user)
	recipient = insert(:user)

	{:error, message} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"123"
	)

	assert message == :content_too_long
	end

	test "it reject messages via MRF" do
	clear_config([:mrf_keyword, :reject], ["GNO"])
	clear_config([:mrf, :policies], [Pleroma.Web.ActivityPub.MRF.KeywordPolicy])

	author = insert(:user)
	recipient = insert(:user)

	assert {:reject, "[KeywordPolicy] Matches with rejected keyword"} ==
	CommonAPI.post_chat_message(author, recipient, "GNO/Linux")
	end

	test "it reject messages with attachments not belonging to user" do
	author = insert(:user)
	not_author = insert(:user)
	recipient = author

	attachment = insert(:attachment, %{user: not_author})

	{:error, message} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"123",
	media_id: attachment.id
	)

	assert message == :forbidden
	end
	end

	describe "unblocking" do
	test "it works even without an existing block activity" do
	blocked = insert(:user)
	blocker = insert(:user)
	User.block(blocker, blocked)

	assert User.blocks?(blocker, blocked)
	assert {:ok, :no_activity} == CommonAPI.unblock(blocked, blocker)
	refute User.blocks?(blocker, blocked)
	end
	end

	describe "deletion" do
	test "it works with pruned objects" do
	user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	clear_config([:instance, :federating], true)

	Object.normalize(post, fetch: false)
	\|> Object.prune()

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert {:ok, delete} = CommonAPI.delete(post.id, user)
	assert delete.local
	assert called(Pleroma.Web.Federator.publish(delete))
	end

	refute Activity.get_by_id(post.id)
	end

	test "it allows users to delete their posts" do
	user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	clear_config([:instance, :federating], true)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert {:ok, delete} = CommonAPI.delete(post.id, user)
	assert delete.local
	assert called(Pleroma.Web.Federator.publish(delete))
	end

	refute Activity.get_by_id(post.id)
	end

	test "it does not allow a user to delete posts from another user" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	assert {:error, "Could not delete"} = CommonAPI.delete(post.id, other_user)
	assert Activity.get_by_id(post.id)
	end

	test "it allows privileged users to delete other user's posts" do
	clear_config([:instance, :moderator_privileges], [:messages_delete])
	user = insert(:user)
	moderator = insert(:user, is_moderator: true)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	assert {:ok, delete} = CommonAPI.delete(post.id, moderator)
	assert delete.local

	refute Activity.get_by_id(post.id)
	end

	test "it doesn't allow unprivileged mods or admins to delete other user's posts" do
	clear_config([:instance, :admin_privileges], [])
	clear_config([:instance, :moderator_privileges], [])
	user = insert(:user)
	moderator = insert(:user, is_moderator: true, is_admin: true)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	assert {:error, "Could not delete"} = CommonAPI.delete(post.id, moderator)
	assert Activity.get_by_id(post.id)
	end

	test "privileged users deleting non-local posts won't federate the delete" do
	clear_config([:instance, :admin_privileges], [:messages_delete])
	# This is the user of the ingested activity
	_user =
	insert(:user,
	local: false,
	ap_id: "http://mastodon.example.org/users/admin",
	last_refreshed_at: NaiveDateTime.utc_now()
	)

	admin = insert(:user, is_admin: true)

	data =
	File.read!("test/fixtures/mastodon-post-activity.json")
	\|> Jason.decode!()

	{:ok, post} = Transmogrifier.handle_incoming(data)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert {:ok, delete} = CommonAPI.delete(post.id, admin)
	assert delete.local
	refute called(Pleroma.Web.Federator.publish(:_))
	end

	refute Activity.get_by_id(post.id)
	end

	test "it allows privileged users to delete banned user's posts" do
	clear_config([:instance, :moderator_privileges], [:messages_delete])
	user = insert(:user)
	moderator = insert(:user, is_moderator: true)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})
	User.set_activation(user, false)

	assert {:ok, delete} = CommonAPI.delete(post.id, moderator)
	assert delete.local

	refute Activity.get_by_id(post.id)
	end
	end

	test "favoriting race condition" do
	user = insert(:user)
	users_serial = insert_list(10, :user)
	users = insert_list(10, :user)

	{:ok, activity} = CommonAPI.post(user, %{status: "."})

	users_serial
	\|> Enum.map(fn user ->
	CommonAPI.favorite(activity.id, user)
	end)

	object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["like_count"] == 10

	users
	\|> Enum.map(fn user ->
	Task.async(fn ->
	CommonAPI.favorite(activity.id, user)
	end)
	end)
	\|> Enum.map(&Task.await/1)

	object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["like_count"] == 20
	end

	test "repeating race condition" do
	user = insert(:user)
	users_serial = insert_list(10, :user)
	users = insert_list(10, :user)

	{:ok, activity} = CommonAPI.post(user, %{status: "."})

	users_serial
	\|> Enum.map(fn user ->
	CommonAPI.repeat(activity.id, user)
	end)

	object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["announcement_count"] == 10

	users
	\|> Enum.map(fn user ->
	Task.async(fn ->
	CommonAPI.repeat(activity.id, user)
	end)
	end)
	\|> Enum.map(&Task.await/1)

	object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["announcement_count"] == 20
	end

	test "when replying to a conversation / participation, it will set the correct context id even if no explicit reply_to is given" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})

	[participation] = Participation.for_user(user)

	{:ok, convo_reply} =
	CommonAPI.post(user, %{status: ".", in_reply_to_conversation_id: participation.id})

	assert Visibility.direct?(convo_reply)

	assert activity.data["context"] == convo_reply.data["context"]
	end

	test "when replying to a conversation / participation, it only mentions the recipients explicitly declared in the participation" do
	har = insert(:user)
	jafnhar = insert(:user)
	tridi = insert(:user)

	{:ok, activity} =
	CommonAPI.post(har, %{
	status: "@#{jafnhar.nickname} hey",
	visibility: "direct"
	})

	assert har.ap_id in activity.recipients
	assert jafnhar.ap_id in activity.recipients

	[participation] = Participation.for_user(har)

	{:ok, activity} =
	CommonAPI.post(har, %{
	status: "I don't really like @#{tridi.nickname}",
	visibility: "direct",
	in_reply_to_status_id: activity.id,
	in_reply_to_conversation_id: participation.id
	})

	assert har.ap_id in activity.recipients
	assert jafnhar.ap_id in activity.recipients
	refute tridi.ap_id in activity.recipients
	end

	test "with the safe_dm_mention option set, it does not mention people beyond the initial tags" do
	har = insert(:user)
	jafnhar = insert(:user)
	tridi = insert(:user)

	clear_config([:instance, :safe_dm_mentions], true)

	{:ok, activity} =
	CommonAPI.post(har, %{
	status: "@#{jafnhar.nickname} hey, i never want to see @#{tridi.nickname} again",
	visibility: "direct"
	})

	refute tridi.ap_id in activity.recipients
	assert jafnhar.ap_id in activity.recipients
	end

	test "it de-duplicates tags" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "#2hu #2HU"})

	object = Object.normalize(activity, fetch: false)

	assert Object.tags(object) == ["2hu"]
	end

	test "zwnj is treated as word character" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "#ساٴين‌س"})

	object = Object.normalize(activity, fetch: false)

	assert Object.tags(object) == ["ساٴين‌س"]
	end

	test "allows lang attribute" do
	user = insert(:user)
	text = ~s{<span lang="en">something</span><p lang="diaetuitech_rpyhpgc">random</p>}

	{:ok, activity} = CommonAPI.post(user, %{status: text, content_type: "text/html"})

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == text
	end

	test "double dot in link is allowed" do
	user = insert(:user)
	text = "https://example.to/something..mp3"
	{:ok, activity} = CommonAPI.post(user, %{status: text})

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == "<a href=\"#{text}\" rel=\"ugc\">#{text}</a>"
	end

	test "it adds emoji in the object" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: ":firefox:"})

	assert Object.normalize(activity, fetch: false).data["emoji"]["firefox"]
	end

	describe "posting" do
	test "it adds an emoji on an external site" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "hey :external_emoji:"})

	assert %{"external_emoji" => url} = Object.normalize(activity).data["emoji"]
	assert url == "https://example.com/emoji.png"

	{:ok, activity} = CommonAPI.post(user, %{status: "hey :blank:"})

	assert %{"blank" => url} = Object.normalize(activity).data["emoji"]
	assert url == "#{Pleroma.Web.Endpoint.url()}/emoji/blank.png"
	end

	test "it copies emoji from the subject of the parent post" do
	%Object{} =
	object =
	Object.normalize("https://patch.cx/objects/a399c28e-c821-4820-bc3e-4afeb044c16f",
	fetch: true
	)

	activity = Activity.get_create_by_object_ap_id(object.data["id"])
	user = insert(:user)

	{:ok, reply_activity} =
	CommonAPI.post(user, %{
	in_reply_to_id: activity.id,
	status: ":joker_disapprove:",
	spoiler_text: ":joker_smile:"
	})

	assert Object.normalize(reply_activity).data["emoji"]["joker_smile"]
	refute Object.normalize(reply_activity).data["emoji"]["joker_disapprove"]
	end

	test "deactivated users can't post" do
	user = insert(:user, is_active: false)
	assert {:error, _} = CommonAPI.post(user, %{status: "ye"})
	end

	test "it supports explicit addressing" do
	user = insert(:user)
	user_two = insert(:user)
	user_three = insert(:user)
	user_four = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"Hey, I think @#{user_three.nickname} is ugly. @#{user_four.nickname} is alright though.",
	to: [user_two.nickname, user_four.nickname, "nonexistent"]
	})

	assert user.ap_id in activity.recipients
	assert user_two.ap_id in activity.recipients
	assert user_four.ap_id in activity.recipients
	refute user_three.ap_id in activity.recipients
	end

	test "it filters out obviously bad tags when accepting a post as HTML" do
	user = insert(:user)

	post = "<p><b>2hu</b></p><script>alert('xss')</script>"

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: post,
	content_type: "text/html"
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == "<p><b>2hu</b></p>alert('xss')"
	assert object.data["source"]["content"] == post
	end

	test "it filters out obviously bad tags when accepting a post as Markdown" do
	user = insert(:user)

	post = "<p><b>2hu</b></p><script>alert('xss')</script>"

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: post,
	content_type: "text/markdown"
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == "<p><b>2hu</b></p>"
	assert object.data["source"]["content"] == post
	end

	test "it does not allow replies to direct messages that are not direct messages themselves" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "suya..", visibility: "direct"})

	assert {:ok, _} =
	CommonAPI.post(user, %{
	status: "suya..",
	visibility: "direct",
	in_reply_to_status_id: activity.id
	})

	Enum.each(["public", "private", "unlisted"], fn visibility ->
	assert {:error, "The message visibility must be direct"} =
	CommonAPI.post(user, %{
	status: "suya..",
	visibility: visibility,
	in_reply_to_status_id: activity.id
	})
	end)
	end

	test "replying with a direct message will NOT auto-add the author of the reply to the recipient list" do
	user = insert(:user)
	other_user = insert(:user)
	third_user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "I'm stupid"})

	{:ok, open_answer} =
	CommonAPI.post(other_user, %{status: "No ur smart", in_reply_to_status_id: post.id})

	# The OP is implicitly added
	assert user.ap_id in open_answer.recipients

	{:ok, secret_answer} =
	CommonAPI.post(other_user, %{
	status: "lol, that guy really is stupid, right, @#{third_user.nickname}?",
	in_reply_to_status_id: post.id,
	visibility: "direct"
	})

	assert third_user.ap_id in secret_answer.recipients

	# The OP is not added
	refute user.ap_id in secret_answer.recipients
	end

	test "it allows to address a list" do
	user = insert(:user)
	{:ok, list} = Pleroma.List.create("foo", user)

	{:ok, activity} = CommonAPI.post(user, %{status: "foobar", visibility: "list:#{list.id}"})

	assert activity.data["bcc"] == [list.ap_id]
	assert activity.recipients == [list.ap_id, user.ap_id]
	assert activity.data["listMessage"] == list.ap_id
	end

	test "it returns error when status is empty and no attachments" do
	user = insert(:user)

	assert {:error, "Cannot post an empty status without attachments"} =
	CommonAPI.post(user, %{status: ""})
	end

	test "it validates character limits are correctly enforced" do
	clear_config([:instance, :limit], 5)

	user = insert(:user)

	assert {:error, "The status is over the character limit"} =
	CommonAPI.post(user, %{status: "foobar"})

	assert {:ok, _activity} = CommonAPI.post(user, %{status: "12345"})
	end

	test "it validates media attachment limits are correctly enforced" do
	clear_config([:instance, :max_media_attachments], 4)

	user = insert(:user)

	file = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, upload} = ActivityPub.upload(file, actor: user.ap_id)

	assert {:error, "Too many attachments"} =
	CommonAPI.post(user, %{
	status: "",
	media_ids: List.duplicate(upload.id, 5)
	})

	assert {:ok, _activity} =
	CommonAPI.post(user, %{
	status: "",
	media_ids: [upload.id]
	})
	end

	test "it can handle activities that expire" do
	user = insert(:user)

	expires_at = DateTime.add(DateTime.utc_now(), 1_000_000)

	assert {:ok, activity} = CommonAPI.post(user, %{status: "chai", expires_in: 1_000_000})

	assert_enqueued(
	worker: Pleroma.Workers.PurgeExpiredActivity,
	args: %{activity_id: activity.id},
	scheduled_at: expires_at
	)
	end

	test "it allows quote posting" do
	user = insert(:user)

	{:ok, quoted} = CommonAPI.post(user, %{status: "Hello world"})

	{:ok, quote_post} =
	CommonAPI.post(user, %{status: "nice post", quoted_status_id: quoted.id})

	quoted = Object.normalize(quoted)
	quote_post = Object.normalize(quote_post)

	assert quote_post.data["quoteUrl"] == quoted.data["id"]

	# The OP is not mentioned
	refute quoted.data["actor"] in quote_post.data["to"]
	end

	test "it supports fallback from `quote_id`" do
	user = insert(:user)

	{:ok, quoted} = CommonAPI.post(user, %{status: "Hello world"})
	{:ok, quote_post} = CommonAPI.post(user, %{status: "nice post", quote_id: quoted.id})

	quoted = Object.normalize(quoted)
	quote_post = Object.normalize(quote_post)

	assert quote_post.data["quoteUrl"] == quoted.data["id"]
	end

	test "quote posting with explicit addressing doesn't mention the OP" do
	user = insert(:user)

	{:ok, quoted} = CommonAPI.post(user, %{status: "Hello world"})

	{:ok, quote_post} =
	CommonAPI.post(user, %{status: "nice post", quoted_status_id: quoted.id, to: []})

	assert Object.normalize(quote_post).data["to"] == [Pleroma.Constants.as_public()]
	end

	test "quote posting visibility" do
	user = insert(:user)
	another_user = insert(:user)

	{:ok, direct} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
	{:ok, private} = CommonAPI.post(user, %{status: ".", visibility: "private"})
	{:ok, unlisted} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
	{:ok, local} = CommonAPI.post(user, %{status: ".", visibility: "local"})
	{:ok, public} = CommonAPI.post(user, %{status: ".", visibility: "public"})

	{:error, _} = CommonAPI.post(user, %{status: "nice", quoted_status_id: direct.id})
	{:ok, _} = CommonAPI.post(user, %{status: "nice", quoted_status_id: private.id})
	{:error, _} = CommonAPI.post(another_user, %{status: "nice", quoted_status_id: private.id})
	{:ok, _} = CommonAPI.post(user, %{status: "nice", quoted_status_id: unlisted.id})
	{:ok, _} = CommonAPI.post(another_user, %{status: "nice", quoted_status_id: unlisted.id})
	{:ok, _} = CommonAPI.post(user, %{status: "nice", quoted_status_id: local.id})
	{:ok, _} = CommonAPI.post(another_user, %{status: "nice", quoted_status_id: local.id})
	{:ok, _} = CommonAPI.post(user, %{status: "nice", quoted_status_id: public.id})
	{:ok, _} = CommonAPI.post(another_user, %{status: "nice", quoted_status_id: public.id})
	end

	test "it properly mentions punycode domain" do
	user = insert(:user)

	_mentioned_user =
	insert(:user, ap_id: "https://xn--i2raa.com/users/yyy", nickname: "yyy@xn--i2raa.com")

	{:ok, activity} =
	CommonAPI.post(user, %{status: "hey @yyy@xn--i2raa.com", content_type: "text/markdown"})

	assert "https://xn--i2raa.com/users/yyy" in Object.normalize(activity).data["to"]
	end
	end

	describe "reactions" do
	test "reacting to a status with an emoji" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, reaction} = CommonAPI.react_with_emoji(activity.id, user, "👍")

	assert reaction.data["actor"] == user.ap_id
	assert reaction.data["content"] == "👍"

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:error, _} = CommonAPI.react_with_emoji(activity.id, user, ".")
	end

	test "unreacting to a status with an emoji" do
	user = insert(:user)
	other_user = insert(:user)

	clear_config([:instance, :federating], true)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})
	{:ok, reaction} = CommonAPI.react_with_emoji(activity.id, user, "👍")

	{:ok, unreaction} = CommonAPI.unreact_with_emoji(activity.id, user, "👍")

	assert unreaction.data["type"] == "Undo"
	assert unreaction.data["object"] == reaction.data["id"]
	assert unreaction.local

	# On federation, it contains the undone (and deleted) object
	unreaction_with_object = %{
	unreaction
	\| data: Map.put(unreaction.data, "object", reaction.data)
	}

	assert called(Pleroma.Web.Federator.publish(unreaction_with_object))
	end
	end

	test "repeating a status" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, %Activity{} = announce_activity} = CommonAPI.repeat(activity.id, user)
	assert Visibility.public?(announce_activity)
	end

	test "can't repeat a repeat" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, %Activity{} = announce} = CommonAPI.repeat(activity.id, other_user)

	refute match?({:ok, %Activity{}}, CommonAPI.repeat(announce.id, user))
	end

	test "repeating a status privately" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, %Activity{} = announce_activity} =
	CommonAPI.repeat(activity.id, user, %{visibility: "private"})

	assert Visibility.private?(announce_activity)
	refute Visibility.visible_for_user?(announce_activity, nil)
	end

	test "author can repeat own private statuses" do
	author = insert(:user)
	follower = insert(:user)
	CommonAPI.follow(author, follower)

	{:ok, activity} = CommonAPI.post(author, %{status: "cofe", visibility: "private"})

	{:ok, %Activity{} = announce_activity} = CommonAPI.repeat(activity.id, author)

	assert Visibility.private?(announce_activity)
	refute Visibility.visible_for_user?(announce_activity, nil)

	assert Visibility.visible_for_user?(activity, follower)
	assert {:error, :not_found} = CommonAPI.repeat(activity.id, follower)
	end

	test "favoriting a status" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, post_activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, %Activity{data: data}} = CommonAPI.favorite(post_activity.id, user)
	assert data["type"] == "Like"
	assert data["actor"] == user.ap_id
	assert data["object"] == post_activity.data["object"]
	end

	test "retweeting a status twice returns the status" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})
	{:ok, %Activity{} = announce} = CommonAPI.repeat(activity.id, user)
	{:ok, ^announce} = CommonAPI.repeat(activity.id, user)
	end

	test "favoriting a status twice returns ok, but without the like activity" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})
	{:ok, %Activity{}} = CommonAPI.favorite(activity.id, user)
	assert {:ok, :already_liked} = CommonAPI.favorite(activity.id, user)
	end
	end

	describe "pinned statuses" do
	setup do
	clear_config([:instance, :max_pinned_statuses], 1)

	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "HI!!!"})

	[user: user, activity: activity]
	end

	test "activity not found error", %{user: user} do
	assert {:error, :not_found} = CommonAPI.pin("id", user)
	end

	test "pin status", %{user: user, activity: activity} do
	assert {:ok, ^activity} = CommonAPI.pin(activity.id, user)

	%{data: %{"id" => object_id}} = Object.normalize(activity)
	user = refresh_record(user)

	assert user.pinned_objects \|> Map.keys() == [object_id]
	end

	test "pin poll", %{user: user} do
	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "How is fediverse today?",
	poll: %{options: ["Absolutely outstanding", "Not good"], expires_in: 20}
	})

	assert {:ok, ^activity} = CommonAPI.pin(activity.id, user)

	%{data: %{"id" => object_id}} = Object.normalize(activity)

	user = refresh_record(user)

	assert user.pinned_objects \|> Map.keys() == [object_id]
	end

	test "unlisted statuses can be pinned", %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "HI!!!", visibility: "unlisted"})
	assert {:ok, ^activity} = CommonAPI.pin(activity.id, user)
	end

	test "only self-authored can be pinned", %{activity: activity} do
	user = insert(:user)

	assert {:error, :ownership_error} = CommonAPI.pin(activity.id, user)
	end

	test "max pinned statuses", %{user: user, activity: activity_one} do
	{:ok, activity_two} = CommonAPI.post(user, %{status: "HI!!!"})

	assert {:ok, ^activity_one} = CommonAPI.pin(activity_one.id, user)

	user = refresh_record(user)

	assert {:error, :pinned_statuses_limit_reached} = CommonAPI.pin(activity_two.id, user)
	end

	test "only public can be pinned", %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "private status", visibility: "private"})
	- {:error, :visibility_error} = CommonAPI.pin(activity.id, user)
	+ {:error, :non_public_error} = CommonAPI.pin(activity.id, user)
	end

	test "unpin status", %{user: user, activity: activity} do
	{:ok, activity} = CommonAPI.pin(activity.id, user)

	user = refresh_record(user)

	id = activity.id

	assert match?({:ok, %{id: ^id}}, CommonAPI.unpin(activity.id, user))

	user = refresh_record(user)

	assert user.pinned_objects == %{}
	end

	test "should unpin when deleting a status", %{user: user, activity: activity} do
	{:ok, activity} = CommonAPI.pin(activity.id, user)

	user = refresh_record(user)

	assert {:ok, _} = CommonAPI.delete(activity.id, user)

	user = refresh_record(user)

	assert user.pinned_objects == %{}
	end

	test "ephemeral activity won't be deleted if was pinned", %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "Hello!", expires_in: 601})

	assert Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity.id)

	{:ok, _activity} = CommonAPI.pin(activity.id, user)
	refute Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity.id)

	user = refresh_record(user)
	{:ok, _} = CommonAPI.unpin(activity.id, user)

	# recreates expiration job on unpin
	assert Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity.id)
	end

	test "ephemeral activity deletion job won't be deleted on pinning error", %{
	user: user,
	activity: activity
	} do
	clear_config([:instance, :max_pinned_statuses], 1)

	{:ok, _activity} = CommonAPI.pin(activity.id, user)

	{:ok, activity2} = CommonAPI.post(user, %{status: "another status", expires_in: 601})

	assert Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity2.id)

	user = refresh_record(user)
	{:error, :pinned_statuses_limit_reached} = CommonAPI.pin(activity2.id, user)

	assert Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity2.id)
	end
	end

	describe "mute tests" do
	setup do
	user = insert(:user)

	activity = insert(:note_activity)

	[user: user, activity: activity]
	end

	test "marks notifications as read after mute" do
	author = insert(:user)
	activity = insert(:note_activity, user: author)

	friend1 = insert(:user)
	friend2 = insert(:user)

	{:ok, reply_activity} =
	CommonAPI.post(
	friend2,
	%{
	status: "@#{author.nickname} @#{friend1.nickname} test reply",
	in_reply_to_status_id: activity.id
	}
	)

	{:ok, favorite_activity} = CommonAPI.favorite(activity.id, friend2)
	{:ok, repeat_activity} = CommonAPI.repeat(activity.id, friend1)

	assert Repo.aggregate(
	from(n in Notification, where: n.seen == false and n.user_id == ^friend1.id),
	:count
	) == 1

	unread_notifications =
	Repo.all(from(n in Notification, where: n.seen == false, where: n.user_id == ^author.id))

	assert Enum.any?(unread_notifications, fn n ->
	n.type == "favourite" && n.activity_id == favorite_activity.id
	end)

	assert Enum.any?(unread_notifications, fn n ->
	n.type == "reblog" && n.activity_id == repeat_activity.id
	end)

	assert Enum.any?(unread_notifications, fn n ->
	n.type == "mention" && n.activity_id == reply_activity.id
	end)

	{:ok, _} = CommonAPI.add_mute(activity, author)
	assert CommonAPI.thread_muted?(activity, author)

	assert Repo.aggregate(
	from(n in Notification, where: n.seen == false and n.user_id == ^friend1.id),
	:count
	) == 1

	read_notifications =
	Repo.all(from(n in Notification, where: n.seen == true, where: n.user_id == ^author.id))

	assert Enum.any?(read_notifications, fn n ->
	n.type == "favourite" && n.activity_id == favorite_activity.id
	end)

	assert Enum.any?(read_notifications, fn n ->
	n.type == "reblog" && n.activity_id == repeat_activity.id
	end)

	assert Enum.any?(read_notifications, fn n ->
	n.type == "mention" && n.activity_id == reply_activity.id
	end)
	end

	test "add mute", %{user: user, activity: activity} do
	{:ok, _} = CommonAPI.add_mute(activity, user)
	assert CommonAPI.thread_muted?(activity, user)
	end

	test "add expiring mute", %{user: user, activity: activity} do
	{:ok, _} = CommonAPI.add_mute(activity, user, %{expires_in: 60})
	assert CommonAPI.thread_muted?(activity, user)

	worker = Pleroma.Workers.MuteExpireWorker
	args = %{"op" => "unmute_conversation", "user_id" => user.id, "activity_id" => activity.id}

	assert_enqueued(
	worker: worker,
	args: args
	)

	assert :ok = perform_job(worker, args)
	refute CommonAPI.thread_muted?(activity, user)
	end

	test "remove mute", %{user: user, activity: activity} do
	CommonAPI.add_mute(activity, user)
	{:ok, _} = CommonAPI.remove_mute(activity, user)
	refute CommonAPI.thread_muted?(activity, user)
	end

	test "remove mute by ids", %{user: user, activity: activity} do
	CommonAPI.add_mute(activity, user)
	{:ok, _} = CommonAPI.remove_mute(activity.id, user.id)
	refute CommonAPI.thread_muted?(activity, user)
	end

	test "check that mutes can't be duplicate", %{user: user, activity: activity} do
	CommonAPI.add_mute(activity, user)
	{:error, _} = CommonAPI.add_mute(activity, user)
	end
	end

	describe "reports" do
	test "creates a report" do
	reporter = insert(:user)
	target_user = insert(:user)

	{:ok, activity} = CommonAPI.post(target_user, %{status: "foobar"})
	activity = Activity.normalize(activity)

	reporter_ap_id = reporter.ap_id
	target_ap_id = target_user.ap_id
	reported_object_ap_id = activity.object.data["id"]
	comment = "foobar"

	report_data = %{
	account_id: target_user.id,
	comment: comment,
	status_ids: [activity.id]
	}

	note_obj = %{
	"type" => "Note",
	"id" => reported_object_ap_id,
	"content" => "foobar",
	"published" => activity.object.data["published"],
	"actor" => AccountView.render("show.json", %{user: target_user})
	}

	assert {:ok, flag_activity} = CommonAPI.report(reporter, report_data)

	assert %Activity{
	actor: ^reporter_ap_id,
	data: %{
	"type" => "Flag",
	"content" => ^comment,
	"object" => [^target_ap_id, ^note_obj],
	"state" => "open"
	}
	} = flag_activity
	end

	+ test "doesn't create a report when post is not visible to user" do
	+ reporter = insert(:user)
	+ target_user = insert(:user)
	+ {:ok, post} = CommonAPI.post(target_user, %{status: "Eric", visibility: "private"})
	+
	+ assert Pleroma.Web.ActivityPub.Visibility.private?(post)
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(post, reporter)
	+
	+ # Fails when all status are invisible
	+ report_data = %{
	+ account_id: target_user.id,
	+ comment: "foobar",
	+ status_ids: [post.id]
	+ }
	+
	+ assert {:error, :visibility_error} = CommonAPI.report(reporter, report_data)
	+ end
	+
	+ test "doesn't create a report when some posts are not visible to user" do
	+ reporter = insert(:user)
	+ target_user = insert(:user)
	+
	+ {:ok, visible_activity} = CommonAPI.post(target_user, %{status: "cofe"})
	+
	+ {:ok, invisibile_activity} =
	+ CommonAPI.post(target_user, %{status: "cawfee", visibility: "private"})
	+
	+ assert Pleroma.Web.ActivityPub.Visibility.private?(invisibile_activity)
	+ assert Pleroma.Web.ActivityPub.Visibility.public?(visible_activity)
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(invisibile_activity, reporter)
	+
	+ # Fails when some statuses are invisible
	+ report_data_partial = %{
	+ account_id: target_user.id,
	+ comment: "foobar",
	+ status_ids: [visible_activity.id, invisibile_activity.id]
	+ }
	+
	+ assert {:error, :visibility_error} = CommonAPI.report(reporter, report_data_partial)
	+ end
	+
	test "updates report state" do
	[reporter, target_user] = insert_pair(:user)
	activity = insert(:note_activity, user: target_user)
	object = Object.normalize(activity)

	{:ok, %Activity{id: report_id}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel offended",
	status_ids: [activity.id]
	})

	{:ok, report} = CommonAPI.update_report_state(report_id, "resolved")

	assert report.data["state"] == "resolved"

	[reported_user, object_id] = report.data["object"]

	assert reported_user == target_user.ap_id
	assert object_id == object.data["id"]
	end

	test "updates report state, don't strip when report_strip_status is false" do
	clear_config([:instance, :report_strip_status], false)

	[reporter, target_user] = insert_pair(:user)
	activity = insert(:note_activity, user: target_user)

	{:ok, %Activity{id: report_id, data: report_data}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel offended",
	status_ids: [activity.id]
	})

	{:ok, report} = CommonAPI.update_report_state(report_id, "resolved")

	assert report.data["state"] == "resolved"

	[reported_user, reported_activity] = report.data["object"]

	assert reported_user == target_user.ap_id
	assert is_map(reported_activity)

	assert reported_activity["content"] ==
	report_data["object"] \|> Enum.at(1) \|> Map.get("content")
	end

	test "does not update report state when state is unsupported" do
	[reporter, target_user] = insert_pair(:user)
	activity = insert(:note_activity, user: target_user)

	{:ok, %Activity{id: report_id}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel offended",
	status_ids: [activity.id]
	})

	assert CommonAPI.update_report_state(report_id, "test") == {:error, "Unsupported state"}
	end

	test "updates state of multiple reports" do
	[reporter, target_user] = insert_pair(:user)
	activity = insert(:note_activity, user: target_user)

	{:ok, %Activity{id: first_report_id}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel offended",
	status_ids: [activity.id]
	})

	{:ok, %Activity{id: second_report_id}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel very offended!",
	status_ids: [activity.id]
	})

	{:ok, report_ids} =
	CommonAPI.update_report_state([first_report_id, second_report_id], "resolved")

	first_report = Activity.get_by_id(first_report_id)
	second_report = Activity.get_by_id(second_report_id)

	assert report_ids -- [first_report_id, second_report_id] == []
	assert first_report.data["state"] == "resolved"
	assert second_report.data["state"] == "resolved"
	end

	test "creates a report with provided rules" do
	reporter = insert(:user)
	target_user = insert(:user)

	%{id: rule_id} = Rule.create(%{text: "There are no rules"})

	reporter_ap_id = reporter.ap_id
	target_ap_id = target_user.ap_id

	report_data = %{
	account_id: target_user.id,
	rule_ids: [rule_id]
	}

	assert {:ok, flag_activity} = CommonAPI.report(reporter, report_data)

	assert %Activity{
	actor: ^reporter_ap_id,
	data: %{
	"type" => "Flag",
	"object" => [^target_ap_id],
	"state" => "open",
	"rules" => [^rule_id]
	}
	} = flag_activity
	end
	end

	describe "reblog muting" do
	setup do
	muter = insert(:user)

	muted = insert(:user)

	[muter: muter, muted: muted]
	end

	test "add a reblog mute", %{muter: muter, muted: muted} do
	{:ok, _reblog_mute} = CommonAPI.hide_reblogs(muted, muter)

	assert User.showing_reblogs?(muter, muted) == false
	end

	test "remove a reblog mute", %{muter: muter, muted: muted} do
	{:ok, _reblog_mute} = CommonAPI.hide_reblogs(muted, muter)
	{:ok, _reblog_mute} = CommonAPI.show_reblogs(muted, muter)

	assert User.showing_reblogs?(muter, muted) == true
	end
	end

	describe "follow/2" do
	test "directly follows a non-locked local user" do
	[follower, followed] = insert_pair(:user)
	{:ok, followed, follower, _} = CommonAPI.follow(followed, follower)

	assert User.following?(follower, followed)
	end
	end

	describe "unfollow/2" do
	test "also unsubscribes a user" do
	[follower, followed] = insert_pair(:user)
	{:ok, followed, follower, _} = CommonAPI.follow(followed, follower)
	{:ok, _subscription} = User.subscribe(follower, followed)

	assert User.subscribed_to?(follower, followed)

	{:ok, follower} = CommonAPI.unfollow(followed, follower)

	refute User.subscribed_to?(follower, followed)
	end

	test "also unpins a user" do
	[follower, followed] = insert_pair(:user)
	{:ok, followed, follower, _} = CommonAPI.follow(followed, follower)
	{:ok, _endorsement} = User.endorse(follower, followed)

	assert User.endorses?(follower, followed)

	{:ok, follower} = CommonAPI.unfollow(followed, follower)

	refute User.endorses?(follower, followed)
	end

	test "cancels a pending follow for a local user" do
	follower = insert(:user)
	followed = insert(:user, is_locked: true)

	assert {:ok, followed, follower, %{id: activity_id, data: %{"state" => "pending"}}} =
	CommonAPI.follow(followed, follower)

	assert User.get_follow_state(follower, followed) == :follow_pending
	assert {:ok, follower} = CommonAPI.unfollow(followed, follower)
	assert User.get_follow_state(follower, followed) == nil

	assert %{id: ^activity_id, data: %{"state" => "cancelled"}} =
	Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(follower, followed)

	assert %{
	data: %{
	"type" => "Undo",
	"object" => %{"type" => "Follow", "state" => "cancelled"}
	}
	} = Pleroma.Web.ActivityPub.Utils.fetch_latest_undo(follower)
	end

	test "cancels a pending follow for a remote user" do
	follower = insert(:user)
	followed = insert(:user, is_locked: true, local: false)

	assert {:ok, followed, follower, %{id: activity_id, data: %{"state" => "pending"}}} =
	CommonAPI.follow(followed, follower)

	assert User.get_follow_state(follower, followed) == :follow_pending
	assert {:ok, follower} = CommonAPI.unfollow(followed, follower)
	assert User.get_follow_state(follower, followed) == nil

	assert %{id: ^activity_id, data: %{"state" => "cancelled"}} =
	Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(follower, followed)

	assert %{
	data: %{
	"type" => "Undo",
	"object" => %{"type" => "Follow", "state" => "cancelled"}
	}
	} = Pleroma.Web.ActivityPub.Utils.fetch_latest_undo(follower)
	end
	end

	describe "accept_follow_request/2" do
	test "after acceptance, it sets all existing pending follow request states to 'accept'" do
	user = insert(:user, is_locked: true)
	follower = insert(:user)
	follower_two = insert(:user)

	{:ok, _, _, follow_activity} = CommonAPI.follow(user, follower)
	{:ok, _, _, follow_activity_two} = CommonAPI.follow(user, follower)
	{:ok, _, _, follow_activity_three} = CommonAPI.follow(user, follower_two)

	assert follow_activity.data["state"] == "pending"
	assert follow_activity_two.data["state"] == "pending"
	assert follow_activity_three.data["state"] == "pending"

	{:ok, _follower} = CommonAPI.accept_follow_request(follower, user)

	assert Repo.get(Activity, follow_activity.id).data["state"] == "accept"
	assert Repo.get(Activity, follow_activity_two.id).data["state"] == "accept"
	assert Repo.get(Activity, follow_activity_three.id).data["state"] == "pending"
	end

	test "after rejection, it sets all existing pending follow request states to 'reject'" do
	user = insert(:user, is_locked: true)
	follower = insert(:user)
	follower_two = insert(:user)

	{:ok, _, _, follow_activity} = CommonAPI.follow(user, follower)
	{:ok, _, _, follow_activity_two} = CommonAPI.follow(user, follower)
	{:ok, _, _, follow_activity_three} = CommonAPI.follow(user, follower_two)

	assert follow_activity.data["state"] == "pending"
	assert follow_activity_two.data["state"] == "pending"
	assert follow_activity_three.data["state"] == "pending"

	{:ok, _follower} = CommonAPI.reject_follow_request(follower, user)

	assert Repo.get(Activity, follow_activity.id).data["state"] == "reject"
	assert Repo.get(Activity, follow_activity_two.id).data["state"] == "reject"
	assert Repo.get(Activity, follow_activity_three.id).data["state"] == "pending"
	end

	test "doesn't create a following relationship if the corresponding follow request doesn't exist" do
	user = insert(:user, is_locked: true)
	not_follower = insert(:user)
	CommonAPI.accept_follow_request(not_follower, user)

	assert Pleroma.FollowingRelationship.following?(not_follower, user) == false
	end
	end

	describe "vote/3" do
	test "does not allow to vote twice" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "Am I cute?",
	poll: %{options: ["Yes", "No"], expires_in: 20}
	})

	object = Object.normalize(activity, fetch: false)

	{:ok, _, object} = CommonAPI.vote(object, other_user, [0])

	assert {:error, "Already voted"} == CommonAPI.vote(object, other_user, [1])
	end
	end

	describe "listen/2" do
	test "returns a valid activity" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.listen(user, %{
	title: "lain radio episode 1",
	album: "lain radio",
	artist: "lain",
	length: 180_000
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["title"] == "lain radio episode 1"

	assert Visibility.get_visibility(activity) == "public"
	end

	test "respects visibility=private" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.listen(user, %{
	title: "lain radio episode 1",
	album: "lain radio",
	artist: "lain",
	length: 180_000,
	visibility: "private"
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["title"] == "lain radio episode 1"

	assert Visibility.get_visibility(activity) == "private"
	end
	end

	describe "get_user/1" do
	test "gets user by ap_id" do
	user = insert(:user)
	assert CommonAPI.get_user(user.ap_id) == user
	end

	test "gets user by guessed nickname" do
	user = insert(:user, ap_id: "", nickname: "mario@mushroom.kingdom")
	assert CommonAPI.get_user("https://mushroom.kingdom/users/mario") == user
	end

	test "fallback" do
	assert %User{
	name: "",
	ap_id: "",
	nickname: "erroruser@example.com"
	} = CommonAPI.get_user("")
	end
	end

	describe "with `local` visibility" do
	setup do: clear_config([:instance, :federating], true)

	test "post" do
	user = insert(:user)

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	{:ok, activity} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})

	assert Visibility.local_public?(activity)
	assert_not_called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "delete" do
	user = insert(:user)

	{:ok, %Activity{id: activity_id}} =
	CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"deleted_activity_id" => ^activity_id}} = activity} =
	CommonAPI.delete(activity_id, user)

	assert Visibility.local_public?(activity)
	assert_not_called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "repeat" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, %Activity{id: activity_id}} =
	CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "Announce"}} = activity} =
	CommonAPI.repeat(activity_id, user)

	assert Visibility.local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "unrepeat" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, %Activity{id: activity_id}} =
	CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	assert {:ok, _} = CommonAPI.repeat(activity_id, user)

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "Undo"}} = activity} =
	CommonAPI.unrepeat(activity_id, user)

	assert Visibility.local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "favorite" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "Like"}} = activity} =
	CommonAPI.favorite(activity.id, user)

	assert Visibility.local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "unfavorite" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	{:ok, %Activity{}} = CommonAPI.favorite(activity.id, user)

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, activity} = CommonAPI.unfavorite(activity.id, user)
	assert Visibility.local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "react_with_emoji" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "EmojiReact"}} = activity} =
	CommonAPI.react_with_emoji(activity.id, user, "👍")

	assert Visibility.local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "unreact_with_emoji" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	{:ok, _reaction} = CommonAPI.react_with_emoji(activity.id, user, "👍")

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "Undo"}} = activity} =
	CommonAPI.unreact_with_emoji(activity.id, user, "👍")

	assert Visibility.local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end
	end

	describe "update/3" do
	test "updates a post" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "foo1", spoiler_text: "title 1"})

	{:ok, updated} = CommonAPI.update(activity, user, %{status: "updated 2"})

	updated_object = Object.normalize(updated)
	assert updated_object.data["content"] == "updated 2"
	assert Map.get(updated_object.data, "summary", "") == ""
	assert Map.has_key?(updated_object.data, "updated")
	end

	test "does not change visibility" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "foo1", spoiler_text: "title 1", visibility: "private"})

	{:ok, updated} = CommonAPI.update(activity, user, %{status: "updated 2"})

	updated_object = Object.normalize(updated)
	assert updated_object.data["content"] == "updated 2"
	assert Map.get(updated_object.data, "summary", "") == ""
	assert Visibility.get_visibility(updated_object) == "private"
	assert Visibility.get_visibility(updated) == "private"
	end

	test "updates a post with emoji" do
	[{emoji1, _}, {emoji2, _} \| _] = Pleroma.Emoji.get_all()

	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "foo1", spoiler_text: "title 1 :#{emoji1}:"})

	{:ok, updated} = CommonAPI.update(activity, user, %{status: "updated 2 :#{emoji2}:"})

	updated_object = Object.normalize(updated)
	assert updated_object.data["content"] == "updated 2 :#{emoji2}:"
	assert %{^emoji2 => _} = updated_object.data["emoji"]
	end

	test "updates a post with emoji and federate properly" do
	[{emoji1, _}, {emoji2, _} \| _] = Pleroma.Emoji.get_all()

	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "foo1", spoiler_text: "title 1 :#{emoji1}:"})

	clear_config([:instance, :federating], true)

	with_mock Pleroma.Web.Federator,
	publish: fn _p -> nil end do
	{:ok, updated} = CommonAPI.update(activity, user, %{status: "updated 2 :#{emoji2}:"})

	assert updated.data["object"]["content"] == "updated 2 :#{emoji2}:"
	assert %{^emoji2 => _} = updated.data["object"]["emoji"]

	assert called(Pleroma.Web.Federator.publish(updated))
	end
	end

	test "editing a post that copied a remote title with remote emoji should keep that emoji" do
	remote_emoji_uri = "https://remote.org/emoji.png"

	note =
	insert(
	:note,
	data: %{
	"summary" => ":remoteemoji:",
	"emoji" => %{
	"remoteemoji" => remote_emoji_uri
	},
	"tag" => [
	%{
	"type" => "Emoji",
	"name" => "remoteemoji",
	"icon" => %{"url" => remote_emoji_uri}
	}
	]
	}
	)

	note_activity = insert(:note_activity, note: note)

	user = insert(:user)

	{:ok, reply} =
	CommonAPI.post(user, %{
	status: "reply",
	spoiler_text: ":remoteemoji:",
	in_reply_to_id: note_activity.id
	})

	assert reply.object.data["emoji"]["remoteemoji"] == remote_emoji_uri

	{:ok, edit} =
	CommonAPI.update(reply, user, %{status: "reply mew mew", spoiler_text: ":remoteemoji:"})

	edited_note = Pleroma.Object.normalize(edit)

	assert edited_note.data["emoji"]["remoteemoji"] == remote_emoji_uri
	end

	test "respects MRF" do
	user = insert(:user)

	clear_config([:mrf, :policies], [Pleroma.Web.ActivityPub.MRF.KeywordPolicy])
	clear_config([:mrf_keyword, :replace], [{"updated", "mewmew"}])

	{:ok, activity} = CommonAPI.post(user, %{status: "foo1", spoiler_text: "updated 1"})
	assert Object.normalize(activity).data["summary"] == "mewmew 1"

	{:ok, updated} = CommonAPI.update(activity, user, %{status: "updated 2"})

	updated_object = Object.normalize(updated)
	assert updated_object.data["content"] == "mewmew 2"
	assert Map.get(updated_object.data, "summary", "") == ""
	assert Map.has_key?(updated_object.data, "updated")
	end
	end

	describe "Group actors" do
	setup do
	poster = insert(:user)
	group = insert(:user, actor_type: "Group")
	other_group = insert(:user, actor_type: "Group")
	%{poster: poster, group: group, other_group: other_group}
	end

	test "it boosts public posts", %{poster: poster, group: group} do
	{:ok, post} = CommonAPI.post(poster, %{status: "hey @#{group.nickname}"})

	announces = get_announces_of_object(post.object)
	assert [_] = announces
	end

	test "it does not boost private posts", %{poster: poster, group: group} do
	{:ok, private_post} =
	CommonAPI.post(poster, %{status: "hey @#{group.nickname}", visibility: "private"})

	assert [] = get_announces_of_object(private_post.object)
	end

	test "remote groups do not boost any posts", %{poster: poster} do
	remote_group =
	insert(:user, actor_type: "Group", local: false, nickname: "remote@example.com")

	{:ok, post} = CommonAPI.post(poster, %{status: "hey @#{User.full_nickname(remote_group)}"})
	assert remote_group.ap_id in post.data["to"]

	announces = get_announces_of_object(post.object)
	assert [] = announces
	end

	test "multiple groups mentioned", %{poster: poster, group: group, other_group: other_group} do
	{:ok, post} =
	CommonAPI.post(poster, %{status: "hey @#{group.nickname} @#{other_group.nickname}"})

	announces = get_announces_of_object(post.object)
	assert [_, _] = announces
	end

	test "it does not boost if group is blocking poster", %{poster: poster, group: group} do
	{:ok, _} = CommonAPI.block(poster, group)
	{:ok, post} = CommonAPI.post(poster, %{status: "hey @#{group.nickname}"})

	announces = get_announces_of_object(post.object)
	assert [] = announces
	end
	end

	describe "Oban jobs are cancelled" do
	setup do
	clear_config([:instance, :federating], true)

	local_user = insert(:user)

	remote_one =
	insert(:user, %{
	local: false,
	nickname: "nick1@domain.com",
	ap_id: "https://domain.com/users/nick1",
	inbox: "https://domain.com/users/nick1/inbox",
	shared_inbox: "https://domain.com/inbox"
	})

	remote_two =
	insert(:user, %{
	local: false,
	nickname: "nick2@example.com",
	ap_id: "https://example.com/users/nick2",
	inbox: "https://example.com/users/nick2/inbox",
	shared_inbox: "https://example.com/inbox"
	})

	%{local_user: local_user, remote_one: remote_one, remote_two: remote_two}
	end

	test "when deleting posts", %{
	local_user: local_user,
	remote_one: remote_one,
	remote_two: remote_two
	} do
	{:ok, _, _} = Pleroma.User.follow(remote_one, local_user)
	{:ok, _, _} = Pleroma.User.follow(remote_two, local_user)

	{:ok, %{id: activity_id} = _activity} =
	CommonAPI.post(local_user, %{status: "Happy Friday everyone!"})

	# Generate the publish_one jobs
	ObanHelpers.perform_all()

	publish_one_jobs =
	all_enqueued()
	\|> Enum.filter(fn job ->
	match?(
	%{
	state: "available",
	queue: "federator_outgoing",
	worker: "Pleroma.Workers.PublisherWorker",
	args: %{"op" => "publish_one", "params" => %{"activity_id" => ^activity_id}}
	},
	job
	)
	end)

	assert length(publish_one_jobs) == 2

	# The delete should have triggered cancelling the publish_one jobs
	assert {:ok, _delete} = CommonAPI.delete(activity_id, local_user)

	# all_enqueued/1 will not return cancelled jobs
	cancelled_jobs =
	Oban.Job
	\|> where([j], j.worker == "Pleroma.Workers.PublisherWorker")
	\|> where([j], j.state == "cancelled")
	\|> where([j], j.args["op"] == "publish_one")
	\|> where([j], j.args["params"]["activity_id"] == ^activity_id)
	\|> Pleroma.Repo.all()

	assert length(cancelled_jobs) == 2
	end

	test "when unfavoriting posts", %{
	local_user: local_user,
	remote_one: remote_user
	} do
	{:ok, activity} =
	CommonAPI.post(remote_user, %{status: "I like turtles!"})

	{:ok, %{id: favorite_id} = _favorite} =
	CommonAPI.favorite(activity.id, local_user)

	# Generate the publish_one jobs
	ObanHelpers.perform_all()

	publish_one_jobs =
	all_enqueued()
	\|> Enum.filter(fn job ->
	match?(
	%{
	state: "available",
	queue: "federator_outgoing",
	worker: "Pleroma.Workers.PublisherWorker",
	args: %{"op" => "publish_one", "params" => %{"activity_id" => ^favorite_id}}
	},
	job
	)
	end)

	assert length(publish_one_jobs) == 1

	# The unfavorite should have triggered cancelling the publish_one jobs
	assert {:ok, _unfavorite} = CommonAPI.unfavorite(activity.id, local_user)

	# all_enqueued/1 will not return cancelled jobs
	cancelled_jobs =
	Oban.Job
	\|> where([j], j.worker == "Pleroma.Workers.PublisherWorker")
	\|> where([j], j.state == "cancelled")
	\|> where([j], j.args["op"] == "publish_one")
	\|> where([j], j.args["params"]["activity_id"] == ^favorite_id)
	\|> Pleroma.Repo.all()

	assert length(cancelled_jobs) == 1
	end

	test "when unboosting posts", %{
	local_user: local_user,
	remote_one: remote_one,
	remote_two: remote_two
	} do
	{:ok, _, _} = Pleroma.User.follow(remote_one, local_user)
	{:ok, _, _} = Pleroma.User.follow(remote_two, local_user)

	{:ok, activity} =
	CommonAPI.post(remote_one, %{status: "This is an unpleasant post"})

	{:ok, %{id: repeat_id} = _repeat} =
	CommonAPI.repeat(activity.id, local_user)

	# Generate the publish_one jobs
	ObanHelpers.perform_all()

	publish_one_jobs =
	all_enqueued()
	\|> Enum.filter(fn job ->
	match?(
	%{
	state: "available",
	queue: "federator_outgoing",
	worker: "Pleroma.Workers.PublisherWorker",
	args: %{"op" => "publish_one", "params" => %{"activity_id" => ^repeat_id}}
	},
	job
	)
	end)

	assert length(publish_one_jobs) == 2

	# The unrepeat should have triggered cancelling the publish_one jobs
	assert {:ok, _unfavorite} = CommonAPI.unrepeat(activity.id, local_user)

	# all_enqueued/1 will not return cancelled jobs
	cancelled_jobs =
	Oban.Job
	\|> where([j], j.worker == "Pleroma.Workers.PublisherWorker")
	\|> where([j], j.state == "cancelled")
	\|> where([j], j.args["op"] == "publish_one")
	\|> where([j], j.args["params"]["activity_id"] == ^repeat_id)
	\|> Pleroma.Repo.all()

	assert length(cancelled_jobs) == 2
	end

	test "when unreacting to posts", %{
	local_user: local_user,
	remote_one: remote_one,
	remote_two: remote_two
	} do
	{:ok, _, _} = Pleroma.User.follow(remote_one, local_user)
	{:ok, _, _} = Pleroma.User.follow(remote_two, local_user)

	{:ok, %{id: activity_id}} =
	CommonAPI.post(remote_one, %{status: "Gang gang!!!!"})

	{:ok, %{id: react_id} = _react} =
	CommonAPI.react_with_emoji(activity_id, local_user, "👍")

	# Generate the publish_one jobs
	ObanHelpers.perform_all()

	publish_one_jobs =
	all_enqueued()
	\|> Enum.filter(fn job ->
	match?(
	%{
	state: "available",
	queue: "federator_outgoing",
	worker: "Pleroma.Workers.PublisherWorker",
	args: %{"op" => "publish_one", "params" => %{"activity_id" => ^react_id}}
	},
	job
	)
	end)

	assert length(publish_one_jobs) == 2

	# The unreact should have triggered cancelling the publish_one jobs
	assert {:ok, _unreact} = CommonAPI.unreact_with_emoji(activity_id, local_user, "👍")

	# all_enqueued/1 will not return cancelled jobs
	cancelled_jobs =
	Oban.Job
	\|> where([j], j.worker == "Pleroma.Workers.PublisherWorker")
	\|> where([j], j.state == "cancelled")
	\|> where([j], j.args["op"] == "publish_one")
	\|> where([j], j.args["params"]["activity_id"] == ^react_id)
	\|> Pleroma.Repo.all()

	assert length(cancelled_jobs) == 2
	end
	end
	end
	diff --git a/test/pleroma/web/mastodon_api/controllers/notification_controller_test.exs b/test/pleroma/web/mastodon_api/controllers/notification_controller_test.exs
	index 88f2fb7af..dd4b7389e 100644
	--- a/test/pleroma/web/mastodon_api/controllers/notification_controller_test.exs
	+++ b/test/pleroma/web/mastodon_api/controllers/notification_controller_test.exs
	@@ -1,714 +1,717 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.NotificationControllerTest do
	use Pleroma.Web.ConnCase, async: false

	alias Pleroma.Notification
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.CommonAPI

	import Pleroma.Factory

	setup do
	Mox.stub_with(Pleroma.UnstubbedConfigMock, Pleroma.Test.StaticConfig)
	:ok
	end

	test "does NOT render account/pleroma/relationship by default" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
	{:ok, [_notification]} = Notification.create_notifications(activity)

	response =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications")
	\|> json_response_and_validate_schema(200)

	assert Enum.all?(response, fn n ->
	get_in(n, ["account", "pleroma", "relationship"]) == %{}
	end)
	end

	test "list of notifications" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})

	{:ok, [_notification]} = Notification.create_notifications(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications")

	expected_response =
	"hi <span class=\"h-card\"><a class=\"u-url mention\" data-user=\"#{user.id}\" href=\"#{user.ap_id}\" rel=\"ugc\">@<span>#{user.nickname}</span></a></span>"

	assert [%{"status" => %{"content" => response}} \| _rest] =
	json_response_and_validate_schema(conn, 200)

	assert response == expected_response
	end

	test "by default, does not contain pleroma:chat_mention" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, _activity} = CommonAPI.post_chat_message(other_user, user, "hey")

	result =
	conn
	\|> get("/api/v1/notifications")
	\|> json_response_and_validate_schema(200)

	assert [] == result

	result =
	conn
	\|> get("/api/v1/notifications?include_types[]=pleroma:chat_mention")
	\|> json_response_and_validate_schema(200)

	assert [_] = result
	end

	test "by default, does not contain pleroma:report" do
	clear_config([:instance, :moderator_privileges], [:reports_manage_reports])

	user = insert(:user)
	other_user = insert(:user)
	third_user = insert(:user)

	{:ok, user} = user \|> User.admin_api_update(%{is_moderator: true})

	%{conn: conn} = oauth_access(["read:notifications"], user: user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})

	{:ok, _report} =
	CommonAPI.report(third_user, %{account_id: other_user.id, status_ids: [activity.id]})

	result =
	conn
	\|> get("/api/v1/notifications")
	\|> json_response_and_validate_schema(200)

	assert [] == result

	result =
	conn
	\|> get("/api/v1/notifications?include_types[]=pleroma:report")
	\|> json_response_and_validate_schema(200)

	assert [_] = result
	end

	test "Pleroma:report is hidden for non-privileged users" do
	clear_config([:instance, :moderator_privileges], [:reports_manage_reports])

	user = insert(:user)
	other_user = insert(:user)
	third_user = insert(:user)

	{:ok, user} = user \|> User.admin_api_update(%{is_moderator: true})

	%{conn: conn} = oauth_access(["read:notifications"], user: user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "hey"})

	{:ok, _report} =
	CommonAPI.report(third_user, %{account_id: other_user.id, status_ids: [activity.id]})

	result =
	conn
	\|> get("/api/v1/notifications?include_types[]=pleroma:report")
	\|> json_response_and_validate_schema(200)

	assert [_] = result

	clear_config([:instance, :moderator_privileges], [])

	result =
	conn
	\|> get("/api/v1/notifications?include_types[]=pleroma:report")
	\|> json_response_and_validate_schema(200)

	assert [] == result
	end

	test "excludes mentions from blockers when blockers_visible is false" do
	clear_config([:activitypub, :blockers_visible], false)

	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	blocker = insert(:user)

	{:ok, _} = CommonAPI.block(user, blocker)
	{:ok, activity} = CommonAPI.post(blocker, %{status: "hi @#{user.nickname}"})

	{:ok, [_notification]} = Notification.create_notifications(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications")

	assert [] == json_response_and_validate_schema(conn, 200)
	end

	test "getting a single notification" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})

	{:ok, [notification]} = Notification.create_notifications(activity)

	conn = get(conn, "/api/v1/notifications/#{notification.id}")

	expected_response =
	"hi <span class=\"h-card\"><a class=\"u-url mention\" data-user=\"#{user.id}\" href=\"#{user.ap_id}\" rel=\"ugc\">@<span>#{user.nickname}</span></a></span>"

	assert %{"status" => %{"content" => response}} = json_response_and_validate_schema(conn, 200)
	assert response == expected_response
	end

	test "dismissing a single notification (deprecated endpoint)" do
	%{user: user, conn: conn} = oauth_access(["write:notifications"])
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})

	{:ok, [notification]} = Notification.create_notifications(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/notifications/dismiss", %{"id" => to_string(notification.id)})

	assert %{} = json_response_and_validate_schema(conn, 200)
	end

	test "dismissing a single notification" do
	%{user: user, conn: conn} = oauth_access(["write:notifications"])
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})

	{:ok, [notification]} = Notification.create_notifications(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/notifications/#{notification.id}/dismiss")

	assert %{} = json_response_and_validate_schema(conn, 200)
	end

	test "clearing all notifications" do
	%{user: user, conn: conn} = oauth_access(["write:notifications", "read:notifications"])
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})

	{:ok, [_notification]} = Notification.create_notifications(activity)

	ret_conn = post(conn, "/api/v1/notifications/clear")

	assert %{} = json_response_and_validate_schema(ret_conn, 200)

	ret_conn = get(conn, "/api/v1/notifications")

	assert all = json_response_and_validate_schema(ret_conn, 200)
	assert all == []
	end

	test "paginates notifications using min_id, since_id, max_id, and limit" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, activity1} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
	{:ok, activity2} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
	{:ok, activity3} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
	{:ok, activity4} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})

	notification1_id = get_notification_id_by_activity(activity1)
	notification2_id = get_notification_id_by_activity(activity2)
	notification3_id = get_notification_id_by_activity(activity3)
	notification4_id = get_notification_id_by_activity(activity4)

	conn = assign(conn, :user, user)

	# min_id
	result =
	conn
	\|> get("/api/v1/notifications?limit=2&min_id=#{notification1_id}")
	\|> json_response_and_validate_schema(:ok)

	assert [%{"id" => ^notification3_id}, %{"id" => ^notification2_id}] = result

	# since_id
	result =
	conn
	\|> get("/api/v1/notifications?limit=2&since_id=#{notification1_id}")
	\|> json_response_and_validate_schema(:ok)

	assert [%{"id" => ^notification4_id}, %{"id" => ^notification3_id}] = result

	# max_id
	result =
	conn
	\|> get("/api/v1/notifications?limit=2&max_id=#{notification4_id}")
	\|> json_response_and_validate_schema(:ok)

	assert [%{"id" => ^notification3_id}, %{"id" => ^notification2_id}] = result
	end

	describe "exclude_visibilities" do
	test "filters notifications for mentions" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, public_activity} =
	CommonAPI.post(other_user, %{status: "@#{user.nickname}", visibility: "public"})

	{:ok, direct_activity} =
	CommonAPI.post(other_user, %{status: "@#{user.nickname}", visibility: "direct"})

	{:ok, unlisted_activity} =
	CommonAPI.post(other_user, %{status: "@#{user.nickname}", visibility: "unlisted"})

	{:ok, private_activity} =
	CommonAPI.post(other_user, %{status: "@#{user.nickname}", visibility: "private"})

	query = params_to_query(%{exclude_visibilities: ["public", "unlisted", "private"]})
	conn_res = get(conn, "/api/v1/notifications?" <> query)

	assert [%{"status" => %{"id" => id}}] = json_response_and_validate_schema(conn_res, 200)
	assert id == direct_activity.id

	query = params_to_query(%{exclude_visibilities: ["public", "unlisted", "direct"]})
	conn_res = get(conn, "/api/v1/notifications?" <> query)

	assert [%{"status" => %{"id" => id}}] = json_response_and_validate_schema(conn_res, 200)
	assert id == private_activity.id

	query = params_to_query(%{exclude_visibilities: ["public", "private", "direct"]})
	conn_res = get(conn, "/api/v1/notifications?" <> query)

	assert [%{"status" => %{"id" => id}}] = json_response_and_validate_schema(conn_res, 200)
	assert id == unlisted_activity.id

	query = params_to_query(%{exclude_visibilities: ["unlisted", "private", "direct"]})
	conn_res = get(conn, "/api/v1/notifications?" <> query)

	assert [%{"status" => %{"id" => id}}] = json_response_and_validate_schema(conn_res, 200)
	assert id == public_activity.id
	end

	test "filters notifications for Like activities" do
	user = insert(:user)
	%{user: other_user, conn: conn} = oauth_access(["read:notifications"])

	+ {:ok, _, _, %{data: %{"state" => "accept"}}} = CommonAPI.follow(other_user, user)
	+ {:ok, _, _, %{data: %{"state" => "accept"}}} = CommonAPI.follow(user, other_user)
	+
	{:ok, public_activity} = CommonAPI.post(other_user, %{status: ".", visibility: "public"})

	{:ok, direct_activity} =
	CommonAPI.post(other_user, %{status: "@#{user.nickname}", visibility: "direct"})

	{:ok, unlisted_activity} =
	CommonAPI.post(other_user, %{status: ".", visibility: "unlisted"})

	{:ok, private_activity} = CommonAPI.post(other_user, %{status: ".", visibility: "private"})

	{:ok, _} = CommonAPI.favorite(public_activity.id, user)
	{:ok, _} = CommonAPI.favorite(direct_activity.id, user)
	{:ok, _} = CommonAPI.favorite(unlisted_activity.id, user)
	{:ok, _} = CommonAPI.favorite(private_activity.id, user)

	activity_ids =
	conn
	\|> get("/api/v1/notifications?exclude_visibilities[]=direct")
	\|> json_response_and_validate_schema(200)
	\|> Enum.map(& &1["status"]["id"])

	assert public_activity.id in activity_ids
	assert unlisted_activity.id in activity_ids
	assert private_activity.id in activity_ids
	refute direct_activity.id in activity_ids

	activity_ids =
	conn
	\|> get("/api/v1/notifications?exclude_visibilities[]=unlisted")
	\|> json_response_and_validate_schema(200)
	\|> Enum.map(& &1["status"]["id"])

	assert public_activity.id in activity_ids
	refute unlisted_activity.id in activity_ids
	assert private_activity.id in activity_ids
	assert direct_activity.id in activity_ids

	activity_ids =
	conn
	\|> get("/api/v1/notifications?exclude_visibilities[]=private")
	\|> json_response_and_validate_schema(200)
	\|> Enum.map(& &1["status"]["id"])

	assert public_activity.id in activity_ids
	assert unlisted_activity.id in activity_ids
	refute private_activity.id in activity_ids
	assert direct_activity.id in activity_ids

	activity_ids =
	conn
	\|> get("/api/v1/notifications?exclude_visibilities[]=public")
	\|> json_response_and_validate_schema(200)
	\|> Enum.map(& &1["status"]["id"])

	refute public_activity.id in activity_ids
	assert unlisted_activity.id in activity_ids
	assert private_activity.id in activity_ids
	assert direct_activity.id in activity_ids
	end

	test "filters notifications for Announce activities" do
	user = insert(:user)
	%{user: other_user, conn: conn} = oauth_access(["read:notifications"])

	{:ok, public_activity} = CommonAPI.post(other_user, %{status: ".", visibility: "public"})

	{:ok, unlisted_activity} =
	CommonAPI.post(other_user, %{status: ".", visibility: "unlisted"})

	{:ok, _} = CommonAPI.repeat(public_activity.id, user)
	{:ok, _} = CommonAPI.repeat(unlisted_activity.id, user)

	activity_ids =
	conn
	\|> get("/api/v1/notifications?exclude_visibilities[]=unlisted")
	\|> json_response_and_validate_schema(200)
	\|> Enum.map(& &1["status"]["id"])

	assert public_activity.id in activity_ids
	refute unlisted_activity.id in activity_ids
	end

	test "doesn't return less than the requested amount of records when the user's reply is liked" do
	user = insert(:user)
	%{user: other_user, conn: conn} = oauth_access(["read:notifications"])

	{:ok, mention} =
	CommonAPI.post(user, %{status: "@#{other_user.nickname}", visibility: "public"})

	{:ok, activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})

	{:ok, reply} =
	CommonAPI.post(other_user, %{
	status: ".",
	visibility: "public",
	in_reply_to_status_id: activity.id
	})

	{:ok, _favorite} = CommonAPI.favorite(reply.id, user)

	activity_ids =
	conn
	\|> get("/api/v1/notifications?exclude_visibilities[]=direct&limit=2")
	\|> json_response_and_validate_schema(200)
	\|> Enum.map(& &1["status"]["id"])

	assert [reply.id, mention.id] == activity_ids
	end
	end

	test "filters notifications using exclude_types" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, mention_activity} = CommonAPI.post(other_user, %{status: "hey @#{user.nickname}"})
	{:ok, create_activity} = CommonAPI.post(user, %{status: "hey"})
	{:ok, favorite_activity} = CommonAPI.favorite(create_activity.id, other_user)
	{:ok, reblog_activity} = CommonAPI.repeat(create_activity.id, other_user)
	{:ok, _, _, follow_activity} = CommonAPI.follow(user, other_user)

	mention_notification_id = get_notification_id_by_activity(mention_activity)
	favorite_notification_id = get_notification_id_by_activity(favorite_activity)
	reblog_notification_id = get_notification_id_by_activity(reblog_activity)
	follow_notification_id = get_notification_id_by_activity(follow_activity)

	query = params_to_query(%{exclude_types: ["mention", "favourite", "reblog"]})
	conn_res = get(conn, "/api/v1/notifications?" <> query)

	assert [%{"id" => ^follow_notification_id}] = json_response_and_validate_schema(conn_res, 200)

	query = params_to_query(%{exclude_types: ["favourite", "reblog", "follow"]})
	conn_res = get(conn, "/api/v1/notifications?" <> query)

	assert [%{"id" => ^mention_notification_id}] =
	json_response_and_validate_schema(conn_res, 200)

	query = params_to_query(%{exclude_types: ["reblog", "follow", "mention"]})
	conn_res = get(conn, "/api/v1/notifications?" <> query)

	assert [%{"id" => ^favorite_notification_id}] =
	json_response_and_validate_schema(conn_res, 200)

	query = params_to_query(%{exclude_types: ["follow", "mention", "favourite"]})
	conn_res = get(conn, "/api/v1/notifications?" <> query)

	assert [%{"id" => ^reblog_notification_id}] = json_response_and_validate_schema(conn_res, 200)
	end

	test "filters notifications using types" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, mention_activity} = CommonAPI.post(other_user, %{status: "hey @#{user.nickname}"})
	{:ok, create_activity} = CommonAPI.post(user, %{status: "hey"})
	{:ok, favorite_activity} = CommonAPI.favorite(create_activity.id, other_user)
	{:ok, reblog_activity} = CommonAPI.repeat(create_activity.id, other_user)
	{:ok, _, _, follow_activity} = CommonAPI.follow(user, other_user)

	mention_notification_id = get_notification_id_by_activity(mention_activity)
	favorite_notification_id = get_notification_id_by_activity(favorite_activity)
	reblog_notification_id = get_notification_id_by_activity(reblog_activity)
	follow_notification_id = get_notification_id_by_activity(follow_activity)

	conn_res = get(conn, "/api/v1/notifications?types[]=follow")

	assert [%{"id" => ^follow_notification_id}] = json_response_and_validate_schema(conn_res, 200)

	conn_res = get(conn, "/api/v1/notifications?types[]=mention")

	assert [%{"id" => ^mention_notification_id}] =
	json_response_and_validate_schema(conn_res, 200)

	conn_res = get(conn, "/api/v1/notifications?types[]=favourite")

	assert [%{"id" => ^favorite_notification_id}] =
	json_response_and_validate_schema(conn_res, 200)

	conn_res = get(conn, "/api/v1/notifications?types[]=reblog")

	assert [%{"id" => ^reblog_notification_id}] = json_response_and_validate_schema(conn_res, 200)

	result = conn \|> get("/api/v1/notifications") \|> json_response_and_validate_schema(200)

	assert length(result) == 4

	query = params_to_query(%{types: ["follow", "mention", "favourite", "reblog"]})

	result =
	conn
	\|> get("/api/v1/notifications?" <> query)
	\|> json_response_and_validate_schema(200)

	assert length(result) == 4
	end

	test "filtering falls back to include_types" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, _activity} = CommonAPI.post(other_user, %{status: "hey @#{user.nickname}"})
	{:ok, create_activity} = CommonAPI.post(user, %{status: "hey"})
	{:ok, _activity} = CommonAPI.favorite(create_activity.id, other_user)
	{:ok, _activity} = CommonAPI.repeat(create_activity.id, other_user)
	{:ok, _, _, follow_activity} = CommonAPI.follow(user, other_user)

	follow_notification_id = get_notification_id_by_activity(follow_activity)

	conn_res = get(conn, "/api/v1/notifications?include_types[]=follow")

	assert [%{"id" => ^follow_notification_id}] = json_response_and_validate_schema(conn_res, 200)
	end

	test "destroy multiple" do
	%{user: user, conn: conn} = oauth_access(["read:notifications", "write:notifications"])
	other_user = insert(:user)

	{:ok, activity1} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
	{:ok, activity2} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
	{:ok, activity3} = CommonAPI.post(user, %{status: "hi @#{other_user.nickname}"})
	{:ok, activity4} = CommonAPI.post(user, %{status: "hi @#{other_user.nickname}"})

	notification1_id = get_notification_id_by_activity(activity1)
	notification2_id = get_notification_id_by_activity(activity2)
	notification3_id = get_notification_id_by_activity(activity3)
	notification4_id = get_notification_id_by_activity(activity4)

	result =
	conn
	\|> get("/api/v1/notifications")
	\|> json_response_and_validate_schema(:ok)

	assert [%{"id" => ^notification2_id}, %{"id" => ^notification1_id}] = result

	conn2 =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:notifications"]))

	result =
	conn2
	\|> get("/api/v1/notifications")
	\|> json_response_and_validate_schema(:ok)

	assert [%{"id" => ^notification4_id}, %{"id" => ^notification3_id}] = result

	query = params_to_query(%{ids: [notification1_id, notification2_id]})
	conn_destroy = delete(conn, "/api/v1/notifications/destroy_multiple?" <> query)

	assert json_response_and_validate_schema(conn_destroy, 200) == %{}

	result =
	conn2
	\|> get("/api/v1/notifications")
	\|> json_response_and_validate_schema(:ok)

	assert [%{"id" => ^notification4_id}, %{"id" => ^notification3_id}] = result
	end

	test "doesn't see notifications after muting user with notifications" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	user2 = insert(:user)

	{:ok, _, _, _} = CommonAPI.follow(user2, user)
	{:ok, _} = CommonAPI.post(user2, %{status: "hey @#{user.nickname}"})

	ret_conn = get(conn, "/api/v1/notifications")

	assert length(json_response_and_validate_schema(ret_conn, 200)) == 1

	{:ok, _user_relationships} = User.mute(user, user2)

	conn = get(conn, "/api/v1/notifications")

	assert json_response_and_validate_schema(conn, 200) == []
	end

	test "see notifications after muting user without notifications" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	user2 = insert(:user)

	{:ok, _, _, _} = CommonAPI.follow(user2, user)
	{:ok, _} = CommonAPI.post(user2, %{status: "hey @#{user.nickname}"})

	ret_conn = get(conn, "/api/v1/notifications")

	assert length(json_response_and_validate_schema(ret_conn, 200)) == 1

	{:ok, _user_relationships} = User.mute(user, user2, %{notifications: false})

	conn = get(conn, "/api/v1/notifications")

	assert length(json_response_and_validate_schema(conn, 200)) == 1
	end

	test "see notifications after muting user with notifications and with_muted parameter" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	user2 = insert(:user)

	{:ok, _, _, _} = CommonAPI.follow(user2, user)
	{:ok, _} = CommonAPI.post(user2, %{status: "hey @#{user.nickname}"})

	ret_conn = get(conn, "/api/v1/notifications")

	assert length(json_response_and_validate_schema(ret_conn, 200)) == 1

	{:ok, _user_relationships} = User.mute(user, user2)

	conn = get(conn, "/api/v1/notifications?with_muted=true")

	assert length(json_response_and_validate_schema(conn, 200)) == 1
	end

	test "see move notifications" do
	old_user = insert(:user)
	new_user = insert(:user, also_known_as: [old_user.ap_id])
	%{user: follower, conn: conn} = oauth_access(["read:notifications"])

	User.follow(follower, old_user)
	Pleroma.Web.ActivityPub.ActivityPub.move(old_user, new_user)
	Pleroma.Tests.ObanHelpers.perform_all()

	conn = get(conn, "/api/v1/notifications")

	assert length(json_response_and_validate_schema(conn, 200)) == 1
	end

	describe "link headers" do
	test "preserves parameters in link headers" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])
	other_user = insert(:user)

	{:ok, activity1} =
	CommonAPI.post(other_user, %{
	status: "hi @#{user.nickname}",
	visibility: "public"
	})

	{:ok, activity2} =
	CommonAPI.post(other_user, %{
	status: "hi @#{user.nickname}",
	visibility: "public"
	})

	notification1 = Repo.get_by(Notification, activity_id: activity1.id)
	notification2 = Repo.get_by(Notification, activity_id: activity2.id)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications?limit=5")

	assert [link_header] = get_resp_header(conn, "link")
	assert link_header =~ ~r/limit=5/
	assert link_header =~ ~r/min_id=#{notification2.id}/
	assert link_header =~ ~r/max_id=#{notification1.id}/
	end
	end

	describe "from specified user" do
	test "account_id" do
	%{user: user, conn: conn} = oauth_access(["read:notifications"])

	%{id: account_id} = other_user1 = insert(:user)
	other_user2 = insert(:user)

	{:ok, _activity} = CommonAPI.post(other_user1, %{status: "hi @#{user.nickname}"})
	{:ok, _activity} = CommonAPI.post(other_user2, %{status: "bye @#{user.nickname}"})

	assert [%{"account" => %{"id" => ^account_id}}] =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications?account_id=#{account_id}")
	\|> json_response_and_validate_schema(200)

	assert %{"error" => "Account is not found"} =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications?account_id=cofe")
	\|> json_response_and_validate_schema(404)
	end
	end

	defp get_notification_id_by_activity(%{id: id}) do
	Notification
	\|> Repo.get_by(activity_id: id)
	\|> Map.get(:id)
	\|> to_string()
	end

	defp params_to_query(%{} = params) do
	Enum.map_join(params, "&", fn
	{k, v} when is_list(v) -> Enum.map_join(v, "&", &"#{k}[]=#{&1}")
	{k, v} -> k <> "=" <> v
	end)
	end
	end
	diff --git a/test/pleroma/web/mastodon_api/controllers/report_controller_test.exs b/test/pleroma/web/mastodon_api/controllers/report_controller_test.exs
	index 4ab5d0771..50d38ddaf 100644
	--- a/test/pleroma/web/mastodon_api/controllers/report_controller_test.exs
	+++ b/test/pleroma/web/mastodon_api/controllers/report_controller_test.exs
	@@ -1,171 +1,216 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.ReportControllerTest do
	use Pleroma.Web.ConnCase, async: true

	alias Pleroma.Activity
	alias Pleroma.Repo
	alias Pleroma.Rule
	alias Pleroma.Web.CommonAPI

	import Pleroma.Factory

	setup do: oauth_access(["write:reports"])

	setup do
	target_user = insert(:user)

	{:ok, activity} = CommonAPI.post(target_user, %{status: "foobar"})

	[target_user: target_user, activity: activity]
	end

	test "submit a basic report", %{conn: conn, target_user: target_user} do
	assert %{"action_taken" => false, "id" => _} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{"account_id" => target_user.id})
	\|> json_response_and_validate_schema(200)
	end

	test "submit a report with a fake Create", %{
	conn: conn
	} do
	target_user = insert(:user)

	note = insert(:note, user: target_user)

	activity_params = %{
	"object" => note.data["id"],
	"actor" => note.data["actor"],
	"to" => note.data["to"] \|\| [],
	"cc" => note.data["cc"] \|\| [],
	"type" => "Create"
	}

	{:ok, fake_activity} =
	Repo.insert(%Activity{
	data: activity_params,
	recipients: activity_params["to"] ++ activity_params["cc"],
	local: true,
	actor: activity_params["actor"]
	})

	assert %{"action_taken" => false, "id" => _} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{
	"account_id" => target_user.id,
	"status_ids" => [fake_activity.id],
	"comment" => "bad status!",
	"forward" => "false"
	})
	\|> json_response_and_validate_schema(200)
	end

	test "submit a report with statuses and comment", %{
	conn: conn,
	target_user: target_user,
	activity: activity
	} do
	assert %{"action_taken" => false, "id" => _} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{
	"account_id" => target_user.id,
	"status_ids" => [activity.id],
	"comment" => "bad status!",
	"forward" => "false"
	})
	\|> json_response_and_validate_schema(200)
	end

	test "submit a report with rule_ids", %{
	conn: conn,
	target_user: target_user
	} do
	%{id: rule_id} = Rule.create(%{text: "There are no rules"})

	rule_id = to_string(rule_id)

	assert %{"action_taken" => false, "id" => id} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{
	"account_id" => target_user.id,
	"forward" => "false",
	"rule_ids" => [rule_id]
	})
	\|> json_response_and_validate_schema(200)

	assert %Activity{data: %{"rules" => [^rule_id]}} = Activity.get_report(id)
	end

	test "rules field is empty if provided wrong rule id", %{
	conn: conn,
	target_user: target_user
	} do
	assert %{"id" => id} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{
	"account_id" => target_user.id,
	"forward" => "false",
	"rule_ids" => ["-1"]
	})
	\|> json_response_and_validate_schema(200)

	assert %Activity{data: %{"rules" => []}} = Activity.get_report(id)
	end

	test "account_id is required", %{
	conn: conn,
	activity: activity
	} do
	assert %{"error" => "Missing field: account_id."} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{"status_ids" => [activity.id]})
	\|> json_response_and_validate_schema(400)
	end

	test "comment must be up to the size specified in the config", %{
	conn: conn,
	target_user: target_user
	} do
	max_size = Pleroma.Config.get([:instance, :max_report_comment_size], 1000)
	comment = String.pad_trailing("a", max_size + 1, "a")

	error = %{"error" => "Comment must be up to #{max_size} characters"}

	assert ^error =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{"account_id" => target_user.id, "comment" => comment})
	\|> json_response_and_validate_schema(400)
	end

	- test "returns error when account is not exist", %{
	+ test "returns error when account does not exist", %{
	conn: conn,
	activity: activity
	} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{"status_ids" => [activity.id], "account_id" => "foo"})

	assert json_response_and_validate_schema(conn, 400) == %{"error" => "Account not found"}
	end

	+ test "returns not found when post isn't visible to reporter", %{user: target_user} do
	+ %{conn: conn, user: reporter} = oauth_access(["write:reports"])
	+
	+ {:ok, invisible_activity} =
	+ CommonAPI.post(target_user, %{status: "Invisible!", visibility: "private"})
	+
	+ assert Pleroma.Web.ActivityPub.Visibility.private?(invisible_activity)
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(invisible_activity, reporter)
	+
	+ assert %{"error" => "Record not found"} =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post(
	+ "/api/v1/reports",
	+ %{"account_id" => target_user.id, "status_ids" => [invisible_activity.id]}
	+ )
	+ \|> json_response_and_validate_schema(404)
	+ end
	+
	+ test "returns not found when some post aren't visible to reporter", %{
	+ activity: activity,
	+ user: target_user
	+ } do
	+ %{conn: conn, user: reporter} = oauth_access(["write:reports"])
	+
	+ {:ok, invisible_activity} =
	+ CommonAPI.post(target_user, %{status: "Invisible!", visibility: "private"})
	+
	+ assert Pleroma.Web.ActivityPub.Visibility.private?(invisible_activity)
	+ assert Pleroma.Web.ActivityPub.Visibility.visible_for_user?(activity, reporter)
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(invisible_activity, reporter)
	+
	+ assert %{"error" => "Record not found"} =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post(
	+ "/api/v1/reports",
	+ %{
	+ "account_id" => target_user.id,
	+ "status_ids" => [activity.id, invisible_activity.id]
	+ }
	+ )
	+ \|> json_response_and_validate_schema(404)
	+ end
	+
	test "doesn't fail if an admin has no email", %{conn: conn, target_user: target_user} do
	insert(:user, %{is_admin: true, email: nil})

	assert %{"action_taken" => false, "id" => _} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/reports", %{"account_id" => target_user.id})
	\|> json_response_and_validate_schema(200)
	end
	end
	diff --git a/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs b/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
	index 5c24df864..67514ae56 100644
	--- a/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
	+++ b/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
	@@ -1,2598 +1,2930 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.StatusControllerTest do
	use Pleroma.Web.ConnCase, async: false
	use Oban.Testing, repo: Pleroma.Repo

	alias Pleroma.Activity
	alias Pleroma.Conversation.Participation
	alias Pleroma.ModerationLog
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.Tests.Helpers
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Utils
	+ alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Workers.ScheduledActivityWorker

	import Mox
	import Pleroma.Factory

	setup do: clear_config([:instance, :federating])
	setup do: clear_config([:instance, :allow_relay])
	setup do: clear_config([:mrf, :policies])
	setup do: clear_config([:mrf_keyword, :reject])

	setup do
	Pleroma.UnstubbedConfigMock
	\|> stub_with(Pleroma.Config)

	Pleroma.StaticStubbedConfigMock
	\|> stub(:get, fn
	[:rich_media, :enabled] -> false
	path -> Pleroma.Test.StaticConfig.get(path)
	end)

	:ok
	end

	describe "posting statuses" do
	setup do: oauth_access(["write:statuses"])

	test "posting a status does not increment reblog_count when relaying", %{conn: conn} do
	clear_config([:instance, :federating], true)
	clear_config([:instance, :allow_relay], true)

	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"content_type" => "text/plain",
	"source" => "Pleroma FE",
	"status" => "Hello world",
	"visibility" => "public"
	})
	\|> json_response_and_validate_schema(200)

	assert response["reblogs_count"] == 0
	ObanHelpers.perform_all()

	response =
	conn
	\|> get("/api/v1/statuses/#{response["id"]}", %{})
	\|> json_response_and_validate_schema(200)

	assert response["reblogs_count"] == 0
	end

	test "posting a status", %{conn: conn} do
	idempotency_key = "Pikachu rocks!"

	conn_one =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> put_req_header("idempotency-key", idempotency_key)
	\|> post("/api/v1/statuses", %{
	"status" => "cofe",
	"spoiler_text" => "2hu",
	"sensitive" => "0"
	})

	assert %{"content" => "cofe", "id" => id, "spoiler_text" => "2hu", "sensitive" => false} =
	json_response_and_validate_schema(conn_one, 200)

	assert Activity.get_by_id(id)

	conn_two =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> put_req_header("idempotency-key", idempotency_key)
	\|> post("/api/v1/statuses", %{
	"status" => "cofe",
	"spoiler_text" => "2hu",
	"sensitive" => 0
	})

	# Idempotency plug response means detection fail
	assert %{"id" => second_id} = json_response(conn_two, 200)
	assert id == second_id

	conn_three =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "cofe",
	"spoiler_text" => "2hu",
	"sensitive" => "False"
	})

	assert %{"id" => third_id} = json_response_and_validate_schema(conn_three, 200)
	refute id == third_id

	# An activity that will expire:
	# 2 hours
	expires_in = 2 * 60 * 60

	expires_at = DateTime.add(DateTime.utc_now(), expires_in)

	conn_four =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "oolong",
	"expires_in" => expires_in
	})

	assert %{"id" => fourth_id} = json_response_and_validate_schema(conn_four, 200)

	assert Activity.get_by_id(fourth_id)

	assert_enqueued(
	worker: Pleroma.Workers.PurgeExpiredActivity,
	args: %{activity_id: fourth_id},
	scheduled_at: expires_at
	)
	end

	test "posting a quote post", %{conn: conn} do
	user = insert(:user)

	{:ok, %{id: activity_id} = activity} = CommonAPI.post(user, %{status: "yolo"})
	%{data: %{"id" => quote_url}} = Object.normalize(activity)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "indeed",
	"quote_id" => activity_id
	})

	assert %{
	"id" => id,
	"pleroma" => %{"quote" => %{"id" => ^activity_id}, "quote_url" => ^quote_url}
	} = json_response_and_validate_schema(conn, 200)

	assert Activity.get_by_id(id)
	end

	test "it fails to create a status if `expires_in` is less or equal than an hour", %{
	conn: conn
	} do
	# 1 minute
	expires_in = 1 * 60

	assert %{"error" => "Expiry date is too soon"} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "oolong",
	"expires_in" => expires_in
	})
	\|> json_response_and_validate_schema(422)

	# 5 minutes
	expires_in = 5 * 60

	assert %{"error" => "Expiry date is too soon"} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "oolong",
	"expires_in" => expires_in
	})
	\|> json_response_and_validate_schema(422)
	end

	test "Get MRF reason when posting a status is rejected by one", %{conn: conn} do
	clear_config([:mrf_keyword, :reject], ["GNO"])
	clear_config([:mrf, :policies], [Pleroma.Web.ActivityPub.MRF.KeywordPolicy])

	assert %{"error" => "[KeywordPolicy] Matches with rejected keyword"} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => "GNO/Linux"})
	\|> json_response_and_validate_schema(422)
	end

	test "posting an undefined status with an attachment", %{user: user, conn: conn} do
	file = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, upload} = ActivityPub.upload(file, actor: user.ap_id)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"media_ids" => [to_string(upload.id)]
	})

	assert json_response_and_validate_schema(conn, 200)
	end

	test "replying to a status", %{user: user, conn: conn} do
	{:ok, replied_to} = CommonAPI.post(user, %{status: "cofe"})

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => "xD", "in_reply_to_id" => replied_to.id})

	assert %{"content" => "xD", "id" => id} = json_response_and_validate_schema(conn, 200)

	activity = Activity.get_by_id(id)

	assert activity.data["context"] == replied_to.data["context"]
	assert Activity.get_in_reply_to_activity(activity).id == replied_to.id
	end

	test "replying to a deleted status", %{user: user, conn: conn} do
	{:ok, status} = CommonAPI.post(user, %{status: "cofe"})
	{:ok, _deleted_status} = CommonAPI.delete(status.id, user)

	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => "xD", "in_reply_to_id" => status.id})
	\|> json_response_and_validate_schema(422)
	end

	test "replying to a direct message with visibility other than direct", %{
	user: user,
	conn: conn
	} do
	{:ok, replied_to} = CommonAPI.post(user, %{status: "suya..", visibility: "direct"})

	Enum.each(["public", "private", "unlisted"], fn visibility ->
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "@#{user.nickname} hey",
	"in_reply_to_id" => replied_to.id,
	"visibility" => visibility
	})

	assert json_response_and_validate_schema(conn, 422) == %{
	"error" => "The message visibility must be direct"
	}
	end)
	end

	+ test "replying to a post the current user can't access fails", %{user: user, conn: conn} do
	+ stranger = insert(:user)
	+
	+ {:ok, priv_post_act} =
	+ CommonAPI.post(stranger, %{status: "forbidden knowledge", visibility: "private"})
	+
	+ assert Visibility.visible_for_user?(priv_post_act, stranger)
	+ refute Visibility.visible_for_user?(priv_post_act, user)
	+
	+ resp =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses", %{
	+ "status" => "@#{stranger.nickname} :peek:",
	+ "in_reply_to_id" => priv_post_act.id,
	+ "visibility" => "private"
	+ })
	+ \|> json_response_and_validate_schema(422)
	+
	+ assert match?(%{"error" => _}, resp)
	+ end
	+
	+ test "replying to own DM succeeds", %{user: user, conn: conn} do
	+ # this is an "edge" case for visibility: replying user is not
	+ # part of addressed users (but is the author)
	+ stranger = insert(:user)
	+
	+ {:ok, %{id: dm_id} = dm_post_act} =
	+ CommonAPI.post(user, %{
	+ status: "@#{stranger.nickname} wanna lose your mind to forbidden knowledge?",
	+ visibility: "direct"
	+ })
	+
	+ assert Visibility.visible_for_user?(dm_post_act, stranger)
	+ assert Visibility.visible_for_user?(dm_post_act, user)
	+
	+ resp =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses", %{
	+ "status" => "@#{stranger.nickname} :peek:",
	+ "in_reply_to_id" => dm_id,
	+ "visibility" => "direct"
	+ })
	+ \|> json_response_and_validate_schema(200)
	+
	+ assert match?(%{"in_reply_to_id" => ^dm_id}, resp)
	+ end
	+
	+ test "replying to a non-post activity fails", %{conn: conn, user: user} do
	+ other_user = insert(:user)
	+
	+ {:ok, _, _, follow_activity} = CommonAPI.follow(other_user, user)
	+ assert Visibility.visible_for_user?(follow_activity, user)
	+
	+ conn =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses", %{
	+ "status" => "hiiii!",
	+ "in_reply_to_id" => to_string(follow_activity.id)
	+ })
	+
	+ assert %{"error" => "Can only reply to posts, not \"Follow\" activities"} =
	+ json_response_and_validate_schema(conn, 422)
	+ end
	+
	test "posting a status with an invalid in_reply_to_id", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => "xD", "in_reply_to_id" => ""})

	assert %{"content" => "xD", "id" => id} = json_response_and_validate_schema(conn, 200)
	assert Activity.get_by_id(id)
	end

	test "posting a sensitive status", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => "cofe", "sensitive" => true})

	assert %{"content" => "cofe", "id" => id, "sensitive" => true} =
	json_response_and_validate_schema(conn, 200)

	assert Activity.get_by_id(id)
	end

	test "posting a fake status", %{conn: conn} do
	real_conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" =>
	"\"Tenshi Eating a Corndog\" is a much discussed concept on /jp/. The significance of it is disputed, so I will focus on one core concept: the symbolism behind it"
	})

	real_status = json_response_and_validate_schema(real_conn, 200)

	assert real_status
	assert Object.get_by_ap_id(real_status["uri"])

	real_status =
	real_status
	\|> Map.put("id", nil)
	\|> Map.put("url", nil)
	\|> Map.put("uri", nil)
	\|> Map.put("created_at", nil)
	\|> Kernel.put_in(["pleroma", "context"], nil)
	\|> Kernel.put_in(["pleroma", "conversation_id"], nil)

	fake_conn =
	conn
	\|> assign(:user, refresh_record(conn.assigns.user))
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" =>
	"\"Tenshi Eating a Corndog\" is a much discussed concept on /jp/. The significance of it is disputed, so I will focus on one core concept: the symbolism behind it",
	"preview" => true
	})

	fake_status = json_response_and_validate_schema(fake_conn, 200)

	assert fake_status
	refute Object.get_by_ap_id(fake_status["uri"])

	fake_status =
	fake_status
	\|> Map.put("id", nil)
	\|> Map.put("url", nil)
	\|> Map.put("uri", nil)
	\|> Map.put("created_at", nil)
	\|> Kernel.put_in(["pleroma", "context"], nil)
	\|> Kernel.put_in(["pleroma", "conversation_id"], nil)

	assert real_status == fake_status
	end

	test "posting a direct status", %{conn: conn} do
	user2 = insert(:user)
	content = "direct cofe @#{user2.nickname}"

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => content, "visibility" => "direct"})

	assert %{"id" => id} = response = json_response_and_validate_schema(conn, 200)
	assert response["visibility"] == "direct"
	assert response["pleroma"]["direct_conversation_id"]
	assert activity = Activity.get_by_id(id)
	assert activity.recipients == [user2.ap_id, conn.assigns[:user].ap_id]
	assert activity.data["to"] == [user2.ap_id]
	assert activity.data["cc"] == []
	end

	test "discloses application metadata when enabled" do
	user = insert(:user, disclose_client: true)
	%{user: _user, token: token, conn: conn} = oauth_access(["write:statuses"], user: user)

	%Pleroma.Web.OAuth.Token{
	app: %Pleroma.Web.OAuth.App{
	client_name: app_name,
	website: app_website
	}
	} = token

	result =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "cofe is my copilot"
	})

	assert %{
	"content" => "cofe is my copilot"
	} = json_response_and_validate_schema(result, 200)

	activity = result.assigns.activity.id

	result =
	conn
	\|> get("/api/v1/statuses/#{activity}")

	assert %{
	"content" => "cofe is my copilot",
	"application" => %{
	"name" => ^app_name,
	"website" => ^app_website
	}
	} = json_response_and_validate_schema(result, 200)
	end

	test "hides application metadata when disabled" do
	user = insert(:user, disclose_client: false)
	%{user: _user, token: _token, conn: conn} = oauth_access(["write:statuses"], user: user)

	result =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "club mate is my wingman"
	})

	assert %{"content" => "club mate is my wingman"} =
	json_response_and_validate_schema(result, 200)

	activity = result.assigns.activity.id

	result =
	conn
	\|> get("/api/v1/statuses/#{activity}")

	assert %{
	"content" => "club mate is my wingman",
	"application" => nil
	} = json_response_and_validate_schema(result, 200)
	end
	end

	describe "posting scheduled statuses" do
	setup do: oauth_access(["write:statuses"])

	test "creates a scheduled activity", %{conn: conn} do
	scheduled_at =
	NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(120), :millisecond)
	\|> NaiveDateTime.to_iso8601()
	\|> Kernel.<>("Z")

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "scheduled",
	"scheduled_at" => scheduled_at
	})

	assert %{"scheduled_at" => expected_scheduled_at} =
	json_response_and_validate_schema(conn, 200)

	assert expected_scheduled_at == CommonAPI.Utils.to_masto_date(scheduled_at)
	assert [] == Repo.all(Activity)
	end

	test "with expiration" do
	%{conn: conn} = oauth_access(["write:statuses", "read:statuses"])

	scheduled_at =
	NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(6), :millisecond)
	\|> NaiveDateTime.to_iso8601()
	\|> Kernel.<>("Z")

	assert %{"id" => status_id, "params" => %{"expires_in" => 300}} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "scheduled",
	"scheduled_at" => scheduled_at,
	"expires_in" => 300
	})
	\|> json_response_and_validate_schema(200)

	assert %{"id" => ^status_id, "params" => %{"expires_in" => 300}} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> get("/api/v1/scheduled_statuses/#{status_id}")
	\|> json_response_and_validate_schema(200)
	end

	test "ignores nil values", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "not scheduled",
	"scheduled_at" => nil
	})

	assert result = json_response_and_validate_schema(conn, 200)
	assert Activity.get_by_id(result["id"])
	end

	test "creates a scheduled activity with a media attachment", %{user: user, conn: conn} do
	scheduled_at =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.minutes(120), :millisecond)
	\|> NaiveDateTime.to_iso8601()
	\|> Kernel.<>("Z")

	file = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, upload} = ActivityPub.upload(file, actor: user.ap_id)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"media_ids" => [to_string(upload.id)],
	"status" => "scheduled",
	"scheduled_at" => scheduled_at
	})

	assert %{"media_attachments" => [media_attachment]} =
	json_response_and_validate_schema(conn, 200)

	assert %{"type" => "image"} = media_attachment
	end

	test "skips the scheduling and creates the activity if scheduled_at is earlier than 5 minutes from now",
	%{conn: conn} do
	scheduled_at =
	NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(5) - 1, :millisecond)
	\|> NaiveDateTime.to_iso8601()
	\|> Kernel.<>("Z")

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "not scheduled",
	"scheduled_at" => scheduled_at
	})

	assert %{"content" => "not scheduled"} = json_response_and_validate_schema(conn, 200)
	assert [] == Repo.all(ScheduledActivity)
	end

	test "returns error when daily user limit is exceeded", %{user: user, conn: conn} do
	today =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.minutes(6), :millisecond)
	\|> NaiveDateTime.to_iso8601()
	# TODO
	\|> Kernel.<>("Z")

	attrs = %{params: %{}, scheduled_at: today}
	{:ok, _} = ScheduledActivity.create(user, attrs)
	{:ok, _} = ScheduledActivity.create(user, attrs)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => "scheduled", "scheduled_at" => today})

	assert %{"error" => "daily limit exceeded"} == json_response_and_validate_schema(conn, 422)
	end

	test "returns error when total user limit is exceeded", %{user: user, conn: conn} do
	today =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.minutes(6), :millisecond)
	\|> NaiveDateTime.to_iso8601()
	\|> Kernel.<>("Z")

	tomorrow =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.hours(36), :millisecond)
	\|> NaiveDateTime.to_iso8601()
	\|> Kernel.<>("Z")

	attrs = %{params: %{}, scheduled_at: today}
	{:ok, _} = ScheduledActivity.create(user, attrs)
	{:ok, _} = ScheduledActivity.create(user, attrs)
	{:ok, _} = ScheduledActivity.create(user, %{params: %{}, scheduled_at: tomorrow})

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => "scheduled", "scheduled_at" => tomorrow})

	assert %{"error" => "total limit exceeded"} == json_response_and_validate_schema(conn, 422)
	end
	end

	describe "posting polls" do
	setup do: oauth_access(["write:statuses"])

	test "posting a poll", %{conn: conn} do
	time = NaiveDateTime.utc_now()

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "Who is the #bestgrill?",
	"poll" => %{
	"options" => ["Rei", "Asuka", "Misato"],
	"expires_in" => 420
	}
	})

	response = json_response_and_validate_schema(conn, 200)

	assert Enum.all?(response["poll"]["options"], fn %{"title" => title} ->
	title in ["Rei", "Asuka", "Misato"]
	end)

	assert NaiveDateTime.diff(NaiveDateTime.from_iso8601!(response["poll"]["expires_at"]), time) in 420..430
	assert response["poll"]["expired"] == false

	question = Object.get_by_id(response["poll"]["id"])

	# closed contains utc timezone
	assert question.data["closed"] =~ "Z"
	end

	test "option limit is enforced", %{conn: conn} do
	limit = Config.get([:instance, :poll_limits, :max_options])

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "desu~",
	"poll" => %{
	"options" => Enum.map(0..limit, fn num -> "desu #{num}" end),
	"expires_in" => 1
	}
	})

	%{"error" => error} = json_response_and_validate_schema(conn, 422)
	assert error == "Poll can't contain more than #{limit} options"
	end

	test "option character limit is enforced", %{conn: conn} do
	limit = Config.get([:instance, :poll_limits, :max_option_chars])

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "...",
	"poll" => %{
	"options" => [String.duplicate(".", limit + 1), "lol"],
	"expires_in" => 1
	}
	})

	%{"error" => error} = json_response_and_validate_schema(conn, 422)
	assert error == "Poll options cannot be longer than #{limit} characters each"
	end

	test "minimal date limit is enforced", %{conn: conn} do
	limit = Config.get([:instance, :poll_limits, :min_expiration])

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "imagine arbitrary limits",
	"poll" => %{
	"options" => ["this post was made by pleroma gang"],
	"expires_in" => limit - 1
	}
	})

	%{"error" => error} = json_response_and_validate_schema(conn, 422)
	assert error == "Expiration date is too soon"
	end

	test "maximum date limit is enforced", %{conn: conn} do
	limit = Config.get([:instance, :poll_limits, :max_expiration])

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "imagine arbitrary limits",
	"poll" => %{
	"options" => ["this post was made by pleroma gang"],
	"expires_in" => limit + 1
	}
	})

	%{"error" => error} = json_response_and_validate_schema(conn, 422)
	assert error == "Expiration date is too far in the future"
	end

	test "scheduled poll", %{conn: conn} do
	clear_config([ScheduledActivity, :enabled], true)

	scheduled_at =
	NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(6), :millisecond)
	\|> NaiveDateTime.to_iso8601()
	\|> Kernel.<>("Z")

	%{"id" => scheduled_id} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "very cool poll",
	"poll" => %{
	"options" => ~w(a b c),
	"expires_in" => 420
	},
	"scheduled_at" => scheduled_at
	})
	\|> json_response_and_validate_schema(200)

	assert {:ok, %{id: activity_id}} =
	perform_job(ScheduledActivityWorker, %{
	activity_id: scheduled_id
	})

	refute_enqueued(worker: ScheduledActivityWorker)

	object =
	Activity
	\|> Repo.get(activity_id)
	\|> Object.normalize()

	assert object.data["content"] == "very cool poll"
	assert object.data["type"] == "Question"
	assert length(object.data["oneOf"]) == 3
	end

	test "cannot have only one option", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "desu~",
	"poll" => %{"options" => ["mew"], "expires_in" => 1}
	})

	%{"error" => error} = json_response_and_validate_schema(conn, 422)
	assert error == "Poll must contain at least 2 options"
	end

	test "cannot have only duplicated options", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "desu~",
	"poll" => %{"options" => ["mew", "mew"], "expires_in" => 1}
	})

	%{"error" => error} = json_response_and_validate_schema(conn, 422)
	assert error == "Poll must contain at least 2 options"
	end
	end

	test "get a status" do
	%{conn: conn} = oauth_access(["read:statuses"])
	activity = insert(:note_activity)

	conn = get(conn, "/api/v1/statuses/#{activity.id}")

	assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
	assert id == to_string(activity.id)
	end

	defp local_and_remote_activities do
	local = insert(:note_activity)
	remote = insert(:note_activity, local: false)
	{:ok, local: local, remote: remote}
	end

	defp local_and_remote_context_activities do
	local_user_1 = insert(:user)
	local_user_2 = insert(:user)
	remote_user = insert(:user, local: false)

	{:ok, %{id: id1, data: %{"context" => context}}} =
	CommonAPI.post(local_user_1, %{status: "post"})

	{:ok, %{id: id2} = post} =
	CommonAPI.post(local_user_2, %{status: "local reply", in_reply_to_status_id: id1})

	params = %{
	"@context" => "https://www.w3.org/ns/activitystreams",
	"actor" => remote_user.ap_id,
	"type" => "Create",
	"context" => context,
	"id" => "#{remote_user.ap_id}/activities/1",
	"inReplyTo" => post.data["id"],
	"object" => %{
	"type" => "Note",
	"content" => "remote reply",
	"context" => context,
	"id" => "#{remote_user.ap_id}/objects/1",
	"attributedTo" => remote_user.ap_id,
	"to" => [
	local_user_1.ap_id,
	local_user_2.ap_id,
	"https://www.w3.org/ns/activitystreams#Public"
	]
	},
	"to" => [
	local_user_1.ap_id,
	local_user_2.ap_id,
	"https://www.w3.org/ns/activitystreams#Public"
	]
	}

	{:ok, job} = Pleroma.Web.Federator.incoming_ap_doc(params)
	{:ok, remote_activity} = ObanHelpers.perform(job)

	%{locals: [id1, id2], remote: remote_activity.id, context: context}
	end

	describe "status with restrict unauthenticated activities for local and remote" do
	setup do: local_and_remote_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :local], true)

	setup do: clear_config([:restrict_unauthenticated, :activities, :remote], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/statuses/#{local.id}")

	assert json_response_and_validate_schema(res_conn, :not_found) == %{
	"error" => "Record not found"
	}

	res_conn = get(conn, "/api/v1/statuses/#{remote.id}")

	assert json_response_and_validate_schema(res_conn, :not_found) == %{
	"error" => "Record not found"
	}
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{local.id}")
	assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

	res_conn = get(conn, "/api/v1/statuses/#{remote.id}")
	assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
	end
	end

	describe "status with restrict unauthenticated activities for local" do
	setup do: local_and_remote_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :local], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/statuses/#{local.id}")

	assert json_response_and_validate_schema(res_conn, :not_found) == %{
	"error" => "Record not found"
	}

	res_conn = get(conn, "/api/v1/statuses/#{remote.id}")
	assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{local.id}")
	assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

	res_conn = get(conn, "/api/v1/statuses/#{remote.id}")
	assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
	end
	end

	describe "status with restrict unauthenticated activities for remote" do
	setup do: local_and_remote_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :remote], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/statuses/#{local.id}")
	assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

	res_conn = get(conn, "/api/v1/statuses/#{remote.id}")

	assert json_response_and_validate_schema(res_conn, :not_found) == %{
	"error" => "Record not found"
	}
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{local.id}")
	assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

	res_conn = get(conn, "/api/v1/statuses/#{remote.id}")
	assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
	end
	end

	test "getting a status that doesn't exist returns 404" do
	%{conn: conn} = oauth_access(["read:statuses"])
	activity = insert(:note_activity)

	conn = get(conn, "/api/v1/statuses/#{String.downcase(activity.id)}")

	assert json_response_and_validate_schema(conn, 404) == %{"error" => "Record not found"}
	end

	test "get a direct status" do
	%{user: user, conn: conn} = oauth_access(["read:statuses"])
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "@#{other_user.nickname}", visibility: "direct"})

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/statuses/#{activity.id}")

	[participation] = Participation.for_user(user)

	res = json_response_and_validate_schema(conn, 200)
	assert res["pleroma"]["direct_conversation_id"] == participation.id
	end

	test "get statuses by IDs" do
	%{conn: conn} = oauth_access(["read:statuses"])
	%{id: id1} = insert(:note_activity)
	%{id: id2} = insert(:note_activity)

	query_string = "id[]=#{id1}&id[]=#{id2}"
	conn = get(conn, "/api/v1/statuses/?#{query_string}")

	assert [%{"id" => ^id1}, %{"id" => ^id2}] =
	Enum.sort_by(json_response_and_validate_schema(conn, :ok), & &1["id"])
	end

	test "get statuses by IDs falls back to ids[]" do
	%{conn: conn} = oauth_access(["read:statuses"])
	%{id: id} = insert(:note_activity)

	query_string = "ids[]=#{id}"
	conn = get(conn, "/api/v1/statuses/?#{query_string}")

	assert [%{"id" => ^id}] = json_response_and_validate_schema(conn, 200)
	end

	describe "getting statuses by ids with restricted unauthenticated for local and remote" do
	setup do: local_and_remote_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :local], true)

	setup do: clear_config([:restrict_unauthenticated, :activities, :remote], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/statuses?id[]=#{local.id}&id[]=#{remote.id}")

	assert json_response_and_validate_schema(res_conn, 200) == []
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/statuses?id[]=#{local.id}&id[]=#{remote.id}")

	assert length(json_response_and_validate_schema(res_conn, 200)) == 2
	end
	end

	describe "getting statuses by ids with restricted unauthenticated for local" do
	setup do: local_and_remote_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :local], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/statuses?id[]=#{local.id}&id[]=#{remote.id}")

	remote_id = remote.id
	assert [%{"id" => ^remote_id}] = json_response_and_validate_schema(res_conn, 200)
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/statuses?id[]=#{local.id}&id[]=#{remote.id}")

	assert length(json_response_and_validate_schema(res_conn, 200)) == 2
	end
	end

	describe "getting statuses by ids with restricted unauthenticated for remote" do
	setup do: local_and_remote_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :remote], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/statuses?id[]=#{local.id}&id[]=#{remote.id}")

	local_id = local.id
	assert [%{"id" => ^local_id}] = json_response_and_validate_schema(res_conn, 200)
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/statuses?id[]=#{local.id}&id[]=#{remote.id}")

	assert length(json_response_and_validate_schema(res_conn, 200)) == 2
	end
	end

	describe "getting status contexts restricted unauthenticated for local and remote" do
	setup do: local_and_remote_context_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :local], true)

	setup do: clear_config([:restrict_unauthenticated, :activities, :remote], true)

	test "if user is unauthenticated", %{conn: conn, locals: [post_id, _]} do
	res_conn = get(conn, "/api/v1/statuses/#{post_id}/context")

	assert json_response_and_validate_schema(res_conn, 200) == %{
	"ancestors" => [],
	"descendants" => []
	}
	end

	test "if user is unauthenticated reply", %{conn: conn, locals: [_, reply_id]} do
	res_conn = get(conn, "/api/v1/statuses/#{reply_id}/context")

	assert json_response_and_validate_schema(res_conn, 200) == %{
	"ancestors" => [],
	"descendants" => []
	}
	end

	test "if user is authenticated", %{locals: [post_id, reply_id], remote: remote_reply_id} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{post_id}/context")

	%{"ancestors" => [], "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert reply_id in descendant_ids
	assert remote_reply_id in descendant_ids
	end

	test "if user is authenticated reply", %{locals: [post_id, reply_id], remote: remote_reply_id} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{reply_id}/context")

	%{"ancestors" => ancestors, "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	ancestor_ids =
	ancestors
	\|> Enum.map(& &1["id"])

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert post_id in ancestor_ids
	assert remote_reply_id in descendant_ids
	end
	end

	describe "getting status contexts restricted unauthenticated for local" do
	setup do: local_and_remote_context_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :local], true)

	setup do: clear_config([:restrict_unauthenticated, :activities, :remote], false)

	test "if user is unauthenticated", %{
	conn: conn,
	locals: [post_id, reply_id],
	remote: remote_reply_id
	} do
	res_conn = get(conn, "/api/v1/statuses/#{post_id}/context")

	%{"ancestors" => [], "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert reply_id not in descendant_ids
	assert remote_reply_id in descendant_ids
	end

	test "if user is unauthenticated reply", %{
	conn: conn,
	locals: [post_id, reply_id],
	remote: remote_reply_id
	} do
	res_conn = get(conn, "/api/v1/statuses/#{reply_id}/context")

	%{"ancestors" => ancestors, "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	ancestor_ids =
	ancestors
	\|> Enum.map(& &1["id"])

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert post_id not in ancestor_ids
	assert remote_reply_id in descendant_ids
	end

	test "if user is authenticated", %{locals: [post_id, reply_id], remote: remote_reply_id} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{post_id}/context")

	%{"ancestors" => [], "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert reply_id in descendant_ids
	assert remote_reply_id in descendant_ids
	end

	test "if user is authenticated reply", %{locals: [post_id, reply_id], remote: remote_reply_id} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{reply_id}/context")

	%{"ancestors" => ancestors, "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	ancestor_ids =
	ancestors
	\|> Enum.map(& &1["id"])

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert post_id in ancestor_ids
	assert remote_reply_id in descendant_ids
	end
	end

	describe "getting status contexts restricted unauthenticated for remote" do
	setup do: local_and_remote_context_activities()

	setup do: clear_config([:restrict_unauthenticated, :activities, :local], false)

	setup do: clear_config([:restrict_unauthenticated, :activities, :remote], true)

	test "if user is unauthenticated", %{
	conn: conn,
	locals: [post_id, reply_id],
	remote: remote_reply_id
	} do
	res_conn = get(conn, "/api/v1/statuses/#{post_id}/context")

	%{"ancestors" => [], "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert reply_id in descendant_ids
	assert remote_reply_id not in descendant_ids
	end

	test "if user is unauthenticated reply", %{
	conn: conn,
	locals: [post_id, reply_id],
	remote: remote_reply_id
	} do
	res_conn = get(conn, "/api/v1/statuses/#{reply_id}/context")

	%{"ancestors" => ancestors, "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	ancestor_ids =
	ancestors
	\|> Enum.map(& &1["id"])

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert post_id in ancestor_ids
	assert remote_reply_id not in descendant_ids
	end

	test "if user is authenticated", %{locals: [post_id, reply_id], remote: remote_reply_id} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{post_id}/context")

	%{"ancestors" => [], "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	reply_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert reply_id in reply_ids
	assert remote_reply_id in reply_ids
	end

	test "if user is authenticated reply", %{locals: [post_id, reply_id], remote: remote_reply_id} do
	%{conn: conn} = oauth_access(["read"])
	res_conn = get(conn, "/api/v1/statuses/#{reply_id}/context")

	%{"ancestors" => ancestors, "descendants" => descendants} =
	json_response_and_validate_schema(res_conn, 200)

	ancestor_ids =
	ancestors
	\|> Enum.map(& &1["id"])

	descendant_ids =
	descendants
	\|> Enum.map(& &1["id"])

	assert post_id in ancestor_ids
	assert remote_reply_id in descendant_ids
	end
	end

	describe "deleting a status" do
	test "when you created it" do
	%{user: author, conn: conn} = oauth_access(["write:statuses"])
	activity = insert(:note_activity, user: author)
	object = Object.normalize(activity, fetch: false)

	content = object.data["content"]
	source = object.data["source"]

	result =
	conn
	\|> assign(:user, author)
	\|> delete("/api/v1/statuses/#{activity.id}")
	\|> json_response_and_validate_schema(200)

	assert match?(%{"content" => ^content, "text" => ^source}, result)

	refute Activity.get_by_id(activity.id)
	end

	test "when it doesn't exist" do
	%{user: author, conn: conn} = oauth_access(["write:statuses"])
	activity = insert(:note_activity, user: author)

	conn =
	conn
	\|> assign(:user, author)
	\|> delete("/api/v1/statuses/#{String.downcase(activity.id)}")

	assert %{"error" => "Record not found"} == json_response_and_validate_schema(conn, 404)
	end

	test "when you didn't create it" do
	%{conn: conn} = oauth_access(["write:statuses"])
	activity = insert(:note_activity)

	conn = delete(conn, "/api/v1/statuses/#{activity.id}")

	assert %{"error" => "Record not found"} == json_response_and_validate_schema(conn, 404)

	assert Activity.get_by_id(activity.id) == activity
	end

	test "when you're privileged to", %{conn: conn} do
	clear_config([:instance, :moderator_privileges], [:messages_delete])
	activity = insert(:note_activity)
	user = insert(:user, is_moderator: true)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:statuses"]))
	\|> delete("/api/v1/statuses/#{activity.id}")

	assert %{} = json_response_and_validate_schema(res_conn, 200)

	assert ModerationLog \|> Repo.one() \|> ModerationLog.get_log_entry_message() ==
	"@#{user.nickname} deleted status ##{activity.id}"

	refute Activity.get_by_id(activity.id)
	end

	test "when you're privileged and the user is banned", %{conn: conn} do
	clear_config([:instance, :moderator_privileges], [:messages_delete])
	posting_user = insert(:user, is_active: false)
	refute posting_user.is_active
	activity = insert(:note_activity, user: posting_user)
	user = insert(:user, is_moderator: true)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:statuses"]))
	\|> delete("/api/v1/statuses/#{activity.id}")

	assert %{} = json_response_and_validate_schema(res_conn, 200)

	assert ModerationLog \|> Repo.one() \|> ModerationLog.get_log_entry_message() ==
	"@#{user.nickname} deleted status ##{activity.id}"

	refute Activity.get_by_id(activity.id)
	end
	end

	describe "reblogging" do
	setup do: oauth_access(["write:statuses"])

	test "reblogs and returns the reblogged status", %{conn: conn} do
	activity = insert(:note_activity)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/reblog")

	assert %{
	"reblog" => %{"id" => id, "reblogged" => true, "reblogs_count" => 1},
	"reblogged" => true
	} = json_response_and_validate_schema(conn, 200)

	assert to_string(activity.id) == id
	end

	test "returns 404 if the reblogged status doesn't exist", %{conn: conn} do
	activity = insert(:note_activity)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{String.downcase(activity.id)}/reblog")

	assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn, 404)
	end

	test "reblogs privately and returns the reblogged status", %{conn: conn} do
	activity = insert(:note_activity)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post(
	"/api/v1/statuses/#{activity.id}/reblog",
	%{"visibility" => "private"}
	)

	assert %{
	"reblog" => %{"id" => id, "reblogged" => true, "reblogs_count" => 1},
	"reblogged" => true,
	"visibility" => "private"
	} = json_response_and_validate_schema(conn, 200)

	assert to_string(activity.id) == id
	end

	test "reblogged status for another user" do
	activity = insert(:note_activity)
	user1 = insert(:user)
	user2 = insert(:user)
	user3 = insert(:user)
	{:ok, _} = CommonAPI.favorite(activity.id, user2)
	{:ok, _bookmark} = Pleroma.Bookmark.create(user2.id, activity.id)
	{:ok, reblog_activity1} = CommonAPI.repeat(activity.id, user1)
	{:ok, _} = CommonAPI.repeat(activity.id, user2)

	conn_res =
	build_conn()
	\|> assign(:user, user3)
	\|> assign(:token, insert(:oauth_token, user: user3, scopes: ["read:statuses"]))
	\|> get("/api/v1/statuses/#{reblog_activity1.id}")

	assert %{
	"reblog" => %{"id" => _id, "reblogged" => false, "reblogs_count" => 2},
	"reblogged" => false,
	"favourited" => false,
	"bookmarked" => false
	} = json_response_and_validate_schema(conn_res, 200)

	conn_res =
	build_conn()
	\|> assign(:user, user2)
	\|> assign(:token, insert(:oauth_token, user: user2, scopes: ["read:statuses"]))
	\|> get("/api/v1/statuses/#{reblog_activity1.id}")

	assert %{
	"reblog" => %{"id" => id, "reblogged" => true, "reblogs_count" => 2},
	"reblogged" => true,
	"favourited" => true,
	"bookmarked" => true
	} = json_response_and_validate_schema(conn_res, 200)

	assert to_string(activity.id) == id
	end

	test "author can reblog own private status", %{conn: conn, user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "cofe", visibility: "private"})

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/reblog")

	assert %{
	"reblog" => %{"id" => id, "reblogged" => true, "reblogs_count" => 1},
	"reblogged" => true,
	"visibility" => "private"
	} = json_response_and_validate_schema(conn, 200)

	assert to_string(activity.id) == id
	end
	+
	+ test "cannot reblog private status of others (even if visible)", %{conn: conn, user: user} do
	+ followed = insert(:user, local: true)
	+
	+ {:ok, _, _, %{data: %{"state" => "accept"}}} = CommonAPI.follow(followed, user)
	+
	+ {:ok, activity} = CommonAPI.post(followed, %{status: "cofe", visibility: "private"})
	+
	+ assert Visibility.visible_for_user?(activity, user)
	+
	+ resp =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/reblog")
	+ \|> json_response_and_validate_schema(404)
	+
	+ assert match?(%{"error" => _}, resp)
	+ end
	end

	describe "unreblogging" do
	setup do: oauth_access(["write:statuses"])

	test "unreblogs and returns the unreblogged status", %{user: user, conn: conn} do
	activity = insert(:note_activity)

	{:ok, _} = CommonAPI.repeat(activity.id, user)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/unreblog")

	assert %{"id" => id, "reblogged" => false, "reblogs_count" => 0} =
	json_response_and_validate_schema(conn, 200)

	assert to_string(activity.id) == id
	end

	test "returns 404 error when activity does not exist", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/foo/unreblog")

	assert json_response_and_validate_schema(conn, 404) == %{"error" => "Record not found"}
	end
	+
	+ test "can't unreblog someone else's reblog", %{user: user, conn: conn} do
	+ activity = insert(:note_activity)
	+ other_user = insert(:user)
	+
	+ {:ok, %{id: reblog_id}} = CommonAPI.repeat(activity.id, other_user)
	+
	+ # unreblog by base post
	+ resp1 =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/unreblog")
	+ \|> json_response(400)
	+
	+ assert match?(%{"error" => _}, resp1)
	+
	+ # unreblog by reblog ID (reblog IDs are accepted by some APIs;
	+ # ensure it fails here one way or another)
	+ resp2 =
	+ build_conn()
	+ \|> assign(:user, user)
	+ \|> assign(:token, insert(:oauth_token, user: user, scopes: ["write", "read"]))
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{reblog_id}/unreblog")
	+ \|> json_response_and_validate_schema(404)
	+
	+ assert match?(%{"error" => _}, resp2)
	+ end
	end

	describe "favoriting" do
	setup do: oauth_access(["write:favourites"])

	test "favs a status and returns it", %{conn: conn} do
	activity = insert(:note_activity)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/favourite")

	assert %{"id" => id, "favourites_count" => 1, "favourited" => true} =
	json_response_and_validate_schema(conn, 200)

	assert to_string(activity.id) == id
	end

	test "favoriting twice will just return 200", %{conn: conn} do
	activity = insert(:note_activity)

	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/favourite")

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/favourite")
	\|> json_response_and_validate_schema(200)
	end

	- test "returns 404 error for a wrong id", %{conn: conn} do
	- conn =
	- conn
	- \|> put_req_header("content-type", "application/json")
	- \|> post("/api/v1/statuses/1/favourite")
	+ test "a status you cannot see fails", %{conn: conn} do
	+ stranger = insert(:user)

	- assert json_response_and_validate_schema(conn, 404) == %{"error" => "Record not found"}
	+ {:ok, activity} =
	+ CommonAPI.post(stranger, %{status: "it can eternal lie", visibility: "private"})
	+
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/favourite")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	+
	+ test "returns 404 error for a wrong id", %{conn: conn} do
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/1/favourite")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	end
	end

	describe "unfavoriting" do
	setup do: oauth_access(["write:favourites"])

	test "unfavorites a status and returns it", %{user: user, conn: conn} do
	activity = insert(:note_activity)

	{:ok, _} = CommonAPI.favorite(activity.id, user)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/unfavourite")

	assert %{"id" => id, "favourites_count" => 0, "favourited" => false} =
	json_response_and_validate_schema(conn, 200)

	assert to_string(activity.id) == id
	end

	+ test "can't unfavourite post that isn't visible to user" do
	+ user = insert(:user)
	+ %{conn: conn, user: stranger} = oauth_access(["write:favourites"])
	+ {:ok, activity} = CommonAPI.post(user, %{status: "invisible", visibility: "private"})
	+
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(activity, stranger)
	+
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/unfavourite")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	+
	+ test "can't unfavourite post that isn't favourited", %{conn: conn} do
	+ activity = insert(:note_activity)
	+
	+ # using base post ID
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/unfavourite")
	+ \|> json_response_and_validate_schema(400) == %{"error" => "Could not unfavorite"}
	+ end
	+
	+ test "can't unfavourite other user's favs", %{conn: conn} do
	+ activity = insert(:note_activity)
	+
	+ other = insert(:user)
	+ {:ok, _} = CommonAPI.favorite(activity.id, other)
	+
	+ # using base post ID
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/unfavourite")
	+ \|> json_response_and_validate_schema(400) == %{"error" => "Could not unfavorite"}
	+ end
	+
	+ test "can't unfavourite other user's favs using their activity", %{conn: conn} do
	+ activity = insert(:note_activity)
	+
	+ other = insert(:user)
	+ {:ok, fav_activity} = CommonAPI.favorite(activity.id, other)
	+ # some APIs (used to) take IDs of any activity type, make sure this fails one way or another
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{fav_activity.id}/unfavourite")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	+
	test "returns 404 error for a wrong id", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/1/unfavourite")

	assert json_response_and_validate_schema(conn, 404) == %{"error" => "Record not found"}
	end
	end

	+ test "can't favourite post that isn't visible to user" do
	+ user = insert(:user)
	+ %{conn: conn, user: stranger} = oauth_access(["write:favourites"])
	+ {:ok, activity} = CommonAPI.post(user, %{status: "invisible", visibility: "private"})
	+
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(activity, stranger)
	+
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/favourite")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	+
	describe "pinned statuses" do
	setup do: oauth_access(["write:accounts"])

	setup %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "HI!!!"})

	%{activity: activity}
	end

	setup do: clear_config([:instance, :max_pinned_statuses], 1)

	test "pin status", %{conn: conn, user: user, activity: activity} do
	id = activity.id

	assert %{"id" => ^id, "pinned" => true} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/pin")
	\|> json_response_and_validate_schema(200)

	assert [%{"id" => ^id, "pinned" => true}] =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
	\|> json_response_and_validate_schema(200)
	end

	test "non authenticated user", %{activity: activity} do
	assert build_conn()
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/pin")
	\|> json_response(403) == %{"error" => "Invalid credentials."}
	end

	- test "/pin: returns 400 error when activity is not public", %{conn: conn, user: user} do
	+ test "/pin: returns 422 error when activity is not public", %{conn: conn, user: user} do
	{:ok, dm} = CommonAPI.post(user, %{status: "test", visibility: "direct"})

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{dm.id}/pin")

	assert json_response_and_validate_schema(conn, 422) == %{
	"error" => "Non-public status cannot be pinned"
	}
	end

	+ test "/pin: returns 404 error when activity not visible to user", %{user: user} do
	+ %{conn: conn, user: stranger} = oauth_access(["write:accounts"])
	+ {:ok, activity} = CommonAPI.post(user, %{status: "invisible", visibility: "private"})
	+
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(activity, stranger)
	+
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/pin")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	+
	test "pin by another user", %{activity: activity} do
	%{conn: conn} = oauth_access(["write:accounts"])

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/pin")
	\|> json_response(422) == %{"error" => "Someone else's status cannot be pinned"}
	end

	test "unpin status", %{conn: conn, user: user, activity: activity} do
	{:ok, _} = CommonAPI.pin(activity.id, user)
	user = refresh_record(user)

	id_str = to_string(activity.id)

	assert %{"id" => ^id_str, "pinned" => false} =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/unpin")
	\|> json_response_and_validate_schema(200)

	assert [] =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
	\|> json_response_and_validate_schema(200)
	end

	test "/unpin: returns 404 error when activity doesn't exist", %{conn: conn} do
	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/1/unpin")
	\|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	end

	+ test "/unpin: returns 404 error when activity not visible to user", %{user: user} do
	+ %{conn: conn, user: stranger} = oauth_access(["write:accounts"])
	+ {:ok, activity} = CommonAPI.post(user, %{status: "yumi", visibility: "private"})
	+
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(activity, stranger)
	+
	+ assert conn
	+ \|> assign(:user, stranger)
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/unpin")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	+
	+ test "/unpin: returns 422 error when activity not owned by user", %{activity: activity} do
	+ %{conn: conn, user: user} = oauth_access(["write:accounts"])
	+
	+ assert Pleroma.Web.ActivityPub.Visibility.visible_for_user?(activity, user)
	+
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/unpin")
	+ \|> json_response_and_validate_schema(422) == %{
	+ "error" => "Someone else's status cannot be unpinned"
	+ }
	+ end
	+
	test "max pinned statuses", %{conn: conn, user: user, activity: activity_one} do
	{:ok, activity_two} = CommonAPI.post(user, %{status: "HI!!!"})

	id_str_one = to_string(activity_one.id)

	assert %{"id" => ^id_str_one, "pinned" => true} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{id_str_one}/pin")
	\|> json_response_and_validate_schema(200)

	user = refresh_record(user)

	assert %{"error" => "You have already pinned the maximum number of statuses"} =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity_two.id}/pin")
	\|> json_response_and_validate_schema(400)
	end

	test "on pin removes deletion job, on unpin reschedule deletion" do
	%{conn: conn} = oauth_access(["write:accounts", "write:statuses"])
	expires_in = 2 * 60 * 60

	expires_at = DateTime.add(DateTime.utc_now(), expires_in)

	assert %{"id" => id} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "oolong",
	"expires_in" => expires_in
	})
	\|> json_response_and_validate_schema(200)

	assert_enqueued(
	worker: Pleroma.Workers.PurgeExpiredActivity,
	args: %{activity_id: id},
	scheduled_at: expires_at
	)

	assert %{"id" => ^id, "pinned" => true} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{id}/pin")
	\|> json_response_and_validate_schema(200)

	refute_enqueued(
	worker: Pleroma.Workers.PurgeExpiredActivity,
	args: %{activity_id: id},
	scheduled_at: expires_at
	)

	assert %{"id" => ^id, "pinned" => false} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{id}/unpin")
	\|> json_response_and_validate_schema(200)

	assert_enqueued(
	worker: Pleroma.Workers.PurgeExpiredActivity,
	args: %{activity_id: id},
	scheduled_at: expires_at
	)
	end
	end

	test "bookmarks" do
	bookmarks_uri = "/api/v1/bookmarks"

	%{conn: conn} = oauth_access(["write:bookmarks", "read:bookmarks"])
	author = insert(:user)

	{:ok, activity1} = CommonAPI.post(author, %{status: "heweoo?"})
	{:ok, activity2} = CommonAPI.post(author, %{status: "heweoo!"})

	response1 =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity1.id}/bookmark")

	assert json_response_and_validate_schema(response1, 200)["bookmarked"] == true

	response2 =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity2.id}/bookmark")

	assert json_response_and_validate_schema(response2, 200)["bookmarked"] == true

	bookmarks = get(conn, bookmarks_uri)

	assert [
	json_response_and_validate_schema(response2, 200),
	json_response_and_validate_schema(response1, 200)
	] ==
	json_response_and_validate_schema(bookmarks, 200)

	response1 =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity1.id}/unbookmark")

	assert json_response_and_validate_schema(response1, 200)["bookmarked"] == false

	bookmarks = get(conn, bookmarks_uri)

	assert [json_response_and_validate_schema(response2, 200)] ==
	json_response_and_validate_schema(bookmarks, 200)
	end

	+ test "cannot bookmark invisible post" do
	+ user = insert(:user)
	+ %{conn: conn, user: stranger} = oauth_access(["write:bookmarks"])
	+ {:ok, activity} = CommonAPI.post(user, %{status: "mocha", visibility: "private"})
	+
	+ refute Pleroma.Web.ActivityPub.Visibility.visible_for_user?(activity, stranger)
	+
	+ resp1 =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/bookmark")
	+
	+ assert json_response_and_validate_schema(resp1, 404) == %{"error" => "Record not found"}
	+
	+ resp2 =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/unbookmark")
	+
	+ assert json_response_and_validate_schema(resp2, 404) == %{"error" => "Record not found"}
	+ end
	+
	test "bookmark folders" do
	%{conn: conn, user: user} = oauth_access(["write:bookmarks", "read:bookmarks"])

	{:ok, folder} = Pleroma.BookmarkFolder.create(user.id, "folder")
	author = insert(:user)

	folder_bookmarks_uri = "/api/v1/bookmarks?folder_id=#{folder.id}"

	{:ok, activity1} = CommonAPI.post(author, %{status: "heweoo?"})
	{:ok, activity2} = CommonAPI.post(author, %{status: "heweoo!"})

	# Add bookmark with a folder
	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity1.id}/bookmark", %{folder_id: folder.id})

	assert json_response_and_validate_schema(response, 200)["bookmarked"] == true

	assert json_response_and_validate_schema(response, 200)["pleroma"]["bookmark_folder"] ==
	folder.id

	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity2.id}/bookmark")

	assert json_response_and_validate_schema(response, 200)["bookmarked"] == true
	assert json_response_and_validate_schema(response, 200)["pleroma"]["bookmark_folder"] == nil

	bookmarks =
	get(conn, folder_bookmarks_uri)
	\|> json_response_and_validate_schema(200)

	assert length(bookmarks) == 1

	# Update folder for existing bookmark
	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity2.id}/bookmark", %{folder_id: folder.id})

	assert json_response_and_validate_schema(response, 200)["bookmarked"] == true

	assert json_response_and_validate_schema(response, 200)["pleroma"]["bookmark_folder"] ==
	folder.id

	bookmarks =
	get(conn, folder_bookmarks_uri)
	\|> json_response_and_validate_schema(200)

	assert length(bookmarks) == 2
	end

	describe "conversation muting" do
	setup do: oauth_access(["write:mutes"])

	setup do
	post_user = insert(:user)
	{:ok, activity} = CommonAPI.post(post_user, %{status: "HIE"})
	%{activity: activity}
	end

	test "mute conversation", %{conn: conn, activity: activity} do
	id_str = to_string(activity.id)

	assert %{"id" => ^id_str, "muted" => true} =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/mute")
	\|> json_response_and_validate_schema(200)
	end

	test "cannot mute already muted conversation", %{conn: conn, user: user, activity: activity} do
	{:ok, _} = CommonAPI.add_mute(activity, user)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/mute")

	assert json_response_and_validate_schema(conn, 400) == %{
	"error" => "conversation is already muted"
	}
	end

	test "unmute conversation", %{conn: conn, user: user, activity: activity} do
	{:ok, _} = CommonAPI.add_mute(activity, user)

	id_str = to_string(activity.id)

	assert %{"id" => ^id_str, "muted" => false} =
	conn
	# \|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/unmute")
	\|> json_response_and_validate_schema(200)
	end
	+
	+ test "cannot mute not visible conversation", %{user: user} do
	+ {:ok, activity} = CommonAPI.post(user, %{status: "Invisible!", visibility: "private"})
	+ %{conn: conn} = oauth_access(["write:mutes"])
	+
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/mute")
	+ \|> json_response_and_validate_schema(404) == %{
	+ "error" => "Record not found"
	+ }
	+ end
	+
	+ test "cannot unmute not visible conversation", %{user: user} do
	+ {:ok, activity} = CommonAPI.post(user, %{status: "Invisible!", visibility: "private"})
	+ %{conn: conn} = oauth_access(["write:mutes"])
	+
	+ assert conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/statuses/#{activity.id}/unmute")
	+ \|> json_response_and_validate_schema(404) == %{
	+ "error" => "Record not found"
	+ }
	+ end
	end

	test "Repeated posts that are replies incorrectly have in_reply_to_id null", %{conn: conn} do
	user1 = insert(:user)
	user2 = insert(:user)
	user3 = insert(:user)

	{:ok, replied_to} = CommonAPI.post(user1, %{status: "cofe"})

	# Reply to status from another user
	conn1 =
	conn
	\|> assign(:user, user2)
	\|> assign(:token, insert(:oauth_token, user: user2, scopes: ["write:statuses"]))
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{"status" => "xD", "in_reply_to_id" => replied_to.id})

	assert %{"content" => "xD", "id" => id} = json_response_and_validate_schema(conn1, 200)

	activity = Activity.get_by_id_with_object(id)

	assert Object.normalize(activity, fetch: false).data["inReplyTo"] ==
	Object.normalize(replied_to, fetch: false).data["id"]

	assert Activity.get_in_reply_to_activity(activity).id == replied_to.id

	# Reblog from the third user
	conn2 =
	conn
	\|> assign(:user, user3)
	\|> assign(:token, insert(:oauth_token, user: user3, scopes: ["write:statuses"]))
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses/#{activity.id}/reblog")

	assert %{"reblog" => %{"id" => id, "reblogged" => true, "reblogs_count" => 1}} =
	json_response_and_validate_schema(conn2, 200)

	assert to_string(activity.id) == id

	# Getting third user status
	conn3 =
	conn
	\|> assign(:user, user3)
	\|> assign(:token, insert(:oauth_token, user: user3, scopes: ["read:statuses"]))
	\|> get("/api/v1/timelines/home")

	[reblogged_activity] = json_response_and_validate_schema(conn3, 200)

	assert reblogged_activity["reblog"]["in_reply_to_id"] == replied_to.id

	replied_to_user = User.get_by_ap_id(replied_to.data["actor"])
	assert reblogged_activity["reblog"]["in_reply_to_account_id"] == replied_to_user.id
	end

	describe "GET /api/v1/statuses/:id/favourited_by" do
	setup do: oauth_access(["read:accounts"])

	setup %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "test"})

	%{activity: activity}
	end

	test "returns users who have favorited the status ordered from newest to oldest", %{
	conn: conn,
	activity: activity
	} do
	[other_user_1, other_user_2] = insert_pair(:user)
	[other_user_3, other_user_4] = insert_pair(:user)

	{:ok, _} = CommonAPI.favorite(activity.id, other_user_1)
	{:ok, _} = CommonAPI.favorite(activity.id, other_user_3)
	{:ok, _} = CommonAPI.favorite(activity.id, other_user_2)
	{:ok, _} = CommonAPI.favorite(activity.id, other_user_4)

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/favourited_by")
	\|> json_response_and_validate_schema(:ok)

	[%{"id" => id1}, %{"id" => id2}, %{"id" => id3}, %{"id" => id4}] = response

	assert id1 == other_user_4.id
	assert id2 == other_user_2.id
	assert id3 == other_user_3.id
	assert id4 == other_user_1.id
	end

	test "returns empty array when status has not been favorited yet", %{
	conn: conn,
	activity: activity
	} do
	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/favourited_by")
	\|> json_response_and_validate_schema(:ok)

	assert Enum.empty?(response)
	end

	test "does not return users who have favorited the status but are blocked", %{
	conn: %{assigns: %{user: user}} = conn,
	activity: activity
	} do
	other_user = insert(:user)
	{:ok, _user_relationship} = User.block(user, other_user)

	{:ok, _} = CommonAPI.favorite(activity.id, other_user)

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/favourited_by")
	\|> json_response_and_validate_schema(:ok)

	assert Enum.empty?(response)
	end

	test "does not fail on an unauthenticated request", %{activity: activity} do
	other_user = insert(:user)
	{:ok, _} = CommonAPI.favorite(activity.id, other_user)

	response =
	build_conn()
	\|> get("/api/v1/statuses/#{activity.id}/favourited_by")
	\|> json_response_and_validate_schema(:ok)

	[%{"id" => id}] = response
	assert id == other_user.id
	end

	test "requires authentication for private posts", %{user: user} do
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "@#{other_user.nickname} wanna get some #cofe together?",
	visibility: "direct"
	})

	{:ok, _} = CommonAPI.favorite(activity.id, other_user)

	favourited_by_url = "/api/v1/statuses/#{activity.id}/favourited_by"

	build_conn()
	\|> get(favourited_by_url)
	\|> json_response_and_validate_schema(404)

	conn =
	build_conn()
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))

	conn
	\|> assign(:token, nil)
	\|> get(favourited_by_url)
	\|> json_response_and_validate_schema(404)

	response =
	conn
	\|> get(favourited_by_url)
	\|> json_response_and_validate_schema(200)

	[%{"id" => id}] = response
	assert id == other_user.id
	end

	+ test "fails when base post not visible to current user", %{user: user} do
	+ other_user = insert(:user, local: true)
	+ %{conn: conn} = oauth_access(["read:accounts"])
	+
	+ {:ok, activity} =
	+ CommonAPI.post(user, %{
	+ status: "craving tea and mochi rn",
	+ visibility: "private"
	+ })
	+
	+ assert conn
	+ \|> assign(:user, other_user)
	+ \|> get("/api/v1/statuses/#{activity.id}/favourited_by")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	+
	test "returns empty array when :show_reactions is disabled", %{conn: conn, activity: activity} do
	clear_config([:instance, :show_reactions], false)

	other_user = insert(:user)
	{:ok, _} = CommonAPI.favorite(activity.id, other_user)

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/favourited_by")
	\|> json_response_and_validate_schema(:ok)

	assert Enum.empty?(response)
	end
	end

	describe "GET /api/v1/statuses/:id/reblogged_by" do
	setup do: oauth_access(["read:accounts"])

	setup %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "test"})

	%{activity: activity}
	end

	test "returns users who have reblogged the status", %{conn: conn, activity: activity} do
	other_user = insert(:user)
	{:ok, _} = CommonAPI.repeat(activity.id, other_user)

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/reblogged_by")
	\|> json_response_and_validate_schema(:ok)

	[%{"id" => id}] = response

	assert id == other_user.id
	end

	test "returns empty array when status has not been reblogged yet", %{
	conn: conn,
	activity: activity
	} do
	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/reblogged_by")
	\|> json_response_and_validate_schema(:ok)

	assert Enum.empty?(response)
	end

	test "does not return users who have reblogged the status but are blocked", %{
	conn: %{assigns: %{user: user}} = conn,
	activity: activity
	} do
	other_user = insert(:user)
	{:ok, _user_relationship} = User.block(user, other_user)

	{:ok, _} = CommonAPI.repeat(activity.id, other_user)

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/reblogged_by")
	\|> json_response_and_validate_schema(:ok)

	assert Enum.empty?(response)
	end

	test "does not return users who have reblogged the status privately", %{
	conn: conn
	} do
	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(other_user, %{status: "my secret post"})

	{:ok, _} = CommonAPI.repeat(activity.id, other_user, %{visibility: "private"})

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/reblogged_by")
	\|> json_response_and_validate_schema(:ok)

	assert Enum.empty?(response)
	end

	test "does not fail on an unauthenticated request", %{activity: activity} do
	other_user = insert(:user)
	{:ok, _} = CommonAPI.repeat(activity.id, other_user)

	response =
	build_conn()
	\|> get("/api/v1/statuses/#{activity.id}/reblogged_by")
	\|> json_response_and_validate_schema(:ok)

	[%{"id" => id}] = response
	assert id == other_user.id
	end

	test "requires authentication for private posts", %{user: user} do
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "@#{other_user.nickname} wanna get some #cofe together?",
	visibility: "direct"
	})

	build_conn()
	\|> get("/api/v1/statuses/#{activity.id}/reblogged_by")
	\|> json_response_and_validate_schema(404)

	response =
	build_conn()
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
	\|> get("/api/v1/statuses/#{activity.id}/reblogged_by")
	\|> json_response_and_validate_schema(200)

	assert [] == response
	end
	+
	+ test "does fail when requesting for a non-visible status", %{user: user} do
	+ other_user = insert(:user, local: true)
	+
	+ {:ok, activity} =
	+ CommonAPI.post(user, %{
	+ status: "deep below it sleeps and mustn't wake",
	+ visibility: "private"
	+ })
	+
	+ response =
	+ build_conn()
	+ \|> assign(:user, other_user)
	+ \|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read"]))
	+ \|> get("/api/v1/statuses/#{activity.id}/reblogged_by")
	+ \|> json_response_and_validate_schema(404)
	+
	+ assert match?(%{"error" => _}, response)
	+ end
	end

	test "context" do
	user = insert(:user)

	{:ok, %{id: id1}} = CommonAPI.post(user, %{status: "1"})
	{:ok, %{id: id2}} = CommonAPI.post(user, %{status: "2", in_reply_to_status_id: id1})
	{:ok, %{id: id3}} = CommonAPI.post(user, %{status: "3", in_reply_to_status_id: id2})
	{:ok, %{id: id4}} = CommonAPI.post(user, %{status: "4", in_reply_to_status_id: id3})
	{:ok, %{id: id5}} = CommonAPI.post(user, %{status: "5", in_reply_to_status_id: id4})

	response =
	build_conn()
	\|> get("/api/v1/statuses/#{id3}/context")
	\|> json_response_and_validate_schema(:ok)

	assert %{
	"ancestors" => [%{"id" => ^id1}, %{"id" => ^id2}],
	"descendants" => [%{"id" => ^id4}, %{"id" => ^id5}]
	} = response
	end

	+ test "context doesn't leak priv posts" do
	+ %{user: user, conn: conn} = oauth_access(["read:statuses"])
	+ stranger = insert(:user)
	+
	+ {:ok, %{id: id1}} = CommonAPI.post(stranger, %{status: "1", visibility: "public"})
	+
	+ {:ok, %{id: id2}} =
	+ CommonAPI.post(stranger, %{status: "2", visibility: "unlisted", in_reply_to_status_id: id1})
	+
	+ {:ok, %{id: _id_boo} = act_boo} =
	+ CommonAPI.post(stranger, %{status: "boo", visibility: "private", in_reply_to_status_id: id1})
	+
	+ refute Visibility.visible_for_user?(act_boo, user)
	+
	+ response =
	+ conn
	+ \|> get("/api/v1/statuses/#{id1}/context")
	+ \|> json_response_and_validate_schema(:ok)
	+
	+ assert match?(
	+ %{
	+ "ancestors" => [],
	+ "descendants" => [%{"id" => ^id2}]
	+ },
	+ response
	+ )
	+ end
	+
	test "favorites paginate correctly" do
	%{user: user, conn: conn} = oauth_access(["read:favourites"])
	other_user = insert(:user)
	{:ok, first_post} = CommonAPI.post(other_user, %{status: "bla"})
	{:ok, second_post} = CommonAPI.post(other_user, %{status: "bla"})
	{:ok, third_post} = CommonAPI.post(other_user, %{status: "bla"})

	{:ok, _first_favorite} = CommonAPI.favorite(third_post.id, user)
	{:ok, _second_favorite} = CommonAPI.favorite(first_post.id, user)
	{:ok, third_favorite} = CommonAPI.favorite(second_post.id, user)

	result =
	conn
	\|> get("/api/v1/favourites?limit=1")

	assert [%{"id" => post_id}] = json_response_and_validate_schema(result, 200)
	assert post_id == second_post.id

	# Using the header for pagination works correctly
	[next, _] = get_resp_header(result, "link") \|> hd() \|> String.split(", ")
	[next_url, _next_rel] = String.split(next, ";")
	next_url = String.trim_trailing(next_url, ">") \|> String.trim_leading("<")

	max_id = Helpers.get_query_parameter(next_url, "max_id")

	assert max_id == third_favorite.id

	result =
	conn
	\|> get("/api/v1/favourites?max_id=#{max_id}")

	assert [%{"id" => first_post_id}, %{"id" => third_post_id}] =
	json_response_and_validate_schema(result, 200)

	assert first_post_id == first_post.id
	assert third_post_id == third_post.id
	end

	test "returns the favorites of a user" do
	%{user: user, conn: conn} = oauth_access(["read:favourites"])
	other_user = insert(:user)

	{:ok, _} = CommonAPI.post(other_user, %{status: "bla"})
	{:ok, activity} = CommonAPI.post(other_user, %{status: "trees are happy"})

	{:ok, last_like} = CommonAPI.favorite(activity.id, user)

	first_conn = get(conn, "/api/v1/favourites")

	assert [status] = json_response_and_validate_schema(first_conn, 200)
	assert status["id"] == to_string(activity.id)

	assert [{"link", _link_header}] =
	Enum.filter(first_conn.resp_headers, fn element -> match?({"link", _}, element) end)

	# Honours query params
	{:ok, second_activity} =
	CommonAPI.post(other_user, %{
	status: "Trees Are Never Sad Look At Them Every Once In Awhile They're Quite Beautiful."
	})

	{:ok, _} = CommonAPI.favorite(second_activity.id, user)

	second_conn = get(conn, "/api/v1/favourites?since_id=#{last_like.id}")

	assert [second_status] = json_response_and_validate_schema(second_conn, 200)
	assert second_status["id"] == to_string(second_activity.id)

	third_conn = get(conn, "/api/v1/favourites?limit=0")

	assert [] = json_response_and_validate_schema(third_conn, 200)
	end

	test "expires_at is nil for another user" do
	%{conn: conn, user: user} = oauth_access(["read:statuses"])
	expires_at = DateTime.add(DateTime.utc_now(), 1_000_000)
	{:ok, activity} = CommonAPI.post(user, %{status: "foobar", expires_in: 1_000_000})

	assert %{"pleroma" => %{"expires_at" => a_expires_at}} =
	conn
	\|> get("/api/v1/statuses/#{activity.id}")
	\|> json_response_and_validate_schema(:ok)

	{:ok, a_expires_at, 0} = DateTime.from_iso8601(a_expires_at)
	assert DateTime.diff(expires_at, a_expires_at) == 0

	%{conn: conn} = oauth_access(["read:statuses"])

	assert %{"pleroma" => %{"expires_at" => nil}} =
	conn
	\|> get("/api/v1/statuses/#{activity.id}")
	\|> json_response_and_validate_schema(:ok)
	end

	describe "local-only statuses" do
	test "posting a local only status" do
	%{user: _user, conn: conn} = oauth_access(["write:statuses"])

	conn_one =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/statuses", %{
	"status" => "cofe",
	"visibility" => "local"
	})

	local = Utils.as_local_public()

	assert %{"content" => "cofe", "id" => id, "visibility" => "local"} =
	json_response_and_validate_schema(conn_one, 200)

	assert %Activity{id: ^id, data: %{"to" => [^local]}} = Activity.get_by_id(id)
	end

	test "other users can read local-only posts" do
	user = insert(:user)
	%{user: _reader, conn: conn} = oauth_access(["read:statuses"])

	{:ok, activity} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})

	received =
	conn
	\|> get("/api/v1/statuses/#{activity.id}")
	\|> json_response_and_validate_schema(:ok)

	assert received["id"] == activity.id
	end

	test "anonymous users cannot see local-only posts" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})

	_received =
	build_conn()
	\|> get("/api/v1/statuses/#{activity.id}")
	\|> json_response_and_validate_schema(:not_found)
	end
	end

	describe "muted reactions" do
	test "index" do
	%{conn: conn, user: user} = oauth_access(["read:statuses"])

	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "test"})

	{:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
	User.mute(user, other_user)

	result =
	conn
	\|> get("/api/v1/statuses/?id[]=#{activity.id}")
	\|> json_response_and_validate_schema(200)

	assert [
	%{
	"pleroma" => %{
	"emoji_reactions" => []
	}
	}
	] = result

	result =
	conn
	\|> get("/api/v1/statuses/?id[]=#{activity.id}&with_muted=true")
	\|> json_response_and_validate_schema(200)

	assert [
	%{
	"pleroma" => %{
	"emoji_reactions" => [%{"count" => 1, "me" => false, "name" => "🎅"}]
	}
	}
	] = result
	end

	test "show" do
	# %{conn: conn, user: user, token: token} = oauth_access(["read:statuses"])
	%{conn: conn, user: user, token: _token} = oauth_access(["read:statuses"])

	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "test"})

	{:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
	User.mute(user, other_user)

	result =
	conn
	\|> get("/api/v1/statuses/#{activity.id}")
	\|> json_response_and_validate_schema(200)

	assert %{
	"pleroma" => %{
	"emoji_reactions" => []
	}
	} = result

	result =
	conn
	\|> get("/api/v1/statuses/#{activity.id}?with_muted=true")
	\|> json_response_and_validate_schema(200)

	assert %{
	"pleroma" => %{
	"emoji_reactions" => [%{"count" => 1, "me" => false, "name" => "🎅"}]
	}
	} = result
	end
	end

	describe "get status history" do
	setup do
	%{conn: build_conn()}
	end

	test "unedited post", %{conn: conn} do
	activity = insert(:note_activity)

	conn = get(conn, "/api/v1/statuses/#{activity.id}/history")

	assert [_] = json_response_and_validate_schema(conn, 200)
	end

	test "edited post", %{conn: conn} do
	note =
	insert(
	:note,
	data: %{
	"formerRepresentations" => %{
	"type" => "OrderedCollection",
	"orderedItems" => [
	%{
	"type" => "Note",
	"content" => "mew mew 2",
	"summary" => "title 2"
	},
	%{
	"type" => "Note",
	"content" => "mew mew 1",
	"summary" => "title 1"
	}
	],
	"totalItems" => 2
	}
	}
	)

	activity = insert(:note_activity, note: note)

	conn = get(conn, "/api/v1/statuses/#{activity.id}/history")

	assert [%{"spoiler_text" => "title 1"}, %{"spoiler_text" => "title 2"}, _] =
	json_response_and_validate_schema(conn, 200)
	end
	end

	describe "get status source" do
	setup do
	%{conn: build_conn()}
	end

	test "it returns the source", %{conn: conn} do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "mew mew #abc", spoiler_text: "#def"})

	conn = get(conn, "/api/v1/statuses/#{activity.id}/source")

	id = activity.id

	assert %{"id" => ^id, "text" => "mew mew #abc", "spoiler_text" => "#def"} =
	json_response_and_validate_schema(conn, 200)
	end
	end

	describe "update status" do
	setup do
	oauth_access(["write:statuses"])
	end

	test "it updates the status" do
	%{conn: conn, user: user} = oauth_access(["write:statuses", "read:statuses"])

	{:ok, activity} = CommonAPI.post(user, %{status: "mew mew #abc", spoiler_text: "#def"})

	conn
	\|> get("/api/v1/statuses/#{activity.id}")
	\|> json_response_and_validate_schema(200)

	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> put("/api/v1/statuses/#{activity.id}", %{
	"status" => "edited",
	"spoiler_text" => "lol"
	})
	\|> json_response_and_validate_schema(200)

	assert response["content"] == "edited"
	assert response["spoiler_text"] == "lol"

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}")
	\|> json_response_and_validate_schema(200)

	assert response["content"] == "edited"
	assert response["spoiler_text"] == "lol"
	end

	test "it updates the attachments", %{conn: conn, user: user} do
	attachment = insert(:attachment, user: user)
	attachment_id = to_string(attachment.id)

	{:ok, activity} = CommonAPI.post(user, %{status: "mew mew #abc", spoiler_text: "#def"})

	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> put("/api/v1/statuses/#{activity.id}", %{
	"status" => "mew mew #abc",
	"spoiler_text" => "#def",
	"media_ids" => [attachment_id]
	})
	\|> json_response_and_validate_schema(200)

	assert [%{"id" => ^attachment_id}] = response["media_attachments"]
	end

	test "it does not update visibility", %{conn: conn, user: user} do
	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "mew mew #abc",
	spoiler_text: "#def",
	visibility: "private"
	})

	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> put("/api/v1/statuses/#{activity.id}", %{
	"status" => "edited",
	"spoiler_text" => "lol"
	})
	\|> json_response_and_validate_schema(200)

	assert response["visibility"] == "private"
	end

	test "it refuses to update when original post is not by the user", %{conn: conn} do
	another_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(another_user, %{status: "mew mew #abc", spoiler_text: "#def"})

	conn
	\|> put_req_header("content-type", "application/json")
	\|> put("/api/v1/statuses/#{activity.id}", %{
	"status" => "edited",
	"spoiler_text" => "lol"
	})
	\|> json_response_and_validate_schema(:forbidden)
	end

	test "it returns 404 if the user cannot see the post", %{conn: conn} do
	another_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(another_user, %{
	status: "mew mew #abc",
	spoiler_text: "#def",
	visibility: "private"
	})

	conn
	\|> put_req_header("content-type", "application/json")
	\|> put("/api/v1/statuses/#{activity.id}", %{
	"status" => "edited",
	"spoiler_text" => "lol"
	})
	\|> json_response_and_validate_schema(:not_found)
	end
	end

	describe "translating statuses" do
	setup do: clear_config([Pleroma.Language.Translation, :provider], TranslationMock)

	test "it translates a status to user language" do
	user = insert(:user, language: "fr")
	%{conn: conn} = oauth_access(["read:statuses"], user: user)
	another_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(another_user, %{
	status: "Cześć!",
	visibility: "public",
	language: "pl"
	})

	response =
	conn
	\|> post("/api/v1/statuses/#{activity.id}/translate")
	\|> json_response_and_validate_schema(200)

	assert response == %{
	"content" => "!ćśezC",
	"detected_source_language" => "pl",
	"provider" => "TranslationMock"
	}
	end

	test "it returns an error if no target language provided" do
	%{conn: conn} = oauth_access(["read:statuses"])
	another_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(another_user, %{
	status: "Cześć!",
	language: "pl"
	})

	assert conn
	\|> post("/api/v1/statuses/#{activity.id}/translate")
	\|> json_response_and_validate_schema(400)
	end

	test "it doesn't translate non-public statuses" do
	%{conn: conn, user: user} = oauth_access(["read:statuses"])

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "Cześć!",
	visibility: "private",
	language: "pl"
	})

	assert conn
	\|> post("/api/v1/statuses/#{activity.id}/translate")
	\|> json_response_and_validate_schema(404)
	end
	end

	describe "getting quotes of a specified post" do
	setup do
	[current_user, user] = insert_pair(:user)
	%{user: current_user, conn: conn} = oauth_access(["read:statuses"], user: current_user)
	[current_user: current_user, user: user, conn: conn]
	end

	test "shows quotes of a post", %{conn: conn} do
	user = insert(:user)
	activity = insert(:note_activity)

	{:ok, quote_post} = CommonAPI.post(user, %{status: "quoat", quote_id: activity.id})

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/quotes")
	\|> json_response_and_validate_schema(:ok)

	[status] = response

	assert length(response) == 1
	assert status["id"] == quote_post.id
	end

	test "returns 404 error when a post can't be seen", %{conn: conn} do
	activity = insert(:direct_note_activity)

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/quotes")

	assert json_response_and_validate_schema(response, 404) == %{"error" => "Record not found"}
	end

	test "returns 404 error when a post does not exist", %{conn: conn} do
	response =
	conn
	\|> get("/api/v1/statuses/idontexist/quotes")

	assert json_response_and_validate_schema(response, 404) == %{"error" => "Record not found"}
	end
	end
	end
	diff --git a/test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs b/test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs
	index c1e452a1e..79b805aca 100644
	--- a/test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs
	+++ b/test/pleroma/web/pleroma_api/controllers/emoji_reaction_controller_test.exs
	@@ -1,375 +1,480 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.EmojiReactionControllerTest do
	use Oban.Testing, repo: Pleroma.Repo
	use Pleroma.Web.ConnCase

	alias Pleroma.Object
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User
	+ alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI

	import Pleroma.Factory

	+ defp prepare_reacted_post(visibility \\ "private") do
	+ unrelated_user = insert(:user, local: true)
	+ poster = insert(:user, local: true)
	+ follower = insert(:user, local: true)
	+ {:ok, _, _, %{data: %{"state" => "accept"}}} = CommonAPI.follow(poster, follower)
	+
	+ {:ok, post_activity} = CommonAPI.post(poster, %{status: "miaow!", visibility: visibility})
	+
	+ if visibility != "direct" do
	+ assert Visibility.visible_for_user?(post_activity, follower)
	+ end
	+
	+ if visibility in ["direct", "private"] do
	+ refute Visibility.visible_for_user?(post_activity, unrelated_user)
	+ end
	+
	+ {:ok, _react_activity} = CommonAPI.react_with_emoji(post_activity.id, follower, "🐾")
	+
	+ {post_activity, poster, follower, unrelated_user}
	+ end
	+
	+ defp prepare_conn_of_user(conn, user) do
	+ conn
	+ \|> assign(:user, user)
	+ \|> assign(:token, insert(:oauth_token, user: user, scopes: ["write", "read"]))
	+ end
	+
	setup do
	Mox.stub_with(Pleroma.UnstubbedConfigMock, Pleroma.Test.StaticConfig)
	:ok
	end

	test "PUT /api/v1/pleroma/statuses/:id/reactions/:emoji", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	note = insert(:note, user: user, data: %{"reactions" => [["👍", [other_user.ap_id], nil]]})
	activity = insert(:note_activity, note: note, user: user)

	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> put("/api/v1/pleroma/statuses/#{activity.id}/reactions/\u26A0")
	\|> json_response_and_validate_schema(200)

	assert %{"id" => id} = result
	assert to_string(activity.id) == id

	assert result["pleroma"]["emoji_reactions"] == [
	%{
	"name" => "👍",
	"count" => 1,
	"me" => true,
	"url" => nil,
	"account_ids" => [other_user.id]
	},
	%{
	"name" => "\u26A0\uFE0F",
	"count" => 1,
	"me" => true,
	"url" => nil,
	"account_ids" => [other_user.id]
	}
	]

	{:ok, activity} = CommonAPI.post(user, %{status: "#cofe"})

	ObanHelpers.perform_all()

	# Reacting with a custom emoji
	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> put("/api/v1/pleroma/statuses/#{activity.id}/reactions/:dinosaur:")
	\|> json_response_and_validate_schema(200)

	assert %{"id" => id} = result
	assert to_string(activity.id) == id

	assert result["pleroma"]["emoji_reactions"] == [
	%{
	"name" => "dinosaur",
	"count" => 1,
	"me" => true,
	"url" => "http://localhost:4001/emoji/dino walking.gif",
	"account_ids" => [other_user.id]
	}
	]

	# Reacting with a remote emoji
	note =
	insert(:note,
	user: user,
	data: %{
	"reactions" => [
	["👍", [other_user.ap_id], nil],
	["wow", [other_user.ap_id], "https://remote/emoji/wow"]
	]
	}
	)

	activity = insert(:note_activity, note: note, user: user)

	result =
	conn
	\|> assign(:user, user)
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:statuses"]))
	\|> put("/api/v1/pleroma/statuses/#{activity.id}/reactions/:wow@remote:")
	\|> json_response(200)

	assert result["pleroma"]["emoji_reactions"] == [
	%{
	"account_ids" => [other_user.id],
	"count" => 1,
	"me" => false,
	"name" => "👍",
	"url" => nil
	},
	%{
	"name" => "wow@remote",
	"count" => 2,
	"me" => true,
	"url" => "https://remote/emoji/wow",
	"account_ids" => [user.id, other_user.id]
	}
	]

	# Reacting with a remote custom emoji that hasn't been reacted with yet
	note =
	insert(:note,
	user: user
	)

	activity = insert(:note_activity, note: note, user: user)

	assert conn
	\|> assign(:user, user)
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:statuses"]))
	\|> put("/api/v1/pleroma/statuses/#{activity.id}/reactions/:wow@remote:")
	\|> json_response(400)

	# Reacting with a non-emoji
	assert conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> put("/api/v1/pleroma/statuses/#{activity.id}/reactions/x")
	\|> json_response_and_validate_schema(400)
	end

	+ test "PUT /api/v1/pleroma/statuses/:id/reactions/:emoji not allowed for non-visible posts", %{
	+ conn: conn
	+ } do
	+ {%{id: activity_id} = _activity, _author, follower, stranger} = prepare_reacted_post()
	+
	+ # Works for follower
	+ resp =
	+ prepare_conn_of_user(conn, follower)
	+ \|> put("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐈")
	+ \|> json_response_and_validate_schema(200)
	+
	+ assert match?(%{"id" => ^activity_id}, resp)
	+
	+ # Fails for stranger
	+ resp =
	+ prepare_conn_of_user(conn, stranger)
	+ \|> put("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐈")
	+ \|> json_response_and_validate_schema(404)
	+
	+ assert match?(%{"error" => "Record not found"}, resp)
	+ end
	+
	test "DELETE /api/v1/pleroma/statuses/:id/reactions/:emoji", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	note =
	insert(:note,
	user: user,
	data: %{"reactions" => [["wow", [user.ap_id], "https://remote/emoji/wow"]]}
	)

	activity = insert(:note_activity, note: note, user: user)

	ObanHelpers.perform_all()

	{:ok, _reaction_activity} = CommonAPI.react_with_emoji(activity.id, other_user, "☕")
	{:ok, _reaction_activity} = CommonAPI.react_with_emoji(activity.id, other_user, ":dinosaur:")

	{:ok, _reaction_activity} =
	CommonAPI.react_with_emoji(activity.id, other_user, ":wow@remote:")

	ObanHelpers.perform_all()

	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> delete("/api/v1/pleroma/statuses/#{activity.id}/reactions/☕")

	assert %{"id" => id} = json_response_and_validate_schema(result, 200)
	assert to_string(activity.id) == id

	# Remove custom emoji

	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> delete("/api/v1/pleroma/statuses/#{activity.id}/reactions/:dinosaur:")

	assert %{"id" => id} = json_response_and_validate_schema(result, 200)
	assert to_string(activity.id) == id

	ObanHelpers.perform_all()

	object = Object.get_by_ap_id(activity.data["object"])

	assert object.data["reaction_count"] == 2

	# Remove custom remote emoji
	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> delete("/api/v1/pleroma/statuses/#{activity.id}/reactions/:wow@remote:")
	\|> json_response(200)

	assert result["pleroma"]["emoji_reactions"] == [
	%{
	"name" => "wow@remote",
	"count" => 1,
	"me" => false,
	"url" => "https://remote/emoji/wow",
	"account_ids" => [user.id]
	}
	]

	# Remove custom remote emoji that hasn't been reacted with yet
	assert conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> delete("/api/v1/pleroma/statuses/#{activity.id}/reactions/:zoop@remote:")
	\|> json_response(400)
	end

	+ test "DELETE /api/v1/pleroma/statuses/:id/reactions/:emoji only allows original reacter to revoke",
	+ %{conn: conn} do
	+ {%{id: activity_id} = _activity, author, follower, unrelated} = prepare_reacted_post("public")
	+
	+ # Works for original reacter
	+ prepare_conn_of_user(conn, follower)
	+ \|> delete("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐾")
	+ \|> json_response_and_validate_schema(200)
	+
	+ # Fails for anyone else
	+ for u <- [author, unrelated] do
	+ resp =
	+ prepare_conn_of_user(conn, u)
	+ \|> delete("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐾")
	+ \|> json_response(400)
	+
	+ assert match?(%{"error" => _}, resp)
	+ end
	+ end
	+
	test "GET /api/v1/pleroma/statuses/:id/reactions", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	doomed_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "#cofe"})

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response_and_validate_schema(200)

	assert result == []

	{:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
	{:ok, _} = CommonAPI.react_with_emoji(activity.id, doomed_user, "🎅")

	User.perform(:delete, doomed_user)

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response_and_validate_schema(200)

	[%{"name" => "🎅", "count" => 1, "accounts" => [represented_user], "me" => false}] = result

	assert represented_user["id"] == other_user.id

	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:statuses"]))
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response_and_validate_schema(200)

	assert [%{"name" => "🎅", "count" => 1, "accounts" => [_represented_user], "me" => true}] =
	result
	end

	test "GET /api/v1/pleroma/statuses/:id/reactions with legacy format", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	note =
	insert(:note,
	user: user,
	data: %{
	"reactions" => [["😿", [other_user.ap_id]]]
	}
	)

	activity = insert(:note_activity, user: user, note: note)

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response_and_validate_schema(200)

	other_user_id = other_user.id

	assert [
	%{
	"name" => "😿",
	"count" => 1,
	"me" => false,
	"url" => nil,
	"accounts" => [%{"id" => ^other_user_id}]
	}
	] = result
	end

	test "GET /api/v1/pleroma/statuses/:id/reactions?with_muted=true", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)
	user3 = insert(:user)

	token = insert(:oauth_token, user: user, scopes: ["read:statuses"])

	{:ok, activity} = CommonAPI.post(user, %{status: "#cofe"})

	{:ok, _} = CommonAPI.react_with_emoji(activity.id, user2, "🎅")
	{:ok, _} = CommonAPI.react_with_emoji(activity.id, user3, "🎅")

	result =
	conn
	\|> assign(:user, user)
	\|> assign(:token, token)
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response_and_validate_schema(200)

	assert [%{"name" => "🎅", "count" => 2}] = result

	User.mute(user, user3)

	result =
	conn
	\|> assign(:user, user)
	\|> assign(:token, token)
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response_and_validate_schema(200)

	assert [%{"name" => "🎅", "count" => 1}] = result

	result =
	conn
	\|> assign(:user, user)
	\|> assign(:token, token)
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions?with_muted=true")
	\|> json_response_and_validate_schema(200)

	assert [%{"name" => "🎅", "count" => 2}] = result
	end

	+ test "GET /api/v1/pleroma/statuses/:id/reactions not allowed for non-visible posts", %{
	+ conn: conn
	+ } do
	+ {%{id: activity_id} = _activity, _author, follower, stranger} = prepare_reacted_post()
	+
	+ # Works for follower
	+ resp =
	+ prepare_conn_of_user(conn, follower)
	+ \|> get("/api/v1/pleroma/statuses/#{activity_id}/reactions")
	+ \|> json_response_and_validate_schema(200)
	+
	+ assert match?([%{"name" => _, "count" => _} \| _], resp)
	+
	+ # Fails for stranger
	+ assert prepare_conn_of_user(conn, stranger)
	+ \|> get("/api/v1/pleroma/statuses/#{activity_id}/reactions")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	+
	test "GET /api/v1/pleroma/statuses/:id/reactions with :show_reactions disabled", %{conn: conn} do
	clear_config([:instance, :show_reactions], false)

	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "#cofe"})
	{:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response_and_validate_schema(200)

	assert result == []
	end

	test "GET /api/v1/pleroma/statuses/:id/reactions/:emoji", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "#cofe"})

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions/🎅")
	\|> json_response_and_validate_schema(200)

	assert result == []

	{:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
	{:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "☕")

	assert [
	%{
	"name" => "🎅",
	"count" => 1,
	"accounts" => [represented_user],
	"me" => false,
	"url" => nil
	}
	] =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions/🎅")
	\|> json_response_and_validate_schema(200)

	assert represented_user["id"] == other_user.id
	end
	+
	+ test "GET /api/v1/pleroma/statuses/:id/reactions/:emoji not allowed for non-visible posts", %{
	+ conn: conn
	+ } do
	+ {%{id: activity_id} = _activity, _author, follower, stranger} = prepare_reacted_post()
	+
	+ # Works for follower
	+ assert prepare_conn_of_user(conn, follower)
	+ \|> get("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐈")
	+ \|> json_response_and_validate_schema(200)
	+
	+ # Fails for stranger
	+ assert prepare_conn_of_user(conn, stranger)
	+ \|> get("/api/v1/pleroma/statuses/#{activity_id}/reactions/🐈")
	+ \|> json_response_and_validate_schema(404) == %{"error" => "Record not found"}
	+ end
	end

File Metadata

Mime Type: text/x-diff
Expires: Fri, Oct 30, 8:46 PM (14 h, 42 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1800535
Default Alt Text: (542 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions