No OneTemporary
Actions

Authored By

Unknown

Size

111 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/cache-control-immutable.add b/changelog.d/cache-control-immutable.add
	new file mode 100644
	index 000000000..516db67bf
	--- /dev/null
	+++ b/changelog.d/cache-control-immutable.add
	@@ -0,0 +1 @@
	+Add immutable tag on cache-control header for several endpoints that's serving the same exact things.
	\ No newline at end of file
	diff --git a/changelog.d/poll-voters-count.fix b/changelog.d/poll-voters-count.fix
	new file mode 100644
	index 000000000..2dbc81b5d
	--- /dev/null
	+++ b/changelog.d/poll-voters-count.fix
	@@ -0,0 +1 @@
	+Federate `votersCount` correctly
	diff --git a/lib/pleroma/constants.ex b/lib/pleroma/constants.ex
	index f78b84099..178dd6094 100644
	--- a/lib/pleroma/constants.ex
	+++ b/lib/pleroma/constants.ex
	@@ -1,160 +1,160 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Constants do
	use Const

	const(as_public, do: "https://www.w3.org/ns/activitystreams#Public")

	const(object_internal_fields,
	do: [
	"reactions",
	"reaction_count",
	"likes",
	"like_count",
	"announcements",
	"announcement_count",
	"emoji",
	"context_id",
	"deleted_activity_id",
	"pleroma_internal",
	"generator",
	"rules",
	"language",
	"voters",
	"assigned_account"
	]
	)

	const(static_only_files,
	do:
	- ~w(index.html robots.txt static static-fe finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc embed.js embed.css)
	+ ~w(index.html robots.txt static static-fe finmoji emoji packs sounds images instance sw.js sw-pleroma.js schemas doc embed.js embed.css)
	)

	const(status_updatable_fields,
	do: [
	"source",
	"tag",
	"updated",
	"emoji",
	"content",
	"contentMap",
	"summary",
	"sensitive",
	"attachment",
	"generator",
	"language"
	]
	)

	const(status_object_types,
	do: [
	"Note",
	"Question",
	"Audio",
	"Video",
	"Event",
	"Article",
	"Page"
	]
	)

	const(updatable_object_types,
	do: [
	"Note",
	"Question",
	"Audio",
	"Video",
	"Event",
	"Article",
	"Page"
	]
	)

	const(actor_types,
	do: [
	"Application",
	"Group",
	"Organization",
	"Person",
	"Service"
	]
	)

	const(allowed_user_actor_types,
	do: [
	"Person",
	"Service",
	"Group"
	]
	)

	const(activity_types,
	do: [
	"Block",
	"Create",
	"Update",
	"Delete",
	"Follow",
	"Accept",
	"Reject",
	"Add",
	"Remove",
	"Like",
	"Dislike",
	"Announce",
	"Undo",
	"Flag",
	"EmojiReact",
	"Listen"
	]
	)

	const(allowed_activity_types_from_strangers,
	do: [
	"Block",
	"Create",
	"Flag",
	"Follow",
	"Like",
	"Dislike",
	"EmojiReact",
	"Announce"
	]
	)

	const(object_types,
	do: ~w[Event Question Answer Audio Video Image Article Note Page ChatMessage]
	)

	# basic regex, just there to weed out potential mistakes
	# https://datatracker.ietf.org/doc/html/rfc2045#section-5.1
	const(mime_regex,
	do: ~r/^[^[:cntrl:] ()<>@,;:\\"\/\[\]?=]+\/[^[:cntrl:] ()<>@,;:\\"\/\[\]?=]+(; .*)?$/
	)

	# List of allowed chars in the path segment of a URI
	# unreserved, sub-delims, ":", "@" and "/" allowed as the separator in path
	# https://datatracker.ietf.org/doc/html/rfc3986
	const(uri_path_allowed_reserved_chars,
	do: ~c"!$&'()*+,;=/:@"
	)

	const(upload_object_types, do: ["Document", "Image"])

	const(activity_json_canonical_mime_type,
	do: "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)

	const(activity_json_mime_types,
	do: [
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"",
	"application/activity+json"
	]
	)

	const(public_streams,
	do: ["public", "public:local", "public:media", "public:local:media"]
	)
	end
	diff --git a/lib/pleroma/object.ex b/lib/pleroma/object.ex
	index d0cb16b79..f1e07a257 100644
	--- a/lib/pleroma/object.ex
	+++ b/lib/pleroma/object.ex
	@@ -1,461 +1,469 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Object do
	use Ecto.Schema

	import Ecto.Query
	import Ecto.Changeset

	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Hashtag
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	alias Pleroma.ObjectTombstone
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Workers.AttachmentsCleanupWorker

	require Logger

	@type t() :: %__MODULE__{}

	@derive {Jason.Encoder, only: [:data]}

	@cachex Pleroma.Config.get([:cachex, :provider], Cachex)

	schema "objects" do
	field(:data, :map)

	many_to_many(:hashtags, Hashtag, join_through: "hashtags_objects", on_replace: :delete)

	timestamps()
	end

	def with_joined_activity(query, activity_type \\ "Create", join_type \\ :inner) do
	object_position = Map.get(query.aliases, :object, 0)

	join(query, join_type, [{object, object_position}], a in Activity,
	on:
	fragment(
	"associated_object_id(?) = (? ->> 'id') AND (?->>'type' = ?) ",
	a.data,
	object.data,
	a.data,
	^activity_type
	),
	as: :object_activity
	)
	end

	def create(data) do
	%Object{}
	\|> Object.change(%{data: data})
	\|> Repo.insert()
	end

	def change(struct, params \\ %{}) do
	struct
	\|> cast(params, [:data])
	\|> validate_required([:data])
	\|> unique_constraint(:ap_id, name: :objects_unique_apid_index)
	# Expecting `maybe_handle_hashtags_change/1` to run last:
	\|> maybe_handle_hashtags_change(struct)
	end

	# Note: not checking activity type (assuming non-legacy objects are associated with Create act.)
	defp maybe_handle_hashtags_change(changeset, struct) do
	with %Ecto.Changeset{valid?: true} <- changeset,
	data_hashtags_change = get_change(changeset, :data),
	{_, true} <- {:changed, hashtags_changed?(struct, data_hashtags_change)},
	{:ok, hashtag_records} <-
	data_hashtags_change
	\|> object_data_hashtags()
	\|> Hashtag.get_or_create_by_names() do
	put_assoc(changeset, :hashtags, hashtag_records)
	else
	%{valid?: false} ->
	changeset

	{:changed, false} ->
	changeset

	{:error, _} ->
	validate_change(changeset, :data, fn _, _ ->
	[data: "error referencing hashtags"]
	end)
	end
	end

	defp hashtags_changed?(%Object{} = struct, %{"tag" => _} = data) do
	Enum.sort(embedded_hashtags(struct)) !=
	Enum.sort(object_data_hashtags(data))
	end

	defp hashtags_changed?(_, _), do: false

	def get_by_id(nil), do: nil
	def get_by_id(id), do: Repo.get(Object, id)

	def get_by_ap_id(nil), do: nil

	def get_by_ap_id(ap_id) do
	Repo.one(from(object in Object, where: fragment("(?)->>'id' = ?", object.data, ^ap_id)))
	end

	@doc """
	Get a single attachment by it's name and href
	"""
	@spec get_attachment_by_name_and_href(String.t(), String.t()) :: Object.t() \| nil
	def get_attachment_by_name_and_href(name, href) do
	query =
	from(o in Object,
	where: fragment("(?)->>'name' = ?", o.data, ^name),
	where: fragment("(?)->>'href' = ?", o.data, ^href)
	)

	Repo.one(query)
	end

	defp warn_on_no_object_preloaded(ap_id) do
	"Object.normalize() called without preloaded object (#{inspect(ap_id)}). Consider preloading the object"
	\|> Logger.debug()

	Logger.debug("Backtrace: #{inspect(Process.info(:erlang.self(), :current_stacktrace))}")
	end

	def normalize(_, options \\ [fetch: false])

	# If we pass an Activity to Object.normalize(), we can try to use the preloaded object.
	# Use this whenever possible, especially when walking graphs in an O(N) loop!
	def normalize(%Object{} = object, _), do: object
	def normalize(%Activity{object: %Object{} = object}, _), do: object

	# A hack for fake activities
	def normalize(%Activity{data: %{"object" => %{"fake" => true} = data}}, _) do
	%Object{id: "pleroma:fake_object_id", data: data}
	end

	# No preloaded object
	def normalize(%Activity{data: %{"object" => %{"id" => ap_id}}}, options) do
	warn_on_no_object_preloaded(ap_id)
	normalize(ap_id, options)
	end

	# No preloaded object
	def normalize(%Activity{data: %{"object" => ap_id}}, options) do
	warn_on_no_object_preloaded(ap_id)
	normalize(ap_id, options)
	end

	# Old way, try fetching the object through cache.
	def normalize(%{"id" => ap_id}, options), do: normalize(ap_id, options)

	def normalize(ap_id, options) when is_binary(ap_id) do
	cond do
	Keyword.get(options, :fetch) ->
	case Fetcher.fetch_object_from_id(ap_id, options) do
	{:ok, object} -> object
	_ -> nil
	end

	true ->
	get_cached_by_ap_id(ap_id)
	end
	end

	def normalize(_, _), do: nil

	# Owned objects can only be accessed by their owner
	def authorize_access(%Object{data: %{"actor" => actor}}, %User{ap_id: ap_id}) do
	if actor == ap_id do
	:ok
	else
	{:error, :forbidden}
	end
	end

	# Legacy objects can be accessed by anybody
	def authorize_access(%Object{}, %User{}), do: :ok

	@spec get_cached_by_ap_id(String.t()) :: Object.t() \| nil
	def get_cached_by_ap_id(ap_id) do
	key = "object:#{ap_id}"

	with {:ok, nil} <- @cachex.get(:object_cache, key),
	object when not is_nil(object) <- get_by_ap_id(ap_id),
	{:ok, true} <- @cachex.put(:object_cache, key, object) do
	object
	else
	{:ok, object} -> object
	nil -> nil
	end
	end

	def make_tombstone(%Object{data: %{"id" => id, "type" => type}}, deleted \\ DateTime.utc_now()) do
	%ObjectTombstone{
	id: id,
	formerType: type,
	deleted: deleted
	}
	\|> Map.from_struct()
	end

	def swap_object_with_tombstone(object) do
	tombstone = make_tombstone(object)

	with {:ok, object} <-
	object
	\|> Object.change(%{data: tombstone})
	\|> Repo.update() do
	Hashtag.unlink(object)
	{:ok, object}
	end
	end

	def delete(%Object{data: %{"id" => id}} = object) do
	with {:ok, _obj} = swap_object_with_tombstone(object),
	deleted_activity = Activity.delete_all_by_object_ap_id(id),
	{:ok, _} <- invalid_object_cache(object) do
	cleanup_attachments(
	Config.get([:instance, :cleanup_attachments]),
	object
	)

	{:ok, object, deleted_activity}
	end
	end

	@spec cleanup_attachments(boolean(), Object.t()) ::
	{:ok, Oban.Job.t() \| nil}
	def cleanup_attachments(true, %Object{} = object) do
	AttachmentsCleanupWorker.new(%{"op" => "cleanup_attachments", "object" => object})
	\|> Oban.insert()
	end

	def cleanup_attachments(_, _), do: {:ok, nil}

	def prune(%Object{data: %{"id" => _id}} = object) do
	with {:ok, object} <- Repo.delete(object),
	{:ok, _} <- invalid_object_cache(object) do
	{:ok, object}
	end
	end

	def invalid_object_cache(%Object{data: %{"id" => id}}) do
	with {:ok, true} <- @cachex.del(:object_cache, "object:#{id}") do
	@cachex.del(:web_resp_cache, URI.parse(id).path)
	end
	end

	def set_cache(%Object{data: %{"id" => ap_id}} = object) do
	@cachex.put(:object_cache, "object:#{ap_id}", object)
	{:ok, object}
	end

	def update_and_set_cache(changeset) do
	with {:ok, object} <- Repo.update(changeset) do
	set_cache(object)
	end
	end

	def increase_replies_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{repliesCount}',
	(coalesce((?->>'repliesCount')::int, 0) + 1)::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	defp poll_is_multiple?(%Object{data: %{"anyOf" => [_ \| _]}}), do: true

	defp poll_is_multiple?(_), do: false

	def decrease_replies_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{repliesCount}',
	(greatest(0, (?->>'repliesCount')::int - 1))::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	def increase_quotes_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{quotesCount}',
	(coalesce((?->>'quotesCount')::int, 0) + 1)::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	def decrease_quotes_count(ap_id) do
	Object
	\|> where([o], fragment("?->>'id' = ?::text", o.data, ^to_string(ap_id)))
	\|> update([o],
	set: [
	data:
	fragment(
	"""
	safe_jsonb_set(?, '{quotesCount}',
	(greatest(0, (?->>'quotesCount')::int - 1))::varchar::jsonb, true)
	""",
	o.data,
	o.data
	)
	]
	)
	\|> Repo.update_all([])
	\|> case do
	{1, [object]} -> set_cache(object)
	_ -> {:error, "Not found"}
	end
	end

	def increase_vote_count(ap_id, name, actor) do
	with %Object{} = object <- Object.normalize(ap_id, fetch: false),
	"Question" <- object.data["type"] do
	key = if poll_is_multiple?(object), do: "anyOf", else: "oneOf"

	options =
	object.data[key]
	\|> Enum.map(fn
	%{"name" => ^name} = option ->
	Kernel.update_in(option["replies"]["totalItems"], &(&1 + 1))

	option ->
	option
	end)

	voters = [actor \| object.data["voters"] \|\| []] \|> Enum.uniq()

	+ voters_count =
	+ if Map.has_key?(object.data, "votersCount") do
	+ object.data["votersCount"] + 1
	+ else
	+ length(voters)
	+ end
	+
	data =
	object.data
	\|> Map.put(key, options)
	\|> Map.put("voters", voters)
	+ \|> Map.put("votersCount", voters_count)

	object
	\|> Object.change(%{data: data})
	\|> update_and_set_cache()
	else
	_ -> :noop
	end
	end

	@doc "Updates data field of an object"
	def update_data(%Object{data: data} = object, attrs \\ %{}) do
	object
	\|> Object.change(%{data: Map.merge(data \|\| %{}, attrs)})
	\|> Repo.update()
	end

	def local?(%Object{data: %{"id" => id}}) do
	String.starts_with?(id, Pleroma.Web.Endpoint.url() <> "/")
	end

	def tags(%Object{data: %{"tag" => tags}}) when is_list(tags), do: tags

	def tags(_), do: []

	def hashtags(%Object{} = object) do
	# Note: always using embedded hashtags regardless whether they are migrated to hashtags table
	# (embedded hashtags stay in sync anyways, and we avoid extra joins and preload hassle)
	embedded_hashtags(object)
	end

	def embedded_hashtags(%Object{data: data}) do
	object_data_hashtags(data)
	end

	def embedded_hashtags(_), do: []

	def object_data_hashtags(%{"tag" => tags}) when is_list(tags) do
	tags
	\|> Enum.filter(fn
	%{"type" => "Hashtag"} = data -> Map.has_key?(data, "name")
	plain_text when is_bitstring(plain_text) -> true
	_ -> false
	end)
	\|> Enum.map(fn
	%{"name" => "#" <> hashtag} -> String.downcase(hashtag)
	%{"name" => hashtag} -> String.downcase(hashtag)
	hashtag when is_bitstring(hashtag) -> String.downcase(hashtag)
	end)
	\|> Enum.uniq()
	# Note: "" elements (plain text) might occur in `data.tag` for incoming objects
	\|> Enum.filter(&(&1 not in [nil, ""]))
	end

	def object_data_hashtags(_), do: []

	def get_emoji_reactions(object) do
	reactions = object.data["reactions"]

	if is_list(reactions) or is_map(reactions) do
	reactions
	\|> Enum.map(fn
	[_emoji, users, _maybe_url] = item when is_list(users) ->
	item

	[emoji, users] when is_list(users) ->
	[emoji, users, nil]

	# This case is here to process the Map situation, which will happen
	# only with the legacy two-value format.
	{emoji, users} when is_list(users) ->
	[emoji, users, nil]

	_ ->
	nil
	end)
	\|> Enum.reject(&is_nil/1)
	else
	[]
	end
	end
	end
	diff --git a/lib/pleroma/reverse_proxy.ex b/lib/pleroma/reverse_proxy.ex
	index bb55a4984..c7ee47c6e 100644
	--- a/lib/pleroma/reverse_proxy.ex
	+++ b/lib/pleroma/reverse_proxy.ex
	@@ -1,471 +1,471 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.ReverseProxy do
	alias Pleroma.Utils.URIEncoding

	@range_headers ~w(range if-range)
	@keep_req_headers ~w(accept accept-encoding cache-control if-modified-since) ++
	~w(if-unmodified-since if-none-match) ++ @range_headers
	@resp_cache_headers ~w(etag date last-modified)
	@keep_resp_headers @resp_cache_headers ++
	~w(content-length content-type content-disposition content-encoding) ++
	~w(content-range accept-ranges vary)
	- @default_cache_control_header "public, max-age=1209600"
	+ @default_cache_control_header "public, max-age=1209600, immutable"
	@valid_resp_codes [200, 206, 304]
	@max_read_duration :timer.seconds(30)
	@max_body_length :infinity
	@failed_request_ttl :timer.seconds(60)
	@methods ~w(GET HEAD)

	@allowed_mime_types Pleroma.Config.get([Pleroma.Upload, :allowed_mime_types], [])

	@cachex Pleroma.Config.get([:cachex, :provider], Cachex)

	def max_read_duration_default, do: @max_read_duration
	def default_cache_control_header, do: @default_cache_control_header

	@moduledoc """
	A reverse proxy.

	Pleroma.ReverseProxy.call(conn, url, options)

	It is not meant to be added into a plug pipeline, but to be called from another plug or controller.

	Supports `#{inspect(@methods)}` HTTP methods, and only allows `#{inspect(@valid_resp_codes)}` status codes.

	Responses are chunked to the client while downloading from the upstream.

	Some request / responses headers are preserved:

	* request: `#{inspect(@keep_req_headers)}`
	* response: `#{inspect(@keep_resp_headers)}`

	Options:

	* `redirect_on_failure` (default `false`). Redirects the client to the real remote URL if there's any HTTP
	errors. Any error during body processing will not be redirected as the response is chunked. This may expose
	remote URL, clients IPs, ….

	* `max_body_length` (default `#{inspect(@max_body_length)}`): limits the content length to be approximately the
	specified length. It is validated with the `content-length` header and also verified when proxying.

	* `max_read_duration` (default `#{inspect(@max_read_duration)}` ms): the total time the connection is allowed to
	read from the remote upstream.

	* `failed_request_ttl` (default `#{inspect(@failed_request_ttl)}` ms): the time the failed request is cached and cannot be retried.

	* `inline_content_types`:
	* `true` will not alter `content-disposition` (up to the upstream),
	* `false` will add `content-disposition: attachment` to any request,
	* a list of whitelisted content types

	* `req_headers`, `resp_headers` additional headers.

	* `http`: options for [hackney](https://github.com/benoitc/hackney) or [gun](https://github.com/ninenines/gun).

	"""
	@default_options [pool: :media]

	@inline_content_types [
	"image/gif",
	"image/jpeg",
	"image/jpg",
	"image/png",
	"image/svg+xml",
	"audio/mpeg",
	"audio/mp3",
	"video/webm",
	"video/mp4",
	"video/quicktime"
	]

	require Logger
	import Plug.Conn

	@type option() ::
	{:max_read_duration, non_neg_integer() \| :infinity}
	\| {:max_body_length, non_neg_integer() \| :infinity}
	\| {:failed_request_ttl, non_neg_integer() \| :infinity}
	\| {:http, keyword()}
	\| {:req_headers, [{String.t(), String.t()}]}
	\| {:resp_headers, [{String.t(), String.t()}]}
	\| {:inline_content_types, boolean() \| list(String.t())}
	\| {:redirect_on_failure, boolean()}

	@spec call(Plug.Conn.t(), String.t(), list(option())) :: Plug.Conn.t()
	def call(_conn, _url, _opts \\ [])

	def call(conn = %{method: method}, url, opts) when method in @methods do
	client_opts = Keyword.merge(@default_options, Keyword.get(opts, :http, []))

	req_headers = build_req_headers(conn.req_headers, opts)

	opts =
	if filename = Pleroma.Web.MediaProxy.filename(url) do
	Keyword.put_new(opts, :attachment_name, filename)
	else
	opts
	end

	with {:ok, nil} <- @cachex.get(:failed_proxy_url_cache, url),
	{:ok, code, headers, client} <- request(method, url, req_headers, client_opts),
	:ok <-
	header_length_constraint(
	headers,
	Keyword.get(opts, :max_body_length, @max_body_length)
	) do
	response(conn, client, url, code, headers, opts)
	else
	{:ok, true} ->
	conn
	\|> error_or_redirect(url, 500, "Request failed", opts)
	\|> halt()

	{:ok, code, headers} ->
	head_response(conn, url, code, headers, opts)
	\|> halt()

	{:error, {:invalid_http_response, code}} ->
	Logger.error("#{__MODULE__}: request to #{inspect(url)} failed with HTTP status #{code}")
	track_failed_url(url, code, opts)

	conn
	\|> error_or_redirect(
	url,
	code,
	"Request failed: " <> Plug.Conn.Status.reason_phrase(code),
	opts
	)
	\|> halt()

	{:error, error} ->
	Logger.error("#{__MODULE__}: request to #{inspect(url)} failed: #{inspect(error)}")
	track_failed_url(url, error, opts)

	conn
	\|> error_or_redirect(url, 500, "Request failed", opts)
	\|> halt()
	end
	end

	def call(conn, _, _) do
	conn
	\|> send_resp(400, Plug.Conn.Status.reason_phrase(400))
	\|> halt()
	end

	defp request(method, url, headers, opts) do
	method = method \|> String.downcase() \|> String.to_existing_atom()

	url = maybe_encode_url(url)

	Logger.debug("#{__MODULE__} #{method} #{url} #{inspect(headers)}")

	case client().request(method, url, headers, "", opts) do
	{:ok, code, headers, client} when code in @valid_resp_codes ->
	{:ok, code, downcase_headers(headers), client}

	{:ok, code, headers} when code in @valid_resp_codes ->
	{:ok, code, downcase_headers(headers)}

	{:ok, code, _, _} ->
	{:error, {:invalid_http_response, code}}

	{:ok, code, _} ->
	{:error, {:invalid_http_response, code}}

	{:error, error} ->
	{:error, error}
	end
	end

	defp response(conn, client, url, status, headers, opts) do
	Logger.debug("#{__MODULE__} #{status} #{url} #{inspect(headers)}")

	result =
	conn
	\|> put_resp_headers(build_resp_headers(headers, opts))
	\|> streaming_compat
	\|> send_chunked(status)
	\|> chunk_reply(client, opts)

	case result do
	{:ok, conn} ->
	halt(conn)

	{:error, :closed, conn} ->
	client().close(client)
	halt(conn)

	{:error, error, conn} ->
	Logger.warning(
	"#{__MODULE__} request to #{url} failed while reading/chunking: #{inspect(error)}"
	)

	client().close(client)
	halt(conn)
	end
	end

	defp chunk_reply(conn, client, opts) do
	chunk_reply(conn, client, opts, 0, 0)
	end

	defp chunk_reply(conn, client, opts, sent_so_far, duration) do
	with {:ok, duration} <-
	check_read_duration(
	duration,
	Keyword.get(opts, :max_read_duration, @max_read_duration)
	),
	{:ok, data, client} <- client().stream_body(client),
	{:ok, duration} <- increase_read_duration(duration),
	sent_so_far = sent_so_far + byte_size(data),
	:ok <-
	body_size_constraint(
	sent_so_far,
	Keyword.get(opts, :max_body_length, @max_body_length)
	),
	{:ok, conn} <- chunk(conn, data) do
	chunk_reply(conn, client, opts, sent_so_far, duration)
	else
	:done -> {:ok, conn}
	{:error, error} -> {:error, error, conn}
	end
	end

	defp head_response(conn, url, code, headers, opts) do
	Logger.debug("#{__MODULE__} #{code} #{url} #{inspect(headers)}")

	conn
	\|> put_resp_headers(build_resp_headers(headers, opts))
	\|> send_resp(code, "")
	end

	defp error_or_redirect(conn, url, code, body, opts) do
	if Keyword.get(opts, :redirect_on_failure, false) do
	conn
	\|> Phoenix.Controller.redirect(external: url)
	\|> halt()
	else
	conn
	\|> send_resp(code, body)
	\|> halt
	end
	end

	defp downcase_headers(headers) do
	Enum.map(headers, fn {k, v} ->
	{String.downcase(k), v}
	end)
	end

	defp get_content_type(headers) do
	{_, content_type} =
	List.keyfind(headers, "content-type", 0, {"content-type", "application/octet-stream"})

	[content_type \| _] = String.split(content_type, ";")
	content_type
	end

	defp put_resp_headers(conn, headers) do
	Enum.reduce(headers, conn, fn {k, v}, conn ->
	put_resp_header(conn, k, v)
	end)
	end

	defp build_req_headers(headers, opts) do
	headers
	\|> downcase_headers()
	\|> Enum.filter(fn {k, _} -> k in @keep_req_headers end)
	\|> build_req_range_or_encoding_header(opts)
	\|> build_req_user_agent_header(opts)
	\|> Keyword.merge(Keyword.get(opts, :req_headers, []))
	end

	# Disable content-encoding if any @range_headers are requested (see #1823).
	defp build_req_range_or_encoding_header(headers, _opts) do
	range? = Enum.any?(headers, fn {header, _} -> Enum.member?(@range_headers, header) end)

	if range? && List.keymember?(headers, "accept-encoding", 0) do
	List.keydelete(headers, "accept-encoding", 0)
	else
	headers
	end
	end

	defp build_req_user_agent_header(headers, _opts) do
	List.keystore(
	headers,
	"user-agent",
	0,
	{"user-agent", Pleroma.Application.user_agent()}
	)
	end

	defp build_resp_headers(headers, opts) do
	headers
	\|> Enum.filter(fn {k, _} -> k in @keep_resp_headers end)
	\|> build_resp_cache_headers(opts)
	\|> sanitise_content_type()
	\|> build_resp_content_disposition_header(opts)
	\|> Keyword.merge(Keyword.get(opts, :resp_headers, []))
	end

	defp sanitise_content_type(headers) do
	original_ct = get_content_type(headers)

	safe_ct =
	Pleroma.Web.Plugs.Utils.get_safe_mime_type(
	%{allowed_mime_types: @allowed_mime_types},
	original_ct
	)

	[
	{"content-type", safe_ct}
	\| Enum.filter(headers, fn {k, _v} -> k != "content-type" end)
	]
	end

	defp build_resp_cache_headers(headers, _opts) do
	has_cache? = Enum.any?(headers, fn {k, _} -> k in @resp_cache_headers end)

	cond do
	has_cache? ->
	# There's caching header present but no cache-control -- we need to set our own
	# as Plug defaults to "max-age=0, private, must-revalidate"
	List.keystore(
	headers,
	"cache-control",
	0,
	{"cache-control", @default_cache_control_header}
	)

	true ->
	List.keystore(
	headers,
	"cache-control",
	0,
	{"cache-control", @default_cache_control_header}
	)
	end
	end

	defp build_resp_content_disposition_header(headers, opts) do
	opt = Keyword.get(opts, :inline_content_types, @inline_content_types)

	content_type = get_content_type(headers)

	attachment? =
	cond do
	is_list(opt) && !Enum.member?(opt, content_type) -> true
	opt == false -> true
	true -> false
	end

	if attachment? do
	name =
	try do
	{{"content-disposition", content_disposition_string}, _} =
	List.keytake(headers, "content-disposition", 0)

	[name \| _] =
	Regex.run(
	~r/filename="((?:[^"\\]\|\\.)*)"/u,
	content_disposition_string \|\| "",
	capture: :all_but_first
	)

	name
	rescue
	MatchError -> Keyword.get(opts, :attachment_name, "attachment")
	end

	disposition = "attachment; filename=\"#{name}\""

	List.keystore(headers, "content-disposition", 0, {"content-disposition", disposition})
	else
	headers
	end
	end

	defp header_length_constraint(headers, limit) when is_integer(limit) and limit > 0 do
	with {_, size} <- List.keyfind(headers, "content-length", 0),
	{size, _} <- Integer.parse(size),
	true <- size <= limit do
	:ok
	else
	false ->
	{:error, :body_too_large}

	_ ->
	:ok
	end
	end

	defp header_length_constraint(_, _), do: :ok

	defp body_size_constraint(size, limit) when is_integer(limit) and limit > 0 and size >= limit do
	{:error, :body_too_large}
	end

	defp body_size_constraint(_, _), do: :ok

	defp check_read_duration(duration, max)
	when is_integer(duration) and is_integer(max) and max > 0 do
	if duration > max do
	{:error, :read_duration_exceeded}
	else
	{:ok, {duration, :erlang.system_time(:millisecond)}}
	end
	end

	defp check_read_duration(_, _), do: {:ok, :no_duration_limit, :no_duration_limit}

	defp increase_read_duration({previous_duration, started})
	when is_integer(previous_duration) and is_integer(started) do
	duration = :erlang.system_time(:millisecond) - started
	{:ok, previous_duration + duration}
	end

	defp client, do: Pleroma.ReverseProxy.Client.Wrapper

	defp track_failed_url(url, error, opts) do
	ttl =
	unless error in [:body_too_large, 400, 204] do
	Keyword.get(opts, :failed_request_ttl, @failed_request_ttl)
	else
	nil
	end

	@cachex.put(:failed_proxy_url_cache, url, true, ttl: ttl)
	end

	# When Cowboy handles a chunked response with a content-length header it streams
	# over HTTP 1.1 instead of chunking. Bandit cannot stream over HTTP 1.1 so the header
	# must be stripped or it breaks RFC compliance for Transfer Encoding: Chunked. RFC9112§6.2
	#
	# HTTP2 is always streamed for all adapters.
	defp streaming_compat(conn) do
	with Phoenix.Endpoint.Cowboy2Adapter <- Pleroma.Web.Endpoint.config(:adapter) do
	conn
	else
	_ -> delete_resp_header(conn, "content-length")
	end
	end

	# Only when Tesla adapter is Hackney or Finch does the URL
	# need encoding before Reverse Proxying as both end up
	# using the raw Hackney client and cannot leverage our
	# EncodeUrl Tesla middleware
	# Also do it for test environment
	defp maybe_encode_url(url) do
	case Application.get_env(:tesla, :adapter) do
	Tesla.Adapter.Hackney -> URIEncoding.encode_url(url)
	{Tesla.Adapter.Finch, _} -> URIEncoding.encode_url(url)
	Tesla.Mock -> URIEncoding.encode_url(url)
	_ -> url
	end
	end
	end
	diff --git a/lib/pleroma/web/activity_pub/object_validators/question_validator.ex b/lib/pleroma/web/activity_pub/object_validators/question_validator.ex
	index 21940f4f1..065c75910 100644
	--- a/lib/pleroma/web/activity_pub/object_validators/question_validator.ex
	+++ b/lib/pleroma/web/activity_pub/object_validators/question_validator.ex
	@@ -1,93 +1,94 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ObjectValidators.QuestionValidator do
	use Ecto.Schema

	alias Pleroma.EctoType.ActivityPub.ObjectValidators
	alias Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes
	alias Pleroma.Web.ActivityPub.ObjectValidators.CommonValidations
	alias Pleroma.Web.ActivityPub.ObjectValidators.QuestionOptionsValidator
	alias Pleroma.Web.ActivityPub.Transmogrifier

	import Ecto.Changeset

	@primary_key false
	@derive Jason.Encoder

	# Extends from NoteValidator
	embedded_schema do
	quote do
	unquote do
	import Elixir.Pleroma.Web.ActivityPub.ObjectValidators.CommonFields
	message_fields()
	object_fields()
	status_object_fields()
	end
	end

	field(:closed, ObjectValidators.DateTime)
	+ field(:votersCount, :integer)
	field(:voters, {:array, ObjectValidators.ObjectID}, default: [])
	field(:nonAnonymous, :boolean)
	embeds_many(:anyOf, QuestionOptionsValidator)
	embeds_many(:oneOf, QuestionOptionsValidator)
	end

	def cast_and_apply(data) do
	data
	\|> cast_data
	\|> apply_action(:insert)
	end

	def cast_and_validate(data) do
	data
	\|> cast_data()
	\|> validate_data()
	end

	def cast_data(data) do
	%__MODULE__{}
	\|> changeset(data)
	end

	defp fix_closed(data) do
	cond do
	is_binary(data["closed"]) -> data
	is_binary(data["endTime"]) -> Map.put(data, "closed", data["endTime"])
	true -> Map.drop(data, ["closed"])
	end
	end

	defp fix(data) do
	data
	\|> CommonFixes.fix_actor()
	\|> CommonFixes.fix_object_defaults()
	\|> CommonFixes.fix_quote_url()
	\|> CommonFixes.fix_likes()
	\|> Transmogrifier.fix_emoji()
	\|> fix_closed()
	end

	def changeset(struct, data) do
	data = fix(data)

	struct
	\|> cast(data, __schema__(:fields) -- [:anyOf, :oneOf, :attachment, :tag])
	\|> cast_embed(:attachment)
	\|> cast_embed(:anyOf)
	\|> cast_embed(:oneOf)
	\|> cast_embed(:tag)
	end

	defp validate_data(data_cng) do
	data_cng
	\|> validate_inclusion(:type, ["Question"])
	\|> validate_required([:id, :actor, :attributedTo, :type, :context])
	\|> CommonValidations.validate_any_presence([:cc, :to])
	\|> CommonValidations.validate_fields_match([:actor, :attributedTo])
	\|> CommonValidations.validate_actor_presence()
	\|> CommonValidations.validate_any_presence([:oneOf, :anyOf])
	\|> CommonValidations.validate_host_match()
	end
	end
	diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
	index 6af5ee89d..4421da26c 100644
	--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
	+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
	@@ -1,1081 +1,1088 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.Transmogrifier do
	@moduledoc """
	A module to handle coding from internal to wire ActivityPub and back.
	"""
	@behaviour Pleroma.Web.ActivityPub.Transmogrifier.API
	alias Pleroma.Activity
	alias Pleroma.EctoType.ActivityPub.ObjectValidators
	alias Pleroma.Emoji
	alias Pleroma.Maps
	alias Pleroma.Object
	alias Pleroma.Object.Containment
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.ObjectValidator
	alias Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.Federator

	import Pleroma.Web.Utils.Guards, only: [not_empty_string: 1]

	require Pleroma.Constants

	@doc """
	Modifies an incoming AP object (mastodon format) to our internal format.
	"""
	def fix_object(object, options \\ []) do
	object
	\|> strip_internal_fields()
	\|> fix_actor()
	\|> fix_url()
	\|> fix_attachments()
	\|> fix_context()
	\|> fix_in_reply_to(options)
	\|> fix_emoji()
	\|> fix_tag()
	\|> fix_content_map()
	\|> fix_addressing()
	\|> fix_summary()
	\|> fix_history(&fix_object/1)
	end

	defp maybe_fix_object(%{"attributedTo" => _} = object), do: fix_object(object)
	defp maybe_fix_object(object), do: object

	defp fix_history(%{"formerRepresentations" => %{"orderedItems" => list}} = obj, fix_fun)
	when is_list(list) do
	update_in(obj["formerRepresentations"]["orderedItems"], fn h -> Enum.map(h, fix_fun) end)
	end

	defp fix_history(obj, _), do: obj

	defp fix_recursive(obj, fun) do
	# unlike Erlang, Elixir does not support recursive inline functions
	# which would allow us to avoid reconstructing this on every recursion
	rec_fun = fn
	obj when is_map(obj) -> fix_recursive(obj, fun)
	# there may be simple AP IDs in history (or object field)
	obj -> obj
	end

	obj
	\|> fun.()
	\|> fix_history(rec_fun)
	\|> then(fn
	%{"object" => object} = doc when is_map(object) ->
	update_in(doc["object"], rec_fun)

	apdoc ->
	apdoc
	end)
	end

	def fix_summary(%{"summary" => nil} = object) do
	Map.put(object, "summary", "")
	end

	def fix_summary(%{"summary" => _} = object) do
	# summary is present, nothing to do
	object
	end

	def fix_summary(object), do: Map.put(object, "summary", "")

	def fix_addressing_list(map, field) do
	addrs = map[field]

	cond do
	is_list(addrs) ->
	Map.put(map, field, Enum.filter(addrs, &is_binary/1))

	is_binary(addrs) ->
	Map.put(map, field, [addrs])

	true ->
	Map.put(map, field, [])
	end
	end

	@doc """
	Bovine compatibility
	https://codeberg.org/bovine/bovine/issues/53
	"""
	def fix_addressing_public(map, field) do
	addrs = Map.get(map, field, []) \|> List.wrap()

	Map.put(
	map,
	field,
	Enum.map(addrs, fn
	"Public" -> Pleroma.Constants.as_public()
	"as:Public" -> Pleroma.Constants.as_public()
	x -> x
	end)
	)
	end

	# if directMessage flag is set to true, leave the addressing alone
	def fix_explicit_addressing(%{"directMessage" => true} = object, _follower_collection),
	do: object

	def fix_explicit_addressing(%{"to" => to, "cc" => cc} = object, follower_collection) do
	explicit_mentions =
	Utils.determine_explicit_mentions(object) ++
	[Pleroma.Constants.as_public(), follower_collection]

	explicit_to = Enum.filter(to, fn x -> x in explicit_mentions end)
	explicit_cc = Enum.filter(to, fn x -> x not in explicit_mentions end)

	final_cc =
	(cc ++ explicit_cc)
	\|> Enum.filter(& &1)
	\|> Enum.reject(fn x -> String.ends_with?(x, "/followers") and x != follower_collection end)
	\|> Enum.uniq()

	object
	\|> Map.put("to", explicit_to)
	\|> Map.put("cc", final_cc)
	end

	# if as:Public is addressed, then make sure the followers collection is also addressed
	# so that the activities will be delivered to local users.
	def fix_implicit_addressing(%{"to" => to, "cc" => cc} = object, followers_collection) do
	recipients = to ++ cc

	if followers_collection not in recipients do
	cond do
	Pleroma.Constants.as_public() in cc ->
	to = to ++ [followers_collection]
	Map.put(object, "to", to)

	Pleroma.Constants.as_public() in to ->
	cc = cc ++ [followers_collection]
	Map.put(object, "cc", cc)

	true ->
	object
	end
	else
	object
	end
	end

	def fix_addressing(object) do
	{:ok, %User{follower_address: follower_collection}} =
	object
	\|> Containment.get_actor()
	\|> User.get_or_fetch_by_ap_id()

	object
	\|> fix_addressing_list("to")
	\|> fix_addressing_list("cc")
	\|> fix_addressing_list("bto")
	\|> fix_addressing_list("bcc")
	\|> fix_addressing_public("to")
	\|> fix_addressing_public("cc")
	\|> fix_addressing_public("bto")
	\|> fix_addressing_public("bcc")
	\|> fix_explicit_addressing(follower_collection)
	\|> fix_implicit_addressing(follower_collection)
	end

	def fix_actor(%{"attributedTo" => actor} = object) do
	actor = Containment.get_actor(%{"actor" => actor})

	# TODO: Remove actor field for Objects
	object
	\|> Map.put("actor", actor)
	\|> Map.put("attributedTo", actor)
	end

	def fix_in_reply_to(object, options \\ [])

	def fix_in_reply_to(%{"inReplyTo" => in_reply_to} = object, options)
	when not is_nil(in_reply_to) do
	in_reply_to_id = prepare_in_reply_to(in_reply_to)
	depth = (options[:depth] \|\| 0) + 1

	if Federator.allowed_thread_distance?(depth) do
	with {:ok, replied_object} <- get_obj_helper(in_reply_to_id, options),
	%Activity{} <- Activity.get_create_by_object_ap_id(replied_object.data["id"]) do
	object
	\|> Map.put("inReplyTo", replied_object.data["id"])
	\|> Map.put("context", replied_object.data["context"] \|\| object["conversation"])
	\|> Map.drop(["conversation", "inReplyToAtomUri"])
	else
	_ ->
	object
	end
	else
	object
	end
	end

	def fix_in_reply_to(object, _options), do: object

	def fix_quote_url_and_maybe_fetch(object, options \\ []) do
	quote_url =
	case CommonFixes.fix_quote_url(object) do
	%{"quoteUrl" => quote_url} -> quote_url
	_ -> nil
	end

	with {:quoting?, true} <- {:quoting?, not is_nil(quote_url)},
	{:ok, quoted_object} <- get_obj_helper(quote_url, options),
	%Activity{} <- Activity.get_create_by_object_ap_id(quoted_object.data["id"]) do
	Map.put(object, "quoteUrl", quoted_object.data["id"])
	else
	{:quoting?, _} ->
	object

	_ ->
	object
	end
	end

	defp prepare_in_reply_to(in_reply_to) do
	cond do
	is_bitstring(in_reply_to) ->
	in_reply_to

	is_map(in_reply_to) && is_bitstring(in_reply_to["id"]) ->
	in_reply_to["id"]

	is_list(in_reply_to) && is_bitstring(Enum.at(in_reply_to, 0)) ->
	Enum.at(in_reply_to, 0)

	true ->
	""
	end
	end

	def fix_context(object) do
	context = object["context"] \|\| object["conversation"] \|\| Utils.generate_context_id()

	object
	\|> Map.put("context", context)
	\|> Map.drop(["conversation"])
	end

	def fix_attachments(%{"attachment" => attachment} = object) when is_list(attachment) do
	attachments =
	Enum.map(attachment, fn data ->
	url =
	cond do
	is_list(data["url"]) -> List.first(data["url"])
	is_map(data["url"]) -> data["url"]
	true -> nil
	end

	media_type =
	cond do
	is_map(url) && url =~ Pleroma.Constants.mime_regex() ->
	url["mediaType"]

	is_bitstring(data["mediaType"]) && data["mediaType"] =~ Pleroma.Constants.mime_regex() ->
	data["mediaType"]

	is_bitstring(data["mimeType"]) && data["mimeType"] =~ Pleroma.Constants.mime_regex() ->
	data["mimeType"]

	true ->
	nil
	end

	href =
	cond do
	is_map(url) && is_binary(url["href"]) -> url["href"]
	is_binary(data["url"]) -> data["url"]
	is_binary(data["href"]) -> data["href"]
	true -> nil
	end

	if href do
	attachment_url =
	%{
	"href" => href,
	"type" => Map.get(url \|\| %{}, "type", "Link")
	}
	\|> Maps.put_if_present("mediaType", media_type)
	\|> Maps.put_if_present("width", (url \|\| %{})["width"] \|\| data["width"])
	\|> Maps.put_if_present("height", (url \|\| %{})["height"] \|\| data["height"])

	%{
	"url" => [attachment_url],
	"type" => data["type"] \|\| "Document"
	}
	\|> Maps.put_if_present("mediaType", media_type)
	\|> Maps.put_if_present("name", data["name"])
	\|> Maps.put_if_present("blurhash", data["blurhash"])
	else
	nil
	end
	end)
	\|> Enum.filter(& &1)

	Map.put(object, "attachment", attachments)
	end

	def fix_attachments(%{"attachment" => attachment} = object) when is_map(attachment) do
	object
	\|> Map.put("attachment", [attachment])
	\|> fix_attachments()
	end

	def fix_attachments(object), do: object

	def fix_url(%{"url" => url} = object) when is_map(url) do
	Map.put(object, "url", url["href"])
	end

	def fix_url(%{"url" => url} = object) when is_list(url) do
	first_element = Enum.at(url, 0)

	url_string =
	cond do
	is_bitstring(first_element) -> first_element
	is_map(first_element) -> first_element["href"] \|\| ""
	true -> ""
	end

	Map.put(object, "url", url_string)
	end

	def fix_url(object), do: object

	def fix_emoji(%{"tag" => tags} = object) when is_list(tags) do
	emoji =
	tags
	\|> Enum.filter(fn data -> is_map(data) and data["type"] == "Emoji" and data["icon"] end)
	\|> Enum.reduce(%{}, fn data, mapping ->
	name = String.trim(data["name"], ":")

	Map.put(mapping, name, data["icon"]["url"])
	end)

	Map.put(object, "emoji", emoji)
	end

	def fix_emoji(%{"tag" => %{"type" => "Emoji"} = tag} = object) do
	name = String.trim(tag["name"], ":")
	emoji = %{name => tag["icon"]["url"]}

	Map.put(object, "emoji", emoji)
	end

	def fix_emoji(object), do: object

	def fix_tag(%{"tag" => tag} = object) when is_list(tag) do
	tags =
	tag
	\|> Enum.filter(fn data -> data["type"] == "Hashtag" and data["name"] end)
	\|> Enum.map(fn
	%{"name" => "#" <> hashtag} -> String.downcase(hashtag)
	%{"name" => hashtag} -> String.downcase(hashtag)
	end)

	Map.put(object, "tag", tag ++ tags)
	end

	def fix_tag(%{"tag" => %{} = tag} = object) do
	object
	\|> Map.put("tag", [tag])
	\|> fix_tag
	end

	def fix_tag(object), do: object

	# prefer content over contentMap
	def fix_content_map(%{"content" => content} = object) when not_empty_string(content), do: object

	# content map usually only has one language so this will do for now.
	def fix_content_map(%{"contentMap" => content_map} = object) do
	content_groups = Map.to_list(content_map)
	{_, content} = Enum.at(content_groups, 0)

	Map.put(object, "content", content)
	end

	def fix_content_map(object), do: object

	defp fix_type(%{"type" => "Note", "inReplyTo" => reply_id, "name" => _} = object, options)
	when is_binary(reply_id) do
	options = Keyword.put(options, :fetch, true)

	with %Object{data: %{"type" => "Question"}} <- Object.normalize(reply_id, options) do
	Map.put(object, "type", "Answer")
	else
	_ -> object
	end
	end

	defp fix_type(object, _options), do: object

	# Reduce the object list to find the reported user.
	defp get_reported(objects) do
	Enum.reduce_while(objects, nil, fn ap_id, _ ->
	with %User{} = user <- User.get_cached_by_ap_id(ap_id) do
	{:halt, user}
	else
	_ -> {:cont, nil}
	end
	end)
	end

	def handle_incoming(data, options \\ []) do
	data
	\|> fix_recursive(&strip_internal_fields/1)
	\|> handle_incoming_normalized(options)
	end

	# Flag objects are placed ahead of the ID check because Mastodon 2.8 and earlier send them
	# with nil ID.
	defp handle_incoming_normalized(
	%{"type" => "Flag", "object" => objects, "actor" => actor} = data,
	_options
	) do
	with context <- data["context"] \|\| Utils.generate_context_id(),
	content <- data["content"] \|\| "",
	%User{} = actor <- User.get_cached_by_ap_id(actor),
	# Reduce the object list to find the reported user.
	%User{} = account <- get_reported(objects),
	# Remove the reported user from the object list.
	statuses <- Enum.filter(objects, fn ap_id -> ap_id != account.ap_id end) do
	%{
	actor: actor,
	context: context,
	account: account,
	statuses: statuses,
	content: content,
	additional: %{"cc" => [account.ap_id]}
	}
	\|> ActivityPub.flag()
	end
	end

	# disallow objects with bogus IDs
	defp handle_incoming_normalized(%{"id" => nil}, _options), do: :error
	defp handle_incoming_normalized(%{"id" => ""}, _options), do: :error
	# length of https:// = 8, should validate better, but good enough for now.
	defp handle_incoming_normalized(%{"id" => id}, _options)
	when is_binary(id) and byte_size(id) < 8,
	do: :error

	defp handle_incoming_normalized(
	%{"type" => "Listen", "object" => %{"type" => "Audio"} = object} = data,
	options
	) do
	actor = Containment.get_actor(data)

	data =
	Map.put(data, "actor", actor)
	\|> fix_addressing

	with {:ok, %User{} = user} <- User.get_or_fetch_by_ap_id(data["actor"]) do
	reply_depth = (options[:depth] \|\| 0) + 1
	options = Keyword.put(options, :depth, reply_depth)
	object = fix_object(object, options)

	params = %{
	to: data["to"],
	object: object,
	actor: user,
	context: nil,
	local: false,
	published: data["published"],
	additional: Map.take(data, ["cc", "id"])
	}

	ActivityPub.listen(params)
	else
	_e -> :error
	end
	end

	@misskey_reactions %{
	"like" => "👍",
	"love" => "❤️",
	"laugh" => "😆",
	"hmm" => "🤔",
	"surprise" => "😮",
	"congrats" => "🎉",
	"angry" => "💢",
	"confused" => "😥",
	"rip" => "😇",
	"pudding" => "🍮",
	"star" => "⭐"
	}

	# Rewrite misskey likes into EmojiReacts
	defp handle_incoming_normalized(
	%{
	"type" => "Like",
	"content" => content
	} = data,
	options
	)
	when is_binary(content) do
	data
	\|> Map.put("type", "EmojiReact")
	\|> handle_incoming_normalized(options)
	end

	defp handle_incoming_normalized(
	%{
	"type" => "Like",
	"_misskey_reaction" => reaction
	} = data,
	options
	) do
	data
	\|> Map.put("content", @misskey_reactions[reaction] \|\| reaction)
	\|> handle_incoming_normalized(options)
	end

	defp handle_incoming_normalized(
	%{"type" => "Create", "object" => %{"type" => objtype, "id" => obj_id}} = data,
	options
	)
	when objtype in ~w{Question Answer ChatMessage Audio Video Event Article Note Page Image} do
	fetch_options = Keyword.put(options, :depth, (options[:depth] \|\| 0) + 1)

	object =
	data["object"]
	\|> strip_internal_fields()
	\|> fix_type(fetch_options)
	\|> fix_in_reply_to(fetch_options)
	\|> fix_quote_url_and_maybe_fetch(fetch_options)

	data = Map.put(data, "object", object)
	options = Keyword.put(options, :local, false)

	with {:ok, %User{}} <- ObjectValidator.fetch_actor(data),
	nil <- Activity.get_create_by_object_ap_id(obj_id),
	{:ok, activity, _} <- Pipeline.common_pipeline(data, options) do
	{:ok, activity}
	else
	%Activity{} = activity -> {:ok, activity}
	e -> e
	end
	end

	defp handle_incoming_normalized(%{"type" => type} = data, _options)
	when type in ~w{Like EmojiReact Announce Add Remove} do
	with :ok <- ObjectValidator.fetch_actor_and_object(data),
	{:ok, activity, _meta} <-
	Pipeline.common_pipeline(data, local: false) do
	{:ok, activity}
	else
	e -> {:error, e}
	end
	end

	defp handle_incoming_normalized(
	%{"type" => type} = data,
	_options
	)
	when type in ~w{Update Block Follow Accept Reject} do
	fixed_obj = maybe_fix_object(data["object"])
	data = if fixed_obj != nil, do: %{data \| "object" => fixed_obj}, else: data

	with {:ok, %User{}} <- ObjectValidator.fetch_actor(data),
	{:ok, activity, _} <-
	Pipeline.common_pipeline(data, local: false) do
	{:ok, activity}
	end
	end

	defp handle_incoming_normalized(
	%{"type" => "Delete"} = data,
	_options
	) do
	with {:ok, activity, _} <-
	Pipeline.common_pipeline(data, local: false) do
	{:ok, activity}
	else
	{:error, {:validate, _}} = e ->
	# Check if we have a create activity for this
	with {:ok, object_id} <- ObjectValidators.ObjectID.cast(data["object"]),
	%Activity{data: %{"actor" => actor}} <-
	Activity.create_by_object_ap_id(object_id) \|> Repo.one(),
	# We have one, insert a tombstone and retry
	{:ok, tombstone_data, _} <- Builder.tombstone(actor, object_id),
	{:ok, _tombstone} <- Object.create(tombstone_data) do
	handle_incoming(data)
	else
	_ -> e
	end

	e ->
	{:error, e}
	end
	end

	defp handle_incoming_normalized(
	%{
	"type" => "Undo",
	"object" => %{"type" => "Follow", "object" => followed},
	"actor" => follower,
	"id" => id
	} = _data,
	_options
	) do
	with %User{local: true} = followed <- User.get_cached_by_ap_id(followed),
	{:ok, %User{} = follower} <- User.get_or_fetch_by_ap_id(follower),
	{:ok, activity} <- ActivityPub.unfollow(follower, followed, id, false) do
	User.unfollow(follower, followed)
	{:ok, activity}
	else
	_e -> :error
	end
	end

	defp handle_incoming_normalized(
	%{
	"type" => "Undo",
	"object" => %{"type" => type}
	} = data,
	_options
	)
	when type in ["Like", "EmojiReact", "Announce", "Block"] do
	with {:ok, activity, _} <- Pipeline.common_pipeline(data, local: false) do
	{:ok, activity}
	end
	end

	# For Undos that don't have the complete object attached, try to find it in our database.
	defp handle_incoming_normalized(
	%{
	"type" => "Undo",
	"object" => object
	} = activity,
	options
	)
	when is_binary(object) do
	with %Activity{data: data} <- Activity.get_by_ap_id(object) do
	activity
	\|> Map.put("object", data)
	\|> handle_incoming_normalized(options)
	else
	_e -> :error
	end
	end

	defp handle_incoming_normalized(
	%{
	"type" => "Move",
	"actor" => origin_actor,
	"object" => origin_actor,
	"target" => target_actor
	},
	_options
	) do
	with %User{} = origin_user <- User.get_cached_by_ap_id(origin_actor),
	{:ok, %User{} = target_user} <- User.get_or_fetch_by_ap_id(target_actor),
	true <- origin_actor in target_user.also_known_as do
	ActivityPub.move(origin_user, target_user, false)
	else
	_e -> :error
	end
	end

	# Rewrite dislikes into the thumbs down emoji
	defp handle_incoming_normalized(%{"type" => "Dislike"} = data, options) do
	data
	\|> Map.put("type", "EmojiReact")
	\|> Map.put("content", "👎")
	\|> handle_incoming_normalized(options)
	end

	defp handle_incoming_normalized(
	%{"type" => "Undo", "object" => %{"type" => "Dislike"}} = data,
	options
	) do
	data
	\|> put_in(["object", "type"], "EmojiReact")
	\|> put_in(["object", "content"], "👎")
	\|> handle_incoming_normalized(options)
	end

	defp handle_incoming_normalized(_, _), do: :error

	@spec get_obj_helper(String.t(), Keyword.t()) :: {:ok, Object.t()} \| nil
	def get_obj_helper(id, options \\ []) do
	options = Keyword.put(options, :fetch, true)

	case Object.normalize(id, options) do
	%Object{} = object -> {:ok, object}
	_ -> nil
	end
	end

	@spec get_embedded_obj_helper(String.t() \| Object.t(), User.t()) :: {:ok, Object.t()} \| nil
	def get_embedded_obj_helper(%{"attributedTo" => attributed_to, "id" => object_id} = data, %User{
	ap_id: ap_id
	})
	when attributed_to == ap_id do
	with {:ok, activity} <-
	handle_incoming(%{
	"type" => "Create",
	"to" => data["to"],
	"cc" => data["cc"],
	"actor" => attributed_to,
	"object" => data
	}) do
	{:ok, Object.normalize(activity, fetch: false)}
	else
	_ -> get_obj_helper(object_id)
	end
	end

	def get_embedded_obj_helper(object_id, _) do
	get_obj_helper(object_id)
	end

	def set_reply_to_uri(%{"inReplyTo" => in_reply_to} = object) when is_binary(in_reply_to) do
	with false <- String.starts_with?(in_reply_to, "http"),
	{:ok, %{data: replied_to_object}} <- get_obj_helper(in_reply_to) do
	Map.put(object, "inReplyTo", replied_to_object["external_url"] \|\| in_reply_to)
	else
	_e -> object
	end
	end

	def set_reply_to_uri(obj), do: obj

	@doc """
	Fedibird compatibility
	https://github.com/fedibird/mastodon/commit/dbd7ae6cf58a92ec67c512296b4daaea0d01e6ac
	"""
	def set_quote_url(%{"quoteUrl" => quote_url} = object) when is_binary(quote_url) do
	Map.put(object, "quoteUri", quote_url)
	end

	def set_quote_url(obj), do: obj

	@doc """
	Inline first page of the `replies` collection,
	containing any replies in chronological order.
	"""
	def set_replies(%{"type" => type} = obj_data)
	when type in Pleroma.Constants.status_object_types() do
	with obj_ap_id when is_binary(obj_ap_id) <- obj_data["id"],
	limit when limit > 0 <-
	Pleroma.Config.get([:activitypub, :note_replies_output_limit], 0),
	collection <-
	Pleroma.Web.ActivityPub.ObjectView.render("object_replies.json", %{
	render_params: %{object_ap_id: obj_data["id"], limit: limit, skip_ap_ctx: true}
	}) do
	Map.put(obj_data, "replies", collection)
	else
	0 -> Map.put(obj_data, "replies", obj_data["id"] <> "/replies")
	_ -> obj_data
	end
	end

	def set_replies(obj_data), do: obj_data

	+ defp set_voters_count(%{"voters" => [_ \| _] = voters} = obj) do
	+ Map.merge(obj, %{"votersCount" => length(voters)})
	+ end
	+
	+ defp set_voters_count(obj), do: obj
	+
	# Prepares and sanitizes the object for federation.
	def prepare_object(object) do
	object
	\|> add_hashtags
	\|> add_mention_tags
	\|> add_emoji_tags
	\|> add_attributed_to
	\|> prepare_attachments
	\|> set_conversation
	\|> set_reply_to_uri
	\|> set_quote_url
	\|> set_replies
	+ \|> set_voters_count
	\|> CommonFixes.maybe_add_content_map()
	\|> strip_internal_fields
	\|> strip_internal_tags
	\|> set_type
	\|> maybe_process_history
	end

	defp maybe_process_history(%{"formerRepresentations" => %{"orderedItems" => history}} = object) do
	processed_history =
	Enum.map(
	history,
	fn
	item when is_map(item) -> prepare_object(item)
	item -> item
	end
	)

	put_in(object, ["formerRepresentations", "orderedItems"], processed_history)
	end

	defp maybe_process_history(object) do
	object
	end

	# @doc
	# """
	# internal -> Mastodon
	# """

	def prepare_activity(%{"type" => activity_type, "object" => object_id} = data)
	when activity_type in ["Create", "Listen"] do
	object =
	object_id
	\|> Object.normalize(fetch: false)
	\|> Map.get(:data)

	data =
	data
	\|> Map.put("object", prepare_object(object))
	\|> Map.merge(Utils.make_json_ld_header(object))
	\|> Map.delete("bcc")

	{:ok, data}
	end

	def prepare_activity(%{"type" => "Update", "object" => %{"type" => objtype} = object} = data)
	when objtype in Pleroma.Constants.updatable_object_types() do
	data =
	data
	\|> Map.put("object", prepare_object(object))
	\|> Map.merge(Utils.make_json_ld_header(object))
	\|> Map.delete("bcc")

	{:ok, data}
	end

	def prepare_activity(%{"type" => "Update", "object" => %{"type" => objtype} = object} = data)
	when objtype in Pleroma.Constants.actor_types() do
	object =
	object
	\|> maybe_fix_user_object()
	\|> strip_internal_fields()

	data =
	data
	\|> Map.put("object", object)
	\|> strip_internal_fields()
	\|> Map.merge(Utils.make_json_ld_header(object))
	\|> Map.delete("bcc")

	{:ok, data}
	end

	def prepare_activity(%{"type" => "Update", "object" => %{}} = data) do
	raise "Requested to serve an Update for non-updateable object type: #{inspect(data)}"
	end

	def prepare_activity(%{"type" => "Announce", "actor" => ap_id, "object" => object_id} = data) do
	object =
	object_id
	\|> Object.normalize(fetch: false)

	data =
	if Visibility.private?(object) && object.data["actor"] == ap_id do
	data \|> Map.put("object", object \|> Map.get(:data) \|> prepare_object)
	else
	data \|> maybe_fix_object_url
	end

	data =
	data
	\|> strip_internal_fields
	\|> Map.merge(Utils.make_json_ld_header())
	\|> Map.delete("bcc")

	{:ok, data}
	end

	# Mastodon Accept/Reject requires a non-normalized object containing the actor URIs,
	# because of course it does.
	def prepare_activity(%{"type" => "Accept"} = data) do
	with follow_activity <- Activity.normalize(data["object"]) do
	object = %{
	"actor" => follow_activity.actor,
	"object" => follow_activity.data["object"],
	"id" => follow_activity.data["id"],
	"type" => "Follow"
	}

	data =
	data
	\|> Map.put("object", object)
	\|> Map.merge(Utils.make_json_ld_header())

	{:ok, data}
	end
	end

	def prepare_activity(%{"type" => "Reject"} = data) do
	with follow_activity <- Activity.normalize(data["object"]) do
	object = %{
	"actor" => follow_activity.actor,
	"object" => follow_activity.data["object"],
	"id" => follow_activity.data["id"],
	"type" => "Follow"
	}

	data =
	data
	\|> Map.put("object", object)
	\|> Map.merge(Utils.make_json_ld_header())

	{:ok, data}
	end
	end

	def prepare_activity(%{"type" => "Flag"} = data) do
	with {:ok, stripped_activity} <- Utils.strip_report_status_data(data),
	stripped_activity <- Utils.maybe_anonymize_reporter(stripped_activity),
	stripped_activity <- Map.merge(stripped_activity, Utils.make_json_ld_header()) do
	{:ok, stripped_activity}
	end
	end

	def prepare_activity(%{"type" => _type} = data) do
	data =
	data
	\|> strip_internal_fields
	\|> maybe_fix_object_url
	\|> Map.merge(Utils.make_json_ld_header(data))

	{:ok, data}
	end

	def maybe_fix_object_url(%{"object" => object} = data) when is_binary(object) do
	with false <- String.starts_with?(object, "http"),
	{:fetch, {:ok, relative_object}} <- {:fetch, get_obj_helper(object)},
	%{data: %{"external_url" => external_url}} when not is_nil(external_url) <-
	relative_object do
	Map.put(data, "object", external_url)
	else
	{:fetch, _} ->
	data

	_ ->
	data
	end
	end

	def maybe_fix_object_url(data), do: data

	def add_hashtags(object) do
	tags =
	(object["tag"] \|\| [])
	\|> Enum.map(fn
	# Expand internal representation tags into AS2 tags.
	tag when is_binary(tag) ->
	%{
	"href" => Pleroma.Web.Endpoint.url() <> "/tags/#{tag}",
	"name" => "##{tag}",
	"type" => "Hashtag"
	}

	# Do not process tags which are already AS2 tag objects.
	tag when is_map(tag) ->
	tag
	end)

	Map.put(object, "tag", tags)
	end

	# TODO These should be added on our side on insertion, it doesn't make much
	# sense to regenerate these all the time
	def add_mention_tags(object) do
	to = object["to"] \|\| []
	cc = object["cc"] \|\| []
	mentioned = User.get_users_from_set(to ++ cc, local_only: false)

	mentions = Enum.map(mentioned, &build_mention_tag/1)

	tags = object["tag"] \|\| []
	Map.put(object, "tag", tags ++ mentions)
	end

	defp build_mention_tag(%{ap_id: ap_id, nickname: nickname} = _) do
	%{"type" => "Mention", "href" => ap_id, "name" => "@#{nickname}"}
	end

	def take_emoji_tags(%User{emoji: emoji}) do
	emoji
	\|> Map.to_list()
	\|> Enum.map(&Emoji.build_emoji_tag/1)
	end

	# TODO: we should probably send mtime instead of unix epoch time for updated
	def add_emoji_tags(%{"emoji" => emoji} = object) do
	tags = object["tag"] \|\| []

	out = Enum.map(emoji, &Emoji.build_emoji_tag/1)

	Map.put(object, "tag", tags ++ out)
	end

	def add_emoji_tags(object), do: object

	def set_conversation(object) do
	Map.put(object, "conversation", object["context"])
	end

	def set_type(%{"type" => "Answer"} = object) do
	Map.put(object, "type", "Note")
	end

	def set_type(object), do: object

	def add_attributed_to(object) do
	attributed_to = object["attributedTo"] \|\| object["actor"]
	Map.put(object, "attributedTo", attributed_to)
	end

	# TODO: Revisit this
	def prepare_attachments(%{"type" => "ChatMessage"} = object), do: object

	def prepare_attachments(object) do
	attachments =
	object
	\|> Map.get("attachment", [])
	\|> Enum.map(fn data ->
	[%{"mediaType" => media_type, "href" => href} = url \| _] = data["url"]

	%{
	"url" => href,
	"mediaType" => media_type,
	"name" => data["name"],
	"type" => "Document"
	}
	\|> Maps.put_if_present("width", url["width"])
	\|> Maps.put_if_present("height", url["height"])
	\|> Maps.put_if_present("blurhash", data["blurhash"])
	end)

	Map.put(object, "attachment", attachments)
	end

	def strip_internal_fields(object) do
	Map.drop(object, Pleroma.Constants.object_internal_fields())
	end

	defp strip_internal_tags(%{"tag" => tags} = object) do
	tags = Enum.filter(tags, fn x -> is_map(x) end)

	Map.put(object, "tag", tags)
	end

	defp strip_internal_tags(object), do: object

	def maybe_fix_user_url(%{"url" => url} = data) when is_map(url) do
	Map.put(data, "url", url["href"])
	end

	def maybe_fix_user_url(data), do: data

	def maybe_fix_user_object(data), do: maybe_fix_user_url(data)
	end
	diff --git a/lib/pleroma/web/endpoint.ex b/lib/pleroma/web/endpoint.ex
	index bab3c9fd0..81a9d3a09 100644
	--- a/lib/pleroma/web/endpoint.ex
	+++ b/lib/pleroma/web/endpoint.ex
	@@ -1,196 +1,206 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Endpoint do
	use Phoenix.Endpoint, otp_app: :pleroma

	require Pleroma.Constants

	alias Pleroma.Config

	socket("/api/v1/streaming", Pleroma.Web.MastodonAPI.WebsocketHandler,
	longpoll: false,
	websocket: [
	path: "/",
	compress: false,
	connect_info: [:sec_websocket_protocol],
	error_handler: {Pleroma.Web.MastodonAPI.WebsocketHandler, :handle_error, []},
	fullsweep_after: 20
	]
	)

	socket("/socket", Pleroma.Web.UserSocket,
	websocket: [
	path: "/websocket",
	serializer: [
	{Phoenix.Socket.V1.JSONSerializer, "~> 1.0.0"},
	{Phoenix.Socket.V2.JSONSerializer, "~> 2.0.0"}
	],
	timeout: 60_000,
	transport_log: false,
	compress: false,
	fullsweep_after: 20
	],
	longpoll: false
	)

	socket("/live", Phoenix.LiveView.Socket)

	plug(Plug.Telemetry, event_prefix: [:phoenix, :endpoint])

	plug(Pleroma.Web.Plugs.LoggerMetadataPath)

	plug(Pleroma.Web.Plugs.SetLocalePlug)
	plug(CORSPlug)
	plug(Pleroma.Web.Plugs.HTTPSecurityPlug)
	plug(Pleroma.Web.Plugs.UploadedMedia)

	- @static_cache_control "public, max-age=1209600"
	+ @static_cache_control "public, max-age=1209600, immutable"
	@static_cache_disabled "public, no-cache"
	+ @favicon_cache_control "public, max=age=86400, immutable" # cache for a day

	# InstanceStatic needs to be before Plug.Static to be able to override shipped-static files
	# If you're adding new paths to `only:` you'll need to configure them in InstanceStatic as well
	# Cache-control headers are duplicated in case we turn off etags in the future
	plug(
	Pleroma.Web.Plugs.InstanceStatic,
	at: "/",
	from: :pleroma,
	only: ["emoji", "images"],
	gzip: true,
	cache_control_for_etags: @static_cache_control,
	headers: %{
	"cache-control" => @static_cache_control
	}
	)

	+ plug(Pleroma.Web.Plugs.FaviconPlug,
	+ at: "/",
	+ only: ["favicon.png"],
	+ cache_control_for_etags: @favicon_cache_control,
	+ headers: %{
	+ "cache-control" => @favicon_cache_control
	+ }
	+ )
	+
	plug(Pleroma.Web.Plugs.InstanceStatic,
	at: "/",
	gzip: true,
	cache_control_for_etags: @static_cache_disabled,
	headers: %{
	"cache-control" => @static_cache_disabled
	}
	)

	plug(Pleroma.Web.Plugs.FrontendStatic,
	at: "/",
	frontend_type: :primary,
	only: ["index.html"],
	gzip: true,
	cache_control_for_etags: @static_cache_disabled,
	headers: %{
	"cache-control" => @static_cache_disabled
	}
	)

	plug(Pleroma.Web.Plugs.FrontendStatic,
	at: "/",
	frontend_type: :primary,
	gzip: true,
	cache_control_for_etags: @static_cache_control,
	headers: %{
	"cache-control" => @static_cache_control
	}
	)

	plug(Plug.Static.IndexHtml, at: "/pleroma/admin/")

	plug(Pleroma.Web.Plugs.FrontendStatic,
	at: "/pleroma/admin",
	frontend_type: :admin,
	gzip: true,
	cache_control_for_etags: @static_cache_disabled,
	headers: %{
	"cache-control" => @static_cache_disabled
	}
	)

	# Serve at "/" the static files from "priv/static" directory.
	#
	# You should set gzip to true if you are running phoenix.digest
	# when deploying your static files in production.
	plug(
	Plug.Static,
	at: "/",
	from: :pleroma,
	only: Pleroma.Constants.static_only_files(),
	# credo:disable-for-previous-line Credo.Check.Readability.MaxLineLength
	gzip: true,
	cache_control_for_etags: @static_cache_disabled,
	headers: %{
	"cache-control" => @static_cache_disabled
	}
	)

	plug(Plug.Static,
	at: "/pleroma/admin/",
	from: {:pleroma, "priv/static/adminfe/"}
	)

	# Code reloading can be explicitly enabled under the
	# :code_reloader configuration of your endpoint.
	if code_reloading? do
	plug(Phoenix.CodeReloader)
	end

	plug(Pleroma.Web.Plugs.TrailingFormatPlug)
	plug(Plug.RequestId)
	plug(Plug.Logger, log: :debug)

	plug(Plug.Parsers,
	parsers: [:urlencoded, Pleroma.Web.Multipart, :json],
	pass: ["/"],
	json_decoder: Jason,
	# Note: this is compile-time only, won't work for database-config
	length: Config.get([:instance, :upload_limit]),
	body_reader: {Pleroma.Web.Plugs.DigestPlug, :read_body, []}
	)

	plug(Plug.MethodOverride)
	plug(Plug.Head)

	secure_cookies = Config.get([__MODULE__, :secure_cookie_flag])

	cookie_name =
	if secure_cookies,
	do: "__Host-pleroma_key",
	else: "pleroma_key"

	extra =
	Config.get([__MODULE__, :extra_cookie_attrs])
	\|> Enum.join(";")

	# The session will be stored in the cookie and signed,
	# this means its contents can be read but not tampered with.
	# Set :encryption_salt if you would also like to encrypt it.
	plug(
	Plug.Session,
	store: :cookie,
	key: cookie_name,
	signing_salt: Config.get([__MODULE__, :signing_salt], "CqaoopA2"),
	http_only: true,
	secure: secure_cookies,
	extra: extra
	)

	plug(Pleroma.Web.Plugs.RemoteIp)

	plug(Pleroma.Web.Router)

	@doc """
	Dynamically loads configuration from the system environment
	on startup.

	It receives the endpoint configuration from the config files
	and must return the updated configuration.
	"""
	def load_from_system_env(config) do
	port = System.get_env("PORT") \|\| raise "expected the PORT environment variable to be set"
	{:ok, Keyword.put(config, :http, [:inet6, port: port])}
	end

	def websocket_url do
	String.replace_leading(url(), "http", "ws")
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/views/poll_view.ex b/lib/pleroma/web/mastodon_api/views/poll_view.ex
	index 1e3c9f36d..3b4271227 100644
	--- a/lib/pleroma/web/mastodon_api/views/poll_view.ex
	+++ b/lib/pleroma/web/mastodon_api/views/poll_view.ex
	@@ -1,105 +1,107 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.PollView do
	use Pleroma.Web, :view

	alias Pleroma.Web.CommonAPI.Utils

	def render("show.json", %{object: object, multiple: multiple, options: options} = params) do
	{end_time, expired} = end_time_and_expired(object)
	{options, votes_count} = options_and_votes_count(options)

	poll = %{
	# Mastodon uses separate ids for polls, but an object can't have
	# more than one poll embedded so object id is fine
	id: to_string(object.id),
	expires_at: end_time,
	expired: expired,
	multiple: multiple,
	votes_count: votes_count,
	voters_count: voters_count(object),
	options: options,
	emojis: Pleroma.Web.MastodonAPI.StatusView.build_emojis(object.data["emoji"]),
	pleroma: %{
	non_anonymous: object.data["nonAnonymous"] \|\| false
	}
	}

	if params[:for] do
	# when unauthenticated Mastodon doesn't include `voted` & `own_votes` keys in response
	{voted, own_votes} = voted_and_own_votes(params, options)
	Map.merge(poll, %{voted: voted, own_votes: own_votes})
	else
	poll
	end
	end

	def render("show.json", %{object: object} = params) do
	case object.data do
	%{"anyOf" => [_ \| _] = options} ->
	render(__MODULE__, "show.json", Map.merge(params, %{multiple: true, options: options}))

	%{"oneOf" => [_ \| _] = options} ->
	render(__MODULE__, "show.json", Map.merge(params, %{multiple: false, options: options}))

	_ ->
	nil
	end
	end

	defp end_time_and_expired(object) do
	if object.data["closed"] do
	end_time = NaiveDateTime.from_iso8601!(object.data["closed"])
	expired = NaiveDateTime.compare(end_time, NaiveDateTime.utc_now()) == :lt

	{Utils.to_masto_date(end_time), expired}
	else
	{nil, false}
	end
	end

	defp options_and_votes_count(options) do
	Enum.map_reduce(options, 0, fn %{"name" => name} = option, count ->
	current_count = option["replies"]["totalItems"] \|\| 0

	{%{
	title: name,
	votes_count: current_count
	}, current_count + count}
	end)
	end

	defp voters_count(%{data: %{"voters" => [_ \| _] = voters}}) do
	length(voters)
	end

	+ defp voters_count(%{data: %{"votersCount" => voters}}), do: voters
	+
	defp voters_count(_), do: 0

	defp voted_and_own_votes(%{object: object} = params, options) do
	if params[:for] do
	existing_votes =
	Pleroma.Web.ActivityPub.Utils.get_existing_votes(params[:for].ap_id, object)

	voted = existing_votes != [] or params[:for].ap_id == object.data["actor"]

	own_votes =
	if voted do
	titles = Enum.map(options, & &1[:title])

	Enum.reduce(existing_votes, [], fn vote, acc ->
	data = vote \|> Map.get(:object) \|> Map.get(:data)
	index = Enum.find_index(titles, &(&1 == data["name"]))
	[index \| acc]
	end)
	else
	[]
	end

	{voted, own_votes}
	else
	{false, []}
	end
	end
	end
	diff --git a/lib/pleroma/web/plugs/favicon_plug.ex b/lib/pleroma/web/plugs/favicon_plug.ex
	new file mode 100644
	index 000000000..e2e1f1adb
	--- /dev/null
	+++ b/lib/pleroma/web/plugs/favicon_plug.ex
	@@ -0,0 +1,71 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2026 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.Plugs.FaviconPlug do
	+ @behaviour Plug
	+
	+ @moduledoc """
	+ This is a shim to call `Plug.Static` but with runtime `from` configuration for instance favicon.
	+
	+ Serves default or custom favicon.png with cacheable cache-control.
	+ """
	+
	+ import Plug.Conn, only: [put_resp_header: 3, send_resp: 3, halt: 1]
	+
	+ require Logger
	+
	+ def init(opts) do
	+ opts
	+ \|> Keyword.put(:from, "__unconfigured_favicon_static_plug")
	+ \|> Plug.Static.init()
	+ end
	+
	+ def call(%{request_path: "/favicon.png"} = conn, opts) do
	+ case find_favicon_dir() do
	+ {:ok, dir} ->
	+ call_static(conn, opts, dir)
	+
	+ :error ->
	+ # Favicon should always be available and this should never occur.
	+ # If it does, halt the pipeline before having unintended side-effects.
	+ Logger.error("No favicon.png found! Is the default favicon deleted?")
	+
	+ conn
	+ \|> send_resp(404, "Not found")
	+ \|> halt()
	+ end
	+ end
	+
	+ def call(conn, _) do
	+ conn
	+ end
	+
	+ defp find_favicon_dir do
	+ instance_dir = Pleroma.Config.get([:instance, :static_dir], "instance/static")
	+ instance_path = Path.join(instance_dir, "favicon.png")
	+
	+ priv_dir = Application.app_dir(:pleroma, "priv/static")
	+ priv_path = Path.join(priv_dir, "favicon.png")
	+
	+ cond do
	+ File.exists?(instance_path) -> {:ok, instance_dir}
	+ File.exists?(priv_path) -> {:ok, priv_dir}
	+ true -> :error
	+ end
	+ end
	+
	+ defp call_static(conn, opts, from) do
	+ opts =
	+ opts
	+ \|> Map.put(:from, from)
	+ \|> Map.put(:content_types, false)
	+
	+ conn = set_content_type(conn)
	+ Plug.Static.call(conn, opts)
	+ end
	+
	+ defp set_content_type(conn) do
	+ put_resp_header(conn, "content-type", "image/png")
	+ end
	+end
	diff --git a/lib/pleroma/web/plugs/uploaded_media.ex b/lib/pleroma/web/plugs/uploaded_media.ex
	index abacf965b..5a3ea12aa 100644
	--- a/lib/pleroma/web/plugs/uploaded_media.ex
	+++ b/lib/pleroma/web/plugs/uploaded_media.ex
	@@ -1,127 +1,127 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Plugs.UploadedMedia do
	@moduledoc """
	"""

	import Plug.Conn
	import Pleroma.Web.Gettext
	require Logger

	alias Pleroma.Web.MediaProxy
	alias Pleroma.Web.Plugs.Utils

	@behaviour Plug
	# no slashes
	@path "media"

	- @default_cache_control_header "public, max-age=1209600"
	+ @default_cache_control_header "public, max-age=1209600, immutable"

	def init(_opts) do
	static_plug_opts =
	[
	headers: %{"cache-control" => @default_cache_control_header},
	cache_control_for_etags: @default_cache_control_header
	]
	\|> Keyword.put(:from, "__unconfigured_media_plug")
	\|> Keyword.put(:at, "/__unconfigured_media_plug")
	\|> Plug.Static.init()

	allowed_mime_types = Pleroma.Config.get([Pleroma.Upload, :allowed_mime_types])

	%{static_plug_opts: static_plug_opts, allowed_mime_types: allowed_mime_types}
	end

	def call(%{request_path: <<"/", @path, "/", file::binary>>} = conn, opts) do
	conn =
	case fetch_query_params(conn) do
	%{query_params: %{"name" => name}} = conn ->
	name = String.replace(name, ~s["], ~s[\\"])

	put_resp_header(conn, "content-disposition", ~s[inline; filename="#{name}"])

	conn ->
	conn
	end
	\|> merge_resp_headers([{"content-security-policy", "sandbox"}])

	config = Pleroma.Config.get(Pleroma.Upload)

	with uploader <- Keyword.fetch!(config, :uploader),
	proxy_remote = Keyword.get(config, :proxy_remote, false),
	{:ok, get_method} <- uploader.get_file(file),
	false <- media_is_banned(conn, get_method) do
	get_media(conn, get_method, proxy_remote, opts)
	else
	_ ->
	conn
	\|> send_resp(:internal_server_error, dgettext("errors", "Failed"))
	\|> halt()
	end
	end

	def call(conn, _opts), do: conn

	defp media_is_banned(%{request_path: path} = _conn, {:static_dir, _}) do
	MediaProxy.in_banned_urls(Pleroma.Upload.base_url() <> path)
	end

	defp media_is_banned(_, {:url, url}), do: MediaProxy.in_banned_urls(url)

	defp media_is_banned(_, _), do: false

	defp set_content_type(conn, opts, filepath) do
	real_mime = MIME.from_path(filepath)
	clean_mime = Utils.get_safe_mime_type(opts, real_mime)
	put_resp_header(conn, "content-type", clean_mime)
	end

	defp get_media(conn, {:static_dir, directory}, _, opts) do
	static_opts =
	Map.get(opts, :static_plug_opts)
	\|> Map.put(:at, [@path])
	\|> Map.put(:from, directory)
	\|> Map.put(:content_types, false)

	conn =
	conn
	\|> set_content_type(opts, conn.request_path)
	\|> Plug.Static.call(static_opts)

	if conn.halted do
	conn
	else
	conn
	\|> send_resp(:not_found, dgettext("errors", "Not found"))
	\|> halt()
	end
	end

	defp get_media(conn, {:url, url}, true, _) do
	proxy_opts = [
	http: [
	follow_redirect: true,
	pool: :upload
	]
	]

	conn
	\|> Pleroma.ReverseProxy.call(url, proxy_opts)
	end

	defp get_media(conn, {:url, url}, _, _) do
	conn
	\|> Phoenix.Controller.redirect(external: url)
	\|> halt()
	end

	defp get_media(conn, unknown, _, _) do
	Logger.error("#{__MODULE__}: Unknown get strategy: #{inspect(unknown)}")

	conn
	\|> send_resp(:internal_server_error, dgettext("errors", "Internal Error"))
	\|> halt()
	end
	end
	diff --git a/test/pleroma/reverse_proxy_test.exs b/test/pleroma/reverse_proxy_test.exs
	index 8dbe9c6bf..ec4470379 100644
	--- a/test/pleroma/reverse_proxy_test.exs
	+++ b/test/pleroma/reverse_proxy_test.exs
	@@ -1,461 +1,461 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.ReverseProxyTest do
	use Pleroma.Web.ConnCase
	import ExUnit.CaptureLog
	import Mox

	alias Pleroma.ReverseProxy
	alias Pleroma.ReverseProxy.ClientMock
	alias Plug.Conn

	setup_all do
	{:ok, _} = Registry.start_link(keys: :unique, name: ClientMock)
	:ok
	end

	setup :verify_on_exit!

	defp request_mock(invokes) do
	ClientMock
	\|> expect(:request, fn :get, url, headers, _body, _opts ->
	Registry.register(ClientMock, url, 0)
	body = headers \|> Enum.into(%{}) \|> Jason.encode!()

	{:ok, 200,
	[
	{"content-type", "application/json"},
	{"content-length", byte_size(body) \|> to_string()}
	], %{url: url, body: body}}
	end)
	\|> expect(:stream_body, invokes, fn %{url: url, body: body} = client ->
	case Registry.lookup(ClientMock, url) do
	[{_, 0}] ->
	Registry.update_value(ClientMock, url, &(&1 + 1))
	{:ok, body, client}

	[{_, 1}] ->
	Registry.unregister(ClientMock, url)
	:done
	end
	end)
	end

	describe "reverse proxy" do
	test "do not track successful request", %{conn: conn} do
	request_mock(2)
	url = "/success"

	conn = ReverseProxy.call(conn, url)

	assert conn.status == 200
	assert Cachex.get(:failed_proxy_url_cache, url) == {:ok, nil}
	end
	end

	test "use Pleroma's user agent in the request; don't pass the client's", %{conn: conn} do
	request_mock(2)

	conn =
	conn
	\|> Plug.Conn.put_req_header("user-agent", "fake/1.0")
	\|> ReverseProxy.call("/user-agent")

	# Convert the response to a map without relying on json_response
	body = conn.resp_body
	assert conn.status == 200
	response = Jason.decode!(body)
	assert response == %{"user-agent" => Pleroma.Application.user_agent()}
	end

	test "closed connection", %{conn: conn} do
	ClientMock
	\|> expect(:request, fn :get, "/closed", _, _, _ -> {:ok, 200, [], %{}} end)
	\|> expect(:stream_body, fn _ -> {:error, :closed} end)
	\|> expect(:close, fn _ -> :ok end)

	conn = ReverseProxy.call(conn, "/closed")
	assert conn.halted
	end

	defp stream_mock(invokes, with_close? \\ false) do
	ClientMock
	\|> expect(:request, fn :get, "/stream-bytes/" <> length, _, _, _ ->
	Registry.register(ClientMock, "/stream-bytes/" <> length, 0)

	{:ok, 200, [{"content-type", "application/octet-stream"}],
	%{url: "/stream-bytes/" <> length}}
	end)
	\|> expect(:stream_body, invokes, fn %{url: "/stream-bytes/" <> length} = client ->
	max = String.to_integer(length)

	case Registry.lookup(ClientMock, "/stream-bytes/" <> length) do
	[{_, current}] when current < max ->
	Registry.update_value(
	ClientMock,
	"/stream-bytes/" <> length,
	&(&1 + 10)
	)

	{:ok, "0123456789", client}

	[{_, ^max}] ->
	Registry.unregister(ClientMock, "/stream-bytes/" <> length)
	:done
	end
	end)

	if with_close? do
	expect(ClientMock, :close, fn _ -> :ok end)
	end
	end

	describe "max_body" do
	test "length returns error if content-length more than option", %{conn: conn} do
	request_mock(0)

	assert capture_log(fn ->
	ReverseProxy.call(conn, "/huge-file", max_body_length: 4)
	end) =~
	"[error] Elixir.Pleroma.ReverseProxy: request to \"/huge-file\" failed: :body_too_large"

	assert {:ok, true} == Cachex.get(:failed_proxy_url_cache, "/huge-file")

	assert capture_log(fn ->
	ReverseProxy.call(conn, "/huge-file", max_body_length: 4)
	end) == ""
	end

	test "max_body_length returns error if streaming body more than that option", %{conn: conn} do
	stream_mock(3, true)

	assert capture_log(fn ->
	ReverseProxy.call(conn, "/stream-bytes/50", max_body_length: 30)
	end) =~
	"Elixir.Pleroma.ReverseProxy request to /stream-bytes/50 failed while reading/chunking: :body_too_large"
	end
	end

	describe "HEAD requests" do
	test "common", %{conn: conn} do
	ClientMock
	\|> expect(:request, fn :head, "/head", _, _, _ ->
	{:ok, 200, [{"content-type", "image/png"}]}
	end)

	conn = ReverseProxy.call(Map.put(conn, :method, "HEAD"), "/head")

	assert conn.status == 200
	assert Conn.get_resp_header(conn, "content-type") == ["image/png"]
	assert conn.resp_body == ""
	end
	end

	defp error_mock(status) when is_integer(status) do
	ClientMock
	\|> expect(:request, fn :get, "/status/" <> _, _, _, _ ->
	{:error, status}
	end)
	end

	describe "returns error on" do
	test "500", %{conn: conn} do
	error_mock(500)
	url = "/status/500"

	capture_log(fn -> ReverseProxy.call(conn, url) end) =~
	"[error] Elixir.Pleroma.ReverseProxy: request to /status/500 failed with HTTP status 500"

	assert Cachex.get(:failed_proxy_url_cache, url) == {:ok, true}

	{:ok, ttl} = Cachex.ttl(:failed_proxy_url_cache, url)
	assert ttl <= 60_000
	end

	test "400", %{conn: conn} do
	error_mock(400)
	url = "/status/400"

	capture_log(fn -> ReverseProxy.call(conn, url) end) =~
	"[error] Elixir.Pleroma.ReverseProxy: request to /status/400 failed with HTTP status 400"

	assert Cachex.get(:failed_proxy_url_cache, url) == {:ok, true}
	assert Cachex.ttl(:failed_proxy_url_cache, url) == {:ok, nil}
	end

	test "403", %{conn: conn} do
	error_mock(403)
	url = "/status/403"

	capture_log(fn ->
	ReverseProxy.call(conn, url, failed_request_ttl: :timer.seconds(120))
	end) =~
	"[error] Elixir.Pleroma.ReverseProxy: request to /status/403 failed with HTTP status 403"

	{:ok, ttl} = Cachex.ttl(:failed_proxy_url_cache, url)
	assert ttl > 100_000
	end

	test "204", %{conn: conn} do
	url = "/status/204"
	expect(ClientMock, :request, fn :get, _url, _, _, _ -> {:ok, 204, [], %{}} end)

	capture_log(fn ->
	conn = ReverseProxy.call(conn, url)
	assert conn.resp_body == "Request failed: No Content"
	assert conn.halted
	end) =~
	"[error] Elixir.Pleroma.ReverseProxy: request to \"/status/204\" failed with HTTP status 204"

	assert Cachex.get(:failed_proxy_url_cache, url) == {:ok, true}
	assert Cachex.ttl(:failed_proxy_url_cache, url) == {:ok, nil}
	end
	end

	test "streaming", %{conn: conn} do
	stream_mock(21)
	conn = ReverseProxy.call(conn, "/stream-bytes/200")
	assert conn.state == :chunked
	assert byte_size(conn.resp_body) == 200
	assert Conn.get_resp_header(conn, "content-type") == ["application/octet-stream"]
	end

	defp headers_mock(_) do
	ClientMock
	\|> expect(:request, fn :get, "/headers", headers, _, _ ->
	Registry.register(ClientMock, "/headers", 0)
	{:ok, 200, [{"content-type", "application/json"}], %{url: "/headers", headers: headers}}
	end)
	\|> expect(:stream_body, 2, fn %{url: url, headers: headers} = client ->
	case Registry.lookup(ClientMock, url) do
	[{_, 0}] ->
	Registry.update_value(ClientMock, url, &(&1 + 1))
	headers = for {k, v} <- headers, into: %{}, do: {String.capitalize(k), v}
	{:ok, Jason.encode!(%{headers: headers}), client}

	[{_, 1}] ->
	Registry.unregister(ClientMock, url)
	:done
	end
	end)

	:ok
	end

	describe "keep request headers" do
	setup [:headers_mock]

	test "header passes", %{conn: conn} do
	conn =
	Conn.put_req_header(
	conn,
	"accept",
	"text/html"
	)
	\|> ReverseProxy.call("/headers")

	body = conn.resp_body
	assert conn.status == 200
	response = Jason.decode!(body)
	headers = response["headers"]
	assert headers["Accept"] == "text/html"
	end

	test "header is filtered", %{conn: conn} do
	conn =
	Conn.put_req_header(
	conn,
	"accept-language",
	"en-US"
	)
	\|> ReverseProxy.call("/headers")

	body = conn.resp_body
	assert conn.status == 200
	response = Jason.decode!(body)
	headers = response["headers"]
	refute headers["Accept-Language"]
	end
	end

	test "returns 400 on non GET, HEAD requests", %{conn: conn} do
	conn = ReverseProxy.call(Map.put(conn, :method, "POST"), "/ip")
	assert conn.status == 400
	end

	describe "cache resp headers" do
	test "add cache-control", %{conn: conn} do
	ClientMock
	\|> expect(:request, fn :get, "/cache", _, _, _ ->
	{:ok, 200, [{"ETag", "some ETag"}], %{}}
	end)
	\|> expect(:stream_body, fn _ -> :done end)

	conn = ReverseProxy.call(conn, "/cache")
	- assert {"cache-control", "public, max-age=1209600"} in conn.resp_headers
	+ assert {"cache-control", "public, max-age=1209600, immutable"} in conn.resp_headers
	end
	end

	defp disposition_headers_mock(headers) do
	ClientMock
	\|> expect(:request, fn :get, "/disposition", _, _, _ ->
	Registry.register(ClientMock, "/disposition", 0)

	{:ok, 200, headers, %{url: "/disposition"}}
	end)
	\|> expect(:stream_body, 2, fn %{url: "/disposition"} = client ->
	case Registry.lookup(ClientMock, "/disposition") do
	[{_, 0}] ->
	Registry.update_value(ClientMock, "/disposition", &(&1 + 1))
	{:ok, "", client}

	[{_, 1}] ->
	Registry.unregister(ClientMock, "/disposition")
	:done
	end
	end)
	end

	describe "response content disposition header" do
	test "not attachment", %{conn: conn} do
	disposition_headers_mock([
	{"content-type", "image/gif"},
	{"content-length", "0"}
	])

	conn = ReverseProxy.call(conn, "/disposition")

	assert {"content-type", "image/gif"} in conn.resp_headers
	end

	test "with content-disposition header", %{conn: conn} do
	disposition_headers_mock([
	{"content-disposition", "attachment; filename=\"filename.jpg\""},
	{"content-length", "0"}
	])

	conn = ReverseProxy.call(conn, "/disposition")

	assert {"content-disposition", "attachment; filename=\"filename.jpg\""} in conn.resp_headers
	end
	end

	describe "content-type sanitisation" do
	test "preserves allowed image type", %{conn: conn} do
	ClientMock
	\|> expect(:request, fn :get, "/content", _, _, _ ->
	{:ok, 200, [{"content-type", "image/png"}], %{url: "/content"}}
	end)
	\|> expect(:stream_body, fn _ -> :done end)

	conn = ReverseProxy.call(conn, "/content")

	assert conn.status == 200
	assert Conn.get_resp_header(conn, "content-type") == ["image/png"]
	end

	test "preserves allowed video type", %{conn: conn} do
	ClientMock
	\|> expect(:request, fn :get, "/content", _, _, _ ->
	{:ok, 200, [{"content-type", "video/mp4"}], %{url: "/content"}}
	end)
	\|> expect(:stream_body, fn _ -> :done end)

	conn = ReverseProxy.call(conn, "/content")

	assert conn.status == 200
	assert Conn.get_resp_header(conn, "content-type") == ["video/mp4"]
	end

	test "sanitizes ActivityPub content type", %{conn: conn} do
	ClientMock
	\|> expect(:request, fn :get, "/content", _, _, _ ->
	{:ok, 200, [{"content-type", "application/activity+json"}], %{url: "/content"}}
	end)
	\|> expect(:stream_body, fn _ -> :done end)

	conn = ReverseProxy.call(conn, "/content")

	assert conn.status == 200
	assert Conn.get_resp_header(conn, "content-type") == ["application/octet-stream"]
	end

	test "sanitizes LD-JSON content type", %{conn: conn} do
	ClientMock
	\|> expect(:request, fn :get, "/content", _, _, _ ->
	{:ok, 200, [{"content-type", "application/ld+json"}], %{url: "/content"}}
	end)
	\|> expect(:stream_body, fn _ -> :done end)

	conn = ReverseProxy.call(conn, "/content")

	assert conn.status == 200
	assert Conn.get_resp_header(conn, "content-type") == ["application/octet-stream"]
	end
	end

	# Hackney is used for Reverse Proxy when Hackney or Finch is the Tesla Adapter
	# Gun is able to proxy through Tesla, so it does not need testing as the
	# test cases in the Pleroma.HTTPTest module are sufficient
	describe "Hackney URL encoding:" do
	setup do
	ClientMock
	\|> expect(:request, fn
	:get,
	"https://example.com/emoji/Pack%201/koronebless.png?foo=bar+baz",
	_headers,
	_body,
	_opts ->
	{:ok, 200, [{"content-type", "image/png"}], "It works!"}

	:get,
	"https://example.com/media/foo/bar%20!$&'()*+,;=/:%20@a%20%5Bbaz%5D.mp4",
	_headers,
	_body,
	_opts ->
	{:ok, 200, [{"content-type", "video/mp4"}], "Allowed reserved chars."}

	:get, "https://example.com/media/unicode%20%F0%9F%99%82%20.gif", _headers, _body, _opts ->
	{:ok, 200, [{"content-type", "image/gif"}], "Unicode emoji in path"}
	end)
	\|> stub(:stream_body, fn _ -> :done end)
	\|> stub(:close, fn _ -> :ok end)

	:ok
	end

	test "properly encodes URLs with spaces", %{conn: conn} do
	url_with_space = "https://example.com/emoji/Pack 1/koronebless.png?foo=bar baz"

	result = ReverseProxy.call(conn, url_with_space)

	assert result.status == 200
	end

	test "properly encoded URL should not be altered", %{conn: conn} do
	properly_encoded_url = "https://example.com/emoji/Pack%201/koronebless.png?foo=bar+baz"

	result = ReverseProxy.call(conn, properly_encoded_url)

	assert result.status == 200
	end

	test "properly encodes URLs with allowed reserved characters", %{conn: conn} do
	url_with_reserved_chars = "https://example.com/media/foo/bar !$&'()*+,;=/: @a [baz].mp4"

	result = ReverseProxy.call(conn, url_with_reserved_chars)

	assert result.status == 200
	end

	test "properly encodes URLs with unicode in path", %{conn: conn} do
	url_with_unicode = "https://example.com/media/unicode 🙂 .gif"

	result = ReverseProxy.call(conn, url_with_unicode)

	assert result.status == 200
	end
	end
	end
	diff --git a/test/pleroma/web/activity_pub/transmogrifier/question_handling_test.exs b/test/pleroma/web/activity_pub/transmogrifier/question_handling_test.exs
	index d31070546..2a4e78cf0 100644
	--- a/test/pleroma/web/activity_pub/transmogrifier/question_handling_test.exs
	+++ b/test/pleroma/web/activity_pub/transmogrifier/question_handling_test.exs
	@@ -1,173 +1,192 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.Transmogrifier.QuestionHandlingTest do
	use Pleroma.DataCase

	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.CommonAPI

	import Pleroma.Factory

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	test "Mastodon Question activity" do
	data = File.read!("test/fixtures/mastodon-question-activity.json") \|> Jason.decode!()

	{:ok, %Activity{local: false} = activity} = Transmogrifier.handle_incoming(data)

	object = Object.normalize(activity, fetch: false)

	assert object.data["url"] == "https://mastodon.sdf.org/@rinpatch/102070944809637304"

	assert object.data["closed"] == "2019-05-11T09:03:36Z"

	assert object.data["context"] == activity.data["context"]

	assert object.data["context"] ==
	"tag:mastodon.sdf.org,2019-05-10:objectId=15095122:objectType=Conversation"

	assert object.data["anyOf"] == []

	assert Enum.sort(object.data["oneOf"]) ==
	Enum.sort([
	%{
	"name" => "25 char limit is dumb",
	"replies" => %{"totalItems" => 0, "type" => "Collection"},
	"type" => "Note"
	},
	%{
	"name" => "Dunno",
	"replies" => %{"totalItems" => 0, "type" => "Collection"},
	"type" => "Note"
	},
	%{
	"name" => "Everyone knows that!",
	"replies" => %{"totalItems" => 1, "type" => "Collection"},
	"type" => "Note"
	},
	%{
	"name" => "I can't even fit a funny",
	"replies" => %{"totalItems" => 1, "type" => "Collection"},
	"type" => "Note"
	}
	])

	user = insert(:user)

	{:ok, reply_activity} = CommonAPI.post(user, %{status: "hewwo", in_reply_to_id: activity.id})

	reply_object = Object.normalize(reply_activity, fetch: false)

	assert reply_object.data["context"] == object.data["context"]
	end

	test "Mastodon Question activity with HTML tags in plaintext" do
	options = [
	%{
	"type" => "Note",
	"name" => "<input type=\"date\">",
	"replies" => %{"totalItems" => 0, "type" => "Collection"}
	},
	%{
	"type" => "Note",
	"name" => "<input type=\"date\"/>",
	"replies" => %{"totalItems" => 0, "type" => "Collection"}
	},
	%{
	"type" => "Note",
	"name" => "<input type=\"date\" />",
	"replies" => %{"totalItems" => 1, "type" => "Collection"}
	},
	%{
	"type" => "Note",
	"name" => "<input type=\"date\"></input>",
	"replies" => %{"totalItems" => 1, "type" => "Collection"}
	}
	]

	data =
	File.read!("test/fixtures/mastodon-question-activity.json")
	\|> Jason.decode!()
	\|> Kernel.put_in(["object", "oneOf"], options)

	{:ok, %Activity{local: false} = activity} = Transmogrifier.handle_incoming(data)
	object = Object.normalize(activity, fetch: false)

	assert Enum.sort(object.data["oneOf"]) == Enum.sort(options)
	end

	test "Mastodon Question activity with custom emojis" do
	options = [
	%{
	"type" => "Note",
	"name" => ":blobcat:",
	"replies" => %{"totalItems" => 0, "type" => "Collection"}
	},
	%{
	"type" => "Note",
	"name" => ":blobfox:",
	"replies" => %{"totalItems" => 0, "type" => "Collection"}
	}
	]

	tag = [
	%{
	"icon" => %{
	"type" => "Image",
	"url" => "https://blob.cat/emoji/custom/blobcats/blobcat.png"
	},
	"id" => "https://blob.cat/emoji/custom/blobcats/blobcat.png",
	"name" => ":blobcat:",
	"type" => "Emoji",
	"updated" => "1970-01-01T00:00:00Z"
	},
	%{
	"icon" => %{"type" => "Image", "url" => "https://blob.cat/emoji/blobfox/blobfox.png"},
	"id" => "https://blob.cat/emoji/blobfox/blobfox.png",
	"name" => ":blobfox:",
	"type" => "Emoji",
	"updated" => "1970-01-01T00:00:00Z"
	}
	]

	data =
	File.read!("test/fixtures/mastodon-question-activity.json")
	\|> Jason.decode!()
	\|> Kernel.put_in(["object", "oneOf"], options)
	\|> Kernel.put_in(["object", "tag"], tag)

	{:ok, %Activity{local: false} = activity} = Transmogrifier.handle_incoming(data)
	object = Object.normalize(activity, fetch: false)

	assert object.data["oneOf"] == options

	assert object.data["emoji"] == %{
	"blobcat" => "https://blob.cat/emoji/custom/blobcats/blobcat.png",
	"blobfox" => "https://blob.cat/emoji/blobfox/blobfox.png"
	}
	end

	test "returns same activity if received a second time" do
	data = File.read!("test/fixtures/mastodon-question-activity.json") \|> Jason.decode!()

	assert {:ok, %Activity{local: false} = activity} = Transmogrifier.handle_incoming(data)

	assert {:ok, ^activity} = Transmogrifier.handle_incoming(data)
	end

	test "accepts a Question with no content" do
	data =
	File.read!("test/fixtures/mastodon-question-activity.json")
	\|> Jason.decode!()
	\|> Kernel.put_in(["object", "content"], "")

	assert {:ok, %Activity{local: false}} = Transmogrifier.handle_incoming(data)
	end
	+
	+ test "it displays voters count for a poll" do
	+ user = insert(:user)
	+ other_user = insert(:user)
	+
	+ {:ok, activity} =
	+ CommonAPI.post(user, %{
	+ status: "???",
	+ poll: %{expires_in: 10, options: ["yes", "no"]}
	+ })
	+
	+ object = Object.normalize(activity, fetch: false)
	+ {:ok, _, _} = CommonAPI.vote(object, other_user, [1])
	+
	+ {:ok, modified} = Transmogrifier.prepare_activity(activity.data)
	+
	+ refute Map.has_key?(modified["object"], "voters")
	+ assert modified["object"]["votersCount"] == 1
	+ end
	end
	diff --git a/test/pleroma/web/mastodon_api/views/poll_view_test.exs b/test/pleroma/web/mastodon_api/views/poll_view_test.exs
	index 6de001421..16281393d 100644
	--- a/test/pleroma/web/mastodon_api/views/poll_view_test.exs
	+++ b/test/pleroma/web/mastodon_api/views/poll_view_test.exs
	@@ -1,176 +1,183 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.PollViewTest do
	use Pleroma.DataCase

	alias Pleroma.Object
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.PollView

	import Pleroma.Factory
	import Tesla.Mock

	setup do
	mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	test "renders a poll" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "Is Tenshi eating a corndog cute?",
	poll: %{
	options: ["absolutely!", "sure", "yes", "why are you even asking?"],
	expires_in: 20
	}
	})

	object = Object.normalize(activity, fetch: false)

	expected = %{
	emojis: [],
	expired: false,
	id: to_string(object.id),
	multiple: false,
	options: [
	%{title: "absolutely!", votes_count: 0},
	%{title: "sure", votes_count: 0},
	%{title: "yes", votes_count: 0},
	%{title: "why are you even asking?", votes_count: 0}
	],
	votes_count: 0,
	voters_count: 0,
	pleroma: %{non_anonymous: false}
	}

	result = PollView.render("show.json", %{object: object})
	expires_at = result.expires_at
	result = Map.delete(result, :expires_at)

	assert result == expected

	expires_at = NaiveDateTime.from_iso8601!(expires_at)
	assert NaiveDateTime.diff(expires_at, NaiveDateTime.utc_now()) in 15..20
	end

	test "detects if it is multiple choice" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "Which Mastodon developer is your favourite?",
	poll: %{
	options: ["Gargron", "Eugen"],
	expires_in: 20,
	multiple: true
	}
	})

	voter = insert(:user)

	object = Object.normalize(activity, fetch: false)

	{:ok, _votes, object} = CommonAPI.vote(object, voter, [0, 1])

	assert match?(
	%{
	multiple: true,
	voters_count: 1,
	votes_count: 2
	},
	PollView.render("show.json", %{object: object})
	)
	end

	test "detects emoji" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "What's with the smug face?",
	poll: %{
	options: [":blank: sip", ":blank::blank: sip", ":blank::blank::blank: sip"],
	expires_in: 20
	}
	})

	object = Object.normalize(activity, fetch: false)

	assert %{emojis: [%{shortcode: "blank"}]} = PollView.render("show.json", %{object: object})
	end

	test "detects vote status" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "Which input devices do you use?",
	poll: %{
	options: ["mouse", "trackball", "trackpoint"],
	multiple: true,
	expires_in: 20
	}
	})

	object = Object.normalize(activity, fetch: false)

	{:ok, _, object} = CommonAPI.vote(object, other_user, [1, 2])

	result = PollView.render("show.json", %{object: object, for: other_user})

	assert result[:voted] == true
	assert 1 in result[:own_votes]
	assert 2 in result[:own_votes]
	assert Enum.at(result[:options], 1)[:votes_count] == 1
	assert Enum.at(result[:options], 2)[:votes_count] == 1
	end

	test "does not crash on polls with no end date" do
	object = Object.normalize("https://skippers-bin.com/notes/7x9tmrp97i", fetch: true)
	result = PollView.render("show.json", %{object: object})

	assert result[:expires_at] == nil
	assert result[:expired] == false
	end

	test "doesn't strips HTML tags" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "What's with the smug face?",
	poll: %{
	options: [
	"<input type=\"date\">",
	"<input type=\"date\" >",
	"<input type=\"date\"/>",
	"<input type=\"date\"></input>"
	],
	expires_in: 20
	}
	})

	object = Object.normalize(activity, fetch: false)

	assert %{
	options: [
	%{title: "<input type=\"date\">", votes_count: 0},
	%{title: "<input type=\"date\" >", votes_count: 0},
	%{title: "<input type=\"date\"/>", votes_count: 0},
	%{title: "<input type=\"date\"></input>", votes_count: 0}
	]
	} = PollView.render("show.json", %{object: object})
	end

	- test "that poll is non anonymous" do
	+ test "displays correct voters count" do
	+ object = Object.normalize("https://friends.grishka.me/posts/54642", fetch: true)
	+ result = PollView.render("show.json", %{object: object})
	+
	+ assert result[:voters_count] == 14
	+ end
	+
	+ test "detects that poll is non anonymous" do
	object = Object.normalize("https://friends.grishka.me/posts/54642", fetch: true)
	result = PollView.render("show.json", %{object: object})

	assert result[:pleroma][:non_anonymous] == true
	end
	end
	diff --git a/test/pleroma/web/plugs/favicon_plug_test.exs b/test/pleroma/web/plugs/favicon_plug_test.exs
	new file mode 100644
	index 000000000..520501250
	--- /dev/null
	+++ b/test/pleroma/web/plugs/favicon_plug_test.exs
	@@ -0,0 +1,63 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2026 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.Plugs.FaviconPlugTest do
	+ use Pleroma.Web.ConnCase
	+
	+ @dir "test/tmp/favicon_static"
	+
	+ setup do
	+ Pleroma.Backports.mkdir_p!(@dir)
	+
	+ on_exit(fn -> File.rm_rf!(@dir) end)
	+ end
	+
	+ describe "default favicon" do
	+ test "returns favicon", %{conn: conn} do
	+ conn = get(conn, "/favicon.png")
	+ body_size = byte_size(conn.resp_body)
	+
	+ assert conn.status == 200
	+ assert body_size == 1583
	+ assert response_content_type(conn, :png)
	+ end
	+
	+ test "returns correct cache-control", %{conn: conn} do
	+ conn = get(conn, "/favicon.png")
	+ cache = get_resp_header(conn, "cache-control")
	+
	+ assert conn.status == 200
	+ assert cache == ["public, max=age=86400, immutable"]
	+ end
	+ end
	+
	+ describe "custom favicon" do
	+ setup do
	+ favicon_path = Path.join(@dir, "favicon.png")
	+ donor_image = "test/fixtures/image.png"
	+
	+ File.cp!(donor_image, favicon_path)
	+ clear_config([:instance, :static_dir], @dir)
	+
	+ on_exit(fn -> File.rm!(favicon_path) end)
	+ end
	+
	+ test "returns favicon", %{conn: conn} do
	+ conn = get(conn, "/favicon.png")
	+ body_size = byte_size(conn.resp_body)
	+
	+ assert conn.status == 200
	+ assert body_size == 104_426
	+ assert response_content_type(conn, :png)
	+ end
	+
	+ test "returns correct cache-control", %{conn: conn} do
	+ conn = get(conn, "/favicon.png")
	+ cache = get_resp_header(conn, "cache-control")
	+
	+ assert conn.status == 200
	+ assert cache == ["public, max=age=86400, immutable"]
	+ end
	+ end
	+end

File Metadata

Mime Type: text/x-diff
Expires: Fri, Oct 30, 9:41 PM (17 h, 9 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1800576
Default Alt Text: (111 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions