No OneTemporary
Actions

Authored By

Unknown

Size

117 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web/api_spec/operations/account_operation.ex b/lib/pleroma/web/api_spec/operations/account_operation.ex
	index fcf030037..bf8d21059 100644
	--- a/lib/pleroma/web/api_spec/operations/account_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/account_operation.ex
	@@ -1,356 +1,369 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.AccountOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Reference
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.Schemas.Account
	+ alias Pleroma.Web.ApiSpec.Schemas.ApiError
	alias Pleroma.Web.ApiSpec.Schemas.AccountCreateRequest
	alias Pleroma.Web.ApiSpec.Schemas.AccountCreateResponse
	alias Pleroma.Web.ApiSpec.Schemas.AccountFollowsRequest
	alias Pleroma.Web.ApiSpec.Schemas.AccountMuteRequest
	alias Pleroma.Web.ApiSpec.Schemas.AccountRelationship
	alias Pleroma.Web.ApiSpec.Schemas.AccountRelationshipsResponse
	alias Pleroma.Web.ApiSpec.Schemas.AccountsResponse
	alias Pleroma.Web.ApiSpec.Schemas.AccountUpdateCredentialsRequest
	alias Pleroma.Web.ApiSpec.Schemas.BooleanLike
	alias Pleroma.Web.ApiSpec.Schemas.ListsResponse
	alias Pleroma.Web.ApiSpec.Schemas.StatusesResponse
	alias Pleroma.Web.ApiSpec.Schemas.VisibilityScope

	import Pleroma.Web.ApiSpec.Helpers

	@spec open_api_operation(atom) :: Operation.t()
	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	@spec create_operation() :: Operation.t()
	def create_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Register an account",
	description:
	"Creates a user and account records. Returns an account access token for the app that initiated the request. The app should save this token for later, and should wait for the user to confirm their account by clicking a link in their email inbox.",
	operationId: "AccountController.create",
	requestBody: request_body("Parameters", AccountCreateRequest, required: true),
	responses: %{
	- 200 => Operation.response("Account", "application/json", AccountCreateResponse)
	+ 200 => Operation.response("Account", "application/json", AccountCreateResponse),
	+ 400 => Operation.response("Error", "application/json", ApiError),
	+ 403 => Operation.response("Error", "application/json", ApiError),
	+ 429 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def verify_credentials_operation do
	%Operation{
	tags: ["accounts"],
	description: "Test to make sure that the user token works.",
	summary: "Verify account credentials",
	operationId: "AccountController.verify_credentials",
	security: [%{"oAuth" => ["read:accounts"]}],
	responses: %{
	200 => Operation.response("Account", "application/json", Account)
	}
	}
	end

	def update_credentials_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Update account credentials",
	description: "Update the user's display and preferences.",
	operationId: "AccountController.update_credentials",
	security: [%{"oAuth" => ["write:accounts"]}],
	requestBody: request_body("Parameters", AccountUpdateCredentialsRequest, required: true),
	responses: %{
	- 200 => Operation.response("Account", "application/json", Account)
	+ 200 => Operation.response("Account", "application/json", Account),
	+ 403 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def relationships_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Check relationships to other accounts",
	operationId: "AccountController.relationships",
	description: "Find out whether a given account is followed, blocked, muted, etc.",
	security: [%{"oAuth" => ["read:follows"]}],
	parameters: [
	Operation.parameter(
	:id,
	:query,
	%Schema{
	oneOf: [%Schema{type: :array, items: %Schema{type: :string}}, %Schema{type: :string}]
	},
	"Account IDs",
	example: "123"
	)
	],
	responses: %{
	200 => Operation.response("Account", "application/json", AccountRelationshipsResponse)
	}
	}
	end

	def show_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Account",
	operationId: "AccountController.show",
	description: "View information about a profile.",
	parameters: [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}],
	responses: %{
	- 200 => Operation.response("Account", "application/json", Account)
	+ 200 => Operation.response("Account", "application/json", Account),
	+ 404 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def statuses_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Statuses",
	operationId: "AccountController.statuses",
	description:
	"Statuses posted to the given account. Public (for public statuses only), or user token + `read:statuses` (for private statuses the user is authorized to see)",
	parameters:
	[
	%Reference{"$ref": "#/components/parameters/accountIdOrNickname"},
	Operation.parameter(:pinned, :query, BooleanLike, "Include only pinned statuses"),
	Operation.parameter(:tagged, :query, :string, "With tag"),
	Operation.parameter(
	:only_media,
	:query,
	BooleanLike,
	"Include only statuses with media attached"
	),
	Operation.parameter(
	:with_muted,
	:query,
	BooleanLike,
	"Include statuses from muted acccounts."
	),
	Operation.parameter(:exclude_reblogs, :query, BooleanLike, "Exclude reblogs"),
	Operation.parameter(
	:exclude_visibilities,
	:query,
	%Schema{type: :array, items: VisibilityScope},
	"Exclude visibilities"
	)
	] ++ pagination_params(),
	responses: %{
	- 200 => Operation.response("Statuses", "application/json", StatusesResponse)
	+ 200 => Operation.response("Statuses", "application/json", StatusesResponse),
	+ 404 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def followers_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Followers",
	operationId: "AccountController.followers",
	security: [%{"oAuth" => ["read:accounts"]}],
	description:
	"Accounts which follow the given account, if network is not hidden by the account owner.",
	parameters:
	[%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}] ++ pagination_params(),
	responses: %{
	200 => Operation.response("Accounts", "application/json", AccountsResponse)
	}
	}
	end

	def following_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Following",
	operationId: "AccountController.following",
	security: [%{"oAuth" => ["read:accounts"]}],
	description:
	"Accounts which the given account is following, if network is not hidden by the account owner.",
	parameters:
	[%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}] ++ pagination_params(),
	responses: %{200 => Operation.response("Accounts", "application/json", AccountsResponse)}
	}
	end

	def lists_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Lists containing this account",
	operationId: "AccountController.lists",
	security: [%{"oAuth" => ["read:lists"]}],
	description: "User lists that you have added this account to.",
	parameters: [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}],
	responses: %{200 => Operation.response("Lists", "application/json", ListsResponse)}
	}
	end

	def follow_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Follow",
	operationId: "AccountController.follow",
	security: [%{"oAuth" => ["follow", "write:follows"]}],
	description: "Follow the given account",
	parameters: [
	%Reference{"$ref": "#/components/parameters/accountIdOrNickname"},
	Operation.parameter(
	:reblogs,
	:query,
	BooleanLike,
	"Receive this account's reblogs in home timeline? Defaults to true."
	)
	],
	responses: %{
	- 200 => Operation.response("Relationship", "application/json", AccountRelationship)
	+ 200 => Operation.response("Relationship", "application/json", AccountRelationship),
	+ 400 => Operation.response("Error", "application/json", ApiError),
	+ 404 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def unfollow_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Unfollow",
	operationId: "AccountController.unfollow",
	security: [%{"oAuth" => ["follow", "write:follows"]}],
	description: "Unfollow the given account",
	parameters: [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}],
	responses: %{
	- 200 => Operation.response("Relationship", "application/json", AccountRelationship)
	+ 200 => Operation.response("Relationship", "application/json", AccountRelationship),
	+ 400 => Operation.response("Error", "application/json", ApiError),
	+ 404 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def mute_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Mute",
	operationId: "AccountController.mute",
	security: [%{"oAuth" => ["follow", "write:mutes"]}],
	requestBody: request_body("Parameters", AccountMuteRequest),
	description:
	"Mute the given account. Clients should filter statuses and notifications from this account, if received (e.g. due to a boost in the Home timeline).",
	parameters: [
	%Reference{"$ref": "#/components/parameters/accountIdOrNickname"},
	Operation.parameter(
	:notifications,
	:query,
	%Schema{allOf: [BooleanLike], default: true},
	"Mute notifications in addition to statuses? Defaults to `true`."
	)
	],
	responses: %{
	200 => Operation.response("Relationship", "application/json", AccountRelationship)
	}
	}
	end

	def unmute_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Unmute",
	operationId: "AccountController.unmute",
	security: [%{"oAuth" => ["follow", "write:mutes"]}],
	description: "Unmute the given account.",
	parameters: [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}],
	responses: %{
	200 => Operation.response("Relationship", "application/json", AccountRelationship)
	}
	}
	end

	def block_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Block",
	operationId: "AccountController.block",
	security: [%{"oAuth" => ["follow", "write:blocks"]}],
	description:
	"Block the given account. Clients should filter statuses from this account if received (e.g. due to a boost in the Home timeline)",
	parameters: [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}],
	responses: %{
	200 => Operation.response("Relationship", "application/json", AccountRelationship)
	}
	}
	end

	def unblock_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Unblock",
	operationId: "AccountController.unblock",
	security: [%{"oAuth" => ["follow", "write:blocks"]}],
	description: "Unblock the given account.",
	parameters: [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}],
	responses: %{
	200 => Operation.response("Relationship", "application/json", AccountRelationship)
	}
	}
	end

	def follows_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Follows",
	operationId: "AccountController.follows",
	security: [%{"oAuth" => ["follow", "write:follows"]}],
	requestBody: request_body("Parameters", AccountFollowsRequest, required: true),
	responses: %{
	- 200 => Operation.response("Account", "application/json", AccountRelationship)
	+ 200 => Operation.response("Account", "application/json", AccountRelationship),
	+ 400 => Operation.response("Error", "application/json", ApiError),
	+ 404 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def mutes_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Muted accounts",
	operationId: "AccountController.mutes",
	description: "Accounts the user has muted.",
	security: [%{"oAuth" => ["follow", "read:mutes"]}],
	responses: %{
	200 => Operation.response("Accounts", "application/json", AccountsResponse)
	}
	}
	end

	def blocks_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Blocked users",
	operationId: "AccountController.blocks",
	description: "View your blocks. See also accounts/:id/{block,unblock}",
	security: [%{"oAuth" => ["read:blocks"]}],
	responses: %{
	200 => Operation.response("Accounts", "application/json", AccountsResponse)
	}
	}
	end

	def endorsements_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Endorsements",
	operationId: "AccountController.endorsements",
	description: "Not implemented",
	security: [%{"oAuth" => ["read:accounts"]}],
	responses: %{
	200 => Operation.response("Empry array", "application/json", %Schema{type: :array})
	}
	}
	end

	def identity_proofs_operation do
	%Operation{
	tags: ["accounts"],
	summary: "Identity proofs",
	operationId: "AccountController.identity_proofs",
	description: "Not implemented",
	responses: %{
	200 => Operation.response("Empry array", "application/json", %Schema{type: :array})
	}
	}
	end
	end
	diff --git a/lib/pleroma/web/api_spec/schemas/account.ex b/lib/pleroma/web/api_spec/schemas/account.ex
	index f57015254..d128feb30 100644
	--- a/lib/pleroma/web/api_spec/schemas/account.ex
	+++ b/lib/pleroma/web/api_spec/schemas/account.ex
	@@ -1,167 +1,167 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.Schemas.Account do
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.Schemas.AccountEmoji
	alias Pleroma.Web.ApiSpec.Schemas.AccountField
	alias Pleroma.Web.ApiSpec.Schemas.AccountRelationship
	alias Pleroma.Web.ApiSpec.Schemas.ActorType
	alias Pleroma.Web.ApiSpec.Schemas.FlakeID
	alias Pleroma.Web.ApiSpec.Schemas.VisibilityScope

	require OpenApiSpex

	OpenApiSpex.schema(%{
	title: "Account",
	description: "Response schema for an account",
	type: :object,
	properties: %{
	acct: %Schema{type: :string},
	avatar_static: %Schema{type: :string, format: :uri},
	avatar: %Schema{type: :string, format: :uri},
	bot: %Schema{type: :boolean},
	created_at: %Schema{type: :string, format: "date-time"},
	display_name: %Schema{type: :string},
	emojis: %Schema{type: :array, items: AccountEmoji},
	fields: %Schema{type: :array, items: AccountField},
	follow_requests_count: %Schema{type: :integer},
	followers_count: %Schema{type: :integer},
	following_count: %Schema{type: :integer},
	header_static: %Schema{type: :string, format: :uri},
	header: %Schema{type: :string, format: :uri},
	id: FlakeID,
	locked: %Schema{type: :boolean},
	note: %Schema{type: :string, format: :html},
	statuses_count: %Schema{type: :integer},
	url: %Schema{type: :string, format: :uri},
	username: %Schema{type: :string},
	pleroma: %Schema{
	type: :object,
	properties: %{
	allow_following_move: %Schema{type: :boolean},
	- background_image: %Schema{type: :boolean, nullable: true},
	+ background_image: %Schema{type: :string, nullable: true},
	chat_token: %Schema{type: :string},
	confirmation_pending: %Schema{type: :boolean},
	hide_favorites: %Schema{type: :boolean},
	hide_followers_count: %Schema{type: :boolean},
	hide_followers: %Schema{type: :boolean},
	hide_follows_count: %Schema{type: :boolean},
	hide_follows: %Schema{type: :boolean},
	is_admin: %Schema{type: :boolean},
	is_moderator: %Schema{type: :boolean},
	skip_thread_containment: %Schema{type: :boolean},
	tags: %Schema{type: :array, items: %Schema{type: :string}},
	unread_conversation_count: %Schema{type: :integer},
	notification_settings: %Schema{
	type: :object,
	properties: %{
	followers: %Schema{type: :boolean},
	follows: %Schema{type: :boolean},
	non_followers: %Schema{type: :boolean},
	non_follows: %Schema{type: :boolean},
	privacy_option: %Schema{type: :boolean}
	}
	},
	relationship: AccountRelationship,
	settings_store: %Schema{
	type: :object
	}
	}
	},
	source: %Schema{
	type: :object,
	properties: %{
	fields: %Schema{type: :array, items: AccountField},
	note: %Schema{type: :string},
	privacy: VisibilityScope,
	sensitive: %Schema{type: :boolean},
	pleroma: %Schema{
	type: :object,
	properties: %{
	actor_type: ActorType,
	discoverable: %Schema{type: :boolean},
	no_rich_text: %Schema{type: :boolean},
	show_role: %Schema{type: :boolean}
	}
	}
	}
	}
	},
	example: %{
	"acct" => "foobar",
	"avatar" => "https://mypleroma.com/images/avi.png",
	"avatar_static" => "https://mypleroma.com/images/avi.png",
	"bot" => false,
	"created_at" => "2020-03-24T13:05:58.000Z",
	"display_name" => "foobar",
	"emojis" => [],
	"fields" => [],
	"follow_requests_count" => 0,
	"followers_count" => 0,
	"following_count" => 1,
	"header" => "https://mypleroma.com/images/banner.png",
	"header_static" => "https://mypleroma.com/images/banner.png",
	"id" => "9tKi3esbG7OQgZ2920",
	"locked" => false,
	"note" => "cofe",
	"pleroma" => %{
	"allow_following_move" => true,
	"background_image" => nil,
	"confirmation_pending" => true,
	"hide_favorites" => true,
	"hide_followers" => false,
	"hide_followers_count" => false,
	"hide_follows" => false,
	"hide_follows_count" => false,
	"is_admin" => false,
	"is_moderator" => false,
	"skip_thread_containment" => false,
	"chat_token" =>
	"SFMyNTY.g3QAAAACZAAEZGF0YW0AAAASOXRLaTNlc2JHN09RZ1oyOTIwZAAGc2lnbmVkbgYARNplS3EB.Mb_Iaqew2bN1I1o79B_iP7encmVCpTKC4OtHZRxdjKc",
	"unread_conversation_count" => 0,
	"tags" => [],
	"notification_settings" => %{
	"followers" => true,
	"follows" => true,
	"non_followers" => true,
	"non_follows" => true,
	"privacy_option" => false
	},
	"relationship" => %{
	"blocked_by" => false,
	"blocking" => false,
	"domain_blocking" => false,
	"endorsed" => false,
	"followed_by" => false,
	"following" => false,
	"id" => "9tKi3esbG7OQgZ2920",
	"muting" => false,
	"muting_notifications" => false,
	"requested" => false,
	"showing_reblogs" => true,
	"subscribing" => false
	},
	"settings_store" => %{
	"pleroma-fe" => %{}
	}
	},
	"source" => %{
	"fields" => [],
	"note" => "foobar",
	"pleroma" => %{
	"actor_type" => "Person",
	"discoverable" => false,
	"no_rich_text" => false,
	"show_role" => true
	},
	"privacy" => "public",
	"sensitive" => false
	},
	"statuses_count" => 0,
	"url" => "https://mypleroma.com/users/foobar",
	"username" => "foobar"
	}
	})
	end
	diff --git a/lib/pleroma/web/controller_helper.ex b/lib/pleroma/web/controller_helper.ex
	index 4780081b2..eb97ae975 100644
	--- a/lib/pleroma/web/controller_helper.ex
	+++ b/lib/pleroma/web/controller_helper.ex
	@@ -1,117 +1,118 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ControllerHelper do
	use Pleroma.Web, :controller

	alias Pleroma.Config

	# As in Mastodon API, per https://api.rubyonrails.org/classes/ActiveModel/Type/Boolean.html
	@falsy_param_values [false, 0, "0", "f", "F", "false", "False", "FALSE", "off", "OFF"]

	def explicitly_falsy_param?(value), do: value in @falsy_param_values

	# Note: `nil` and `""` are considered falsy values in Pleroma
	def falsy_param?(value),
	do: explicitly_falsy_param?(value) or value in [nil, ""]

	def truthy_param?(value), do: not falsy_param?(value)

	def json_response(conn, status, json) do
	conn
	\|> put_status(status)
	\|> json(json)
	end

	@spec fetch_integer_param(map(), String.t(), integer() \| nil) :: integer() \| nil
	def fetch_integer_param(params, name, default \\ nil) do
	params
	\|> Map.get(name, default)
	\|> param_to_integer(default)
	end

	defp param_to_integer(val, _) when is_integer(val), do: val

	defp param_to_integer(val, default) when is_binary(val) do
	case Integer.parse(val) do
	{res, _} -> res
	_ -> default
	end
	end

	defp param_to_integer(_, default), do: default

	def add_link_headers(conn, activities, extra_params \\ %{})

	def add_link_headers(%{assigns: %{skip_link_headers: true}} = conn, _activities, _extra_params),
	do: conn

	def add_link_headers(conn, activities, extra_params) do
	case List.last(activities) do
	%{id: max_id} ->
	params =
	conn.params
	\|> Map.drop(Map.keys(conn.path_params))
	\|> Map.drop(["since_id", "max_id", "min_id"])
	\|> Map.merge(extra_params)

	limit =
	params
	\|> Map.get("limit", "20")
	\|> String.to_integer()

	min_id =
	if length(activities) <= limit do
	activities
	\|> List.first()
	\|> Map.get(:id)
	else
	activities
	\|> Enum.at(limit * -1)
	\|> Map.get(:id)
	end

	next_url = current_url(conn, Map.merge(params, %{max_id: max_id}))
	prev_url = current_url(conn, Map.merge(params, %{min_id: min_id}))

	put_resp_header(conn, "link", "<#{next_url}>; rel=\"next\", <#{prev_url}>; rel=\"prev\"")

	_ ->
	conn
	end
	end

	- def assign_account_by_id(%{params: %{"id" => id}} = conn, _) do
	- case Pleroma.User.get_cached_by_id(id) do
	+ def assign_account_by_id(conn, _) do
	+ # TODO: use `conn.params[:id]` only after moving to OpenAPI
	+ case Pleroma.User.get_cached_by_id(conn.params[:id] \|\| conn.params["id"]) do
	%Pleroma.User{} = account -> assign(conn, :account, account)
	nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) \|> halt()
	end
	end

	def try_render(conn, target, params) when is_binary(target) do
	case render(conn, target, params) do
	nil -> render_error(conn, :not_implemented, "Can't display this activity")
	res -> res
	end
	end

	def try_render(conn, _, _) do
	render_error(conn, :not_implemented, "Can't display this activity")
	end

	@spec put_if_exist(map(), atom() \| String.t(), any) :: map()
	def put_if_exist(map, _key, nil), do: map

	def put_if_exist(map, key, value), do: Map.put(map, key, value)

	@doc "Whether to skip rendering `[:account][:pleroma][:relationship]`for statuses/notifications"
	def skip_relationships?(params) do
	if Config.get([:extensions, :output_relationships_in_statuses_by_default]) do
	false
	else
	# BREAKING: older PleromaFE versions do not send this param but _do_ expect relationships.
	not truthy_param?(params["with_relationships"])
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	index 93df79645..b1513001b 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	@@ -1,415 +1,415 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [
	add_link_headers: 2,
	truthy_param?: 1,
	assign_account_by_id: 2,
	json_response: 3,
	skip_relationships?: 1
	]

	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.Plugs.RateLimiter
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.ListView
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	alias Pleroma.Web.MastodonAPI.MastodonAPIController
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.TwitterAPI

	+ plug(OpenApiSpex.Plug.CastAndValidate, render_error: Pleroma.Web.ApiSpec.RenderError)
	+
	plug(:skip_plug, OAuthScopesPlug when action == :identity_proofs)

	plug(
	OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["read:accounts"]}
	when action == :show
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:accounts"]}
	when action in [:endorsements, :verify_credentials, :followers, :following]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :update_credentials)

	plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :lists)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "read:blocks"]} when action == :blocks
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:blocks"]} when action in [:block, :unblock]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:follows"]} when action == :relationships)

	# Note: :follows (POST /api/v1/follows) is the same as :follow, consider removing :follows
	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]} when action in [:follows, :follow, :unfollow]
	)

	plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)

	plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])

	plug(
	Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
	when action not in [:create, :show, :statuses]
	)

	@relationship_actions [:follow, :unfollow]
	@needs_account ~W(followers following lists follow unfollow mute unmute block unblock)a

	plug(
	RateLimiter,
	[name: :relation_id_action, params: ["id", "uri"]] when action in @relationship_actions
	)

	plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
	plug(RateLimiter, [name: :app_account_creation] when action == :create)
	plug(:assign_account_by_id when action in @needs_account)

	- plug(OpenApiSpex.Plug.CastAndValidate, render_error: Pleroma.Web.ApiSpec.RenderError)
	-
	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AccountOperation

	@doc "POST /api/v1/accounts"
	def create(%{assigns: %{app: app}, body_params: params} = conn, _params) do
	params =
	params
	\|> Map.take([
	:email,
	:bio,
	:captcha_solution,
	:captcha_token,
	:captcha_answer_data,
	:token,
	:password,
	:fullname
	])
	\|> Map.put(:nickname, params.username)
	\|> Map.put(:fullname, params.fullname \|\| params.username)
	\|> Map.put(:bio, params.bio \|\| "")
	\|> Map.put(:confirm, params.password)
	\|> Map.put(:trusted_app, app.trusted)

	with :ok <- validate_email_param(params),
	{:ok, user} <- TwitterAPI.register_user(params, need_confirmation: true),
	{:ok, token} <- Token.create_token(app, user, %{scopes: app.scopes}) do
	json(conn, %{
	token_type: "Bearer",
	access_token: token.token,
	scope: app.scopes,
	created_at: Token.Utils.format_created_at(token)
	})
	else
	{:error, errors} -> json_response(conn, :bad_request, errors)
	end
	end

	def create(%{assigns: %{app: _app}} = conn, _) do
	render_error(conn, :bad_request, "Missing parameters")
	end

	def create(conn, _) do
	render_error(conn, :forbidden, "Invalid credentials")
	end

	defp validate_email_param(%{:email => email}) when not is_nil(email), do: :ok

	defp validate_email_param(_) do
	case Pleroma.Config.get([:instance, :account_activation_required]) do
	true -> {:error, %{"error" => "Missing parameters"}}
	_ -> :ok
	end
	end

	@doc "GET /api/v1/accounts/verify_credentials"
	def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	chat_token = Phoenix.Token.sign(conn, "user socket", user.id)

	render(conn, "show.json",
	user: user,
	for: user,
	with_pleroma_settings: true,
	with_chat_token: chat_token
	)
	end

	@doc "PATCH /api/v1/accounts/update_credentials"
	def update_credentials(%{assigns: %{user: original_user}, body_params: params} = conn, _params) do
	user = original_user

	params =
	params
	\|> Map.from_struct()
	\|> Enum.filter(fn {_, value} -> not is_nil(value) end)
	\|> Enum.into(%{})

	user_params =
	[
	:no_rich_text,
	:locked,
	:hide_followers_count,
	:hide_follows_count,
	:hide_followers,
	:hide_follows,
	:hide_favorites,
	:show_role,
	:skip_thread_containment,
	:allow_following_move,
	:discoverable
	]
	\|> Enum.reduce(%{}, fn key, acc ->
	add_if_present(acc, params, key, key, &{:ok, truthy_param?(&1)})
	end)
	\|> add_if_present(params, :display_name, :name)
	\|> add_if_present(params, :note, :bio)
	\|> add_if_present(params, :avatar, :avatar)
	\|> add_if_present(params, :header, :banner)
	\|> add_if_present(params, :pleroma_background_image, :background)
	\|> add_if_present(
	params,
	:fields_attributes,
	:raw_fields,
	&{:ok, normalize_fields_attributes(&1)}
	)
	\|> add_if_present(params, :pleroma_settings_store, :pleroma_settings_store)
	\|> add_if_present(params, :default_scope, :default_scope)
	\|> add_if_present(params, :actor_type, :actor_type)

	changeset = User.update_changeset(user, user_params)

	with {:ok, user} <- User.update_and_set_cache(changeset) do
	render(conn, "show.json", user: user, for: user, with_pleroma_settings: true)
	else
	_e -> render_error(conn, :forbidden, "Invalid request")
	end
	end

	defp add_if_present(map, params, params_field, map_field, value_function \\ &{:ok, &1}) do
	with true <- Map.has_key?(params, params_field),
	{:ok, new_value} <- value_function.(Map.get(params, params_field)) do
	Map.put(map, map_field, new_value)
	else
	_ -> map
	end
	end

	defp normalize_fields_attributes(fields) do
	if Enum.all?(fields, &is_tuple/1) do
	Enum.map(fields, fn {_, v} -> v end)
	else
	Enum.map(fields, fn
	%Pleroma.Web.ApiSpec.Schemas.AccountAttributeField{} = field ->
	%{"name" => field.name, "value" => field.value}

	field ->
	field
	end)
	end
	end

	@doc "GET /api/v1/accounts/relationships"
	def relationships(%{assigns: %{user: user}} = conn, %{id: id}) do
	targets = User.get_all_by_ids(List.wrap(id))

	render(conn, "relationships.json", user: user, targets: targets)
	end

	# Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])

	@doc "GET /api/v1/accounts/:id"
	def show(%{assigns: %{user: for_user}} = conn, %{id: nickname_or_id}) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
	true <- User.visible_for?(user, for_user) do
	render(conn, "show.json", user: user, for: for_user)
	else
	_e -> render_error(conn, :not_found, "Can't find user")
	end
	end

	@doc "GET /api/v1/accounts/:id/statuses"
	def statuses(%{assigns: %{user: reading_user}} = conn, params) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(params.id, for: reading_user),
	true <- User.visible_for?(user, reading_user) do
	params =
	params
	\|> Map.delete(:tagged)
	\|> Enum.filter(&(not is_nil(&1)))
	\|> Map.new(fn {key, value} -> {to_string(key), value} end)
	\|> Map.put("tag", params[:tagged])

	activities = ActivityPub.fetch_user_activities(user, reading_user, params)

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json",
	activities: activities,
	for: reading_user,
	as: :activity,
	skip_relationships: skip_relationships?(params)
	)
	else
	_e -> render_error(conn, :not_found, "Can't find user")
	end
	end

	@doc "GET /api/v1/accounts/:id/followers"
	def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
	params =
	params
	\|> Enum.map(fn {key, value} -> {to_string(key), value} end)
	\|> Enum.into(%{})

	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_followers(user, params)
	user.hide_followers -> []
	true -> MastodonAPI.get_followers(user, params)
	end

	conn
	\|> add_link_headers(followers)
	\|> render("index.json", for: for_user, users: followers, as: :user)
	end

	@doc "GET /api/v1/accounts/:id/following"
	def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
	params =
	params
	\|> Enum.map(fn {key, value} -> {to_string(key), value} end)
	\|> Enum.into(%{})

	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_friends(user, params)
	user.hide_follows -> []
	true -> MastodonAPI.get_friends(user, params)
	end

	conn
	\|> add_link_headers(followers)
	\|> render("index.json", for: for_user, users: followers, as: :user)
	end

	@doc "GET /api/v1/accounts/:id/lists"
	def lists(%{assigns: %{user: user, account: account}} = conn, _params) do
	lists = Pleroma.List.get_lists_account_belongs(user, account)

	conn
	\|> put_view(ListView)
	\|> render("index.json", lists: lists)
	end

	@doc "POST /api/v1/accounts/:id/follow"
	def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not follow yourself"}
	end

	def follow(%{assigns: %{user: follower, account: followed}} = conn, params) do
	with {:ok, follower} <- MastodonAPI.follow(follower, followed, params) do
	render(conn, "relationship.json", user: follower, target: followed)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unfollow"
	def unfollow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not unfollow yourself"}
	end

	def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.unfollow(follower, followed) do
	render(conn, "relationship.json", user: follower, target: followed)
	end
	end

	@doc "POST /api/v1/accounts/:id/mute"
	def mute(%{assigns: %{user: muter, account: muted}, body_params: params} = conn, _params) do
	with {:ok, _user_relationships} <- User.mute(muter, muted, params.notifications) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unmute"
	def unmute(%{assigns: %{user: muter, account: muted}} = conn, _params) do
	with {:ok, _user_relationships} <- User.unmute(muter, muted) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/block"
	def block(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _user_block} <- User.block(blocker, blocked),
	{:ok, _activity} <- ActivityPub.block(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unblock"
	def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _user_block} <- User.unblock(blocker, blocked),
	{:ok, _activity} <- ActivityPub.unblock(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/follows"
	def follows(%{body_params: %{uri: uri}} = conn, _) do
	case User.get_cached_by_nickname(uri) do
	%User{} = user ->
	conn
	\|> assign(:account, user)
	\|> follow(%{})

	nil ->
	{:error, :not_found}
	end
	end

	@doc "GET /api/v1/mutes"
	def mutes(%{assigns: %{user: user}} = conn, _) do
	users = User.muted_users(user, _restrict_deactivated = true)
	render(conn, "index.json", users: users, for: user, as: :user)
	end

	@doc "GET /api/v1/blocks"
	def blocks(%{assigns: %{user: user}} = conn, _) do
	users = User.blocked_users(user, _restrict_deactivated = true)
	render(conn, "index.json", users: users, for: user, as: :user)
	end

	@doc "GET /api/v1/endorsements"
	def endorsements(conn, params), do: MastodonAPIController.empty_array(conn, params)

	@doc "GET /api/v1/identity_proofs"
	def identity_proofs(conn, params), do: MastodonAPIController.empty_array(conn, params)
	end
	diff --git a/test/support/conn_case.ex b/test/support/conn_case.ex
	index 8099461cc..fa30a0c41 100644
	--- a/test/support/conn_case.ex
	+++ b/test/support/conn_case.ex
	@@ -1,134 +1,147 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ConnCase do
	@moduledoc """
	This module defines the test case to be used by
	tests that require setting up a connection.

	Such tests rely on `Phoenix.ConnTest` and also
	import other functionality to make it easier
	to build common datastructures and query the data layer.

	Finally, if the test case interacts with the database,
	it cannot be async. For this reason, every test runs
	inside a transaction which is reset at the beginning
	of the test unless the test case is marked as async.
	"""

	use ExUnit.CaseTemplate

	using do
	quote do
	# Import conveniences for testing with connections
	use Phoenix.ConnTest
	use Pleroma.Tests.Helpers
	import Pleroma.Web.Router.Helpers

	alias Pleroma.Config

	# The default endpoint for testing
	@endpoint Pleroma.Web.Endpoint

	# Sets up OAuth access with specified scopes
	defp oauth_access(scopes, opts \\ []) do
	user =
	Keyword.get_lazy(opts, :user, fn ->
	Pleroma.Factory.insert(:user)
	end)

	token =
	Keyword.get_lazy(opts, :oauth_token, fn ->
	Pleroma.Factory.insert(:oauth_token, user: user, scopes: scopes)
	end)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> assign(:token, token)

	%{user: user, token: token, conn: conn}
	end

	defp request_content_type(%{conn: conn}) do
	conn = put_req_header(conn, "content-type", "multipart/form-data")
	[conn: conn]
	end

	- defp json_response_and_validate_schema(conn, status \\ nil) do
	+ defp json_response_and_validate_schema(
	+ %{
	+ private: %{
	+ open_api_spex: %{operation_id: op_id, operation_lookup: lookup, spec: spec}
	+ }
	+ } = conn,
	+ status
	+ ) do
	content_type =
	conn
	\|> Plug.Conn.get_resp_header("content-type")
	\|> List.first()
	\|> String.split(";")
	\|> List.first()

	- status = status \|\| conn.status
	+ status = Plug.Conn.Status.code(status)

	- %{private: %{open_api_spex: %{operation_id: op_id, operation_lookup: lookup, spec: spec}}} =
	- conn
	+ unless lookup[op_id].responses[status] do
	+ err = "Response schema not found for #{conn.status} #{conn.method} #{conn.request_path}"
	+ flunk(err)
	+ end

	schema = lookup[op_id].responses[status].content[content_type].schema
	json = json_response(conn, status)

	case OpenApiSpex.cast_value(json, schema, spec) do
	{:ok, _data} ->
	json

	{:error, errors} ->
	errors =
	Enum.map(errors, fn error ->
	message = OpenApiSpex.Cast.Error.message(error)
	path = OpenApiSpex.Cast.Error.path_to_string(error)
	"#{message} at #{path}"
	end)

	flunk(
	"Response does not conform to schema of #{op_id} operation: #{
	Enum.join(errors, "\n")
	}\n#{inspect(json)}"
	)
	end
	end

	+ defp json_response_and_validate_schema(conn, _status) do
	+ flunk("Response schema not found for #{conn.method} #{conn.request_path} #{conn.status}")
	+ end
	+
	defp ensure_federating_or_authenticated(conn, url, user) do
	initial_setting = Config.get([:instance, :federating])
	on_exit(fn -> Config.put([:instance, :federating], initial_setting) end)

	Config.put([:instance, :federating], false)

	conn
	\|> get(url)
	\|> response(403)

	conn
	\|> assign(:user, user)
	\|> get(url)
	\|> response(200)

	Config.put([:instance, :federating], true)

	conn
	\|> get(url)
	\|> response(200)
	end
	end
	end

	setup tags do
	Cachex.clear(:user_cache)
	Cachex.clear(:object_cache)
	:ok = Ecto.Adapters.SQL.Sandbox.checkout(Pleroma.Repo)

	unless tags[:async] do
	Ecto.Adapters.SQL.Sandbox.mode(Pleroma.Repo, {:shared, self()})
	end

	if tags[:needs_streamer] do
	start_supervised(Pleroma.Web.Streamer.supervisor())
	end

	{:ok, conn: Phoenix.ConnTest.build_conn()}
	end
	end
	diff --git a/test/web/mastodon_api/controllers/account_controller/update_credentials_test.exs b/test/web/mastodon_api/controllers/account_controller/update_credentials_test.exs
	index a3356c12f..fdb6d4c5d 100644
	--- a/test/web/mastodon_api/controllers/account_controller/update_credentials_test.exs
	+++ b/test/web/mastodon_api/controllers/account_controller/update_credentials_test.exs
	@@ -1,383 +1,383 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIController.UpdateCredentialsTest do
	alias Pleroma.Repo
	alias Pleroma.User

	use Pleroma.Web.ConnCase

	import Pleroma.Factory

	setup do: clear_config([:instance, :max_account_fields])

	describe "updating credentials" do
	setup do: oauth_access(["write:accounts"])
	setup :request_content_type

	test "sets user settings in a generic way", %{conn: conn} do
	res_conn =
	patch(conn, "/api/v1/accounts/update_credentials", %{
	"pleroma_settings_store" => %{
	pleroma_fe: %{
	theme: "bla"
	}
	}
	})

	- assert user_data = json_response(res_conn, 200)
	+ assert user_data = json_response_and_validate_schema(res_conn, 200)
	assert user_data["pleroma"]["settings_store"] == %{"pleroma_fe" => %{"theme" => "bla"}}

	user = Repo.get(User, user_data["id"])

	res_conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{
	"pleroma_settings_store" => %{
	masto_fe: %{
	theme: "bla"
	}
	}
	})

	- assert user_data = json_response(res_conn, 200)
	+ assert user_data = json_response_and_validate_schema(res_conn, 200)

	assert user_data["pleroma"]["settings_store"] ==
	%{
	"pleroma_fe" => %{"theme" => "bla"},
	"masto_fe" => %{"theme" => "bla"}
	}

	user = Repo.get(User, user_data["id"])

	res_conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{
	"pleroma_settings_store" => %{
	masto_fe: %{
	theme: "blub"
	}
	}
	})

	- assert user_data = json_response(res_conn, 200)
	+ assert user_data = json_response_and_validate_schema(res_conn, 200)

	assert user_data["pleroma"]["settings_store"] ==
	%{
	"pleroma_fe" => %{"theme" => "bla"},
	"masto_fe" => %{"theme" => "blub"}
	}
	end

	test "updates the user's bio", %{conn: conn} do
	user2 = insert(:user)

	conn =
	patch(conn, "/api/v1/accounts/update_credentials", %{
	"note" => "I drink #cofe with @#{user2.nickname}\n\nsuya.."
	})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)

	assert user_data["note"] ==
	~s(I drink <a class="hashtag" data-tag="cofe" href="http://localhost:4001/tag/cofe">#cofe</a> with <span class="h-card"><a class="u-url mention" data-user="#{
	user2.id
	}" href="#{user2.ap_id}" rel="ugc">@<span>#{user2.nickname}</span></a></span><br/><br/>suya..)
	end

	test "updates the user's locking status", %{conn: conn} do
	conn = patch(conn, "/api/v1/accounts/update_credentials", %{locked: "true"})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["locked"] == true
	end

	test "updates the user's allow_following_move", %{user: user, conn: conn} do
	assert user.allow_following_move == true

	conn = patch(conn, "/api/v1/accounts/update_credentials", %{allow_following_move: "false"})

	assert refresh_record(user).allow_following_move == false
	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["pleroma"]["allow_following_move"] == false
	end

	test "updates the user's default scope", %{conn: conn} do
	conn = patch(conn, "/api/v1/accounts/update_credentials", %{default_scope: "unlisted"})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["source"]["privacy"] == "unlisted"
	end

	test "updates the user's hide_followers status", %{conn: conn} do
	conn = patch(conn, "/api/v1/accounts/update_credentials", %{hide_followers: "true"})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["pleroma"]["hide_followers"] == true
	end

	test "updates the user's discoverable status", %{conn: conn} do
	assert %{"source" => %{"pleroma" => %{"discoverable" => true}}} =
	conn
	\|> patch("/api/v1/accounts/update_credentials", %{discoverable: "true"})
	- \|> json_response(:ok)
	+ \|> json_response_and_validate_schema(:ok)

	assert %{"source" => %{"pleroma" => %{"discoverable" => false}}} =
	conn
	\|> patch("/api/v1/accounts/update_credentials", %{discoverable: "false"})
	- \|> json_response(:ok)
	+ \|> json_response_and_validate_schema(:ok)
	end

	test "updates the user's hide_followers_count and hide_follows_count", %{conn: conn} do
	conn =
	patch(conn, "/api/v1/accounts/update_credentials", %{
	hide_followers_count: "true",
	hide_follows_count: "true"
	})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["pleroma"]["hide_followers_count"] == true
	assert user_data["pleroma"]["hide_follows_count"] == true
	end

	test "updates the user's skip_thread_containment option", %{user: user, conn: conn} do
	response =
	conn
	\|> patch("/api/v1/accounts/update_credentials", %{skip_thread_containment: "true"})
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert response["pleroma"]["skip_thread_containment"] == true
	assert refresh_record(user).skip_thread_containment
	end

	test "updates the user's hide_follows status", %{conn: conn} do
	conn = patch(conn, "/api/v1/accounts/update_credentials", %{hide_follows: "true"})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["pleroma"]["hide_follows"] == true
	end

	test "updates the user's hide_favorites status", %{conn: conn} do
	conn = patch(conn, "/api/v1/accounts/update_credentials", %{hide_favorites: "true"})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["pleroma"]["hide_favorites"] == true
	end

	test "updates the user's show_role status", %{conn: conn} do
	conn = patch(conn, "/api/v1/accounts/update_credentials", %{show_role: "false"})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["source"]["pleroma"]["show_role"] == false
	end

	test "updates the user's no_rich_text status", %{conn: conn} do
	conn = patch(conn, "/api/v1/accounts/update_credentials", %{no_rich_text: "true"})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["source"]["pleroma"]["no_rich_text"] == true
	end

	test "updates the user's name", %{conn: conn} do
	conn =
	patch(conn, "/api/v1/accounts/update_credentials", %{"display_name" => "markorepairs"})

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)
	assert user_data["display_name"] == "markorepairs"
	end

	test "updates the user's avatar", %{user: user, conn: conn} do
	new_avatar = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn = patch(conn, "/api/v1/accounts/update_credentials", %{"avatar" => new_avatar})

	- assert user_response = json_response(conn, 200)
	+ assert user_response = json_response_and_validate_schema(conn, 200)
	assert user_response["avatar"] != User.avatar_url(user)
	end

	test "updates the user's banner", %{user: user, conn: conn} do
	new_header = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn = patch(conn, "/api/v1/accounts/update_credentials", %{"header" => new_header})

	- assert user_response = json_response(conn, 200)
	+ assert user_response = json_response_and_validate_schema(conn, 200)
	assert user_response["header"] != User.banner_url(user)
	end

	test "updates the user's background", %{conn: conn} do
	new_header = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	patch(conn, "/api/v1/accounts/update_credentials", %{
	"pleroma_background_image" => new_header
	})

	- assert user_response = json_response(conn, 200)
	+ assert user_response = json_response_and_validate_schema(conn, 200)
	assert user_response["pleroma"]["background_image"]
	end

	test "requires 'write:accounts' permission" do
	token1 = insert(:oauth_token, scopes: ["read"])
	token2 = insert(:oauth_token, scopes: ["write", "follow"])

	for token <- [token1, token2] do
	conn =
	build_conn()
	\|> put_req_header("content-type", "multipart/form-data")
	\|> put_req_header("authorization", "Bearer #{token.token}")
	\|> patch("/api/v1/accounts/update_credentials", %{})

	if token == token1 do
	assert %{"error" => "Insufficient permissions: write:accounts."} ==
	- json_response(conn, 403)
	+ json_response_and_validate_schema(conn, 403)
	else
	- assert json_response(conn, 200)
	+ assert json_response_and_validate_schema(conn, 200)
	end
	end
	end

	test "updates profile emojos", %{user: user, conn: conn} do
	note = "sips :blank:"
	name = "I am :firefox:"

	ret_conn =
	patch(conn, "/api/v1/accounts/update_credentials", %{
	"note" => note,
	"display_name" => name
	})

	- assert json_response(ret_conn, 200)
	+ assert json_response_and_validate_schema(ret_conn, 200)

	conn = get(conn, "/api/v1/accounts/#{user.id}")

	- assert user_data = json_response(conn, 200)
	+ assert user_data = json_response_and_validate_schema(conn, 200)

	assert user_data["note"] == note
	assert user_data["display_name"] == name
	assert [%{"shortcode" => "blank"}, %{"shortcode" => "firefox"}] = user_data["emojis"]
	end

	test "update fields", %{conn: conn} do
	fields = [
	%{"name" => "<a href=\"http://google.com\">foo</a>", "value" => "<script>bar</script>"},
	%{"name" => "link.io", "value" => "cofe.io"}
	]

	account_data =
	conn
	\|> patch("/api/v1/accounts/update_credentials", %{"fields_attributes" => fields})
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert account_data["fields"] == [
	%{"name" => "<a href=\"http://google.com\">foo</a>", "value" => "bar"},
	%{
	"name" => "link.io",
	"value" => ~S(<a href="http://cofe.io" rel="ugc">cofe.io</a>)
	}
	]

	assert account_data["source"]["fields"] == [
	%{
	"name" => "<a href=\"http://google.com\">foo</a>",
	"value" => "<script>bar</script>"
	},
	%{"name" => "link.io", "value" => "cofe.io"}
	]
	end

	test "update fields via x-www-form-urlencoded", %{conn: conn} do
	fields =
	[
	"fields_attributes[1][name]=link",
	"fields_attributes[1][value]=http://cofe.io",
	"fields_attributes[0][name]=foo",
	"fields_attributes[0][value]=bar"
	]
	\|> Enum.join("&")

	account =
	conn
	\|> put_req_header("content-type", "application/x-www-form-urlencoded")
	\|> patch("/api/v1/accounts/update_credentials", fields)
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert account["fields"] == [
	%{"name" => "foo", "value" => "bar"},
	%{
	"name" => "link",
	"value" => ~S(<a href="http://cofe.io" rel="ugc">http://cofe.io</a>)
	}
	]

	assert account["source"]["fields"] == [
	%{"name" => "foo", "value" => "bar"},
	%{"name" => "link", "value" => "http://cofe.io"}
	]
	end

	test "update fields with empty name", %{conn: conn} do
	fields = [
	%{"name" => "foo", "value" => ""},
	%{"name" => "", "value" => "bar"}
	]

	account =
	conn
	\|> patch("/api/v1/accounts/update_credentials", %{"fields_attributes" => fields})
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert account["fields"] == [
	%{"name" => "foo", "value" => ""}
	]
	end

	test "update fields when invalid request", %{conn: conn} do
	name_limit = Pleroma.Config.get([:instance, :account_field_name_length])
	value_limit = Pleroma.Config.get([:instance, :account_field_value_length])

	long_name = Enum.map(0..name_limit, fn _ -> "x" end) \|> Enum.join()
	long_value = Enum.map(0..value_limit, fn _ -> "x" end) \|> Enum.join()

	fields = [%{"name" => "foo", "value" => long_value}]

	assert %{"error" => "Invalid request"} ==
	conn
	\|> patch("/api/v1/accounts/update_credentials", %{"fields_attributes" => fields})
	- \|> json_response(403)
	+ \|> json_response_and_validate_schema(403)

	fields = [%{"name" => long_name, "value" => "bar"}]

	assert %{"error" => "Invalid request"} ==
	conn
	\|> patch("/api/v1/accounts/update_credentials", %{"fields_attributes" => fields})
	- \|> json_response(403)
	+ \|> json_response_and_validate_schema(403)

	Pleroma.Config.put([:instance, :max_account_fields], 1)

	fields = [
	%{"name" => "foo", "value" => "bar"},
	%{"name" => "link", "value" => "cofe.io"}
	]

	assert %{"error" => "Invalid request"} ==
	conn
	\|> patch("/api/v1/accounts/update_credentials", %{"fields_attributes" => fields})
	- \|> json_response(403)
	+ \|> json_response_and_validate_schema(403)
	end
	end
	end
	diff --git a/test/web/mastodon_api/controllers/account_controller_test.exs b/test/web/mastodon_api/controllers/account_controller_test.exs
	index d885b5e08..ba70ba66c 100644
	--- a/test/web/mastodon_api/controllers/account_controller_test.exs
	+++ b/test/web/mastodon_api/controllers/account_controller_test.exs
	@@ -1,1253 +1,1198 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.Config
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.InternalFetchActor
	- alias Pleroma.Web.ApiSpec
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.OAuth.Token

	- import OpenApiSpex.TestAssertions
	import Pleroma.Factory

	describe "account fetching" do
	setup do: clear_config([:instance, :limit_to_local_content])

	test "works by id" do
	- user = insert(:user)
	+ %User{id: user_id} = insert(:user)

	- conn =
	- build_conn()
	- \|> get("/api/v1/accounts/#{user.id}")
	-
	- assert %{"id" => id} = json_response(conn, 200)
	- assert id == to_string(user.id)
	+ assert %{"id" => ^user_id} =
	+ build_conn()
	+ \|> get("/api/v1/accounts/#{user_id}")
	+ \|> json_response_and_validate_schema(200)

	- conn =
	- build_conn()
	- \|> get("/api/v1/accounts/-1")
	-
	- assert %{"error" => "Can't find user"} = json_response(conn, 404)
	+ assert %{"error" => "Can't find user"} =
	+ build_conn()
	+ \|> get("/api/v1/accounts/-1")
	+ \|> json_response_and_validate_schema(404)
	end

	test "works by nickname" do
	user = insert(:user)

	- conn =
	- build_conn()
	- \|> get("/api/v1/accounts/#{user.nickname}")
	-
	- assert %{"id" => id} = json_response(conn, 200)
	- assert id == user.id
	+ assert %{"id" => user_id} =
	+ build_conn()
	+ \|> get("/api/v1/accounts/#{user.nickname}")
	+ \|> json_response_and_validate_schema(200)
	end

	test "works by nickname for remote users" do
	Config.put([:instance, :limit_to_local_content], false)
	- user = insert(:user, nickname: "user@example.com", local: false)

	- conn =
	- build_conn()
	- \|> get("/api/v1/accounts/#{user.nickname}")
	+ user = insert(:user, nickname: "user@example.com", local: false)

	- assert %{"id" => id} = json_response(conn, 200)
	- assert id == user.id
	+ assert %{"id" => user_id} =
	+ build_conn()
	+ \|> get("/api/v1/accounts/#{user.nickname}")
	+ \|> json_response_and_validate_schema(200)
	end

	test "respects limit_to_local_content == :all for remote user nicknames" do
	Config.put([:instance, :limit_to_local_content], :all)

	user = insert(:user, nickname: "user@example.com", local: false)

	- conn =
	- build_conn()
	- \|> get("/api/v1/accounts/#{user.nickname}")
	-
	- assert json_response(conn, 404)
	+ assert build_conn()
	+ \|> get("/api/v1/accounts/#{user.nickname}")
	+ \|> json_response_and_validate_schema(404)
	end

	test "respects limit_to_local_content == :unauthenticated for remote user nicknames" do
	Config.put([:instance, :limit_to_local_content], :unauthenticated)

	user = insert(:user, nickname: "user@example.com", local: false)
	reading_user = insert(:user)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/#{user.nickname}")

	- assert json_response(conn, 404)
	+ assert json_response_and_validate_schema(conn, 404)

	conn =
	build_conn()
	\|> assign(:user, reading_user)
	\|> assign(:token, insert(:oauth_token, user: reading_user, scopes: ["read:accounts"]))
	\|> get("/api/v1/accounts/#{user.nickname}")

	- assert %{"id" => id} = json_response(conn, 200)
	+ assert %{"id" => id} = json_response_and_validate_schema(conn, 200)
	assert id == user.id
	end

	test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
	# Need to set an old-style integer ID to reproduce the problem
	# (these are no longer assigned to new accounts but were preserved
	# for existing accounts during the migration to flakeIDs)
	user_one = insert(:user, %{id: 1212})
	user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})

	- resp_one =
	+ acc_one =
	conn
	\|> get("/api/v1/accounts/#{user_one.id}")
	+ \|> json_response_and_validate_schema(:ok)

	- resp_two =
	+ acc_two =
	conn
	\|> get("/api/v1/accounts/#{user_two.nickname}")
	+ \|> json_response_and_validate_schema(:ok)

	- resp_three =
	+ acc_three =
	conn
	\|> get("/api/v1/accounts/#{user_two.id}")
	+ \|> json_response_and_validate_schema(:ok)

	- acc_one = json_response(resp_one, 200)
	- acc_two = json_response(resp_two, 200)
	- acc_three = json_response(resp_three, 200)
	refute acc_one == acc_two
	assert acc_two == acc_three
	end

	test "returns 404 when user is invisible", %{conn: conn} do
	user = insert(:user, %{invisible: true})

	- resp =
	- conn
	- \|> get("/api/v1/accounts/#{user.nickname}")
	- \|> json_response(404)
	-
	- assert %{"error" => "Can't find user"} = resp
	+ assert %{"error" => "Can't find user"} =
	+ conn
	+ \|> get("/api/v1/accounts/#{user.nickname}")
	+ \|> json_response_and_validate_schema(404)
	end

	test "returns 404 for internal.fetch actor", %{conn: conn} do
	%User{nickname: "internal.fetch"} = InternalFetchActor.get_actor()

	- resp =
	- conn
	- \|> get("/api/v1/accounts/internal.fetch")
	- \|> json_response(404)
	-
	- assert %{"error" => "Can't find user"} = resp
	+ assert %{"error" => "Can't find user"} =
	+ conn
	+ \|> get("/api/v1/accounts/internal.fetch")
	+ \|> json_response_and_validate_schema(404)
	end
	end

	defp local_and_remote_users do
	local = insert(:user)
	remote = insert(:user, local: false)
	{:ok, local: local, remote: remote}
	end

	describe "user fetching with restrict unauthenticated profiles for local and remote" do
	setup do: local_and_remote_users()

	setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)

	setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	- res_conn = get(conn, "/api/v1/accounts/#{local.id}")
	-
	- assert json_response(res_conn, :not_found) == %{
	- "error" => "Can't find user"
	- }
	-
	- res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
	+ assert %{"error" => "Can't find user"} ==
	+ conn
	+ \|> get("/api/v1/accounts/#{local.id}")
	+ \|> json_response_and_validate_schema(:not_found)

	- assert json_response(res_conn, :not_found) == %{
	- "error" => "Can't find user"
	- }
	+ assert %{"error" => "Can't find user"} ==
	+ conn
	+ \|> get("/api/v1/accounts/#{remote.id}")
	+ \|> json_response_and_validate_schema(:not_found)
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/accounts/#{local.id}")
	- assert %{"id" => _} = json_response(res_conn, 200)
	+ assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
	- assert %{"id" => _} = json_response(res_conn, 200)
	+ assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
	end
	end

	describe "user fetching with restrict unauthenticated profiles for local" do
	setup do: local_and_remote_users()

	setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/accounts/#{local.id}")

	- assert json_response(res_conn, :not_found) == %{
	+ assert json_response_and_validate_schema(res_conn, :not_found) == %{
	"error" => "Can't find user"
	}

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
	- assert %{"id" => _} = json_response(res_conn, 200)
	+ assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/accounts/#{local.id}")
	- assert %{"id" => _} = json_response(res_conn, 200)
	+ assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
	- assert %{"id" => _} = json_response(res_conn, 200)
	+ assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
	end
	end

	describe "user fetching with restrict unauthenticated profiles for remote" do
	setup do: local_and_remote_users()

	setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/accounts/#{local.id}")
	- assert %{"id" => _} = json_response(res_conn, 200)
	+ assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}")

	- assert json_response(res_conn, :not_found) == %{
	+ assert json_response_and_validate_schema(res_conn, :not_found) == %{
	"error" => "Can't find user"
	}
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/accounts/#{local.id}")
	- assert %{"id" => _} = json_response(res_conn, 200)
	+ assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}")
	- assert %{"id" => _} = json_response(res_conn, 200)
	+ assert %{"id" => _} = json_response_and_validate_schema(res_conn, 200)
	end
	end

	describe "user timelines" do
	setup do: oauth_access(["read:statuses"])

	test "respects blocks", %{user: user_one, conn: conn} do
	user_two = insert(:user)
	user_three = insert(:user)

	User.block(user_one, user_two)

	{:ok, activity} = CommonAPI.post(user_two, %{"status" => "User one sux0rz"})
	{:ok, repeat, _} = CommonAPI.repeat(activity.id, user_three)

	- assert resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses") \|> json_response(200)
	+ assert resp =
	+ conn
	+ \|> get("/api/v1/accounts/#{user_two.id}/statuses")
	+ \|> json_response_and_validate_schema(200)
	+
	assert [%{"id" => id}] = resp
	- assert_schema(resp, "StatusesResponse", ApiSpec.spec())
	assert id == activity.id

	# Even a blocked user will deliver the full user timeline, there would be
	# no point in looking at a blocked users timeline otherwise
	- assert resp = get(conn, "/api/v1/accounts/#{user_two.id}/statuses") \|> json_response(200)
	+ assert resp =
	+ conn
	+ \|> get("/api/v1/accounts/#{user_two.id}/statuses")
	+ \|> json_response_and_validate_schema(200)
	+
	assert [%{"id" => id}] = resp
	assert id == activity.id
	- assert_schema(resp, "StatusesResponse", ApiSpec.spec())

	# Third user's timeline includes the repeat when viewed by unauthenticated user
	- resp = get(build_conn(), "/api/v1/accounts/#{user_three.id}/statuses") \|> json_response(200)
	+ resp =
	+ build_conn()
	+ \|> get("/api/v1/accounts/#{user_three.id}/statuses")
	+ \|> json_response_and_validate_schema(200)
	+
	assert [%{"id" => id}] = resp
	assert id == repeat.id
	- assert_schema(resp, "StatusesResponse", ApiSpec.spec())

	# When viewing a third user's timeline, the blocked users' statuses will NOT be shown
	resp = get(conn, "/api/v1/accounts/#{user_three.id}/statuses")

	- assert [] = json_response(resp, 200)
	+ assert [] == json_response_and_validate_schema(resp, 200)
	end

	test "gets users statuses", %{conn: conn} do
	user_one = insert(:user)
	user_two = insert(:user)
	user_three = insert(:user)

	{:ok, _user_three} = User.follow(user_three, user_one)

	{:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})

	{:ok, direct_activity} =
	CommonAPI.post(user_one, %{
	"status" => "Hi, @#{user_two.nickname}.",
	"visibility" => "direct"
	})

	{:ok, private_activity} =
	CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})

	- resp = get(conn, "/api/v1/accounts/#{user_one.id}/statuses") \|> json_response(200)
	+ # TODO!!!
	+ resp =
	+ conn
	+ \|> get("/api/v1/accounts/#{user_one.id}/statuses")
	+ \|> json_response_and_validate_schema(200)
	+
	assert [%{"id" => id}] = resp
	assert id == to_string(activity.id)
	- assert_schema(resp, "StatusesResponse", ApiSpec.spec())

	resp =
	conn
	\|> assign(:user, user_two)
	\|> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
	\|> get("/api/v1/accounts/#{user_one.id}/statuses")
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert [%{"id" => id_one}, %{"id" => id_two}] = resp
	assert id_one == to_string(direct_activity.id)
	assert id_two == to_string(activity.id)
	- assert_schema(resp, "StatusesResponse", ApiSpec.spec())

	resp =
	conn
	\|> assign(:user, user_three)
	\|> assign(:token, insert(:oauth_token, user: user_three, scopes: ["read:statuses"]))
	\|> get("/api/v1/accounts/#{user_one.id}/statuses")
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert [%{"id" => id_one}, %{"id" => id_two}] = resp
	assert id_one == to_string(private_activity.id)
	assert id_two == to_string(activity.id)
	- assert_schema(resp, "StatusesResponse", ApiSpec.spec())
	end

	test "unimplemented pinned statuses feature", %{conn: conn} do
	note = insert(:note_activity)
	user = User.get_cached_by_ap_id(note.data["actor"])

	conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?pinned=true")

	- assert json_response(conn, 200) == []
	+ assert json_response_and_validate_schema(conn, 200) == []
	end

	test "gets an users media", %{conn: conn} do
	note = insert(:note_activity)
	user = User.get_cached_by_ap_id(note.data["actor"])

	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, %{id: media_id}} = ActivityPub.upload(file, actor: user.ap_id)

	- {:ok, image_post} = CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})
	+ {:ok, %{id: image_post_id}} =
	+ CommonAPI.post(user, %{"status" => "cofe", "media_ids" => [media_id]})

	conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?only_media=true")

	- assert [%{"id" => id}] = json_response(conn, 200)
	- assert id == to_string(image_post.id)
	- assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)

	conn = get(build_conn(), "/api/v1/accounts/#{user.id}/statuses?only_media=1")

	- assert [%{"id" => id}] = json_response(conn, 200)
	- assert id == to_string(image_post.id)
	- assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert [%{"id" => ^image_post_id}] = json_response_and_validate_schema(conn, 200)
	end

	test "gets a user's statuses without reblogs", %{user: user, conn: conn} do
	- {:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
	- {:ok, _, _} = CommonAPI.repeat(post.id, user)
	+ {:ok, %{id: post_id}} = CommonAPI.post(user, %{"status" => "HI!!!"})
	+ {:ok, _, _} = CommonAPI.repeat(post_id, user)

	conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=true")
	-
	- assert [%{"id" => id}] = json_response(conn, 200)
	- assert id == to_string(post.id)
	- assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)

	conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_reblogs=1")
	-
	- assert [%{"id" => id}] = json_response(conn, 200)
	- assert id == to_string(post.id)
	- assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
	end

	test "filters user's statuses by a hashtag", %{user: user, conn: conn} do
	- {:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
	+ {:ok, %{id: post_id}} = CommonAPI.post(user, %{"status" => "#hashtag"})
	{:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})

	conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?tagged=hashtag")
	-
	- assert [%{"id" => id}] = json_response(conn, 200)
	- assert id == to_string(post.id)
	- assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert [%{"id" => ^post_id}] = json_response_and_validate_schema(conn, 200)
	end

	test "the user views their own timelines and excludes direct messages", %{
	user: user,
	conn: conn
	} do
	- {:ok, public_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
	+ {:ok, %{id: public_activity_id}} =
	+ CommonAPI.post(user, %{"status" => ".", "visibility" => "public"})
	+
	{:ok, _direct_activity} = CommonAPI.post(user, %{"status" => ".", "visibility" => "direct"})

	conn = get(conn, "/api/v1/accounts/#{user.id}/statuses?exclude_visibilities[]=direct")
	-
	- assert [%{"id" => id}] = json_response(conn, 200)
	- assert id == to_string(public_activity.id)
	- assert_schema(json_response(conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert [%{"id" => ^public_activity_id}] = json_response_and_validate_schema(conn, 200)
	end
	end

	defp local_and_remote_activities(%{local: local, remote: remote}) do
	insert(:note_activity, user: local)
	insert(:note_activity, user: remote, local: false)

	:ok
	end

	describe "statuses with restrict unauthenticated profiles for local and remote" do
	setup do: local_and_remote_users()
	setup :local_and_remote_activities

	setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)

	setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	- res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
	-
	- assert json_response(res_conn, :not_found) == %{
	- "error" => "Can't find user"
	- }
	-
	- res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
	+ assert %{"error" => "Can't find user"} ==
	+ conn
	+ \|> get("/api/v1/accounts/#{local.id}/statuses")
	+ \|> json_response_and_validate_schema(:not_found)

	- assert json_response(res_conn, :not_found) == %{
	- "error" => "Can't find user"
	- }
	+ assert %{"error" => "Can't find user"} ==
	+ conn
	+ \|> get("/api/v1/accounts/#{remote.id}/statuses")
	+ \|> json_response_and_validate_schema(:not_found)
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
	- assert length(json_response(res_conn, 200)) == 1
	- assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
	- assert length(json_response(res_conn, 200)) == 1
	- assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1
	end
	end

	describe "statuses with restrict unauthenticated profiles for local" do
	setup do: local_and_remote_users()
	setup :local_and_remote_activities

	setup do: clear_config([:restrict_unauthenticated, :profiles, :local], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	- res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
	-
	- assert json_response(res_conn, :not_found) == %{
	- "error" => "Can't find user"
	- }
	+ assert %{"error" => "Can't find user"} ==
	+ conn
	+ \|> get("/api/v1/accounts/#{local.id}/statuses")
	+ \|> json_response_and_validate_schema(:not_found)

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
	- assert length(json_response(res_conn, 200)) == 1
	- assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
	- assert length(json_response(res_conn, 200)) == 1
	- assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
	- assert length(json_response(res_conn, 200)) == 1
	- assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1
	end
	end

	describe "statuses with restrict unauthenticated profiles for remote" do
	setup do: local_and_remote_users()
	setup :local_and_remote_activities

	setup do: clear_config([:restrict_unauthenticated, :profiles, :remote], true)

	test "if user is unauthenticated", %{conn: conn, local: local, remote: remote} do
	res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
	- assert length(json_response(res_conn, 200)) == 1
	- assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1

	- res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
	-
	- assert json_response(res_conn, :not_found) == %{
	- "error" => "Can't find user"
	- }
	+ assert %{"error" => "Can't find user"} ==
	+ conn
	+ \|> get("/api/v1/accounts/#{remote.id}/statuses")
	+ \|> json_response_and_validate_schema(:not_found)
	end

	test "if user is authenticated", %{local: local, remote: remote} do
	%{conn: conn} = oauth_access(["read"])

	res_conn = get(conn, "/api/v1/accounts/#{local.id}/statuses")
	- assert length(json_response(res_conn, 200)) == 1
	- assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1

	res_conn = get(conn, "/api/v1/accounts/#{remote.id}/statuses")
	- assert length(json_response(res_conn, 200)) == 1
	- assert_schema(json_response(res_conn, 200), "StatusesResponse", ApiSpec.spec())
	+ assert length(json_response_and_validate_schema(res_conn, 200)) == 1
	end
	end

	describe "followers" do
	setup do: oauth_access(["read:accounts"])

	test "getting followers", %{user: user, conn: conn} do
	other_user = insert(:user)
	- {:ok, user} = User.follow(user, other_user)
	+ {:ok, %{id: user_id}} = User.follow(user, other_user)

	conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")

	- assert [%{"id" => id}] = json_response(conn, 200)
	- assert id == to_string(user.id)
	- assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
	+ assert [%{"id" => ^user_id}] = json_response_and_validate_schema(conn, 200)
	end

	test "getting followers, hide_followers", %{user: user, conn: conn} do
	other_user = insert(:user, hide_followers: true)
	{:ok, _user} = User.follow(user, other_user)

	conn = get(conn, "/api/v1/accounts/#{other_user.id}/followers")

	- assert [] == json_response(conn, 200)
	+ assert [] == json_response_and_validate_schema(conn, 200)
	end

	test "getting followers, hide_followers, same user requesting" do
	user = insert(:user)
	other_user = insert(:user, hide_followers: true)
	{:ok, _user} = User.follow(user, other_user)

	conn =
	build_conn()
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
	\|> get("/api/v1/accounts/#{other_user.id}/followers")

	- refute [] == json_response(conn, 200)
	- assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
	+ refute [] == json_response_and_validate_schema(conn, 200)
	end

	test "getting followers, pagination", %{user: user, conn: conn} do
	- follower1 = insert(:user)
	- follower2 = insert(:user)
	- follower3 = insert(:user)
	- {:ok, _} = User.follow(follower1, user)
	- {:ok, _} = User.follow(follower2, user)
	- {:ok, _} = User.follow(follower3, user)
	-
	- res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")
	+ {:ok, %User{id: follower1_id}} = :user \|> insert() \|> User.follow(user)
	+ {:ok, %User{id: follower2_id}} = :user \|> insert() \|> User.follow(user)
	+ {:ok, %User{id: follower3_id}} = :user \|> insert() \|> User.follow(user)

	- assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
	- assert id3 == follower3.id
	- assert id2 == follower2.id
	- assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())
	-
	- res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")
	+ assert [%{"id" => ^follower3_id}, %{"id" => ^follower2_id}] =
	+ conn
	+ \|> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1_id}")
	+ \|> json_response_and_validate_schema(200)

	- assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
	- assert id2 == follower2.id
	- assert id1 == follower1.id
	+ assert [%{"id" => ^follower2_id}, %{"id" => ^follower1_id}] =
	+ conn
	+ \|> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3_id}")
	+ \|> json_response_and_validate_schema(200)

	- res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")
	+ res_conn = get(conn, "/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3_id}")

	- assert [%{"id" => id2}] = json_response(res_conn, 200)
	- assert id2 == follower2.id
	+ assert [%{"id" => ^follower2_id}] = json_response_and_validate_schema(res_conn, 200)

	assert [link_header] = get_resp_header(res_conn, "link")
	- assert link_header =~ ~r/min_id=#{follower2.id}/
	- assert link_header =~ ~r/max_id=#{follower2.id}/
	- assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())
	+ assert link_header =~ ~r/min_id=#{follower2_id}/
	+ assert link_header =~ ~r/max_id=#{follower2_id}/
	end
	end

	describe "following" do
	setup do: oauth_access(["read:accounts"])

	test "getting following", %{user: user, conn: conn} do
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn = get(conn, "/api/v1/accounts/#{user.id}/following")

	- assert [%{"id" => id}] = json_response(conn, 200)
	+ assert [%{"id" => id}] = json_response_and_validate_schema(conn, 200)
	assert id == to_string(other_user.id)
	- assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
	end

	test "getting following, hide_follows, other user requesting" do
	user = insert(:user, hide_follows: true)
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	build_conn()
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:accounts"]))
	\|> get("/api/v1/accounts/#{user.id}/following")

	- assert [] == json_response(conn, 200)
	- assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
	+ assert [] == json_response_and_validate_schema(conn, 200)
	end

	test "getting following, hide_follows, same user requesting" do
	user = insert(:user, hide_follows: true)
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["read:accounts"]))
	\|> get("/api/v1/accounts/#{user.id}/following")

	- refute [] == json_response(conn, 200)
	+ refute [] == json_response_and_validate_schema(conn, 200)
	end

	test "getting following, pagination", %{user: user, conn: conn} do
	following1 = insert(:user)
	following2 = insert(:user)
	following3 = insert(:user)
	{:ok, _} = User.follow(user, following1)
	{:ok, _} = User.follow(user, following2)
	{:ok, _} = User.follow(user, following3)

	res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")

	- assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
	+ assert [%{"id" => id3}, %{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
	assert id3 == following3.id
	assert id2 == following2.id
	- assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())

	res_conn = get(conn, "/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")

	- assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
	+ assert [%{"id" => id2}, %{"id" => id1}] = json_response_and_validate_schema(res_conn, 200)
	assert id2 == following2.id
	assert id1 == following1.id
	- assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())

	res_conn =
	get(conn, "/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")

	- assert [%{"id" => id2}] = json_response(res_conn, 200)
	+ assert [%{"id" => id2}] = json_response_and_validate_schema(res_conn, 200)
	assert id2 == following2.id

	assert [link_header] = get_resp_header(res_conn, "link")
	assert link_header =~ ~r/min_id=#{following2.id}/
	assert link_header =~ ~r/max_id=#{following2.id}/
	- assert_schema(json_response(res_conn, 200), "AccountsResponse", ApiSpec.spec())
	end
	end

	describe "follow/unfollow" do
	setup do: oauth_access(["follow"])

	test "following / unfollowing a user", %{conn: conn} do
	- other_user = insert(:user)
	-
	- ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/follow")
	-
	- assert %{"id" => _id, "following" => true} = json_response(ret_conn, 200)
	- assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
	+ %{id: other_user_id, nickname: other_user_nickname} = insert(:user)

	- ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/unfollow")
	-
	- assert %{"id" => _id, "following" => false} = json_response(ret_conn, 200)
	- assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
	+ assert %{"id" => _id, "following" => true} =
	+ conn
	+ \|> post("/api/v1/accounts/#{other_user_id}/follow")
	+ \|> json_response_and_validate_schema(200)

	- conn =
	- conn
	- \|> put_req_header("content-type", "application/json")
	- \|> post("/api/v1/follows", %{"uri" => other_user.nickname})
	+ assert %{"id" => _id, "following" => false} =
	+ conn
	+ \|> post("/api/v1/accounts/#{other_user_id}/unfollow")
	+ \|> json_response_and_validate_schema(200)

	- assert %{"id" => id} = json_response(conn, 200)
	- assert id == to_string(other_user.id)
	- assert_schema(json_response(conn, 200), "Account", ApiSpec.spec())
	+ assert %{"id" => ^other_user_id} =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/follows", %{"uri" => other_user_nickname})
	+ \|> json_response_and_validate_schema(200)
	end

	test "cancelling follow request", %{conn: conn} do
	%{id: other_user_id} = insert(:user, %{locked: true})

	- resp = conn \|> post("/api/v1/accounts/#{other_user_id}/follow") \|> json_response(:ok)
	-
	- assert %{"id" => ^other_user_id, "following" => false, "requested" => true} = resp
	- assert_schema(resp, "AccountRelationship", ApiSpec.spec())
	-
	- resp = conn \|> post("/api/v1/accounts/#{other_user_id}/unfollow") \|> json_response(:ok)
	+ assert %{"id" => ^other_user_id, "following" => false, "requested" => true} =
	+ conn
	+ \|> post("/api/v1/accounts/#{other_user_id}/follow")
	+ \|> json_response_and_validate_schema(:ok)

	- assert %{"id" => ^other_user_id, "following" => false, "requested" => false} = resp
	- assert_schema(resp, "AccountRelationship", ApiSpec.spec())
	+ assert %{"id" => ^other_user_id, "following" => false, "requested" => false} =
	+ conn
	+ \|> post("/api/v1/accounts/#{other_user_id}/unfollow")
	+ \|> json_response_and_validate_schema(:ok)
	end

	test "following without reblogs" do
	%{conn: conn} = oauth_access(["follow", "read:statuses"])
	followed = insert(:user)
	other_user = insert(:user)

	ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=false")

	- assert %{"showing_reblogs" => false} = json_response(ret_conn, 200)
	- assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
	+ assert %{"showing_reblogs" => false} = json_response_and_validate_schema(ret_conn, 200)

	{:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
	- {:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)
	-
	- ret_conn = get(conn, "/api/v1/timelines/home")
	+ {:ok, %{id: reblog_id}, _} = CommonAPI.repeat(activity.id, followed)

	- assert [] == json_response(ret_conn, 200)
	-
	- ret_conn = post(conn, "/api/v1/accounts/#{followed.id}/follow?reblogs=true")
	-
	- assert %{"showing_reblogs" => true} = json_response(ret_conn, 200)
	- assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
	+ assert [] ==
	+ conn
	+ \|> get("/api/v1/timelines/home")
	+ \|> json_response(200)

	- conn = get(conn, "/api/v1/timelines/home")
	+ assert %{"showing_reblogs" => true} =
	+ conn
	+ \|> post("/api/v1/accounts/#{followed.id}/follow?reblogs=true")
	+ \|> json_response_and_validate_schema(200)

	- expected_activity_id = reblog.id
	- assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
	+ assert [%{"id" => ^reblog_id}] =
	+ conn
	+ \|> get("/api/v1/timelines/home")
	+ \|> json_response(200)
	end

	test "following / unfollowing errors", %{user: user, conn: conn} do
	# self follow
	conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
	- assert %{"error" => "Can not follow yourself"} = json_response(conn_res, 400)
	+
	+ assert %{"error" => "Can not follow yourself"} =
	+ json_response_and_validate_schema(conn_res, 400)

	# self unfollow
	user = User.get_cached_by_id(user.id)
	conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
	- assert %{"error" => "Can not unfollow yourself"} = json_response(conn_res, 400)
	+
	+ assert %{"error" => "Can not unfollow yourself"} =
	+ json_response_and_validate_schema(conn_res, 400)

	# self follow via uri
	user = User.get_cached_by_id(user.id)

	- conn_res =
	- conn
	- \|> put_req_header("content-type", "multipart/form-data")
	- \|> post("/api/v1/follows", %{"uri" => user.nickname})
	-
	- assert %{"error" => "Can not follow yourself"} = json_response(conn_res, 400)
	+ assert %{"error" => "Can not follow yourself"} =
	+ conn
	+ \|> put_req_header("content-type", "multipart/form-data")
	+ \|> post("/api/v1/follows", %{"uri" => user.nickname})
	+ \|> json_response_and_validate_schema(400)

	# follow non existing user
	conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
	- assert %{"error" => "Record not found"} = json_response(conn_res, 404)
	+ assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)

	# follow non existing user via uri
	conn_res =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/v1/follows", %{"uri" => "doesntexist"})

	- assert %{"error" => "Record not found"} = json_response(conn_res, 404)
	+ assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)

	# unfollow non existing user
	conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
	- assert %{"error" => "Record not found"} = json_response(conn_res, 404)
	+ assert %{"error" => "Record not found"} = json_response_and_validate_schema(conn_res, 404)
	end
	end

	describe "mute/unmute" do
	setup do: oauth_access(["write:mutes"])

	test "with notifications", %{conn: conn} do
	other_user = insert(:user)

	- ret_conn =
	- conn
	- \|> put_req_header("content-type", "application/json")
	- \|> post("/api/v1/accounts/#{other_user.id}/mute")
	-
	- response = json_response(ret_conn, 200)
	-
	- assert %{"id" => _id, "muting" => true, "muting_notifications" => true} = response
	- assert_schema(response, "AccountRelationship", ApiSpec.spec())
	+ assert %{"id" => _id, "muting" => true, "muting_notifications" => true} =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/accounts/#{other_user.id}/mute")
	+ \|> json_response_and_validate_schema(200)

	conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")

	- response = json_response(conn, 200)
	- assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
	- assert_schema(response, "AccountRelationship", ApiSpec.spec())
	+ assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
	+ json_response_and_validate_schema(conn, 200)
	end

	test "without notifications", %{conn: conn} do
	other_user = insert(:user)

	ret_conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/v1/accounts/#{other_user.id}/mute", %{"notifications" => "false"})

	- response = json_response(ret_conn, 200)
	-
	- assert %{"id" => _id, "muting" => true, "muting_notifications" => false} = response
	- assert_schema(response, "AccountRelationship", ApiSpec.spec())
	+ assert %{"id" => _id, "muting" => true, "muting_notifications" => false} =
	+ json_response_and_validate_schema(ret_conn, 200)

	conn = post(conn, "/api/v1/accounts/#{other_user.id}/unmute")

	- response = json_response(conn, 200)
	- assert %{"id" => _id, "muting" => false, "muting_notifications" => false} = response
	- assert_schema(response, "AccountRelationship", ApiSpec.spec())
	+ assert %{"id" => _id, "muting" => false, "muting_notifications" => false} =
	+ json_response_and_validate_schema(conn, 200)
	end
	end

	describe "pinned statuses" do
	setup do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
	%{conn: conn} = oauth_access(["read:statuses"], user: user)

	[conn: conn, user: user, activity: activity]
	end

	- test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
	- {:ok, _} = CommonAPI.pin(activity.id, user)
	+ test "returns pinned statuses", %{conn: conn, user: user, activity: %{id: activity_id}} do
	+ {:ok, _} = CommonAPI.pin(activity_id, user)

	- result =
	- conn
	- \|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
	- \|> json_response(200)
	-
	- id_str = to_string(activity.id)
	-
	- assert [%{"id" => ^id_str, "pinned" => true}] = result
	+ assert [%{"id" => ^activity_id, "pinned" => true}] =
	+ conn
	+ \|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
	+ \|> json_response_and_validate_schema(200)
	end
	end

	test "blocking / unblocking a user" do
	%{conn: conn} = oauth_access(["follow"])
	other_user = insert(:user)

	ret_conn = post(conn, "/api/v1/accounts/#{other_user.id}/block")

	- assert %{"id" => _id, "blocking" => true} = json_response(ret_conn, 200)
	- assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
	+ assert %{"id" => _id, "blocking" => true} = json_response_and_validate_schema(ret_conn, 200)

	conn = post(conn, "/api/v1/accounts/#{other_user.id}/unblock")

	- assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
	- assert_schema(json_response(ret_conn, 200), "AccountRelationship", ApiSpec.spec())
	+ assert %{"id" => _id, "blocking" => false} = json_response_and_validate_schema(conn, 200)
	end

	describe "create account by app" do
	setup do
	valid_params = %{
	username: "lain",
	email: "lain@example.org",
	password: "PlzDontHackLain",
	agreement: true
	}

	[valid_params: valid_params]
	end

	setup do: clear_config([:instance, :account_activation_required])

	test "Account registration via Application", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/apps", %{
	client_name: "client_name",
	redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
	scopes: "read, write, follow"
	})

	- %{
	- "client_id" => client_id,
	- "client_secret" => client_secret,
	- "id" => _,
	- "name" => "client_name",
	- "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
	- "vapid_key" => _,
	- "website" => nil
	- } = json_response(conn, 200)
	+ assert %{
	+ "client_id" => client_id,
	+ "client_secret" => client_secret,
	+ "id" => _,
	+ "name" => "client_name",
	+ "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
	+ "vapid_key" => _,
	+ "website" => nil
	+ } = json_response_and_validate_schema(conn, 200)

	conn =
	post(conn, "/oauth/token", %{
	grant_type: "client_credentials",
	client_id: client_id,
	client_secret: client_secret
	})

	assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
	json_response(conn, 200)

	assert token
	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	assert refresh
	assert scope == "read write follow"

	conn =
	build_conn()
	\|> put_req_header("content-type", "multipart/form-data")
	\|> put_req_header("authorization", "Bearer " <> token)
	\|> post("/api/v1/accounts", %{
	username: "lain",
	email: "lain@example.org",
	password: "PlzDontHackLain",
	bio: "Test Bio",
	agreement: true
	})

	%{
	"access_token" => token,
	"created_at" => _created_at,
	"scope" => _scope,
	"token_type" => "Bearer"
	- } = json_response(conn, 200)
	+ } = json_response_and_validate_schema(conn, 200)

	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	token_from_db = Repo.preload(token_from_db, :user)
	assert token_from_db.user

	assert token_from_db.user.confirmation_pending
	end

	test "returns error when user already registred", %{conn: conn, valid_params: valid_params} do
	_user = insert(:user, email: "lain@example.org")
	app_token = insert(:oauth_token, user: nil)

	res =
	conn
	\|> put_req_header("authorization", "Bearer " <> app_token.token)
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/accounts", valid_params)

	- assert json_response(res, 400) == %{"error" => "{\"email\":[\"has already been taken\"]}"}
	+ assert json_response_and_validate_schema(res, 400) == %{
	+ "error" => "{\"email\":[\"has already been taken\"]}"
	+ }
	end

	test "returns bad_request if missing required params", %{
	conn: conn,
	valid_params: valid_params
	} do
	app_token = insert(:oauth_token, user: nil)

	conn =
	conn
	\|> put_req_header("authorization", "Bearer " <> app_token.token)
	\|> put_req_header("content-type", "application/json")

	res = post(conn, "/api/v1/accounts", valid_params)
	- assert json_response(res, 200)
	+ assert json_response_and_validate_schema(res, 200)

	[{127, 0, 0, 1}, {127, 0, 0, 2}, {127, 0, 0, 3}, {127, 0, 0, 4}]
	\|> Stream.zip(Map.delete(valid_params, :email))
	\|> Enum.each(fn {ip, {attr, _}} ->
	res =
	conn
	\|> Map.put(:remote_ip, ip)
	\|> post("/api/v1/accounts", Map.delete(valid_params, attr))
	- \|> json_response(400)
	+ \|> json_response_and_validate_schema(400)

	assert res == %{
	"error" => "Missing field: #{attr}.",
	"errors" => [
	%{
	"message" => "Missing field: #{attr}",
	"source" => %{"pointer" => "/#{attr}"},
	"title" => "Invalid value"
	}
	]
	}
	end)
	end

	setup do: clear_config([:instance, :account_activation_required])

	test "returns bad_request if missing email params when :account_activation_required is enabled",
	%{conn: conn, valid_params: valid_params} do
	Pleroma.Config.put([:instance, :account_activation_required], true)

	app_token = insert(:oauth_token, user: nil)

	conn =
	conn
	\|> put_req_header("authorization", "Bearer " <> app_token.token)
	\|> put_req_header("content-type", "application/json")

	res =
	conn
	\|> Map.put(:remote_ip, {127, 0, 0, 5})
	\|> post("/api/v1/accounts", Map.delete(valid_params, :email))

	- assert json_response(res, 400) == %{"error" => "Missing parameters"}
	+ assert json_response_and_validate_schema(res, 400) == %{"error" => "Missing parameters"}

	res =
	conn
	\|> Map.put(:remote_ip, {127, 0, 0, 6})
	\|> post("/api/v1/accounts", Map.put(valid_params, :email, ""))

	- assert json_response(res, 400) == %{"error" => "{\"email\":[\"can't be blank\"]}"}
	+ assert json_response_and_validate_schema(res, 400) == %{
	+ "error" => "{\"email\":[\"can't be blank\"]}"
	+ }
	end

	test "allow registration without an email", %{conn: conn, valid_params: valid_params} do
	app_token = insert(:oauth_token, user: nil)
	conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)

	res =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> Map.put(:remote_ip, {127, 0, 0, 7})
	\|> post("/api/v1/accounts", Map.delete(valid_params, :email))

	- assert json_response(res, 200)
	+ assert json_response_and_validate_schema(res, 200)
	end

	test "allow registration with an empty email", %{conn: conn, valid_params: valid_params} do
	app_token = insert(:oauth_token, user: nil)
	conn = put_req_header(conn, "authorization", "Bearer " <> app_token.token)

	res =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> Map.put(:remote_ip, {127, 0, 0, 8})
	\|> post("/api/v1/accounts", Map.put(valid_params, :email, ""))

	- assert json_response(res, 200)
	+ assert json_response_and_validate_schema(res, 200)
	end

	test "returns forbidden if token is invalid", %{conn: conn, valid_params: valid_params} do
	res =
	conn
	\|> put_req_header("authorization", "Bearer " <> "invalid-token")
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/v1/accounts", valid_params)

	- assert json_response(res, 403) == %{"error" => "Invalid credentials"}
	+ assert json_response_and_validate_schema(res, 403) == %{"error" => "Invalid credentials"}
	end

	test "registration from trusted app" do
	clear_config([Pleroma.Captcha, :enabled], true)
	app = insert(:oauth_app, trusted: true, scopes: ["read", "write", "follow", "push"])

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "client_credentials",
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "token_type" => "Bearer"} = json_response(conn, 200)

	response =
	build_conn()
	\|> Plug.Conn.put_req_header("authorization", "Bearer " <> token)
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/v1/accounts", %{
	nickname: "nickanme",
	agreement: true,
	email: "email@example.com",
	fullname: "Lain",
	username: "Lain",
	password: "some_password",
	confirm: "some_password"
	})
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert %{
	"access_token" => access_token,
	"created_at" => _,
	"scope" => ["read", "write", "follow", "push"],
	"token_type" => "Bearer"
	} = response

	response =
	build_conn()
	\|> Plug.Conn.put_req_header("authorization", "Bearer " <> access_token)
	\|> get("/api/v1/accounts/verify_credentials")
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert %{
	"acct" => "Lain",
	"bot" => false,
	"display_name" => "Lain",
	"follow_requests_count" => 0,
	"followers_count" => 0,
	"following_count" => 0,
	"locked" => false,
	"note" => "",
	"source" => %{
	"fields" => [],
	"note" => "",
	"pleroma" => %{
	"actor_type" => "Person",
	"discoverable" => false,
	"no_rich_text" => false,
	"show_role" => true
	},
	"privacy" => "public",
	"sensitive" => false
	},
	"statuses_count" => 0,
	"username" => "Lain"
	} = response
	end
	end

	describe "create account by app / rate limit" do
	setup do: clear_config([:rate_limit, :app_account_creation], {10_000, 2})

	test "respects rate limit setting", %{conn: conn} do
	app_token = insert(:oauth_token, user: nil)

	conn =
	conn
	\|> put_req_header("authorization", "Bearer " <> app_token.token)
	\|> Map.put(:remote_ip, {15, 15, 15, 15})
	\|> put_req_header("content-type", "multipart/form-data")

	for i <- 1..2 do
	conn =
	conn
	\|> post("/api/v1/accounts", %{
	username: "#{i}lain",
	email: "#{i}lain@example.org",
	password: "PlzDontHackLain",
	agreement: true
	})

	%{
	"access_token" => token,
	"created_at" => _created_at,
	"scope" => _scope,
	"token_type" => "Bearer"
	- } = json_response(conn, 200)
	+ } = json_response_and_validate_schema(conn, 200)

	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	token_from_db = Repo.preload(token_from_db, :user)
	assert token_from_db.user

	assert token_from_db.user.confirmation_pending
	end

	conn =
	post(conn, "/api/v1/accounts", %{
	username: "6lain",
	email: "6lain@example.org",
	password: "PlzDontHackLain",
	agreement: true
	})

	- assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
	+ assert json_response_and_validate_schema(conn, :too_many_requests) == %{
	+ "error" => "Throttled"
	+ }
	end
	end

	describe "GET /api/v1/accounts/:id/lists - account_lists" do
	test "returns lists to which the account belongs" do
	%{user: user, conn: conn} = oauth_access(["read:lists"])
	other_user = insert(:user)
	- assert {:ok, %Pleroma.List{} = list} = Pleroma.List.create("Test List", user)
	+ assert {:ok, %Pleroma.List{id: list_id} = list} = Pleroma.List.create("Test List", user)
	{:ok, %{following: _following}} = Pleroma.List.follow(list, other_user)

	- res =
	- conn
	- \|> get("/api/v1/accounts/#{other_user.id}/lists")
	- \|> json_response(200)
	-
	- assert res == [%{"id" => to_string(list.id), "title" => "Test List"}]
	- assert_schema(res, "ListsResponse", ApiSpec.spec())
	+ assert [%{"id" => list_id, "title" => "Test List"}] =
	+ conn
	+ \|> get("/api/v1/accounts/#{other_user.id}/lists")
	+ \|> json_response_and_validate_schema(200)
	end
	end

	describe "verify_credentials" do
	test "verify_credentials" do
	%{user: user, conn: conn} = oauth_access(["read:accounts"])
	conn = get(conn, "/api/v1/accounts/verify_credentials")

	- response = json_response(conn, 200)
	+ response = json_response_and_validate_schema(conn, 200)

	assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
	assert response["pleroma"]["chat_token"]
	assert id == to_string(user.id)
	end

	test "verify_credentials default scope unlisted" do
	user = insert(:user, default_scope: "unlisted")
	%{conn: conn} = oauth_access(["read:accounts"], user: user)

	conn = get(conn, "/api/v1/accounts/verify_credentials")

	- assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
	+ assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} =
	+ json_response_and_validate_schema(conn, 200)
	+
	assert id == to_string(user.id)
	end

	test "locked accounts" do
	user = insert(:user, default_scope: "private")
	%{conn: conn} = oauth_access(["read:accounts"], user: user)

	conn = get(conn, "/api/v1/accounts/verify_credentials")

	- assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
	+ assert %{"id" => id, "source" => %{"privacy" => "private"}} =
	+ json_response_and_validate_schema(conn, 200)
	+
	assert id == to_string(user.id)
	end
	end

	describe "user relationships" do
	setup do: oauth_access(["read:follows"])

	test "returns the relationships for the current user", %{user: user, conn: conn} do
	%{id: other_user_id} = other_user = insert(:user)
	{:ok, _user} = User.follow(user, other_user)

	assert [%{"id" => ^other_user_id}] =
	conn
	\|> get("/api/v1/accounts/relationships?id=#{other_user.id}")
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)

	assert [%{"id" => ^other_user_id}] =
	conn
	\|> get("/api/v1/accounts/relationships?id[]=#{other_user.id}")
	- \|> json_response(200)
	+ \|> json_response_and_validate_schema(200)
	end

	test "returns an empty list on a bad request", %{conn: conn} do
	conn = get(conn, "/api/v1/accounts/relationships", %{})

	- assert [] = json_response(conn, 200)
	+ assert [] = json_response_and_validate_schema(conn, 200)
	end
	end

	test "getting a list of mutes" do
	%{user: user, conn: conn} = oauth_access(["read:mutes"])
	other_user = insert(:user)

	{:ok, _user_relationships} = User.mute(user, other_user)

	conn = get(conn, "/api/v1/mutes")

	other_user_id = to_string(other_user.id)
	- assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
	- assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
	+ assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
	end

	test "getting a list of blocks" do
	%{user: user, conn: conn} = oauth_access(["read:blocks"])
	other_user = insert(:user)

	{:ok, _user_relationship} = User.block(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/blocks")

	other_user_id = to_string(other_user.id)
	- assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
	- assert_schema(json_response(conn, 200), "AccountsResponse", ApiSpec.spec())
	+ assert [%{"id" => ^other_user_id}] = json_response_and_validate_schema(conn, 200)
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Oct 31, 11:36 AM (11 h, 29 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1801364
Default Alt Text: (117 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions