No OneTemporary
Actions

Authored By

Unknown

Size

384 KB

Referenced Files

None

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	diff --git a/CHANGELOG.md b/CHANGELOG.md
	index 86cbaeff7..149944a02 100644
	--- a/CHANGELOG.md
	+++ b/CHANGELOG.md
	@@ -1,209 +1,214 @@
	# Changelog
	All notable changes to this project will be documented in this file.

	The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

	## [Unreleased]
	### Changed
	- Breaking: Configuration: A setting to explicitly disable the mailer was added, defaulting to true, if you are using a mailer add `config :pleroma, Pleroma.Emails.Mailer, enabled: true` to your config
	- Configuration: OpenGraph and TwitterCard providers enabled by default
	- Configuration: Filter.AnonymizeFilename added ability to retain file extension with custom text
	+- Federation: Return 403 errors when trying to request pages from a user's follower/following collections if they have `hide_followers`/`hide_follows` set
	- NodeInfo: Return `skipThreadContainment` in `metadata` for the `skip_thread_containment` option

	### Fixed
	- Not being able to pin unlisted posts
	- Metadata rendering errors resulting in the entire page being inaccessible
	+- Federation/MediaProxy not working with instances that have wrong certificate order
	- Mastodon API: Handling of search timeouts (`/api/v1/search` and `/api/v2/search`)
	- Mastodon API: Embedded relationships not being properly rendered in the Account entity of Status entity
	- Mastodon API: Add `account_id`, `type`, `offset`, and `limit` to search API (`/api/v1/search` and `/api/v2/search`)
	+- ActivityPub C2S: follower/following collection pages being inaccessible even when authentifucated if `hide_followers`/ `hide_follows` was set

	### Added
	- MRF: Support for priming the mediaproxy cache (`Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy`)
	-Configuration: `federation_incoming_replies_max_depth` option
	+- MRF: Support for excluding specific domains from Transparency.
	+- Configuration: `federation_incoming_replies_max_depth` option
	- Mastodon API: Support for the [`tagged` filter](https://github.com/tootsuite/mastodon/pull/9755) in [`GET /api/v1/accounts/:id/statuses`](https://docs.joinmastodon.org/api/rest/accounts/#get-api-v1-accounts-id-statuses)
	- Mastodon API, streaming: Add support for passing the token in the `Sec-WebSocket-Protocol` header
	- Mastodon API, extension: Ability to reset avatar, profile banner, and background
	- Admin API: Return users' tags when querying reports
	- Admin API: Return avatar and display name when querying users
	- Admin API: Allow querying user by ID
	- Admin API: Added support for `tuples`.
	- Added synchronization of following/followers counters for external users
	- Configuration: `enabled` option for `Pleroma.Emails.Mailer`, defaulting to `false`.
	- Mastodon API: Add support for categories for custom emojis by reusing the group feature. <https://github.com/tootsuite/mastodon/pull/11196>
	+- Configuration: Pleroma.Plugs.RateLimiter `bucket_name`, `params` options.
	- Admin API: Endpoint for fetching latest user's statuses

	### Changed
	- Configuration: Filter.AnonymizeFilename added ability to retain file extension with custom text
	- Admin API: changed json structure for saving config settings.

	## [1.0.0] - 2019-06-29
	### Security
	- Mastodon API: Fix display names not being sanitized
	- Rich media: Do not crawl private IP ranges

	### Added
	- Add a generic settings store for frontends / clients to use.
	- Explicit addressing option for posting.
	- Optional SSH access mode. (Needs `erlang-ssh` package on some distributions).
	- [MongooseIM](https://github.com/esl/MongooseIM) http authentication support.
	- LDAP authentication
	- External OAuth provider authentication
	- Support for building a release using [`mix release`](https://hexdocs.pm/mix/master/Mix.Tasks.Release.html)
	- A [job queue](https://git.pleroma.social/pleroma/pleroma_job_queue) for federation, emails, web push, etc.
	- [Prometheus](https://prometheus.io/) metrics
	- Support for Mastodon's remote interaction
	- Mix Tasks: `mix pleroma.database bump_all_conversations`
	- Mix Tasks: `mix pleroma.database remove_embedded_objects`
	- Mix Tasks: `mix pleroma.database update_users_following_followers_counts`
	- Mix Tasks: `mix pleroma.user toggle_confirmed`
	- Mix Tasks: `mix pleroma.config migrate_to_db`
	- Mix Tasks: `mix pleroma.config migrate_from_db`
	- Federation: Support for `Question` and `Answer` objects
	- Federation: Support for reports
	- Configuration: `poll_limits` option
	- Configuration: `pack_extensions` option
	- Configuration: `safe_dm_mentions` option
	- Configuration: `link_name` option
	- Configuration: `fetch_initial_posts` option
	- Configuration: `notify_email` option
	- Configuration: Media proxy `whitelist` option
	- Configuration: `report_uri` option
	- Configuration: `limit_to_local_content` option
	- Pleroma API: User subscriptions
	- Pleroma API: Healthcheck endpoint
	- Pleroma API: `/api/v1/pleroma/mascot` per-user frontend mascot configuration endpoints
	- Admin API: Endpoints for listing/revoking invite tokens
	- Admin API: Endpoints for making users follow/unfollow each other
	- Admin API: added filters (role, tags, email, name) for users endpoint
	- Admin API: Endpoints for managing reports
	- Admin API: Endpoints for deleting and changing the scope of individual reported statuses
	- Admin API: Endpoints to view and change config settings.
	- AdminFE: initial release with basic user management accessible at /pleroma/admin/
	- Mastodon API: Add chat token to `verify_credentials` response
	- Mastodon API: Add background image setting to `update_credentials`
	- Mastodon API: [Scheduled statuses](https://docs.joinmastodon.org/api/rest/scheduled-statuses/)
	- Mastodon API: `/api/v1/notifications/destroy_multiple` (glitch-soc extension)
	- Mastodon API: `/api/v1/pleroma/accounts/:id/favourites` (API extension)
	- Mastodon API: [Reports](https://docs.joinmastodon.org/api/rest/reports/)
	- Mastodon API: `POST /api/v1/accounts` (account creation API)
	- Mastodon API: [Polls](https://docs.joinmastodon.org/api/rest/polls/)
	- ActivityPub C2S: OAuth endpoints
	- Metadata: RelMe provider
	- OAuth: added support for refresh tokens
	- Emoji packs and emoji pack manager
	- Object pruning (`mix pleroma.database prune_objects`)
	- OAuth: added job to clean expired access tokens
	- MRF: Support for rejecting reports from specific instances (`mrf_simple`)
	- MRF: Support for stripping avatars and banner images from specific instances (`mrf_simple`)
	- MRF: Support for running subchains.
	- Configuration: `skip_thread_containment` option
	- Configuration: `rate_limit` option. See `Pleroma.Plugs.RateLimiter` documentation for details.
	- MRF: Support for filtering out likely spam messages by rejecting posts from new users that contain links.
	- Configuration: `ignore_hosts` option
	- Configuration: `ignore_tld` option
	- Configuration: default syslog tag "Pleroma" is now lowercased to "pleroma"

	### Changed
	- Breaking: bind to 127.0.0.1 instead of 0.0.0.0 by default
	- Breaking: Configuration: move from Pleroma.Mailer to Pleroma.Emails.Mailer
	- Thread containment / test for complete visibility will be skipped by default.
	- Enforcement of OAuth scopes
	- Add multiple use/time expiring invite token
	- Restyled OAuth pages to fit with Pleroma's default theme
	- Link/mention/hashtag detection is now handled by [auto_linker](https://git.pleroma.social/pleroma/auto_linker)
	- NodeInfo: Return `safe_dm_mentions` feature flag
	- Federation: Expand the audience of delete activities to all recipients of the deleted object
	- Federation: Removed `inReplyToStatusId` from objects
	- Configuration: Dedupe enabled by default
	- Configuration: Default log level in `prod` environment is now set to `warn`
	- Configuration: Added `extra_cookie_attrs` for setting non-standard cookie attributes. Defaults to ["SameSite=Lax"] so that remote follows work.
	- Timelines: Messages involving people you have blocked will be excluded from the timeline in all cases instead of just repeats.
	- Admin API: Move the user related API to `api/pleroma/admin/users`
	- Pleroma API: Support for emoji tags in `/api/pleroma/emoji` resulting in a breaking API change
	- Mastodon API: Support for `exclude_types`, `limit` and `min_id` in `/api/v1/notifications`
	- Mastodon API: Add `languages` and `registrations` to `/api/v1/instance`
	- Mastodon API: Provide plaintext versions of cw/content in the Status entity
	- Mastodon API: Add `pleroma.conversation_id`, `pleroma.in_reply_to_account_acct` fields to the Status entity
	- Mastodon API: Add `pleroma.tags`, `pleroma.relationship{}`, `pleroma.is_moderator`, `pleroma.is_admin`, `pleroma.confirmation_pending`, `pleroma.hide_followers`, `pleroma.hide_follows`, `pleroma.hide_favorites` fields to the User entity
	- Mastodon API: Add `pleroma.show_role`, `pleroma.no_rich_text` fields to the Source subentity
	- Mastodon API: Add support for updating `no_rich_text`, `hide_followers`, `hide_follows`, `hide_favorites`, `show_role` in `PATCH /api/v1/update_credentials`
	- Mastodon API: Add `pleroma.is_seen` to the Notification entity
	- Mastodon API: Add `pleroma.local` to the Status entity
	- Mastodon API: Add `preview` parameter to `POST /api/v1/statuses`
	- Mastodon API: Add `with_muted` parameter to timeline endpoints
	- Mastodon API: Actual reblog hiding instead of a dummy
	- Mastodon API: Remove attachment limit in the Status entity
	- Mastodon API: Added support max_id & since_id for bookmark timeline endpoints.
	- Deps: Updated Cowboy to 2.6
	- Deps: Updated Ecto to 3.0.7
	- Don't ship finmoji by default, they can be installed as an emoji pack
	- Hide deactivated users and their statuses
	- Posts which are marked sensitive or tagged nsfw no longer have link previews.
	- HTTP connection timeout is now set to 10 seconds.
	- Respond with a 404 Not implemented JSON error message when requested API is not implemented
	- Rich Media: crawl only https URLs.

	### Fixed
	- Follow requests don't get 'stuck' anymore.
	- Added an FTS index on objects. Running `vacuum analyze` and setting a larger `work_mem` is recommended.
	- Followers counter not being updated when a follower is blocked
	- Deactivated users being able to request an access token
	- Limit on request body in rich media/relme parsers being ignored resulting in a possible memory leak
	- Proper Twitter Card generation instead of a dummy
	- Deletions failing for users with a large number of posts
	- NodeInfo: Include admins in `staffAccounts`
	- ActivityPub: Crashing when requesting empty local user's outbox
	- Federation: Handling of objects without `summary` property
	- Federation: Add a language tag to activities as required by ActivityStreams 2.0
	- Federation: Do not federate avatar/banner if set to default allowing other servers/clients to use their defaults
	- Federation: Cope with missing or explicitly nulled address lists
	- Federation: Explicitly ensure activities addressed to `as:Public` become addressed to the followers collection
	- Federation: Better cope with actors which do not declare a followers collection and use `as:Public` with these semantics
	- Federation: Follow requests from remote users who have been blocked will be automatically rejected if appropriate
	- MediaProxy: Parse name from content disposition headers even for non-whitelisted types
	- MediaProxy: S3 link encoding
	- Rich Media: Reject any data which cannot be explicitly encoded into JSON
	- Pleroma API: Importing follows from Mastodon 2.8+
	- Twitter API: Exposing default scope, `no_rich_text` of the user to anyone
	- Twitter API: Returning the `role` object in user entity despite `show_role = false`
	- Mastodon API: `/api/v1/favourites` serving only public activities
	- Mastodon API: Reblogs having `in_reply_to_id` - `null` even when they are replies
	- Mastodon API: Streaming API broadcasting wrong activity id
	- Mastodon API: 500 errors when requesting a card for a private conversation
	- Mastodon API: Handling of `reblogs` in `/api/v1/accounts/:id/follow`
	- Mastodon API: Correct `reblogged`, `favourited`, and `bookmarked` values in the reblog status JSON
	- Mastodon API: Exposing default scope of the user to anyone
	- Mastodon API: Make `irreversible` field default to `false` [`POST /api/v1/filters`]
	- Mastodon API: Replace missing non-nullable Card attributes with empty strings
	- User-Agent is now sent correctly for all HTTP requests.
	- MRF: Simple policy now properly delists imported or relayed statuses

	## Removed
	- Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations`

	## [0.9.99999] - 2019-05-31
	### Security
	- Mastodon API: Fix lists leaking private posts

	## [0.9.9999] - 2019-04-05
	### Security
	- Mastodon API: Fix content warnings skipping HTML sanitization

	## [0.9.999] - 2019-03-13
	Frontend changes only.
	### Added
	- Added floating action button for posting status on mobile
	### Changed
	- Changed user-settings icon to a pencil
	### Fixed
	- Keyboard shortcuts activating when typing a message
	- Gaps when scrolling down on a timeline after showing new

	## [0.9.99] - 2019-03-08
	### Changed
	- Update the frontend to the 0.9.99 tag
	### Fixed
	- Sign the date header in federation to fix Mastodon federation.

	## [0.9.9] - 2019-02-22
	This is our first stable release.
	diff --git a/config/config.exs b/config/config.exs
	index 99b500993..2ffa8c621 100644
	--- a/config/config.exs
	+++ b/config/config.exs
	@@ -1,526 +1,531 @@
	# .i;;;;i.
	# iYcviii;vXY:
	# .YXi .i1c.
	# .YC. . in7.
	# .vc. ...... ;1c.
	# i7, .. .;1;
	# i7, .. ... .Y1i
	# ,7v .6MMM@; .YX,
	# .7;. ..IMMMMMM1 :t7.
	# .;Y. ;$MMMMMM9. :tc.
	# vY. .. .nMMM@MMU. ;1v.
	# i7i ... .#MM@M@C. .....:71i
	# it: .... $MMM@9;.,i;;;i,;tti
	# :t7. ..... 0MMMWv.,iii:::,,;St.
	# .nC. ..... IMMMQ..,::::::,.,czX.
	# .ct: ....... .ZMMMI..,:::::::,,:76Y.
	# c2: ......,i..Y$M@t..:::::::,,..inZY
	# vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
	# i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
	# iIS. ......:ii::..;@MI....,............;Ez.
	# .I9. ......:i::::...8M1..................C0z.
	# .z9; ......:i::::,.. .i:...................zWX.
	# vbv ......,i::::,,. ................. :AQY
	# c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
	# :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
	# :6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
	# .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
	# 7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
	# 7C...::::::::::::,,,,.. .................... vSi.
	# ;1;...,,::::::,......... .................. Yz:
	# v97,......... .voC.
	# izAotX7777777777777777777777777777777777777777Y7n92:
	# .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
	#
	# !!! ATTENTION !!!
	# DO NOT EDIT THIS FILE! THIS FILE CONTAINS THE DEFAULT VALUES FOR THE CON-
	# FIGURATION! EDIT YOUR SECRET FILE (either prod.secret.exs, dev.secret.exs).
	#
	# This file is responsible for configuring your application
	# and its dependencies with the aid of the Mix.Config module.
	#
	# This configuration file is loaded before any dependency and
	# is restricted to this project.
	use Mix.Config

	# General application configuration
	config :pleroma, ecto_repos: [Pleroma.Repo]

	config :pleroma, Pleroma.Repo,
	types: Pleroma.PostgresTypes,
	telemetry_event: [Pleroma.Repo.Instrumenter],
	migration_lock: nil

	config :pleroma, Pleroma.Captcha,
	enabled: false,
	seconds_valid: 60,
	method: Pleroma.Captcha.Kocaptcha

	config :pleroma, :hackney_pools,
	federation: [
	max_connections: 50,
	timeout: 150_000
	],
	media: [
	max_connections: 50,
	timeout: 150_000
	],
	upload: [
	max_connections: 25,
	timeout: 300_000
	]

	config :pleroma, Pleroma.Captcha.Kocaptcha, endpoint: "https://captcha.kotobank.ch"

	# Upload configuration
	config :pleroma, Pleroma.Upload,
	uploader: Pleroma.Uploaders.Local,
	filters: [Pleroma.Upload.Filter.Dedupe],
	link_name: true,
	proxy_remote: false,
	proxy_opts: [
	redirect_on_failure: false,
	max_body_length: 25 * 1_048_576,
	http: [
	follow_redirect: true,
	pool: :upload
	]
	]

	config :pleroma, Pleroma.Uploaders.Local, uploads: "uploads"

	config :pleroma, Pleroma.Uploaders.S3,
	bucket: nil,
	public_endpoint: "https://s3.amazonaws.com"

	config :pleroma, Pleroma.Uploaders.MDII,
	cgi: "https://mdii.sakura.ne.jp/mdii-post.cgi",
	files: "https://mdii.sakura.ne.jp"

	config :pleroma, :emoji,
	shortcode_globs: ["/emoji/custom/*/.png"],
	pack_extensions: [".png", ".gif"],
	groups: [
	# Put groups that have higher priority than defaults here. Example in `docs/config/custom_emoji.md`
	Custom: ["/emoji/.png", "/emoji//.png"]
	],
	default_manifest: "https://git.pleroma.social/pleroma/emoji-index/raw/master/index.json"

	config :pleroma, :uri_schemes,
	valid_schemes: [
	"https",
	"http",
	"dat",
	"dweb",
	"gopher",
	"ipfs",
	"ipns",
	"irc",
	"ircs",
	"magnet",
	"mailto",
	"mumble",
	"ssb",
	"xmpp"
	]

	websocket_config = [
	path: "/websocket",
	serializer: [
	{Phoenix.Socket.V1.JSONSerializer, "~> 1.0.0"},
	{Phoenix.Socket.V2.JSONSerializer, "~> 2.0.0"}
	],
	timeout: 60_000,
	transport_log: false,
	compress: false
	]

	# Configures the endpoint
	config :pleroma, Pleroma.Web.Endpoint,
	instrumenters: [Pleroma.Web.Endpoint.Instrumenter],
	url: [host: "localhost"],
	http: [
	ip: {127, 0, 0, 1},
	dispatch: [
	{:_,
	[
	{"/api/v1/streaming", Pleroma.Web.MastodonAPI.WebsocketHandler, []},
	{"/websocket", Phoenix.Endpoint.CowboyWebSocket,
	{Phoenix.Transports.WebSocket,
	{Pleroma.Web.Endpoint, Pleroma.Web.UserSocket, websocket_config}}},
	{:_, Phoenix.Endpoint.Cowboy2Handler, {Pleroma.Web.Endpoint, []}}
	]}
	]
	],
	protocol: "https",
	secret_key_base: "aK4Abxf29xU9TTDKre9coZPUgevcVCFQJe/5xP/7Lt4BEif6idBIbjupVbOrbKxl",
	signing_salt: "CqaoopA2",
	render_errors: [view: Pleroma.Web.ErrorView, accepts: ~w(json)],
	pubsub: [name: Pleroma.PubSub, adapter: Phoenix.PubSub.PG2],
	secure_cookie_flag: true,
	extra_cookie_attrs: [
	"SameSite=Lax"
	]

	# Configures Elixir's Logger
	config :logger, :console,
	format: "$time $metadata[$level] $message\n",
	metadata: [:request_id]

	config :logger, :ex_syslogger,
	level: :debug,
	ident: "pleroma",
	format: "$metadata[$level] $message",
	metadata: [:request_id]

	config :quack,
	level: :warn,
	meta: [:all],
	webhook_url: "https://hooks.slack.com/services/YOUR-KEY-HERE"

	config :mime, :types, %{
	"application/xml" => ["xml"],
	"application/xrd+xml" => ["xrd+xml"],
	"application/jrd+json" => ["jrd+json"],
	"application/activity+json" => ["activity+json"],
	"application/ld+json" => ["activity+json"]
	}

	config :tesla, adapter: Tesla.Adapter.Hackney

	# Configures http settings, upstream proxy etc.
	config :pleroma, :http,
	proxy_url: nil,
	send_user_agent: true,
	adapter: [
	ssl_options: [
	+ # Workaround for remote server certificate chain issues
	+ partial_chain: &:hackney_connect.partial_chain/1,
	# We don't support TLS v1.3 yet
	versions: [:tlsv1, :"tlsv1.1", :"tlsv1.2"]
	]
	]

	config :pleroma, :instance,
	name: "Pleroma",
	email: "example@example.com",
	notify_email: "noreply@example.com",
	description: "A Pleroma instance, an alternative fediverse server",
	limit: 5_000,
	remote_limit: 100_000,
	upload_limit: 16_000_000,
	avatar_upload_limit: 2_000_000,
	background_upload_limit: 4_000_000,
	banner_upload_limit: 4_000_000,
	poll_limits: %{
	max_options: 20,
	max_option_chars: 200,
	min_expiration: 0,
	max_expiration: 365 * 24 * 60 * 60
	},
	registrations_open: true,
	federating: true,
	federation_incoming_replies_max_depth: 100,
	federation_reachability_timeout_days: 7,
	federation_publisher_modules: [
	Pleroma.Web.ActivityPub.Publisher,
	Pleroma.Web.Websub,
	Pleroma.Web.Salmon
	],
	allow_relay: true,
	rewrite_policy: Pleroma.Web.ActivityPub.MRF.NoOpPolicy,
	public: true,
	quarantined_instances: [],
	managed_config: true,
	static_dir: "instance/static/",
	allowed_post_formats: [
	"text/plain",
	"text/html",
	"text/markdown",
	"text/bbcode"
	],
	mrf_transparency: true,
	+ mrf_transparency_exclusions: [],
	autofollowed_nicknames: [],
	max_pinned_statuses: 1,
	no_attachment_links: false,
	welcome_user_nickname: nil,
	welcome_message: nil,
	max_report_comment_size: 1000,
	safe_dm_mentions: false,
	healthcheck: false,
	remote_post_retention_days: 90,
	skip_thread_containment: true,
	limit_to_local_content: :unauthenticated,
	dynamic_configuration: false,
	external_user_synchronization: true

	config :pleroma, :markup,
	# XXX - unfortunately, inline images must be enabled by default right now, because
	# of custom emoji. Issue #275 discusses defanging that somehow.
	allow_inline_images: true,
	allow_headings: false,
	allow_tables: false,
	allow_fonts: false,
	scrub_policy: [
	Pleroma.HTML.Transform.MediaProxy,
	Pleroma.HTML.Scrubber.Default
	]

	config :pleroma, :frontend_configurations,
	pleroma_fe: %{
	theme: "pleroma-dark",
	logo: "/static/logo.png",
	background: "/images/city.jpg",
	redirectRootNoLogin: "/main/all",
	redirectRootLogin: "/main/friends",
	showInstanceSpecificPanel: true,
	scopeOptionsEnabled: false,
	formattingOptionsEnabled: false,
	collapseMessageWithSubject: false,
	hidePostStats: false,
	hideUserStats: false,
	scopeCopy: true,
	subjectLineBehavior: "email",
	alwaysShowSubjectInput: true
	},
	masto_fe: %{
	showInstanceSpecificPanel: true
	}

	config :pleroma, :assets,
	mascots: [
	pleroma_fox_tan: %{
	url: "/images/pleroma-fox-tan-smol.png",
	mime_type: "image/png"
	},
	pleroma_fox_tan_shy: %{
	url: "/images/pleroma-fox-tan-shy.png",
	mime_type: "image/png"
	}
	],
	default_mascot: :pleroma_fox_tan

	config :pleroma, :activitypub,
	accept_blocks: true,
	unfollow_blocked: true,
	outgoing_blocks: true,
	follow_handshake_timeout: 500

	config :pleroma, :user, deny_follow_blocked: true

	config :pleroma, :mrf_normalize_markup, scrub_policy: Pleroma.HTML.Scrubber.Default

	config :pleroma, :mrf_rejectnonpublic,
	allow_followersonly: false,
	allow_direct: false

	config :pleroma, :mrf_hellthread,
	delist_threshold: 10,
	reject_threshold: 20

	config :pleroma, :mrf_simple,
	media_removal: [],
	media_nsfw: [],
	federated_timeline_removal: [],
	report_removal: [],
	reject: [],
	accept: [],
	avatar_removal: [],
	banner_removal: []

	config :pleroma, :mrf_keyword,
	reject: [],
	federated_timeline_removal: [],
	replace: []

	config :pleroma, :mrf_subchain, match_actor: %{}

	config :pleroma, :rich_media,
	enabled: true,
	ignore_hosts: [],
	ignore_tld: ["local", "localdomain", "lan"]

	config :pleroma, :media_proxy,
	enabled: false,
	proxy_opts: [
	redirect_on_failure: false,
	max_body_length: 25 * 1_048_576,
	http: [
	follow_redirect: true,
	pool: :media
	]
	],
	whitelist: []

	config :pleroma, :chat, enabled: true

	config :phoenix, :format_encoders, json: Jason

	config :pleroma, :gopher,
	enabled: false,
	ip: {0, 0, 0, 0},
	port: 9999

	config :pleroma, Pleroma.Web.Metadata,
	providers: [
	Pleroma.Web.Metadata.Providers.OpenGraph,
	Pleroma.Web.Metadata.Providers.TwitterCard,
	Pleroma.Web.Metadata.Providers.RelMe
	],
	unfurl_nsfw: false

	config :pleroma, :suggestions,
	enabled: false,
	third_party_engine:
	"http://vinayaka.distsn.org/cgi-bin/vinayaka-user-match-suggestions-api.cgi?{{host}}+{{user}}",
	timeout: 300_000,
	limit: 40,
	web: "https://vinayaka.distsn.org"

	config :pleroma, :http_security,
	enabled: true,
	sts: false,
	sts_max_age: 31_536_000,
	ct_max_age: 2_592_000,
	referrer_policy: "same-origin"

	config :cors_plug,
	max_age: 86_400,
	methods: ["POST", "PUT", "DELETE", "GET", "PATCH", "OPTIONS"],
	expose: [
	"Link",
	"X-RateLimit-Reset",
	"X-RateLimit-Limit",
	"X-RateLimit-Remaining",
	"X-Request-Id",
	"Idempotency-Key"
	],
	credentials: true,
	headers: ["Authorization", "Content-Type", "Idempotency-Key"]

	config :pleroma, Pleroma.User,
	restricted_nicknames: [
	".well-known",
	"~",
	"about",
	"activities",
	"api",
	"auth",
	"check_password",
	"dev",
	"friend-requests",
	"inbox",
	"internal",
	"main",
	"media",
	"nodeinfo",
	"notice",
	"oauth",
	"objects",
	"ostatus_subscribe",
	"pleroma",
	"proxy",
	"push",
	"registration",
	"relay",
	"settings",
	"status",
	"tag",
	"user-search",
	"user_exists",
	"users",
	"web"
	]

	config :pleroma, Pleroma.Web.Federator.RetryQueue,
	enabled: false,
	max_jobs: 20,
	initial_timeout: 30,
	max_retries: 5

	config :pleroma_job_queue, :queues,
	federator_incoming: 50,
	federator_outgoing: 50,
	web_push: 50,
	mailer: 10,
	transmogrifier: 20,
	scheduled_activities: 10,
	background: 5

	config :pleroma, :fetch_initial_posts,
	enabled: false,
	pages: 5

	config :auto_linker,
	opts: [
	scheme: true,
	extra: true,
	# TODO: Set to :no_scheme when it works properly
	validate_tld: true,
	class: false,
	strip_prefix: false,
	new_window: false,
	rel: false
	]

	config :pleroma, :ldap,
	enabled: System.get_env("LDAP_ENABLED") == "true",
	host: System.get_env("LDAP_HOST") \|\| "localhost",
	port: String.to_integer(System.get_env("LDAP_PORT") \|\| "389"),
	ssl: System.get_env("LDAP_SSL") == "true",
	sslopts: [],
	tls: System.get_env("LDAP_TLS") == "true",
	tlsopts: [],
	base: System.get_env("LDAP_BASE") \|\| "dc=example,dc=com",
	uid: System.get_env("LDAP_UID") \|\| "cn"

	config :esshd,
	enabled: false

	oauth_consumer_strategies =
	System.get_env("OAUTH_CONSUMER_STRATEGIES")
	\|> to_string()
	\|> String.split()
	\|> Enum.map(&hd(String.split(&1, ":")))

	ueberauth_providers =
	for strategy <- oauth_consumer_strategies do
	strategy_module_name = "Elixir.Ueberauth.Strategy.#{String.capitalize(strategy)}"
	strategy_module = String.to_atom(strategy_module_name)
	{String.to_atom(strategy), {strategy_module, [callback_params: ["state"]]}}
	end

	config :ueberauth,
	Ueberauth,
	base_path: "/oauth",
	providers: ueberauth_providers

	config :pleroma, :auth, oauth_consumer_strategies: oauth_consumer_strategies

	config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Sendmail, enabled: false

	config :prometheus, Pleroma.Web.Endpoint.MetricsExporter, path: "/api/pleroma/app_metrics"

	config :pleroma, Pleroma.ScheduledActivity,
	daily_user_limit: 25,
	total_user_limit: 300,
	enabled: true

	config :pleroma, :oauth2,
	token_expires_in: 600,
	issue_new_refresh_token: true,
	clean_expired_tokens: false,
	clean_expired_tokens_interval: 86_400_000

	config :pleroma, :database, rum_enabled: false

	config :pleroma, :env, Mix.env()

	config :http_signatures,
	adapter: Pleroma.Signature

	config :pleroma, :rate_limit,
	search: [{1000, 10}, {1000, 30}],
	- app_account_creation: {1_800_000, 25}
	+ app_account_creation: {1_800_000, 25},
	+ statuses_actions: {10_000, 15},
	+ status_id_action: {60_000, 3}

	# Import environment specific config. This must remain at the bottom
	# of this file so it overrides the configuration defined above.
	import_config "#{Mix.env()}.exs"
	diff --git a/docs/api/differences_in_mastoapi_responses.md b/docs/api/differences_in_mastoapi_responses.md
	index 2cbe1458d..3ee7115cf 100644
	--- a/docs/api/differences_in_mastoapi_responses.md
	+++ b/docs/api/differences_in_mastoapi_responses.md
	@@ -1,120 +1,112 @@
	# Differences in Mastodon API responses from vanilla Mastodon

	A Pleroma instance can be identified by "<Mastodon version> (compatible; Pleroma <version>)" present in `version` field in response from `/api/v1/instance`

	## Flake IDs

	Pleroma uses 128-bit ids as opposed to Mastodon's 64 bits. However just like Mastodon's ids they are sortable strings

	## Attachment cap

	Some apps operate under the assumption that no more than 4 attachments can be returned or uploaded. Pleroma however does not enforce any limits on attachment count neither when returning the status object nor when posting.

	## Timelines

	Adding the parameter `with_muted=true` to the timeline queries will also return activities by muted (not by blocked!) users.

	## Statuses

	Has these additional fields under the `pleroma` object:

	- `local`: true if the post was made on the local instance.
	- `conversation_id`: the ID of the conversation the status is associated with (if any)
	- `in_reply_to_account_acct`: the `acct` property of User entity for replied user (if any)
	- `content`: a map consisting of alternate representations of the `content` property with the key being it's mimetype. Currently the only alternate representation supported is `text/plain`
	- `spoiler_text`: a map consisting of alternate representations of the `spoiler_text` property with the key being it's mimetype. Currently the only alternate representation supported is `text/plain`

	## Attachments

	Has these additional fields under the `pleroma` object:

	- `mime_type`: mime type of the attachment.

	## Accounts

	- `/api/v1/accounts/:id`: The `id` parameter can also be the `nickname` of the user. This only works in this endpoint, not the deeper nested ones for following etc.

	Has these additional fields under the `pleroma` object:

	- `tags`: Lists an array of tags for the user
	- `relationship{}`: Includes fields as documented for Mastodon API https://docs.joinmastodon.org/api/entities/#relationship
	- `is_moderator`: boolean, nullable, true if user is a moderator
	- `is_admin`: boolean, nullable, true if user is an admin
	- `confirmation_pending`: boolean, true if a new user account is waiting on email confirmation to be activated
	- `hide_followers`: boolean, true when the user has follower hiding enabled
	- `hide_follows`: boolean, true when the user has follow hiding enabled
	- `settings_store`: A generic map of settings for frontends. Opaque to the backend. Only returned in `verify_credentials` and `update_credentials`
	- `chat_token`: The token needed for Pleroma chat. Only returned in `verify_credentials`

	-### Extensions for PleromaFE
	-
	-These endpoints added for controlling PleromaFE features over the Mastodon API
	-
	-- PATCH `/api/v1/accounts/update_avatar`: Set/clear user avatar image
	-- PATCH `/api/v1/accounts/update_banner`: Set/clear user banner image
	-- PATCH `/api/v1/accounts/update_background`: Set/clear user background image
	-
	### Source

	Has these additional fields under the `pleroma` object:

	- `show_role`: boolean, nullable, true when the user wants his role (e.g admin, moderator) to be shown
	- `no_rich_text` - boolean, nullable, true when html tags are stripped from all statuses requested from the API

	## Account Search

	Behavior has changed:

	- `/api/v1/accounts/search`: Does not require authentication

	## Notifications

	Has these additional fields under the `pleroma` object:

	- `is_seen`: true if the notification was read by the user

	## POST `/api/v1/statuses`

	Additional parameters can be added to the JSON body/Form data:

	- `preview`: boolean, if set to `true` the post won't be actually posted, but the status entitiy would still be rendered back. This could be useful for previewing rich text/custom emoji, for example.
	- `content_type`: string, contain the MIME type of the status, it is transformed into HTML by the backend. You can get the list of the supported MIME types with the nodeinfo endpoint.
	- `to`: A list of nicknames (like `lain@soykaf.club` or `lain` on the local server) that will be used to determine who is going to be addressed by this post. Using this will disable the implicit addressing by mentioned names in the `status` body, only the people in the `to` list will be addressed. The normal rules for for post visibility are not affected by this and will still apply.

	## PATCH `/api/v1/update_credentials`

	Additional parameters can be added to the JSON body/Form data:

	- `no_rich_text` - if true, html tags are stripped from all statuses requested from the API
	- `hide_followers` - if true, user's followers will be hidden
	- `hide_follows` - if true, user's follows will be hidden
	- `hide_favorites` - if true, user's favorites timeline will be hidden
	- `show_role` - if true, user's role (e.g admin, moderator) will be exposed to anyone in the API
	- `default_scope` - the scope returned under `privacy` key in Source subentity
	- `pleroma_settings_store` - Opaque user settings to be saved on the backend.
	- `skip_thread_containment` - if true, skip filtering out broken threads
	- `pleroma_background_image` - sets the background image of the user.

	### Pleroma Settings Store
	Pleroma has mechanism that allows frontends to save blobs of json for each user on the backend. This can be used to save frontend-specific settings for a user that the backend does not need to know about.

	The parameter should have a form of `{frontend_name: {...}}`, with `frontend_name` identifying your type of client, e.g. `pleroma_fe`. It will overwrite everything under this property, but will not overwrite other frontend's settings.

	This information is returned in the `verify_credentials` endpoint.

	## Authentication

	*Pleroma supports refreshing tokens.

	`POST /oauth/token`
	Post here request with grant_type=refresh_token to obtain new access token. Returns an access token.

	## Account Registration
	`POST /api/v1/accounts`

	Has theses additionnal parameters (which are the same as in Pleroma-API):
	* `fullname`: optional
	* `bio`: optional
	* `captcha_solution`: optional, contains provider-specific captcha solution,
	* `captcha_token`: optional, contains provider-specific captcha token
	* `token`: invite token required when the registerations aren't public.
	diff --git a/docs/api/pleroma_api.md b/docs/api/pleroma_api.md
	index edc62727a..d83ebd734 100644
	--- a/docs/api/pleroma_api.md
	+++ b/docs/api/pleroma_api.md
	@@ -1,306 +1,313 @@
	# Pleroma API

	Requests that require it can be authenticated with [an OAuth token](https://tools.ietf.org/html/rfc6749), the `_pleroma_key` cookie, or [HTTP Basic Authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization).

	Request parameters can be passed via [query strings](https://en.wikipedia.org/wiki/Query_string) or as [form data](https://www.w3.org/TR/html401/interact/forms.html). Files must be uploaded as `multipart/form-data`.

	## `/api/pleroma/emoji`
	### Lists the custom emoji on that server.
	* Method: `GET`
	* Authentication: not required
	* Params: none
	* Response: JSON
	* Example response:
	```json
	{
	"girlpower": {
	"tags": [
	"Finmoji"
	],
	"image_url": "/finmoji/128px/girlpower-128.png"
	},
	"education": {
	"tags": [
	"Finmoji"
	],
	"image_url": "/finmoji/128px/education-128.png"
	},
	"finnishlove": {
	"tags": [
	"Finmoji"
	],
	"image_url": "/finmoji/128px/finnishlove-128.png"
	}
	}
	```
	* Note: Same data as Mastodon API’s `/api/v1/custom_emojis` but in a different format

	## `/api/pleroma/follow_import`
	### Imports your follows, for example from a Mastodon CSV file.
	* Method: `POST`
	* Authentication: required
	* Params:
	* `list`: STRING or FILE containing a whitespace-separated list of accounts to follow
	* Response: HTTP 200 on success, 500 on error
	* Note: Users that can't be followed are silently skipped.

	## `/api/pleroma/captcha`
	### Get a new captcha
	* Method: `GET`
	* Authentication: not required
	* Params: none
	* Response: Provider specific JSON, the only guaranteed parameter is `type`
	* Example response: `{"type": "kocaptcha", "token": "whatever", "url": "https://captcha.kotobank.ch/endpoint"}`

	## `/api/pleroma/delete_account`
	### Delete an account
	* Method `POST`
	* Authentication: required
	* Params:
	* `password`: user's password
	* Response: JSON. Returns `{"status": "success"}` if the deletion was successful, `{"error": "[error message]"}` otherwise
	* Example response: `{"error": "Invalid password."}`

	## `/api/pleroma/disable_account`
	### Disable an account
	* Method `POST`
	* Authentication: required
	* Params:
	* `password`: user's password
	* Response: JSON. Returns `{"status": "success"}` if the account was successfully disabled, `{"error": "[error message]"}` otherwise
	* Example response: `{"error": "Invalid password."}`

	## `/api/account/register`
	### Register a new user
	* Method `POST`
	* Authentication: not required
	* Params:
	* `nickname`
	* `fullname`
	* `bio`
	* `email`
	* `password`
	* `confirm`
	* `captcha_solution`: optional, contains provider-specific captcha solution,
	* `captcha_token`: optional, contains provider-specific captcha token
	* `token`: invite token required when the registrations aren't public.
	* Response: JSON. Returns a user object on success, otherwise returns `{"error": "error_msg"}`
	* Example response:
	```json
	{
	"background_image": null,
	"cover_photo": "https://pleroma.soykaf.com/images/banner.png",
	"created_at": "Tue Dec 18 16:55:56 +0000 2018",
	"default_scope": "public",
	"description": "blushy-crushy fediverse idol + pleroma dev\nlet's be friends \nぷれろまの生徒会長。謎の外人。日本語OK. \n公主病.",
	"description_html": "blushy-crushy fediverse idol + pleroma dev.<br />let's be friends <br />ぷれろまの生徒会長。謎の外人。日本語OK. <br />公主病.",
	"favourites_count": 0,
	"fields": [],
	"followers_count": 0,
	"following": false,
	"follows_you": false,
	"friends_count": 0,
	"id": 6,
	"is_local": true,
	"locked": false,
	"name": "lain",
	"name_html": "lain",
	"no_rich_text": false,
	"pleroma": {
	"tags": []
	},
	"profile_image_url": "https://pleroma.soykaf.com/images/avi.png",
	"profile_image_url_https": "https://pleroma.soykaf.com/images/avi.png",
	"profile_image_url_original": "https://pleroma.soykaf.com/images/avi.png",
	"profile_image_url_profile_size": "https://pleroma.soykaf.com/images/avi.png",
	"rights": {
	"delete_others_notice": false
	},
	"screen_name": "lain",
	"statuses_count": 0,
	"statusnet_blocking": false,
	"statusnet_profile_url": "https://pleroma.soykaf.com/users/lain"
	}
	```

	## `/api/pleroma/admin/`…
	See [Admin-API](Admin-API.md)

	## `/api/pleroma/notifications/read`
	### Mark a single notification as read
	* Method `POST`
	* Authentication: required
	* Params:
	* `id`: notification's id
	* Response: JSON. Returns `{"status": "success"}` if the reading was successful, otherwise returns `{"error": "error_msg"}`

	## `/api/v1/pleroma/accounts/:id/subscribe`
	### Subscribe to receive notifications for all statuses posted by a user
	* Method `POST`
	* Authentication: required
	* Params:
	* `id`: account id to subscribe to
	* Response: JSON, returns a mastodon relationship object on success, otherwise returns `{"error": "error_msg"}`
	* Example response:
	```json
	{
	"id": "abcdefg",
	"following": true,
	"followed_by": false,
	"blocking": false,
	"muting": false,
	"muting_notifications": false,
	"subscribing": true,
	"requested": false,
	"domain_blocking": false,
	"showing_reblogs": true,
	"endorsed": false
	}
	```

	## `/api/v1/pleroma/accounts/:id/unsubscribe`
	### Unsubscribe to stop receiving notifications from user statuses
	* Method `POST`
	* Authentication: required
	* Params:
	* `id`: account id to unsubscribe from
	* Response: JSON, returns a mastodon relationship object on success, otherwise returns `{"error": "error_msg"}`
	* Example response:
	```json
	{
	"id": "abcdefg",
	"following": true,
	"followed_by": false,
	"blocking": false,
	"muting": false,
	"muting_notifications": false,
	"subscribing": false,
	"requested": false,
	"domain_blocking": false,
	"showing_reblogs": true,
	"endorsed": false
	}
	```

	## `/api/v1/pleroma/accounts/:id/favourites`
	### Returns favorites timeline of any user
	* Method `GET`
	* Authentication: not required
	* Params:
	* `id`: the id of the account for whom to return results
	* `limit`: optional, the number of records to retrieve
	* `since_id`: optional, returns results that are more recent than the specified id
	* `max_id`: optional, returns results that are older than the specified id
	* Response: JSON, returns a list of Mastodon Status entities on success, otherwise returns `{"error": "error_msg"}`
	* Example response:
	```json
	[
	{
	"account": {
	"id": "9hptFmUF3ztxYh3Svg",
	"url": "https://pleroma.example.org/users/nick2",
	"username": "nick2",
	...
	},
	"application": {"name": "Web", "website": null},
	"bookmarked": false,
	"card": null,
	"content": "This is :moominmamma: note 0",
	"created_at": "2019-04-15T15:42:15.000Z",
	"emojis": [],
	"favourited": false,
	"favourites_count": 1,
	"id": "9hptFmVJ02khbzYJaS",
	"in_reply_to_account_id": null,
	"in_reply_to_id": null,
	"language": null,
	"media_attachments": [],
	"mentions": [],
	"muted": false,
	"pinned": false,
	"pleroma": {
	"content": {"text/plain": "This is :moominmamma: note 0"},
	"conversation_id": 13679,
	"local": true,
	"spoiler_text": {"text/plain": "2hu"}
	},
	"reblog": null,
	"reblogged": false,
	"reblogs_count": 0,
	"replies_count": 0,
	"sensitive": false,
	"spoiler_text": "2hu",
	"tags": [{"name": "2hu", "url": "/tag/2hu"}],
	"uri": "https://pleroma.example.org/objects/198ed2a1-7912-4482-b559-244a0369e984",
	"url": "https://pleroma.example.org/notice/9hptFmVJ02khbzYJaS",
	"visibility": "public"
	}
	]
	```

	+## `/api/v1/pleroma/accounts/update_*`
	+### Set and clear account avatar, banner, and background
	+
	+- PATCH `/api/v1/pleroma/accounts/update_avatar`: Set/clear user avatar image
	+- PATCH `/api/v1/pleroma/accounts/update_banner`: Set/clear user banner image
	+- PATCH `/api/v1/pleroma/accounts/update_background`: Set/clear user background image
	+
	## `/api/v1/pleroma/mascot`
	### Gets user mascot image
	* Method `GET`
	* Authentication: required

	* Response: JSON. Returns a mastodon media attachment entity.
	* Example response:
	```json
	{
	"id": "abcdefg",
	"url": "https://pleroma.example.org/media/abcdefg.png",
	"type": "image",
	"pleroma": {
	"mime_type": "image/png"
	}
	}
	```

	### Updates user mascot image
	* Method `PUT`
	* Authentication: required
	* Params:
	* `image`: Multipart image
	* Response: JSON. Returns a mastodon media attachment entity
	when successful, otherwise returns HTTP 415 `{"error": "error_msg"}`
	* Example response:
	```json
	{
	"id": "abcdefg",
	"url": "https://pleroma.example.org/media/abcdefg.png",
	"type": "image",
	"pleroma": {
	"mime_type": "image/png"
	}
	}
	```
	* Note: Behaves exactly the same as `POST /api/v1/upload`.
	Can only accept images - any attempt to upload non-image files will be met with `HTTP 415 Unsupported Media Type`.

	## `/api/pleroma/notification_settings`
	### Updates user notification settings
	* Method `PUT`
	* Authentication: required
	* Params:
	* `followers`: BOOLEAN field, receives notifications from followers
	* `follows`: BOOLEAN field, receives notifications from people the user follows
	* `remote`: BOOLEAN field, receives notifications from people on remote instances
	* `local`: BOOLEAN field, receives notifications from people on the local instance
	* Response: JSON. Returns `{"status": "success"}` if the update was successful, otherwise returns `{"error": "error_msg"}`

	## `/api/pleroma/healthcheck`
	### Healthcheck endpoint with additional system data.
	* Method `GET`
	* Authentication: not required
	* Params: none
	* Response: JSON, statuses (200 - healthy, 503 unhealthy).
	* Example response:
	```json
	{
	"pool_size": 0, # database connection pool
	"active": 0, # active processes
	"idle": 0, # idle processes
	"memory_used": 0.00, # Memory used
	"healthy": true # Instance state
	}
	```
	diff --git a/docs/config.md b/docs/config.md
	index 140789d87..a65b7a560 100644
	--- a/docs/config.md
	+++ b/docs/config.md
	@@ -1,642 +1,650 @@
	# Configuration

	This file describe the configuration, it is recommended to edit the relevant *.secret.exs file instead of the others founds in the ``config`` directory.
	If you run Pleroma with ``MIX_ENV=prod`` the file is ``prod.secret.exs``, otherwise it is ``dev.secret.exs``.

	## Pleroma.Upload
	* `uploader`: Select which `Pleroma.Uploaders` to use
	* `filters`: List of `Pleroma.Upload.Filter` to use.
	* `link_name`: When enabled Pleroma will add a `name` parameter to the url of the upload, for example `https://instance.tld/media/corndog.png?name=corndog.png`. This is needed to provide the correct filename in Content-Disposition headers when using filters like `Pleroma.Upload.Filter.Dedupe`
	* `base_url`: The base URL to access a user-uploaded file. Useful when you want to proxy the media files via another host.
	* `proxy_remote`: If you\'re using a remote uploader, Pleroma will proxy media requests instead of redirecting to it.
	* `proxy_opts`: Proxy options, see `Pleroma.ReverseProxy` documentation.

	Note: `strip_exif` has been replaced by `Pleroma.Upload.Filter.Mogrify`.

	## Pleroma.Uploaders.Local
	* `uploads`: Which directory to store the user-uploads in, relative to pleroma’s working directory

	## Pleroma.Uploaders.S3
	* `bucket`: S3 bucket name
	* `public_endpoint`: S3 endpoint that the user finally accesses(ex. "https://s3.dualstack.ap-northeast-1.amazonaws.com")
	* `truncated_namespace`: If you use S3 compatible service such as Digital Ocean Spaces or CDN, set folder name or "" etc.
	For example, when using CDN to S3 virtual host format, set "".
	At this time, write CNAME to CDN in public_endpoint.

	## Pleroma.Upload.Filter.Mogrify

	* `args`: List of actions for the `mogrify` command like `"strip"` or `["strip", "auto-orient", {"impode", "1"}]`.

	## Pleroma.Upload.Filter.Dedupe

	No specific configuration.

	## Pleroma.Upload.Filter.AnonymizeFilename

	This filter replaces the filename (not the path) of an upload. For complete obfuscation, add
	`Pleroma.Upload.Filter.Dedupe` before AnonymizeFilename.

	* `text`: Text to replace filenames in links. If empty, `{random}.extension` will be used. You can get the original filename extension by using `{extension}`, for example `custom-file-name.{extension}`.

	## Pleroma.Emails.Mailer
	* `adapter`: one of the mail adapters listed in [Swoosh readme](https://github.com/swoosh/swoosh#adapters), or `Swoosh.Adapters.Local` for in-memory mailbox.
	* `api_key` / `password` and / or other adapter-specific settings, per the above documentation.
	* `enabled`: Allows enable/disable send emails. Default: `false`.

	An example for Sendgrid adapter:

	```elixir
	config :pleroma, Pleroma.Emails.Mailer,
	adapter: Swoosh.Adapters.Sendgrid,
	api_key: "YOUR_API_KEY"
	```

	An example for SMTP adapter:

	```elixir
	config :pleroma, Pleroma.Emails.Mailer,
	adapter: Swoosh.Adapters.SMTP,
	relay: "smtp.gmail.com",
	username: "YOUR_USERNAME@gmail.com",
	password: "YOUR_SMTP_PASSWORD",
	port: 465,
	ssl: true,
	tls: :always,
	auth: :always
	```

	## :uri_schemes
	* `valid_schemes`: List of the scheme part that is considered valid to be an URL

	## :instance
	* `name`: The instance’s name
	* `email`: Email used to reach an Administrator/Moderator of the instance
	* `notify_email`: Email used for notifications.
	* `description`: The instance’s description, can be seen in nodeinfo and ``/api/v1/instance``
	* `limit`: Posts character limit (CW/Subject included in the counter)
	* `remote_limit`: Hard character limit beyond which remote posts will be dropped.
	* `upload_limit`: File size limit of uploads (except for avatar, background, banner)
	* `avatar_upload_limit`: File size limit of user’s profile avatars
	* `background_upload_limit`: File size limit of user’s profile backgrounds
	* `banner_upload_limit`: File size limit of user’s profile banners
	* `poll_limits`: A map with poll limits for local polls
	* `max_options`: Maximum number of options
	* `max_option_chars`: Maximum number of characters per option
	* `min_expiration`: Minimum expiration time (in seconds)
	* `max_expiration`: Maximum expiration time (in seconds)
	* `registrations_open`: Enable registrations for anyone, invitations can be enabled when false.
	* `invites_enabled`: Enable user invitations for admins (depends on `registrations_open: false`).
	* `account_activation_required`: Require users to confirm their emails before signing in.
	* `federating`: Enable federation with other instances
	* `federation_incoming_replies_max_depth`: Max. depth of reply-to activities fetching on incoming federation, to prevent out-of-memory situations while fetching very long threads. If set to `nil`, threads of any depth will be fetched. Lower this value if you experience out-of-memory crashes.
	* `federation_reachability_timeout_days`: Timeout (in days) of each external federation target being unreachable prior to pausing federating to it.
	* `allow_relay`: Enable Pleroma’s Relay, which makes it possible to follow a whole instance
	* `rewrite_policy`: Message Rewrite Policy, either one or a list. Here are the ones available by default:
	* `Pleroma.Web.ActivityPub.MRF.NoOpPolicy`: Doesn’t modify activities (default)
	* `Pleroma.Web.ActivityPub.MRF.DropPolicy`: Drops all activities. It generally doesn’t makes sense to use in production
	* `Pleroma.Web.ActivityPub.MRF.SimplePolicy`: Restrict the visibility of activities from certains instances (See ``:mrf_simple`` section)
	* `Pleroma.Web.ActivityPub.MRF.TagPolicy`: Applies policies to individual users based on tags, which can be set using pleroma-fe/admin-fe/any other app that supports Pleroma Admin API. For example it allows marking posts from individual users nsfw (sensitive)
	* `Pleroma.Web.ActivityPub.MRF.SubchainPolicy`: Selectively runs other MRF policies when messages match (see ``:mrf_subchain`` section)
	* `Pleroma.Web.ActivityPub.MRF.RejectNonPublic`: Drops posts with non-public visibility settings (See ``:mrf_rejectnonpublic`` section)
	* `Pleroma.Web.ActivityPub.MRF.EnsureRePrepended`: Rewrites posts to ensure that replies to posts with subjects do not have an identical subject and instead begin with re:.
	* `Pleroma.Web.ActivityPub.MRF.AntiLinkSpamPolicy`: Rejects posts from likely spambots by rejecting posts from new users that contain links.
	* `Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy`: Crawls attachments using their MediaProxy URLs so that the MediaProxy cache is primed.
	* `public`: Makes the client API in authentificated mode-only except for user-profiles. Useful for disabling the Local Timeline and The Whole Known Network.
	* `quarantined_instances`: List of ActivityPub instances where private(DMs, followers-only) activities will not be send.
	* `managed_config`: Whenether the config for pleroma-fe is configured in this config or in ``static/config.json``
	* `allowed_post_formats`: MIME-type list of formats allowed to be posted (transformed into HTML)
	* `mrf_transparency`: Make the content of your Message Rewrite Facility settings public (via nodeinfo).
	+* `mrf_transparency_exclusions`: Exclude specific instance names from MRF transparency. The use of the exclusions feature will be disclosed in nodeinfo as a boolean value.
	* `scope_copy`: Copy the scope (private/unlisted/public) in replies to posts by default.
	* `subject_line_behavior`: Allows changing the default behaviour of subject lines in replies. Valid values:
	* "email": Copy and preprend re:, as in email.
	* "masto": Copy verbatim, as in Mastodon.
	* "noop": Don't copy the subject.
	* `always_show_subject_input`: When set to false, auto-hide the subject field when it's empty.
	* `extended_nickname_format`: Set to `true` to use extended local nicknames format (allows underscores/dashes). This will break federation with
	older software for theses nicknames.
	* `max_pinned_statuses`: The maximum number of pinned statuses. `0` will disable the feature.
	* `autofollowed_nicknames`: Set to nicknames of (local) users that every new user should automatically follow.
	* `no_attachment_links`: Set to true to disable automatically adding attachment link text to statuses
	* `welcome_message`: A message that will be send to a newly registered users as a direct message.
	* `welcome_user_nickname`: The nickname of the local user that sends the welcome message.
	* `max_report_comment_size`: The maximum size of the report comment (Default: `1000`)
	* `safe_dm_mentions`: If set to true, only mentions at the beginning of a post will be used to address people in direct messages. This is to prevent accidental mentioning of people when talking about them (e.g. "@friend hey i really don't like @enemy"). Default: `false`.
	* `healthcheck`: If set to true, system data will be shown on ``/api/pleroma/healthcheck``.
	* `remote_post_retention_days`: The default amount of days to retain remote posts when pruning the database.
	* `skip_thread_containment`: Skip filter out broken threads. The default is `false`.
	* `limit_to_local_content`: Limit unauthenticated users to search for local statutes and users only. Possible values: `:unauthenticated`, `:all` and `false`. The default is `:unauthenticated`.
	* `dynamic_configuration`: Allow transferring configuration to DB with the subsequent customization from Admin api.
	* `external_user_synchronization`: Enabling following/followers counters synchronization for external users.



	## :logger
	* `backends`: `:console` is used to send logs to stdout, `{ExSyslogger, :ex_syslogger}` to log to syslog, and `Quack.Logger` to log to Slack

	An example to enable ONLY ExSyslogger (f/ex in ``prod.secret.exs``) with info and debug suppressed:
	```elixir
	config :logger,
	backends: [{ExSyslogger, :ex_syslogger}]

	config :logger, :ex_syslogger,
	level: :warn
	```

	Another example, keeping console output and adding the pid to syslog output:
	```elixir
	config :logger,
	backends: [:console, {ExSyslogger, :ex_syslogger}]

	config :logger, :ex_syslogger,
	level: :warn,
	option: [:pid, :ndelay]
	```

	See: [logger’s documentation](https://hexdocs.pm/logger/Logger.html) and [ex_syslogger’s documentation](https://hexdocs.pm/ex_syslogger/)

	An example of logging info to local syslog, but warn to a Slack channel:
	```elixir
	config :logger,
	backends: [ {ExSyslogger, :ex_syslogger}, Quack.Logger ],
	level: :info

	config :logger, :ex_syslogger,
	level: :info,
	ident: "pleroma",
	format: "$metadata[$level] $message"

	config :quack,
	level: :warn,
	meta: [:all],
	webhook_url: "https://hooks.slack.com/services/YOUR-API-KEY-HERE"
	```

	See the [Quack Github](https://github.com/azohra/quack) for more details

	## :frontend_configurations

	This can be used to configure a keyword list that keeps the configuration data for any kind of frontend. By default, settings for `pleroma_fe` and `masto_fe` are configured.

	Frontends can access these settings at `/api/pleroma/frontend_configurations`

	To add your own configuration for PleromaFE, use it like this:

	```elixir
	config :pleroma, :frontend_configurations,
	pleroma_fe: %{
	theme: "pleroma-dark",
	# ... see /priv/static/static/config.json for the available keys.
	},
	masto_fe: %{
	showInstanceSpecificPanel: true
	}
	```

	These settings need to be complete, they will override the defaults.

	NOTE: for versions < 1.0, you need to set [`:fe`](#fe) to false, as shown a few lines below.

	## :fe
	__THIS IS DEPRECATED__

	If you are using this method, please change it to the [`frontend_configurations`](#frontend_configurations) method.
	Please set this option to false in your config like this:

	```elixir
	config :pleroma, :fe, false
	```

	This section is used to configure Pleroma-FE, unless ``:managed_config`` in ``:instance`` is set to false.

	* `theme`: Which theme to use, they are defined in ``styles.json``
	* `logo`: URL of the logo, defaults to Pleroma’s logo
	* `logo_mask`: Whether to use only the logo's shape as a mask (true) or as a regular image (false)
	* `logo_margin`: What margin to use around the logo
	* `background`: URL of the background, unless viewing a user profile with a background that is set
	* `redirect_root_no_login`: relative URL which indicates where to redirect when a user isn’t logged in.
	* `redirect_root_login`: relative URL which indicates where to redirect when a user is logged in.
	* `show_instance_panel`: Whenether to show the instance’s specific panel.
	* `scope_options_enabled`: Enable setting an notice visibility and subject/CW when posting
	* `formatting_options_enabled`: Enable setting a formatting different than plain-text (ie. HTML, Markdown) when posting, relates to ``:instance, allowed_post_formats``
	* `collapse_message_with_subjects`: When a message has a subject(aka Content Warning), collapse it by default
	* `hide_post_stats`: Hide notices statistics(repeats, favorites, …)
	* `hide_user_stats`: Hide profile statistics(posts, posts per day, followers, followings, …)

	## :assets

	This section configures assets to be used with various frontends. Currently the only option
	relates to mascots on the mastodon frontend

	* `mascots`: KeywordList of mascots, each element __MUST__ contain both a `url` and a
	`mime_type` key.
	* `default_mascot`: An element from `mascots` - This will be used as the default mascot
	on MastoFE (default: `:pleroma_fox_tan`)

	## :mrf_simple
	* `media_removal`: List of instances to remove medias from
	* `media_nsfw`: List of instances to put medias as NSFW(sensitive) from
	* `federated_timeline_removal`: List of instances to remove from Federated (aka The Whole Known Network) Timeline
	* `reject`: List of instances to reject any activities from
	* `accept`: List of instances to accept any activities from
	* `report_removal`: List of instances to reject reports from
	* `avatar_removal`: List of instances to strip avatars from
	* `banner_removal`: List of instances to strip banners from

	## :mrf_subchain
	This policy processes messages through an alternate pipeline when a given message matches certain criteria.
	All criteria are configured as a map of regular expressions to lists of policy modules.

	* `match_actor`: Matches a series of regular expressions against the actor field.

	Example:

	```
	config :pleroma, :mrf_subchain,
	match_actor: %{
	~r/https:\/\/example.com/s => [Pleroma.Web.ActivityPub.MRF.DropPolicy]
	}
	```

	## :mrf_rejectnonpublic
	* `allow_followersonly`: whether to allow followers-only posts
	* `allow_direct`: whether to allow direct messages

	## :mrf_hellthread
	* `delist_threshold`: Number of mentioned users after which the message gets delisted (the message can still be seen, but it will not show up in public timelines and mentioned users won't get notifications about it). Set to 0 to disable.
	* `reject_threshold`: Number of mentioned users after which the messaged gets rejected. Set to 0 to disable.

	## :mrf_keyword
	* `reject`: A list of patterns which result in message being rejected, each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html)
	* `federated_timeline_removal`: A list of patterns which result in message being removed from federated timelines (a.k.a unlisted), each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html)
	* `replace`: A list of tuples containing `{pattern, replacement}`, `pattern` can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html)

	## :media_proxy
	* `enabled`: Enables proxying of remote media to the instance’s proxy
	* `base_url`: The base URL to access a user-uploaded file. Useful when you want to proxy the media files via another host/CDN fronts.
	* `proxy_opts`: All options defined in `Pleroma.ReverseProxy` documentation, defaults to `[max_body_length: (25*1_048_576)]`.
	* `whitelist`: List of domains to bypass the mediaproxy

	## :gopher
	* `enabled`: Enables the gopher interface
	* `ip`: IP address to bind to
	* `port`: Port to bind to
	* `dstport`: Port advertised in urls (optional, defaults to `port`)

	## Pleroma.Web.Endpoint
	`Phoenix` endpoint configuration, all configuration options can be viewed [here](https://hexdocs.pm/phoenix/Phoenix.Endpoint.html#module-dynamic-configuration), only common options are listed here
	* `http` - a list containing http protocol configuration, all configuration options can be viewed [here](https://hexdocs.pm/plug_cowboy/Plug.Cowboy.html#module-options), only common options are listed here. For deployment using docker, you need to set this to `[ip: {0,0,0,0}, port: 4000]` to make pleroma accessible from other containers (such as your nginx server).
	- `ip` - a tuple consisting of 4 integers
	- `port`
	* `url` - a list containing the configuration for generating urls, accepts
	- `host` - the host without the scheme and a post (e.g `example.com`, not `https://example.com:2020`)
	- `scheme` - e.g `http`, `https`
	- `port`
	- `path`
	* `extra_cookie_attrs` - a list of `Key=Value` strings to be added as non-standard cookie attributes. Defaults to `["SameSite=Lax"]`. See the [SameSite article](https://www.owasp.org/index.php/SameSite) on OWASP for more info.



	Important note: if you modify anything inside these lists, default `config.exs` values will be overwritten, which may result in breakage, to make sure this does not happen please copy the default value for the list from `config.exs` and modify/add only what you need

	Example:
	```elixir
	config :pleroma, Pleroma.Web.Endpoint,
	url: [host: "example.com", port: 2020, scheme: "https"],
	http: [
	# start copied from config.exs
	dispatch: [
	{:_,
	[
	{"/api/v1/streaming", Pleroma.Web.MastodonAPI.WebsocketHandler, []},
	{"/websocket", Phoenix.Endpoint.CowboyWebSocket,
	{Phoenix.Transports.WebSocket,
	{Pleroma.Web.Endpoint, Pleroma.Web.UserSocket, websocket_config}}},
	{:_, Phoenix.Endpoint.Cowboy2Handler, {Pleroma.Web.Endpoint, []}}
	]}
	# end copied from config.exs
	],
	port: 8080,
	ip: {127, 0, 0, 1}
	]
	```

	This will make Pleroma listen on `127.0.0.1` port `8080` and generate urls starting with `https://example.com:2020`

	## :activitypub
	* ``accept_blocks``: Whether to accept incoming block activities from other instances
	* ``unfollow_blocked``: Whether blocks result in people getting unfollowed
	* ``outgoing_blocks``: Whether to federate blocks to other instances
	* ``deny_follow_blocked``: Whether to disallow following an account that has blocked the user in question

	## :http_security
	* ``enabled``: Whether the managed content security policy is enabled
	* ``sts``: Whether to additionally send a `Strict-Transport-Security` header
	* ``sts_max_age``: The maximum age for the `Strict-Transport-Security` header if sent
	* ``ct_max_age``: The maximum age for the `Expect-CT` header if sent
	* ``referrer_policy``: The referrer policy to use, either `"same-origin"` or `"no-referrer"`
	* ``report_uri``: Adds the specified url to `report-uri` and `report-to` group in CSP header.

	## :mrf_user_allowlist

	The keys in this section are the domain names that the policy should apply to.
	Each key should be assigned a list of users that should be allowed through by
	their ActivityPub ID.

	An example:

	```elixir
	config :pleroma, :mrf_user_allowlist,
	"example.org": ["https://example.org/users/admin"]
	```

	## :web_push_encryption, :vapid_details

	Web Push Notifications configuration. You can use the mix task `mix web_push.gen.keypair` to generate it.

	* ``subject``: a mailto link for the administrative contact. It’s best if this email is not a personal email address, but rather a group email so that if a person leaves an organization, is unavailable for an extended period, or otherwise can’t respond, someone else on the list can.
	* ``public_key``: VAPID public key
	* ``private_key``: VAPID private key

	## Pleroma.Captcha
	* `enabled`: Whether the captcha should be shown on registration
	* `method`: The method/service to use for captcha
	* `seconds_valid`: The time in seconds for which the captcha is valid

	### Pleroma.Captcha.Kocaptcha
	Kocaptcha is a very simple captcha service with a single API endpoint,
	the source code is here: https://github.com/koto-bank/kocaptcha. The default endpoint
	`https://captcha.kotobank.ch` is hosted by the developer.

	* `endpoint`: the kocaptcha endpoint to use

	## :admin_token

	Allows to set a token that can be used to authenticate with the admin api without using an actual user by giving it as the 'admin_token' parameter. Example:

	```elixir
	config :pleroma, :admin_token, "somerandomtoken"
	```

	You can then do

	```sh
	curl "http://localhost:4000/api/pleroma/admin/invite_token?admin_token=somerandomtoken"
	```

	## :pleroma_job_queue

	[Pleroma Job Queue](https://git.pleroma.social/pleroma/pleroma_job_queue) configuration: a list of queues with maximum concurrent jobs.

	Pleroma has the following queues:

	* `federator_outgoing` - Outgoing federation
	* `federator_incoming` - Incoming federation
	* `mailer` - Email sender, see [`Pleroma.Emails.Mailer`](#pleroma-emails-mailer)
	* `transmogrifier` - Transmogrifier
	* `web_push` - Web push notifications
	* `scheduled_activities` - Scheduled activities, see [`Pleroma.ScheduledActivities`](#pleromascheduledactivity)

	Example:

	```elixir
	config :pleroma_job_queue, :queues,
	federator_incoming: 50,
	federator_outgoing: 50
	```

	This config contains two queues: `federator_incoming` and `federator_outgoing`. Both have the `max_jobs` set to `50`.

	## Pleroma.Web.Federator.RetryQueue

	* `enabled`: If set to `true`, failed federation jobs will be retried
	* `max_jobs`: The maximum amount of parallel federation jobs running at the same time.
	* `initial_timeout`: The initial timeout in seconds
	* `max_retries`: The maximum number of times a federation job is retried

	## Pleroma.Web.Metadata
	* `providers`: a list of metadata providers to enable. Providers available:
	* Pleroma.Web.Metadata.Providers.OpenGraph
	* Pleroma.Web.Metadata.Providers.TwitterCard
	* Pleroma.Web.Metadata.Providers.RelMe - add links from user bio with rel=me into the `<header>` as `<link rel=me>`
	* `unfurl_nsfw`: If set to `true` nsfw attachments will be shown in previews

	## :rich_media
	* `enabled`: if enabled the instance will parse metadata from attached links to generate link previews
	* `ignore_hosts`: list of hosts which will be ignored by the metadata parser. For example `["accounts.google.com", "xss.website"]`, defaults to `[]`.
	* `ignore_tld`: list TLDs (top-level domains) which will ignore for parse metadata. default is ["local", "localdomain", "lan"]

	## :fetch_initial_posts
	* `enabled`: if enabled, when a new user is federated with, fetch some of their latest posts
	* `pages`: the amount of pages to fetch

	## :hackney_pools

	Advanced. Tweaks Hackney (http client) connections pools.

	There's three pools used:

	* `:federation` for the federation jobs.
	You may want this pool max_connections to be at least equal to the number of federator jobs + retry queue jobs.
	* `:media` for rich media, media proxy
	* `:upload` for uploaded media (if using a remote uploader and `proxy_remote: true`)

	For each pool, the options are:

	* `max_connections` - how much connections a pool can hold
	* `timeout` - retention duration for connections

	## :auto_linker

	Configuration for the `auto_linker` library:

	* `class: "auto-linker"` - specify the class to be added to the generated link. false to clear
	* `rel: "noopener noreferrer"` - override the rel attribute. false to clear
	* `new_window: true` - set to false to remove `target='_blank'` attribute
	* `scheme: false` - Set to true to link urls with schema `http://google.com`
	* `truncate: false` - Set to a number to truncate urls longer then the number. Truncated urls will end in `..`
	* `strip_prefix: true` - Strip the scheme prefix
	* `extra: false` - link urls with rarely used schemes (magnet, ipfs, irc, etc.)

	Example:

	```elixir
	config :auto_linker,
	opts: [
	scheme: true,
	extra: true,
	class: false,
	strip_prefix: false,
	new_window: false,
	rel: false
	]
	```

	## Pleroma.ScheduledActivity

	* `daily_user_limit`: the number of scheduled activities a user is allowed to create in a single day (Default: `25`)
	* `total_user_limit`: the number of scheduled activities a user is allowed to create in total (Default: `300`)
	* `enabled`: whether scheduled activities are sent to the job queue to be executed

	## Pleroma.Web.Auth.Authenticator

	* `Pleroma.Web.Auth.PleromaAuthenticator`: default database authenticator
	* `Pleroma.Web.Auth.LDAPAuthenticator`: LDAP authentication

	## :ldap

	Use LDAP for user authentication. When a user logs in to the Pleroma
	instance, the name and password will be verified by trying to authenticate
	(bind) to an LDAP server. If a user exists in the LDAP directory but there
	is no account with the same name yet on the Pleroma instance then a new
	Pleroma account will be created with the same name as the LDAP user name.

	* `enabled`: enables LDAP authentication
	* `host`: LDAP server hostname
	* `port`: LDAP port, e.g. 389 or 636
	* `ssl`: true to use SSL, usually implies the port 636
	* `sslopts`: additional SSL options
	* `tls`: true to start TLS, usually implies the port 389
	* `tlsopts`: additional TLS options
	* `base`: LDAP base, e.g. "dc=example,dc=com"
	* `uid`: LDAP attribute name to authenticate the user, e.g. when "cn", the filter will be "cn=username,base"

	## BBS / SSH access

	To enable simple command line interface accessible over ssh, add a setting like this to your configuration file:

	```exs
	app_dir = File.cwd!
	priv_dir = Path.join([app_dir, "priv/ssh_keys"])

	config :esshd,
	enabled: true,
	priv_dir: priv_dir,
	handler: "Pleroma.BBS.Handler",
	port: 10_022,
	password_authenticator: "Pleroma.BBS.Authenticator"
	```

	Feel free to adjust the priv_dir and port number. Then you will have to create the key for the keys (in the example `priv/ssh_keys`) and create the host keys with `ssh-keygen -m PEM -N "" -b 2048 -t rsa -f ssh_host_rsa_key`. After restarting, you should be able to connect to your Pleroma instance with `ssh username@server -p $PORT`

	## :auth

	* `Pleroma.Web.Auth.PleromaAuthenticator`: default database authenticator
	* `Pleroma.Web.Auth.LDAPAuthenticator`: LDAP authentication

	Authentication / authorization settings.

	* `auth_template`: authentication form template. By default it's `show.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/show.html.eex`.
	* `oauth_consumer_template`: OAuth consumer mode authentication form template. By default it's `consumer.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex`.
	* `oauth_consumer_strategies`: the list of enabled OAuth consumer strategies; by default it's set by `OAUTH_CONSUMER_STRATEGIES` environment variable. Each entry in this space-delimited string should be of format `<strategy>` or `<strategy>:<dependency>` (e.g. `twitter` or `keycloak:ueberauth_keycloak_strategy` in case dependency is named differently than `ueberauth_<strategy>`).

	## OAuth consumer mode

	OAuth consumer mode allows sign in / sign up via external OAuth providers (e.g. Twitter, Facebook, Google, Microsoft, etc.).
	Implementation is based on Ueberauth; see the list of [available strategies](https://github.com/ueberauth/ueberauth/wiki/List-of-Strategies).

	Note: each strategy is shipped as a separate dependency; in order to get the strategies, run `OAUTH_CONSUMER_STRATEGIES="..." mix deps.get`,
	e.g. `OAUTH_CONSUMER_STRATEGIES="twitter facebook google microsoft" mix deps.get`.
	The server should also be started with `OAUTH_CONSUMER_STRATEGIES="..." mix phx.server` in case you enable any strategies.

	Note: each strategy requires separate setup (on external provider side and Pleroma side). Below are the guidelines on setting up most popular strategies.

	Note: make sure that `"SameSite=Lax"` is set in `extra_cookie_attrs` when you have this feature enabled. OAuth consumer mode will not work with `"SameSite=Strict"`

	* For Twitter, [register an app](https://developer.twitter.com/en/apps), configure callback URL to https://<your_host>/oauth/twitter/callback

	* For Facebook, [register an app](https://developers.facebook.com/apps), configure callback URL to https://<your_host>/oauth/facebook/callback, enable Facebook Login service at https://developers.facebook.com/apps/<app_id>/fb-login/settings/

	* For Google, [register an app](https://console.developers.google.com), configure callback URL to https://<your_host>/oauth/google/callback

	* For Microsoft, [register an app](https://portal.azure.com), configure callback URL to https://<your_host>/oauth/microsoft/callback

	Once the app is configured on external OAuth provider side, add app's credentials and strategy-specific settings (if any — e.g. see Microsoft below) to `config/prod.secret.exs`,
	per strategy's documentation (e.g. [ueberauth_twitter](https://github.com/ueberauth/ueberauth_twitter)). Example config basing on environment variables:

	```elixir
	# Twitter
	config :ueberauth, Ueberauth.Strategy.Twitter.OAuth,
	consumer_key: System.get_env("TWITTER_CONSUMER_KEY"),
	consumer_secret: System.get_env("TWITTER_CONSUMER_SECRET")

	# Facebook
	config :ueberauth, Ueberauth.Strategy.Facebook.OAuth,
	client_id: System.get_env("FACEBOOK_APP_ID"),
	client_secret: System.get_env("FACEBOOK_APP_SECRET"),
	redirect_uri: System.get_env("FACEBOOK_REDIRECT_URI")

	# Google
	config :ueberauth, Ueberauth.Strategy.Google.OAuth,
	client_id: System.get_env("GOOGLE_CLIENT_ID"),
	client_secret: System.get_env("GOOGLE_CLIENT_SECRET"),
	redirect_uri: System.get_env("GOOGLE_REDIRECT_URI")

	# Microsoft
	config :ueberauth, Ueberauth.Strategy.Microsoft.OAuth,
	client_id: System.get_env("MICROSOFT_CLIENT_ID"),
	client_secret: System.get_env("MICROSOFT_CLIENT_SECRET")

	config :ueberauth, Ueberauth,
	providers: [
	microsoft: {Ueberauth.Strategy.Microsoft, [callback_params: []]}
	]

	# Keycloak
	# Note: make sure to add `keycloak:ueberauth_keycloak_strategy` entry to `OAUTH_CONSUMER_STRATEGIES` environment variable
	keycloak_url = "https://publicly-reachable-keycloak-instance.org:8080"

	config :ueberauth, Ueberauth.Strategy.Keycloak.OAuth,
	client_id: System.get_env("KEYCLOAK_CLIENT_ID"),
	client_secret: System.get_env("KEYCLOAK_CLIENT_SECRET"),
	site: keycloak_url,
	authorize_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/auth",
	token_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/token",
	userinfo_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/userinfo",
	token_method: :post

	config :ueberauth, Ueberauth,
	providers: [
	keycloak: {Ueberauth.Strategy.Keycloak, [uid_field: :email]}
	]
	```

	## OAuth 2.0 provider - :oauth2

	Configure OAuth 2 provider capabilities:

	* `token_expires_in` - The lifetime in seconds of the access token.
	* `issue_new_refresh_token` - Keeps old refresh token or generate new refresh token when to obtain an access token.
	* `clean_expired_tokens` - Enable a background job to clean expired oauth tokens. Defaults to `false`.
	* `clean_expired_tokens_interval` - Interval to run the job to clean expired tokens. Defaults to `86_400_000` (24 hours).

	## :emoji
	* `shortcode_globs`: Location of custom emoji files. `` can be used as a wildcard. Example `["/emoji/custom//.png"]`
	* `pack_extensions`: A list of file extensions for emojis, when no emoji.txt for a pack is present. Example `[".png", ".gif"]`
	* `groups`: Emojis are ordered in groups (tags). This is an array of key-value pairs where the key is the groupname and the value the location or array of locations. `` can be used as a wildcard. Example `[Custom: ["/emoji/.png", "/emoji/custom/*.png"]]`
	* `default_manifest`: Location of the JSON-manifest. This manifest contains information about the emoji-packs you can download. Currently only one manifest can be added (no arrays).

	## Database options

	### RUM indexing for full text search
	* `rum_enabled`: If RUM indexes should be used. Defaults to `false`.

	RUM indexes are an alternative indexing scheme that is not included in PostgreSQL by default. While they may eventually be mainlined, for now they have to be installed as a PostgreSQL extension from https://github.com/postgrespro/rum.

	Their advantage over the standard GIN indexes is that they allow efficient ordering of search results by timestamp, which makes search queries a lot faster on larger servers, by one or two orders of magnitude. They take up around 3 times as much space as GIN indexes.

	To enable them, both the `rum_enabled` flag has to be set and the following special migration has to be run:

	`mix ecto.migrate --migrations-path priv/repo/optional_migrations/rum_indexing/`

	This will probably take a long time.

	## :rate_limit

	A keyword list of rate limiters where a key is a limiter name and value is the limiter configuration. The basic configuration is a tuple where:

	* The first element: `scale` (Integer). The time scale in milliseconds.
	* The second element: `limit` (Integer). How many requests to limit in the time scale provided.

	It is also possible to have different limits for unauthenticated and authenticated users: the keyword value must be a list of two tuples where the first one is a config for unauthenticated users and the second one is for authenticated.

	See [`Pleroma.Plugs.RateLimiter`](Pleroma.Plugs.RateLimiter.html) documentation for examples.
	+
	+Supported rate limiters:
	+
	+* `:search` for the search requests (account & status search etc.)
	+* `:app_account_creation` for registering user accounts from the same IP address
	+* `:statuses_actions` for create / delete / fav / unfav / reblog / unreblog actions on any statuses
	+* `:status_id_action` for fav / unfav or reblog / unreblog actions on the same status by the same user
	diff --git a/lib/pleroma/http/connection.ex b/lib/pleroma/http/connection.ex
	index c216cdcb1..a1460d303 100644
	--- a/lib/pleroma/http/connection.ex
	+++ b/lib/pleroma/http/connection.ex
	@@ -1,42 +1,42 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.HTTP.Connection do
	@moduledoc """
	Connection for http-requests.
	"""

	@hackney_options [
	connect_timeout: 10_000,
	recv_timeout: 20_000,
	follow_redirect: true,
	pool: :federation
	]
	@adapter Application.get_env(:tesla, :adapter)

	@doc """
	Configure a client connection

	# Returns

	Tesla.Env.client
	"""
	@spec new(Keyword.t()) :: Tesla.Env.client()
	def new(opts \\ []) do
	Tesla.client([], {@adapter, hackney_options(opts)})
	end

	# fetch Hackney options
	#
	- defp hackney_options(opts) do
	+ def hackney_options(opts) do
	options = Keyword.get(opts, :adapter, [])
	adapter_options = Pleroma.Config.get([:http, :adapter], [])
	proxy_url = Pleroma.Config.get([:http, :proxy_url], nil)

	@hackney_options
	\|> Keyword.merge(adapter_options)
	\|> Keyword.merge(options)
	\|> Keyword.merge(proxy: proxy_url)
	end
	end
	diff --git a/lib/pleroma/http/http.ex b/lib/pleroma/http/http.ex
	index c96ee7353..dec24458a 100644
	--- a/lib/pleroma/http/http.ex
	+++ b/lib/pleroma/http/http.ex
	@@ -1,89 +1,86 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.HTTP do
	@moduledoc """

	"""

	alias Pleroma.HTTP.Connection
	alias Pleroma.HTTP.RequestBuilder, as: Builder

	@type t :: __MODULE__

	@doc """
	Builds and perform http request.

	# Arguments:
	`method` - :get, :post, :put, :delete
	`url`
	`body`
	`headers` - a keyworld list of headers, e.g. `[{"content-type", "text/plain"}]`
	`options` - custom, per-request middleware or adapter options

	# Returns:
	`{:ok, %Tesla.Env{}}` or `{:error, error}`

	"""
	def request(method, url, body \\ "", headers \\ [], options \\ []) do
	try do
	options =
	process_request_options(options)
	\|> process_sni_options(url)

	params = Keyword.get(options, :params, [])

	%{}
	\|> Builder.method(method)
	\|> Builder.headers(headers)
	\|> Builder.opts(options)
	\|> Builder.url(url)
	\|> Builder.add_param(:body, :body, body)
	\|> Builder.add_param(:query, :query, params)
	\|> Enum.into([])
	\|> (&Tesla.request(Connection.new(options), &1)).()
	rescue
	e ->
	{:error, e}
	catch
	:exit, e ->
	{:error, e}
	end
	end

	defp process_sni_options(options, nil), do: options

	defp process_sni_options(options, url) do
	uri = URI.parse(url)
	host = uri.host \|> to_charlist()

	case uri.scheme do
	"https" -> options ++ [ssl: [server_name_indication: host]]
	_ -> options
	end
	end

	def process_request_options(options) do
	- case Pleroma.Config.get([:http, :proxy_url]) do
	- nil -> options
	- proxy -> options ++ [proxy: proxy]
	- end
	+ Keyword.merge(Pleroma.HTTP.Connection.hackney_options([]), options)
	end

	@doc """
	Performs GET request.

	See `Pleroma.HTTP.request/5`
	"""
	def get(url, headers \\ [], options \\ []),
	do: request(:get, url, "", headers, options)

	@doc """
	Performs POST request.

	See `Pleroma.HTTP.request/5`
	"""
	def post(url, body, headers \\ [], options \\ []),
	do: request(:post, url, body, headers, options)
	end
	diff --git a/lib/pleroma/plugs/rate_limiter.ex b/lib/pleroma/plugs/rate_limiter.ex
	index c5e0957e8..31388f574 100644
	--- a/lib/pleroma/plugs/rate_limiter.ex
	+++ b/lib/pleroma/plugs/rate_limiter.ex
	@@ -1,92 +1,131 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Plugs.RateLimiter do
	@moduledoc """

	## Configuration

	A keyword list of rate limiters where a key is a limiter name and value is the limiter configuration. The basic configuration is a tuple where:

	* The first element: `scale` (Integer). The time scale in milliseconds.
	* The second element: `limit` (Integer). How many requests to limit in the time scale provided.

	It is also possible to have different limits for unauthenticated and authenticated users: the keyword value must be a list of two tuples where the first one is a config for unauthenticated users and the second one is for authenticated.

	To disable a limiter set its value to `nil`.

	### Example

	config :pleroma, :rate_limit,
	one: {1000, 10},
	two: [{10_000, 10}, {10_000, 50}],
	foobar: nil

	Here we have three limiters:

	* `one` which is not over 10req/1s
	* `two` which has two limits: 10req/10s for unauthenticated users and 50req/10s for authenticated users
	* `foobar` which is disabled

	## Usage

	+ AllowedSyntax:
	+
	+ plug(Pleroma.Plugs.RateLimiter, :limiter_name)
	+ plug(Pleroma.Plugs.RateLimiter, {:limiter_name, options})
	+
	+ Allowed options:
	+
	+ * `bucket_name` overrides bucket name (e.g. to have a separate limit for a set of actions)
	+ * `params` appends values of specified request params (e.g. ["id"]) to bucket name
	+
	Inside a controller:

	plug(Pleroma.Plugs.RateLimiter, :one when action == :one)
	plug(Pleroma.Plugs.RateLimiter, :two when action in [:two, :three])

	- or inside a router pipiline:
	+ plug(
	+ Pleroma.Plugs.RateLimiter,
	+ {:status_id_action, bucket_name: "status_id_action:fav_unfav", params: ["id"]}
	+ when action in ~w(fav_status unfav_status)a
	+ )
	+
	+ or inside a router pipeline:

	pipeline :api do
	...
	plug(Pleroma.Plugs.RateLimiter, :one)
	...
	end
	"""
	import Pleroma.Web.TranslationHelpers
	import Plug.Conn

	alias Pleroma.User

	- def init(limiter_name) do
	+ def init(limiter_name) when is_atom(limiter_name) do
	+ init({limiter_name, []})
	+ end
	+
	+ def init({limiter_name, opts}) do
	case Pleroma.Config.get([:rate_limit, limiter_name]) do
	nil -> nil
	- config -> {limiter_name, config}
	+ config -> {limiter_name, config, opts}
	end
	end

	- # do not limit if there is no limiter configuration
	+ # Do not limit if there is no limiter configuration
	def call(conn, nil), do: conn

	- def call(conn, opts) do
	- case check_rate(conn, opts) do
	- {:ok, _count} -> conn
	- {:error, _count} -> render_throttled_error(conn)
	+ def call(conn, settings) do
	+ case check_rate(conn, settings) do
	+ {:ok, _count} ->
	+ conn
	+
	+ {:error, _count} ->
	+ render_throttled_error(conn)
	+ end
	+ end
	+
	+ defp bucket_name(conn, limiter_name, opts) do
	+ bucket_name = opts[:bucket_name] \|\| limiter_name
	+
	+ if params_names = opts[:params] do
	+ params_values = for p <- Enum.sort(params_names), do: conn.params[p]
	+ Enum.join([bucket_name] ++ params_values, ":")
	+ else
	+ bucket_name
	end
	end

	- defp check_rate(%{assigns: %{user: %User{id: user_id}}}, {limiter_name, [_, {scale, limit}]}) do
	- ExRated.check_rate("#{limiter_name}:#{user_id}", scale, limit)
	+ defp check_rate(
	+ %{assigns: %{user: %User{id: user_id}}} = conn,
	+ {limiter_name, [_, {scale, limit}], opts}
	+ ) do
	+ bucket_name = bucket_name(conn, limiter_name, opts)
	+ ExRated.check_rate("#{bucket_name}:#{user_id}", scale, limit)
	end

	- defp check_rate(conn, {limiter_name, [{scale, limit} \| _]}) do
	- ExRated.check_rate("#{limiter_name}:#{ip(conn)}", scale, limit)
	+ defp check_rate(conn, {limiter_name, [{scale, limit} \| _], opts}) do
	+ bucket_name = bucket_name(conn, limiter_name, opts)
	+ ExRated.check_rate("#{bucket_name}:#{ip(conn)}", scale, limit)
	end

	- defp check_rate(conn, {limiter_name, {scale, limit}}) do
	- check_rate(conn, {limiter_name, [{scale, limit}]})
	+ defp check_rate(conn, {limiter_name, {scale, limit}, opts}) do
	+ check_rate(conn, {limiter_name, [{scale, limit}, {scale, limit}], opts})
	end

	def ip(%{remote_ip: remote_ip}) do
	remote_ip
	\|> Tuple.to_list()
	\|> Enum.join(".")
	end

	defp render_throttled_error(conn) do
	conn
	\|> render_error(:too_many_requests, "Throttled")
	\|> halt()
	end
	end
	diff --git a/lib/pleroma/reverse_proxy/reverse_proxy.ex b/lib/pleroma/reverse_proxy/reverse_proxy.ex
	index bf31e9cba..1f98f215c 100644
	--- a/lib/pleroma/reverse_proxy/reverse_proxy.ex
	+++ b/lib/pleroma/reverse_proxy/reverse_proxy.ex
	@@ -1,382 +1,383 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.ReverseProxy do
	alias Pleroma.HTTP

	@keep_req_headers ~w(accept user-agent accept-encoding cache-control if-modified-since) ++
	~w(if-unmodified-since if-none-match if-range range)
	@resp_cache_headers ~w(etag date last-modified cache-control)
	@keep_resp_headers @resp_cache_headers ++
	~w(content-type content-disposition content-encoding content-range) ++
	~w(accept-ranges vary)
	@default_cache_control_header "public, max-age=1209600"
	@valid_resp_codes [200, 206, 304]
	@max_read_duration :timer.seconds(30)
	@max_body_length :infinity
	@methods ~w(GET HEAD)

	@moduledoc """
	A reverse proxy.

	Pleroma.ReverseProxy.call(conn, url, options)

	It is not meant to be added into a plug pipeline, but to be called from another plug or controller.

	Supports `#{inspect(@methods)}` HTTP methods, and only allows `#{inspect(@valid_resp_codes)}` status codes.

	Responses are chunked to the client while downloading from the upstream.

	Some request / responses headers are preserved:

	* request: `#{inspect(@keep_req_headers)}`
	* response: `#{inspect(@keep_resp_headers)}`

	If no caching headers (`#{inspect(@resp_cache_headers)}`) are returned by upstream, `cache-control` will be
	set to `#{inspect(@default_cache_control_header)}`.

	Options:

	* `redirect_on_failure` (default `false`). Redirects the client to the real remote URL if there's any HTTP
	errors. Any error during body processing will not be redirected as the response is chunked. This may expose
	remote URL, clients IPs, ….

	* `max_body_length` (default `#{inspect(@max_body_length)}`): limits the content length to be approximately the
	specified length. It is validated with the `content-length` header and also verified when proxying.

	* `max_read_duration` (default `#{inspect(@max_read_duration)}` ms): the total time the connection is allowed to
	read from the remote upstream.

	* `inline_content_types`:
	* `true` will not alter `content-disposition` (up to the upstream),
	* `false` will add `content-disposition: attachment` to any request,
	* a list of whitelisted content types

	* `keep_user_agent` will forward the client's user-agent to the upstream. This may be useful if the upstream is
	doing content transformation (encoding, …) depending on the request.

	* `req_headers`, `resp_headers` additional headers.

	* `http`: options for [hackney](https://github.com/benoitc/hackney).

	"""
	- @default_hackney_options []
	+ @default_hackney_options [pool: :media]

	@inline_content_types [
	"image/gif",
	"image/jpeg",
	"image/jpg",
	"image/png",
	"image/svg+xml",
	"audio/mpeg",
	"audio/mp3",
	"video/webm",
	"video/mp4",
	"video/quicktime"
	]

	require Logger
	import Plug.Conn

	@type option() ::
	{:keep_user_agent, boolean}
	\| {:max_read_duration, :timer.time() \| :infinity}
	\| {:max_body_length, non_neg_integer() \| :infinity}
	\| {:http, []}
	\| {:req_headers, [{String.t(), String.t()}]}
	\| {:resp_headers, [{String.t(), String.t()}]}
	\| {:inline_content_types, boolean() \| [String.t()]}
	\| {:redirect_on_failure, boolean()}

	@spec call(Plug.Conn.t(), url :: String.t(), [option()]) :: Plug.Conn.t()
	def call(_conn, _url, _opts \\ [])

	def call(conn = %{method: method}, url, opts) when method in @methods do
	hackney_opts =
	- @default_hackney_options
	+ Pleroma.HTTP.Connection.hackney_options([])
	+ \|> Keyword.merge(@default_hackney_options)
	\|> Keyword.merge(Keyword.get(opts, :http, []))
	\|> HTTP.process_request_options()

	req_headers = build_req_headers(conn.req_headers, opts)

	opts =
	if filename = Pleroma.Web.MediaProxy.filename(url) do
	Keyword.put_new(opts, :attachment_name, filename)
	else
	opts
	end

	with {:ok, code, headers, client} <- request(method, url, req_headers, hackney_opts),
	:ok <- header_length_constraint(headers, Keyword.get(opts, :max_body_length)) do
	response(conn, client, url, code, headers, opts)
	else
	{:ok, code, headers} ->
	head_response(conn, url, code, headers, opts)
	\|> halt()

	{:error, {:invalid_http_response, code}} ->
	Logger.error("#{__MODULE__}: request to #{inspect(url)} failed with HTTP status #{code}")

	conn
	\|> error_or_redirect(
	url,
	code,
	"Request failed: " <> Plug.Conn.Status.reason_phrase(code),
	opts
	)
	\|> halt()

	{:error, error} ->
	Logger.error("#{__MODULE__}: request to #{inspect(url)} failed: #{inspect(error)}")

	conn
	\|> error_or_redirect(url, 500, "Request failed", opts)
	\|> halt()
	end
	end

	def call(conn, _, _) do
	conn
	\|> send_resp(400, Plug.Conn.Status.reason_phrase(400))
	\|> halt()
	end

	defp request(method, url, headers, hackney_opts) do
	Logger.debug("#{__MODULE__} #{method} #{url} #{inspect(headers)}")
	method = method \|> String.downcase() \|> String.to_existing_atom()

	case client().request(method, url, headers, "", hackney_opts) do
	{:ok, code, headers, client} when code in @valid_resp_codes ->
	{:ok, code, downcase_headers(headers), client}

	{:ok, code, headers} when code in @valid_resp_codes ->
	{:ok, code, downcase_headers(headers)}

	{:ok, code, _, _} ->
	{:error, {:invalid_http_response, code}}

	{:error, error} ->
	{:error, error}
	end
	end

	defp response(conn, client, url, status, headers, opts) do
	result =
	conn
	\|> put_resp_headers(build_resp_headers(headers, opts))
	\|> send_chunked(status)
	\|> chunk_reply(client, opts)

	case result do
	{:ok, conn} ->
	halt(conn)

	{:error, :closed, conn} ->
	client().close(client)
	halt(conn)

	{:error, error, conn} ->
	Logger.warn(
	"#{__MODULE__} request to #{url} failed while reading/chunking: #{inspect(error)}"
	)

	client().close(client)
	halt(conn)
	end
	end

	defp chunk_reply(conn, client, opts) do
	chunk_reply(conn, client, opts, 0, 0)
	end

	defp chunk_reply(conn, client, opts, sent_so_far, duration) do
	with {:ok, duration} <-
	check_read_duration(
	duration,
	Keyword.get(opts, :max_read_duration, @max_read_duration)
	),
	{:ok, data} <- client().stream_body(client),
	{:ok, duration} <- increase_read_duration(duration),
	sent_so_far = sent_so_far + byte_size(data),
	:ok <- body_size_constraint(sent_so_far, Keyword.get(opts, :max_body_size)),
	{:ok, conn} <- chunk(conn, data) do
	chunk_reply(conn, client, opts, sent_so_far, duration)
	else
	:done -> {:ok, conn}
	{:error, error} -> {:error, error, conn}
	end
	end

	defp head_response(conn, _url, code, headers, opts) do
	conn
	\|> put_resp_headers(build_resp_headers(headers, opts))
	\|> send_resp(code, "")
	end

	defp error_or_redirect(conn, url, code, body, opts) do
	if Keyword.get(opts, :redirect_on_failure, false) do
	conn
	\|> Phoenix.Controller.redirect(external: url)
	\|> halt()
	else
	conn
	\|> send_resp(code, body)
	\|> halt
	end
	end

	defp downcase_headers(headers) do
	Enum.map(headers, fn {k, v} ->
	{String.downcase(k), v}
	end)
	end

	defp get_content_type(headers) do
	{_, content_type} =
	List.keyfind(headers, "content-type", 0, {"content-type", "application/octet-stream"})

	[content_type \| _] = String.split(content_type, ";")
	content_type
	end

	defp put_resp_headers(conn, headers) do
	Enum.reduce(headers, conn, fn {k, v}, conn ->
	put_resp_header(conn, k, v)
	end)
	end

	defp build_req_headers(headers, opts) do
	headers
	\|> downcase_headers()
	\|> Enum.filter(fn {k, _} -> k in @keep_req_headers end)
	\|> (fn headers ->
	headers = headers ++ Keyword.get(opts, :req_headers, [])

	if Keyword.get(opts, :keep_user_agent, false) do
	List.keystore(
	headers,
	"user-agent",
	0,
	{"user-agent", Pleroma.Application.user_agent()}
	)
	else
	headers
	end
	end).()
	end

	defp build_resp_headers(headers, opts) do
	headers
	\|> Enum.filter(fn {k, _} -> k in @keep_resp_headers end)
	\|> build_resp_cache_headers(opts)
	\|> build_resp_content_disposition_header(opts)
	\|> (fn headers -> headers ++ Keyword.get(opts, :resp_headers, []) end).()
	end

	defp build_resp_cache_headers(headers, _opts) do
	has_cache? = Enum.any?(headers, fn {k, _} -> k in @resp_cache_headers end)
	has_cache_control? = List.keymember?(headers, "cache-control", 0)

	cond do
	has_cache? && has_cache_control? ->
	headers

	has_cache? ->
	# There's caching header present but no cache-control -- we need to explicitely override it
	# to public as Plug defaults to "max-age=0, private, must-revalidate"
	List.keystore(headers, "cache-control", 0, {"cache-control", "public"})

	true ->
	List.keystore(
	headers,
	"cache-control",
	0,
	{"cache-control", @default_cache_control_header}
	)
	end
	end

	defp build_resp_content_disposition_header(headers, opts) do
	opt = Keyword.get(opts, :inline_content_types, @inline_content_types)

	content_type = get_content_type(headers)

	attachment? =
	cond do
	is_list(opt) && !Enum.member?(opt, content_type) -> true
	opt == false -> true
	true -> false
	end

	if attachment? do
	name =
	try do
	{{"content-disposition", content_disposition_string}, _} =
	List.keytake(headers, "content-disposition", 0)

	[name \| _] =
	Regex.run(
	~r/filename="((?:[^"\\]\|\\.)*)"/u,
	content_disposition_string \|\| "",
	capture: :all_but_first
	)

	name
	rescue
	MatchError -> Keyword.get(opts, :attachment_name, "attachment")
	end

	disposition = "attachment; filename=\"#{name}\""

	List.keystore(headers, "content-disposition", 0, {"content-disposition", disposition})
	else
	headers
	end
	end

	defp header_length_constraint(headers, limit) when is_integer(limit) and limit > 0 do
	with {_, size} <- List.keyfind(headers, "content-length", 0),
	{size, _} <- Integer.parse(size),
	true <- size <= limit do
	:ok
	else
	false ->
	{:error, :body_too_large}

	_ ->
	:ok
	end
	end

	defp header_length_constraint(_, _), do: :ok

	defp body_size_constraint(size, limit) when is_integer(limit) and limit > 0 and size >= limit do
	{:error, :body_too_large}
	end

	defp body_size_constraint(_, _), do: :ok

	defp check_read_duration(duration, max)
	when is_integer(duration) and is_integer(max) and max > 0 do
	if duration > max do
	{:error, :read_duration_exceeded}
	else
	{:ok, {duration, :erlang.system_time(:millisecond)}}
	end
	end

	defp check_read_duration(_, _), do: {:ok, :no_duration_limit, :no_duration_limit}

	defp increase_read_duration({previous_duration, started})
	when is_integer(previous_duration) and is_integer(started) do
	duration = :erlang.system_time(:millisecond) - started
	{:ok, previous_duration + duration}
	end

	defp increase_read_duration(_) do
	{:ok, :no_duration_limit, :no_duration_limit}
	end

	defp client, do: Pleroma.ReverseProxy.Client
	end
	diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	index cf5176201..e2af4ad1a 100644
	--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	@@ -1,328 +1,355 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubController do
	use Pleroma.Web, :controller

	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.Federator

	require Logger

	action_fallback(:errors)

	plug(Pleroma.Web.FederatingPlug when action in [:inbox, :relay])
	plug(:set_requester_reachable when action in [:inbox])
	plug(:relay_active? when action in [:relay])

	def relay_active?(conn, _) do
	if Pleroma.Config.get([:instance, :allow_relay]) do
	conn
	else
	conn
	\|> render_error(:not_found, "not found")
	\|> halt()
	end
	end

	def user(conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(UserView.render("user.json", %{user: user}))
	else
	nil -> {:error, :not_found}
	end
	end

	def object(conn, %{"uuid" => uuid}) do
	with ap_id <- o_status_url(conn, :object, uuid),
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(object)} do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(ObjectView.render("object.json", %{object: object}))
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	def object_likes(conn, %{"uuid" => uuid, "page" => page}) do
	with ap_id <- o_status_url(conn, :object, uuid),
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(object)},
	likes <- Utils.get_object_likes(object) do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(ObjectView.render("likes.json", ap_id, likes, page))
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	def object_likes(conn, %{"uuid" => uuid}) do
	with ap_id <- o_status_url(conn, :object, uuid),
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(object)},
	likes <- Utils.get_object_likes(object) do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(ObjectView.render("likes.json", ap_id, likes))
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	def activity(conn, %{"uuid" => uuid}) do
	with ap_id <- o_status_url(conn, :activity, uuid),
	%Activity{} = activity <- Activity.normalize(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(activity)} do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(ObjectView.render("object.json", %{object: activity}))
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	- def following(conn, %{"nickname" => nickname, "page" => page}) do
	+ def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	- {:ok, user} <- User.ensure_keys_present(user) do
	+ {user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
	+ {:show_follows, true} <-
	+ {:show_follows, (for_user && for_user == user) \|\| !user.info.hide_follows} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_header("content-type", "application/activity+json")
	- \|> json(UserView.render("following.json", %{user: user, page: page}))
	+ \|> json(UserView.render("following.json", %{user: user, page: page, for: for_user}))
	+ else
	+ {:show_follows, _} ->
	+ conn
	+ \|> put_resp_header("content-type", "application/activity+json")
	+ \|> send_resp(403, "")
	end
	end

	- def following(conn, %{"nickname" => nickname}) do
	+ def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	- {:ok, user} <- User.ensure_keys_present(user) do
	+ {user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	- \|> json(UserView.render("following.json", %{user: user}))
	+ \|> json(UserView.render("following.json", %{user: user, for: for_user}))
	end
	end

	- def followers(conn, %{"nickname" => nickname, "page" => page}) do
	+ def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	- {:ok, user} <- User.ensure_keys_present(user) do
	+ {user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
	+ {:show_followers, true} <-
	+ {:show_followers, (for_user && for_user == user) \|\| !user.info.hide_followers} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_header("content-type", "application/activity+json")
	- \|> json(UserView.render("followers.json", %{user: user, page: page}))
	+ \|> json(UserView.render("followers.json", %{user: user, page: page, for: for_user}))
	+ else
	+ {:show_followers, _} ->
	+ conn
	+ \|> put_resp_header("content-type", "application/activity+json")
	+ \|> send_resp(403, "")
	end
	end

	- def followers(conn, %{"nickname" => nickname}) do
	+ def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	- {:ok, user} <- User.ensure_keys_present(user) do
	+ {user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	- \|> json(UserView.render("followers.json", %{user: user}))
	+ \|> json(UserView.render("followers.json", %{user: user, for: for_user}))
	end
	end

	def outbox(conn, %{"nickname" => nickname} = params) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(UserView.render("outbox.json", %{user: user, max_id: params["max_id"]}))
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, %{"nickname" => nickname} = params) do
	with %User{} = recipient <- User.get_cached_by_nickname(nickname),
	{:ok, %User{} = actor} <- User.get_or_fetch_by_ap_id(params["actor"]),
	true <- Utils.recipient_in_message(recipient, actor, params),
	params <- Utils.maybe_splice_recipient(recipient.ap_id, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end

	# only accept relayed Creates
	def inbox(conn, %{"type" => "Create"} = params) do
	Logger.info(
	"Signature missing or not from author, relayed Create message, fetching object from source"
	)

	Fetcher.fetch_object_from_id(params["object"]["id"])

	json(conn, "ok")
	end

	def inbox(conn, params) do
	headers = Enum.into(conn.req_headers, %{})

	if String.contains?(headers["signature"], params["actor"]) do
	Logger.info(
	"Signature validation error for: #{params["actor"]}, make sure you are forwarding the HTTP Host header!"
	)

	Logger.info(inspect(conn.req_headers))
	end

	json(conn, dgettext("errors", "error"))
	end

	def relay(conn, _params) do
	with %User{} = user <- Relay.get_actor(),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(UserView.render("user.json", %{user: user}))
	else
	nil -> {:error, :not_found}
	end
	end

	def whoami(%{assigns: %{user: %User{} = user}} = conn, _params) do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(UserView.render("user.json", %{user: user}))
	end

	def whoami(_conn, _params), do: {:error, :not_found}

	def read_inbox(%{assigns: %{user: user}} = conn, %{"nickname" => nickname} = params) do
	if nickname == user.nickname do
	conn
	\|> put_resp_header("content-type", "application/activity+json")
	\|> json(UserView.render("inbox.json", %{user: user, max_id: params["max_id"]}))
	else
	err =
	dgettext("errors", "can't read inbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: user.nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end
	end

	def handle_user_activity(user, %{"type" => "Create"} = params) do
	object =
	params["object"]
	\|> Map.merge(Map.take(params, ["to", "cc"]))
	\|> Map.put("attributedTo", user.ap_id())
	\|> Transmogrifier.fix_object()

	ActivityPub.create(%{
	to: params["to"],
	actor: user,
	context: object["context"],
	object: object,
	additional: Map.take(params, ["cc"])
	})
	end

	def handle_user_activity(user, %{"type" => "Delete"} = params) do
	with %Object{} = object <- Object.normalize(params["object"]),
	true <- user.info.is_moderator \|\| user.ap_id == object.data["actor"],
	{:ok, delete} <- ActivityPub.delete(object) do
	{:ok, delete}
	else
	_ -> {:error, dgettext("errors", "Can't delete object")}
	end
	end

	def handle_user_activity(user, %{"type" => "Like"} = params) do
	with %Object{} = object <- Object.normalize(params["object"]),
	{:ok, activity, _object} <- ActivityPub.like(user, object) do
	{:ok, activity}
	else
	_ -> {:error, dgettext("errors", "Can't like object")}
	end
	end

	def handle_user_activity(_, _) do
	{:error, dgettext("errors", "Unhandled activity type")}
	end

	def update_outbox(
	%{assigns: %{user: user}} = conn,
	%{"nickname" => nickname} = params
	) do
	if nickname == user.nickname do
	actor = user.ap_id()

	params =
	params
	\|> Map.drop(["id"])
	\|> Map.put("actor", actor)
	\|> Transmogrifier.fix_addressing()

	with {:ok, %Activity{} = activity} <- handle_user_activity(user, params) do
	conn
	\|> put_status(:created)
	\|> put_resp_header("location", activity.data["id"])
	\|> json(activity.data)
	else
	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(message)
	end
	else
	err =
	dgettext("errors", "can't update outbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: user.nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end
	end

	def errors(conn, {:error, :not_found}) do
	conn
	\|> put_status(:not_found)
	\|> json(dgettext("errors", "Not found"))
	end

	def errors(conn, _e) do
	conn
	\|> put_status(:internal_server_error)
	\|> json(dgettext("errors", "error"))
	end

	defp set_requester_reachable(%Plug.Conn{} = conn, _) do
	with actor <- conn.params["actor"],
	true <- is_binary(actor) do
	Pleroma.Instances.set_reachable(actor)
	end

	conn
	end
	+
	+ defp ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	+ {:ok, new_user} = User.ensure_keys_present(user)
	+
	+ for_user =
	+ if new_user != user and match?(%User{}, for_user) do
	+ User.get_cached_by_nickname(for_user.nickname)
	+ else
	+ for_user
	+ end
	+
	+ {new_user, for_user}
	+ end
	end
	diff --git a/lib/pleroma/web/activity_pub/views/user_view.ex b/lib/pleroma/web/activity_pub/views/user_view.ex
	index 327e0e05b..d9c1bcb2c 100644
	--- a/lib/pleroma/web/activity_pub/views/user_view.ex
	+++ b/lib/pleroma/web/activity_pub/views/user_view.ex
	@@ -1,308 +1,323 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.UserView do
	use Pleroma.Web, :view

	alias Pleroma.Keys
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.Endpoint
	alias Pleroma.Web.Router.Helpers

	import Ecto.Query

	def render("endpoints.json", %{user: %User{nickname: nil, local: true} = _user}) do
	%{"sharedInbox" => Helpers.activity_pub_url(Endpoint, :inbox)}
	end

	def render("endpoints.json", %{user: %User{local: true} = _user}) do
	%{
	"oauthAuthorizationEndpoint" => Helpers.o_auth_url(Endpoint, :authorize),
	"oauthRegistrationEndpoint" => Helpers.mastodon_api_url(Endpoint, :create_app),
	"oauthTokenEndpoint" => Helpers.o_auth_url(Endpoint, :token_exchange),
	"sharedInbox" => Helpers.activity_pub_url(Endpoint, :inbox)
	}
	end

	def render("endpoints.json", _), do: %{}

	# the instance itself is not a Person, but instead an Application
	def render("user.json", %{user: %{nickname: nil} = user}) do
	{:ok, user} = User.ensure_keys_present(user)
	{:ok, _, public_key} = Keys.keys_from_pem(user.info.keys)
	public_key = :public_key.pem_entry_encode(:SubjectPublicKeyInfo, public_key)
	public_key = :public_key.pem_encode([public_key])

	endpoints = render("endpoints.json", %{user: user})

	%{
	"id" => user.ap_id,
	"type" => "Application",
	"following" => "#{user.ap_id}/following",
	"followers" => "#{user.ap_id}/followers",
	"inbox" => "#{user.ap_id}/inbox",
	"name" => "Pleroma",
	"summary" => "Virtual actor for Pleroma relay",
	"url" => user.ap_id,
	"manuallyApprovesFollowers" => false,
	"publicKey" => %{
	"id" => "#{user.ap_id}#main-key",
	"owner" => user.ap_id,
	"publicKeyPem" => public_key
	},
	"endpoints" => endpoints
	}
	\|> Map.merge(Utils.make_json_ld_header())
	end

	def render("user.json", %{user: user}) do
	{:ok, user} = User.ensure_keys_present(user)
	{:ok, _, public_key} = Keys.keys_from_pem(user.info.keys)
	public_key = :public_key.pem_entry_encode(:SubjectPublicKeyInfo, public_key)
	public_key = :public_key.pem_encode([public_key])

	endpoints = render("endpoints.json", %{user: user})

	user_tags =
	user
	\|> Transmogrifier.add_emoji_tags()
	\|> Map.get("tag", [])

	%{
	"id" => user.ap_id,
	"type" => "Person",
	"following" => "#{user.ap_id}/following",
	"followers" => "#{user.ap_id}/followers",
	"inbox" => "#{user.ap_id}/inbox",
	"outbox" => "#{user.ap_id}/outbox",
	"preferredUsername" => user.nickname,
	"name" => user.name,
	"summary" => user.bio,
	"url" => user.ap_id,
	"manuallyApprovesFollowers" => user.info.locked,
	"publicKey" => %{
	"id" => "#{user.ap_id}#main-key",
	"owner" => user.ap_id,
	"publicKeyPem" => public_key
	},
	"endpoints" => endpoints,
	"tag" => (user.info.source_data["tag"] \|\| []) ++ user_tags
	}
	\|> Map.merge(maybe_make_image(&User.avatar_url/2, "icon", user))
	\|> Map.merge(maybe_make_image(&User.banner_url/2, "image", user))
	\|> Map.merge(Utils.make_json_ld_header())
	end

	- def render("following.json", %{user: user, page: page}) do
	+ def render("following.json", %{user: user, page: page} = opts) do
	+ showing = (opts[:for] && opts[:for] == user) \|\| !user.info.hide_follows
	query = User.get_friends_query(user)
	query = from(user in query, select: [:ap_id])
	following = Repo.all(query)

	total =
	- if !user.info.hide_follows do
	+ if showing do
	length(following)
	else
	0
	end

	- collection(following, "#{user.ap_id}/following", page, !user.info.hide_follows, total)
	+ collection(following, "#{user.ap_id}/following", page, showing, total)
	\|> Map.merge(Utils.make_json_ld_header())
	end

	- def render("following.json", %{user: user}) do
	+ def render("following.json", %{user: user} = opts) do
	+ showing = (opts[:for] && opts[:for] == user) \|\| !user.info.hide_follows
	query = User.get_friends_query(user)
	query = from(user in query, select: [:ap_id])
	following = Repo.all(query)

	total =
	- if !user.info.hide_follows do
	+ if showing do
	length(following)
	else
	0
	end

	%{
	"id" => "#{user.ap_id}/following",
	"type" => "OrderedCollection",
	"totalItems" => total,
	- "first" => collection(following, "#{user.ap_id}/following", 1, !user.info.hide_follows)
	+ "first" =>
	+ if showing do
	+ collection(following, "#{user.ap_id}/following", 1, !user.info.hide_follows)
	+ else
	+ "#{user.ap_id}/following?page=1"
	+ end
	}
	\|> Map.merge(Utils.make_json_ld_header())
	end

	- def render("followers.json", %{user: user, page: page}) do
	+ def render("followers.json", %{user: user, page: page} = opts) do
	+ showing = (opts[:for] && opts[:for] == user) \|\| !user.info.hide_followers
	+
	query = User.get_followers_query(user)
	query = from(user in query, select: [:ap_id])
	followers = Repo.all(query)

	total =
	- if !user.info.hide_followers do
	+ if showing do
	length(followers)
	else
	0
	end

	- collection(followers, "#{user.ap_id}/followers", page, !user.info.hide_followers, total)
	+ collection(followers, "#{user.ap_id}/followers", page, showing, total)
	\|> Map.merge(Utils.make_json_ld_header())
	end

	- def render("followers.json", %{user: user}) do
	+ def render("followers.json", %{user: user} = opts) do
	+ showing = (opts[:for] && opts[:for] == user) \|\| !user.info.hide_followers
	+
	query = User.get_followers_query(user)
	query = from(user in query, select: [:ap_id])
	followers = Repo.all(query)

	total =
	- if !user.info.hide_followers do
	+ if showing do
	length(followers)
	else
	0
	end

	%{
	"id" => "#{user.ap_id}/followers",
	"type" => "OrderedCollection",
	"totalItems" => total,
	"first" =>
	- collection(followers, "#{user.ap_id}/followers", 1, !user.info.hide_followers, total)
	+ if showing do
	+ collection(followers, "#{user.ap_id}/followers", 1, showing, total)
	+ else
	+ "#{user.ap_id}/followers?page=1"
	+ end
	}
	\|> Map.merge(Utils.make_json_ld_header())
	end

	def render("outbox.json", %{user: user, max_id: max_qid}) do
	params = %{
	"limit" => "10"
	}

	params =
	if max_qid != nil do
	Map.put(params, "max_id", max_qid)
	else
	params
	end

	activities = ActivityPub.fetch_user_activities(user, nil, params)

	{max_id, min_id, collection} =
	if length(activities) > 0 do
	{
	Enum.at(Enum.reverse(activities), 0).id,
	Enum.at(activities, 0).id,
	Enum.map(activities, fn act ->
	{:ok, data} = Transmogrifier.prepare_outgoing(act.data)
	data
	end)
	}
	else
	{
	0,
	0,
	[]
	}
	end

	iri = "#{user.ap_id}/outbox"

	page = %{
	"id" => "#{iri}?max_id=#{max_id}",
	"type" => "OrderedCollectionPage",
	"partOf" => iri,
	"orderedItems" => collection,
	"next" => "#{iri}?max_id=#{min_id}"
	}

	if max_qid == nil do
	%{
	"id" => iri,
	"type" => "OrderedCollection",
	"first" => page
	}
	\|> Map.merge(Utils.make_json_ld_header())
	else
	page \|> Map.merge(Utils.make_json_ld_header())
	end
	end

	def render("inbox.json", %{user: user, max_id: max_qid}) do
	params = %{
	"limit" => "10"
	}

	params =
	if max_qid != nil do
	Map.put(params, "max_id", max_qid)
	else
	params
	end

	activities = ActivityPub.fetch_activities([user.ap_id \| user.following], params)

	min_id = Enum.at(Enum.reverse(activities), 0).id
	max_id = Enum.at(activities, 0).id

	collection =
	Enum.map(activities, fn act ->
	{:ok, data} = Transmogrifier.prepare_outgoing(act.data)
	data
	end)

	iri = "#{user.ap_id}/inbox"

	page = %{
	"id" => "#{iri}?max_id=#{max_id}",
	"type" => "OrderedCollectionPage",
	"partOf" => iri,
	"orderedItems" => collection,
	"next" => "#{iri}?max_id=#{min_id}"
	}

	if max_qid == nil do
	%{
	"id" => iri,
	"type" => "OrderedCollection",
	"first" => page
	}
	\|> Map.merge(Utils.make_json_ld_header())
	else
	page \|> Map.merge(Utils.make_json_ld_header())
	end
	end

	def collection(collection, iri, page, show_items \\ true, total \\ nil) do
	offset = (page - 1) * 10
	items = Enum.slice(collection, offset, 10)
	items = Enum.map(items, fn user -> user.ap_id end)
	total = total \|\| length(collection)

	map = %{
	"id" => "#{iri}?page=#{page}",
	"type" => "OrderedCollectionPage",
	"partOf" => iri,
	"totalItems" => total,
	"orderedItems" => if(show_items, do: items, else: [])
	}

	if offset < total do
	Map.put(map, "next", "#{iri}?page=#{page + 1}")
	else
	map
	end
	end

	defp maybe_make_image(func, key, user) do
	if image = func.(user, no_default: true) do
	%{
	key => %{
	"type" => "Image",
	"url" => image
	}
	}
	else
	%{}
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
	index 8c2033c3a..8a7b75025 100644
	--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
	@@ -1,1808 +1,1825 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
	use Pleroma.Web, :controller
	alias Ecto.Changeset
	alias Pleroma.Activity
	alias Pleroma.Bookmark
	alias Pleroma.Config
	alias Pleroma.Conversation.Participation
	alias Pleroma.Filter
	alias Pleroma.Formatter
	alias Pleroma.HTTP
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Pagination
	+ alias Pleroma.Plugs.RateLimiter
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.Stats
	alias Pleroma.User
	alias Pleroma.Web
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.AppView
	alias Pleroma.Web.MastodonAPI.ConversationView
	alias Pleroma.Web.MastodonAPI.FilterView
	alias Pleroma.Web.MastodonAPI.ListView
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	alias Pleroma.Web.MastodonAPI.MastodonView
	alias Pleroma.Web.MastodonAPI.NotificationView
	alias Pleroma.Web.MastodonAPI.ReportView
	alias Pleroma.Web.MastodonAPI.ScheduledActivityView
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.MediaProxy
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Scopes
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.TwitterAPI

	alias Pleroma.Web.ControllerHelper
	import Ecto.Query

	require Logger

	- plug(Pleroma.Plugs.RateLimiter, :app_account_creation when action == :account_register)
	- plug(Pleroma.Plugs.RateLimiter, :search when action in [:search, :search2, :account_search])
	+ @rate_limited_status_actions ~w(reblog_status unreblog_status fav_status unfav_status
	+ post_status delete_status)a
	+
	+ plug(
	+ RateLimiter,
	+ {:status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: ["id"]}
	+ when action in ~w(reblog_status unreblog_status)a
	+ )
	+
	+ plug(
	+ RateLimiter,
	+ {:status_id_action, bucket_name: "status_id_action:fav_unfav", params: ["id"]}
	+ when action in ~w(fav_status unfav_status)a
	+ )
	+
	+ plug(RateLimiter, :statuses_actions when action in @rate_limited_status_actions)
	+ plug(RateLimiter, :app_account_creation when action == :account_register)
	+ plug(RateLimiter, :search when action in [:search, :search2, :account_search])

	@local_mastodon_name "Mastodon-Local"

	action_fallback(:errors)

	def create_app(conn, params) do
	scopes = Scopes.fetch_scopes(params, ["read"])

	app_attrs =
	params
	\|> Map.drop(["scope", "scopes"])
	\|> Map.put("scopes", scopes)

	with cs <- App.register_changeset(%App{}, app_attrs),
	false <- cs.changes[:client_name] == @local_mastodon_name,
	{:ok, app} <- Repo.insert(cs) do
	conn
	\|> put_view(AppView)
	\|> render("show.json", %{app: app})
	end
	end

	defp add_if_present(
	map,
	params,
	params_field,
	map_field,
	value_function \\ fn x -> {:ok, x} end
	) do
	if Map.has_key?(params, params_field) do
	case value_function.(params[params_field]) do
	{:ok, new_value} -> Map.put(map, map_field, new_value)
	:error -> map
	end
	else
	map
	end
	end

	def update_credentials(%{assigns: %{user: user}} = conn, params) do
	original_user = user

	user_params =
	%{}
	\|> add_if_present(params, "display_name", :name)
	\|> add_if_present(params, "note", :bio, fn value -> {:ok, User.parse_bio(value, user)} end)
	\|> add_if_present(params, "avatar", :avatar, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :avatar) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)

	emojis_text = (user_params["display_name"] \|\| "") <> (user_params["note"] \|\| "")

	user_info_emojis =
	((user.info.emoji \|\| []) ++ Formatter.get_emoji_map(emojis_text))
	\|> Enum.dedup()

	info_params =
	[
	:no_rich_text,
	:locked,
	:hide_followers,
	:hide_follows,
	:hide_favorites,
	:show_role,
	:skip_thread_containment
	]
	\|> Enum.reduce(%{}, fn key, acc ->
	add_if_present(acc, params, to_string(key), key, fn value ->
	{:ok, ControllerHelper.truthy_param?(value)}
	end)
	end)
	\|> add_if_present(params, "default_scope", :default_scope)
	\|> add_if_present(params, "pleroma_settings_store", :pleroma_settings_store, fn value ->
	{:ok, Map.merge(user.info.pleroma_settings_store, value)}
	end)
	\|> add_if_present(params, "header", :banner, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :banner) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)
	\|> add_if_present(params, "pleroma_background_image", :background, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :background) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)
	\|> Map.put(:emoji, user_info_emojis)

	info_cng = User.Info.profile_update(user.info, info_params)

	with changeset <- User.update_changeset(user, user_params),
	changeset <- Ecto.Changeset.put_embed(changeset, :info, info_cng),
	{:ok, user} <- User.update_and_set_cache(changeset) do
	if original_user != user do
	CommonAPI.update(user)
	end

	json(
	conn,
	AccountView.render("account.json", %{user: user, for: user, with_pleroma_settings: true})
	)
	else
	_e -> render_error(conn, :forbidden, "Invalid request")
	end
	end

	def update_avatar(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
	change = Changeset.change(user, %{avatar: nil})
	{:ok, user} = User.update_and_set_cache(change)
	CommonAPI.update(user)

	json(conn, %{url: nil})
	end

	def update_avatar(%{assigns: %{user: user}} = conn, params) do
	{:ok, object} = ActivityPub.upload(params, type: :avatar)
	change = Changeset.change(user, %{avatar: object.data})
	{:ok, user} = User.update_and_set_cache(change)
	CommonAPI.update(user)
	%{"url" => [%{"href" => href} \| _]} = object.data

	json(conn, %{url: href})
	end

	def update_banner(%{assigns: %{user: user}} = conn, %{"banner" => ""}) do
	with new_info <- %{"banner" => %{}},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Ecto.Changeset.change(user) \|> Ecto.Changeset.put_embed(:info, info_cng),
	{:ok, user} <- User.update_and_set_cache(changeset) do
	CommonAPI.update(user)

	json(conn, %{url: nil})
	end
	end

	def update_banner(%{assigns: %{user: user}} = conn, params) do
	with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}, type: :banner),
	new_info <- %{"banner" => object.data},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Ecto.Changeset.change(user) \|> Ecto.Changeset.put_embed(:info, info_cng),
	{:ok, user} <- User.update_and_set_cache(changeset) do
	CommonAPI.update(user)
	%{"url" => [%{"href" => href} \| _]} = object.data

	json(conn, %{url: href})
	end
	end

	def update_background(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
	with new_info <- %{"background" => %{}},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Ecto.Changeset.change(user) \|> Ecto.Changeset.put_embed(:info, info_cng),
	{:ok, _user} <- User.update_and_set_cache(changeset) do
	json(conn, %{url: nil})
	end
	end

	def update_background(%{assigns: %{user: user}} = conn, params) do
	with {:ok, object} <- ActivityPub.upload(params, type: :background),
	new_info <- %{"background" => object.data},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Ecto.Changeset.change(user) \|> Ecto.Changeset.put_embed(:info, info_cng),
	{:ok, _user} <- User.update_and_set_cache(changeset) do
	%{"url" => [%{"href" => href} \| _]} = object.data

	json(conn, %{url: href})
	end
	end

	def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	chat_token = Phoenix.Token.sign(conn, "user socket", user.id)

	account =
	AccountView.render("account.json", %{
	user: user,
	for: user,
	with_pleroma_settings: true,
	with_chat_token: chat_token
	})

	json(conn, account)
	end

	def verify_app_credentials(%{assigns: %{user: _user, token: token}} = conn, _) do
	with %Token{app: %App{} = app} <- Repo.preload(token, :app) do
	conn
	\|> put_view(AppView)
	\|> render("short.json", %{app: app})
	end
	end

	def user(%{assigns: %{user: for_user}} = conn, %{"id" => nickname_or_id}) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id),
	true <- User.auth_active?(user) \|\| user.id == for_user.id \|\| User.superuser?(for_user) do
	account = AccountView.render("account.json", %{user: user, for: for_user})
	json(conn, account)
	else
	_e -> render_error(conn, :not_found, "Can't find user")
	end
	end

	@mastodon_api_level "2.7.2"

	def masto_instance(conn, _params) do
	instance = Config.get(:instance)

	response = %{
	uri: Web.base_url(),
	title: Keyword.get(instance, :name),
	description: Keyword.get(instance, :description),
	version: "#{@mastodon_api_level} (compatible; #{Pleroma.Application.named_version()})",
	email: Keyword.get(instance, :email),
	urls: %{
	streaming_api: Pleroma.Web.Endpoint.websocket_url()
	},
	stats: Stats.get_stats(),
	thumbnail: Web.base_url() <> "/instance/thumbnail.jpeg",
	languages: ["en"],
	registrations: Pleroma.Config.get([:instance, :registrations_open]),
	# Extra (not present in Mastodon):
	max_toot_chars: Keyword.get(instance, :limit),
	poll_limits: Keyword.get(instance, :poll_limits)
	}

	json(conn, response)
	end

	def peers(conn, _params) do
	json(conn, Stats.get_peers())
	end

	defp mastodonized_emoji do
	Pleroma.Emoji.get_all()
	\|> Enum.map(fn {shortcode, relative_url, tags} ->
	url = to_string(URI.merge(Web.base_url(), relative_url))

	%{
	"shortcode" => shortcode,
	"static_url" => url,
	"visible_in_picker" => true,
	"url" => url,
	"tags" => tags,
	# Assuming that a comma is authorized in the category name
	"category" => (tags -- ["Custom"]) \|> Enum.join(",")
	}
	end)
	end

	def custom_emojis(conn, _params) do
	mastodon_emoji = mastodonized_emoji()
	json(conn, mastodon_emoji)
	end

	defp add_link_headers(conn, method, activities, param \\ nil, params \\ %{}) do
	params =
	conn.params
	\|> Map.drop(["since_id", "max_id", "min_id"])
	\|> Map.merge(params)

	last = List.last(activities)

	if last do
	max_id = last.id

	limit =
	params
	\|> Map.get("limit", "20")
	\|> String.to_integer()

	min_id =
	if length(activities) <= limit do
	activities
	\|> List.first()
	\|> Map.get(:id)
	else
	activities
	\|> Enum.at(limit * -1)
	\|> Map.get(:id)
	end

	{next_url, prev_url} =
	if param do
	{
	mastodon_api_url(
	Pleroma.Web.Endpoint,
	method,
	param,
	Map.merge(params, %{max_id: max_id})
	),
	mastodon_api_url(
	Pleroma.Web.Endpoint,
	method,
	param,
	Map.merge(params, %{min_id: min_id})
	)
	}
	else
	{
	mastodon_api_url(
	Pleroma.Web.Endpoint,
	method,
	Map.merge(params, %{max_id: max_id})
	),
	mastodon_api_url(
	Pleroma.Web.Endpoint,
	method,
	Map.merge(params, %{min_id: min_id})
	)
	}
	end

	conn
	\|> put_resp_header("link", "<#{next_url}>; rel=\"next\", <#{prev_url}>; rel=\"prev\"")
	else
	conn
	end
	end

	def home_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", ["Create", "Announce"])
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("user", user)

	activities =
	[user.ap_id \| user.following]
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:home_timeline, activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def public_timeline(%{assigns: %{user: user}} = conn, params) do
	local_only = params["local"] in [true, "True", "true", "1"]

	activities =
	params
	\|> Map.put("type", ["Create", "Announce"])
	\|> Map.put("local_only", local_only)
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> ActivityPub.fetch_public_activities()
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:public_timeline, activities, false, %{"local" => local_only})
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def user_statuses(%{assigns: %{user: reading_user}} = conn, params) do
	with %User{} = user <- User.get_cached_by_id(params["id"]) do
	params =
	params
	\|> Map.put("tag", params["tagged"])

	activities = ActivityPub.fetch_user_activities(user, reading_user, params)

	conn
	\|> add_link_headers(:user_statuses, activities, params["id"])
	\|> put_view(StatusView)
	\|> render("index.json", %{
	activities: activities,
	for: reading_user,
	as: :activity
	})
	end
	end

	def dm_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("blocking_user", user)
	\|> Map.put("user", user)
	\|> Map.put(:visibility, "direct")

	activities =
	[user.ap_id]
	\|> ActivityPub.fetch_activities_query(params)
	\|> Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(:dm_timeline, activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def get_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user})
	end
	end

	def get_context(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	activities <-
	ActivityPub.fetch_activities_for_context(activity.data["context"], %{
	"blocking_user" => user,
	"user" => user
	}),
	activities <-
	activities \|> Enum.filter(fn %{id: aid} -> to_string(aid) != to_string(id) end),
	activities <-
	activities \|> Enum.filter(fn %{data: %{"type" => type}} -> type == "Create" end),
	grouped_activities <- Enum.group_by(activities, fn %{id: id} -> id < activity.id end) do
	result = %{
	ancestors:
	StatusView.render(
	"index.json",
	for: user,
	activities: grouped_activities[true] \|\| [],
	as: :activity
	)
	\|> Enum.reverse(),
	# credo:disable-for-previous-line Credo.Check.Refactor.PipeChainStart
	descendants:
	StatusView.render(
	"index.json",
	for: user,
	activities: grouped_activities[false] \|\| [],
	as: :activity
	)
	\|> Enum.reverse()
	# credo:disable-for-previous-line Credo.Check.Refactor.PipeChainStart
	}

	json(conn, result)
	end
	end

	def get_poll(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Object{} = object <- Object.get_by_id(id),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
	true <- Visibility.visible_for_user?(activity, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("poll.json", %{object: object, for: user})
	else
	nil -> render_error(conn, :not_found, "Record not found")
	false -> render_error(conn, :not_found, "Record not found")
	end
	end

	defp get_cached_vote_or_vote(user, object, choices) do
	idempotency_key = "polls:#{user.id}:#{object.data["id"]}"

	{_, res} =
	Cachex.fetch(:idempotency_cache, idempotency_key, fn _ ->
	case CommonAPI.vote(user, object, choices) do
	{:error, _message} = res -> {:ignore, res}
	res -> {:commit, res}
	end
	end)

	res
	end

	def poll_vote(%{assigns: %{user: user}} = conn, %{"id" => id, "choices" => choices}) do
	with %Object{} = object <- Object.get_by_id(id),
	true <- object.data["type"] == "Question",
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _activities, object} <- get_cached_vote_or_vote(user, object, choices) do
	conn
	\|> put_view(StatusView)
	\|> try_render("poll.json", %{object: object, for: user})
	else
	nil ->
	render_error(conn, :not_found, "Record not found")

	false ->
	render_error(conn, :not_found, "Record not found")

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	def scheduled_statuses(%{assigns: %{user: user}} = conn, params) do
	with scheduled_activities <- MastodonAPI.get_scheduled_activities(user, params) do
	conn
	\|> add_link_headers(:scheduled_statuses, scheduled_activities)
	\|> put_view(ScheduledActivityView)
	\|> render("index.json", %{scheduled_activities: scheduled_activities})
	end
	end

	def show_scheduled_status(%{assigns: %{user: user}} = conn, %{"id" => scheduled_activity_id}) do
	with %ScheduledActivity{} = scheduled_activity <-
	ScheduledActivity.get(user, scheduled_activity_id) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", %{scheduled_activity: scheduled_activity})
	else
	_ -> {:error, :not_found}
	end
	end

	def update_scheduled_status(
	%{assigns: %{user: user}} = conn,
	%{"id" => scheduled_activity_id} = params
	) do
	with %ScheduledActivity{} = scheduled_activity <-
	ScheduledActivity.get(user, scheduled_activity_id),
	{:ok, scheduled_activity} <- ScheduledActivity.update(scheduled_activity, params) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", %{scheduled_activity: scheduled_activity})
	else
	nil -> {:error, :not_found}
	error -> error
	end
	end

	def delete_scheduled_status(%{assigns: %{user: user}} = conn, %{"id" => scheduled_activity_id}) do
	with %ScheduledActivity{} = scheduled_activity <-
	ScheduledActivity.get(user, scheduled_activity_id),
	{:ok, scheduled_activity} <- ScheduledActivity.delete(scheduled_activity) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", %{scheduled_activity: scheduled_activity})
	else
	nil -> {:error, :not_found}
	error -> error
	end
	end

	def post_status(%{assigns: %{user: user}} = conn, %{"status" => _} = params) do
	params =
	params
	\|> Map.put("in_reply_to_status_id", params["in_reply_to_id"])

	scheduled_at = params["scheduled_at"]

	if scheduled_at && ScheduledActivity.far_enough?(scheduled_at) do
	with {:ok, scheduled_activity} <-
	ScheduledActivity.create(user, %{"params" => params, "scheduled_at" => scheduled_at}) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", %{scheduled_activity: scheduled_activity})
	end
	else
	params = Map.drop(params, ["scheduled_at"])

	case CommonAPI.post(user, params) do
	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:ok, activity} ->
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end
	end

	def delete_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	json(conn, %{})
	else
	_e -> render_error(conn, :forbidden, "Can't delete this post")
	end
	end

	def reblog_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, announce, _activity} <- CommonAPI.repeat(ap_id_or_id, user),
	%Activity{} = announce <- Activity.normalize(announce.data) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: announce, for: user, as: :activity})
	end
	end

	def unreblog_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, _unannounce, %{data: %{"id" => id}}} <- CommonAPI.unrepeat(ap_id_or_id, user),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id_with_object(id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def fav_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, _fav, %{data: %{"id" => id}}} <- CommonAPI.favorite(ap_id_or_id, user),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def unfav_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, _, _, %{data: %{"id" => id}}} <- CommonAPI.unfavorite(ap_id_or_id, user),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def pin_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	else
	{:error, reason} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{"error" => reason})
	end
	end

	def unpin_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def bookmark_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.create(user.id, activity.id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def unbookmark_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.destroy(user.id, activity.id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def mute_conversation(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	activity = Activity.get_by_id(id)

	with {:ok, activity} <- CommonAPI.add_mute(user, activity) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	else
	{:error, reason} ->
	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(:bad_request, Jason.encode!(%{"error" => reason}))
	end
	end

	def unmute_conversation(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	activity = Activity.get_by_id(id)

	with {:ok, activity} <- CommonAPI.remove_mute(user, activity) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def notifications(%{assigns: %{user: user}} = conn, params) do
	notifications = MastodonAPI.get_notifications(user, params)

	conn
	\|> add_link_headers(:notifications, notifications)
	\|> put_view(NotificationView)
	\|> render("index.json", %{notifications: notifications, for: user})
	end

	def get_notification(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	with {:ok, notification} <- Notification.get(user, id) do
	conn
	\|> put_view(NotificationView)
	\|> render("show.json", %{notification: notification, for: user})
	else
	{:error, reason} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{"error" => reason})
	end
	end

	def clear_notifications(%{assigns: %{user: user}} = conn, _params) do
	Notification.clear(user)
	json(conn, %{})
	end

	def dismiss_notification(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	with {:ok, _notif} <- Notification.dismiss(user, id) do
	json(conn, %{})
	else
	{:error, reason} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{"error" => reason})
	end
	end

	def destroy_multiple(%{assigns: %{user: user}} = conn, %{"ids" => ids} = _params) do
	Notification.destroy_multiple(user, ids)
	json(conn, %{})
	end

	def relationships(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	id = List.wrap(id)
	q = from(u in User, where: u.id in ^id)
	targets = Repo.all(q)

	conn
	\|> put_view(AccountView)
	\|> render("relationships.json", %{user: user, targets: targets})
	end

	# Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])

	def update_media(%{assigns: %{user: user}} = conn, data) do
	with %Object{} = object <- Repo.get(Object, data["id"]),
	true <- Object.authorize_mutation(object, user),
	true <- is_binary(data["description"]),
	description <- data["description"] do
	new_data = %{object.data \| "name" => description}

	{:ok, _} =
	object
	\|> Object.change(%{data: new_data})
	\|> Repo.update()

	attachment_data = Map.put(new_data, "id", object.id)

	conn
	\|> put_view(StatusView)
	\|> render("attachment.json", %{attachment: attachment_data})
	end
	end

	def upload(%{assigns: %{user: user}} = conn, %{"file" => file} = data) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, "description")
	) do
	attachment_data = Map.put(object.data, "id", object.id)

	conn
	\|> put_view(StatusView)
	\|> render("attachment.json", %{attachment: attachment_data})
	end
	end

	def set_mascot(%{assigns: %{user: user}} = conn, %{"file" => file}) do
	with {:ok, object} <- ActivityPub.upload(file, actor: User.ap_id(user)),
	%{} = attachment_data <- Map.put(object.data, "id", object.id),
	%{type: type} = rendered <-
	StatusView.render("attachment.json", %{attachment: attachment_data}) do
	# Reject if not an image
	if type == "image" do
	# Sure!
	# Save to the user's info
	info_changeset = User.Info.mascot_update(user.info, rendered)

	user_changeset =
	user
	\|> Ecto.Changeset.change()
	\|> Ecto.Changeset.put_embed(:info, info_changeset)

	{:ok, _user} = User.update_and_set_cache(user_changeset)

	conn
	\|> json(rendered)
	else
	render_error(conn, :unsupported_media_type, "mascots can only be images")
	end
	end
	end

	def get_mascot(%{assigns: %{user: user}} = conn, _params) do
	mascot = User.get_mascot(user)

	conn
	\|> json(mascot)
	end

	def favourited_by(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{data: %{"object" => object}} <- Repo.get(Activity, id),
	%Object{data: %{"likes" => likes}} <- Object.normalize(object) do
	q = from(u in User, where: u.ap_id in ^likes)
	users = Repo.all(q)

	conn
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: user, users: users, as: :user})
	else
	_ -> json(conn, [])
	end
	end

	def reblogged_by(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{data: %{"object" => object}} <- Repo.get(Activity, id),
	%Object{data: %{"announcements" => announces}} <- Object.normalize(object) do
	q = from(u in User, where: u.ap_id in ^announces)
	users = Repo.all(q)

	conn
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: user, users: users, as: :user})
	else
	_ -> json(conn, [])
	end
	end

	def hashtag_timeline(%{assigns: %{user: user}} = conn, params) do
	local_only = params["local"] in [true, "True", "true", "1"]

	tags =
	[params["tag"], params["any"]]
	\|> List.flatten()
	\|> Enum.uniq()
	\|> Enum.filter(& &1)
	\|> Enum.map(&String.downcase(&1))

	tag_all =
	params["all"] \|\|
	[]
	\|> Enum.map(&String.downcase(&1))

	tag_reject =
	params["none"] \|\|
	[]
	\|> Enum.map(&String.downcase(&1))

	activities =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("local_only", local_only)
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("tag", tags)
	\|> Map.put("tag_all", tag_all)
	\|> Map.put("tag_reject", tag_reject)
	\|> ActivityPub.fetch_public_activities()
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:hashtag_timeline, activities, params["tag"], %{"local" => local_only})
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"id" => id} = params) do
	with %User{} = user <- User.get_cached_by_id(id),
	followers <- MastodonAPI.get_followers(user, params) do
	followers =
	cond do
	for_user && user.id == for_user.id -> followers
	user.info.hide_followers -> []
	true -> followers
	end

	conn
	\|> add_link_headers(:followers, followers, user)
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: for_user, users: followers, as: :user})
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"id" => id} = params) do
	with %User{} = user <- User.get_cached_by_id(id),
	followers <- MastodonAPI.get_friends(user, params) do
	followers =
	cond do
	for_user && user.id == for_user.id -> followers
	user.info.hide_follows -> []
	true -> followers
	end

	conn
	\|> add_link_headers(:following, followers, user)
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: for_user, users: followers, as: :user})
	end
	end

	def follow_requests(%{assigns: %{user: followed}} = conn, _params) do
	with {:ok, follow_requests} <- User.get_follow_requests(followed) do
	conn
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: followed, users: follow_requests, as: :user})
	end
	end

	def authorize_follow_request(%{assigns: %{user: followed}} = conn, %{"id" => id}) do
	with %User{} = follower <- User.get_cached_by_id(id),
	{:ok, follower} <- CommonAPI.accept_follow_request(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: followed, target: follower})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def reject_follow_request(%{assigns: %{user: followed}} = conn, %{"id" => id}) do
	with %User{} = follower <- User.get_cached_by_id(id),
	{:ok, follower} <- CommonAPI.reject_follow_request(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: followed, target: follower})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def follow(%{assigns: %{user: follower}} = conn, %{"id" => id}) do
	with {_, %User{} = followed} <- {:followed, User.get_cached_by_id(id)},
	{_, true} <- {:followed, follower.id != followed.id},
	{:ok, follower} <- MastodonAPI.follow(follower, followed, conn.params) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: follower, target: followed})
	else
	{:followed, _} ->
	{:error, :not_found}

	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def follow(%{assigns: %{user: follower}} = conn, %{"uri" => uri}) do
	with {_, %User{} = followed} <- {:followed, User.get_cached_by_nickname(uri)},
	{_, true} <- {:followed, follower.id != followed.id},
	{:ok, follower, followed, _} <- CommonAPI.follow(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("account.json", %{user: followed, for: follower})
	else
	{:followed, _} ->
	{:error, :not_found}

	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def unfollow(%{assigns: %{user: follower}} = conn, %{"id" => id}) do
	with {_, %User{} = followed} <- {:followed, User.get_cached_by_id(id)},
	{_, true} <- {:followed, follower.id != followed.id},
	{:ok, follower} <- CommonAPI.unfollow(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: follower, target: followed})
	else
	{:followed, _} ->
	{:error, :not_found}

	error ->
	error
	end
	end

	def mute(%{assigns: %{user: muter}} = conn, %{"id" => id}) do
	with %User{} = muted <- User.get_cached_by_id(id),
	{:ok, muter} <- User.mute(muter, muted) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: muter, target: muted})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def unmute(%{assigns: %{user: muter}} = conn, %{"id" => id}) do
	with %User{} = muted <- User.get_cached_by_id(id),
	{:ok, muter} <- User.unmute(muter, muted) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: muter, target: muted})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def mutes(%{assigns: %{user: user}} = conn, _) do
	with muted_accounts <- User.muted_users(user) do
	res = AccountView.render("accounts.json", users: muted_accounts, for: user, as: :user)
	json(conn, res)
	end
	end

	def block(%{assigns: %{user: blocker}} = conn, %{"id" => id}) do
	with %User{} = blocked <- User.get_cached_by_id(id),
	{:ok, blocker} <- User.block(blocker, blocked),
	{:ok, _activity} <- ActivityPub.block(blocker, blocked) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: blocker, target: blocked})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def unblock(%{assigns: %{user: blocker}} = conn, %{"id" => id}) do
	with %User{} = blocked <- User.get_cached_by_id(id),
	{:ok, blocker} <- User.unblock(blocker, blocked),
	{:ok, _activity} <- ActivityPub.unblock(blocker, blocked) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: blocker, target: blocked})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def blocks(%{assigns: %{user: user}} = conn, _) do
	with blocked_accounts <- User.blocked_users(user) do
	res = AccountView.render("accounts.json", users: blocked_accounts, for: user, as: :user)
	json(conn, res)
	end
	end

	def domain_blocks(%{assigns: %{user: %{info: info}}} = conn, _) do
	json(conn, info.domain_blocks \|\| [])
	end

	def block_domain(%{assigns: %{user: blocker}} = conn, %{"domain" => domain}) do
	User.block_domain(blocker, domain)
	json(conn, %{})
	end

	def unblock_domain(%{assigns: %{user: blocker}} = conn, %{"domain" => domain}) do
	User.unblock_domain(blocker, domain)
	json(conn, %{})
	end

	def subscribe(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %User{} = subscription_target <- User.get_cached_by_id(id),
	{:ok, subscription_target} = User.subscribe(user, subscription_target) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: user, target: subscription_target})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def unsubscribe(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %User{} = subscription_target <- User.get_cached_by_id(id),
	{:ok, subscription_target} = User.unsubscribe(user, subscription_target) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: user, target: subscription_target})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def favourites(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("favorited_by", user.ap_id)
	\|> Map.put("blocking_user", user)

	activities =
	ActivityPub.fetch_activities([], params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:favourites, activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def user_favourites(%{assigns: %{user: for_user}} = conn, %{"id" => id} = params) do
	with %User{} = user <- User.get_by_id(id),
	false <- user.info.hide_favorites do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("favorited_by", user.ap_id)
	\|> Map.put("blocking_user", for_user)

	recipients =
	if for_user do
	["https://www.w3.org/ns/activitystreams#Public"] ++
	[for_user.ap_id \| for_user.following]
	else
	["https://www.w3.org/ns/activitystreams#Public"]
	end

	activities =
	recipients
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:favourites, activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: for_user, as: :activity})
	else
	nil -> {:error, :not_found}
	true -> render_error(conn, :forbidden, "Can't get favorites")
	end
	end

	def bookmarks(%{assigns: %{user: user}} = conn, params) do
	user = User.get_cached_by_id(user.id)

	bookmarks =
	Bookmark.for_user_query(user.id)
	\|> Pagination.fetch_paginated(params)

	activities =
	bookmarks
	\|> Enum.map(fn b -> Map.put(b.activity, :bookmark, Map.delete(b, :activity)) end)

	conn
	\|> add_link_headers(:bookmarks, bookmarks)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def get_lists(%{assigns: %{user: user}} = conn, opts) do
	lists = Pleroma.List.for_user(user, opts)
	res = ListView.render("lists.json", lists: lists)
	json(conn, res)
	end

	def get_list(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Pleroma.List{} = list <- Pleroma.List.get(id, user) do
	res = ListView.render("list.json", list: list)
	json(conn, res)
	else
	_e -> render_error(conn, :not_found, "Record not found")
	end
	end

	def account_lists(%{assigns: %{user: user}} = conn, %{"id" => account_id}) do
	lists = Pleroma.List.get_lists_account_belongs(user, account_id)
	res = ListView.render("lists.json", lists: lists)
	json(conn, res)
	end

	def delete_list(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Pleroma.List{} = list <- Pleroma.List.get(id, user),
	{:ok, _list} <- Pleroma.List.delete(list) do
	json(conn, %{})
	else
	_e ->
	json(conn, dgettext("errors", "error"))
	end
	end

	def create_list(%{assigns: %{user: user}} = conn, %{"title" => title}) do
	with {:ok, %Pleroma.List{} = list} <- Pleroma.List.create(title, user) do
	res = ListView.render("list.json", list: list)
	json(conn, res)
	end
	end

	def add_to_list(%{assigns: %{user: user}} = conn, %{"id" => id, "account_ids" => accounts}) do
	accounts
	\|> Enum.each(fn account_id ->
	with %Pleroma.List{} = list <- Pleroma.List.get(id, user),
	%User{} = followed <- User.get_cached_by_id(account_id) do
	Pleroma.List.follow(list, followed)
	end
	end)

	json(conn, %{})
	end

	def remove_from_list(%{assigns: %{user: user}} = conn, %{"id" => id, "account_ids" => accounts}) do
	accounts
	\|> Enum.each(fn account_id ->
	with %Pleroma.List{} = list <- Pleroma.List.get(id, user),
	%User{} = followed <- User.get_cached_by_id(account_id) do
	Pleroma.List.unfollow(list, followed)
	end
	end)

	json(conn, %{})
	end

	def list_accounts(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Pleroma.List{} = list <- Pleroma.List.get(id, user),
	{:ok, users} = Pleroma.List.get_following(list) do
	conn
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: user, users: users, as: :user})
	end
	end

	def rename_list(%{assigns: %{user: user}} = conn, %{"id" => id, "title" => title}) do
	with %Pleroma.List{} = list <- Pleroma.List.get(id, user),
	{:ok, list} <- Pleroma.List.rename(list, title) do
	res = ListView.render("list.json", list: list)
	json(conn, res)
	else
	_e ->
	json(conn, dgettext("errors", "error"))
	end
	end

	def list_timeline(%{assigns: %{user: user}} = conn, %{"list_id" => id} = params) do
	with %Pleroma.List{title: _title, following: following} <- Pleroma.List.get(id, user) do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)

	# we must filter the following list for the user to avoid leaking statuses the user
	# does not actually have permission to see (for more info, peruse security issue #270).
	activities =
	following
	\|> Enum.filter(fn x -> x in user.following end)
	\|> ActivityPub.fetch_activities_bounded(following, params)
	\|> Enum.reverse()

	conn
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	else
	_e -> render_error(conn, :forbidden, "Error.")
	end
	end

	def index(%{assigns: %{user: user}} = conn, _params) do
	token = get_session(conn, :oauth_token)

	if user && token do
	mastodon_emoji = mastodonized_emoji()

	limit = Config.get([:instance, :limit])

	accounts =
	Map.put(%{}, user.id, AccountView.render("account.json", %{user: user, for: user}))

	initial_state =
	%{
	meta: %{
	streaming_api_base_url: Pleroma.Web.Endpoint.websocket_url(),
	access_token: token,
	locale: "en",
	domain: Pleroma.Web.Endpoint.host(),
	admin: "1",
	me: "#{user.id}",
	unfollow_modal: false,
	boost_modal: false,
	delete_modal: true,
	auto_play_gif: false,
	display_sensitive_media: false,
	reduce_motion: false,
	max_toot_chars: limit,
	mascot: User.get_mascot(user)["url"]
	},
	poll_limits: Config.get([:instance, :poll_limits]),
	rights: %{
	delete_others_notice: present?(user.info.is_moderator),
	admin: present?(user.info.is_admin)
	},
	compose: %{
	me: "#{user.id}",
	default_privacy: user.info.default_scope,
	default_sensitive: false,
	allow_content_types: Config.get([:instance, :allowed_post_formats])
	},
	media_attachments: %{
	accept_content_types: [
	".jpg",
	".jpeg",
	".png",
	".gif",
	".webm",
	".mp4",
	".m4v",
	"image\/jpeg",
	"image\/png",
	"image\/gif",
	"video\/webm",
	"video\/mp4"
	]
	},
	settings:
	user.info.settings \|\|
	%{
	onboarded: true,
	home: %{
	shows: %{
	reblog: true,
	reply: true
	}
	},
	notifications: %{
	alerts: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	},
	shows: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	},
	sounds: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	}
	}
	},
	push_subscription: nil,
	accounts: accounts,
	custom_emojis: mastodon_emoji,
	char_limit: limit
	}
	\|> Jason.encode!()

	conn
	\|> put_layout(false)
	\|> put_view(MastodonView)
	\|> render("index.html", %{initial_state: initial_state})
	else
	conn
	\|> put_session(:return_to, conn.request_path)
	\|> redirect(to: "/web/login")
	end
	end

	def put_settings(%{assigns: %{user: user}} = conn, %{"data" => settings} = _params) do
	info_cng = User.Info.mastodon_settings_update(user.info, settings)

	with changeset <- Ecto.Changeset.change(user),
	changeset <- Ecto.Changeset.put_embed(changeset, :info, info_cng),
	{:ok, _user} <- User.update_and_set_cache(changeset) do
	json(conn, %{})
	else
	e ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: inspect(e)})
	end
	end

	def login(%{assigns: %{user: %User{}}} = conn, _params) do
	redirect(conn, to: local_mastodon_root_path(conn))
	end

	@doc "Local Mastodon FE login init action"
	def login(conn, %{"code" => auth_token}) do
	with {:ok, app} <- get_or_make_app(),
	%Authorization{} = auth <- Repo.get_by(Authorization, token: auth_token, app_id: app.id),
	{:ok, token} <- Token.exchange_token(app, auth) do
	conn
	\|> put_session(:oauth_token, token.token)
	\|> redirect(to: local_mastodon_root_path(conn))
	end
	end

	@doc "Local Mastodon FE callback action"
	def login(conn, _) do
	with {:ok, app} <- get_or_make_app() do
	path =
	o_auth_path(
	conn,
	:authorize,
	response_type: "code",
	client_id: app.client_id,
	redirect_uri: ".",
	scope: Enum.join(app.scopes, " ")
	)

	redirect(conn, to: path)
	end
	end

	defp local_mastodon_root_path(conn) do
	case get_session(conn, :return_to) do
	nil ->
	mastodon_api_path(conn, :index, ["getting-started"])

	return_to ->
	delete_session(conn, :return_to)
	return_to
	end
	end

	defp get_or_make_app do
	find_attrs = %{client_name: @local_mastodon_name, redirect_uris: "."}
	scopes = ["read", "write", "follow", "push"]

	with %App{} = app <- Repo.get_by(App, find_attrs) do
	{:ok, app} =
	if app.scopes == scopes do
	{:ok, app}
	else
	app
	\|> Ecto.Changeset.change(%{scopes: scopes})
	\|> Repo.update()
	end

	{:ok, app}
	else
	_e ->
	cs =
	App.register_changeset(
	%App{},
	Map.put(find_attrs, :scopes, scopes)
	)

	Repo.insert(cs)
	end
	end

	def logout(conn, _) do
	conn
	\|> clear_session
	\|> redirect(to: "/")
	end

	def relationship_noop(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	Logger.debug("Unimplemented, returning unmodified relationship")

	with %User{} = target <- User.get_cached_by_id(id) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: user, target: target})
	end
	end

	def empty_array(conn, _) do
	Logger.debug("Unimplemented, returning an empty array")
	json(conn, [])
	end

	def empty_object(conn, _) do
	Logger.debug("Unimplemented, returning an empty object")
	json(conn, %{})
	end

	def get_filters(%{assigns: %{user: user}} = conn, _) do
	filters = Filter.get_filters(user)
	res = FilterView.render("filters.json", filters: filters)
	json(conn, res)
	end

	def create_filter(
	%{assigns: %{user: user}} = conn,
	%{"phrase" => phrase, "context" => context} = params
	) do
	query = %Filter{
	user_id: user.id,
	phrase: phrase,
	context: context,
	hide: Map.get(params, "irreversible", false),
	whole_word: Map.get(params, "boolean", true)
	# expires_at
	}

	{:ok, response} = Filter.create(query)
	res = FilterView.render("filter.json", filter: response)
	json(conn, res)
	end

	def get_filter(%{assigns: %{user: user}} = conn, %{"id" => filter_id}) do
	filter = Filter.get(filter_id, user)
	res = FilterView.render("filter.json", filter: filter)
	json(conn, res)
	end

	def update_filter(
	%{assigns: %{user: user}} = conn,
	%{"phrase" => phrase, "context" => context, "id" => filter_id} = params
	) do
	query = %Filter{
	user_id: user.id,
	filter_id: filter_id,
	phrase: phrase,
	context: context,
	hide: Map.get(params, "irreversible", nil),
	whole_word: Map.get(params, "boolean", true)
	# expires_at
	}

	{:ok, response} = Filter.update(query)
	res = FilterView.render("filter.json", filter: response)
	json(conn, res)
	end

	def delete_filter(%{assigns: %{user: user}} = conn, %{"id" => filter_id}) do
	query = %Filter{
	user_id: user.id,
	filter_id: filter_id
	}

	{:ok, _} = Filter.delete(query)
	json(conn, %{})
	end

	# fallback action
	#
	def errors(conn, {:error, %Changeset{} = changeset}) do
	error_message =
	changeset
	\|> Changeset.traverse_errors(fn {message, _opt} -> message end)
	\|> Enum.map_join(", ", fn {_k, v} -> v end)

	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: error_message})
	end

	def errors(conn, {:error, :not_found}) do
	render_error(conn, :not_found, "Record not found")
	end

	def errors(conn, _) do
	conn
	\|> put_status(:internal_server_error)
	\|> json(dgettext("errors", "Something went wrong"))
	end

	def suggestions(%{assigns: %{user: user}} = conn, _) do
	suggestions = Config.get(:suggestions)

	if Keyword.get(suggestions, :enabled, false) do
	api = Keyword.get(suggestions, :third_party_engine, "")
	timeout = Keyword.get(suggestions, :timeout, 5000)
	limit = Keyword.get(suggestions, :limit, 23)

	host = Config.get([Pleroma.Web.Endpoint, :url, :host])

	user = user.nickname

	url =
	api
	\|> String.replace("{{host}}", host)
	\|> String.replace("{{user}}", user)

	with {:ok, %{status: 200, body: body}} <-
	HTTP.get(
	url,
	[],
	adapter: [
	recv_timeout: timeout,
	pool: :default
	]
	),
	{:ok, data} <- Jason.decode(body) do
	data =
	data
	\|> Enum.slice(0, limit)
	\|> Enum.map(fn x ->
	Map.put(
	x,
	"id",
	case User.get_or_fetch(x["acct"]) do
	{:ok, %User{id: id}} -> id
	_ -> 0
	end
	)
	end)
	\|> Enum.map(fn x ->
	Map.put(x, "avatar", MediaProxy.url(x["avatar"]))
	end)
	\|> Enum.map(fn x ->
	Map.put(x, "avatar_static", MediaProxy.url(x["avatar_static"]))
	end)

	conn
	\|> json(data)
	else
	e -> Logger.error("Could not retrieve suggestions at fetch #{url}, #{inspect(e)}")
	end
	else
	json(conn, [])
	end
	end

	def status_card(%{assigns: %{user: user}} = conn, %{"id" => status_id}) do
	with %Activity{} = activity <- Activity.get_by_id(status_id),
	true <- Visibility.visible_for_user?(activity, user) do
	data =
	StatusView.render(
	"card.json",
	Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
	)

	json(conn, data)
	else
	_e ->
	%{}
	end
	end

	def reports(%{assigns: %{user: user}} = conn, params) do
	case CommonAPI.report(user, params) do
	{:ok, activity} ->
	conn
	\|> put_view(ReportView)
	\|> try_render("report.json", %{activity: activity})

	{:error, err} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: err})
	end
	end

	def account_register(
	%{assigns: %{app: app}} = conn,
	%{"username" => nickname, "email" => _, "password" => _, "agreement" => true} = params
	) do
	params =
	params
	\|> Map.take([
	"email",
	"captcha_solution",
	"captcha_token",
	"captcha_answer_data",
	"token",
	"password"
	])
	\|> Map.put("nickname", nickname)
	\|> Map.put("fullname", params["fullname"] \|\| nickname)
	\|> Map.put("bio", params["bio"] \|\| "")
	\|> Map.put("confirm", params["password"])

	with {:ok, user} <- TwitterAPI.register_user(params, need_confirmation: true),
	{:ok, token} <- Token.create_token(app, user, %{scopes: app.scopes}) do
	json(conn, %{
	token_type: "Bearer",
	access_token: token.token,
	scope: app.scopes,
	created_at: Token.Utils.format_created_at(token)
	})
	else
	{:error, errors} ->
	conn
	\|> put_status(:bad_request)
	\|> json(errors)
	end
	end

	def account_register(%{assigns: %{app: _app}} = conn, _params) do
	render_error(conn, :bad_request, "Missing parameters")
	end

	def account_register(conn, _) do
	render_error(conn, :forbidden, "Invalid credentials")
	end

	def conversations(%{assigns: %{user: user}} = conn, params) do
	participations = Participation.for_user_with_last_activity_id(user, params)

	conversations =
	Enum.map(participations, fn participation ->
	ConversationView.render("participation.json", %{participation: participation, user: user})
	end)

	conn
	\|> add_link_headers(:conversations, participations)
	\|> json(conversations)
	end

	def conversation_read(%{assigns: %{user: user}} = conn, %{"id" => participation_id}) do
	with %Participation{} = participation <-
	Repo.get_by(Participation, id: participation_id, user_id: user.id),
	{:ok, participation} <- Participation.mark_as_read(participation) do
	participation_view =
	ConversationView.render("participation.json", %{participation: participation, user: user})

	conn
	\|> json(participation_view)
	end
	end

	def try_render(conn, target, params)
	when is_binary(target) do
	case render(conn, target, params) do
	nil -> render_error(conn, :not_implemented, "Can't display this activity")
	res -> res
	end
	end

	def try_render(conn, _, _) do
	render_error(conn, :not_implemented, "Can't display this activity")
	end

	defp present?(nil), do: false
	defp present?(false), do: false
	defp present?(_), do: true
	end
	diff --git a/lib/pleroma/web/media_proxy/controller.ex b/lib/pleroma/web/media_proxy/controller.ex
	index c0552d89f..ea33d7685 100644
	--- a/lib/pleroma/web/media_proxy/controller.ex
	+++ b/lib/pleroma/web/media_proxy/controller.ex
	@@ -1,44 +1,39 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MediaProxy.MediaProxyController do
	use Pleroma.Web, :controller
	alias Pleroma.ReverseProxy
	alias Pleroma.Web.MediaProxy

	@default_proxy_opts [max_body_length: 25 * 1_048_576, http: [follow_redirect: true]]

	def remote(conn, %{"sig" => sig64, "url" => url64} = params) do
	with config <- Pleroma.Config.get([:media_proxy], []),
	true <- Keyword.get(config, :enabled, false),
	{:ok, url} <- MediaProxy.decode_url(sig64, url64),
	:ok <- filename_matches(Map.has_key?(params, "filename"), conn.request_path, url) do
	ReverseProxy.call(conn, url, Keyword.get(config, :proxy_opts, @default_proxy_opts))
	else
	false ->
	send_resp(conn, 404, Plug.Conn.Status.reason_phrase(404))

	{:error, :invalid_signature} ->
	send_resp(conn, 403, Plug.Conn.Status.reason_phrase(403))

	{:wrong_filename, filename} ->
	redirect(conn, external: MediaProxy.build_url(sig64, url64, filename))
	end
	end

	def filename_matches(has_filename, path, url) do
	- filename =
	- url
	- \|> MediaProxy.filename()
	- \|> URI.decode()
	-
	- path = URI.decode(path)
	+ filename = url \|> MediaProxy.filename()

	if has_filename && filename && Path.basename(path) != filename do
	{:wrong_filename, filename}
	else
	:ok
	end
	end
	end
	diff --git a/lib/pleroma/web/metadata/opengraph.ex b/lib/pleroma/web/metadata/opengraph.ex
	index 4033ec38f..e7fa7f408 100644
	--- a/lib/pleroma/web/metadata/opengraph.ex
	+++ b/lib/pleroma/web/metadata/opengraph.ex
	@@ -1,126 +1,119 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Metadata.Providers.OpenGraph do
	alias Pleroma.User
	alias Pleroma.Web.Metadata
	alias Pleroma.Web.Metadata.Providers.Provider
	alias Pleroma.Web.Metadata.Utils

	@behaviour Provider
	+ @media_types ["image", "audio", "video"]

	@impl Provider
	def build_tags(%{
	object: object,
	url: url,
	user: user
	}) do
	attachments = build_attachments(object)
	scrubbed_content = Utils.scrub_html_and_truncate(object)
	# Zero width space
	content =
	if scrubbed_content != "" and scrubbed_content != "\u200B" do
	": “" <> scrubbed_content <> "”"
	else
	""
	end

	# Most previews only show og:title which is inconvenient. Instagram
	# hacks this by putting the description in the title and making the
	# description longer prefixed by how many likes and shares the post
	# has. Here we use the descriptive nickname in the title, and expand
	# the full account & nickname in the description. We also use the cute^Wevil
	# smart quotes around the status text like Instagram, too.
	[
	{:meta,
	[
	property: "og:title",
	content: "#{user.name}" <> content
	], []},
	{:meta, [property: "og:url", content: url], []},
	{:meta,
	[
	property: "og:description",
	content: "#{Utils.user_name_string(user)}" <> content
	], []},
	{:meta, [property: "og:type", content: "website"], []}
	] ++
	if attachments == [] or Metadata.activity_nsfw?(object) do
	[
	{:meta, [property: "og:image", content: Utils.attachment_url(User.avatar_url(user))],
	[]},
	{:meta, [property: "og:image:width", content: 150], []},
	{:meta, [property: "og:image:height", content: 150], []}
	]
	else
	attachments
	end
	end

	@impl Provider
	def build_tags(%{user: user}) do
	with truncated_bio = Utils.scrub_html_and_truncate(user.bio \|\| "") do
	[
	{:meta,
	[
	property: "og:title",
	content: Utils.user_name_string(user)
	], []},
	{:meta, [property: "og:url", content: User.profile_url(user)], []},
	{:meta, [property: "og:description", content: truncated_bio], []},
	{:meta, [property: "og:type", content: "website"], []},
	{:meta, [property: "og:image", content: Utils.attachment_url(User.avatar_url(user))], []},
	{:meta, [property: "og:image:width", content: 150], []},
	{:meta, [property: "og:image:height", content: 150], []}
	]
	end
	end

	defp build_attachments(%{data: %{"attachment" => attachments}}) do
	Enum.reduce(attachments, [], fn attachment, acc ->
	rendered_tags =
	Enum.reduce(attachment["url"], [], fn url, acc ->
	- media_type =
	- Enum.find(["image", "audio", "video"], fn media_type ->
	- String.starts_with?(url["mediaType"], media_type)
	- end)
	-
	# TODO: Add additional properties to objects when we have the data available.
	# Also, Whatsapp only wants JPEG or PNGs. It seems that if we add a second og:image
	# object when a Video or GIF is attached it will display that in Whatsapp Rich Preview.
	- case media_type do
	+ case Utils.fetch_media_type(@media_types, url["mediaType"]) do
	"audio" ->
	[
	- {:meta,
	- [property: "og:" <> media_type, content: Utils.attachment_url(url["href"])], []}
	+ {:meta, [property: "og:audio", content: Utils.attachment_url(url["href"])], []}
	\| acc
	]

	"image" ->
	[
	- {:meta,
	- [property: "og:" <> media_type, content: Utils.attachment_url(url["href"])], []},
	+ {:meta, [property: "og:image", content: Utils.attachment_url(url["href"])], []},
	{:meta, [property: "og:image:width", content: 150], []},
	{:meta, [property: "og:image:height", content: 150], []}
	\| acc
	]

	"video" ->
	[
	- {:meta,
	- [property: "og:" <> media_type, content: Utils.attachment_url(url["href"])], []}
	+ {:meta, [property: "og:video", content: Utils.attachment_url(url["href"])], []}
	\| acc
	]

	_ ->
	acc
	end
	end)

	acc ++ rendered_tags
	end)
	end

	defp build_attachments(_), do: []
	end
	diff --git a/lib/pleroma/web/metadata/twitter_card.ex b/lib/pleroma/web/metadata/twitter_card.ex
	index 8dd01e0d5..d6a6049b3 100644
	--- a/lib/pleroma/web/metadata/twitter_card.ex
	+++ b/lib/pleroma/web/metadata/twitter_card.ex
	@@ -1,125 +1,112 @@
	# Pleroma: A lightweight social networking server
	+
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Metadata.Providers.TwitterCard do
	alias Pleroma.User
	alias Pleroma.Web.Metadata
	alias Pleroma.Web.Metadata.Providers.Provider
	alias Pleroma.Web.Metadata.Utils

	@behaviour Provider
	+ @media_types ["image", "audio", "video"]

	@impl Provider
	- def build_tags(%{
	- activity_id: id,
	- object: object,
	- user: user
	- }) do
	+ def build_tags(%{activity_id: id, object: object, user: user}) do
	attachments = build_attachments(id, object)
	scrubbed_content = Utils.scrub_html_and_truncate(object)
	# Zero width space
	content =
	if scrubbed_content != "" and scrubbed_content != "\u200B" do
	"“" <> scrubbed_content <> "”"
	else
	""
	end

	[
	- {:meta,
	- [
	- property: "twitter:title",
	- content: Utils.user_name_string(user)
	- ], []},
	- {:meta,
	- [
	- property: "twitter:description",
	- content: content
	- ], []}
	+ title_tag(user),
	+ {:meta, [property: "twitter:description", content: content], []}
	] ++
	if attachments == [] or Metadata.activity_nsfw?(object) do
	[
	- {:meta,
	- [property: "twitter:image", content: Utils.attachment_url(User.avatar_url(user))], []},
	+ image_tag(user),
	{:meta, [property: "twitter:card", content: "summary_large_image"], []}
	]
	else
	attachments
	end
	end

	@impl Provider
	def build_tags(%{user: user}) do
	with truncated_bio = Utils.scrub_html_and_truncate(user.bio \|\| "") do
	[
	- {:meta,
	- [
	- property: "twitter:title",
	- content: Utils.user_name_string(user)
	- ], []},
	+ title_tag(user),
	{:meta, [property: "twitter:description", content: truncated_bio], []},
	- {:meta, [property: "twitter:image", content: Utils.attachment_url(User.avatar_url(user))],
	- []},
	+ image_tag(user),
	{:meta, [property: "twitter:card", content: "summary"], []}
	]
	end
	end

	+ defp title_tag(user) do
	+ {:meta, [property: "twitter:title", content: Utils.user_name_string(user)], []}
	+ end
	+
	+ def image_tag(user) do
	+ {:meta, [property: "twitter:image", content: Utils.attachment_url(User.avatar_url(user))], []}
	+ end
	+
	defp build_attachments(id, %{data: %{"attachment" => attachments}}) do
	Enum.reduce(attachments, [], fn attachment, acc ->
	rendered_tags =
	Enum.reduce(attachment["url"], [], fn url, acc ->
	- media_type =
	- Enum.find(["image", "audio", "video"], fn media_type ->
	- String.starts_with?(url["mediaType"], media_type)
	- end)
	-
	# TODO: Add additional properties to objects when we have the data available.
	- case media_type do
	+ case Utils.fetch_media_type(@media_types, url["mediaType"]) do
	"audio" ->
	[
	{:meta, [property: "twitter:card", content: "player"], []},
	{:meta, [property: "twitter:player:width", content: "480"], []},
	{:meta, [property: "twitter:player:height", content: "80"], []},
	{:meta, [property: "twitter:player", content: player_url(id)], []}
	\| acc
	]

	"image" ->
	[
	{:meta, [property: "twitter:card", content: "summary_large_image"], []},
	{:meta,
	[
	property: "twitter:player",
	content: Utils.attachment_url(url["href"])
	], []}
	\| acc
	]

	# TODO: Need the true width and height values here or Twitter renders an iFrame with
	# a bad aspect ratio
	"video" ->
	[
	{:meta, [property: "twitter:card", content: "player"], []},
	{:meta, [property: "twitter:player", content: player_url(id)], []},
	{:meta, [property: "twitter:player:width", content: "480"], []},
	{:meta, [property: "twitter:player:height", content: "480"], []}
	\| acc
	]

	_ ->
	acc
	end
	end)

	acc ++ rendered_tags
	end)
	end

	defp build_attachments(_id, _object), do: []

	defp player_url(id) do
	Pleroma.Web.Router.Helpers.o_status_url(Pleroma.Web.Endpoint, :notice_player, id)
	end
	end
	diff --git a/lib/pleroma/web/metadata/utils.ex b/lib/pleroma/web/metadata/utils.ex
	index 58385a3d1..720bd4519 100644
	--- a/lib/pleroma/web/metadata/utils.ex
	+++ b/lib/pleroma/web/metadata/utils.ex
	@@ -1,42 +1,49 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Metadata.Utils do
	alias Pleroma.Formatter
	alias Pleroma.HTML
	alias Pleroma.Web.MediaProxy

	def scrub_html_and_truncate(%{data: %{"content" => content}} = object) do
	content
	# html content comes from DB already encoded, decode first and scrub after
	\|> HtmlEntities.decode()
	\|> String.replace(~r/<br\s?\/?>/, " ")
	\|> HTML.get_cached_stripped_html_for_activity(object, "metadata")
	\|> Formatter.demojify()
	\|> Formatter.truncate()
	end

	def scrub_html_and_truncate(content, max_length \\ 200) when is_binary(content) do
	content
	# html content comes from DB already encoded, decode first and scrub after
	\|> HtmlEntities.decode()
	\|> String.replace(~r/<br\s?\/?>/, " ")
	\|> HTML.strip_tags()
	\|> Formatter.demojify()
	\|> Formatter.truncate(max_length)
	end

	def attachment_url(url) do
	MediaProxy.url(url)
	end

	def user_name_string(user) do
	"#{user.name} " <>
	if user.local do
	"(@#{user.nickname}@#{Pleroma.Web.Endpoint.host()})"
	else
	"(@#{user.nickname})"
	end
	end
	+
	+ @spec fetch_media_type(list(String.t()), String.t()) :: String.t() \| nil
	+ def fetch_media_type(supported_types, media_type) do
	+ Enum.find(supported_types, fn support_type ->
	+ String.starts_with?(media_type, support_type)
	+ end)
	+ end
	end
	diff --git a/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex b/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
	index cd9a4f4a8..a1d7fcc7d 100644
	--- a/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
	+++ b/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
	@@ -1,206 +1,210 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Nodeinfo.NodeinfoController do
	use Pleroma.Web, :controller

	alias Pleroma.Config
	alias Pleroma.Stats
	alias Pleroma.User
	alias Pleroma.Web
	alias Pleroma.Web.ActivityPub.MRF
	alias Pleroma.Web.Federator.Publisher

	def schemas(conn, _params) do
	response = %{
	links: [
	%{
	rel: "http://nodeinfo.diaspora.software/ns/schema/2.0",
	href: Web.base_url() <> "/nodeinfo/2.0.json"
	},
	%{
	rel: "http://nodeinfo.diaspora.software/ns/schema/2.1",
	href: Web.base_url() <> "/nodeinfo/2.1.json"
	}
	]
	}

	json(conn, response)
	end

	# returns a nodeinfo 2.0 map, since 2.1 just adds a repository field
	# under software.
	def raw_nodeinfo do
	stats = Stats.get_stats()

	+ exclusions = Config.get([:instance, :mrf_transparency_exclusions])
	+
	mrf_simple =
	Config.get(:mrf_simple)
	+ \|> Enum.map(fn {k, v} -> {k, Enum.reject(v, fn v -> v in exclusions end)} end)
	\|> Enum.into(%{})

	# This horror is needed to convert regex sigils to strings
	mrf_keyword =
	Config.get(:mrf_keyword, [])
	\|> Enum.map(fn {key, value} ->
	{key,
	Enum.map(value, fn
	{pattern, replacement} ->
	%{
	"pattern" =>
	if not is_binary(pattern) do
	inspect(pattern)
	else
	pattern
	end,
	"replacement" => replacement
	}

	pattern ->
	if not is_binary(pattern) do
	inspect(pattern)
	else
	pattern
	end
	end)}
	end)
	\|> Enum.into(%{})

	mrf_policies =
	MRF.get_policies()
	\|> Enum.map(fn policy -> to_string(policy) \|> String.split(".") \|> List.last() end)

	quarantined = Config.get([:instance, :quarantined_instances], [])

	staff_accounts =
	User.all_superusers()
	\|> Enum.map(fn u -> u.ap_id end)

	mrf_user_allowlist =
	Config.get([:mrf_user_allowlist], [])
	\|> Enum.into(%{}, fn {k, v} -> {k, length(v)} end)

	federation_response =
	if Config.get([:instance, :mrf_transparency]) do
	%{
	mrf_policies: mrf_policies,
	mrf_simple: mrf_simple,
	mrf_keyword: mrf_keyword,
	mrf_user_allowlist: mrf_user_allowlist,
	- quarantined_instances: quarantined
	+ quarantined_instances: quarantined,
	+ exclusions: length(exclusions) > 0
	}
	else
	%{}
	end

	features =
	[
	"pleroma_api",
	"mastodon_api",
	"mastodon_api_streaming",
	"polls",
	"pleroma_explicit_addressing",
	if Config.get([:media_proxy, :enabled]) do
	"media_proxy"
	end,
	if Config.get([:gopher, :enabled]) do
	"gopher"
	end,
	if Config.get([:chat, :enabled]) do
	"chat"
	end,
	if Config.get([:suggestions, :enabled]) do
	"suggestions"
	end,
	if Config.get([:instance, :allow_relay]) do
	"relay"
	end,
	if Config.get([:instance, :safe_dm_mentions]) do
	"safe_dm_mentions"
	end
	]
	\|> Enum.filter(& &1)

	%{
	version: "2.0",
	software: %{
	name: Pleroma.Application.name() \|> String.downcase(),
	version: Pleroma.Application.version()
	},
	protocols: Publisher.gather_nodeinfo_protocol_names(),
	services: %{
	inbound: [],
	outbound: []
	},
	openRegistrations: Config.get([:instance, :registrations_open]),
	usage: %{
	users: %{
	total: stats.user_count \|\| 0
	},
	localPosts: stats.status_count \|\| 0
	},
	metadata: %{
	nodeName: Config.get([:instance, :name]),
	nodeDescription: Config.get([:instance, :description]),
	private: !Config.get([:instance, :public], true),
	suggestions: %{
	enabled: Config.get([:suggestions, :enabled], false),
	thirdPartyEngine: Config.get([:suggestions, :third_party_engine], ""),
	timeout: Config.get([:suggestions, :timeout], 5000),
	limit: Config.get([:suggestions, :limit], 23),
	web: Config.get([:suggestions, :web], "")
	},
	staffAccounts: staff_accounts,
	federation: federation_response,
	pollLimits: Config.get([:instance, :poll_limits]),
	postFormats: Config.get([:instance, :allowed_post_formats]),
	uploadLimits: %{
	general: Config.get([:instance, :upload_limit]),
	avatar: Config.get([:instance, :avatar_upload_limit]),
	banner: Config.get([:instance, :banner_upload_limit]),
	background: Config.get([:instance, :background_upload_limit])
	},
	accountActivationRequired: Config.get([:instance, :account_activation_required], false),
	invitesEnabled: Config.get([:instance, :invites_enabled], false),
	features: features,
	restrictedNicknames: Config.get([Pleroma.User, :restricted_nicknames]),
	skipThreadContainment: Config.get([:instance, :skip_thread_containment], false)
	}
	}
	end

	# Schema definition: https://github.com/jhass/nodeinfo/blob/master/schemas/2.0/schema.json
	# and https://github.com/jhass/nodeinfo/blob/master/schemas/2.1/schema.json
	def nodeinfo(conn, %{"version" => "2.0"}) do
	conn
	\|> put_resp_header(
	"content-type",
	"application/json; profile=http://nodeinfo.diaspora.software/ns/schema/2.0#; charset=utf-8"
	)
	\|> json(raw_nodeinfo())
	end

	def nodeinfo(conn, %{"version" => "2.1"}) do
	raw_response = raw_nodeinfo()

	updated_software =
	raw_response
	\|> Map.get(:software)
	\|> Map.put(:repository, Pleroma.Application.repository())

	response =
	raw_response
	\|> Map.put(:software, updated_software)
	\|> Map.put(:version, "2.1")

	conn
	\|> put_resp_header(
	"content-type",
	"application/json; profile=http://nodeinfo.diaspora.software/ns/schema/2.1#; charset=utf-8"
	)
	\|> json(response)
	end

	def nodeinfo(conn, _) do
	render_error(conn, :not_found, "Nodeinfo schema version not handled")
	end
	end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 9315302c8..d1bbebc7d 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,793 +1,797 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router

	pipeline :browser do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	end

	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	end

	pipeline :api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :authenticated_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :admin_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.AdminSecretAuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.UserIsAdminPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :mastodon_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :pleroma_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :oauth_read_or_public do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{
	scopes: ["read"],
	fallback: :proceed_unauthenticated
	})

	plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)
	end

	pipeline :oauth_read do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["read"]})
	end

	pipeline :oauth_write do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["write"]})
	end

	pipeline :oauth_follow do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["follow"]})
	end

	pipeline :oauth_push do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["push"]})
	end

	pipeline :well_known do
	plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", PasswordController, :reset, as: :reset_password)
	post("/password_reset", PasswordController, :do_reset, as: :reset_password)
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	get("/healthcheck", UtilController, :healthcheck)
	end

	scope "/api/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	scope "/api/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through([:admin_api, :oauth_write])

	post("/users/follow", AdminAPIController, :user_follow)
	post("/users/unfollow", AdminAPIController, :user_unfollow)

	# TODO: to be removed at version 1.0
	delete("/user", AdminAPIController, :user_delete)
	post("/user", AdminAPIController, :user_create)

	delete("/users", AdminAPIController, :user_delete)
	post("/users", AdminAPIController, :user_create)
	patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)

	# TODO: to be removed at version 1.0
	get("/permission_group/:nickname", AdminAPIController, :right_get)
	get("/permission_group/:nickname/:permission_group", AdminAPIController, :right_get)
	post("/permission_group/:nickname/:permission_group", AdminAPIController, :right_add)
	delete("/permission_group/:nickname/:permission_group", AdminAPIController, :right_delete)

	get("/users/:nickname/permission_group", AdminAPIController, :right_get)
	get("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_get)
	post("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_add)

	delete(
	"/users/:nickname/permission_group/:permission_group",
	AdminAPIController,
	:right_delete
	)

	put("/users/:nickname/activation_status", AdminAPIController, :set_activation_status)

	post("/relay", AdminAPIController, :relay_follow)
	delete("/relay", AdminAPIController, :relay_unfollow)

	get("/users/invite_token", AdminAPIController, :get_invite_token)
	get("/users/invites", AdminAPIController, :invites)
	post("/users/revoke_invite", AdminAPIController, :revoke_invite)
	post("/users/email_invite", AdminAPIController, :email_invite)

	# TODO: to be removed at version 1.0
	get("/password_reset", AdminAPIController, :get_password_reset)

	get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)

	get("/users", AdminAPIController, :list_users)
	get("/users/:nickname", AdminAPIController, :user_show)
	get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)

	get("/reports", AdminAPIController, :list_reports)
	get("/reports/:id", AdminAPIController, :report_show)
	put("/reports/:id", AdminAPIController, :report_update_state)
	post("/reports/:id/respond", AdminAPIController, :report_respond)

	put("/statuses/:id", AdminAPIController, :status_update)
	delete("/statuses/:id", AdminAPIController, :status_delete)

	get("/config", AdminAPIController, :config_show)
	post("/config", AdminAPIController, :config_update)
	end

	scope "/", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_html)

	post("/main/ostatus", UtilController, :remote_subscribe)
	get("/ostatus_subscribe", UtilController, :remote_follow)

	scope [] do
	pipe_through(:oauth_follow)
	post("/ostatus_subscribe", UtilController, :do_remote_follow)
	end
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:authenticated_api)

	scope [] do
	pipe_through(:oauth_write)

	post("/change_password", UtilController, :change_password)
	post("/delete_account", UtilController, :delete_account)
	put("/notification_settings", UtilController, :update_notificaton_settings)
	post("/disable_account", UtilController, :disable_account)
	end

	scope [] do
	pipe_through(:oauth_follow)

	post("/blocks_import", UtilController, :blocks_import)
	post("/follow_import", UtilController, :follow_import)
	end

	scope [] do
	pipe_through(:oauth_read)

	post("/notifications/read", UtilController, :notifications_read)
	end
	end

	scope "/oauth", Pleroma.Web.OAuth do
	scope [] do
	pipe_through(:oauth)
	get("/authorize", OAuthController, :authorize)
	end

	post("/authorize", OAuthController, :create_authorization)
	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	get("/registration_details", OAuthController, :registration_details)

	scope [] do
	pipe_through(:browser)

	get("/prepare_request", OAuthController, :prepare_request)
	get("/:provider", OAuthController, :request)
	get("/:provider/callback", OAuthController, :callback)
	post("/register", OAuthController, :register)
	end
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	scope [] do
	pipe_through(:oauth_read)

	get("/accounts/verify_credentials", MastodonAPIController, :verify_credentials)

	get("/accounts/relationships", MastodonAPIController, :relationships)

	get("/accounts/:id/lists", MastodonAPIController, :account_lists)
	get("/accounts/:id/identity_proofs", MastodonAPIController, :empty_array)

	get("/follow_requests", MastodonAPIController, :follow_requests)
	get("/blocks", MastodonAPIController, :blocks)
	get("/mutes", MastodonAPIController, :mutes)

	get("/timelines/home", MastodonAPIController, :home_timeline)
	get("/timelines/direct", MastodonAPIController, :dm_timeline)

	get("/favourites", MastodonAPIController, :favourites)
	get("/bookmarks", MastodonAPIController, :bookmarks)

	post("/notifications/clear", MastodonAPIController, :clear_notifications)
	post("/notifications/dismiss", MastodonAPIController, :dismiss_notification)
	get("/notifications", MastodonAPIController, :notifications)
	get("/notifications/:id", MastodonAPIController, :get_notification)
	delete("/notifications/destroy_multiple", MastodonAPIController, :destroy_multiple)

	get("/scheduled_statuses", MastodonAPIController, :scheduled_statuses)
	get("/scheduled_statuses/:id", MastodonAPIController, :show_scheduled_status)

	get("/lists", MastodonAPIController, :get_lists)
	get("/lists/:id", MastodonAPIController, :get_list)
	get("/lists/:id/accounts", MastodonAPIController, :list_accounts)

	get("/domain_blocks", MastodonAPIController, :domain_blocks)

	get("/filters", MastodonAPIController, :get_filters)

	get("/suggestions", MastodonAPIController, :suggestions)

	get("/conversations", MastodonAPIController, :conversations)
	post("/conversations/:id/read", MastodonAPIController, :conversation_read)

	get("/endorsements", MastodonAPIController, :empty_array)
	end

	scope [] do
	pipe_through(:oauth_write)

	patch("/accounts/update_credentials", MastodonAPIController, :update_credentials)

	- patch("/accounts/update_avatar", MastodonAPIController, :update_avatar)
	- patch("/accounts/update_banner", MastodonAPIController, :update_banner)
	- patch("/accounts/update_background", MastodonAPIController, :update_background)
	-
	post("/statuses", MastodonAPIController, :post_status)
	delete("/statuses/:id", MastodonAPIController, :delete_status)

	post("/statuses/:id/reblog", MastodonAPIController, :reblog_status)
	post("/statuses/:id/unreblog", MastodonAPIController, :unreblog_status)
	post("/statuses/:id/favourite", MastodonAPIController, :fav_status)
	post("/statuses/:id/unfavourite", MastodonAPIController, :unfav_status)
	post("/statuses/:id/pin", MastodonAPIController, :pin_status)
	post("/statuses/:id/unpin", MastodonAPIController, :unpin_status)
	post("/statuses/:id/bookmark", MastodonAPIController, :bookmark_status)
	post("/statuses/:id/unbookmark", MastodonAPIController, :unbookmark_status)
	post("/statuses/:id/mute", MastodonAPIController, :mute_conversation)
	post("/statuses/:id/unmute", MastodonAPIController, :unmute_conversation)

	put("/scheduled_statuses/:id", MastodonAPIController, :update_scheduled_status)
	delete("/scheduled_statuses/:id", MastodonAPIController, :delete_scheduled_status)

	post("/polls/:id/votes", MastodonAPIController, :poll_vote)

	post("/media", MastodonAPIController, :upload)
	put("/media/:id", MastodonAPIController, :update_media)

	delete("/lists/:id", MastodonAPIController, :delete_list)
	post("/lists", MastodonAPIController, :create_list)
	put("/lists/:id", MastodonAPIController, :rename_list)

	post("/lists/:id/accounts", MastodonAPIController, :add_to_list)
	delete("/lists/:id/accounts", MastodonAPIController, :remove_from_list)

	post("/filters", MastodonAPIController, :create_filter)
	get("/filters/:id", MastodonAPIController, :get_filter)
	put("/filters/:id", MastodonAPIController, :update_filter)
	delete("/filters/:id", MastodonAPIController, :delete_filter)

	+ patch("/pleroma/accounts/update_avatar", MastodonAPIController, :update_avatar)
	+ patch("/pleroma/accounts/update_banner", MastodonAPIController, :update_banner)
	+ patch("/pleroma/accounts/update_background", MastodonAPIController, :update_background)
	+
	get("/pleroma/mascot", MastodonAPIController, :get_mascot)
	put("/pleroma/mascot", MastodonAPIController, :set_mascot)

	post("/reports", MastodonAPIController, :reports)
	end

	scope [] do
	pipe_through(:oauth_follow)

	post("/follows", MastodonAPIController, :follow)
	post("/accounts/:id/follow", MastodonAPIController, :follow)

	post("/accounts/:id/unfollow", MastodonAPIController, :unfollow)
	post("/accounts/:id/block", MastodonAPIController, :block)
	post("/accounts/:id/unblock", MastodonAPIController, :unblock)
	post("/accounts/:id/mute", MastodonAPIController, :mute)
	post("/accounts/:id/unmute", MastodonAPIController, :unmute)

	post("/follow_requests/:id/authorize", MastodonAPIController, :authorize_follow_request)
	post("/follow_requests/:id/reject", MastodonAPIController, :reject_follow_request)

	post("/domain_blocks", MastodonAPIController, :block_domain)
	delete("/domain_blocks", MastodonAPIController, :unblock_domain)

	post("/pleroma/accounts/:id/subscribe", MastodonAPIController, :subscribe)
	post("/pleroma/accounts/:id/unsubscribe", MastodonAPIController, :unsubscribe)
	end

	scope [] do
	pipe_through(:oauth_push)

	post("/push/subscription", SubscriptionController, :create)
	get("/push/subscription", SubscriptionController, :get)
	put("/push/subscription", SubscriptionController, :update)
	delete("/push/subscription", SubscriptionController, :delete)
	end
	end

	scope "/api/web", Pleroma.Web.MastodonAPI do
	pipe_through([:authenticated_api, :oauth_write])

	put("/settings", MastodonAPIController, :put_settings)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	post("/accounts", MastodonAPIController, :account_register)

	get("/instance", MastodonAPIController, :masto_instance)
	get("/instance/peers", MastodonAPIController, :peers)
	post("/apps", MastodonAPIController, :create_app)
	get("/apps/verify_credentials", MastodonAPIController, :verify_app_credentials)
	get("/custom_emojis", MastodonAPIController, :custom_emojis)

	get("/statuses/:id/card", MastodonAPIController, :status_card)

	get("/statuses/:id/favourited_by", MastodonAPIController, :favourited_by)
	get("/statuses/:id/reblogged_by", MastodonAPIController, :reblogged_by)

	get("/trends", MastodonAPIController, :empty_array)

	get("/accounts/search", SearchController, :account_search)

	scope [] do
	pipe_through(:oauth_read_or_public)

	get("/timelines/public", MastodonAPIController, :public_timeline)
	get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline)
	get("/timelines/list/:list_id", MastodonAPIController, :list_timeline)

	get("/statuses/:id", MastodonAPIController, :get_status)
	get("/statuses/:id/context", MastodonAPIController, :get_context)

	get("/polls/:id", MastodonAPIController, :get_poll)

	get("/accounts/:id/statuses", MastodonAPIController, :user_statuses)
	get("/accounts/:id/followers", MastodonAPIController, :followers)
	get("/accounts/:id/following", MastodonAPIController, :following)
	get("/accounts/:id", MastodonAPIController, :user)

	get("/search", SearchController, :search)

	get("/pleroma/accounts/:id/favourites", MastodonAPIController, :user_favourites)
	end
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	pipe_through([:api, :oauth_read_or_public])
	get("/search", SearchController, :search2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	get("/help/test", TwitterAPI.UtilController, :help_test)
	post("/help/test", TwitterAPI.UtilController, :help_test)
	get("/statusnet/config", TwitterAPI.UtilController, :config)
	get("/statusnet/version", TwitterAPI.UtilController, :version)
	get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	post("/account/register", TwitterAPI.Controller, :register)
	post("/account/password_reset", TwitterAPI.Controller, :password_reset)

	post("/account/resend_confirmation_email", TwitterAPI.Controller, :resend_confirmation_email)

	get(
	"/account/confirm_email/:user_id/:token",
	TwitterAPI.Controller,
	:confirm_email,
	as: :confirm_email
	)

	scope [] do
	pipe_through(:oauth_read_or_public)

	get("/statuses/user_timeline", TwitterAPI.Controller, :user_timeline)
	get("/qvitter/statuses/user_timeline", TwitterAPI.Controller, :user_timeline)
	get("/users/show", TwitterAPI.Controller, :show_user)

	get("/statuses/followers", TwitterAPI.Controller, :followers)
	get("/statuses/friends", TwitterAPI.Controller, :friends)
	get("/statuses/blocks", TwitterAPI.Controller, :blocks)
	get("/statuses/show/:id", TwitterAPI.Controller, :fetch_status)
	get("/statusnet/conversation/:id", TwitterAPI.Controller, :fetch_conversation)

	get("/search", TwitterAPI.Controller, :search)
	get("/statusnet/tags/timeline/:tag", TwitterAPI.Controller, :public_and_external_timeline)
	end
	end

	scope "/api", Pleroma.Web do
	pipe_through([:api, :oauth_read_or_public])

	get("/statuses/public_timeline", TwitterAPI.Controller, :public_timeline)

	get(
	"/statuses/public_and_external_timeline",
	TwitterAPI.Controller,
	:public_and_external_timeline
	)

	get("/statuses/networkpublic_timeline", TwitterAPI.Controller, :public_and_external_timeline)
	end

	scope "/api", Pleroma.Web, as: :twitter_api_search do
	pipe_through([:api, :oauth_read_or_public])
	get("/pleroma/search_user", TwitterAPI.Controller, :search_user)
	end

	scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	pipe_through(:authenticated_api)

	get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)

	scope [] do
	pipe_through(:oauth_read)

	get("/account/verify_credentials", TwitterAPI.Controller, :verify_credentials)
	post("/account/verify_credentials", TwitterAPI.Controller, :verify_credentials)

	get("/statuses/home_timeline", TwitterAPI.Controller, :friends_timeline)
	get("/statuses/friends_timeline", TwitterAPI.Controller, :friends_timeline)
	get("/statuses/mentions", TwitterAPI.Controller, :mentions_timeline)
	get("/statuses/mentions_timeline", TwitterAPI.Controller, :mentions_timeline)
	get("/statuses/dm_timeline", TwitterAPI.Controller, :dm_timeline)
	get("/qvitter/statuses/notifications", TwitterAPI.Controller, :notifications)

	get("/pleroma/friend_requests", TwitterAPI.Controller, :friend_requests)

	get("/friends/ids", TwitterAPI.Controller, :friends_ids)
	get("/friendships/no_retweets/ids", TwitterAPI.Controller, :empty_array)

	get("/mutes/users/ids", TwitterAPI.Controller, :empty_array)
	get("/qvitter/mutes", TwitterAPI.Controller, :raw_empty_array)

	get("/externalprofile/show", TwitterAPI.Controller, :external_profile)

	post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read)
	end

	scope [] do
	pipe_through(:oauth_write)

	post("/account/update_profile", TwitterAPI.Controller, :update_profile)
	post("/account/update_profile_banner", TwitterAPI.Controller, :update_banner)
	post("/qvitter/update_background_image", TwitterAPI.Controller, :update_background)

	post("/statuses/update", TwitterAPI.Controller, :status_update)
	post("/statuses/retweet/:id", TwitterAPI.Controller, :retweet)
	post("/statuses/unretweet/:id", TwitterAPI.Controller, :unretweet)
	post("/statuses/destroy/:id", TwitterAPI.Controller, :delete_post)

	post("/statuses/pin/:id", TwitterAPI.Controller, :pin)
	post("/statuses/unpin/:id", TwitterAPI.Controller, :unpin)

	post("/statusnet/media/upload", TwitterAPI.Controller, :upload)
	post("/media/upload", TwitterAPI.Controller, :upload_json)
	post("/media/metadata/create", TwitterAPI.Controller, :update_media)

	post("/favorites/create/:id", TwitterAPI.Controller, :favorite)
	post("/favorites/create", TwitterAPI.Controller, :favorite)
	post("/favorites/destroy/:id", TwitterAPI.Controller, :unfavorite)

	post("/qvitter/update_avatar", TwitterAPI.Controller, :update_avatar)
	end

	scope [] do
	pipe_through(:oauth_follow)

	post("/pleroma/friendships/approve", TwitterAPI.Controller, :approve_friend_request)
	post("/pleroma/friendships/deny", TwitterAPI.Controller, :deny_friend_request)

	post("/friendships/create", TwitterAPI.Controller, :follow)
	post("/friendships/destroy", TwitterAPI.Controller, :unfollow)

	post("/blocks/create", TwitterAPI.Controller, :block)
	post("/blocks/destroy", TwitterAPI.Controller, :unblock)
	end
	end

	pipeline :ap_relay do
	plug(:accepts, ["activity+json", "json"])
	end

	pipeline :ostatus do
	plug(:accepts, ["html", "xml", "atom", "activity+json", "json"])
	end

	pipeline :oembed do
	plug(:accepts, ["json", "xml"])
	end

	scope "/", Pleroma.Web do
	pipe_through(:ostatus)

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)
	get("/users/:nickname/feed", OStatus.OStatusController, :feed)
	get("/users/:nickname", OStatus.OStatusController, :feed_redirect)

	post("/users/:nickname/salmon", OStatus.OStatusController, :salmon_incoming)
	post("/push/hub/:nickname", Websub.WebsubController, :websub_subscription_request)
	get("/push/subscriptions/:id", Websub.WebsubController, :websub_subscription_confirmation)
	post("/push/subscriptions/:id", Websub.WebsubController, :websub_incoming)
	end

	pipeline :activitypub do
	plug(:accepts, ["activity+json", "json"])
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	# XXX: not really ostatus
	pipe_through(:ostatus)

	- get("/users/:nickname/followers", ActivityPubController, :followers)
	- get("/users/:nickname/following", ActivityPubController, :following)
	get("/users/:nickname/outbox", ActivityPubController, :outbox)
	get("/objects/:uuid/likes", ActivityPubController, :object_likes)
	end

	pipeline :activitypub_client do
	plug(:accepts, ["activity+json", "json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	scope [] do
	pipe_through(:oauth_read)
	get("/api/ap/whoami", ActivityPubController, :whoami)
	get("/users/:nickname/inbox", ActivityPubController, :read_inbox)
	end

	scope [] do
	pipe_through(:oauth_write)
	post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	end
	+
	+ scope [] do
	+ pipe_through(:oauth_read_or_public)
	+ get("/users/:nickname/followers", ActivityPubController, :followers)
	+ get("/users/:nickname/following", ActivityPubController, :following)
	+ end
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_relay)
	get("/", ActivityPubController, :relay)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through(:activitypub)
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web.MastodonAPI do
	pipe_through(:mastodon_html)

	get("/web/login", MastodonAPIController, :login)
	delete("/auth/sign_out", MastodonAPIController, :logout)

	scope [] do
	pipe_through(:oauth_read_or_public)
	get("/web/*path", MastodonAPIController, :index)
	end
	end

	pipeline :remote_media do
	end

	scope "/proxy/", Pleroma.Web.MediaProxy do
	pipe_through(:remote_media)

	get("/:sig/:url", MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxyController, :remote)
	end

	if Pleroma.Config.get(:env) == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	scope "/", Pleroma.Web.MongooseIM do
	get("/user_exists", MongooseIMController, :user_exists)
	get("/check_password", MongooseIMController, :check_password)
	end

	scope "/", Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	get("/api*path", RedirectController, :api_not_implemented)
	get("/*path", RedirectController, :redirector)

	options("/*path", RedirectController, :empty)
	end
	end

	defmodule Fallback.RedirectController do
	use Pleroma.Web, :controller
	require Logger
	alias Pleroma.User
	alias Pleroma.Web.Metadata

	def api_not_implemented(conn, _params) do
	conn
	\|> put_status(404)
	\|> json(%{error: "Not implemented"})
	end

	def redirector(conn, _params, code \\ 200) do
	conn
	\|> put_resp_content_type("text/html")
	\|> send_file(code, index_file_path())
	end

	def redirector_with_meta(conn, %{"maybe_nickname_or_id" => maybe_nickname_or_id} = params) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(maybe_nickname_or_id) do
	redirector_with_meta(conn, %{user: user})
	else
	nil ->
	redirector(conn, params)
	end
	end

	def redirector_with_meta(conn, params) do
	{:ok, index_content} = File.read(index_file_path())

	tags =
	try do
	Metadata.build_tags(params)
	rescue
	e ->
	Logger.error(
	"Metadata rendering for #{conn.request_path} failed.\n" <>
	Exception.format(:error, e, __STACKTRACE__)
	)

	""
	end

	response = String.replace(index_content, "<!--server-generated-meta-->", tags)

	conn
	\|> put_resp_content_type("text/html")
	\|> send_resp(200, response)
	end

	def index_file_path do
	Pleroma.Plugs.InstanceStatic.file_path("index.html")
	end

	def registration_page(conn, params) do
	redirector(conn, params)
	end

	def empty(conn, _params) do
	conn
	\|> put_status(204)
	\|> text("")
	end
	end
	diff --git a/test/media_proxy_test.exs b/test/media_proxy_test.exs
	index 1d6d170b7..fbf200931 100644
	--- a/test/media_proxy_test.exs
	+++ b/test/media_proxy_test.exs
	@@ -1,217 +1,209 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.MediaProxyTest do
	use ExUnit.Case
	import Pleroma.Web.MediaProxy
	alias Pleroma.Web.MediaProxy.MediaProxyController

	setup do
	enabled = Pleroma.Config.get([:media_proxy, :enabled])
	on_exit(fn -> Pleroma.Config.put([:media_proxy, :enabled], enabled) end)
	:ok
	end

	describe "when enabled" do
	setup do
	Pleroma.Config.put([:media_proxy, :enabled], true)
	:ok
	end

	test "ignores invalid url" do
	assert url(nil) == nil
	assert url("") == nil
	end

	test "ignores relative url" do
	assert url("/local") == "/local"
	assert url("/") == "/"
	end

	test "ignores local url" do
	local_url = Pleroma.Web.Endpoint.url() <> "/hello"
	local_root = Pleroma.Web.Endpoint.url()
	assert url(local_url) == local_url
	assert url(local_root) == local_root
	end

	test "encodes and decodes URL" do
	url = "https://pleroma.soykaf.com/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(
	encoded,
	Pleroma.Config.get([:media_proxy, :base_url], Pleroma.Web.base_url())
	)

	assert String.ends_with?(encoded, "/logo.png")

	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL without a path" do
	url = "https://pleroma.soykaf.com"
	encoded = url(url)
	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL without an extension" do
	url = "https://pleroma.soykaf.com/path/"
	encoded = url(url)
	assert String.ends_with?(encoded, "/path")
	assert decode_result(encoded) == url
	end

	test "encodes and decodes URL and ignores query params for the path" do
	url = "https://pleroma.soykaf.com/static/logo.png?93939393939&bunny=true"
	encoded = url(url)
	assert String.ends_with?(encoded, "/logo.png")
	assert decode_result(encoded) == url
	end

	test "validates signature" do
	secret_key_base = Pleroma.Config.get([Pleroma.Web.Endpoint, :secret_key_base])

	on_exit(fn ->
	Pleroma.Config.put([Pleroma.Web.Endpoint, :secret_key_base], secret_key_base)
	end)

	encoded = url("https://pleroma.social")

	Pleroma.Config.put(
	[Pleroma.Web.Endpoint, :secret_key_base],
	"00000000000000000000000000000000000000000000000"
	)

	[_, "proxy", sig, base64 \| _] = URI.parse(encoded).path \|> String.split("/")
	assert decode_url(sig, base64) == {:error, :invalid_signature}
	end

	- test "filename_matches matches url encoded paths" do
	+ test "filename_matches preserves the encoded or decoded path" do
	assert MediaProxyController.filename_matches(
	true,
	- "/Hello%20world.jpg",
	+ "/Hello world.jpg",
	"http://pleroma.social/Hello world.jpg"
	) == :ok

	assert MediaProxyController.filename_matches(
	true,
	"/Hello%20world.jpg",
	"http://pleroma.social/Hello%20world.jpg"
	) == :ok
	- end

	- test "filename_matches matches non-url encoded paths" do
	assert MediaProxyController.filename_matches(
	true,
	- "/Hello world.jpg",
	- "http://pleroma.social/Hello%20world.jpg"
	- ) == :ok
	-
	- assert MediaProxyController.filename_matches(
	- true,
	- "/Hello world.jpg",
	- "http://pleroma.social/Hello world.jpg"
	+ "/my%2Flong%2Furl%2F2019%2F07%2FS.jpg",
	+ "http://pleroma.social/my%2Flong%2Furl%2F2019%2F07%2FS.jpg"
	) == :ok
	end

	test "uses the configured base_url" do
	base_url = Pleroma.Config.get([:media_proxy, :base_url])

	if base_url do
	on_exit(fn ->
	Pleroma.Config.put([:media_proxy, :base_url], base_url)
	end)
	end

	Pleroma.Config.put([:media_proxy, :base_url], "https://cache.pleroma.social")

	url = "https://pleroma.soykaf.com/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(encoded, Pleroma.Config.get([:media_proxy, :base_url]))
	end

	# Some sites expect ASCII encoded characters in the URL to be preserved even if
	# unnecessary.
	# Issues: https://git.pleroma.social/pleroma/pleroma/issues/580
	# https://git.pleroma.social/pleroma/pleroma/issues/1055
	test "preserve ASCII encoding" do
	url =
	"https://pleroma.com/%20/%21/%22/%23/%24/%25/%26/%27/%28/%29/%2A/%2B/%2C/%2D/%2E/%2F/%30/%31/%32/%33/%34/%35/%36/%37/%38/%39/%3A/%3B/%3C/%3D/%3E/%3F/%40/%41/%42/%43/%44/%45/%46/%47/%48/%49/%4A/%4B/%4C/%4D/%4E/%4F/%50/%51/%52/%53/%54/%55/%56/%57/%58/%59/%5A/%5B/%5C/%5D/%5E/%5F/%60/%61/%62/%63/%64/%65/%66/%67/%68/%69/%6A/%6B/%6C/%6D/%6E/%6F/%70/%71/%72/%73/%74/%75/%76/%77/%78/%79/%7A/%7B/%7C/%7D/%7E/%7F/%80/%81/%82/%83/%84/%85/%86/%87/%88/%89/%8A/%8B/%8C/%8D/%8E/%8F/%90/%91/%92/%93/%94/%95/%96/%97/%98/%99/%9A/%9B/%9C/%9D/%9E/%9F/%C2%A0/%A1/%A2/%A3/%A4/%A5/%A6/%A7/%A8/%A9/%AA/%AB/%AC/%C2%AD/%AE/%AF/%B0/%B1/%B2/%B3/%B4/%B5/%B6/%B7/%B8/%B9/%BA/%BB/%BC/%BD/%BE/%BF/%C0/%C1/%C2/%C3/%C4/%C5/%C6/%C7/%C8/%C9/%CA/%CB/%CC/%CD/%CE/%CF/%D0/%D1/%D2/%D3/%D4/%D5/%D6/%D7/%D8/%D9/%DA/%DB/%DC/%DD/%DE/%DF/%E0/%E1/%E2/%E3/%E4/%E5/%E6/%E7/%E8/%E9/%EA/%EB/%EC/%ED/%EE/%EF/%F0/%F1/%F2/%F3/%F4/%F5/%F6/%F7/%F8/%F9/%FA/%FB/%FC/%FD/%FE/%FF"

	encoded = url(url)
	assert decode_result(encoded) == url
	end

	# This includes unsafe/reserved characters which are not interpreted as part of the URL
	# and would otherwise have to be ASCII encoded. It is our role to ensure the proxied URL
	# is unmodified, so we are testing these characters anyway.
	test "preserve non-unicode characters per RFC3986" do
	url =
	"https://pleroma.com/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890-._~:/?#[]@!$&'()*+,;=\|^`{}"

	encoded = url(url)
	assert decode_result(encoded) == url
	end

	test "preserve unicode characters" do
	url = "https://ko.wikipedia.org/wiki/위키백과:대문"

	encoded = url(url)
	assert decode_result(encoded) == url
	end

	test "does not change whitelisted urls" do
	upload_config = Pleroma.Config.get([Pleroma.Upload])
	media_url = "https://media.pleroma.social"
	Pleroma.Config.put([Pleroma.Upload, :base_url], media_url)
	Pleroma.Config.put([:media_proxy, :whitelist], ["media.pleroma.social"])
	Pleroma.Config.put([:media_proxy, :base_url], "https://cache.pleroma.social")

	url = "#{media_url}/static/logo.png"
	encoded = url(url)

	assert String.starts_with?(encoded, media_url)

	Pleroma.Config.put([Pleroma.Upload], upload_config)
	end
	end

	describe "when disabled" do
	setup do
	enabled = Pleroma.Config.get([:media_proxy, :enabled])

	if enabled do
	Pleroma.Config.put([:media_proxy, :enabled], false)

	on_exit(fn ->
	Pleroma.Config.put([:media_proxy, :enabled], enabled)
	:ok
	end)
	end

	:ok
	end

	test "does not encode remote urls" do
	assert url("https://google.fr") == "https://google.fr"
	end
	end

	defp decode_result(encoded) do
	[_, "proxy", sig, base64 \| _] = URI.parse(encoded).path \|> String.split("/")
	{:ok, decoded} = decode_url(sig, base64)
	decoded
	end

	test "mediaproxy whitelist" do
	Pleroma.Config.put([:media_proxy, :enabled], true)
	Pleroma.Config.put([:media_proxy, :whitelist], ["google.com", "feld.me"])
	url = "https://feld.me/foo.png"

	unencoded = url(url)
	assert unencoded == url
	end
	end
	diff --git a/test/plugs/rate_limiter_test.exs b/test/plugs/rate_limiter_test.exs
	index f8251b5c7..395095079 100644
	--- a/test/plugs/rate_limiter_test.exs
	+++ b/test/plugs/rate_limiter_test.exs
	@@ -1,112 +1,174 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Plugs.RateLimiterTest do
	use ExUnit.Case, async: true
	use Plug.Test

	alias Pleroma.Plugs.RateLimiter

	import Pleroma.Factory

	- @limiter_name :testing
	+ # Note: each example must work with separate buckets in order to prevent concurrency issues

	test "init/1" do
	- Pleroma.Config.put([:rate_limit, @limiter_name], {1, 1})
	+ limiter_name = :test_init
	+ Pleroma.Config.put([:rate_limit, limiter_name], {1, 1})

	- assert {@limiter_name, {1, 1}} == RateLimiter.init(@limiter_name)
	+ assert {limiter_name, {1, 1}, []} == RateLimiter.init(limiter_name)
	assert nil == RateLimiter.init(:foo)
	end

	test "ip/1" do
	assert "127.0.0.1" == RateLimiter.ip(%{remote_ip: {127, 0, 0, 1}})
	end

	test "it restricts by opts" do
	+ limiter_name = :test_opts
	scale = 1000
	limit = 5

	- Pleroma.Config.put([:rate_limit, @limiter_name], {scale, limit})
	+ Pleroma.Config.put([:rate_limit, limiter_name], {scale, limit})

	- opts = RateLimiter.init(@limiter_name)
	+ opts = RateLimiter.init(limiter_name)
	conn = conn(:get, "/")
	- bucket_name = "#{@limiter_name}:#{RateLimiter.ip(conn)}"
	+ bucket_name = "#{limiter_name}:#{RateLimiter.ip(conn)}"

	conn = RateLimiter.call(conn, opts)
	assert {1, 4, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)
	assert {2, 3, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)
	assert {3, 2, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)
	assert {4, 1, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)
	assert {5, 0, to_reset, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)

	assert %{"error" => "Throttled"} = Phoenix.ConnTest.json_response(conn, :too_many_requests)
	assert conn.halted

	Process.sleep(to_reset)

	conn = conn(:get, "/")

	conn = RateLimiter.call(conn, opts)
	assert {1, 4, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	refute conn.status == Plug.Conn.Status.code(:too_many_requests)
	refute conn.resp_body
	refute conn.halted
	end

	+ test "`bucket_name` option overrides default bucket name" do
	+ limiter_name = :test_bucket_name
	+ scale = 1000
	+ limit = 5
	+
	+ Pleroma.Config.put([:rate_limit, limiter_name], {scale, limit})
	+ base_bucket_name = "#{limiter_name}:group1"
	+ opts = RateLimiter.init({limiter_name, bucket_name: base_bucket_name})
	+
	+ conn = conn(:get, "/")
	+ default_bucket_name = "#{limiter_name}:#{RateLimiter.ip(conn)}"
	+ customized_bucket_name = "#{base_bucket_name}:#{RateLimiter.ip(conn)}"
	+
	+ RateLimiter.call(conn, opts)
	+ assert {1, 4, _, _, _} = ExRated.inspect_bucket(customized_bucket_name, scale, limit)
	+ assert {0, 5, _, _, _} = ExRated.inspect_bucket(default_bucket_name, scale, limit)
	+ end
	+
	+ test "`params` option appends specified params' values to bucket name" do
	+ limiter_name = :test_params
	+ scale = 1000
	+ limit = 5
	+
	+ Pleroma.Config.put([:rate_limit, limiter_name], {scale, limit})
	+ opts = RateLimiter.init({limiter_name, params: ["id"]})
	+ id = "1"
	+
	+ conn = conn(:get, "/?id=#{id}")
	+ conn = Plug.Conn.fetch_query_params(conn)
	+
	+ default_bucket_name = "#{limiter_name}:#{RateLimiter.ip(conn)}"
	+ parametrized_bucket_name = "#{limiter_name}:#{id}:#{RateLimiter.ip(conn)}"
	+
	+ RateLimiter.call(conn, opts)
	+ assert {1, 4, _, _, _} = ExRated.inspect_bucket(parametrized_bucket_name, scale, limit)
	+ assert {0, 5, _, _, _} = ExRated.inspect_bucket(default_bucket_name, scale, limit)
	+ end
	+
	+ test "it supports combination of options modifying bucket name" do
	+ limiter_name = :test_options_combo
	+ scale = 1000
	+ limit = 5
	+
	+ Pleroma.Config.put([:rate_limit, limiter_name], {scale, limit})
	+ base_bucket_name = "#{limiter_name}:group1"
	+ opts = RateLimiter.init({limiter_name, bucket_name: base_bucket_name, params: ["id"]})
	+ id = "100"
	+
	+ conn = conn(:get, "/?id=#{id}")
	+ conn = Plug.Conn.fetch_query_params(conn)
	+
	+ default_bucket_name = "#{limiter_name}:#{RateLimiter.ip(conn)}"
	+ parametrized_bucket_name = "#{base_bucket_name}:#{id}:#{RateLimiter.ip(conn)}"
	+
	+ RateLimiter.call(conn, opts)
	+ assert {1, 4, _, _, _} = ExRated.inspect_bucket(parametrized_bucket_name, scale, limit)
	+ assert {0, 5, _, _, _} = ExRated.inspect_bucket(default_bucket_name, scale, limit)
	+ end
	+
	test "optional limits for authenticated users" do
	+ limiter_name = :test_authenticated
	Ecto.Adapters.SQL.Sandbox.checkout(Pleroma.Repo)

	scale = 1000
	limit = 5
	- Pleroma.Config.put([:rate_limit, @limiter_name], [{1, 10}, {scale, limit}])
	+ Pleroma.Config.put([:rate_limit, limiter_name], [{1, 10}, {scale, limit}])

	- opts = RateLimiter.init(@limiter_name)
	+ opts = RateLimiter.init(limiter_name)

	user = insert(:user)
	conn = conn(:get, "/") \|> assign(:user, user)
	- bucket_name = "#{@limiter_name}:#{user.id}"
	+ bucket_name = "#{limiter_name}:#{user.id}"

	conn = RateLimiter.call(conn, opts)
	assert {1, 4, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)
	assert {2, 3, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)
	assert {3, 2, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)
	assert {4, 1, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)
	assert {5, 0, to_reset, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	conn = RateLimiter.call(conn, opts)

	assert %{"error" => "Throttled"} = Phoenix.ConnTest.json_response(conn, :too_many_requests)
	assert conn.halted

	Process.sleep(to_reset)

	conn = conn(:get, "/") \|> assign(:user, user)

	conn = RateLimiter.call(conn, opts)
	assert {1, 4, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)

	refute conn.status == Plug.Conn.Status.code(:too_many_requests)
	refute conn.resp_body
	refute conn.halted
	end
	end
	diff --git a/test/web/activity_pub/activity_pub_controller_test.exs b/test/web/activity_pub/activity_pub_controller_test.exs
	index 1f8eb9d71..452172bb4 100644
	--- a/test/web/activity_pub/activity_pub_controller_test.exs
	+++ b/test/web/activity_pub/activity_pub_controller_test.exs
	@@ -1,650 +1,705 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
	use Pleroma.Web.ConnCase
	import Pleroma.Factory
	alias Pleroma.Activity
	alias Pleroma.Instances
	alias Pleroma.Object
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	+ alias Pleroma.Web.CommonAPI

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)

	config_path = [:instance, :federating]
	initial_setting = Pleroma.Config.get(config_path)

	Pleroma.Config.put(config_path, true)
	on_exit(fn -> Pleroma.Config.put(config_path, initial_setting) end)

	:ok
	end

	describe "/relay" do
	test "with the relay active, it returns the relay user", %{conn: conn} do
	res =
	conn
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(200)

	assert res["id"] =~ "/relay"
	end

	test "with the relay disabled, it returns 404", %{conn: conn} do
	Pleroma.Config.put([:instance, :allow_relay], false)

	conn
	\|> get(activity_pub_path(conn, :relay))
	\|> json_response(404)
	\|> assert

	Pleroma.Config.put([:instance, :allow_relay], true)
	end
	end

	describe "/users/:nickname" do
	test "it returns a json representation of the user with accept application/json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns a json representation of the user with accept application/activity+json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end

	test "it returns a json representation of the user with accept application/ld+json", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header(
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)
	\|> get("/users/#{user.nickname}")

	user = User.get_cached_by_id(user.id)

	assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
	end
	end

	describe "/object/:uuid" do
	test "it returns a json representation of the object with accept application/json", %{
	conn: conn
	} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns a json representation of the object with accept application/activity+json",
	%{conn: conn} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns a json representation of the object with accept application/ld+json", %{
	conn: conn
	} do
	note = insert(:note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header(
	"accept",
	"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
	)
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
	end

	test "it returns 404 for non-public messages", %{conn: conn} do
	note = insert(:direct_note)
	uuid = String.split(note.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end

	test "it returns 404 for tombstone objects", %{conn: conn} do
	tombstone = insert(:tombstone)
	uuid = String.split(tombstone.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}")

	assert json_response(conn, 404)
	end
	end

	describe "/object/:uuid/likes" do
	test "it returns the like activities in a collection", %{conn: conn} do
	like = insert(:like_activity)
	like_object_ap_id = Object.normalize(like).data["id"]
	uuid = String.split(like_object_ap_id, "/") \|> List.last()

	result =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/objects/#{uuid}/likes")
	\|> json_response(200)

	assert List.first(result["first"]["orderedItems"])["id"] == like.data["id"]
	end
	end

	describe "/activities/:uuid" do
	test "it returns a json representation of the activity", %{conn: conn} do
	activity = insert(:note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
	end

	test "it returns 404 for non-public activities", %{conn: conn} do
	activity = insert(:direct_note_activity)
	uuid = String.split(activity.data["id"], "/") \|> List.last()

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/activities/#{uuid}")

	assert json_response(conn, 404)
	end
	end

	describe "/inbox" do
	test "it inserts an incoming activity into the database", %{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Poison.decode!()

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)
	:timer.sleep(500)
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it clears `unreachable` federation status of the sender", %{conn: conn} do
	data = File.read!("test/fixtures/mastodon-post-activity.json") \|> Poison.decode!()

	sender_url = data["actor"]
	Instances.set_consistently_unreachable(sender_url)
	refute Instances.reachable?(sender_url)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/inbox", data)

	assert "ok" == json_response(conn, 200)
	assert Instances.reachable?(sender_url)
	end
	end

	describe "/users/:nickname/inbox" do
	setup do
	data =
	File.read!("test/fixtures/mastodon-post-activity.json")
	\|> Poison.decode!()

	[data: data]
	end

	test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
	user = insert(:user)
	data = Map.put(data, "bcc", [user.ap_id])

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	:timer.sleep(500)
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it accepts messages from actors that are followed by the user", %{
	conn: conn,
	data: data
	} do
	recipient = insert(:user)
	actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})

	{:ok, recipient} = User.follow(recipient, actor)

	object =
	data["object"]
	\|> Map.put("attributedTo", actor.ap_id)

	data =
	data
	\|> Map.put("actor", actor.ap_id)
	\|> Map.put("object", object)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{recipient.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	:timer.sleep(500)
	assert Activity.get_by_ap_id(data["id"])
	end

	test "it rejects reads from other users", %{conn: conn} do
	user = insert(:user)
	otheruser = insert(:user)

	conn =
	conn
	\|> assign(:user, otheruser)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/inbox")

	assert json_response(conn, 403)
	end

	test "it returns a note activity in a collection", %{conn: conn} do
	note_activity = insert(:direct_note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/inbox")

	assert response(conn, 200) =~ note_object.data["content"]
	end

	test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
	user = insert(:user)
	data = Map.put(data, "bcc", [user.ap_id])

	sender_host = URI.parse(data["actor"]).host
	Instances.set_consistently_unreachable(sender_host)
	refute Instances.reachable?(sender_host)

	conn =
	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/inbox", data)

	assert "ok" == json_response(conn, 200)
	assert Instances.reachable?(sender_host)
	end

	test "it removes all follower collections but actor's", %{conn: conn} do
	[actor, recipient] = insert_pair(:user)

	data =
	File.read!("test/fixtures/activitypub-client-post-activity.json")
	\|> Poison.decode!()

	object = Map.put(data["object"], "attributedTo", actor.ap_id)

	data =
	data
	\|> Map.put("id", Utils.generate_object_id())
	\|> Map.put("actor", actor.ap_id)
	\|> Map.put("object", object)
	\|> Map.put("cc", [
	recipient.follower_address,
	actor.follower_address
	])
	\|> Map.put("to", [
	recipient.ap_id,
	recipient.follower_address,
	"https://www.w3.org/ns/activitystreams#Public"
	])

	conn
	\|> assign(:valid_signature, true)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{recipient.nickname}/inbox", data)
	\|> json_response(200)

	activity = Activity.get_by_ap_id(data["id"])

	assert activity.id
	assert actor.follower_address in activity.recipients
	assert actor.follower_address in activity.data["cc"]

	refute recipient.follower_address in activity.recipients
	refute recipient.follower_address in activity.data["cc"]
	refute recipient.follower_address in activity.data["to"]
	end
	end

	describe "/users/:nickname/outbox" do
	test "it will not bomb when there is no activity", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox")

	result = json_response(conn, 200)
	assert user.ap_id <> "/outbox" == result["id"]
	end

	test "it returns a note activity in a collection", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox")

	assert response(conn, 200) =~ note_object.data["content"]
	end

	test "it returns an announce activity in a collection", %{conn: conn} do
	announce_activity = insert(:announce_activity)
	user = User.get_cached_by_ap_id(announce_activity.data["actor"])

	conn =
	conn
	\|> put_req_header("accept", "application/activity+json")
	\|> get("/users/#{user.nickname}/outbox")

	assert response(conn, 200) =~ announce_activity.data["object"]
	end

	test "it rejects posts from other users", %{conn: conn} do
	data = File.read!("test/fixtures/activitypub-client-post-activity.json") \|> Poison.decode!()
	user = insert(:user)
	otheruser = insert(:user)

	conn =
	conn
	\|> assign(:user, otheruser)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	assert json_response(conn, 403)
	end

	test "it inserts an incoming create activity into the database", %{conn: conn} do
	data = File.read!("test/fixtures/activitypub-client-post-activity.json") \|> Poison.decode!()
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)
	assert Activity.get_by_ap_id(result["id"])
	end

	test "it rejects an incoming activity with bogus type", %{conn: conn} do
	data = File.read!("test/fixtures/activitypub-client-post-activity.json") \|> Poison.decode!()
	user = insert(:user)

	data =
	data
	\|> Map.put("type", "BadType")

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	assert json_response(conn, 400)
	end

	test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	data = %{
	type: "Delete",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)
	assert Activity.get_by_ap_id(result["id"])

	assert object = Object.get_by_ap_id(note_object.data["id"])
	assert object.data["type"] == "Tombstone"
	end

	test "it rejects delete activity of object from other actor", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = insert(:user)

	data = %{
	type: "Delete",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	assert json_response(conn, 400)
	end

	test "it increases like count when receiving a like action", %{conn: conn} do
	note_activity = insert(:note_activity)
	note_object = Object.normalize(note_activity)
	user = User.get_cached_by_ap_id(note_activity.data["actor"])

	data = %{
	type: "Like",
	object: %{
	id: note_object.data["id"]
	}
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put_req_header("content-type", "application/activity+json")
	\|> post("/users/#{user.nickname}/outbox", data)

	result = json_response(conn, 201)
	assert Activity.get_by_ap_id(result["id"])

	assert object = Object.get_by_ap_id(note_object.data["id"])
	assert object.data["like_count"] == 1
	end
	end

	describe "/users/:nickname/followers" do
	test "it returns the followers in a collection", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	\|> get("/users/#{user_two.nickname}/followers")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user.ap_id]
	end

	- test "it returns returns empty if the user has 'hide_followers' set", %{conn: conn} do
	+ test "it returns returns a uri if the user has 'hide_followers' set", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user, %{info: %{hide_followers: true}})
	User.follow(user, user_two)

	result =
	conn
	\|> get("/users/#{user_two.nickname}/followers")
	\|> json_response(200)

	- assert result["first"]["orderedItems"] == []
	- assert result["totalItems"] == 0
	+ assert is_binary(result["first"])
	+ end
	+
	+ test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is not authenticated",
	+ %{conn: conn} do
	+ user = insert(:user, %{info: %{hide_followers: true}})
	+
	+ result =
	+ conn
	+ \|> get("/users/#{user.nickname}/followers?page=1")
	+
	+ assert result.status == 403
	+ assert result.resp_body == ""
	+ end
	+
	+ test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
	+ %{conn: conn} do
	+ user = insert(:user, %{info: %{hide_followers: true}})
	+ other_user = insert(:user)
	+ {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
	+
	+ result =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/users/#{user.nickname}/followers?page=1")
	+ \|> json_response(200)
	+
	+ assert result["totalItems"] == 1
	+ assert result["orderedItems"] == [other_user.ap_id]
	end

	test "it works for more than 10 users", %{conn: conn} do
	user = insert(:user)

	Enum.each(1..15, fn _ ->
	other_user = insert(:user)
	User.follow(other_user, user)
	end)

	result =
	conn
	\|> get("/users/#{user.nickname}/followers")
	\|> json_response(200)

	assert length(result["first"]["orderedItems"]) == 10
	assert result["first"]["totalItems"] == 15
	assert result["totalItems"] == 15

	result =
	conn
	\|> get("/users/#{user.nickname}/followers?page=2")
	\|> json_response(200)

	assert length(result["orderedItems"]) == 5
	assert result["totalItems"] == 15
	end
	end

	describe "/users/:nickname/following" do
	test "it returns the following in a collection", %{conn: conn} do
	user = insert(:user)
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	assert result["first"]["orderedItems"] == [user_two.ap_id]
	end

	- test "it returns returns empty if the user has 'hide_follows' set", %{conn: conn} do
	+ test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
	user = insert(:user, %{info: %{hide_follows: true}})
	user_two = insert(:user)
	User.follow(user, user_two)

	result =
	conn
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	- assert result["first"]["orderedItems"] == []
	- assert result["totalItems"] == 0
	+ assert is_binary(result["first"])
	+ end
	+
	+ test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is not authenticated",
	+ %{conn: conn} do
	+ user = insert(:user, %{info: %{hide_follows: true}})
	+
	+ result =
	+ conn
	+ \|> get("/users/#{user.nickname}/following?page=1")
	+
	+ assert result.status == 403
	+ assert result.resp_body == ""
	+ end
	+
	+ test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
	+ %{conn: conn} do
	+ user = insert(:user, %{info: %{hide_follows: true}})
	+ other_user = insert(:user)
	+ {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
	+
	+ result =
	+ conn
	+ \|> assign(:user, user)
	+ \|> get("/users/#{user.nickname}/following?page=1")
	+ \|> json_response(200)
	+
	+ assert result["totalItems"] == 1
	+ assert result["orderedItems"] == [other_user.ap_id]
	end

	test "it works for more than 10 users", %{conn: conn} do
	user = insert(:user)

	Enum.each(1..15, fn _ ->
	user = User.get_cached_by_id(user.id)
	other_user = insert(:user)
	User.follow(user, other_user)
	end)

	result =
	conn
	\|> get("/users/#{user.nickname}/following")
	\|> json_response(200)

	assert length(result["first"]["orderedItems"]) == 10
	assert result["first"]["totalItems"] == 15
	assert result["totalItems"] == 15

	result =
	conn
	\|> get("/users/#{user.nickname}/following?page=2")
	\|> json_response(200)

	assert length(result["orderedItems"]) == 5
	assert result["totalItems"] == 15
	end
	end
	end
	diff --git a/test/web/activity_pub/views/user_view_test.exs b/test/web/activity_pub/views/user_view_test.exs
	index 969860c4c..86254117f 100644
	--- a/test/web/activity_pub/views/user_view_test.exs
	+++ b/test/web/activity_pub/views/user_view_test.exs
	@@ -1,85 +1,110 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.UserViewTest do
	use Pleroma.DataCase
	import Pleroma.Factory

	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.UserView
	+ alias Pleroma.Web.CommonAPI

	test "Renders a user, including the public key" do
	user = insert(:user)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})

	assert result["id"] == user.ap_id
	assert result["preferredUsername"] == user.nickname

	assert String.contains?(result["publicKey"]["publicKeyPem"], "BEGIN PUBLIC KEY")
	end

	test "Does not add an avatar image if the user hasn't set one" do
	user = insert(:user)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})
	refute result["icon"]
	refute result["image"]

	user =
	insert(:user,
	avatar: %{"url" => [%{"href" => "https://someurl"}]},
	info: %{
	banner: %{"url" => [%{"href" => "https://somebanner"}]}
	}
	)

	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})
	assert result["icon"]["url"] == "https://someurl"
	assert result["image"]["url"] == "https://somebanner"
	end

	describe "endpoints" do
	test "local users have a usable endpoints structure" do
	user = insert(:user)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})

	assert result["id"] == user.ap_id

	%{
	"sharedInbox" => _,
	"oauthAuthorizationEndpoint" => _,
	"oauthRegistrationEndpoint" => _,
	"oauthTokenEndpoint" => _
	} = result["endpoints"]
	end

	test "remote users have an empty endpoints structure" do
	user = insert(:user, local: false)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})

	assert result["id"] == user.ap_id
	assert result["endpoints"] == %{}
	end

	test "instance users do not expose oAuth endpoints" do
	user = insert(:user, nickname: nil, local: true)
	{:ok, user} = User.ensure_keys_present(user)

	result = UserView.render("user.json", %{user: user})

	refute result["endpoints"]["oauthAuthorizationEndpoint"]
	refute result["endpoints"]["oauthRegistrationEndpoint"]
	refute result["endpoints"]["oauthTokenEndpoint"]
	end
	end
	+
	+ describe "followers" do
	+ test "sets totalItems to zero when followers are hidden" do
	+ user = insert(:user)
	+ other_user = insert(:user)
	+ {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
	+ assert %{"totalItems" => 1} = UserView.render("followers.json", %{user: user})
	+ info = Map.put(user.info, :hide_followers, true)
	+ user = Map.put(user, :info, info)
	+ assert %{"totalItems" => 0} = UserView.render("followers.json", %{user: user})
	+ end
	+ end
	+
	+ describe "following" do
	+ test "sets totalItems to zero when follows are hidden" do
	+ user = insert(:user)
	+ other_user = insert(:user)
	+ {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
	+ assert %{"totalItems" => 1} = UserView.render("following.json", %{user: user})
	+ info = Map.put(user.info, :hide_follows, true)
	+ user = Map.put(user, :info, info)
	+ assert %{"totalItems" => 0} = UserView.render("following.json", %{user: user})
	+ end
	+ end
	end
	diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
	index 8afb1497b..b7c050dbf 100644
	--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
	+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
	@@ -1,3515 +1,3515 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
	use Pleroma.Web.ConnCase

	alias Ecto.Changeset
	alias Pleroma.Activity
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.FilterView
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.OStatus
	alias Pleroma.Web.Push
	alias Pleroma.Web.TwitterAPI.TwitterAPI
	import Pleroma.Factory
	import ExUnit.CaptureLog
	import Tesla.Mock

	@image "data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7"

	setup do
	mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	test "the home timeline", %{conn: conn} do
	user = insert(:user)
	following = insert(:user)

	{:ok, _activity} = TwitterAPI.create_status(following, %{"status" => "test"})

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/timelines/home")

	assert Enum.empty?(json_response(conn, 200))

	{:ok, user} = User.follow(user, following)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> get("/api/v1/timelines/home")

	assert [%{"content" => "test"}] = json_response(conn, 200)
	end

	test "the public timeline", %{conn: conn} do
	following = insert(:user)

	capture_log(fn ->
	{:ok, _activity} = TwitterAPI.create_status(following, %{"status" => "test"})

	{:ok, [_activity]} =
	OStatus.fetch_activity_from_url("https://shitposter.club/notice/2827873")

	conn =
	conn
	\|> get("/api/v1/timelines/public", %{"local" => "False"})

	assert length(json_response(conn, 200)) == 2

	conn =
	build_conn()
	\|> get("/api/v1/timelines/public", %{"local" => "True"})

	assert [%{"content" => "test"}] = json_response(conn, 200)

	conn =
	build_conn()
	\|> get("/api/v1/timelines/public", %{"local" => "1"})

	assert [%{"content" => "test"}] = json_response(conn, 200)
	end)
	end

	test "the public timeline when public is set to false", %{conn: conn} do
	public = Pleroma.Config.get([:instance, :public])
	Pleroma.Config.put([:instance, :public], false)

	on_exit(fn ->
	Pleroma.Config.put([:instance, :public], public)
	end)

	assert conn
	\|> get("/api/v1/timelines/public", %{"local" => "False"})
	\|> json_response(403) == %{"error" => "This resource requires authentication."}
	end

	describe "posting statuses" do
	setup do
	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, user)

	[conn: conn]
	end

	test "posting a status", %{conn: conn} do
	idempotency_key = "Pikachu rocks!"

	conn_one =
	conn
	\|> put_req_header("idempotency-key", idempotency_key)
	\|> post("/api/v1/statuses", %{
	"status" => "cofe",
	"spoiler_text" => "2hu",
	"sensitive" => "false"
	})

	{:ok, ttl} = Cachex.ttl(:idempotency_cache, idempotency_key)
	# Six hours
	assert ttl > :timer.seconds(6 * 60 * 60 - 1)

	assert %{"content" => "cofe", "id" => id, "spoiler_text" => "2hu", "sensitive" => false} =
	json_response(conn_one, 200)

	assert Activity.get_by_id(id)

	conn_two =
	conn
	\|> put_req_header("idempotency-key", idempotency_key)
	\|> post("/api/v1/statuses", %{
	"status" => "cofe",
	"spoiler_text" => "2hu",
	"sensitive" => "false"
	})

	assert %{"id" => second_id} = json_response(conn_two, 200)
	assert id == second_id

	conn_three =
	conn
	\|> post("/api/v1/statuses", %{
	"status" => "cofe",
	"spoiler_text" => "2hu",
	"sensitive" => "false"
	})

	assert %{"id" => third_id} = json_response(conn_three, 200)
	refute id == third_id
	end

	test "replying to a status", %{conn: conn} do
	user = insert(:user)
	{:ok, replied_to} = CommonAPI.post(user, %{"status" => "cofe"})

	conn =
	conn
	\|> post("/api/v1/statuses", %{"status" => "xD", "in_reply_to_id" => replied_to.id})

	assert %{"content" => "xD", "id" => id} = json_response(conn, 200)

	activity = Activity.get_by_id(id)

	assert activity.data["context"] == replied_to.data["context"]
	assert Activity.get_in_reply_to_activity(activity).id == replied_to.id
	end

	test "replying to a direct message with visibility other than direct", %{conn: conn} do
	user = insert(:user)
	{:ok, replied_to} = CommonAPI.post(user, %{"status" => "suya..", "visibility" => "direct"})

	Enum.each(["public", "private", "unlisted"], fn visibility ->
	conn =
	conn
	\|> post("/api/v1/statuses", %{
	"status" => "@#{user.nickname} hey",
	"in_reply_to_id" => replied_to.id,
	"visibility" => visibility
	})

	assert json_response(conn, 422) == %{"error" => "The message visibility must be direct"}
	end)
	end

	test "posting a status with an invalid in_reply_to_id", %{conn: conn} do
	conn =
	conn
	\|> post("/api/v1/statuses", %{"status" => "xD", "in_reply_to_id" => ""})

	assert %{"content" => "xD", "id" => id} = json_response(conn, 200)
	assert Activity.get_by_id(id)
	end

	test "posting a sensitive status", %{conn: conn} do
	conn =
	conn
	\|> post("/api/v1/statuses", %{"status" => "cofe", "sensitive" => true})

	assert %{"content" => "cofe", "id" => id, "sensitive" => true} = json_response(conn, 200)
	assert Activity.get_by_id(id)
	end

	test "posting a fake status", %{conn: conn} do
	real_conn =
	conn
	\|> post("/api/v1/statuses", %{
	"status" =>
	"\"Tenshi Eating a Corndog\" is a much discussed concept on /jp/. The significance of it is disputed, so I will focus on one core concept: the symbolism behind it"
	})

	real_status = json_response(real_conn, 200)

	assert real_status
	assert Object.get_by_ap_id(real_status["uri"])

	real_status =
	real_status
	\|> Map.put("id", nil)
	\|> Map.put("url", nil)
	\|> Map.put("uri", nil)
	\|> Map.put("created_at", nil)
	\|> Kernel.put_in(["pleroma", "conversation_id"], nil)

	fake_conn =
	conn
	\|> post("/api/v1/statuses", %{
	"status" =>
	"\"Tenshi Eating a Corndog\" is a much discussed concept on /jp/. The significance of it is disputed, so I will focus on one core concept: the symbolism behind it",
	"preview" => true
	})

	fake_status = json_response(fake_conn, 200)

	assert fake_status
	refute Object.get_by_ap_id(fake_status["uri"])

	fake_status =
	fake_status
	\|> Map.put("id", nil)
	\|> Map.put("url", nil)
	\|> Map.put("uri", nil)
	\|> Map.put("created_at", nil)
	\|> Kernel.put_in(["pleroma", "conversation_id"], nil)

	assert real_status == fake_status
	end

	test "posting a status with OGP link preview", %{conn: conn} do
	Pleroma.Config.put([:rich_media, :enabled], true)

	conn =
	conn
	\|> post("/api/v1/statuses", %{
	"status" => "https://example.com/ogp"
	})

	assert %{"id" => id, "card" => %{"title" => "The Rock"}} = json_response(conn, 200)
	assert Activity.get_by_id(id)
	Pleroma.Config.put([:rich_media, :enabled], false)
	end

	test "posting a direct status", %{conn: conn} do
	user2 = insert(:user)
	content = "direct cofe @#{user2.nickname}"

	conn =
	conn
	\|> post("api/v1/statuses", %{"status" => content, "visibility" => "direct"})

	assert %{"id" => id, "visibility" => "direct"} = json_response(conn, 200)
	assert activity = Activity.get_by_id(id)
	assert activity.recipients == [user2.ap_id, conn.assigns[:user].ap_id]
	assert activity.data["to"] == [user2.ap_id]
	assert activity.data["cc"] == []
	end
	end

	describe "posting polls" do
	test "posting a poll", %{conn: conn} do
	user = insert(:user)
	time = NaiveDateTime.utc_now()

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{
	"status" => "Who is the #bestgrill?",
	"poll" => %{"options" => ["Rei", "Asuka", "Misato"], "expires_in" => 420}
	})

	response = json_response(conn, 200)

	assert Enum.all?(response["poll"]["options"], fn %{"title" => title} ->
	title in ["Rei", "Asuka", "Misato"]
	end)

	assert NaiveDateTime.diff(NaiveDateTime.from_iso8601!(response["poll"]["expires_at"]), time) in 420..430
	refute response["poll"]["expred"]
	end

	test "option limit is enforced", %{conn: conn} do
	user = insert(:user)
	limit = Pleroma.Config.get([:instance, :poll_limits, :max_options])

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{
	"status" => "desu~",
	"poll" => %{"options" => Enum.map(0..limit, fn _ -> "desu" end), "expires_in" => 1}
	})

	%{"error" => error} = json_response(conn, 422)
	assert error == "Poll can't contain more than #{limit} options"
	end

	test "option character limit is enforced", %{conn: conn} do
	user = insert(:user)
	limit = Pleroma.Config.get([:instance, :poll_limits, :max_option_chars])

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{
	"status" => "...",
	"poll" => %{
	"options" => [Enum.reduce(0..limit, "", fn _, acc -> acc <> "." end)],
	"expires_in" => 1
	}
	})

	%{"error" => error} = json_response(conn, 422)
	assert error == "Poll options cannot be longer than #{limit} characters each"
	end

	test "minimal date limit is enforced", %{conn: conn} do
	user = insert(:user)
	limit = Pleroma.Config.get([:instance, :poll_limits, :min_expiration])

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{
	"status" => "imagine arbitrary limits",
	"poll" => %{
	"options" => ["this post was made by pleroma gang"],
	"expires_in" => limit - 1
	}
	})

	%{"error" => error} = json_response(conn, 422)
	assert error == "Expiration date is too soon"
	end

	test "maximum date limit is enforced", %{conn: conn} do
	user = insert(:user)
	limit = Pleroma.Config.get([:instance, :poll_limits, :max_expiration])

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{
	"status" => "imagine arbitrary limits",
	"poll" => %{
	"options" => ["this post was made by pleroma gang"],
	"expires_in" => limit + 1
	}
	})

	%{"error" => error} = json_response(conn, 422)
	assert error == "Expiration date is too far in the future"
	end
	end

	test "direct timeline", %{conn: conn} do
	user_one = insert(:user)
	user_two = insert(:user)

	{:ok, user_two} = User.follow(user_two, user_one)

	{:ok, direct} =
	CommonAPI.post(user_one, %{
	"status" => "Hi @#{user_two.nickname}!",
	"visibility" => "direct"
	})

	{:ok, _follower_only} =
	CommonAPI.post(user_one, %{
	"status" => "Hi @#{user_two.nickname}!",
	"visibility" => "private"
	})

	# Only direct should be visible here
	res_conn =
	conn
	\|> assign(:user, user_two)
	\|> get("api/v1/timelines/direct")

	[status] = json_response(res_conn, 200)

	assert %{"visibility" => "direct"} = status
	assert status["url"] != direct.data["id"]

	# User should be able to see his own direct message
	res_conn =
	build_conn()
	\|> assign(:user, user_one)
	\|> get("api/v1/timelines/direct")

	[status] = json_response(res_conn, 200)

	assert %{"visibility" => "direct"} = status

	# Both should be visible here
	res_conn =
	conn
	\|> assign(:user, user_two)
	\|> get("api/v1/timelines/home")

	[_s1, _s2] = json_response(res_conn, 200)

	# Test pagination
	Enum.each(1..20, fn _ ->
	{:ok, _} =
	CommonAPI.post(user_one, %{
	"status" => "Hi @#{user_two.nickname}!",
	"visibility" => "direct"
	})
	end)

	res_conn =
	conn
	\|> assign(:user, user_two)
	\|> get("api/v1/timelines/direct")

	statuses = json_response(res_conn, 200)
	assert length(statuses) == 20

	res_conn =
	conn
	\|> assign(:user, user_two)
	\|> get("api/v1/timelines/direct", %{max_id: List.last(statuses)["id"]})

	[status] = json_response(res_conn, 200)

	assert status["url"] != direct.data["id"]
	end

	test "Conversations", %{conn: conn} do
	user_one = insert(:user)
	user_two = insert(:user)
	user_three = insert(:user)

	{:ok, user_two} = User.follow(user_two, user_one)

	{:ok, direct} =
	CommonAPI.post(user_one, %{
	"status" => "Hi @#{user_two.nickname}, @#{user_three.nickname}!",
	"visibility" => "direct"
	})

	{:ok, _follower_only} =
	CommonAPI.post(user_one, %{
	"status" => "Hi @#{user_two.nickname}!",
	"visibility" => "private"
	})

	res_conn =
	conn
	\|> assign(:user, user_one)
	\|> get("/api/v1/conversations")

	assert response = json_response(res_conn, 200)

	assert [
	%{
	"id" => res_id,
	"accounts" => res_accounts,
	"last_status" => res_last_status,
	"unread" => unread
	}
	] = response

	account_ids = Enum.map(res_accounts, & &1["id"])
	assert length(res_accounts) == 2
	assert user_two.id in account_ids
	assert user_three.id in account_ids
	assert is_binary(res_id)
	assert unread == true
	assert res_last_status["id"] == direct.id

	# Apparently undocumented API endpoint
	res_conn =
	conn
	\|> assign(:user, user_one)
	\|> post("/api/v1/conversations/#{res_id}/read")

	assert response = json_response(res_conn, 200)
	assert length(response["accounts"]) == 2
	assert response["last_status"]["id"] == direct.id
	assert response["unread"] == false

	# (vanilla) Mastodon frontend behaviour
	res_conn =
	conn
	\|> assign(:user, user_one)
	\|> get("/api/v1/statuses/#{res_last_status["id"]}/context")

	assert %{"ancestors" => [], "descendants" => []} == json_response(res_conn, 200)
	end

	test "doesn't include DMs from blocked users", %{conn: conn} do
	blocker = insert(:user)
	blocked = insert(:user)
	user = insert(:user)
	{:ok, blocker} = User.block(blocker, blocked)

	{:ok, _blocked_direct} =
	CommonAPI.post(blocked, %{
	"status" => "Hi @#{blocker.nickname}!",
	"visibility" => "direct"
	})

	{:ok, direct} =
	CommonAPI.post(user, %{
	"status" => "Hi @#{blocker.nickname}!",
	"visibility" => "direct"
	})

	res_conn =
	conn
	\|> assign(:user, user)
	\|> get("api/v1/timelines/direct")

	[status] = json_response(res_conn, 200)
	assert status["id"] == direct.id
	end

	test "verify_credentials", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/verify_credentials")

	response = json_response(conn, 200)

	assert %{"id" => id, "source" => %{"privacy" => "public"}} = response
	assert response["pleroma"]["chat_token"]
	assert id == to_string(user.id)
	end

	test "verify_credentials default scope unlisted", %{conn: conn} do
	user = insert(:user, %{info: %User.Info{default_scope: "unlisted"}})

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/verify_credentials")

	assert %{"id" => id, "source" => %{"privacy" => "unlisted"}} = json_response(conn, 200)
	assert id == to_string(user.id)
	end

	test "apps/verify_credentials", %{conn: conn} do
	token = insert(:oauth_token)

	conn =
	conn
	\|> assign(:user, token.user)
	\|> assign(:token, token)
	\|> get("/api/v1/apps/verify_credentials")

	app = Repo.preload(token, :app).app

	expected = %{
	"name" => app.client_name,
	"website" => app.website,
	"vapid_key" => Push.vapid_config() \|> Keyword.get(:public_key)
	}

	assert expected == json_response(conn, 200)
	end

	test "user avatar can be set", %{conn: conn} do
	user = insert(:user)
	avatar_image = File.read!("test/fixtures/avatar_data_uri")

	conn =
	conn
	\|> assign(:user, user)
	- \|> patch("/api/v1/accounts/update_avatar", %{img: avatar_image})
	+ \|> patch("/api/v1/pleroma/accounts/update_avatar", %{img: avatar_image})

	user = refresh_record(user)

	assert %{
	"name" => _,
	"type" => _,
	"url" => [
	%{
	"href" => _,
	"mediaType" => _,
	"type" => _
	}
	]
	} = user.avatar

	assert %{"url" => _} = json_response(conn, 200)
	end

	test "user avatar can be reset", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	- \|> patch("/api/v1/accounts/update_avatar", %{img: ""})
	+ \|> patch("/api/v1/pleroma/accounts/update_avatar", %{img: ""})

	user = User.get_cached_by_id(user.id)

	assert user.avatar == nil

	assert %{"url" => nil} = json_response(conn, 200)
	end

	test "can set profile banner", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	- \|> patch("/api/v1/accounts/update_banner", %{"banner" => @image})
	+ \|> patch("/api/v1/pleroma/accounts/update_banner", %{"banner" => @image})

	user = refresh_record(user)
	assert user.info.banner["type"] == "Image"

	assert %{"url" => _} = json_response(conn, 200)
	end

	test "can reset profile banner", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	- \|> patch("/api/v1/accounts/update_banner", %{"banner" => ""})
	+ \|> patch("/api/v1/pleroma/accounts/update_banner", %{"banner" => ""})

	user = refresh_record(user)
	assert user.info.banner == %{}

	assert %{"url" => nil} = json_response(conn, 200)
	end

	test "background image can be set", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	- \|> patch("/api/v1/accounts/update_background", %{"img" => @image})
	+ \|> patch("/api/v1/pleroma/accounts/update_background", %{"img" => @image})

	user = refresh_record(user)
	assert user.info.background["type"] == "Image"
	assert %{"url" => _} = json_response(conn, 200)
	end

	test "background image can be reset", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	- \|> patch("/api/v1/accounts/update_background", %{"img" => ""})
	+ \|> patch("/api/v1/pleroma/accounts/update_background", %{"img" => ""})

	user = refresh_record(user)
	assert user.info.background == %{}
	assert %{"url" => nil} = json_response(conn, 200)
	end

	test "creates an oauth app", %{conn: conn} do
	user = insert(:user)
	app_attrs = build(:oauth_app)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/apps", %{
	client_name: app_attrs.client_name,
	redirect_uris: app_attrs.redirect_uris
	})

	[app] = Repo.all(App)

	expected = %{
	"name" => app.client_name,
	"website" => app.website,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret,
	"id" => app.id \|> to_string(),
	"redirect_uri" => app.redirect_uris,
	"vapid_key" => Push.vapid_config() \|> Keyword.get(:public_key)
	}

	assert expected == json_response(conn, 200)
	end

	test "get a status", %{conn: conn} do
	activity = insert(:note_activity)

	conn =
	conn
	\|> get("/api/v1/statuses/#{activity.id}")

	assert %{"id" => id} = json_response(conn, 200)
	assert id == to_string(activity.id)
	end

	describe "deleting a status" do
	test "when you created it", %{conn: conn} do
	activity = insert(:note_activity)
	author = User.get_cached_by_ap_id(activity.data["actor"])

	conn =
	conn
	\|> assign(:user, author)
	\|> delete("/api/v1/statuses/#{activity.id}")

	assert %{} = json_response(conn, 200)

	refute Activity.get_by_id(activity.id)
	end

	test "when you didn't create it", %{conn: conn} do
	activity = insert(:note_activity)
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> delete("/api/v1/statuses/#{activity.id}")

	assert %{"error" => _} = json_response(conn, 403)

	assert Activity.get_by_id(activity.id) == activity
	end

	test "when you're an admin or moderator", %{conn: conn} do
	activity1 = insert(:note_activity)
	activity2 = insert(:note_activity)
	admin = insert(:user, info: %{is_admin: true})
	moderator = insert(:user, info: %{is_moderator: true})

	res_conn =
	conn
	\|> assign(:user, admin)
	\|> delete("/api/v1/statuses/#{activity1.id}")

	assert %{} = json_response(res_conn, 200)

	res_conn =
	conn
	\|> assign(:user, moderator)
	\|> delete("/api/v1/statuses/#{activity2.id}")

	assert %{} = json_response(res_conn, 200)

	refute Activity.get_by_id(activity1.id)
	refute Activity.get_by_id(activity2.id)
	end
	end

	describe "filters" do
	test "creating a filter", %{conn: conn} do
	user = insert(:user)

	filter = %Pleroma.Filter{
	phrase: "knights",
	context: ["home"]
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/filters", %{"phrase" => filter.phrase, context: filter.context})

	assert response = json_response(conn, 200)
	assert response["phrase"] == filter.phrase
	assert response["context"] == filter.context
	assert response["irreversible"] == false
	assert response["id"] != nil
	assert response["id"] != ""
	end

	test "fetching a list of filters", %{conn: conn} do
	user = insert(:user)

	query_one = %Pleroma.Filter{
	user_id: user.id,
	filter_id: 1,
	phrase: "knights",
	context: ["home"]
	}

	query_two = %Pleroma.Filter{
	user_id: user.id,
	filter_id: 2,
	phrase: "who",
	context: ["home"]
	}

	{:ok, filter_one} = Pleroma.Filter.create(query_one)
	{:ok, filter_two} = Pleroma.Filter.create(query_two)

	response =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/filters")
	\|> json_response(200)

	assert response ==
	render_json(
	FilterView,
	"filters.json",
	filters: [filter_two, filter_one]
	)
	end

	test "get a filter", %{conn: conn} do
	user = insert(:user)

	query = %Pleroma.Filter{
	user_id: user.id,
	filter_id: 2,
	phrase: "knight",
	context: ["home"]
	}

	{:ok, filter} = Pleroma.Filter.create(query)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/filters/#{filter.filter_id}")

	assert _response = json_response(conn, 200)
	end

	test "update a filter", %{conn: conn} do
	user = insert(:user)

	query = %Pleroma.Filter{
	user_id: user.id,
	filter_id: 2,
	phrase: "knight",
	context: ["home"]
	}

	{:ok, _filter} = Pleroma.Filter.create(query)

	new = %Pleroma.Filter{
	phrase: "nii",
	context: ["home"]
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/v1/filters/#{query.filter_id}", %{
	phrase: new.phrase,
	context: new.context
	})

	assert response = json_response(conn, 200)
	assert response["phrase"] == new.phrase
	assert response["context"] == new.context
	end

	test "delete a filter", %{conn: conn} do
	user = insert(:user)

	query = %Pleroma.Filter{
	user_id: user.id,
	filter_id: 2,
	phrase: "knight",
	context: ["home"]
	}

	{:ok, filter} = Pleroma.Filter.create(query)

	conn =
	conn
	\|> assign(:user, user)
	\|> delete("/api/v1/filters/#{filter.filter_id}")

	assert response = json_response(conn, 200)
	assert response == %{}
	end
	end

	describe "lists" do
	test "creating a list", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/lists", %{"title" => "cuties"})

	assert %{"title" => title} = json_response(conn, 200)
	assert title == "cuties"
	end

	test "adding users to a list", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, list} = Pleroma.List.create("name", user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/lists/#{list.id}/accounts", %{"account_ids" => [other_user.id]})

	assert %{} == json_response(conn, 200)
	%Pleroma.List{following: following} = Pleroma.List.get(list.id, user)
	assert following == [other_user.follower_address]
	end

	test "removing users from a list", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	third_user = insert(:user)
	{:ok, list} = Pleroma.List.create("name", user)
	{:ok, list} = Pleroma.List.follow(list, other_user)
	{:ok, list} = Pleroma.List.follow(list, third_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> delete("/api/v1/lists/#{list.id}/accounts", %{"account_ids" => [other_user.id]})

	assert %{} == json_response(conn, 200)
	%Pleroma.List{following: following} = Pleroma.List.get(list.id, user)
	assert following == [third_user.follower_address]
	end

	test "listing users in a list", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, list} = Pleroma.List.create("name", user)
	{:ok, list} = Pleroma.List.follow(list, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/lists/#{list.id}/accounts", %{"account_ids" => [other_user.id]})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(other_user.id)
	end

	test "retrieving a list", %{conn: conn} do
	user = insert(:user)
	{:ok, list} = Pleroma.List.create("name", user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/lists/#{list.id}")

	assert %{"id" => id} = json_response(conn, 200)
	assert id == to_string(list.id)
	end

	test "renaming a list", %{conn: conn} do
	user = insert(:user)
	{:ok, list} = Pleroma.List.create("name", user)

	conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/v1/lists/#{list.id}", %{"title" => "newname"})

	assert %{"title" => name} = json_response(conn, 200)
	assert name == "newname"
	end

	test "deleting a list", %{conn: conn} do
	user = insert(:user)
	{:ok, list} = Pleroma.List.create("name", user)

	conn =
	conn
	\|> assign(:user, user)
	\|> delete("/api/v1/lists/#{list.id}")

	assert %{} = json_response(conn, 200)
	assert is_nil(Repo.get(Pleroma.List, list.id))
	end

	test "list timeline", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, _activity_one} = TwitterAPI.create_status(user, %{"status" => "Marisa is cute."})
	{:ok, activity_two} = TwitterAPI.create_status(other_user, %{"status" => "Marisa is cute."})
	{:ok, list} = Pleroma.List.create("name", user)
	{:ok, list} = Pleroma.List.follow(list, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/timelines/list/#{list.id}")

	assert [%{"id" => id}] = json_response(conn, 200)

	assert id == to_string(activity_two.id)
	end

	test "list timeline does not leak non-public statuses for unfollowed users", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, activity_one} = TwitterAPI.create_status(other_user, %{"status" => "Marisa is cute."})

	{:ok, _activity_two} =
	TwitterAPI.create_status(other_user, %{
	"status" => "Marisa is cute.",
	"visibility" => "private"
	})

	{:ok, list} = Pleroma.List.create("name", user)
	{:ok, list} = Pleroma.List.follow(list, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/timelines/list/#{list.id}")

	assert [%{"id" => id}] = json_response(conn, 200)

	assert id == to_string(activity_one.id)
	end
	end

	describe "notifications" do
	test "list of notifications", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	TwitterAPI.create_status(other_user, %{"status" => "hi @#{user.nickname}"})

	{:ok, [_notification]} = Notification.create_notifications(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications")

	expected_response =
	"hi <span class=\"h-card\"><a data-user=\"#{user.id}\" class=\"u-url mention\" href=\"#{
	user.ap_id
	}\">@<span>#{user.nickname}</span></a></span>"

	assert [%{"status" => %{"content" => response}} \| _rest] = json_response(conn, 200)
	assert response == expected_response
	end

	test "getting a single notification", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	TwitterAPI.create_status(other_user, %{"status" => "hi @#{user.nickname}"})

	{:ok, [notification]} = Notification.create_notifications(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications/#{notification.id}")

	expected_response =
	"hi <span class=\"h-card\"><a data-user=\"#{user.id}\" class=\"u-url mention\" href=\"#{
	user.ap_id
	}\">@<span>#{user.nickname}</span></a></span>"

	assert %{"status" => %{"content" => response}} = json_response(conn, 200)
	assert response == expected_response
	end

	test "dismissing a single notification", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	TwitterAPI.create_status(other_user, %{"status" => "hi @#{user.nickname}"})

	{:ok, [notification]} = Notification.create_notifications(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/notifications/dismiss", %{"id" => notification.id})

	assert %{} = json_response(conn, 200)
	end

	test "clearing all notifications", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	TwitterAPI.create_status(other_user, %{"status" => "hi @#{user.nickname}"})

	{:ok, [_notification]} = Notification.create_notifications(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/notifications/clear")

	assert %{} = json_response(conn, 200)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> get("/api/v1/notifications")

	assert all = json_response(conn, 200)
	assert all == []
	end

	test "paginates notifications using min_id, since_id, max_id, and limit", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity1} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
	{:ok, activity2} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
	{:ok, activity3} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
	{:ok, activity4} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})

	notification1_id = Repo.get_by(Notification, activity_id: activity1.id).id \|> to_string()
	notification2_id = Repo.get_by(Notification, activity_id: activity2.id).id \|> to_string()
	notification3_id = Repo.get_by(Notification, activity_id: activity3.id).id \|> to_string()
	notification4_id = Repo.get_by(Notification, activity_id: activity4.id).id \|> to_string()

	conn =
	conn
	\|> assign(:user, user)

	# min_id
	conn_res =
	conn
	\|> get("/api/v1/notifications?limit=2&min_id=#{notification1_id}")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^notification3_id}, %{"id" => ^notification2_id}] = result

	# since_id
	conn_res =
	conn
	\|> get("/api/v1/notifications?limit=2&since_id=#{notification1_id}")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^notification4_id}, %{"id" => ^notification3_id}] = result

	# max_id
	conn_res =
	conn
	\|> get("/api/v1/notifications?limit=2&max_id=#{notification4_id}")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^notification3_id}, %{"id" => ^notification2_id}] = result
	end

	test "filters notifications using exclude_types", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, mention_activity} = CommonAPI.post(other_user, %{"status" => "hey @#{user.nickname}"})
	{:ok, create_activity} = CommonAPI.post(user, %{"status" => "hey"})
	{:ok, favorite_activity, _} = CommonAPI.favorite(create_activity.id, other_user)
	{:ok, reblog_activity, _} = CommonAPI.repeat(create_activity.id, other_user)
	{:ok, _, _, follow_activity} = CommonAPI.follow(other_user, user)

	mention_notification_id =
	Repo.get_by(Notification, activity_id: mention_activity.id).id \|> to_string()

	favorite_notification_id =
	Repo.get_by(Notification, activity_id: favorite_activity.id).id \|> to_string()

	reblog_notification_id =
	Repo.get_by(Notification, activity_id: reblog_activity.id).id \|> to_string()

	follow_notification_id =
	Repo.get_by(Notification, activity_id: follow_activity.id).id \|> to_string()

	conn =
	conn
	\|> assign(:user, user)

	conn_res =
	get(conn, "/api/v1/notifications", %{exclude_types: ["mention", "favourite", "reblog"]})

	assert [%{"id" => ^follow_notification_id}] = json_response(conn_res, 200)

	conn_res =
	get(conn, "/api/v1/notifications", %{exclude_types: ["favourite", "reblog", "follow"]})

	assert [%{"id" => ^mention_notification_id}] = json_response(conn_res, 200)

	conn_res =
	get(conn, "/api/v1/notifications", %{exclude_types: ["reblog", "follow", "mention"]})

	assert [%{"id" => ^favorite_notification_id}] = json_response(conn_res, 200)

	conn_res =
	get(conn, "/api/v1/notifications", %{exclude_types: ["follow", "mention", "favourite"]})

	assert [%{"id" => ^reblog_notification_id}] = json_response(conn_res, 200)
	end

	test "destroy multiple", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity1} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
	{:ok, activity2} = CommonAPI.post(other_user, %{"status" => "hi @#{user.nickname}"})
	{:ok, activity3} = CommonAPI.post(user, %{"status" => "hi @#{other_user.nickname}"})
	{:ok, activity4} = CommonAPI.post(user, %{"status" => "hi @#{other_user.nickname}"})

	notification1_id = Repo.get_by(Notification, activity_id: activity1.id).id \|> to_string()
	notification2_id = Repo.get_by(Notification, activity_id: activity2.id).id \|> to_string()
	notification3_id = Repo.get_by(Notification, activity_id: activity3.id).id \|> to_string()
	notification4_id = Repo.get_by(Notification, activity_id: activity4.id).id \|> to_string()

	conn =
	conn
	\|> assign(:user, user)

	conn_res =
	conn
	\|> get("/api/v1/notifications")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^notification2_id}, %{"id" => ^notification1_id}] = result

	conn2 =
	conn
	\|> assign(:user, other_user)

	conn_res =
	conn2
	\|> get("/api/v1/notifications")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^notification4_id}, %{"id" => ^notification3_id}] = result

	conn_destroy =
	conn
	\|> delete("/api/v1/notifications/destroy_multiple", %{
	"ids" => [notification1_id, notification2_id]
	})

	assert json_response(conn_destroy, 200) == %{}

	conn_res =
	conn2
	\|> get("/api/v1/notifications")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^notification4_id}, %{"id" => ^notification3_id}] = result
	end
	end

	describe "reblogging" do
	test "reblogs and returns the reblogged status", %{conn: conn} do
	activity = insert(:note_activity)
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/reblog")

	assert %{
	"reblog" => %{"id" => id, "reblogged" => true, "reblogs_count" => 1},
	"reblogged" => true
	} = json_response(conn, 200)

	assert to_string(activity.id) == id
	end

	test "reblogged status for another user", %{conn: conn} do
	activity = insert(:note_activity)
	user1 = insert(:user)
	user2 = insert(:user)
	user3 = insert(:user)
	CommonAPI.favorite(activity.id, user2)
	{:ok, _bookmark} = Pleroma.Bookmark.create(user2.id, activity.id)
	{:ok, reblog_activity1, _object} = CommonAPI.repeat(activity.id, user1)
	{:ok, _, _object} = CommonAPI.repeat(activity.id, user2)

	conn_res =
	conn
	\|> assign(:user, user3)
	\|> get("/api/v1/statuses/#{reblog_activity1.id}")

	assert %{
	"reblog" => %{"id" => id, "reblogged" => false, "reblogs_count" => 2},
	"reblogged" => false,
	"favourited" => false,
	"bookmarked" => false
	} = json_response(conn_res, 200)

	conn_res =
	conn
	\|> assign(:user, user2)
	\|> get("/api/v1/statuses/#{reblog_activity1.id}")

	assert %{
	"reblog" => %{"id" => id, "reblogged" => true, "reblogs_count" => 2},
	"reblogged" => true,
	"favourited" => true,
	"bookmarked" => true
	} = json_response(conn_res, 200)

	assert to_string(activity.id) == id
	end
	end

	describe "unreblogging" do
	test "unreblogs and returns the unreblogged status", %{conn: conn} do
	activity = insert(:note_activity)
	user = insert(:user)

	{:ok, _, _} = CommonAPI.repeat(activity.id, user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/unreblog")

	assert %{"id" => id, "reblogged" => false, "reblogs_count" => 0} = json_response(conn, 200)

	assert to_string(activity.id) == id
	end
	end

	describe "favoriting" do
	test "favs a status and returns it", %{conn: conn} do
	activity = insert(:note_activity)
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/favourite")

	assert %{"id" => id, "favourites_count" => 1, "favourited" => true} =
	json_response(conn, 200)

	assert to_string(activity.id) == id
	end

	test "returns 500 for a wrong id", %{conn: conn} do
	user = insert(:user)

	resp =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/1/favourite")
	\|> json_response(500)

	assert resp == "Something went wrong"
	end
	end

	describe "unfavoriting" do
	test "unfavorites a status and returns it", %{conn: conn} do
	activity = insert(:note_activity)
	user = insert(:user)

	{:ok, _, _} = CommonAPI.favorite(activity.id, user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/unfavourite")

	assert %{"id" => id, "favourites_count" => 0, "favourited" => false} =
	json_response(conn, 200)

	assert to_string(activity.id) == id
	end
	end

	describe "user timelines" do
	test "gets a users statuses", %{conn: conn} do
	user_one = insert(:user)
	user_two = insert(:user)
	user_three = insert(:user)

	{:ok, user_three} = User.follow(user_three, user_one)

	{:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})

	{:ok, direct_activity} =
	CommonAPI.post(user_one, %{
	"status" => "Hi, @#{user_two.nickname}.",
	"visibility" => "direct"
	})

	{:ok, private_activity} =
	CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})

	resp =
	conn
	\|> get("/api/v1/accounts/#{user_one.id}/statuses")

	assert [%{"id" => id}] = json_response(resp, 200)
	assert id == to_string(activity.id)

	resp =
	conn
	\|> assign(:user, user_two)
	\|> get("/api/v1/accounts/#{user_one.id}/statuses")

	assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
	assert id_one == to_string(direct_activity.id)
	assert id_two == to_string(activity.id)

	resp =
	conn
	\|> assign(:user, user_three)
	\|> get("/api/v1/accounts/#{user_one.id}/statuses")

	assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
	assert id_one == to_string(private_activity.id)
	assert id_two == to_string(activity.id)
	end

	test "unimplemented pinned statuses feature", %{conn: conn} do
	note = insert(:note_activity)
	user = User.get_cached_by_ap_id(note.data["actor"])

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")

	assert json_response(conn, 200) == []
	end

	test "gets an users media", %{conn: conn} do
	note = insert(:note_activity)
	user = User.get_cached_by_ap_id(note.data["actor"])

	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	media =
	TwitterAPI.upload(file, user, "json")
	\|> Poison.decode!()

	{:ok, image_post} =
	TwitterAPI.create_status(user, %{"status" => "cofe", "media_ids" => [media["media_id"]]})

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "true"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(image_post.id)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"only_media" => "1"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(image_post.id)
	end

	test "gets a user's statuses without reblogs", %{conn: conn} do
	user = insert(:user)
	{:ok, post} = CommonAPI.post(user, %{"status" => "HI!!!"})
	{:ok, _, _} = CommonAPI.repeat(post.id, user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "true"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(post.id)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"exclude_reblogs" => "1"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(post.id)
	end

	test "filters user's statuses by a hashtag", %{conn: conn} do
	user = insert(:user)
	{:ok, post} = CommonAPI.post(user, %{"status" => "#hashtag"})
	{:ok, _post} = CommonAPI.post(user, %{"status" => "hashtag"})

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/statuses", %{"tagged" => "hashtag"})

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(post.id)
	end
	end

	describe "user relationships" do
	test "returns the relationships for the current user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/relationships", %{"id" => [other_user.id]})

	assert [relationship] = json_response(conn, 200)

	assert to_string(other_user.id) == relationship["id"]
	end
	end

	describe "media upload" do
	setup do
	upload_config = Pleroma.Config.get([Pleroma.Upload])
	proxy_config = Pleroma.Config.get([:media_proxy])

	on_exit(fn ->
	Pleroma.Config.put([Pleroma.Upload], upload_config)
	Pleroma.Config.put([:media_proxy], proxy_config)
	end)

	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, user)

	image = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	[conn: conn, image: image]
	end

	test "returns uploaded image", %{conn: conn, image: image} do
	desc = "Description of the image"

	media =
	conn
	\|> post("/api/v1/media", %{"file" => image, "description" => desc})
	\|> json_response(:ok)

	assert media["type"] == "image"
	assert media["description"] == desc
	assert media["id"]

	object = Repo.get(Object, media["id"])
	assert object.data["actor"] == User.ap_id(conn.assigns[:user])
	end

	test "returns proxied url when media proxy is enabled", %{conn: conn, image: image} do
	Pleroma.Config.put([Pleroma.Upload, :base_url], "https://media.pleroma.social")

	proxy_url = "https://cache.pleroma.social"
	Pleroma.Config.put([:media_proxy, :enabled], true)
	Pleroma.Config.put([:media_proxy, :base_url], proxy_url)

	media =
	conn
	\|> post("/api/v1/media", %{"file" => image})
	\|> json_response(:ok)

	assert String.starts_with?(media["url"], proxy_url)
	end

	test "returns media url when proxy is enabled but media url is whitelisted", %{
	conn: conn,
	image: image
	} do
	media_url = "https://media.pleroma.social"
	Pleroma.Config.put([Pleroma.Upload, :base_url], media_url)

	Pleroma.Config.put([:media_proxy, :enabled], true)
	Pleroma.Config.put([:media_proxy, :base_url], "https://cache.pleroma.social")
	Pleroma.Config.put([:media_proxy, :whitelist], ["media.pleroma.social"])

	media =
	conn
	\|> post("/api/v1/media", %{"file" => image})
	\|> json_response(:ok)

	assert String.starts_with?(media["url"], media_url)
	end
	end

	describe "locked accounts" do
	test "/api/v1/follow_requests works" do
	user = insert(:user, %{info: %User.Info{locked: true}})
	other_user = insert(:user)

	{:ok, _activity} = ActivityPub.follow(other_user, user)

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	assert User.following?(other_user, user) == false

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> get("/api/v1/follow_requests")

	assert [relationship] = json_response(conn, 200)
	assert to_string(other_user.id) == relationship["id"]
	end

	test "/api/v1/follow_requests/:id/authorize works" do
	user = insert(:user, %{info: %User.Info{locked: true}})
	other_user = insert(:user)

	{:ok, _activity} = ActivityPub.follow(other_user, user)

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	assert User.following?(other_user, user) == false

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/follow_requests/#{other_user.id}/authorize")

	assert relationship = json_response(conn, 200)
	assert to_string(other_user.id) == relationship["id"]

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	assert User.following?(other_user, user) == true
	end

	test "verify_credentials", %{conn: conn} do
	user = insert(:user, %{info: %User.Info{default_scope: "private"}})

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/verify_credentials")

	assert %{"id" => id, "source" => %{"privacy" => "private"}} = json_response(conn, 200)
	assert id == to_string(user.id)
	end

	test "/api/v1/follow_requests/:id/reject works" do
	user = insert(:user, %{info: %User.Info{locked: true}})
	other_user = insert(:user)

	{:ok, _activity} = ActivityPub.follow(other_user, user)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/follow_requests/#{other_user.id}/reject")

	assert relationship = json_response(conn, 200)
	assert to_string(other_user.id) == relationship["id"]

	user = User.get_cached_by_id(user.id)
	other_user = User.get_cached_by_id(other_user.id)

	assert User.following?(other_user, user) == false
	end
	end

	test "account fetching", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}")

	assert %{"id" => id} = json_response(conn, 200)
	assert id == to_string(user.id)

	conn =
	build_conn()
	\|> get("/api/v1/accounts/-1")

	assert %{"error" => "Can't find user"} = json_response(conn, 404)
	end

	test "account fetching also works nickname", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.nickname}")

	assert %{"id" => id} = json_response(conn, 200)
	assert id == user.id
	end

	test "mascot upload", %{conn: conn} do
	user = insert(:user)

	non_image_file = %Plug.Upload{
	content_type: "audio/mpeg",
	path: Path.absname("test/fixtures/sound.mp3"),
	filename: "sound.mp3"
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/v1/pleroma/mascot", %{"file" => non_image_file})

	assert json_response(conn, 415)

	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> put("/api/v1/pleroma/mascot", %{"file" => file})

	assert %{"id" => _, "type" => image} = json_response(conn, 200)
	end

	test "mascot retrieving", %{conn: conn} do
	user = insert(:user)
	# When user hasn't set a mascot, we should just get pleroma tan back
	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/pleroma/mascot")

	assert %{"url" => url} = json_response(conn, 200)
	assert url =~ "pleroma-fox-tan-smol"

	# When a user sets their mascot, we should get that back
	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> put("/api/v1/pleroma/mascot", %{"file" => file})

	assert json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> get("/api/v1/pleroma/mascot")

	assert %{"url" => url, "type" => "image"} = json_response(conn, 200)
	assert url =~ "an_image"
	end

	test "hashtag timeline", %{conn: conn} do
	following = insert(:user)

	capture_log(fn ->
	{:ok, activity} = TwitterAPI.create_status(following, %{"status" => "test #2hu"})

	{:ok, [_activity]} =
	OStatus.fetch_activity_from_url("https://shitposter.club/notice/2827873")

	nconn =
	conn
	\|> get("/api/v1/timelines/tag/2hu")

	assert [%{"id" => id}] = json_response(nconn, 200)

	assert id == to_string(activity.id)

	# works for different capitalization too
	nconn =
	conn
	\|> get("/api/v1/timelines/tag/2HU")

	assert [%{"id" => id}] = json_response(nconn, 200)

	assert id == to_string(activity.id)
	end)
	end

	test "multi-hashtag timeline", %{conn: conn} do
	user = insert(:user)

	{:ok, activity_test} = CommonAPI.post(user, %{"status" => "#test"})
	{:ok, activity_test1} = CommonAPI.post(user, %{"status" => "#test #test1"})
	{:ok, activity_none} = CommonAPI.post(user, %{"status" => "#test #none"})

	any_test =
	conn
	\|> get("/api/v1/timelines/tag/test", %{"any" => ["test1"]})

	[status_none, status_test1, status_test] = json_response(any_test, 200)

	assert to_string(activity_test.id) == status_test["id"]
	assert to_string(activity_test1.id) == status_test1["id"]
	assert to_string(activity_none.id) == status_none["id"]

	restricted_test =
	conn
	\|> get("/api/v1/timelines/tag/test", %{"all" => ["test1"], "none" => ["none"]})

	assert [status_test1] == json_response(restricted_test, 200)

	all_test = conn \|> get("/api/v1/timelines/tag/test", %{"all" => ["none"]})

	assert [status_none] == json_response(all_test, 200)
	end

	test "getting followers", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{other_user.id}/followers")

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(user.id)
	end

	test "getting followers, hide_followers", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user, %{info: %{hide_followers: true}})
	{:ok, _user} = User.follow(user, other_user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{other_user.id}/followers")

	assert [] == json_response(conn, 200)
	end

	test "getting followers, hide_followers, same user requesting", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user, %{info: %{hide_followers: true}})
	{:ok, _user} = User.follow(user, other_user)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> get("/api/v1/accounts/#{other_user.id}/followers")

	refute [] == json_response(conn, 200)
	end

	test "getting followers, pagination", %{conn: conn} do
	user = insert(:user)
	follower1 = insert(:user)
	follower2 = insert(:user)
	follower3 = insert(:user)
	{:ok, _} = User.follow(follower1, user)
	{:ok, _} = User.follow(follower2, user)
	{:ok, _} = User.follow(follower3, user)

	conn =
	conn
	\|> assign(:user, user)

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/followers?since_id=#{follower1.id}")

	assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
	assert id3 == follower3.id
	assert id2 == follower2.id

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/followers?max_id=#{follower3.id}")

	assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
	assert id2 == follower2.id
	assert id1 == follower1.id

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/followers?limit=1&max_id=#{follower3.id}")

	assert [%{"id" => id2}] = json_response(res_conn, 200)
	assert id2 == follower2.id

	assert [link_header] = get_resp_header(res_conn, "link")
	assert link_header =~ ~r/min_id=#{follower2.id}/
	assert link_header =~ ~r/max_id=#{follower2.id}/
	end

	test "getting following", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following")

	assert [%{"id" => id}] = json_response(conn, 200)
	assert id == to_string(other_user.id)
	end

	test "getting following, hide_follows", %{conn: conn} do
	user = insert(:user, %{info: %{hide_follows: true}})
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following")

	assert [] == json_response(conn, 200)
	end

	test "getting following, hide_follows, same user requesting", %{conn: conn} do
	user = insert(:user, %{info: %{hide_follows: true}})
	other_user = insert(:user)
	{:ok, user} = User.follow(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/#{user.id}/following")

	refute [] == json_response(conn, 200)
	end

	test "getting following, pagination", %{conn: conn} do
	user = insert(:user)
	following1 = insert(:user)
	following2 = insert(:user)
	following3 = insert(:user)
	{:ok, _} = User.follow(user, following1)
	{:ok, _} = User.follow(user, following2)
	{:ok, _} = User.follow(user, following3)

	conn =
	conn
	\|> assign(:user, user)

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following?since_id=#{following1.id}")

	assert [%{"id" => id3}, %{"id" => id2}] = json_response(res_conn, 200)
	assert id3 == following3.id
	assert id2 == following2.id

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following?max_id=#{following3.id}")

	assert [%{"id" => id2}, %{"id" => id1}] = json_response(res_conn, 200)
	assert id2 == following2.id
	assert id1 == following1.id

	res_conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}/following?limit=1&max_id=#{following3.id}")

	assert [%{"id" => id2}] = json_response(res_conn, 200)
	assert id2 == following2.id

	assert [link_header] = get_resp_header(res_conn, "link")
	assert link_header =~ ~r/min_id=#{following2.id}/
	assert link_header =~ ~r/max_id=#{following2.id}/
	end

	test "following / unfollowing a user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/follow")

	assert %{"id" => _id, "following" => true} = json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/unfollow")

	assert %{"id" => _id, "following" => false} = json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/follows", %{"uri" => other_user.nickname})

	assert %{"id" => id} = json_response(conn, 200)
	assert id == to_string(other_user.id)
	end

	test "following without reblogs" do
	follower = insert(:user)
	followed = insert(:user)
	other_user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, follower)
	\|> post("/api/v1/accounts/#{followed.id}/follow?reblogs=false")

	assert %{"showing_reblogs" => false} = json_response(conn, 200)

	{:ok, activity} = CommonAPI.post(other_user, %{"status" => "hey"})
	{:ok, reblog, _} = CommonAPI.repeat(activity.id, followed)

	conn =
	build_conn()
	\|> assign(:user, User.get_cached_by_id(follower.id))
	\|> get("/api/v1/timelines/home")

	assert [] == json_response(conn, 200)

	conn =
	build_conn()
	\|> assign(:user, follower)
	\|> post("/api/v1/accounts/#{followed.id}/follow?reblogs=true")

	assert %{"showing_reblogs" => true} = json_response(conn, 200)

	conn =
	build_conn()
	\|> assign(:user, User.get_cached_by_id(follower.id))
	\|> get("/api/v1/timelines/home")

	expected_activity_id = reblog.id
	assert [%{"id" => ^expected_activity_id}] = json_response(conn, 200)
	end

	test "following / unfollowing errors" do
	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, user)

	# self follow
	conn_res = post(conn, "/api/v1/accounts/#{user.id}/follow")
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# self unfollow
	user = User.get_cached_by_id(user.id)
	conn_res = post(conn, "/api/v1/accounts/#{user.id}/unfollow")
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# self follow via uri
	user = User.get_cached_by_id(user.id)
	conn_res = post(conn, "/api/v1/follows", %{"uri" => user.nickname})
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# follow non existing user
	conn_res = post(conn, "/api/v1/accounts/doesntexist/follow")
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# follow non existing user via uri
	conn_res = post(conn, "/api/v1/follows", %{"uri" => "doesntexist"})
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)

	# unfollow non existing user
	conn_res = post(conn, "/api/v1/accounts/doesntexist/unfollow")
	assert %{"error" => "Record not found"} = json_response(conn_res, 404)
	end

	test "muting / unmuting a user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/mute")

	assert %{"id" => _id, "muting" => true} = json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/unmute")

	assert %{"id" => _id, "muting" => false} = json_response(conn, 200)
	end

	test "subscribing / unsubscribing to a user", %{conn: conn} do
	user = insert(:user)
	subscription_target = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/pleroma/accounts/#{subscription_target.id}/subscribe")

	assert %{"id" => _id, "subscribing" => true} = json_response(conn, 200)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/pleroma/accounts/#{subscription_target.id}/unsubscribe")

	assert %{"id" => _id, "subscribing" => false} = json_response(conn, 200)
	end

	test "getting a list of mutes", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, user} = User.mute(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/mutes")

	other_user_id = to_string(other_user.id)
	assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
	end

	test "blocking / unblocking a user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/block")

	assert %{"id" => _id, "blocking" => true} = json_response(conn, 200)

	user = User.get_cached_by_id(user.id)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> post("/api/v1/accounts/#{other_user.id}/unblock")

	assert %{"id" => _id, "blocking" => false} = json_response(conn, 200)
	end

	test "getting a list of blocks", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, user} = User.block(user, other_user)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/blocks")

	other_user_id = to_string(other_user.id)
	assert [%{"id" => ^other_user_id}] = json_response(conn, 200)
	end

	test "blocking / unblocking a domain", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user, %{ap_id: "https://dogwhistle.zone/@pundit"})

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/domain_blocks", %{"domain" => "dogwhistle.zone"})

	assert %{} = json_response(conn, 200)
	user = User.get_cached_by_ap_id(user.ap_id)
	assert User.blocks?(user, other_user)

	conn =
	build_conn()
	\|> assign(:user, user)
	\|> delete("/api/v1/domain_blocks", %{"domain" => "dogwhistle.zone"})

	assert %{} = json_response(conn, 200)
	user = User.get_cached_by_ap_id(user.ap_id)
	refute User.blocks?(user, other_user)
	end

	test "getting a list of domain blocks", %{conn: conn} do
	user = insert(:user)

	{:ok, user} = User.block_domain(user, "bad.site")
	{:ok, user} = User.block_domain(user, "even.worse.site")

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/domain_blocks")

	domain_blocks = json_response(conn, 200)

	assert "bad.site" in domain_blocks
	assert "even.worse.site" in domain_blocks
	end

	test "unimplemented follow_requests, blocks, domain blocks" do
	user = insert(:user)

	["blocks", "domain_blocks", "follow_requests"]
	\|> Enum.each(fn endpoint ->
	conn =
	build_conn()
	\|> assign(:user, user)
	\|> get("/api/v1/#{endpoint}")

	assert [] = json_response(conn, 200)
	end)
	end

	test "returns the favorites of a user", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, _} = CommonAPI.post(other_user, %{"status" => "bla"})
	{:ok, activity} = CommonAPI.post(other_user, %{"status" => "traps are happy"})

	{:ok, _, _} = CommonAPI.favorite(activity.id, user)

	first_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/favourites")

	assert [status] = json_response(first_conn, 200)
	assert status["id"] == to_string(activity.id)

	assert [{"link", _link_header}] =
	Enum.filter(first_conn.resp_headers, fn element -> match?({"link", _}, element) end)

	# Honours query params
	{:ok, second_activity} =
	CommonAPI.post(other_user, %{
	"status" =>
	"Trees Are Never Sad Look At Them Every Once In Awhile They're Quite Beautiful."
	})

	{:ok, _, _} = CommonAPI.favorite(second_activity.id, user)

	last_like = status["id"]

	second_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/favourites?since_id=#{last_like}")

	assert [second_status] = json_response(second_conn, 200)
	assert second_status["id"] == to_string(second_activity.id)

	third_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/favourites?limit=0")

	assert [] = json_response(third_conn, 200)
	end

	describe "getting favorites timeline of specified user" do
	setup do
	[current_user, user] = insert_pair(:user, %{info: %{hide_favorites: false}})
	[current_user: current_user, user: user]
	end

	test "returns list of statuses favorited by specified user", %{
	conn: conn,
	current_user: current_user,
	user: user
	} do
	[activity \| _] = insert_pair(:note_activity)
	CommonAPI.favorite(activity.id, user)

	response =
	conn
	\|> assign(:user, current_user)
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites")
	\|> json_response(:ok)

	[like] = response

	assert length(response) == 1
	assert like["id"] == activity.id
	end

	test "returns favorites for specified user_id when user is not logged in", %{
	conn: conn,
	user: user
	} do
	activity = insert(:note_activity)
	CommonAPI.favorite(activity.id, user)

	response =
	conn
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites")
	\|> json_response(:ok)

	assert length(response) == 1
	end

	test "returns favorited DM only when user is logged in and he is one of recipients", %{
	conn: conn,
	current_user: current_user,
	user: user
	} do
	{:ok, direct} =
	CommonAPI.post(current_user, %{
	"status" => "Hi @#{user.nickname}!",
	"visibility" => "direct"
	})

	CommonAPI.favorite(direct.id, user)

	response =
	conn
	\|> assign(:user, current_user)
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites")
	\|> json_response(:ok)

	assert length(response) == 1

	anonymous_response =
	conn
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites")
	\|> json_response(:ok)

	assert Enum.empty?(anonymous_response)
	end

	test "does not return others' favorited DM when user is not one of recipients", %{
	conn: conn,
	current_user: current_user,
	user: user
	} do
	user_two = insert(:user)

	{:ok, direct} =
	CommonAPI.post(user_two, %{
	"status" => "Hi @#{user.nickname}!",
	"visibility" => "direct"
	})

	CommonAPI.favorite(direct.id, user)

	response =
	conn
	\|> assign(:user, current_user)
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites")
	\|> json_response(:ok)

	assert Enum.empty?(response)
	end

	test "paginates favorites using since_id and max_id", %{
	conn: conn,
	current_user: current_user,
	user: user
	} do
	activities = insert_list(10, :note_activity)

	Enum.each(activities, fn activity ->
	CommonAPI.favorite(activity.id, user)
	end)

	third_activity = Enum.at(activities, 2)
	seventh_activity = Enum.at(activities, 6)

	response =
	conn
	\|> assign(:user, current_user)
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites", %{
	since_id: third_activity.id,
	max_id: seventh_activity.id
	})
	\|> json_response(:ok)

	assert length(response) == 3
	refute third_activity in response
	refute seventh_activity in response
	end

	test "limits favorites using limit parameter", %{
	conn: conn,
	current_user: current_user,
	user: user
	} do
	7
	\|> insert_list(:note_activity)
	\|> Enum.each(fn activity ->
	CommonAPI.favorite(activity.id, user)
	end)

	response =
	conn
	\|> assign(:user, current_user)
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites", %{limit: "3"})
	\|> json_response(:ok)

	assert length(response) == 3
	end

	test "returns empty response when user does not have any favorited statuses", %{
	conn: conn,
	current_user: current_user,
	user: user
	} do
	response =
	conn
	\|> assign(:user, current_user)
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites")
	\|> json_response(:ok)

	assert Enum.empty?(response)
	end

	test "returns 404 error when specified user is not exist", %{conn: conn} do
	conn = get(conn, "/api/v1/pleroma/accounts/test/favourites")

	assert json_response(conn, 404) == %{"error" => "Record not found"}
	end

	test "returns 403 error when user has hidden own favorites", %{
	conn: conn,
	current_user: current_user
	} do
	user = insert(:user, %{info: %{hide_favorites: true}})
	activity = insert(:note_activity)
	CommonAPI.favorite(activity.id, user)

	conn =
	conn
	\|> assign(:user, current_user)
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites")

	assert json_response(conn, 403) == %{"error" => "Can't get favorites"}
	end

	test "hides favorites for new users by default", %{conn: conn, current_user: current_user} do
	user = insert(:user)
	activity = insert(:note_activity)
	CommonAPI.favorite(activity.id, user)

	conn =
	conn
	\|> assign(:user, current_user)
	\|> get("/api/v1/pleroma/accounts/#{user.id}/favourites")

	assert user.info.hide_favorites
	assert json_response(conn, 403) == %{"error" => "Can't get favorites"}
	end
	end

	test "get instance information", %{conn: conn} do
	conn = get(conn, "/api/v1/instance")
	assert result = json_response(conn, 200)

	email = Pleroma.Config.get([:instance, :email])
	# Note: not checking for "max_toot_chars" since it's optional
	assert %{
	"uri" => _,
	"title" => _,
	"description" => _,
	"version" => _,
	"email" => from_config_email,
	"urls" => %{
	"streaming_api" => _
	},
	"stats" => _,
	"thumbnail" => _,
	"languages" => _,
	"registrations" => _,
	"poll_limits" => _
	} = result

	assert email == from_config_email
	end

	test "get instance stats", %{conn: conn} do
	user = insert(:user, %{local: true})

	user2 = insert(:user, %{local: true})
	{:ok, _user2} = User.deactivate(user2, !user2.info.deactivated)

	insert(:user, %{local: false, nickname: "u@peer1.com"})
	insert(:user, %{local: false, nickname: "u@peer2.com"})

	{:ok, _} = TwitterAPI.create_status(user, %{"status" => "cofe"})

	# Stats should count users with missing or nil `info.deactivated` value
	user = User.get_cached_by_id(user.id)
	info_change = Changeset.change(user.info, %{deactivated: nil})

	{:ok, _user} =
	user
	\|> Changeset.change()
	\|> Changeset.put_embed(:info, info_change)
	\|> User.update_and_set_cache()

	Pleroma.Stats.update_stats()

	conn = get(conn, "/api/v1/instance")

	assert result = json_response(conn, 200)

	stats = result["stats"]

	assert stats
	assert stats["user_count"] == 1
	assert stats["status_count"] == 1
	assert stats["domain_count"] == 2
	end

	test "get peers", %{conn: conn} do
	insert(:user, %{local: false, nickname: "u@peer1.com"})
	insert(:user, %{local: false, nickname: "u@peer2.com"})

	Pleroma.Stats.update_stats()

	conn = get(conn, "/api/v1/instance/peers")

	assert result = json_response(conn, 200)

	assert ["peer1.com", "peer2.com"] == Enum.sort(result)
	end

	test "put settings", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/web/settings", %{"data" => %{"programming" => "socks"}})

	assert _result = json_response(conn, 200)

	user = User.get_cached_by_ap_id(user.ap_id)
	assert user.info.settings == %{"programming" => "socks"}
	end

	describe "pinned statuses" do
	setup do
	Pleroma.Config.put([:instance, :max_pinned_statuses], 1)

	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})

	[user: user, activity: activity]
	end

	test "returns pinned statuses", %{conn: conn, user: user, activity: activity} do
	{:ok, _} = CommonAPI.pin(activity.id, user)

	result =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
	\|> json_response(200)

	id_str = to_string(activity.id)

	assert [%{"id" => ^id_str, "pinned" => true}] = result
	end

	test "pin status", %{conn: conn, user: user, activity: activity} do
	id_str = to_string(activity.id)

	assert %{"id" => ^id_str, "pinned" => true} =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/pin")
	\|> json_response(200)

	assert [%{"id" => ^id_str, "pinned" => true}] =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
	\|> json_response(200)
	end

	test "unpin status", %{conn: conn, user: user, activity: activity} do
	{:ok, _} = CommonAPI.pin(activity.id, user)

	id_str = to_string(activity.id)
	user = refresh_record(user)

	assert %{"id" => ^id_str, "pinned" => false} =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/unpin")
	\|> json_response(200)

	assert [] =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
	\|> json_response(200)
	end

	test "max pinned statuses", %{conn: conn, user: user, activity: activity_one} do
	{:ok, activity_two} = CommonAPI.post(user, %{"status" => "HI!!!"})

	id_str_one = to_string(activity_one.id)

	assert %{"id" => ^id_str_one, "pinned" => true} =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{id_str_one}/pin")
	\|> json_response(200)

	user = refresh_record(user)

	assert %{"error" => "You have already pinned the maximum number of statuses"} =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity_two.id}/pin")
	\|> json_response(400)
	end
	end

	describe "cards" do
	setup do
	Pleroma.Config.put([:rich_media, :enabled], true)

	on_exit(fn ->
	Pleroma.Config.put([:rich_media, :enabled], false)
	end)

	user = insert(:user)
	%{user: user}
	end

	test "returns rich-media card", %{conn: conn, user: user} do
	{:ok, activity} = CommonAPI.post(user, %{"status" => "https://example.com/ogp"})

	card_data = %{
	"image" => "http://ia.media-imdb.com/images/rock.jpg",
	"provider_name" => "www.imdb.com",
	"provider_url" => "http://www.imdb.com",
	"title" => "The Rock",
	"type" => "link",
	"url" => "http://www.imdb.com/title/tt0117500/",
	"description" =>
	"Directed by Michael Bay. With Sean Connery, Nicolas Cage, Ed Harris, John Spencer.",
	"pleroma" => %{
	"opengraph" => %{
	"image" => "http://ia.media-imdb.com/images/rock.jpg",
	"title" => "The Rock",
	"type" => "video.movie",
	"url" => "http://www.imdb.com/title/tt0117500/",
	"description" =>
	"Directed by Michael Bay. With Sean Connery, Nicolas Cage, Ed Harris, John Spencer."
	}
	}
	}

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/card")
	\|> json_response(200)

	assert response == card_data

	# works with private posts
	{:ok, activity} =
	CommonAPI.post(user, %{"status" => "https://example.com/ogp", "visibility" => "direct"})

	response_two =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/statuses/#{activity.id}/card")
	\|> json_response(200)

	assert response_two == card_data
	end

	test "replaces missing description with an empty string", %{conn: conn, user: user} do
	{:ok, activity} =
	CommonAPI.post(user, %{"status" => "https://example.com/ogp-missing-data"})

	response =
	conn
	\|> get("/api/v1/statuses/#{activity.id}/card")
	\|> json_response(:ok)

	assert response == %{
	"type" => "link",
	"title" => "Pleroma",
	"description" => "",
	"image" => nil,
	"provider_name" => "pleroma.social",
	"provider_url" => "https://pleroma.social",
	"url" => "https://pleroma.social/",
	"pleroma" => %{
	"opengraph" => %{
	"title" => "Pleroma",
	"type" => "website",
	"url" => "https://pleroma.social/"
	}
	}
	}
	end
	end

	test "bookmarks" do
	user = insert(:user)
	for_user = insert(:user)

	{:ok, activity1} =
	CommonAPI.post(user, %{
	"status" => "heweoo?"
	})

	{:ok, activity2} =
	CommonAPI.post(user, %{
	"status" => "heweoo!"
	})

	response1 =
	build_conn()
	\|> assign(:user, for_user)
	\|> post("/api/v1/statuses/#{activity1.id}/bookmark")

	assert json_response(response1, 200)["bookmarked"] == true

	response2 =
	build_conn()
	\|> assign(:user, for_user)
	\|> post("/api/v1/statuses/#{activity2.id}/bookmark")

	assert json_response(response2, 200)["bookmarked"] == true

	bookmarks =
	build_conn()
	\|> assign(:user, for_user)
	\|> get("/api/v1/bookmarks")

	assert [json_response(response2, 200), json_response(response1, 200)] ==
	json_response(bookmarks, 200)

	response1 =
	build_conn()
	\|> assign(:user, for_user)
	\|> post("/api/v1/statuses/#{activity1.id}/unbookmark")

	assert json_response(response1, 200)["bookmarked"] == false

	bookmarks =
	build_conn()
	\|> assign(:user, for_user)
	\|> get("/api/v1/bookmarks")

	assert [json_response(response2, 200)] == json_response(bookmarks, 200)
	end

	describe "conversation muting" do
	setup do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{"status" => "HIE"})

	[user: user, activity: activity]
	end

	test "mute conversation", %{conn: conn, user: user, activity: activity} do
	id_str = to_string(activity.id)

	assert %{"id" => ^id_str, "muted" => true} =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/mute")
	\|> json_response(200)
	end

	test "unmute conversation", %{conn: conn, user: user, activity: activity} do
	{:ok, _} = CommonAPI.add_mute(user, activity)

	id_str = to_string(activity.id)
	user = refresh_record(user)

	assert %{"id" => ^id_str, "muted" => false} =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses/#{activity.id}/unmute")
	\|> json_response(200)
	end
	end

	describe "reports" do
	setup do
	reporter = insert(:user)
	target_user = insert(:user)

	{:ok, activity} = CommonAPI.post(target_user, %{"status" => "foobar"})

	[reporter: reporter, target_user: target_user, activity: activity]
	end

	test "submit a basic report", %{conn: conn, reporter: reporter, target_user: target_user} do
	assert %{"action_taken" => false, "id" => _} =
	conn
	\|> assign(:user, reporter)
	\|> post("/api/v1/reports", %{"account_id" => target_user.id})
	\|> json_response(200)
	end

	test "submit a report with statuses and comment", %{
	conn: conn,
	reporter: reporter,
	target_user: target_user,
	activity: activity
	} do
	assert %{"action_taken" => false, "id" => _} =
	conn
	\|> assign(:user, reporter)
	\|> post("/api/v1/reports", %{
	"account_id" => target_user.id,
	"status_ids" => [activity.id],
	"comment" => "bad status!"
	})
	\|> json_response(200)
	end

	test "account_id is required", %{
	conn: conn,
	reporter: reporter,
	activity: activity
	} do
	assert %{"error" => "Valid `account_id` required"} =
	conn
	\|> assign(:user, reporter)
	\|> post("/api/v1/reports", %{"status_ids" => [activity.id]})
	\|> json_response(400)
	end

	test "comment must be up to the size specified in the config", %{
	conn: conn,
	reporter: reporter,
	target_user: target_user
	} do
	max_size = Pleroma.Config.get([:instance, :max_report_comment_size], 1000)
	comment = String.pad_trailing("a", max_size + 1, "a")

	error = %{"error" => "Comment must be up to #{max_size} characters"}

	assert ^error =
	conn
	\|> assign(:user, reporter)
	\|> post("/api/v1/reports", %{"account_id" => target_user.id, "comment" => comment})
	\|> json_response(400)
	end
	end

	describe "link headers" do
	test "preserves parameters in link headers", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity1} =
	CommonAPI.post(other_user, %{
	"status" => "hi @#{user.nickname}",
	"visibility" => "public"
	})

	{:ok, activity2} =
	CommonAPI.post(other_user, %{
	"status" => "hi @#{user.nickname}",
	"visibility" => "public"
	})

	notification1 = Repo.get_by(Notification, activity_id: activity1.id)
	notification2 = Repo.get_by(Notification, activity_id: activity2.id)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/notifications", %{media_only: true})

	assert [link_header] = get_resp_header(conn, "link")
	assert link_header =~ ~r/media_only=true/
	assert link_header =~ ~r/min_id=#{notification2.id}/
	assert link_header =~ ~r/max_id=#{notification1.id}/
	end
	end

	test "accounts fetches correct account for nicknames beginning with numbers", %{conn: conn} do
	# Need to set an old-style integer ID to reproduce the problem
	# (these are no longer assigned to new accounts but were preserved
	# for existing accounts during the migration to flakeIDs)
	user_one = insert(:user, %{id: 1212})
	user_two = insert(:user, %{nickname: "#{user_one.id}garbage"})

	resp_one =
	conn
	\|> get("/api/v1/accounts/#{user_one.id}")

	resp_two =
	conn
	\|> get("/api/v1/accounts/#{user_two.nickname}")

	resp_three =
	conn
	\|> get("/api/v1/accounts/#{user_two.id}")

	acc_one = json_response(resp_one, 200)
	acc_two = json_response(resp_two, 200)
	acc_three = json_response(resp_three, 200)
	refute acc_one == acc_two
	assert acc_two == acc_three
	end

	describe "custom emoji" do
	test "with tags", %{conn: conn} do
	[emoji \| _body] =
	conn
	\|> get("/api/v1/custom_emojis")
	\|> json_response(200)

	assert Map.has_key?(emoji, "shortcode")
	assert Map.has_key?(emoji, "static_url")
	assert Map.has_key?(emoji, "tags")
	assert is_list(emoji["tags"])
	assert Map.has_key?(emoji, "category")
	assert Map.has_key?(emoji, "url")
	assert Map.has_key?(emoji, "visible_in_picker")
	end
	end

	describe "index/2 redirections" do
	setup %{conn: conn} do
	session_opts = [
	store: :cookie,
	key: "_test",
	signing_salt: "cooldude"
	]

	conn =
	conn
	\|> Plug.Session.call(Plug.Session.init(session_opts))
	\|> fetch_session()

	test_path = "/web/statuses/test"
	%{conn: conn, path: test_path}
	end

	test "redirects not logged-in users to the login page", %{conn: conn, path: path} do
	conn = get(conn, path)

	assert conn.status == 302
	assert redirected_to(conn) == "/web/login"
	end

	test "does not redirect logged in users to the login page", %{conn: conn, path: path} do
	token = insert(:oauth_token)

	conn =
	conn
	\|> assign(:user, token.user)
	\|> put_session(:oauth_token, token.token)
	\|> get(path)

	assert conn.status == 200
	end

	test "saves referer path to session", %{conn: conn, path: path} do
	conn = get(conn, path)
	return_to = Plug.Conn.get_session(conn, :return_to)

	assert return_to == path
	end

	test "redirects to the saved path after log in", %{conn: conn, path: path} do
	app = insert(:oauth_app, client_name: "Mastodon-Local", redirect_uris: ".")
	auth = insert(:oauth_authorization, app: app)

	conn =
	conn
	\|> put_session(:return_to, path)
	\|> get("/web/login", %{code: auth.token})

	assert conn.status == 302
	assert redirected_to(conn) == path
	end

	test "redirects to the getting-started page when referer is not present", %{conn: conn} do
	app = insert(:oauth_app, client_name: "Mastodon-Local", redirect_uris: ".")
	auth = insert(:oauth_authorization, app: app)

	conn = get(conn, "/web/login", %{code: auth.token})

	assert conn.status == 302
	assert redirected_to(conn) == "/web/getting-started"
	end
	end

	describe "scheduled activities" do
	test "creates a scheduled activity", %{conn: conn} do
	user = insert(:user)
	scheduled_at = NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(120), :millisecond)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{
	"status" => "scheduled",
	"scheduled_at" => scheduled_at
	})

	assert %{"scheduled_at" => expected_scheduled_at} = json_response(conn, 200)
	assert expected_scheduled_at == Pleroma.Web.CommonAPI.Utils.to_masto_date(scheduled_at)
	assert [] == Repo.all(Activity)
	end

	test "creates a scheduled activity with a media attachment", %{conn: conn} do
	user = insert(:user)
	scheduled_at = NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(120), :millisecond)

	file = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, upload} = ActivityPub.upload(file, actor: user.ap_id)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{
	"media_ids" => [to_string(upload.id)],
	"status" => "scheduled",
	"scheduled_at" => scheduled_at
	})

	assert %{"media_attachments" => [media_attachment]} = json_response(conn, 200)
	assert %{"type" => "image"} = media_attachment
	end

	test "skips the scheduling and creates the activity if scheduled_at is earlier than 5 minutes from now",
	%{conn: conn} do
	user = insert(:user)

	scheduled_at =
	NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(5) - 1, :millisecond)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{
	"status" => "not scheduled",
	"scheduled_at" => scheduled_at
	})

	assert %{"content" => "not scheduled"} = json_response(conn, 200)
	assert [] == Repo.all(ScheduledActivity)
	end

	test "returns error when daily user limit is exceeded", %{conn: conn} do
	user = insert(:user)

	today =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.minutes(6), :millisecond)
	\|> NaiveDateTime.to_iso8601()

	attrs = %{params: %{}, scheduled_at: today}
	{:ok, _} = ScheduledActivity.create(user, attrs)
	{:ok, _} = ScheduledActivity.create(user, attrs)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{"status" => "scheduled", "scheduled_at" => today})

	assert %{"error" => "daily limit exceeded"} == json_response(conn, 422)
	end

	test "returns error when total user limit is exceeded", %{conn: conn} do
	user = insert(:user)

	today =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.minutes(6), :millisecond)
	\|> NaiveDateTime.to_iso8601()

	tomorrow =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.hours(36), :millisecond)
	\|> NaiveDateTime.to_iso8601()

	attrs = %{params: %{}, scheduled_at: today}
	{:ok, _} = ScheduledActivity.create(user, attrs)
	{:ok, _} = ScheduledActivity.create(user, attrs)
	{:ok, _} = ScheduledActivity.create(user, %{params: %{}, scheduled_at: tomorrow})

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/v1/statuses", %{"status" => "scheduled", "scheduled_at" => tomorrow})

	assert %{"error" => "total limit exceeded"} == json_response(conn, 422)
	end

	test "shows scheduled activities", %{conn: conn} do
	user = insert(:user)
	scheduled_activity_id1 = insert(:scheduled_activity, user: user).id \|> to_string()
	scheduled_activity_id2 = insert(:scheduled_activity, user: user).id \|> to_string()
	scheduled_activity_id3 = insert(:scheduled_activity, user: user).id \|> to_string()
	scheduled_activity_id4 = insert(:scheduled_activity, user: user).id \|> to_string()

	conn =
	conn
	\|> assign(:user, user)

	# min_id
	conn_res =
	conn
	\|> get("/api/v1/scheduled_statuses?limit=2&min_id=#{scheduled_activity_id1}")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^scheduled_activity_id3}, %{"id" => ^scheduled_activity_id2}] = result

	# since_id
	conn_res =
	conn
	\|> get("/api/v1/scheduled_statuses?limit=2&since_id=#{scheduled_activity_id1}")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^scheduled_activity_id4}, %{"id" => ^scheduled_activity_id3}] = result

	# max_id
	conn_res =
	conn
	\|> get("/api/v1/scheduled_statuses?limit=2&max_id=#{scheduled_activity_id4}")

	result = json_response(conn_res, 200)
	assert [%{"id" => ^scheduled_activity_id3}, %{"id" => ^scheduled_activity_id2}] = result
	end

	test "shows a scheduled activity", %{conn: conn} do
	user = insert(:user)
	scheduled_activity = insert(:scheduled_activity, user: user)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/scheduled_statuses/#{scheduled_activity.id}")

	assert %{"id" => scheduled_activity_id} = json_response(res_conn, 200)
	assert scheduled_activity_id == scheduled_activity.id \|> to_string()

	res_conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/scheduled_statuses/404")

	assert %{"error" => "Record not found"} = json_response(res_conn, 404)
	end

	test "updates a scheduled activity", %{conn: conn} do
	user = insert(:user)
	scheduled_activity = insert(:scheduled_activity, user: user)

	new_scheduled_at =
	NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(120), :millisecond)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/v1/scheduled_statuses/#{scheduled_activity.id}", %{
	scheduled_at: new_scheduled_at
	})

	assert %{"scheduled_at" => expected_scheduled_at} = json_response(res_conn, 200)
	assert expected_scheduled_at == Pleroma.Web.CommonAPI.Utils.to_masto_date(new_scheduled_at)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/v1/scheduled_statuses/404", %{scheduled_at: new_scheduled_at})

	assert %{"error" => "Record not found"} = json_response(res_conn, 404)
	end

	test "deletes a scheduled activity", %{conn: conn} do
	user = insert(:user)
	scheduled_activity = insert(:scheduled_activity, user: user)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> delete("/api/v1/scheduled_statuses/#{scheduled_activity.id}")

	assert %{} = json_response(res_conn, 200)
	assert nil == Repo.get(ScheduledActivity, scheduled_activity.id)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> delete("/api/v1/scheduled_statuses/#{scheduled_activity.id}")

	assert %{"error" => "Record not found"} = json_response(res_conn, 404)
	end
	end

	test "Repeated posts that are replies incorrectly have in_reply_to_id null", %{conn: conn} do
	user1 = insert(:user)
	user2 = insert(:user)
	user3 = insert(:user)

	{:ok, replied_to} = TwitterAPI.create_status(user1, %{"status" => "cofe"})

	# Reply to status from another user
	conn1 =
	conn
	\|> assign(:user, user2)
	\|> post("/api/v1/statuses", %{"status" => "xD", "in_reply_to_id" => replied_to.id})

	assert %{"content" => "xD", "id" => id} = json_response(conn1, 200)

	activity = Activity.get_by_id_with_object(id)

	assert Object.normalize(activity).data["inReplyTo"] == Object.normalize(replied_to).data["id"]
	assert Activity.get_in_reply_to_activity(activity).id == replied_to.id

	# Reblog from the third user
	conn2 =
	conn
	\|> assign(:user, user3)
	\|> post("/api/v1/statuses/#{activity.id}/reblog")

	assert %{"reblog" => %{"id" => id, "reblogged" => true, "reblogs_count" => 1}} =
	json_response(conn2, 200)

	assert to_string(activity.id) == id

	# Getting third user status
	conn3 =
	conn
	\|> assign(:user, user3)
	\|> get("api/v1/timelines/home")

	[reblogged_activity] = json_response(conn3, 200)

	assert reblogged_activity["reblog"]["in_reply_to_id"] == replied_to.id

	replied_to_user = User.get_by_ap_id(replied_to.data["actor"])
	assert reblogged_activity["reblog"]["in_reply_to_account_id"] == replied_to_user.id
	end

	describe "create account by app" do
	test "Account registration via Application", %{conn: conn} do
	conn =
	conn
	\|> post("/api/v1/apps", %{
	client_name: "client_name",
	redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
	scopes: "read, write, follow"
	})

	%{
	"client_id" => client_id,
	"client_secret" => client_secret,
	"id" => _,
	"name" => "client_name",
	"redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
	"vapid_key" => _,
	"website" => nil
	} = json_response(conn, 200)

	conn =
	conn
	\|> post("/oauth/token", %{
	grant_type: "client_credentials",
	client_id: client_id,
	client_secret: client_secret
	})

	assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
	json_response(conn, 200)

	assert token
	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	assert refresh
	assert scope == "read write follow"

	conn =
	build_conn()
	\|> put_req_header("authorization", "Bearer " <> token)
	\|> post("/api/v1/accounts", %{
	username: "lain",
	email: "lain@example.org",
	password: "PlzDontHackLain",
	agreement: true
	})

	%{
	"access_token" => token,
	"created_at" => _created_at,
	"scope" => _scope,
	"token_type" => "Bearer"
	} = json_response(conn, 200)

	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	token_from_db = Repo.preload(token_from_db, :user)
	assert token_from_db.user

	assert token_from_db.user.info.confirmation_pending
	end

	test "rate limit", %{conn: conn} do
	app_token = insert(:oauth_token, user: nil)

	conn =
	put_req_header(conn, "authorization", "Bearer " <> app_token.token)
	\|> Map.put(:remote_ip, {15, 15, 15, 15})

	for i <- 1..5 do
	conn =
	conn
	\|> post("/api/v1/accounts", %{
	username: "#{i}lain",
	email: "#{i}lain@example.org",
	password: "PlzDontHackLain",
	agreement: true
	})

	%{
	"access_token" => token,
	"created_at" => _created_at,
	"scope" => _scope,
	"token_type" => "Bearer"
	} = json_response(conn, 200)

	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	token_from_db = Repo.preload(token_from_db, :user)
	assert token_from_db.user

	assert token_from_db.user.info.confirmation_pending
	end

	conn =
	conn
	\|> post("/api/v1/accounts", %{
	username: "6lain",
	email: "6lain@example.org",
	password: "PlzDontHackLain",
	agreement: true
	})

	assert json_response(conn, :too_many_requests) == %{"error" => "Throttled"}
	end
	end

	describe "GET /api/v1/polls/:id" do
	test "returns poll entity for object id", %{conn: conn} do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "Pleroma does",
	"poll" => %{"options" => ["what Mastodon't", "n't what Mastodoes"], "expires_in" => 20}
	})

	object = Object.normalize(activity)

	conn =
	conn
	\|> assign(:user, user)
	\|> get("/api/v1/polls/#{object.id}")

	response = json_response(conn, 200)
	id = object.id
	assert %{"id" => ^id, "expired" => false, "multiple" => false} = response
	end

	test "does not expose polls for private statuses", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "Pleroma does",
	"poll" => %{"options" => ["what Mastodon't", "n't what Mastodoes"], "expires_in" => 20},
	"visibility" => "private"
	})

	object = Object.normalize(activity)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> get("/api/v1/polls/#{object.id}")

	assert json_response(conn, 404)
	end
	end

	describe "POST /api/v1/polls/:id/votes" do
	test "votes are added to the poll", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "A very delicious sandwich",
	"poll" => %{
	"options" => ["Lettuce", "Grilled Bacon", "Tomato"],
	"expires_in" => 20,
	"multiple" => true
	}
	})

	object = Object.normalize(activity)

	conn =
	conn
	\|> assign(:user, other_user)
	\|> post("/api/v1/polls/#{object.id}/votes", %{"choices" => [0, 1, 2]})

	assert json_response(conn, 200)
	object = Object.get_by_id(object.id)

	assert Enum.all?(object.data["anyOf"], fn %{"replies" => %{"totalItems" => total_items}} ->
	total_items == 1
	end)
	end

	test "author can't vote", %{conn: conn} do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "Am I cute?",
	"poll" => %{"options" => ["Yes", "No"], "expires_in" => 20}
	})

	object = Object.normalize(activity)

	assert conn
	\|> assign(:user, user)
	\|> post("/api/v1/polls/#{object.id}/votes", %{"choices" => [1]})
	\|> json_response(422) == %{"error" => "Poll's author can't vote"}

	object = Object.get_by_id(object.id)

	refute Enum.at(object.data["oneOf"], 1)["replies"]["totalItems"] == 1
	end

	test "does not allow multiple choices on a single-choice question", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	"status" => "The glass is",
	"poll" => %{"options" => ["half empty", "half full"], "expires_in" => 20}
	})

	object = Object.normalize(activity)

	assert conn
	\|> assign(:user, other_user)
	\|> post("/api/v1/polls/#{object.id}/votes", %{"choices" => [0, 1]})
	\|> json_response(422) == %{"error" => "Too many choices"}

	object = Object.get_by_id(object.id)

	refute Enum.any?(object.data["oneOf"], fn %{"replies" => %{"totalItems" => total_items}} ->
	total_items == 1
	end)
	end
	end
	end
	diff --git a/test/web/metadata/player_view_test.exs b/test/web/metadata/player_view_test.exs
	new file mode 100644
	index 000000000..742b0ed8b
	--- /dev/null
	+++ b/test/web/metadata/player_view_test.exs
	@@ -0,0 +1,33 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.Metadata.PlayerViewTest do
	+ use Pleroma.DataCase
	+
	+ alias Pleroma.Web.Metadata.PlayerView
	+
	+ test "it renders audio tag" do
	+ res =
	+ PlayerView.render(
	+ "player.html",
	+ %{"mediaType" => "audio", "href" => "test-href"}
	+ )
	+ \|> Phoenix.HTML.safe_to_string()
	+
	+ assert res ==
	+ "<audio controls><source src=\"test-href\" type=\"audio\">Your browser does not support audio playback.</audio>"
	+ end
	+
	+ test "it renders videos tag" do
	+ res =
	+ PlayerView.render(
	+ "player.html",
	+ %{"mediaType" => "video", "href" => "test-href"}
	+ )
	+ \|> Phoenix.HTML.safe_to_string()
	+
	+ assert res ==
	+ "<video controls loop><source src=\"test-href\" type=\"video\">Your browser does not support video playback.</video>"
	+ end
	+end
	diff --git a/test/web/metadata/twitter_card_test.exs b/test/web/metadata/twitter_card_test.exs
	new file mode 100644
	index 000000000..0814006d2
	--- /dev/null
	+++ b/test/web/metadata/twitter_card_test.exs
	@@ -0,0 +1,123 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.Metadata.Providers.TwitterCardTest do
	+ use Pleroma.DataCase
	+ import Pleroma.Factory
	+
	+ alias Pleroma.User
	+ alias Pleroma.Web.CommonAPI
	+ alias Pleroma.Web.Endpoint
	+ alias Pleroma.Web.Metadata.Providers.TwitterCard
	+ alias Pleroma.Web.Metadata.Utils
	+ alias Pleroma.Web.Router
	+
	+ test "it renders twitter card for user info" do
	+ user = insert(:user, name: "Jimmy Hendriks", bio: "born 19 March 1994")
	+ avatar_url = Utils.attachment_url(User.avatar_url(user))
	+ res = TwitterCard.build_tags(%{user: user})
	+
	+ assert res == [
	+ {:meta, [property: "twitter:title", content: Utils.user_name_string(user)], []},
	+ {:meta, [property: "twitter:description", content: "born 19 March 1994"], []},
	+ {:meta, [property: "twitter:image", content: avatar_url], []},
	+ {:meta, [property: "twitter:card", content: "summary"], []}
	+ ]
	+ end
	+
	+ test "it does not render attachments if post is nsfw" do
	+ Pleroma.Config.put([Pleroma.Web.Metadata, :unfurl_nsfw], false)
	+ user = insert(:user, name: "Jimmy Hendriks", bio: "born 19 March 1994")
	+ {:ok, activity} = CommonAPI.post(user, %{"status" => "HI"})
	+
	+ note =
	+ insert(:note, %{
	+ data: %{
	+ "actor" => user.ap_id,
	+ "tag" => [],
	+ "id" => "https://pleroma.gov/objects/whatever",
	+ "content" => "pleroma in a nutshell",
	+ "sensitive" => true,
	+ "attachment" => [
	+ %{
	+ "url" => [%{"mediaType" => "image/png", "href" => "https://pleroma.gov/tenshi.png"}]
	+ },
	+ %{
	+ "url" => [
	+ %{
	+ "mediaType" => "application/octet-stream",
	+ "href" => "https://pleroma.gov/fqa/badapple.sfc"
	+ }
	+ ]
	+ },
	+ %{
	+ "url" => [
	+ %{"mediaType" => "video/webm", "href" => "https://pleroma.gov/about/juche.webm"}
	+ ]
	+ }
	+ ]
	+ }
	+ })
	+
	+ result = TwitterCard.build_tags(%{object: note, user: user, activity_id: activity.id})
	+
	+ assert [
	+ {:meta, [property: "twitter:title", content: Utils.user_name_string(user)], []},
	+ {:meta, [property: "twitter:description", content: "“pleroma in a nutshell”"], []},
	+ {:meta, [property: "twitter:image", content: "http://localhost:4001/images/avi.png"],
	+ []},
	+ {:meta, [property: "twitter:card", content: "summary_large_image"], []}
	+ ] == result
	+ end
	+
	+ test "it renders supported types of attachments and skips unknown types" do
	+ user = insert(:user, name: "Jimmy Hendriks", bio: "born 19 March 1994")
	+ {:ok, activity} = CommonAPI.post(user, %{"status" => "HI"})
	+
	+ note =
	+ insert(:note, %{
	+ data: %{
	+ "actor" => user.ap_id,
	+ "tag" => [],
	+ "id" => "https://pleroma.gov/objects/whatever",
	+ "content" => "pleroma in a nutshell",
	+ "attachment" => [
	+ %{
	+ "url" => [%{"mediaType" => "image/png", "href" => "https://pleroma.gov/tenshi.png"}]
	+ },
	+ %{
	+ "url" => [
	+ %{
	+ "mediaType" => "application/octet-stream",
	+ "href" => "https://pleroma.gov/fqa/badapple.sfc"
	+ }
	+ ]
	+ },
	+ %{
	+ "url" => [
	+ %{"mediaType" => "video/webm", "href" => "https://pleroma.gov/about/juche.webm"}
	+ ]
	+ }
	+ ]
	+ }
	+ })
	+
	+ result = TwitterCard.build_tags(%{object: note, user: user, activity_id: activity.id})
	+
	+ assert [
	+ {:meta, [property: "twitter:title", content: Utils.user_name_string(user)], []},
	+ {:meta, [property: "twitter:description", content: "“pleroma in a nutshell”"], []},
	+ {:meta, [property: "twitter:card", content: "summary_large_image"], []},
	+ {:meta, [property: "twitter:player", content: "https://pleroma.gov/tenshi.png"], []},
	+ {:meta, [property: "twitter:card", content: "player"], []},
	+ {:meta,
	+ [
	+ property: "twitter:player",
	+ content: Router.Helpers.o_status_url(Endpoint, :notice_player, activity.id)
	+ ], []},
	+ {:meta, [property: "twitter:player:width", content: "480"], []},
	+ {:meta, [property: "twitter:player:height", content: "480"], []}
	+ ] == result
	+ end
	+end
	diff --git a/test/web/node_info_test.exs b/test/web/node_info_test.exs
	index be1173513..d7f848bfa 100644
	--- a/test/web/node_info_test.exs
	+++ b/test/web/node_info_test.exs
	@@ -1,86 +1,129 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.NodeInfoTest do
	use Pleroma.Web.ConnCase

	import Pleroma.Factory

	test "GET /.well-known/nodeinfo", %{conn: conn} do
	links =
	conn
	\|> get("/.well-known/nodeinfo")
	\|> json_response(200)
	\|> Map.fetch!("links")

	Enum.each(links, fn link ->
	href = Map.fetch!(link, "href")

	conn
	\|> get(href)
	\|> json_response(200)
	end)
	end

	test "nodeinfo shows staff accounts", %{conn: conn} do
	moderator = insert(:user, %{local: true, info: %{is_moderator: true}})
	admin = insert(:user, %{local: true, info: %{is_admin: true}})

	conn =
	conn
	\|> get("/nodeinfo/2.1.json")

	assert result = json_response(conn, 200)

	assert moderator.ap_id in result["metadata"]["staffAccounts"]
	assert admin.ap_id in result["metadata"]["staffAccounts"]
	end

	test "nodeinfo shows restricted nicknames", %{conn: conn} do
	conn =
	conn
	\|> get("/nodeinfo/2.1.json")

	assert result = json_response(conn, 200)

	assert Pleroma.Config.get([Pleroma.User, :restricted_nicknames]) ==
	result["metadata"]["restrictedNicknames"]
	end

	test "returns software.repository field in nodeinfo 2.1", %{conn: conn} do
	conn
	\|> get("/.well-known/nodeinfo")
	\|> json_response(200)

	conn =
	conn
	\|> get("/nodeinfo/2.1.json")

	assert result = json_response(conn, 200)
	assert Pleroma.Application.repository() == result["software"]["repository"]
	end

	test "it returns the safe_dm_mentions feature if enabled", %{conn: conn} do
	option = Pleroma.Config.get([:instance, :safe_dm_mentions])
	Pleroma.Config.put([:instance, :safe_dm_mentions], true)

	response =
	conn
	\|> get("/nodeinfo/2.1.json")
	\|> json_response(:ok)

	assert "safe_dm_mentions" in response["metadata"]["features"]

	Pleroma.Config.put([:instance, :safe_dm_mentions], false)

	response =
	conn
	\|> get("/nodeinfo/2.1.json")
	\|> json_response(:ok)

	refute "safe_dm_mentions" in response["metadata"]["features"]

	Pleroma.Config.put([:instance, :safe_dm_mentions], option)
	end
	+
	+ test "it shows MRF transparency data if enabled", %{conn: conn} do
	+ option = Pleroma.Config.get([:instance, :mrf_transparency])
	+ Pleroma.Config.put([:instance, :mrf_transparency], true)
	+
	+ simple_config = %{"reject" => ["example.com"]}
	+ Pleroma.Config.put(:mrf_simple, simple_config)
	+
	+ response =
	+ conn
	+ \|> get("/nodeinfo/2.1.json")
	+ \|> json_response(:ok)
	+
	+ assert response["metadata"]["federation"]["mrf_simple"] == simple_config
	+
	+ Pleroma.Config.put([:instance, :mrf_transparency], option)
	+ Pleroma.Config.put(:mrf_simple, %{})
	+ end
	+
	+ test "it performs exclusions from MRF transparency data if configured", %{conn: conn} do
	+ option = Pleroma.Config.get([:instance, :mrf_transparency])
	+ Pleroma.Config.put([:instance, :mrf_transparency], true)
	+
	+ exclusions = Pleroma.Config.get([:instance, :mrf_transparency_exclusions])
	+ Pleroma.Config.put([:instance, :mrf_transparency_exclusions], ["other.site"])
	+
	+ simple_config = %{"reject" => ["example.com", "other.site"]}
	+ expected_config = %{"reject" => ["example.com"]}
	+
	+ Pleroma.Config.put(:mrf_simple, simple_config)
	+
	+ response =
	+ conn
	+ \|> get("/nodeinfo/2.1.json")
	+ \|> json_response(:ok)
	+
	+ assert response["metadata"]["federation"]["mrf_simple"] == expected_config
	+ assert response["metadata"]["federation"]["exclusions"] == true
	+
	+ Pleroma.Config.put([:instance, :mrf_transparency], option)
	+ Pleroma.Config.put([:instance, :mrf_transparency_exclusions], exclusions)
	+ Pleroma.Config.put(:mrf_simple, %{})
	+ end
	end

File Metadata

Mime Type: text/x-diff
Expires: Thu, Oct 29, 11:03 AM (23 h, 32 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1798020
Default Alt Text: (384 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions