No OneTemporary
Actions

Size

219 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/config/config.exs b/config/config.exs
	index 5d959a859..900140797 100644
	--- a/config/config.exs
	+++ b/config/config.exs
	@@ -1,409 +1,425 @@
	# This file is responsible for configuring your application
	# and its dependencies with the aid of the Mix.Config module.
	#
	# This configuration file is loaded before any dependency and
	# is restricted to this project.
	use Mix.Config

	# General application configuration
	config :pleroma, ecto_repos: [Pleroma.Repo]

	config :pleroma, Pleroma.Repo,
	types: Pleroma.PostgresTypes,
	telemetry_event: [Pleroma.Repo.Instrumenter]

	config :pleroma, Pleroma.Captcha,
	enabled: false,
	seconds_valid: 60,
	method: Pleroma.Captcha.Kocaptcha

	config :pleroma, :hackney_pools,
	federation: [
	max_connections: 50,
	timeout: 150_000
	],
	media: [
	max_connections: 50,
	timeout: 150_000
	],
	upload: [
	max_connections: 25,
	timeout: 300_000
	]

	config :pleroma, Pleroma.Captcha.Kocaptcha, endpoint: "https://captcha.kotobank.ch"

	# Upload configuration
	config :pleroma, Pleroma.Upload,
	uploader: Pleroma.Uploaders.Local,
	filters: [Pleroma.Upload.Filter.Dedupe],
	link_name: true,
	proxy_remote: false,
	proxy_opts: [
	redirect_on_failure: false,
	max_body_length: 25 * 1_048_576,
	http: [
	follow_redirect: true,
	pool: :upload
	]
	]

	config :pleroma, Pleroma.Uploaders.Local, uploads: "uploads"

	config :pleroma, Pleroma.Uploaders.S3,
	bucket: nil,
	public_endpoint: "https://s3.amazonaws.com"

	config :pleroma, Pleroma.Uploaders.MDII,
	cgi: "https://mdii.sakura.ne.jp/mdii-post.cgi",
	files: "https://mdii.sakura.ne.jp"

	config :pleroma, :emoji,
	shortcode_globs: ["/emoji/custom/*/.png"],
	groups: [
	# Put groups that have higher priority than defaults here. Example in `docs/config/custom_emoji.md`
	Finmoji: "/finmoji/128px/*-128.png",
	Custom: ["/emoji/.png", "/emoji/custom/.png"]
	]

	config :pleroma, :uri_schemes,
	valid_schemes: [
	"https",
	"http",
	"dat",
	"dweb",
	"gopher",
	"ipfs",
	"ipns",
	"irc",
	"ircs",
	"magnet",
	"mailto",
	"mumble",
	"ssb",
	"xmpp"
	]

	websocket_config = [
	path: "/websocket",
	serializer: [
	{Phoenix.Socket.V1.JSONSerializer, "~> 1.0.0"},
	{Phoenix.Socket.V2.JSONSerializer, "~> 2.0.0"}
	],
	timeout: 60_000,
	transport_log: false,
	compress: false
	]

	# Configures the endpoint
	config :pleroma, Pleroma.Web.Endpoint,
	instrumenters: [Pleroma.Web.Endpoint.Instrumenter],
	url: [host: "localhost"],
	http: [
	dispatch: [
	{:_,
	[
	{"/api/v1/streaming", Pleroma.Web.MastodonAPI.WebsocketHandler, []},
	{"/websocket", Phoenix.Endpoint.CowboyWebSocket,
	{Phoenix.Transports.WebSocket,
	{Pleroma.Web.Endpoint, Pleroma.Web.UserSocket, websocket_config}}},
	{:_, Phoenix.Endpoint.Cowboy2Handler, {Pleroma.Web.Endpoint, []}}
	]}
	]
	],
	protocol: "https",
	secret_key_base: "aK4Abxf29xU9TTDKre9coZPUgevcVCFQJe/5xP/7Lt4BEif6idBIbjupVbOrbKxl",
	signing_salt: "CqaoopA2",
	render_errors: [view: Pleroma.Web.ErrorView, accepts: ~w(json)],
	pubsub: [name: Pleroma.PubSub, adapter: Phoenix.PubSub.PG2],
	secure_cookie_flag: true

	# Configures Elixir's Logger
	config :logger, :console,
	format: "$time $metadata[$level] $message\n",
	metadata: [:request_id]

	config :logger, :ex_syslogger,
	level: :debug,
	ident: "Pleroma",
	format: "$metadata[$level] $message",
	metadata: [:request_id]

	config :quack,
	level: :warn,
	meta: [:all],
	webhook_url: "https://hooks.slack.com/services/YOUR-KEY-HERE"

	config :mime, :types, %{
	"application/xml" => ["xml"],
	"application/xrd+xml" => ["xrd+xml"],
	"application/jrd+json" => ["jrd+json"],
	"application/activity+json" => ["activity+json"],
	"application/ld+json" => ["activity+json"]
	}

	config :pleroma, :websub, Pleroma.Web.Websub
	config :pleroma, :ostatus, Pleroma.Web.OStatus
	config :pleroma, :httpoison, Pleroma.HTTP
	config :tesla, adapter: Tesla.Adapter.Hackney

	# Configures http settings, upstream proxy etc.
	config :pleroma, :http,
	proxy_url: nil,
	adapter: [
	ssl_options: [
	# We don't support TLS v1.3 yet
	versions: [:tlsv1, :"tlsv1.1", :"tlsv1.2"]
	]
	]

	config :pleroma, :instance,
	name: "Pleroma",
	email: "example@example.com",
	description: "A Pleroma instance, an alternative fediverse server",
	limit: 5_000,
	remote_limit: 100_000,
	upload_limit: 16_000_000,
	avatar_upload_limit: 2_000_000,
	background_upload_limit: 4_000_000,
	banner_upload_limit: 4_000_000,
	registrations_open: true,
	federating: true,
	federation_reachability_timeout_days: 7,
	allow_relay: true,
	rewrite_policy: Pleroma.Web.ActivityPub.MRF.NoOpPolicy,
	public: true,
	quarantined_instances: [],
	managed_config: true,
	static_dir: "instance/static/",
	allowed_post_formats: [
	"text/plain",
	"text/html",
	"text/markdown"
	],
	finmoji_enabled: true,
	mrf_transparency: true,
	autofollowed_nicknames: [],
	max_pinned_statuses: 1,
	no_attachment_links: false,
	welcome_user_nickname: nil,
	welcome_message: nil,
	max_report_comment_size: 1000,
	safe_dm_mentions: false

	config :pleroma, :markup,
	# XXX - unfortunately, inline images must be enabled by default right now, because
	# of custom emoji. Issue #275 discusses defanging that somehow.
	allow_inline_images: true,
	allow_headings: false,
	allow_tables: false,
	allow_fonts: false,
	scrub_policy: [
	Pleroma.HTML.Transform.MediaProxy,
	Pleroma.HTML.Scrubber.Default
	]

	# Deprecated, will be gone in 1.0
	config :pleroma, :fe,
	theme: "pleroma-dark",
	logo: "/static/logo.png",
	logo_mask: true,
	logo_margin: "0.1em",
	background: "/static/aurora_borealis.jpg",
	redirect_root_no_login: "/main/all",
	redirect_root_login: "/main/friends",
	show_instance_panel: true,
	scope_options_enabled: false,
	formatting_options_enabled: false,
	collapse_message_with_subject: false,
	hide_post_stats: false,
	hide_user_stats: false,
	scope_copy: true,
	subject_line_behavior: "email",
	always_show_subject_input: true

	config :pleroma, :frontend_configurations,
	pleroma_fe: %{
	theme: "pleroma-dark",
	logo: "/static/logo.png",
	background: "/images/city.jpg",
	redirectRootNoLogin: "/main/all",
	redirectRootLogin: "/main/friends",
	showInstanceSpecificPanel: true,
	scopeOptionsEnabled: false,
	formattingOptionsEnabled: false,
	collapseMessageWithSubject: false,
	hidePostStats: false,
	hideUserStats: false,
	scopeCopy: true,
	subjectLineBehavior: "email",
	alwaysShowSubjectInput: true
	},
	masto_fe: %{
	showInstanceSpecificPanel: true
	}

	config :pleroma, :activitypub,
	accept_blocks: true,
	unfollow_blocked: true,
	outgoing_blocks: true,
	follow_handshake_timeout: 500

	config :pleroma, :user, deny_follow_blocked: true

	config :pleroma, :mrf_normalize_markup, scrub_policy: Pleroma.HTML.Scrubber.Default

	config :pleroma, :mrf_rejectnonpublic,
	allow_followersonly: false,
	allow_direct: false

	config :pleroma, :mrf_hellthread,
	delist_threshold: 10,
	reject_threshold: 20

	config :pleroma, :mrf_simple,
	media_removal: [],
	media_nsfw: [],
	federated_timeline_removal: [],
	reject: [],
	accept: []

	config :pleroma, :mrf_keyword,
	reject: [],
	federated_timeline_removal: [],
	replace: []

	config :pleroma, :rich_media, enabled: true

	config :pleroma, :media_proxy,
	enabled: false,
	proxy_opts: [
	redirect_on_failure: false,
	max_body_length: 25 * 1_048_576,
	http: [
	follow_redirect: true,
	pool: :media
	]
	]

	config :pleroma, :chat, enabled: true

	config :phoenix, :format_encoders, json: Jason

	config :pleroma, :gopher,
	enabled: false,
	ip: {0, 0, 0, 0},
	port: 9999

	config :pleroma, Pleroma.Web.Metadata, providers: [], unfurl_nsfw: false

	config :pleroma, :suggestions,
	enabled: false,
	third_party_engine:
	"http://vinayaka.distsn.org/cgi-bin/vinayaka-user-match-suggestions-api.cgi?{{host}}+{{user}}",
	timeout: 300_000,
	limit: 23,
	web: "https://vinayaka.distsn.org/?{{host}}+{{user}}"

	config :pleroma, :http_security,
	enabled: true,
	sts: false,
	sts_max_age: 31_536_000,
	ct_max_age: 2_592_000,
	referrer_policy: "same-origin"

	config :cors_plug,
	max_age: 86_400,
	methods: ["POST", "PUT", "DELETE", "GET", "PATCH", "OPTIONS"],
	expose: [
	"Link",
	"X-RateLimit-Reset",
	"X-RateLimit-Limit",
	"X-RateLimit-Remaining",
	"X-Request-Id",
	"Idempotency-Key"
	],
	credentials: true,
	headers: ["Authorization", "Content-Type", "Idempotency-Key"]

	config :pleroma, Pleroma.User,
	restricted_nicknames: [
	".well-known",
	"~",
	"about",
	"activities",
	"api",
	"auth",
	"dev",
	"friend-requests",
	"inbox",
	"internal",
	"main",
	"media",
	"nodeinfo",
	"notice",
	"oauth",
	"objects",
	"ostatus_subscribe",
	"pleroma",
	"proxy",
	"push",
	"registration",
	"relay",
	"settings",
	"status",
	"tag",
	"user-search",
	"users",
	"web"
	]

	config :pleroma, Pleroma.Web.Federator.RetryQueue,
	enabled: false,
	max_jobs: 20,
	initial_timeout: 30,
	max_retries: 5

	config :pleroma_job_queue, :queues,
	federator_incoming: 50,
	federator_outgoing: 50,
	mailer: 10,
	scheduled_activities: 10

	config :pleroma, :fetch_initial_posts,
	enabled: false,
	pages: 5

	config :auto_linker,
	opts: [
	scheme: true,
	extra: true,
	class: false,
	strip_prefix: false,
	new_window: false,
	rel: false
	]

	config :pleroma, :ldap,
	enabled: System.get_env("LDAP_ENABLED") == "true",
	host: System.get_env("LDAP_HOST") \|\| "localhost",
	port: String.to_integer(System.get_env("LDAP_PORT") \|\| "389"),
	ssl: System.get_env("LDAP_SSL") == "true",
	sslopts: [],
	tls: System.get_env("LDAP_TLS") == "true",
	tlsopts: [],
	base: System.get_env("LDAP_BASE") \|\| "dc=example,dc=com",
	uid: System.get_env("LDAP_UID") \|\| "cn"

	+oauth_consumer_strategies = String.split(System.get_env("OAUTH_CONSUMER_STRATEGIES") \|\| "")
	+
	+ueberauth_providers =
	+ for strategy <- oauth_consumer_strategies do
	+ strategy_module_name = "Elixir.Ueberauth.Strategy.#{String.capitalize(strategy)}"
	+ strategy_module = String.to_atom(strategy_module_name)
	+ {String.to_atom(strategy), {strategy_module, [callback_params: ["state"]]}}
	+ end
	+
	+config :ueberauth,
	+ Ueberauth,
	+ base_path: "/oauth",
	+ providers: ueberauth_providers
	+
	+config :pleroma, :auth, oauth_consumer_strategies: oauth_consumer_strategies
	+
	config :pleroma, Pleroma.Mailer, adapter: Swoosh.Adapters.Sendmail

	config :prometheus, Pleroma.Web.Endpoint.MetricsExporter, path: "/api/pleroma/app_metrics"

	config :pleroma, Pleroma.ScheduledActivity,
	daily_user_limit: 25,
	total_user_limit: 300,
	enabled: true

	# Import environment specific config. This must remain at the bottom
	# of this file so it overrides the configuration defined above.
	import_config "#{Mix.env()}.exs"
	diff --git a/config/dev.exs b/config/dev.exs
	index f77bb9976..a7eb4b644 100644
	--- a/config/dev.exs
	+++ b/config/dev.exs
	@@ -1,62 +1,61 @@
	use Mix.Config

	# For development, we disable any cache and enable
	# debugging and code reloading.
	#
	# The watchers configuration can be used to run external
	# watchers to your application. For example, we use it
	# with brunch.io to recompile .js and .css sources.
	config :pleroma, Pleroma.Web.Endpoint,
	http: [
	port: 4000,
	protocol_options: [max_request_line_length: 8192, max_header_value_length: 8192]
	],
	protocol: "http",
	- secure_cookie_flag: false,
	debug_errors: true,
	code_reloader: true,
	check_origin: false,
	watchers: [],
	secure_cookie_flag: false

	config :pleroma, Pleroma.Mailer, adapter: Swoosh.Adapters.Local

	# ## SSL Support
	#
	# In order to use HTTPS in development, a self-signed
	# certificate can be generated by running the following
	# command from your terminal:
	#
	# openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" -keyout priv/server.key -out priv/server.pem
	#
	# The `http:` config above can be replaced with:
	#
	# https: [port: 4000, keyfile: "priv/server.key", certfile: "priv/server.pem"],
	#
	# If desired, both `http:` and `https:` keys can be
	# configured to run both http and https servers on
	# different ports.

	# Do not include metadata nor timestamps in development logs
	config :logger, :console, format: "[$level] $message\n"

	# Set a higher stacktrace during development. Avoid configuring such
	# in production as building large stacktraces may be expensive.
	config :phoenix, :stacktrace_depth, 20

	# Configure your database
	config :pleroma, Pleroma.Repo,
	adapter: Ecto.Adapters.Postgres,
	username: "postgres",
	password: "postgres",
	database: "pleroma_dev",
	hostname: "localhost",
	pool_size: 10

	if File.exists?("./config/dev.secret.exs") do
	import_config "dev.secret.exs"
	else
	IO.puts(
	"!!! RUNNING IN LOCALHOST DEV MODE! !!!\nFEDERATION WON'T WORK UNTIL YOU CONFIGURE A dev.secret.exs"
	)
	end
	diff --git a/docs/config.md b/docs/config.md
	index ba0759e87..ed9b91363 100644
	--- a/docs/config.md
	+++ b/docs/config.md
	@@ -1,421 +1,480 @@
	# Configuration

	This file describe the configuration, it is recommended to edit the relevant *.secret.exs file instead of the others founds in the ``config`` directory.
	If you run Pleroma with ``MIX_ENV=prod`` the file is ``prod.secret.exs``, otherwise it is ``dev.secret.exs``.

	## Pleroma.Upload
	* `uploader`: Select which `Pleroma.Uploaders` to use
	* `filters`: List of `Pleroma.Upload.Filter` to use.
	* `link_name`: When enabled Pleroma will add a `name` parameter to the url of the upload, for example `https://instance.tld/media/corndog.png?name=corndog.png`. This is needed to provide the correct filename in Content-Disposition headers when using filters like `Pleroma.Upload.Filter.Dedupe`
	* `base_url`: The base URL to access a user-uploaded file. Useful when you want to proxy the media files via another host.
	* `proxy_remote`: If you\'re using a remote uploader, Pleroma will proxy media requests instead of redirecting to it.
	* `proxy_opts`: Proxy options, see `Pleroma.ReverseProxy` documentation.

	Note: `strip_exif` has been replaced by `Pleroma.Upload.Filter.Mogrify`.

	## Pleroma.Uploaders.Local
	* `uploads`: Which directory to store the user-uploads in, relative to pleroma’s working directory

	## Pleroma.Upload.Filter.Mogrify

	* `args`: List of actions for the `mogrify` command like `"strip"` or `["strip", "auto-orient", {"impode", "1"}]`.

	## Pleroma.Upload.Filter.Dedupe

	No specific configuration.

	## Pleroma.Upload.Filter.AnonymizeFilename

	This filter replaces the filename (not the path) of an upload. For complete obfuscation, add
	`Pleroma.Upload.Filter.Dedupe` before AnonymizeFilename.

	* `text`: Text to replace filenames in links. If empty, `{random}.extension` will be used.

	## Pleroma.Mailer
	* `adapter`: one of the mail adapters listed in [Swoosh readme](https://github.com/swoosh/swoosh#adapters), or `Swoosh.Adapters.Local` for in-memory mailbox.
	* `api_key` / `password` and / or other adapter-specific settings, per the above documentation.

	An example for Sendgrid adapter:

	```exs
	config :pleroma, Pleroma.Mailer,
	adapter: Swoosh.Adapters.Sendgrid,
	api_key: "YOUR_API_KEY"
	```

	An example for SMTP adapter:

	```exs
	config :pleroma, Pleroma.Mailer,
	adapter: Swoosh.Adapters.SMTP,
	relay: "smtp.gmail.com",
	username: "YOUR_USERNAME@gmail.com",
	password: "YOUR_SMTP_PASSWORD",
	port: 465,
	ssl: true,
	tls: :always,
	auth: :always
	```

	## :uri_schemes
	* `valid_schemes`: List of the scheme part that is considered valid to be an URL

	## :instance
	* `name`: The instance’s name
	* `email`: Email used to reach an Administrator/Moderator of the instance
	* `description`: The instance’s description, can be seen in nodeinfo and ``/api/v1/instance``
	* `limit`: Posts character limit (CW/Subject included in the counter)
	* `remote_limit`: Hard character limit beyond which remote posts will be dropped.
	* `upload_limit`: File size limit of uploads (except for avatar, background, banner)
	* `avatar_upload_limit`: File size limit of user’s profile avatars
	* `background_upload_limit`: File size limit of user’s profile backgrounds
	* `banner_upload_limit`: File size limit of user’s profile banners
	* `registrations_open`: Enable registrations for anyone, invitations can be enabled when false.
	* `invites_enabled`: Enable user invitations for admins (depends on `registrations_open: false`).
	* `account_activation_required`: Require users to confirm their emails before signing in.
	* `federating`: Enable federation with other instances
	* `federation_reachability_timeout_days`: Timeout (in days) of each external federation target being unreachable prior to pausing federating to it.
	* `allow_relay`: Enable Pleroma’s Relay, which makes it possible to follow a whole instance
	* `rewrite_policy`: Message Rewrite Policy, either one or a list. Here are the ones available by default:
	* `Pleroma.Web.ActivityPub.MRF.NoOpPolicy`: Doesn’t modify activities (default)
	* `Pleroma.Web.ActivityPub.MRF.DropPolicy`: Drops all activities. It generally doesn’t makes sense to use in production
	* `Pleroma.Web.ActivityPub.MRF.SimplePolicy`: Restrict the visibility of activities from certains instances (See ``:mrf_simple`` section)
	* `Pleroma.Web.ActivityPub.MRF.RejectNonPublic`: Drops posts with non-public visibility settings (See ``:mrf_rejectnonpublic`` section)
	* `Pleroma.Web.ActivityPub.MRF.EnsureRePrepended`: Rewrites posts to ensure that replies to posts with subjects do not have an identical subject and instead begin with re:.
	* `public`: Makes the client API in authentificated mode-only except for user-profiles. Useful for disabling the Local Timeline and The Whole Known Network.
	* `quarantined_instances`: List of ActivityPub instances where private(DMs, followers-only) activities will not be send.
	* `managed_config`: Whenether the config for pleroma-fe is configured in this config or in ``static/config.json``
	* `allowed_post_formats`: MIME-type list of formats allowed to be posted (transformed into HTML)
	* `finmoji_enabled`: Whenether to enable the finmojis in the custom emojis.
	* `mrf_transparency`: Make the content of your Message Rewrite Facility settings public (via nodeinfo).
	* `scope_copy`: Copy the scope (private/unlisted/public) in replies to posts by default.
	* `subject_line_behavior`: Allows changing the default behaviour of subject lines in replies. Valid values:
	* "email": Copy and preprend re:, as in email.
	* "masto": Copy verbatim, as in Mastodon.
	* "noop": Don't copy the subject.
	* `always_show_subject_input`: When set to false, auto-hide the subject field when it's empty.
	* `extended_nickname_format`: Set to `true` to use extended local nicknames format (allows underscores/dashes). This will break federation with
	older software for theses nicknames.
	* `max_pinned_statuses`: The maximum number of pinned statuses. `0` will disable the feature.
	* `autofollowed_nicknames`: Set to nicknames of (local) users that every new user should automatically follow.
	* `no_attachment_links`: Set to true to disable automatically adding attachment link text to statuses
	* `welcome_message`: A message that will be send to a newly registered users as a direct message.
	* `welcome_user_nickname`: The nickname of the local user that sends the welcome message.
	* `max_report_comment_size`: The maximum size of the report comment (Default: `1000`)
	* `safe_dm_mentions`: If set to true, only mentions at the beginning of a post will be used to address people in direct messages. This is to prevent accidental mentioning of people when talking about them (e.g. "@friend hey i really don't like @enemy"). (Default: `false`)

	## :logger
	* `backends`: `:console` is used to send logs to stdout, `{ExSyslogger, :ex_syslogger}` to log to syslog, and `Quack.Logger` to log to Slack

	An example to enable ONLY ExSyslogger (f/ex in ``prod.secret.exs``) with info and debug suppressed:
	```
	config :logger,
	backends: [{ExSyslogger, :ex_syslogger}]

	config :logger, :ex_syslogger,
	level: :warn
	```

	Another example, keeping console output and adding the pid to syslog output:
	```
	config :logger,
	backends: [:console, {ExSyslogger, :ex_syslogger}]

	config :logger, :ex_syslogger,
	level: :warn,
	option: [:pid, :ndelay]
	```

	See: [logger’s documentation](https://hexdocs.pm/logger/Logger.html) and [ex_syslogger’s documentation](https://hexdocs.pm/ex_syslogger/)

	An example of logging info to local syslog, but warn to a Slack channel:
	```
	config :logger,
	backends: [ {ExSyslogger, :ex_syslogger}, Quack.Logger ],
	level: :info

	config :logger, :ex_syslogger,
	level: :info,
	ident: "pleroma",
	format: "$metadata[$level] $message"

	config :quack,
	level: :warn,
	meta: [:all],
	webhook_url: "https://hooks.slack.com/services/YOUR-API-KEY-HERE"
	```

	See the [Quack Github](https://github.com/azohra/quack) for more details

	## :frontend_configurations

	This can be used to configure a keyword list that keeps the configuration data for any kind of frontend. By default, settings for `pleroma_fe` and `masto_fe` are configured.

	Frontends can access these settings at `/api/pleroma/frontend_configurations`

	To add your own configuration for PleromaFE, use it like this:

	`config :pleroma, :frontend_configurations, pleroma_fe: %{redirectRootNoLogin: "/main/all", ...}`

	These settings need to be complete, they will override the defaults. See `priv/static/static/config.json` for the available keys.

	## :fe
	__THIS IS DEPRECATED__

	If you are using this method, please change it to the `frontend_configurations` method. Please set this option to false in your config like this: `config :pleroma, :fe, false`.

	This section is used to configure Pleroma-FE, unless ``:managed_config`` in ``:instance`` is set to false.

	* `theme`: Which theme to use, they are defined in ``styles.json``
	* `logo`: URL of the logo, defaults to Pleroma’s logo
	* `logo_mask`: Whether to use only the logo's shape as a mask (true) or as a regular image (false)
	* `logo_margin`: What margin to use around the logo
	* `background`: URL of the background, unless viewing a user profile with a background that is set
	* `redirect_root_no_login`: relative URL which indicates where to redirect when a user isn’t logged in.
	* `redirect_root_login`: relative URL which indicates where to redirect when a user is logged in.
	* `show_instance_panel`: Whenether to show the instance’s specific panel.
	* `scope_options_enabled`: Enable setting an notice visibility and subject/CW when posting
	* `formatting_options_enabled`: Enable setting a formatting different than plain-text (ie. HTML, Markdown) when posting, relates to ``:instance, allowed_post_formats``
	* `collapse_message_with_subjects`: When a message has a subject(aka Content Warning), collapse it by default
	* `hide_post_stats`: Hide notices statistics(repeats, favorites, …)
	* `hide_user_stats`: Hide profile statistics(posts, posts per day, followers, followings, …)

	## :mrf_simple
	* `media_removal`: List of instances to remove medias from
	* `media_nsfw`: List of instances to put medias as NSFW(sensitive) from
	* `federated_timeline_removal`: List of instances to remove from Federated (aka The Whole Known Network) Timeline
	* `reject`: List of instances to reject any activities from
	* `accept`: List of instances to accept any activities from

	## :mrf_rejectnonpublic
	* `allow_followersonly`: whether to allow followers-only posts
	* `allow_direct`: whether to allow direct messages

	## :mrf_hellthread
	* `delist_threshold`: Number of mentioned users after which the message gets delisted (the message can still be seen, but it will not show up in public timelines and mentioned users won't get notifications about it). Set to 0 to disable.
	* `reject_threshold`: Number of mentioned users after which the messaged gets rejected. Set to 0 to disable.

	## :mrf_keyword
	* `reject`: A list of patterns which result in message being rejected, each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html)
	* `federated_timeline_removal`: A list of patterns which result in message being removed from federated timelines (a.k.a unlisted), each pattern can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html)
	* `replace`: A list of tuples containing `{pattern, replacement}`, `pattern` can be a string or a [regular expression](https://hexdocs.pm/elixir/Regex.html)

	## :media_proxy
	* `enabled`: Enables proxying of remote media to the instance’s proxy
	* `base_url`: The base URL to access a user-uploaded file. Useful when you want to proxy the media files via another host/CDN fronts.
	* `proxy_opts`: All options defined in `Pleroma.ReverseProxy` documentation, defaults to `[max_body_length: (25*1_048_576)]`.

	## :gopher
	* `enabled`: Enables the gopher interface
	* `ip`: IP address to bind to
	* `port`: Port to bind to
	* `dstport`: Port advertised in urls (optional, defaults to `port`)

	## Pleroma.Web.Endpoint
	`Phoenix` endpoint configuration, all configuration options can be viewed [here](https://hexdocs.pm/phoenix/Phoenix.Endpoint.html#module-dynamic-configuration), only common options are listed here
	* `http` - a list containing http protocol configuration, all configuration options can be viewed [here](https://hexdocs.pm/plug_cowboy/Plug.Cowboy.html#module-options), only common options are listed here
	- `ip` - a tuple consisting of 4 integers
	- `port`
	* `url` - a list containing the configuration for generating urls, accepts
	- `host` - the host without the scheme and a post (e.g `example.com`, not `https://example.com:2020`)
	- `scheme` - e.g `http`, `https`
	- `port`
	- `path`


	Important note: if you modify anything inside these lists, default `config.exs` values will be overwritten, which may result in breakage, to make sure this does not happen please copy the default value for the list from `config.exs` and modify/add only what you need

	Example:
	```elixir
	config :pleroma, Pleroma.Web.Endpoint,
	url: [host: "example.com", port: 2020, scheme: "https"],
	http: [
	# start copied from config.exs
	dispatch: [
	{:_,
	[
	{"/api/v1/streaming", Pleroma.Web.MastodonAPI.WebsocketHandler, []},
	{"/websocket", Phoenix.Endpoint.CowboyWebSocket,
	{Phoenix.Transports.WebSocket,
	{Pleroma.Web.Endpoint, Pleroma.Web.UserSocket, websocket_config}}},
	{:_, Phoenix.Endpoint.Cowboy2Handler, {Pleroma.Web.Endpoint, []}}
	]}
	# end copied from config.exs
	],
	port: 8080,
	ip: {127, 0, 0, 1}
	]
	```

	This will make Pleroma listen on `127.0.0.1` port `8080` and generate urls starting with `https://example.com:2020`

	## :activitypub
	* ``accept_blocks``: Whether to accept incoming block activities from other instances
	* ``unfollow_blocked``: Whether blocks result in people getting unfollowed
	* ``outgoing_blocks``: Whether to federate blocks to other instances
	* ``deny_follow_blocked``: Whether to disallow following an account that has blocked the user in question

	## :http_security
	* ``enabled``: Whether the managed content security policy is enabled
	* ``sts``: Whether to additionally send a `Strict-Transport-Security` header
	* ``sts_max_age``: The maximum age for the `Strict-Transport-Security` header if sent
	* ``ct_max_age``: The maximum age for the `Expect-CT` header if sent
	* ``referrer_policy``: The referrer policy to use, either `"same-origin"` or `"no-referrer"`.

	## :mrf_user_allowlist

	The keys in this section are the domain names that the policy should apply to.
	Each key should be assigned a list of users that should be allowed through by
	their ActivityPub ID.

	An example:

	```exs
	config :pleroma, :mrf_user_allowlist,
	"example.org": ["https://example.org/users/admin"]
	```

	## :web_push_encryption, :vapid_details

	Web Push Notifications configuration. You can use the mix task `mix web_push.gen.keypair` to generate it.

	* ``subject``: a mailto link for the administrative contact. It’s best if this email is not a personal email address, but rather a group email so that if a person leaves an organization, is unavailable for an extended period, or otherwise can’t respond, someone else on the list can.
	* ``public_key``: VAPID public key
	* ``private_key``: VAPID private key

	## Pleroma.Captcha
	* `enabled`: Whether the captcha should be shown on registration
	* `method`: The method/service to use for captcha
	* `seconds_valid`: The time in seconds for which the captcha is valid

	### Pleroma.Captcha.Kocaptcha
	Kocaptcha is a very simple captcha service with a single API endpoint,
	the source code is here: https://github.com/koto-bank/kocaptcha. The default endpoint
	`https://captcha.kotobank.ch` is hosted by the developer.

	* `endpoint`: the kocaptcha endpoint to use

	## :admin_token

	Allows to set a token that can be used to authenticate with the admin api without using an actual user by giving it as the 'admin_token' parameter. Example:

	```exs
	config :pleroma, :admin_token, "somerandomtoken"
	```

	You can then do

	```sh
	curl "http://localhost:4000/api/pleroma/admin/invite_token?admin_token=somerandomtoken"
	```

	## :pleroma_job_queue

	[Pleroma Job Queue](https://git.pleroma.social/pleroma/pleroma_job_queue) configuration: a list of queues with maximum concurrent jobs.

	Pleroma has the following queues:
	* `federator_outgoing` - Outgoing federation
	* `federator_incoming` - Incoming federation
	* `mailer` - Email sender, see [`Pleroma.Mailer`](#pleroma-mailer)
	* `scheduled_activities` - Scheduled activities, see [`Pleroma.ScheduledActivities`](#pleromascheduledactivity)

	Example:

	```elixir
	config :pleroma_job_queue, :queues,
	federator_incoming: 50,
	federator_outgoing: 50
	```

	This config contains two queues: `federator_incoming` and `federator_outgoing`. Both have the `max_jobs` set to `50`.

	## Pleroma.Web.Federator.RetryQueue

	* `enabled`: If set to `true`, failed federation jobs will be retried
	* `max_jobs`: The maximum amount of parallel federation jobs running at the same time.
	* `initial_timeout`: The initial timeout in seconds
	* `max_retries`: The maximum number of times a federation job is retried

	## Pleroma.Web.Metadata
	* `providers`: a list of metadata providers to enable. Providers availible:
	* Pleroma.Web.Metadata.Providers.OpenGraph
	* Pleroma.Web.Metadata.Providers.TwitterCard
	* `unfurl_nsfw`: If set to `true` nsfw attachments will be shown in previews

	## :rich_media
	* `enabled`: if enabled the instance will parse metadata from attached links to generate link previews

	## :fetch_initial_posts
	* `enabled`: if enabled, when a new user is federated with, fetch some of their latest posts
	* `pages`: the amount of pages to fetch

	## :hackney_pools

	Advanced. Tweaks Hackney (http client) connections pools.

	There's three pools used:

	* `:federation` for the federation jobs.
	You may want this pool max_connections to be at least equal to the number of federator jobs + retry queue jobs.
	* `:media` for rich media, media proxy
	* `:upload` for uploaded media (if using a remote uploader and `proxy_remote: true`)

	For each pool, the options are:

	* `max_connections` - how much connections a pool can hold
	* `timeout` - retention duration for connections

	## :auto_linker

	Configuration for the `auto_linker` library:

	* `class: "auto-linker"` - specify the class to be added to the generated link. false to clear
	* `rel: "noopener noreferrer"` - override the rel attribute. false to clear
	* `new_window: true` - set to false to remove `target='_blank'` attribute
	* `scheme: false` - Set to true to link urls with schema `http://google.com`
	* `truncate: false` - Set to a number to truncate urls longer then the number. Truncated urls will end in `..`
	* `strip_prefix: true` - Strip the scheme prefix
	* `extra: false` - link urls with rarely used schemes (magnet, ipfs, irc, etc.)

	Example:

	```exs
	config :auto_linker,
	opts: [
	scheme: true,
	extra: true,
	class: false,
	strip_prefix: false,
	new_window: false,
	rel: false
	]
	```

	+## Pleroma.ScheduledActivity
	+
	+* `daily_user_limit`: the number of scheduled activities a user is allowed to create in a single day (Default: `25`)
	+* `total_user_limit`: the number of scheduled activities a user is allowed to create in total (Default: `300`)
	+* `enabled`: whether scheduled activities are sent to the job queue to be executed
	+
	+## Pleroma.Web.Auth.Authenticator
	+
	+* `Pleroma.Web.Auth.PleromaAuthenticator`: default database authenticator
	+* `Pleroma.Web.Auth.LDAPAuthenticator`: LDAP authentication
	+
	## :ldap

	Use LDAP for user authentication. When a user logs in to the Pleroma
	instance, the name and password will be verified by trying to authenticate
	(bind) to an LDAP server. If a user exists in the LDAP directory but there
	is no account with the same name yet on the Pleroma instance then a new
	Pleroma account will be created with the same name as the LDAP user name.

	* `enabled`: enables LDAP authentication
	* `host`: LDAP server hostname
	* `port`: LDAP port, e.g. 389 or 636
	* `ssl`: true to use SSL, usually implies the port 636
	* `sslopts`: additional SSL options
	* `tls`: true to start TLS, usually implies the port 389
	* `tlsopts`: additional TLS options
	* `base`: LDAP base, e.g. "dc=example,dc=com"
	* `uid`: LDAP attribute name to authenticate the user, e.g. when "cn", the filter will be "cn=username,base"

	-## Pleroma.Web.Auth.Authenticator
	+## :auth

	-* `Pleroma.Web.Auth.PleromaAuthenticator`: default database authenticator
	-* `Pleroma.Web.Auth.LDAPAuthenticator`: LDAP authentication
	+Authentication / authorization settings.

	-## Pleroma.ScheduledActivity
	+* `auth_template`: authentication form template. By default it's `show.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/show.html.eex`.
	+* `oauth_consumer_template`: OAuth consumer mode authentication form template. By default it's `consumer.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex`.
	+* `oauth_consumer_strategies`: the list of enabled OAuth consumer strategies; by default it's set by OAUTH_CONSUMER_STRATEGIES environment variable.

	-* `daily_user_limit`: the number of scheduled activities a user is allowed to create in a single day (Default: `25`)
	-* `total_user_limit`: the number of scheduled activities a user is allowed to create in total (Default: `300`)
	-* `enabled`: whether scheduled activities are sent to the job queue to be executed
	+# OAuth consumer mode
	+
	+OAuth consumer mode allows sign in / sign up via external OAuth providers (e.g. Twitter, Facebook, Google, Microsoft, etc.).
	+Implementation is based on Ueberauth; see the list of [available strategies](https://github.com/ueberauth/ueberauth/wiki/List-of-Strategies).
	+
	+Note: each strategy is shipped as a separate dependency; in order to get the strategies, run `OAUTH_CONSUMER_STRATEGIES="..." mix deps.get`,
	+e.g. `OAUTH_CONSUMER_STRATEGIES="twitter facebook google microsoft" mix deps.get`.
	+The server should also be started with `OAUTH_CONSUMER_STRATEGIES="..." mix phx.server` in case you enable any strategies.
	+
	+Note: each strategy requires separate setup (on external provider side and Pleroma side). Below are the guidelines on setting up most popular strategies.
	+
	+* For Twitter, [register an app](https://developer.twitter.com/en/apps), configure callback URL to https://<your_host>/oauth/twitter/callback
	+
	+* For Facebook, [register an app](https://developers.facebook.com/apps), configure callback URL to https://<your_host>/oauth/facebook/callback, enable Facebook Login service at https://developers.facebook.com/apps/<app_id>/fb-login/settings/
	+
	+* For Google, [register an app](https://console.developers.google.com), configure callback URL to https://<your_host>/oauth/google/callback
	+
	+* For Microsoft, [register an app](https://portal.azure.com), configure callback URL to https://<your_host>/oauth/microsoft/callback
	+
	+Once the app is configured on external OAuth provider side, add app's credentials and strategy-specific settings (if any — e.g. see Microsoft below) to `config/prod.secret.exs`,
	+per strategy's documentation (e.g. [ueberauth_twitter](https://github.com/ueberauth/ueberauth_twitter)). Example config basing on environment variables:
	+
	+```
	+# Twitter
	+config :ueberauth, Ueberauth.Strategy.Twitter.OAuth,
	+ consumer_key: System.get_env("TWITTER_CONSUMER_KEY"),
	+ consumer_secret: System.get_env("TWITTER_CONSUMER_SECRET")
	+
	+# Facebook
	+config :ueberauth, Ueberauth.Strategy.Facebook.OAuth,
	+ client_id: System.get_env("FACEBOOK_APP_ID"),
	+ client_secret: System.get_env("FACEBOOK_APP_SECRET"),
	+ redirect_uri: System.get_env("FACEBOOK_REDIRECT_URI")
	+
	+# Google
	+config :ueberauth, Ueberauth.Strategy.Google.OAuth,
	+ client_id: System.get_env("GOOGLE_CLIENT_ID"),
	+ client_secret: System.get_env("GOOGLE_CLIENT_SECRET"),
	+ redirect_uri: System.get_env("GOOGLE_REDIRECT_URI")
	+
	+# Microsoft
	+config :ueberauth, Ueberauth.Strategy.Microsoft.OAuth,
	+ client_id: System.get_env("MICROSOFT_CLIENT_ID"),
	+ client_secret: System.get_env("MICROSOFT_CLIENT_SECRET")
	+
	+config :ueberauth, Ueberauth,
	+ providers: [
	+ microsoft: {Ueberauth.Strategy.Microsoft, [callback_params: []]}
	+ ]
	+```
	diff --git a/lib/pleroma/config.ex b/lib/pleroma/config.ex
	index 21507cd38..189faa15f 100644
	--- a/lib/pleroma/config.ex
	+++ b/lib/pleroma/config.ex
	@@ -1,60 +1,64 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Config do
	defmodule Error do
	defexception [:message]
	end

	def get(key), do: get(key, nil)

	def get([key], default), do: get(key, default)

	def get([parent_key \| keys], default) do
	Application.get_env(:pleroma, parent_key)
	\|> get_in(keys) \|\| default
	end

	def get(key, default) do
	Application.get_env(:pleroma, key, default)
	end

	def get!(key) do
	value = get(key, nil)

	if value == nil do
	raise(Error, message: "Missing configuration value: #{inspect(key)}")
	else
	value
	end
	end

	def put([key], value), do: put(key, value)

	def put([parent_key \| keys], value) do
	parent =
	Application.get_env(:pleroma, parent_key)
	\|> put_in(keys, value)

	Application.put_env(:pleroma, parent_key, parent)
	end

	def put(key, value) do
	Application.put_env(:pleroma, key, value)
	end

	def delete([key]), do: delete(key)

	def delete([parent_key \| keys]) do
	{_, parent} =
	Application.get_env(:pleroma, parent_key)
	\|> get_and_update_in(keys, fn _ -> :pop end)

	Application.put_env(:pleroma, parent_key, parent)
	end

	def delete(key) do
	Application.delete_env(:pleroma, key)
	end
	+
	+ def oauth_consumer_strategies, do: get([:auth, :oauth_consumer_strategies], [])
	+
	+ def oauth_consumer_enabled?, do: oauth_consumer_strategies() != []
	end
	diff --git a/lib/pleroma/registration.ex b/lib/pleroma/registration.ex
	new file mode 100644
	index 000000000..21fd1fc3f
	--- /dev/null
	+++ b/lib/pleroma/registration.ex
	@@ -0,0 +1,57 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Registration do
	+ use Ecto.Schema
	+
	+ import Ecto.Changeset
	+
	+ alias Pleroma.Registration
	+ alias Pleroma.Repo
	+ alias Pleroma.User
	+
	+ @primary_key {:id, Pleroma.FlakeId, autogenerate: true}
	+
	+ schema "registrations" do
	+ belongs_to(:user, User, type: Pleroma.FlakeId)
	+ field(:provider, :string)
	+ field(:uid, :string)
	+ field(:info, :map, default: %{})
	+
	+ timestamps()
	+ end
	+
	+ def nickname(registration, default \\ nil),
	+ do: Map.get(registration.info, "nickname", default)
	+
	+ def email(registration, default \\ nil),
	+ do: Map.get(registration.info, "email", default)
	+
	+ def name(registration, default \\ nil),
	+ do: Map.get(registration.info, "name", default)
	+
	+ def description(registration, default \\ nil),
	+ do: Map.get(registration.info, "description", default)
	+
	+ def changeset(registration, params \\ %{}) do
	+ registration
	+ \|> cast(params, [:user_id, :provider, :uid, :info])
	+ \|> validate_required([:provider, :uid])
	+ \|> foreign_key_constraint(:user_id)
	+ \|> unique_constraint(:uid, name: :registrations_provider_uid_index)
	+ end
	+
	+ def bind_to_user(registration, user) do
	+ registration
	+ \|> changeset(%{user_id: (user && user.id) \|\| nil})
	+ \|> Repo.update()
	+ end
	+
	+ def get_by_provider_uid(provider, uid) do
	+ Repo.get_by(Registration,
	+ provider: to_string(provider),
	+ uid: to_string(uid)
	+ )
	+ end
	+end
	diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
	index 5012aef77..05f56c01e 100644
	--- a/lib/pleroma/user.ex
	+++ b/lib/pleroma/user.ex
	@@ -1,1379 +1,1387 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.User do
	use Ecto.Schema

	import Ecto.Changeset
	import Ecto.Query

	alias Comeonin.Pbkdf2
	alias Pleroma.Activity
	alias Pleroma.Formatter
	alias Pleroma.Notification
	alias Pleroma.Object
	+ alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.CommonAPI.Utils, as: CommonUtils
	alias Pleroma.Web.OAuth
	alias Pleroma.Web.OStatus
	alias Pleroma.Web.RelMe
	alias Pleroma.Web.Websub

	require Logger

	@type t :: %__MODULE__{}

	@primary_key {:id, Pleroma.FlakeId, autogenerate: true}

	# credo:disable-for-next-line Credo.Check.Readability.MaxLineLength
	@email_regex ~r/^[a-zA-Z0-9.!#$%&'+\/=?^_`{\|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)$/

	@strict_local_nickname_regex ~r/^[a-zA-Z\d]+$/
	@extended_local_nickname_regex ~r/^[a-zA-Z\d_-]+$/

	schema "users" do
	field(:bio, :string)
	field(:email, :string)
	field(:name, :string)
	field(:nickname, :string)
	field(:password_hash, :string)
	field(:password, :string, virtual: true)
	field(:password_confirmation, :string, virtual: true)
	field(:following, {:array, :string}, default: [])
	field(:ap_id, :string)
	field(:avatar, :map)
	field(:local, :boolean, default: true)
	field(:follower_address, :string)
	field(:search_rank, :float, virtual: true)
	field(:search_type, :integer, virtual: true)
	field(:tags, {:array, :string}, default: [])
	field(:bookmarks, {:array, :string}, default: [])
	field(:last_refreshed_at, :naive_datetime_usec)
	has_many(:notifications, Notification)
	+ has_many(:registrations, Registration)
	embeds_one(:info, Pleroma.User.Info)

	timestamps()
	end

	def auth_active?(%User{info: %User.Info{confirmation_pending: true}}),
	do: !Pleroma.Config.get([:instance, :account_activation_required])

	def auth_active?(%User{}), do: true

	def visible_for?(user, for_user \\ nil)

	def visible_for?(%User{id: user_id}, %User{id: for_id}) when user_id == for_id, do: true

	def visible_for?(%User{} = user, for_user) do
	auth_active?(user) \|\| superuser?(for_user)
	end

	def visible_for?(_, _), do: false

	def superuser?(%User{local: true, info: %User.Info{is_admin: true}}), do: true
	def superuser?(%User{local: true, info: %User.Info{is_moderator: true}}), do: true
	def superuser?(_), do: false

	def avatar_url(user, options \\ []) do
	case user.avatar do
	%{"url" => [%{"href" => href} \| _]} -> href
	_ -> !options[:no_default] && "#{Web.base_url()}/images/avi.png"
	end
	end

	def banner_url(user, options \\ []) do
	case user.info.banner do
	%{"url" => [%{"href" => href} \| _]} -> href
	_ -> !options[:no_default] && "#{Web.base_url()}/images/banner.png"
	end
	end

	def profile_url(%User{info: %{source_data: %{"url" => url}}}), do: url
	def profile_url(%User{ap_id: ap_id}), do: ap_id
	def profile_url(_), do: nil

	def ap_id(%User{nickname: nickname}) do
	"#{Web.base_url()}/users/#{nickname}"
	end

	def ap_followers(%User{follower_address: fa}) when is_binary(fa), do: fa
	def ap_followers(%User{} = user), do: "#{ap_id(user)}/followers"

	def user_info(%User{} = user) do
	oneself = if user.local, do: 1, else: 0

	%{
	following_count: length(user.following) - oneself,
	note_count: user.info.note_count,
	follower_count: user.info.follower_count,
	locked: user.info.locked,
	confirmation_pending: user.info.confirmation_pending,
	default_scope: user.info.default_scope
	}
	end

	def remote_user_creation(params) do
	params =
	params
	\|> Map.put(:info, params[:info] \|\| %{})

	info_cng = User.Info.remote_user_creation(%User.Info{}, params[:info])

	changes =
	%User{}
	\|> cast(params, [:bio, :name, :ap_id, :nickname, :avatar])
	\|> validate_required([:name, :ap_id])
	\|> unique_constraint(:nickname)
	\|> validate_format(:nickname, @email_regex)
	\|> validate_length(:bio, max: 5000)
	\|> validate_length(:name, max: 100)
	\|> put_change(:local, false)
	\|> put_embed(:info, info_cng)

	if changes.valid? do
	case info_cng.changes[:source_data] do
	%{"followers" => followers} ->
	changes
	\|> put_change(:follower_address, followers)

	_ ->
	followers = User.ap_followers(%User{nickname: changes.changes[:nickname]})

	changes
	\|> put_change(:follower_address, followers)
	end
	else
	changes
	end
	end

	def update_changeset(struct, params \\ %{}) do
	struct
	\|> cast(params, [:bio, :name, :avatar])
	\|> unique_constraint(:nickname)
	\|> validate_format(:nickname, local_nickname_regex())
	\|> validate_length(:bio, max: 5000)
	\|> validate_length(:name, min: 1, max: 100)
	end

	def upgrade_changeset(struct, params \\ %{}) do
	params =
	params
	\|> Map.put(:last_refreshed_at, NaiveDateTime.utc_now())

	info_cng =
	struct.info
	\|> User.Info.user_upgrade(params[:info])

	struct
	\|> cast(params, [:bio, :name, :follower_address, :avatar, :last_refreshed_at])
	\|> unique_constraint(:nickname)
	\|> validate_format(:nickname, local_nickname_regex())
	\|> validate_length(:bio, max: 5000)
	\|> validate_length(:name, max: 100)
	\|> put_embed(:info, info_cng)
	end

	def password_update_changeset(struct, params) do
	changeset =
	struct
	\|> cast(params, [:password, :password_confirmation])
	\|> validate_required([:password, :password_confirmation])
	\|> validate_confirmation(:password)

	OAuth.Token.delete_user_tokens(struct)
	OAuth.Authorization.delete_user_authorizations(struct)

	if changeset.valid? do
	hashed = Pbkdf2.hashpwsalt(changeset.changes[:password])

	changeset
	\|> put_change(:password_hash, hashed)
	else
	changeset
	end
	end

	def reset_password(user, data) do
	update_and_set_cache(password_update_changeset(user, data))
	end

	def register_changeset(struct, params \\ %{}, opts \\ []) do
	confirmation_status =
	if opts[:confirmed] \|\| !Pleroma.Config.get([:instance, :account_activation_required]) do
	:confirmed
	else
	:unconfirmed
	end

	info_change = User.Info.confirmation_changeset(%User.Info{}, confirmation_status)

	changeset =
	struct
	\|> cast(params, [:bio, :email, :name, :nickname, :password, :password_confirmation])
	- \|> validate_required([:email, :name, :nickname, :password, :password_confirmation])
	+ \|> validate_required([:name, :nickname, :password, :password_confirmation])
	\|> validate_confirmation(:password)
	\|> unique_constraint(:email)
	\|> unique_constraint(:nickname)
	\|> validate_exclusion(:nickname, Pleroma.Config.get([Pleroma.User, :restricted_nicknames]))
	\|> validate_format(:nickname, local_nickname_regex())
	\|> validate_format(:email, @email_regex)
	\|> validate_length(:bio, max: 1000)
	\|> validate_length(:name, min: 1, max: 100)
	\|> put_change(:info, info_change)

	+ changeset =
	+ if opts[:external] do
	+ changeset
	+ else
	+ validate_required(changeset, [:email])
	+ end
	+
	if changeset.valid? do
	hashed = Pbkdf2.hashpwsalt(changeset.changes[:password])
	ap_id = User.ap_id(%User{nickname: changeset.changes[:nickname]})
	followers = User.ap_followers(%User{nickname: changeset.changes[:nickname]})

	changeset
	\|> put_change(:password_hash, hashed)
	\|> put_change(:ap_id, ap_id)
	\|> unique_constraint(:ap_id)
	\|> put_change(:following, [followers])
	\|> put_change(:follower_address, followers)
	else
	changeset
	end
	end

	defp autofollow_users(user) do
	candidates = Pleroma.Config.get([:instance, :autofollowed_nicknames])

	autofollowed_users =
	from(u in User,
	where: u.local == true,
	where: u.nickname in ^candidates
	)
	\|> Repo.all()

	follow_all(user, autofollowed_users)
	end

	@doc "Inserts provided changeset, performs post-registration actions (confirmation email sending etc.)"
	def register(%Ecto.Changeset{} = changeset) do
	with {:ok, user} <- Repo.insert(changeset),
	{:ok, user} <- autofollow_users(user),
	{:ok, _} <- Pleroma.User.WelcomeMessage.post_welcome_message_to_user(user),
	{:ok, _} <- try_send_confirmation_email(user) do
	{:ok, user}
	end
	end

	def try_send_confirmation_email(%User{} = user) do
	if user.info.confirmation_pending &&
	Pleroma.Config.get([:instance, :account_activation_required]) do
	user
	\|> Pleroma.UserEmail.account_confirmation_email()
	\|> Pleroma.Mailer.deliver_async()
	else
	{:ok, :noop}
	end
	end

	def needs_update?(%User{local: true}), do: false

	def needs_update?(%User{local: false, last_refreshed_at: nil}), do: true

	def needs_update?(%User{local: false} = user) do
	NaiveDateTime.diff(NaiveDateTime.utc_now(), user.last_refreshed_at) >= 86_400
	end

	def needs_update?(_), do: true

	def maybe_direct_follow(%User{} = follower, %User{local: true, info: %{locked: true}}) do
	{:ok, follower}
	end

	def maybe_direct_follow(%User{} = follower, %User{local: true} = followed) do
	follow(follower, followed)
	end

	def maybe_direct_follow(%User{} = follower, %User{} = followed) do
	if not User.ap_enabled?(followed) do
	follow(follower, followed)
	else
	{:ok, follower}
	end
	end

	def maybe_follow(%User{} = follower, %User{info: _info} = followed) do
	if not following?(follower, followed) do
	follow(follower, followed)
	else
	{:ok, follower}
	end
	end

	@doc "A mass follow for local users. Respects blocks in both directions but does not create activities."
	@spec follow_all(User.t(), list(User.t())) :: {atom(), User.t()}
	def follow_all(follower, followeds) do
	followed_addresses =
	followeds
	\|> Enum.reject(fn followed -> blocks?(follower, followed) \|\| blocks?(followed, follower) end)
	\|> Enum.map(fn %{follower_address: fa} -> fa end)

	q =
	from(u in User,
	where: u.id == ^follower.id,
	update: [
	set: [
	following:
	fragment(
	"array(select distinct unnest (array_cat(?, ?)))",
	u.following,
	^followed_addresses
	)
	]
	],
	select: u
	)

	{1, [follower]} = Repo.update_all(q, [])

	Enum.each(followeds, fn followed ->
	update_follower_count(followed)
	end)

	set_cache(follower)
	end

	def follow(%User{} = follower, %User{info: info} = followed) do
	user_config = Application.get_env(:pleroma, :user)
	deny_follow_blocked = Keyword.get(user_config, :deny_follow_blocked)

	ap_followers = followed.follower_address

	cond do
	following?(follower, followed) or info.deactivated ->
	{:error, "Could not follow user: #{followed.nickname} is already on your list."}

	deny_follow_blocked and blocks?(followed, follower) ->
	{:error, "Could not follow user: #{followed.nickname} blocked you."}

	true ->
	if !followed.local && follower.local && !ap_enabled?(followed) do
	Websub.subscribe(follower, followed)
	end

	q =
	from(u in User,
	where: u.id == ^follower.id,
	update: [push: [following: ^ap_followers]],
	select: u
	)

	{1, [follower]} = Repo.update_all(q, [])

	{:ok, _} = update_follower_count(followed)

	set_cache(follower)
	end
	end

	def unfollow(%User{} = follower, %User{} = followed) do
	ap_followers = followed.follower_address

	if following?(follower, followed) and follower.ap_id != followed.ap_id do
	q =
	from(u in User,
	where: u.id == ^follower.id,
	update: [pull: [following: ^ap_followers]],
	select: u
	)

	{1, [follower]} = Repo.update_all(q, [])

	{:ok, followed} = update_follower_count(followed)

	set_cache(follower)

	{:ok, follower, Utils.fetch_latest_follow(follower, followed)}
	else
	{:error, "Not subscribed!"}
	end
	end

	@spec following?(User.t(), User.t()) :: boolean
	def following?(%User{} = follower, %User{} = followed) do
	Enum.member?(follower.following, followed.follower_address)
	end

	def follow_import(%User{} = follower, followed_identifiers)
	when is_list(followed_identifiers) do
	Enum.map(
	followed_identifiers,
	fn followed_identifier ->
	with %User{} = followed <- get_or_fetch(followed_identifier),
	{:ok, follower} <- maybe_direct_follow(follower, followed),
	{:ok, _} <- ActivityPub.follow(follower, followed) do
	followed
	else
	err ->
	Logger.debug("follow_import failed for #{followed_identifier} with: #{inspect(err)}")
	err
	end
	end
	)
	end

	def locked?(%User{} = user) do
	user.info.locked \|\| false
	end

	def get_by_id(id) do
	Repo.get_by(User, id: id)
	end

	def get_by_ap_id(ap_id) do
	Repo.get_by(User, ap_id: ap_id)
	end

	# This is mostly an SPC migration fix. This guesses the user nickname by taking the last part
	# of the ap_id and the domain and tries to get that user
	def get_by_guessed_nickname(ap_id) do
	domain = URI.parse(ap_id).host
	name = List.last(String.split(ap_id, "/"))
	nickname = "#{name}@#{domain}"

	get_by_nickname(nickname)
	end

	def set_cache(user) do
	Cachex.put(:user_cache, "ap_id:#{user.ap_id}", user)
	Cachex.put(:user_cache, "nickname:#{user.nickname}", user)
	Cachex.put(:user_cache, "user_info:#{user.id}", user_info(user))
	{:ok, user}
	end

	def update_and_set_cache(changeset) do
	with {:ok, user} <- Repo.update(changeset) do
	set_cache(user)
	else
	e -> e
	end
	end

	def invalidate_cache(user) do
	Cachex.del(:user_cache, "ap_id:#{user.ap_id}")
	Cachex.del(:user_cache, "nickname:#{user.nickname}")
	Cachex.del(:user_cache, "user_info:#{user.id}")
	end

	def get_cached_by_ap_id(ap_id) do
	key = "ap_id:#{ap_id}"
	Cachex.fetch!(:user_cache, key, fn _ -> get_by_ap_id(ap_id) end)
	end

	def get_cached_by_id(id) do
	key = "id:#{id}"

	ap_id =
	Cachex.fetch!(:user_cache, key, fn _ ->
	user = get_by_id(id)

	if user do
	Cachex.put(:user_cache, "ap_id:#{user.ap_id}", user)
	{:commit, user.ap_id}
	else
	{:ignore, ""}
	end
	end)

	get_cached_by_ap_id(ap_id)
	end

	def get_cached_by_nickname(nickname) do
	key = "nickname:#{nickname}"
	Cachex.fetch!(:user_cache, key, fn _ -> get_or_fetch_by_nickname(nickname) end)
	end

	def get_cached_by_nickname_or_id(nickname_or_id) do
	get_cached_by_id(nickname_or_id) \|\| get_cached_by_nickname(nickname_or_id)
	end

	def get_by_nickname(nickname) do
	Repo.get_by(User, nickname: nickname) \|\|
	if Regex.match?(~r(@#{Pleroma.Web.Endpoint.host()})i, nickname) do
	Repo.get_by(User, nickname: local_nickname(nickname))
	end
	end

	+ def get_by_email(email), do: Repo.get_by(User, email: email)
	+
	def get_by_nickname_or_email(nickname_or_email) do
	- case user = Repo.get_by(User, nickname: nickname_or_email) do
	- %User{} -> user
	- nil -> Repo.get_by(User, email: nickname_or_email)
	- end
	+ get_by_nickname(nickname_or_email) \|\| get_by_email(nickname_or_email)
	end

	def get_cached_user_info(user) do
	key = "user_info:#{user.id}"
	Cachex.fetch!(:user_cache, key, fn _ -> user_info(user) end)
	end

	def fetch_by_nickname(nickname) do
	ap_try = ActivityPub.make_user_from_nickname(nickname)

	case ap_try do
	{:ok, user} -> {:ok, user}
	_ -> OStatus.make_user(nickname)
	end
	end

	def get_or_fetch_by_nickname(nickname) do
	with %User{} = user <- get_by_nickname(nickname) do
	user
	else
	_e ->
	with [_nick, _domain] <- String.split(nickname, "@"),
	{:ok, user} <- fetch_by_nickname(nickname) do
	if Pleroma.Config.get([:fetch_initial_posts, :enabled]) do
	{:ok, _} = Task.start(__MODULE__, :fetch_initial_posts, [user])
	end

	user
	else
	_e -> nil
	end
	end
	end

	@doc "Fetch some posts when the user has just been federated with"
	def fetch_initial_posts(user) do
	pages = Pleroma.Config.get!([:fetch_initial_posts, :pages])

	Enum.each(
	# Insert all the posts in reverse order, so they're in the right order on the timeline
	Enum.reverse(Utils.fetch_ordered_collection(user.info.source_data["outbox"], pages)),
	&Pleroma.Web.Federator.incoming_ap_doc/1
	)
	end

	def get_followers_query(%User{id: id, follower_address: follower_address}, nil) do
	from(
	u in User,
	where: fragment("? <@ ?", ^[follower_address], u.following),
	where: u.id != ^id
	)
	end

	def get_followers_query(user, page) do
	from(u in get_followers_query(user, nil))
	\|> paginate(page, 20)
	end

	def get_followers_query(user), do: get_followers_query(user, nil)

	def get_followers(user, page \\ nil) do
	q = get_followers_query(user, page)

	{:ok, Repo.all(q)}
	end

	def get_followers_ids(user, page \\ nil) do
	q = get_followers_query(user, page)

	Repo.all(from(u in q, select: u.id))
	end

	def get_friends_query(%User{id: id, following: following}, nil) do
	from(
	u in User,
	where: u.follower_address in ^following,
	where: u.id != ^id
	)
	end

	def get_friends_query(user, page) do
	from(u in get_friends_query(user, nil))
	\|> paginate(page, 20)
	end

	def get_friends_query(user), do: get_friends_query(user, nil)

	def get_friends(user, page \\ nil) do
	q = get_friends_query(user, page)

	{:ok, Repo.all(q)}
	end

	def get_friends_ids(user, page \\ nil) do
	q = get_friends_query(user, page)

	Repo.all(from(u in q, select: u.id))
	end

	def get_follow_requests_query(%User{} = user) do
	from(
	a in Activity,
	where:
	fragment(
	"? ->> 'type' = 'Follow'",
	a.data
	),
	where:
	fragment(
	"? ->> 'state' = 'pending'",
	a.data
	),
	where:
	fragment(
	"coalesce((?)->'object'->>'id', (?)->>'object') = ?",
	a.data,
	a.data,
	^user.ap_id
	)
	)
	end

	def get_follow_requests(%User{} = user) do
	users =
	user
	\|> User.get_follow_requests_query()
	\|> join(:inner, [a], u in User, on: a.actor == u.ap_id)
	\|> where([a, u], not fragment("? @> ?", u.following, ^[user.follower_address]))
	\|> group_by([a, u], u.id)
	\|> select([a, u], u)
	\|> Repo.all()

	{:ok, users}
	end

	def increase_note_count(%User{} = user) do
	User
	\|> where(id: ^user.id)
	\|> update([u],
	set: [
	info:
	fragment(
	"jsonb_set(?, '{note_count}', ((?->>'note_count')::int + 1)::varchar::jsonb, true)",
	u.info,
	u.info
	)
	]
	)
	\|> select([u], u)
	\|> Repo.update_all([])
	\|> case do
	{1, [user]} -> set_cache(user)
	_ -> {:error, user}
	end
	end

	def decrease_note_count(%User{} = user) do
	User
	\|> where(id: ^user.id)
	\|> update([u],
	set: [
	info:
	fragment(
	"jsonb_set(?, '{note_count}', (greatest(0, (?->>'note_count')::int - 1))::varchar::jsonb, true)",
	u.info,
	u.info
	)
	]
	)
	\|> select([u], u)
	\|> Repo.update_all([])
	\|> case do
	{1, [user]} -> set_cache(user)
	_ -> {:error, user}
	end
	end

	def update_note_count(%User{} = user) do
	note_count_query =
	from(
	a in Object,
	where: fragment("?->>'actor' = ? and ?->>'type' = 'Note'", a.data, ^user.ap_id, a.data),
	select: count(a.id)
	)

	note_count = Repo.one(note_count_query)

	info_cng = User.Info.set_note_count(user.info, note_count)

	cng =
	change(user)
	\|> put_embed(:info, info_cng)

	update_and_set_cache(cng)
	end

	def update_follower_count(%User{} = user) do
	follower_count_query =
	User
	\|> where([u], ^user.follower_address in u.following)
	\|> where([u], u.id != ^user.id)
	\|> select([u], %{count: count(u.id)})

	User
	\|> where(id: ^user.id)
	\|> join(:inner, [u], s in subquery(follower_count_query))
	\|> update([u, s],
	set: [
	info:
	fragment(
	"jsonb_set(?, '{follower_count}', ?::varchar::jsonb, true)",
	u.info,
	s.count
	)
	]
	)
	\|> select([u], u)
	\|> Repo.update_all([])
	\|> case do
	{1, [user]} -> set_cache(user)
	_ -> {:error, user}
	end
	end

	def get_users_from_set_query(ap_ids, false) do
	from(
	u in User,
	where: u.ap_id in ^ap_ids
	)
	end

	def get_users_from_set_query(ap_ids, true) do
	query = get_users_from_set_query(ap_ids, false)

	from(
	u in query,
	where: u.local == true
	)
	end

	def get_users_from_set(ap_ids, local_only \\ true) do
	get_users_from_set_query(ap_ids, local_only)
	\|> Repo.all()
	end

	def get_recipients_from_activity(%Activity{recipients: to}) do
	query =
	from(
	u in User,
	where: u.ap_id in ^to,
	or_where: fragment("? && ?", u.following, ^to)
	)

	query = from(u in query, where: u.local == true)

	Repo.all(query)
	end

	def search(query, resolve \\ false, for_user \\ nil) do
	# Strip the beginning @ off if there is a query
	query = String.trim_leading(query, "@")

	if resolve, do: get_or_fetch(query)

	{:ok, results} =
	Repo.transaction(fn ->
	Ecto.Adapters.SQL.query(Repo, "select set_limit(0.25)", [])
	Repo.all(search_query(query, for_user))
	end)

	results
	end

	def search_query(query, for_user) do
	fts_subquery = fts_search_subquery(query)
	trigram_subquery = trigram_search_subquery(query)
	union_query = from(s in trigram_subquery, union_all: ^fts_subquery)
	distinct_query = from(s in subquery(union_query), order_by: s.search_type, distinct: s.id)

	from(s in subquery(boost_search_rank_query(distinct_query, for_user)),
	order_by: [desc: s.search_rank],
	limit: 20
	)
	end

	defp boost_search_rank_query(query, nil), do: query

	defp boost_search_rank_query(query, for_user) do
	friends_ids = get_friends_ids(for_user)
	followers_ids = get_followers_ids(for_user)

	from(u in subquery(query),
	select_merge: %{
	search_rank:
	fragment(
	"""
	CASE WHEN (?) THEN (?) * 1.3
	WHEN (?) THEN (?) * 1.2
	WHEN (?) THEN (?) * 1.1
	ELSE (?) END
	""",
	u.id in ^friends_ids and u.id in ^followers_ids,
	u.search_rank,
	u.id in ^friends_ids,
	u.search_rank,
	u.id in ^followers_ids,
	u.search_rank,
	u.search_rank
	)
	}
	)
	end

	defp fts_search_subquery(term, query \\ User) do
	processed_query =
	term
	\|> String.replace(~r/\W+/, " ")
	\|> String.trim()
	\|> String.split()
	\|> Enum.map(&(&1 <> ":*"))
	\|> Enum.join(" \| ")

	from(
	u in query,
	select_merge: %{
	search_type: ^0,
	search_rank:
	fragment(
	"""
	ts_rank_cd(
	setweight(to_tsvector('simple', regexp_replace(?, '\\W', ' ', 'g')), 'A') \|\|
	setweight(to_tsvector('simple', regexp_replace(coalesce(?, ''), '\\W', ' ', 'g')), 'B'),
	to_tsquery('simple', ?),
	32
	)
	""",
	u.nickname,
	u.name,
	^processed_query
	)
	},
	where:
	fragment(
	"""
	(setweight(to_tsvector('simple', regexp_replace(?, '\\W', ' ', 'g')), 'A') \|\|
	setweight(to_tsvector('simple', regexp_replace(coalesce(?, ''), '\\W', ' ', 'g')), 'B')) @@ to_tsquery('simple', ?)
	""",
	u.nickname,
	u.name,
	^processed_query
	)
	)
	end

	defp trigram_search_subquery(term) do
	from(
	u in User,
	select_merge: %{
	# ^1 gives 'Postgrex expected a binary, got 1' for some weird reason
	search_type: fragment("?", 1),
	search_rank:
	fragment(
	"similarity(?, trim(? \|\| ' ' \|\| coalesce(?, '')))",
	^term,
	u.nickname,
	u.name
	)
	},
	where: fragment("trim(? \|\| ' ' \|\| coalesce(?, '')) % ?", u.nickname, u.name, ^term)
	)
	end

	def blocks_import(%User{} = blocker, blocked_identifiers) when is_list(blocked_identifiers) do
	Enum.map(
	blocked_identifiers,
	fn blocked_identifier ->
	with %User{} = blocked <- get_or_fetch(blocked_identifier),
	{:ok, blocker} <- block(blocker, blocked),
	{:ok, _} <- ActivityPub.block(blocker, blocked) do
	blocked
	else
	err ->
	Logger.debug("blocks_import failed for #{blocked_identifier} with: #{inspect(err)}")
	err
	end
	end
	)
	end

	def mute(muter, %User{ap_id: ap_id}) do
	info_cng =
	muter.info
	\|> User.Info.add_to_mutes(ap_id)

	cng =
	change(muter)
	\|> put_embed(:info, info_cng)

	update_and_set_cache(cng)
	end

	def unmute(muter, %{ap_id: ap_id}) do
	info_cng =
	muter.info
	\|> User.Info.remove_from_mutes(ap_id)

	cng =
	change(muter)
	\|> put_embed(:info, info_cng)

	update_and_set_cache(cng)
	end

	def block(blocker, %User{ap_id: ap_id} = blocked) do
	# sever any follow relationships to prevent leaks per activitypub (Pleroma issue #213)
	blocker =
	if following?(blocker, blocked) do
	{:ok, blocker, _} = unfollow(blocker, blocked)
	blocker
	else
	blocker
	end

	if following?(blocked, blocker) do
	unfollow(blocked, blocker)
	end

	info_cng =
	blocker.info
	\|> User.Info.add_to_block(ap_id)

	cng =
	change(blocker)
	\|> put_embed(:info, info_cng)

	update_and_set_cache(cng)
	end

	# helper to handle the block given only an actor's AP id
	def block(blocker, %{ap_id: ap_id}) do
	block(blocker, User.get_by_ap_id(ap_id))
	end

	def unblock(blocker, %{ap_id: ap_id}) do
	info_cng =
	blocker.info
	\|> User.Info.remove_from_block(ap_id)

	cng =
	change(blocker)
	\|> put_embed(:info, info_cng)

	update_and_set_cache(cng)
	end

	def mutes?(nil, _), do: false
	def mutes?(user, %{ap_id: ap_id}), do: Enum.member?(user.info.mutes, ap_id)

	def blocks?(user, %{ap_id: ap_id}) do
	blocks = user.info.blocks
	domain_blocks = user.info.domain_blocks
	%{host: host} = URI.parse(ap_id)

	Enum.member?(blocks, ap_id) \|\|
	Enum.any?(domain_blocks, fn domain ->
	host == domain
	end)
	end

	def muted_users(user),
	do: Repo.all(from(u in User, where: u.ap_id in ^user.info.mutes))

	def blocked_users(user),
	do: Repo.all(from(u in User, where: u.ap_id in ^user.info.blocks))

	def block_domain(user, domain) do
	info_cng =
	user.info
	\|> User.Info.add_to_domain_block(domain)

	cng =
	change(user)
	\|> put_embed(:info, info_cng)

	update_and_set_cache(cng)
	end

	def unblock_domain(user, domain) do
	info_cng =
	user.info
	\|> User.Info.remove_from_domain_block(domain)

	cng =
	change(user)
	\|> put_embed(:info, info_cng)

	update_and_set_cache(cng)
	end

	def maybe_local_user_query(query, local) do
	if local, do: local_user_query(query), else: query
	end

	def local_user_query(query \\ User) do
	from(
	u in query,
	where: u.local == true,
	where: not is_nil(u.nickname)
	)
	end

	def maybe_external_user_query(query, external) do
	if external, do: external_user_query(query), else: query
	end

	def external_user_query(query \\ User) do
	from(
	u in query,
	where: u.local == false,
	where: not is_nil(u.nickname)
	)
	end

	def maybe_active_user_query(query, active) do
	if active, do: active_user_query(query), else: query
	end

	def active_user_query(query \\ User) do
	from(
	u in query,
	where: fragment("not (?->'deactivated' @> 'true')", u.info),
	where: not is_nil(u.nickname)
	)
	end

	def maybe_deactivated_user_query(query, deactivated) do
	if deactivated, do: deactivated_user_query(query), else: query
	end

	def deactivated_user_query(query \\ User) do
	from(
	u in query,
	where: fragment("(?->'deactivated' @> 'true')", u.info),
	where: not is_nil(u.nickname)
	)
	end

	def active_local_user_query do
	from(
	u in local_user_query(),
	where: fragment("not (?->'deactivated' @> 'true')", u.info)
	)
	end

	def moderator_user_query do
	from(
	u in User,
	where: u.local == true,
	where: fragment("?->'is_moderator' @> 'true'", u.info)
	)
	end

	def deactivate(%User{} = user, status \\ true) do
	info_cng = User.Info.set_activation_status(user.info, status)

	cng =
	change(user)
	\|> put_embed(:info, info_cng)

	update_and_set_cache(cng)
	end

	def delete(%User{} = user) do
	{:ok, user} = User.deactivate(user)

	# Remove all relationships
	{:ok, followers} = User.get_followers(user)

	Enum.each(followers, fn follower -> User.unfollow(follower, user) end)

	{:ok, friends} = User.get_friends(user)

	Enum.each(friends, fn followed -> User.unfollow(user, followed) end)

	delete_user_activities(user)
	end

	def delete_user_activities(%User{ap_id: ap_id} = user) do
	Activity
	\|> where(actor: ^ap_id)
	\|> Activity.with_preloaded_object()
	\|> Repo.all()
	\|> Enum.each(fn
	%{data: %{"type" => "Create"}} = activity ->
	activity \|> Object.normalize() \|> ActivityPub.delete()

	# TODO: Do something with likes, follows, repeats.
	_ ->
	"Doing nothing"
	end)

	{:ok, user}
	end

	def html_filter_policy(%User{info: %{no_rich_text: true}}) do
	Pleroma.HTML.Scrubber.TwitterText
	end

	@default_scrubbers Pleroma.Config.get([:markup, :scrub_policy])

	def html_filter_policy(_), do: @default_scrubbers

	def fetch_by_ap_id(ap_id) do
	ap_try = ActivityPub.make_user_from_ap_id(ap_id)

	case ap_try do
	{:ok, user} ->
	user

	_ ->
	case OStatus.make_user(ap_id) do
	{:ok, user} -> user
	_ -> {:error, "Could not fetch by AP id"}
	end
	end
	end

	def get_or_fetch_by_ap_id(ap_id) do
	user = get_by_ap_id(ap_id)

	if !is_nil(user) and !User.needs_update?(user) do
	user
	else
	# Whether to fetch initial posts for the user (if it's a new user & the fetching is enabled)
	should_fetch_initial = is_nil(user) and Pleroma.Config.get([:fetch_initial_posts, :enabled])

	user = fetch_by_ap_id(ap_id)

	if should_fetch_initial do
	with %User{} = user do
	{:ok, _} = Task.start(__MODULE__, :fetch_initial_posts, [user])
	end
	end

	user
	end
	end

	def get_or_create_instance_user do
	relay_uri = "#{Pleroma.Web.Endpoint.url()}/relay"

	if user = get_by_ap_id(relay_uri) do
	user
	else
	changes =
	%User{info: %User.Info{}}
	\|> cast(%{}, [:ap_id, :nickname, :local])
	\|> put_change(:ap_id, relay_uri)
	\|> put_change(:nickname, nil)
	\|> put_change(:local, true)
	\|> put_change(:follower_address, relay_uri <> "/followers")

	{:ok, user} = Repo.insert(changes)
	user
	end
	end

	# AP style
	def public_key_from_info(%{
	source_data: %{"publicKey" => %{"publicKeyPem" => public_key_pem}}
	}) do
	key =
	public_key_pem
	\|> :public_key.pem_decode()
	\|> hd()
	\|> :public_key.pem_entry_decode()

	{:ok, key}
	end

	# OStatus Magic Key
	def public_key_from_info(%{magic_key: magic_key}) do
	{:ok, Pleroma.Web.Salmon.decode_key(magic_key)}
	end

	def get_public_key_for_ap_id(ap_id) do
	with %User{} = user <- get_or_fetch_by_ap_id(ap_id),
	{:ok, public_key} <- public_key_from_info(user.info) do
	{:ok, public_key}
	else
	_ -> :error
	end
	end

	defp blank?(""), do: nil
	defp blank?(n), do: n

	def insert_or_update_user(data) do
	data =
	data
	\|> Map.put(:name, blank?(data[:name]) \|\| data[:nickname])

	cs = User.remote_user_creation(data)

	Repo.insert(cs, on_conflict: :replace_all, conflict_target: :nickname)
	end

	def ap_enabled?(%User{local: true}), do: true
	def ap_enabled?(%User{info: info}), do: info.ap_enabled
	def ap_enabled?(_), do: false

	@doc "Gets or fetch a user by uri or nickname."
	@spec get_or_fetch(String.t()) :: User.t()
	def get_or_fetch("http" <> _host = uri), do: get_or_fetch_by_ap_id(uri)
	def get_or_fetch(nickname), do: get_or_fetch_by_nickname(nickname)

	# wait a period of time and return newest version of the User structs
	# this is because we have synchronous follow APIs and need to simulate them
	# with an async handshake
	def wait_and_refresh(_, %User{local: true} = a, %User{local: true} = b) do
	with %User{} = a <- User.get_by_id(a.id),
	%User{} = b <- User.get_by_id(b.id) do
	{:ok, a, b}
	else
	_e ->
	:error
	end
	end

	def wait_and_refresh(timeout, %User{} = a, %User{} = b) do
	with :ok <- :timer.sleep(timeout),
	%User{} = a <- User.get_by_id(a.id),
	%User{} = b <- User.get_by_id(b.id) do
	{:ok, a, b}
	else
	_e ->
	:error
	end
	end

	def parse_bio(bio, user \\ %User{info: %{source_data: %{}}})
	def parse_bio(nil, _user), do: ""
	def parse_bio(bio, _user) when bio == "", do: bio

	def parse_bio(bio, user) do
	emoji =
	(user.info.source_data["tag"] \|\| [])
	\|> Enum.filter(fn %{"type" => t} -> t == "Emoji" end)
	\|> Enum.map(fn %{"icon" => %{"url" => url}, "name" => name} ->
	{String.trim(name, ":"), url}
	end)

	# TODO: get profile URLs other than user.ap_id
	profile_urls = [user.ap_id]

	bio
	\|> CommonUtils.format_input("text/plain",
	mentions_format: :full,
	rel: &RelMe.maybe_put_rel_me(&1, profile_urls)
	)
	\|> elem(0)
	\|> Formatter.emojify(emoji)
	end

	def tag(user_identifiers, tags) when is_list(user_identifiers) do
	Repo.transaction(fn ->
	for user_identifier <- user_identifiers, do: tag(user_identifier, tags)
	end)
	end

	def tag(nickname, tags) when is_binary(nickname),
	do: tag(User.get_by_nickname(nickname), tags)

	def tag(%User{} = user, tags),
	do: update_tags(user, Enum.uniq((user.tags \|\| []) ++ normalize_tags(tags)))

	def untag(user_identifiers, tags) when is_list(user_identifiers) do
	Repo.transaction(fn ->
	for user_identifier <- user_identifiers, do: untag(user_identifier, tags)
	end)
	end

	def untag(nickname, tags) when is_binary(nickname),
	do: untag(User.get_by_nickname(nickname), tags)

	def untag(%User{} = user, tags),
	do: update_tags(user, (user.tags \|\| []) -- normalize_tags(tags))

	defp update_tags(%User{} = user, new_tags) do
	{:ok, updated_user} =
	user
	\|> change(%{tags: new_tags})
	\|> update_and_set_cache()

	updated_user
	end

	def bookmark(%User{} = user, status_id) do
	bookmarks = Enum.uniq(user.bookmarks ++ [status_id])
	update_bookmarks(user, bookmarks)
	end

	def unbookmark(%User{} = user, status_id) do
	bookmarks = Enum.uniq(user.bookmarks -- [status_id])
	update_bookmarks(user, bookmarks)
	end

	def update_bookmarks(%User{} = user, bookmarks) do
	user
	\|> change(%{bookmarks: bookmarks})
	\|> update_and_set_cache
	end

	defp normalize_tags(tags) do
	[tags]
	\|> List.flatten()
	\|> Enum.map(&String.downcase(&1))
	end

	defp local_nickname_regex do
	if Pleroma.Config.get([:instance, :extended_nickname_format]) do
	@extended_local_nickname_regex
	else
	@strict_local_nickname_regex
	end
	end

	def local_nickname(nickname_or_mention) do
	nickname_or_mention
	\|> full_nickname()
	\|> String.split("@")
	\|> hd()
	end

	def full_nickname(nickname_or_mention),
	do: String.trim_leading(nickname_or_mention, "@")

	def error_user(ap_id) do
	%User{
	name: ap_id,
	ap_id: ap_id,
	info: %User.Info{},
	nickname: "erroruser@example.com",
	inserted_at: NaiveDateTime.utc_now()
	}
	end

	def all_superusers do
	from(
	u in User,
	where: u.local == true,
	where: fragment("?->'is_admin' @> 'true' OR ?->'is_moderator' @> 'true'", u.info, u.info)
	)
	\|> Repo.all()
	end

	defp paginate(query, page, page_size) do
	from(u in query,
	limit: ^page_size,
	offset: ^((page - 1) * page_size)
	)
	end

	def showing_reblogs?(%User{} = user, %User{} = target) do
	target.ap_id not in user.info.muted_reblogs
	end
	end
	diff --git a/lib/pleroma/web/auth/authenticator.ex b/lib/pleroma/web/auth/authenticator.ex
	index 82267c595..89d88af32 100644
	--- a/lib/pleroma/web/auth/authenticator.ex
	+++ b/lib/pleroma/web/auth/authenticator.ex
	@@ -1,25 +1,45 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.Authenticator do
	+ alias Pleroma.Registration
	alias Pleroma.User

	def implementation do
	Pleroma.Config.get(
	Pleroma.Web.Auth.Authenticator,
	Pleroma.Web.Auth.PleromaAuthenticator
	)
	end

	- @callback get_user(Plug.Conn.t()) :: {:ok, User.t()} \| {:error, any()}
	- def get_user(plug), do: implementation().get_user(plug)
	+ @callback get_user(Plug.Conn.t(), Map.t()) :: {:ok, User.t()} \| {:error, any()}
	+ def get_user(plug, params), do: implementation().get_user(plug, params)
	+
	+ @callback create_from_registration(Plug.Conn.t(), Map.t(), Registration.t()) ::
	+ {:ok, User.t()} \| {:error, any()}
	+ def create_from_registration(plug, params, registration),
	+ do: implementation().create_from_registration(plug, params, registration)
	+
	+ @callback get_registration(Plug.Conn.t(), Map.t()) ::
	+ {:ok, Registration.t()} \| {:error, any()}
	+ def get_registration(plug, params),
	+ do: implementation().get_registration(plug, params)

	@callback handle_error(Plug.Conn.t(), any()) :: any()
	def handle_error(plug, error), do: implementation().handle_error(plug, error)

	@callback auth_template() :: String.t() \| nil
	def auth_template do
	- implementation().auth_template() \|\| Pleroma.Config.get(:auth_template, "show.html")
	+ # Note: `config :pleroma, :auth_template, "..."` support is deprecated
	+ implementation().auth_template() \|\|
	+ Pleroma.Config.get([:auth, :auth_template], Pleroma.Config.get(:auth_template)) \|\|
	+ "show.html"
	+ end
	+
	+ @callback oauth_consumer_template() :: String.t() \| nil
	+ def oauth_consumer_template do
	+ implementation().oauth_consumer_template() \|\|
	+ Pleroma.Config.get([:auth, :oauth_consumer_template], "consumer.html")
	end
	end
	diff --git a/lib/pleroma/web/auth/ldap_authenticator.ex b/lib/pleroma/web/auth/ldap_authenticator.ex
	index 88217aab8..8b6d5a77f 100644
	--- a/lib/pleroma/web/auth/ldap_authenticator.ex
	+++ b/lib/pleroma/web/auth/ldap_authenticator.ex
	@@ -1,143 +1,150 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.LDAPAuthenticator do
	alias Pleroma.User

	require Logger

	@behaviour Pleroma.Web.Auth.Authenticator
	+ @base Pleroma.Web.Auth.PleromaAuthenticator

	@connection_timeout 10_000
	@search_timeout 10_000

	- def get_user(%Plug.Conn{} = conn) do
	+ defdelegate get_registration(conn, params), to: @base
	+
	+ defdelegate create_from_registration(conn, params, registration), to: @base
	+
	+ def get_user(%Plug.Conn{} = conn, params) do
	if Pleroma.Config.get([:ldap, :enabled]) do
	{name, password} =
	- case conn.params do
	+ case params do
	%{"authorization" => %{"name" => name, "password" => password}} ->
	{name, password}

	%{"grant_type" => "password", "username" => name, "password" => password} ->
	{name, password}
	end

	case ldap_user(name, password) do
	%User{} = user ->
	{:ok, user}

	{:error, {:ldap_connection_error, _}} ->
	# When LDAP is unavailable, try default authenticator
	- Pleroma.Web.Auth.PleromaAuthenticator.get_user(conn)
	+ @base.get_user(conn, params)

	error ->
	error
	end
	else
	# Fall back to default authenticator
	- Pleroma.Web.Auth.PleromaAuthenticator.get_user(conn)
	+ @base.get_user(conn, params)
	end
	end

	def handle_error(%Plug.Conn{} = _conn, error) do
	error
	end

	def auth_template, do: nil

	+ def oauth_consumer_template, do: nil
	+
	defp ldap_user(name, password) do
	ldap = Pleroma.Config.get(:ldap, [])
	host = Keyword.get(ldap, :host, "localhost")
	port = Keyword.get(ldap, :port, 389)
	ssl = Keyword.get(ldap, :ssl, false)
	sslopts = Keyword.get(ldap, :sslopts, [])

	options =
	[{:port, port}, {:ssl, ssl}, {:timeout, @connection_timeout}] ++
	if sslopts != [], do: [{:sslopts, sslopts}], else: []

	case :eldap.open([to_charlist(host)], options) do
	{:ok, connection} ->
	try do
	if Keyword.get(ldap, :tls, false) do
	:application.ensure_all_started(:ssl)

	case :eldap.start_tls(
	connection,
	Keyword.get(ldap, :tlsopts, []),
	@connection_timeout
	) do
	:ok ->
	:ok

	error ->
	Logger.error("Could not start TLS: #{inspect(error)}")
	end
	end

	bind_user(connection, ldap, name, password)
	after
	:eldap.close(connection)
	end

	{:error, error} ->
	Logger.error("Could not open LDAP connection: #{inspect(error)}")
	{:error, {:ldap_connection_error, error}}
	end
	end

	defp bind_user(connection, ldap, name, password) do
	uid = Keyword.get(ldap, :uid, "cn")
	base = Keyword.get(ldap, :base)

	case :eldap.simple_bind(connection, "#{uid}=#{name},#{base}", password) do
	:ok ->
	case User.get_by_nickname_or_email(name) do
	%User{} = user ->
	user

	_ ->
	register_user(connection, base, uid, name, password)
	end

	error ->
	error
	end
	end

	defp register_user(connection, base, uid, name, password) do
	case :eldap.search(connection, [
	{:base, to_charlist(base)},
	{:filter, :eldap.equalityMatch(to_charlist(uid), to_charlist(name))},
	{:scope, :eldap.wholeSubtree()},
	{:attributes, ['mail', 'email']},
	{:timeout, @search_timeout}
	]) do
	{:ok, {:eldap_search_result, [{:eldap_entry, _, attributes}], _}} ->
	with {_, [mail]} <- List.keyfind(attributes, 'mail', 0) do
	params = %{
	email: :erlang.list_to_binary(mail),
	name: name,
	nickname: name,
	password: password,
	password_confirmation: password
	}

	changeset = User.register_changeset(%User{}, params)

	case User.register(changeset) do
	{:ok, user} -> user
	error -> error
	end
	else
	_ ->
	Logger.error("Could not find LDAP attribute mail: #{inspect(attributes)}")
	{:error, :ldap_registration_missing_attributes}
	end

	error ->
	error
	end
	end
	end
	diff --git a/lib/pleroma/web/auth/pleroma_authenticator.ex b/lib/pleroma/web/auth/pleroma_authenticator.ex
	index 94a19ad49..c826adb4c 100644
	--- a/lib/pleroma/web/auth/pleroma_authenticator.ex
	+++ b/lib/pleroma/web/auth/pleroma_authenticator.ex
	@@ -1,35 +1,97 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.PleromaAuthenticator do
	alias Comeonin.Pbkdf2
	+ alias Pleroma.Registration
	+ alias Pleroma.Repo
	alias Pleroma.User

	@behaviour Pleroma.Web.Auth.Authenticator

	- def get_user(%Plug.Conn{} = conn) do
	+ def get_user(%Plug.Conn{} = _conn, params) do
	{name, password} =
	- case conn.params do
	+ case params do
	%{"authorization" => %{"name" => name, "password" => password}} ->
	{name, password}

	%{"grant_type" => "password", "username" => name, "password" => password} ->
	{name, password}
	end

	with {_, %User{} = user} <- {:user, User.get_by_nickname_or_email(name)},
	{_, true} <- {:checkpw, Pbkdf2.checkpw(password, user.password_hash)} do
	{:ok, user}
	else
	error ->
	{:error, error}
	end
	end

	+ def get_registration(
	+ %Plug.Conn{assigns: %{ueberauth_auth: %{provider: provider, uid: uid} = auth}},
	+ _params
	+ ) do
	+ registration = Registration.get_by_provider_uid(provider, uid)
	+
	+ if registration do
	+ {:ok, registration}
	+ else
	+ info = auth.info
	+
	+ Registration.changeset(%Registration{}, %{
	+ provider: to_string(provider),
	+ uid: to_string(uid),
	+ info: %{
	+ "nickname" => info.nickname,
	+ "email" => info.email,
	+ "name" => info.name,
	+ "description" => info.description
	+ }
	+ })
	+ \|> Repo.insert()
	+ end
	+ end
	+
	+ def get_registration(%Plug.Conn{} = _conn, _params), do: {:error, :missing_credentials}
	+
	+ def create_from_registration(_conn, params, registration) do
	+ nickname = value([params["nickname"], Registration.nickname(registration)])
	+ email = value([params["email"], Registration.email(registration)])
	+ name = value([params["name"], Registration.name(registration)]) \|\| nickname
	+ bio = value([params["bio"], Registration.description(registration)])
	+
	+ random_password = :crypto.strong_rand_bytes(64) \|> Base.encode64()
	+
	+ with {:ok, new_user} <-
	+ User.register_changeset(
	+ %User{},
	+ %{
	+ email: email,
	+ nickname: nickname,
	+ name: name,
	+ bio: bio,
	+ password: random_password,
	+ password_confirmation: random_password
	+ },
	+ external: true,
	+ confirmed: true
	+ )
	+ \|> Repo.insert(),
	+ {:ok, _} <-
	+ Registration.changeset(registration, %{user_id: new_user.id}) \|> Repo.update() do
	+ {:ok, new_user}
	+ end
	+ end
	+
	+ defp value(list), do: Enum.find(list, &(to_string(&1) != ""))
	+
	def handle_error(%Plug.Conn{} = _conn, error) do
	error
	end

	def auth_template, do: nil
	+
	+ def oauth_consumer_template, do: nil
	end
	diff --git a/lib/pleroma/web/endpoint.ex b/lib/pleroma/web/endpoint.ex
	index 6d9528c86..1633477c3 100644
	--- a/lib/pleroma/web/endpoint.ex
	+++ b/lib/pleroma/web/endpoint.ex
	@@ -1,110 +1,120 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Endpoint do
	use Phoenix.Endpoint, otp_app: :pleroma

	socket("/socket", Pleroma.Web.UserSocket)

	# Serve at "/" the static files from "priv/static" directory.
	#
	# You should set gzip to true if you are running phoenix.digest
	# when deploying your static files in production.
	plug(CORSPlug)
	plug(Pleroma.Plugs.HTTPSecurityPlug)

	plug(Pleroma.Plugs.UploadedMedia)

	# InstanceStatic needs to be before Plug.Static to be able to override shipped-static files
	# If you're adding new paths to `only:` you'll need to configure them in InstanceStatic as well
	plug(Pleroma.Plugs.InstanceStatic, at: "/")

	plug(
	Plug.Static,
	at: "/",
	from: :pleroma,
	only:
	~w(index.html robots.txt static finmoji emoji packs sounds images instance sw.js sw-pleroma.js favicon.png schemas doc)
	# credo:disable-for-previous-line Credo.Check.Readability.MaxLineLength
	)

	# Code reloading can be explicitly enabled under the
	# :code_reloader configuration of your endpoint.
	if code_reloading? do
	plug(Phoenix.CodeReloader)
	end

	plug(TrailingFormatPlug)
	plug(Plug.RequestId)
	plug(Plug.Logger)

	plug(
	Plug.Parsers,
	parsers: [:urlencoded, :multipart, :json],
	pass: ["/"],
	json_decoder: Jason,
	length: Application.get_env(:pleroma, :instance) \|> Keyword.get(:upload_limit),
	body_reader: {Pleroma.Web.Plugs.DigestPlug, :read_body, []}
	)

	plug(Plug.MethodOverride)
	plug(Plug.Head)

	+ secure_cookies = Pleroma.Config.get([__MODULE__, :secure_cookie_flag])
	+
	cookie_name =
	- if Application.get_env(:pleroma, Pleroma.Web.Endpoint) \|> Keyword.get(:secure_cookie_flag),
	+ if secure_cookies,
	do: "__Host-pleroma_key",
	else: "pleroma_key"

	+ same_site =
	+ if Pleroma.Config.oauth_consumer_enabled?() do
	+ # Note: "SameSite=Strict" prevents sign in with external OAuth provider
	+ # (there would be no cookies during callback request from OAuth provider)
	+ "SameSite=Lax"
	+ else
	+ "SameSite=Strict"
	+ end
	+
	# The session will be stored in the cookie and signed,
	# this means its contents can be read but not tampered with.
	# Set :encryption_salt if you would also like to encrypt it.
	plug(
	Plug.Session,
	store: :cookie,
	key: cookie_name,
	signing_salt: {Pleroma.Config, :get, [[__MODULE__, :signing_salt], "CqaoopA2"]},
	http_only: true,
	- secure:
	- Application.get_env(:pleroma, Pleroma.Web.Endpoint) \|> Keyword.get(:secure_cookie_flag),
	- extra: "SameSite=Strict"
	+ secure: secure_cookies,
	+ extra: same_site
	)

	# Note: the plug and its configuration is compile-time this can't be upstreamed yet
	if proxies = Pleroma.Config.get([__MODULE__, :reverse_proxies]) do
	plug(RemoteIp, proxies: proxies)
	end

	defmodule Instrumenter do
	use Prometheus.PhoenixInstrumenter
	end

	defmodule PipelineInstrumenter do
	use Prometheus.PlugPipelineInstrumenter
	end

	defmodule MetricsExporter do
	use Prometheus.PlugExporter
	end

	plug(PipelineInstrumenter)
	plug(MetricsExporter)

	plug(Pleroma.Web.Router)

	@doc """
	Dynamically loads configuration from the system environment
	on startup.

	It receives the endpoint configuration from the config files
	and must return the updated configuration.
	"""
	def load_from_system_env(config) do
	port = System.get_env("PORT") \|\| raise "expected the PORT environment variable to be set"
	{:ok, Keyword.put(config, :http, [:inet6, port: port])}
	end

	def websocket_url do
	String.replace_leading(url(), "http", "ws")
	end
	end
	diff --git a/lib/pleroma/web/oauth/fallback_controller.ex b/lib/pleroma/web/oauth/fallback_controller.ex
	index f0fe3b578..afaa00242 100644
	--- a/lib/pleroma/web/oauth/fallback_controller.ex
	+++ b/lib/pleroma/web/oauth/fallback_controller.ex
	@@ -1,16 +1,29 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.FallbackController do
	use Pleroma.Web, :controller
	alias Pleroma.Web.OAuth.OAuthController

	- # No user/password
	- def call(conn, _) do
	+ def call(conn, {:register, :generic_error}) do
	+ conn
	+ \|> put_status(:internal_server_error)
	+ \|> put_flash(:error, "Unknown error, please check the details and try again.")
	+ \|> OAuthController.registration_details(conn.params)
	+ end
	+
	+ def call(conn, {:register, _error}) do
	+ conn
	+ \|> put_status(:unauthorized)
	+ \|> put_flash(:error, "Invalid Username/Password")
	+ \|> OAuthController.registration_details(conn.params)
	+ end
	+
	+ def call(conn, _error) do
	conn
	\|> put_status(:unauthorized)
	\|> put_flash(:error, "Invalid Username/Password")
	\|> OAuthController.authorize(conn.params["authorization"])
	end
	end
	diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
	index aac8f97fc..bee7084ad 100644
	--- a/lib/pleroma/web/oauth/oauth_controller.ex
	+++ b/lib/pleroma/web/oauth/oauth_controller.ex
	@@ -1,251 +1,436 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthController do
	use Pleroma.Web, :controller

	+ alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.Auth.Authenticator
	alias Pleroma.Web.ControllerHelper
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Token

	import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2]

	+ if Pleroma.Config.oauth_consumer_enabled?(), do: plug(Ueberauth)
	+
	plug(:fetch_session)
	plug(:fetch_flash)

	action_fallback(Pleroma.Web.OAuth.FallbackController)

	def authorize(%{assigns: %{token: %Token{} = token}} = conn, params) do
	if ControllerHelper.truthy_param?(params["force_login"]) do
	do_authorize(conn, params)
	else
	redirect_uri =
	if is_binary(params["redirect_uri"]) do
	params["redirect_uri"]
	else
	app = Repo.preload(token, :app).app

	app.redirect_uris
	\|> String.split()
	\|> Enum.at(0)
	end

	redirect(conn, external: redirect_uri(conn, redirect_uri))
	end
	end

	def authorize(conn, params), do: do_authorize(conn, params)

	defp do_authorize(conn, params) do
	app = Repo.get_by(App, client_id: params["client_id"])
	available_scopes = (app && app.scopes) \|\| []
	scopes = oauth_scopes(params, nil) \|\| available_scopes

	render(conn, Authenticator.auth_template(), %{
	response_type: params["response_type"],
	client_id: params["client_id"],
	available_scopes: available_scopes,
	scopes: scopes,
	redirect_uri: params["redirect_uri"],
	state: params["state"],
	params: params
	})
	end

	- def create_authorization(conn, %{
	- "authorization" =>
	- %{
	- "client_id" => client_id,
	- "redirect_uri" => redirect_uri
	- } = auth_params
	- }) do
	- with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn)},
	- %App{} = app <- Repo.get_by(App, client_id: client_id),
	- true <- redirect_uri in String.split(app.redirect_uris),
	- scopes <- oauth_scopes(auth_params, []),
	- {:unsupported_scopes, []} <- {:unsupported_scopes, scopes -- app.scopes},
	- # Note: `scope` param is intentionally not optional in this context
	- {:missing_scopes, false} <- {:missing_scopes, scopes == []},
	- {:auth_active, true} <- {:auth_active, User.auth_active?(user)},
	- {:ok, auth} <- Authorization.create_authorization(app, user, scopes) do
	- redirect_uri = redirect_uri(conn, redirect_uri)
	+ def create_authorization(
	+ conn,
	+ %{"authorization" => auth_params} = params,
	+ opts \\ []
	+ ) do
	+ with {:ok, auth} <- do_create_authorization(conn, params, opts[:user]) do
	+ after_create_authorization(conn, auth, auth_params)
	+ else
	+ error ->
	+ handle_create_authorization_error(conn, error, auth_params)
	+ end
	+ end

	- cond do
	- redirect_uri == "urn:ietf:wg:oauth:2.0:oob" ->
	- render(conn, "results.html", %{
	- auth: auth
	- })
	+ def after_create_authorization(conn, auth, %{"redirect_uri" => redirect_uri} = auth_params) do
	+ redirect_uri = redirect_uri(conn, redirect_uri)

	- true ->
	- connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?"
	- url = "#{redirect_uri}#{connector}"
	- url_params = %{:code => auth.token}
	+ if redirect_uri == "urn:ietf:wg:oauth:2.0:oob" do
	+ render(conn, "results.html", %{
	+ auth: auth
	+ })
	+ else
	+ connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?"
	+ url = "#{redirect_uri}#{connector}"
	+ url_params = %{:code => auth.token}

	- url_params =
	- if auth_params["state"] do
	- Map.put(url_params, :state, auth_params["state"])
	- else
	- url_params
	- end
	+ url_params =
	+ if auth_params["state"] do
	+ Map.put(url_params, :state, auth_params["state"])
	+ else
	+ url_params
	+ end

	- url = "#{url}#{Plug.Conn.Query.encode(url_params)}"
	+ url = "#{url}#{Plug.Conn.Query.encode(url_params)}"

	- redirect(conn, external: url)
	- end
	- else
	- {scopes_issue, _} when scopes_issue in [:unsupported_scopes, :missing_scopes] ->
	- # Per https://github.com/tootsuite/mastodon/blob/
	- # 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L39
	- conn
	- \|> put_flash(:error, "This action is outside the authorized scopes")
	- \|> put_status(:unauthorized)
	- \|> authorize(auth_params)
	+ redirect(conn, external: url)
	+ end
	+ end

	- {:auth_active, false} ->
	- # Per https://github.com/tootsuite/mastodon/blob/
	- # 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L76
	- conn
	- \|> put_flash(:error, "Your login is missing a confirmed e-mail address")
	- \|> put_status(:forbidden)
	- \|> authorize(auth_params)
	+ defp handle_create_authorization_error(conn, {scopes_issue, _}, auth_params)
	+ when scopes_issue in [:unsupported_scopes, :missing_scopes] do
	+ # Per https://github.com/tootsuite/mastodon/blob/
	+ # 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L39
	+ conn
	+ \|> put_flash(:error, "This action is outside the authorized scopes")
	+ \|> put_status(:unauthorized)
	+ \|> authorize(auth_params)
	+ end

	- error ->
	- Authenticator.handle_error(conn, error)
	- end
	+ defp handle_create_authorization_error(conn, {:auth_active, false}, auth_params) do
	+ # Per https://github.com/tootsuite/mastodon/blob/
	+ # 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L76
	+ conn
	+ \|> put_flash(:error, "Your login is missing a confirmed e-mail address")
	+ \|> put_status(:forbidden)
	+ \|> authorize(auth_params)
	+ end
	+
	+ defp handle_create_authorization_error(conn, error, _auth_params) do
	+ Authenticator.handle_error(conn, error)
	end

	def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do
	with %App{} = app <- get_app_from_request(conn, params),
	fixed_token = fix_padding(params["code"]),
	%Authorization{} = auth <-
	Repo.get_by(Authorization, token: fixed_token, app_id: app.id),
	%User{} = user <- User.get_by_id(auth.user_id),
	{:ok, token} <- Token.exchange_token(app, auth),
	{:ok, inserted_at} <- DateTime.from_naive(token.inserted_at, "Etc/UTC") do
	response = %{
	token_type: "Bearer",
	access_token: token.token,
	refresh_token: token.refresh_token,
	created_at: DateTime.to_unix(inserted_at),
	expires_in: 60 * 10,
	scope: Enum.join(token.scopes, " "),
	me: user.ap_id
	}

	json(conn, response)
	else
	_error ->
	put_status(conn, 400)
	\|> json(%{error: "Invalid credentials"})
	end
	end

	def token_exchange(
	conn,
	%{"grant_type" => "password"} = params
	) do
	- with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn)},
	+ with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn, params)},
	%App{} = app <- get_app_from_request(conn, params),
	{:auth_active, true} <- {:auth_active, User.auth_active?(user)},
	{:user_active, true} <- {:user_active, !user.info.deactivated},
	scopes <- oauth_scopes(params, app.scopes),
	[] <- scopes -- app.scopes,
	true <- Enum.any?(scopes),
	{:ok, auth} <- Authorization.create_authorization(app, user, scopes),
	{:ok, token} <- Token.exchange_token(app, auth) do
	response = %{
	token_type: "Bearer",
	access_token: token.token,
	refresh_token: token.refresh_token,
	expires_in: 60 * 10,
	scope: Enum.join(token.scopes, " "),
	me: user.ap_id
	}

	json(conn, response)
	else
	{:auth_active, false} ->
	# Per https://github.com/tootsuite/mastodon/blob/
	# 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L76
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: "Your login is missing a confirmed e-mail address"})

	{:user_active, false} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: "Your account is currently disabled"})

	_error ->
	put_status(conn, 400)
	\|> json(%{error: "Invalid credentials"})
	end
	end

	def token_exchange(
	conn,
	%{"grant_type" => "password", "name" => name, "password" => _password} = params
	) do
	params =
	params
	\|> Map.delete("name")
	\|> Map.put("username", name)

	token_exchange(conn, params)
	end

	def token_revoke(conn, %{"token" => token} = params) do
	with %App{} = app <- get_app_from_request(conn, params),
	%Token{} = token <- Repo.get_by(Token, token: token, app_id: app.id),
	{:ok, %Token{}} <- Repo.delete(token) do
	json(conn, %{})
	else
	_error ->
	# RFC 7009: invalid tokens [in the request] do not cause an error response
	json(conn, %{})
	end
	end

	+ @doc "Prepares OAuth request to provider for Ueberauth"
	+ def prepare_request(conn, %{"provider" => provider} = params) do
	+ scope =
	+ oauth_scopes(params, [])
	+ \|> Enum.join(" ")
	+
	+ state =
	+ params
	+ \|> Map.delete("scopes")
	+ \|> Map.put("scope", scope)
	+ \|> Poison.encode!()
	+
	+ params =
	+ params
	+ \|> Map.drop(~w(scope scopes client_id redirect_uri))
	+ \|> Map.put("state", state)
	+
	+ # Handing the request to Ueberauth
	+ redirect(conn, to: o_auth_path(conn, :request, provider, params))
	+ end
	+
	+ def request(conn, params) do
	+ message =
	+ if params["provider"] do
	+ "Unsupported OAuth provider: #{params["provider"]}."
	+ else
	+ "Bad OAuth request."
	+ end
	+
	+ conn
	+ \|> put_flash(:error, message)
	+ \|> redirect(to: "/")
	+ end
	+
	+ def callback(%{assigns: %{ueberauth_failure: failure}} = conn, params) do
	+ params = callback_params(params)
	+ messages = for e <- Map.get(failure, :errors, []), do: e.message
	+ message = Enum.join(messages, "; ")
	+
	+ conn
	+ \|> put_flash(:error, "Failed to authenticate: #{message}.")
	+ \|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	+ end
	+
	+ def callback(conn, params) do
	+ params = callback_params(params)
	+
	+ with {:ok, registration} <- Authenticator.get_registration(conn, params) do
	+ user = Repo.preload(registration, :user).user
	+ auth_params = Map.take(params, ~w(client_id redirect_uri scope scopes state))
	+
	+ if user do
	+ create_authorization(
	+ conn,
	+ %{"authorization" => auth_params},
	+ user: user
	+ )
	+ else
	+ registration_params =
	+ Map.merge(auth_params, %{
	+ "nickname" => Registration.nickname(registration),
	+ "email" => Registration.email(registration)
	+ })
	+
	+ conn
	+ \|> put_session(:registration_id, registration.id)
	+ \|> registration_details(registration_params)
	+ end
	+ else
	+ _ ->
	+ conn
	+ \|> put_flash(:error, "Failed to set up user account.")
	+ \|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	+ end
	+ end
	+
	+ defp callback_params(%{"state" => state} = params) do
	+ Map.merge(params, Poison.decode!(state))
	+ end
	+
	+ def registration_details(conn, params) do
	+ render(conn, "register.html", %{
	+ client_id: params["client_id"],
	+ redirect_uri: params["redirect_uri"],
	+ state: params["state"],
	+ scopes: oauth_scopes(params, []),
	+ nickname: params["nickname"],
	+ email: params["email"]
	+ })
	+ end
	+
	+ def register(conn, %{"op" => "connect"} = params) do
	+ authorization_params = Map.put(params, "name", params["auth_name"])
	+ create_authorization_params = %{"authorization" => authorization_params}
	+
	+ with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	+ %Registration{} = registration <- Repo.get(Registration, registration_id),
	+ {_, {:ok, auth}} <-
	+ {:create_authorization, do_create_authorization(conn, create_authorization_params)},
	+ %User{} = user <- Repo.preload(auth, :user).user,
	+ {:ok, _updated_registration} <- Registration.bind_to_user(registration, user) do
	+ conn
	+ \|> put_session_registration_id(nil)
	+ \|> after_create_authorization(auth, authorization_params)
	+ else
	+ {:create_authorization, error} ->
	+ {:register, handle_create_authorization_error(conn, error, create_authorization_params)}
	+
	+ _ ->
	+ {:register, :generic_error}
	+ end
	+ end
	+
	+ def register(conn, %{"op" => "register"} = params) do
	+ with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	+ %Registration{} = registration <- Repo.get(Registration, registration_id),
	+ {:ok, user} <- Authenticator.create_from_registration(conn, params, registration) do
	+ conn
	+ \|> put_session_registration_id(nil)
	+ \|> create_authorization(
	+ %{
	+ "authorization" => %{
	+ "client_id" => params["client_id"],
	+ "redirect_uri" => params["redirect_uri"],
	+ "scopes" => oauth_scopes(params, nil)
	+ }
	+ },
	+ user: user
	+ )
	+ else
	+ {:error, changeset} ->
	+ message =
	+ Enum.map(changeset.errors, fn {field, {error, _}} ->
	+ "#{field} #{error}"
	+ end)
	+ \|> Enum.join("; ")
	+
	+ message =
	+ String.replace(
	+ message,
	+ "ap_id has already been taken",
	+ "nickname has already been taken"
	+ )
	+
	+ conn
	+ \|> put_status(:forbidden)
	+ \|> put_flash(:error, "Error: #{message}.")
	+ \|> registration_details(params)
	+
	+ _ ->
	+ {:register, :generic_error}
	+ end
	+ end
	+
	+ defp do_create_authorization(
	+ conn,
	+ %{
	+ "authorization" =>
	+ %{
	+ "client_id" => client_id,
	+ "redirect_uri" => redirect_uri
	+ } = auth_params
	+ } = params,
	+ user \\ nil
	+ ) do
	+ with {_, {:ok, %User{} = user}} <-
	+ {:get_user, (user && {:ok, user}) \|\| Authenticator.get_user(conn, params)},
	+ %App{} = app <- Repo.get_by(App, client_id: client_id),
	+ true <- redirect_uri in String.split(app.redirect_uris),
	+ scopes <- oauth_scopes(auth_params, []),
	+ {:unsupported_scopes, []} <- {:unsupported_scopes, scopes -- app.scopes},
	+ # Note: `scope` param is intentionally not optional in this context
	+ {:missing_scopes, false} <- {:missing_scopes, scopes == []},
	+ {:auth_active, true} <- {:auth_active, User.auth_active?(user)} do
	+ Authorization.create_authorization(app, user, scopes)
	+ end
	+ end
	+
	# XXX - for whatever reason our token arrives urlencoded, but Plug.Conn should be
	# decoding it. Investigate sometime.
	defp fix_padding(token) do
	token
	\|> URI.decode()
	\|> Base.url_decode64!(padding: false)
	\|> Base.url_encode64(padding: false)
	end

	defp get_app_from_request(conn, params) do
	# Per RFC 6749, HTTP Basic is preferred to body params
	{client_id, client_secret} =
	with ["Basic " <> encoded] <- get_req_header(conn, "authorization"),
	{:ok, decoded} <- Base.decode64(encoded),
	[id, secret] <-
	String.split(decoded, ":")
	\|> Enum.map(fn s -> URI.decode_www_form(s) end) do
	{id, secret}
	else
	_ -> {params["client_id"], params["client_secret"]}
	end

	if client_id && client_secret do
	Repo.get_by(
	App,
	client_id: client_id,
	client_secret: client_secret
	)
	else
	nil
	end
	end

	# Special case: Local MastodonFE
	defp redirect_uri(conn, "."), do: mastodon_api_url(conn, :login)

	defp redirect_uri(_conn, redirect_uri), do: redirect_uri
	+
	+ defp get_session_registration_id(conn), do: get_session(conn, :registration_id)
	+
	+ defp put_session_registration_id(conn, registration_id),
	+ do: put_session(conn, :registration_id, registration_id)
	end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 3b5ac6fdd..ef38fc34d 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,699 +1,714 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router

	+ pipeline :browser do
	+ plug(:accepts, ["html"])
	+ plug(:fetch_session)
	+ end
	+
	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	end

	pipeline :api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :authenticated_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	end

	pipeline :admin_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.AdminSecretAuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.UserIsAdminPlug)
	end

	pipeline :mastodon_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :pleroma_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :oauth_read_or_unauthenticated do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{
	scopes: ["read"],
	fallback: :proceed_unauthenticated
	})
	end

	pipeline :oauth_read do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["read"]})
	end

	pipeline :oauth_write do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["write"]})
	end

	pipeline :oauth_follow do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["follow"]})
	end

	pipeline :oauth_push do
	plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["push"]})
	end

	pipeline :well_known do
	plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", UtilController, :show_password_reset)
	post("/password_reset", UtilController, :password_reset)
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	end

	scope "/api/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	scope "/api/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through([:admin_api, :oauth_write])

	post("/user/follow", AdminAPIController, :user_follow)
	post("/user/unfollow", AdminAPIController, :user_unfollow)

	get("/users", AdminAPIController, :list_users)
	get("/users/:nickname", AdminAPIController, :user_show)

	delete("/user", AdminAPIController, :user_delete)
	patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
	post("/user", AdminAPIController, :user_create)
	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)

	get("/permission_group/:nickname", AdminAPIController, :right_get)
	get("/permission_group/:nickname/:permission_group", AdminAPIController, :right_get)
	post("/permission_group/:nickname/:permission_group", AdminAPIController, :right_add)
	delete("/permission_group/:nickname/:permission_group", AdminAPIController, :right_delete)

	put("/activation_status/:nickname", AdminAPIController, :set_activation_status)

	post("/relay", AdminAPIController, :relay_follow)
	delete("/relay", AdminAPIController, :relay_unfollow)

	get("/invite_token", AdminAPIController, :get_invite_token)
	post("/email_invite", AdminAPIController, :email_invite)

	get("/password_reset", AdminAPIController, :get_password_reset)
	end

	scope "/", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_html)

	post("/main/ostatus", UtilController, :remote_subscribe)
	get("/ostatus_subscribe", UtilController, :remote_follow)

	scope [] do
	pipe_through(:oauth_follow)
	post("/ostatus_subscribe", UtilController, :do_remote_follow)
	end
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:authenticated_api)

	scope [] do
	pipe_through(:oauth_write)

	post("/change_password", UtilController, :change_password)
	post("/delete_account", UtilController, :delete_account)
	end

	scope [] do
	pipe_through(:oauth_follow)

	post("/blocks_import", UtilController, :blocks_import)
	post("/follow_import", UtilController, :follow_import)
	end

	scope [] do
	pipe_through(:oauth_read)

	post("/notifications/read", UtilController, :notifications_read)
	end
	end

	scope "/oauth", Pleroma.Web.OAuth do
	scope [] do
	pipe_through(:oauth)
	get("/authorize", OAuthController, :authorize)
	end

	post("/authorize", OAuthController, :create_authorization)
	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	+ get("/registration_details", OAuthController, :registration_details)
	+
	+ scope [] do
	+ pipe_through(:browser)
	+
	+ get("/prepare_request", OAuthController, :prepare_request)
	+ get("/:provider", OAuthController, :request)
	+ get("/:provider/callback", OAuthController, :callback)
	+ post("/register", OAuthController, :register)
	+ end
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	scope [] do
	pipe_through(:oauth_read)

	get("/accounts/verify_credentials", MastodonAPIController, :verify_credentials)

	get("/accounts/relationships", MastodonAPIController, :relationships)
	get("/accounts/search", MastodonAPIController, :account_search)

	get("/accounts/:id/lists", MastodonAPIController, :account_lists)
	get("/accounts/:id/identity_proofs", MastodonAPIController, :empty_array)

	get("/follow_requests", MastodonAPIController, :follow_requests)
	get("/blocks", MastodonAPIController, :blocks)
	get("/mutes", MastodonAPIController, :mutes)

	get("/timelines/home", MastodonAPIController, :home_timeline)
	get("/timelines/direct", MastodonAPIController, :dm_timeline)

	get("/favourites", MastodonAPIController, :favourites)
	get("/bookmarks", MastodonAPIController, :bookmarks)

	post("/notifications/clear", MastodonAPIController, :clear_notifications)
	post("/notifications/dismiss", MastodonAPIController, :dismiss_notification)
	get("/notifications", MastodonAPIController, :notifications)
	get("/notifications/:id", MastodonAPIController, :get_notification)

	get("/scheduled_statuses", MastodonAPIController, :scheduled_statuses)
	get("/scheduled_statuses/:id", MastodonAPIController, :show_scheduled_status)

	get("/lists", MastodonAPIController, :get_lists)
	get("/lists/:id", MastodonAPIController, :get_list)
	get("/lists/:id/accounts", MastodonAPIController, :list_accounts)

	get("/domain_blocks", MastodonAPIController, :domain_blocks)

	get("/filters", MastodonAPIController, :get_filters)

	get("/suggestions", MastodonAPIController, :suggestions)

	get("/endorsements", MastodonAPIController, :empty_array)

	get("/pleroma/flavour", MastodonAPIController, :get_flavour)
	end

	scope [] do
	pipe_through(:oauth_write)

	patch("/accounts/update_credentials", MastodonAPIController, :update_credentials)

	post("/statuses", MastodonAPIController, :post_status)
	delete("/statuses/:id", MastodonAPIController, :delete_status)

	post("/statuses/:id/reblog", MastodonAPIController, :reblog_status)
	post("/statuses/:id/unreblog", MastodonAPIController, :unreblog_status)
	post("/statuses/:id/favourite", MastodonAPIController, :fav_status)
	post("/statuses/:id/unfavourite", MastodonAPIController, :unfav_status)
	post("/statuses/:id/pin", MastodonAPIController, :pin_status)
	post("/statuses/:id/unpin", MastodonAPIController, :unpin_status)
	post("/statuses/:id/bookmark", MastodonAPIController, :bookmark_status)
	post("/statuses/:id/unbookmark", MastodonAPIController, :unbookmark_status)
	post("/statuses/:id/mute", MastodonAPIController, :mute_conversation)
	post("/statuses/:id/unmute", MastodonAPIController, :unmute_conversation)

	put("/scheduled_statuses/:id", MastodonAPIController, :update_scheduled_status)
	delete("/scheduled_statuses/:id", MastodonAPIController, :delete_scheduled_status)

	post("/media", MastodonAPIController, :upload)
	put("/media/:id", MastodonAPIController, :update_media)

	delete("/lists/:id", MastodonAPIController, :delete_list)
	post("/lists", MastodonAPIController, :create_list)
	put("/lists/:id", MastodonAPIController, :rename_list)

	post("/lists/:id/accounts", MastodonAPIController, :add_to_list)
	delete("/lists/:id/accounts", MastodonAPIController, :remove_from_list)

	post("/filters", MastodonAPIController, :create_filter)
	get("/filters/:id", MastodonAPIController, :get_filter)
	put("/filters/:id", MastodonAPIController, :update_filter)
	delete("/filters/:id", MastodonAPIController, :delete_filter)

	post("/pleroma/flavour/:flavour", MastodonAPIController, :set_flavour)

	post("/reports", MastodonAPIController, :reports)
	end

	scope [] do
	pipe_through(:oauth_follow)

	post("/follows", MastodonAPIController, :follow)
	post("/accounts/:id/follow", MastodonAPIController, :follow)

	post("/accounts/:id/unfollow", MastodonAPIController, :unfollow)
	post("/accounts/:id/block", MastodonAPIController, :block)
	post("/accounts/:id/unblock", MastodonAPIController, :unblock)
	post("/accounts/:id/mute", MastodonAPIController, :mute)
	post("/accounts/:id/unmute", MastodonAPIController, :unmute)

	post("/follow_requests/:id/authorize", MastodonAPIController, :authorize_follow_request)
	post("/follow_requests/:id/reject", MastodonAPIController, :reject_follow_request)

	post("/domain_blocks", MastodonAPIController, :block_domain)
	delete("/domain_blocks", MastodonAPIController, :unblock_domain)
	end

	scope [] do
	pipe_through(:oauth_push)

	post("/push/subscription", SubscriptionController, :create)
	get("/push/subscription", SubscriptionController, :get)
	put("/push/subscription", SubscriptionController, :update)
	delete("/push/subscription", SubscriptionController, :delete)
	end
	end

	scope "/api/web", Pleroma.Web.MastodonAPI do
	pipe_through([:authenticated_api, :oauth_write])

	put("/settings", MastodonAPIController, :put_settings)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	get("/instance", MastodonAPIController, :masto_instance)
	get("/instance/peers", MastodonAPIController, :peers)
	post("/apps", MastodonAPIController, :create_app)
	get("/apps/verify_credentials", MastodonAPIController, :verify_app_credentials)
	get("/custom_emojis", MastodonAPIController, :custom_emojis)

	get("/statuses/:id/card", MastodonAPIController, :status_card)

	get("/statuses/:id/favourited_by", MastodonAPIController, :favourited_by)
	get("/statuses/:id/reblogged_by", MastodonAPIController, :reblogged_by)

	get("/trends", MastodonAPIController, :empty_array)

	scope [] do
	pipe_through(:oauth_read_or_unauthenticated)

	get("/timelines/public", MastodonAPIController, :public_timeline)
	get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline)
	get("/timelines/list/:list_id", MastodonAPIController, :list_timeline)

	get("/statuses/:id", MastodonAPIController, :get_status)
	get("/statuses/:id/context", MastodonAPIController, :get_context)

	get("/accounts/:id/statuses", MastodonAPIController, :user_statuses)
	get("/accounts/:id/followers", MastodonAPIController, :followers)
	get("/accounts/:id/following", MastodonAPIController, :following)
	get("/accounts/:id", MastodonAPIController, :user)

	get("/search", MastodonAPIController, :search)
	end
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	pipe_through([:api, :oauth_read_or_unauthenticated])
	get("/search", MastodonAPIController, :search2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	get("/help/test", TwitterAPI.UtilController, :help_test)
	post("/help/test", TwitterAPI.UtilController, :help_test)
	get("/statusnet/config", TwitterAPI.UtilController, :config)
	get("/statusnet/version", TwitterAPI.UtilController, :version)
	get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	post("/account/register", TwitterAPI.Controller, :register)
	post("/account/password_reset", TwitterAPI.Controller, :password_reset)

	post("/account/resend_confirmation_email", TwitterAPI.Controller, :resend_confirmation_email)

	get(
	"/account/confirm_email/:user_id/:token",
	TwitterAPI.Controller,
	:confirm_email,
	as: :confirm_email
	)

	scope [] do
	pipe_through(:oauth_read_or_unauthenticated)

	get("/statuses/user_timeline", TwitterAPI.Controller, :user_timeline)
	get("/qvitter/statuses/user_timeline", TwitterAPI.Controller, :user_timeline)
	get("/users/show", TwitterAPI.Controller, :show_user)

	get("/statuses/followers", TwitterAPI.Controller, :followers)
	get("/statuses/friends", TwitterAPI.Controller, :friends)
	get("/statuses/blocks", TwitterAPI.Controller, :blocks)
	get("/statuses/show/:id", TwitterAPI.Controller, :fetch_status)
	get("/statusnet/conversation/:id", TwitterAPI.Controller, :fetch_conversation)

	get("/search", TwitterAPI.Controller, :search)
	get("/statusnet/tags/timeline/:tag", TwitterAPI.Controller, :public_and_external_timeline)
	end
	end

	scope "/api", Pleroma.Web do
	pipe_through([:api, :oauth_read_or_unauthenticated])

	get("/statuses/public_timeline", TwitterAPI.Controller, :public_timeline)

	get(
	"/statuses/public_and_external_timeline",
	TwitterAPI.Controller,
	:public_and_external_timeline
	)

	get("/statuses/networkpublic_timeline", TwitterAPI.Controller, :public_and_external_timeline)
	end

	scope "/api", Pleroma.Web, as: :twitter_api_search do
	pipe_through([:api, :oauth_read_or_unauthenticated])
	get("/pleroma/search_user", TwitterAPI.Controller, :search_user)
	end

	scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	pipe_through(:authenticated_api)

	get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)

	scope [] do
	pipe_through(:oauth_read)

	get("/account/verify_credentials", TwitterAPI.Controller, :verify_credentials)
	post("/account/verify_credentials", TwitterAPI.Controller, :verify_credentials)

	get("/statuses/home_timeline", TwitterAPI.Controller, :friends_timeline)
	get("/statuses/friends_timeline", TwitterAPI.Controller, :friends_timeline)
	get("/statuses/mentions", TwitterAPI.Controller, :mentions_timeline)
	get("/statuses/mentions_timeline", TwitterAPI.Controller, :mentions_timeline)
	get("/statuses/dm_timeline", TwitterAPI.Controller, :dm_timeline)
	get("/qvitter/statuses/notifications", TwitterAPI.Controller, :notifications)

	get("/pleroma/friend_requests", TwitterAPI.Controller, :friend_requests)

	get("/friends/ids", TwitterAPI.Controller, :friends_ids)
	get("/friendships/no_retweets/ids", TwitterAPI.Controller, :empty_array)

	get("/mutes/users/ids", TwitterAPI.Controller, :empty_array)
	get("/qvitter/mutes", TwitterAPI.Controller, :raw_empty_array)

	get("/externalprofile/show", TwitterAPI.Controller, :external_profile)

	post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read)
	end

	scope [] do
	pipe_through(:oauth_write)

	post("/account/update_profile", TwitterAPI.Controller, :update_profile)
	post("/account/update_profile_banner", TwitterAPI.Controller, :update_banner)
	post("/qvitter/update_background_image", TwitterAPI.Controller, :update_background)

	post("/statuses/update", TwitterAPI.Controller, :status_update)
	post("/statuses/retweet/:id", TwitterAPI.Controller, :retweet)
	post("/statuses/unretweet/:id", TwitterAPI.Controller, :unretweet)
	post("/statuses/destroy/:id", TwitterAPI.Controller, :delete_post)

	post("/statuses/pin/:id", TwitterAPI.Controller, :pin)
	post("/statuses/unpin/:id", TwitterAPI.Controller, :unpin)

	post("/statusnet/media/upload", TwitterAPI.Controller, :upload)
	post("/media/upload", TwitterAPI.Controller, :upload_json)
	post("/media/metadata/create", TwitterAPI.Controller, :update_media)

	post("/favorites/create/:id", TwitterAPI.Controller, :favorite)
	post("/favorites/create", TwitterAPI.Controller, :favorite)
	post("/favorites/destroy/:id", TwitterAPI.Controller, :unfavorite)

	post("/qvitter/update_avatar", TwitterAPI.Controller, :update_avatar)
	end

	scope [] do
	pipe_through(:oauth_follow)

	post("/pleroma/friendships/approve", TwitterAPI.Controller, :approve_friend_request)
	post("/pleroma/friendships/deny", TwitterAPI.Controller, :deny_friend_request)

	post("/friendships/create", TwitterAPI.Controller, :follow)
	post("/friendships/destroy", TwitterAPI.Controller, :unfollow)

	post("/blocks/create", TwitterAPI.Controller, :block)
	post("/blocks/destroy", TwitterAPI.Controller, :unblock)
	end
	end

	pipeline :ap_relay do
	plug(:accepts, ["activity+json", "json"])
	end

	pipeline :ostatus do
	plug(:accepts, ["html", "xml", "atom", "activity+json", "json"])
	end

	pipeline :oembed do
	plug(:accepts, ["json", "xml"])
	end

	scope "/", Pleroma.Web do
	pipe_through(:ostatus)

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)
	get("/users/:nickname/feed", OStatus.OStatusController, :feed)
	get("/users/:nickname", OStatus.OStatusController, :feed_redirect)

	post("/users/:nickname/salmon", OStatus.OStatusController, :salmon_incoming)
	post("/push/hub/:nickname", Websub.WebsubController, :websub_subscription_request)
	get("/push/subscriptions/:id", Websub.WebsubController, :websub_subscription_confirmation)
	post("/push/subscriptions/:id", Websub.WebsubController, :websub_incoming)
	end

	scope "/", Pleroma.Web do
	pipe_through(:oembed)

	get("/oembed", OEmbed.OEmbedController, :url)
	end

	pipeline :activitypub do
	plug(:accepts, ["activity+json", "json"])
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	# XXX: not really ostatus
	pipe_through(:ostatus)

	get("/users/:nickname/followers", ActivityPubController, :followers)
	get("/users/:nickname/following", ActivityPubController, :following)
	get("/users/:nickname/outbox", ActivityPubController, :outbox)
	get("/objects/:uuid/likes", ActivityPubController, :object_likes)
	end

	pipeline :activitypub_client do
	plug(:accepts, ["activity+json", "json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	scope [] do
	pipe_through(:oauth_read)
	get("/api/ap/whoami", ActivityPubController, :whoami)
	get("/users/:nickname/inbox", ActivityPubController, :read_inbox)
	end

	scope [] do
	pipe_through(:oauth_write)
	post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	end
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_relay)
	get("/", ActivityPubController, :relay)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through(:activitypub)
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web.MastodonAPI do
	pipe_through(:mastodon_html)

	get("/web/login", MastodonAPIController, :login)
	delete("/auth/sign_out", MastodonAPIController, :logout)

	scope [] do
	pipe_through(:oauth_read_or_unauthenticated)
	get("/web/*path", MastodonAPIController, :index)
	end
	end

	pipeline :remote_media do
	end

	scope "/proxy/", Pleroma.Web.MediaProxy do
	pipe_through(:remote_media)

	get("/:sig/:url", MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxyController, :remote)
	end

	if Mix.env() == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	scope "/", Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	get("/*path", RedirectController, :redirector)

	options("/*path", RedirectController, :empty)
	end
	end

	defmodule Fallback.RedirectController do
	use Pleroma.Web, :controller
	alias Pleroma.User
	alias Pleroma.Web.Metadata

	def redirector(conn, _params, code \\ 200) do
	conn
	\|> put_resp_content_type("text/html")
	\|> send_file(code, index_file_path())
	end

	def redirector_with_meta(conn, %{"maybe_nickname_or_id" => maybe_nickname_or_id} = params) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(maybe_nickname_or_id) do
	redirector_with_meta(conn, %{user: user})
	else
	nil ->
	redirector(conn, params)
	end
	end

	def redirector_with_meta(conn, params) do
	{:ok, index_content} = File.read(index_file_path())
	tags = Metadata.build_tags(params)
	response = String.replace(index_content, "<!--server-generated-meta-->", tags)

	conn
	\|> put_resp_content_type("text/html")
	\|> send_resp(200, response)
	end

	def index_file_path do
	Pleroma.Plugs.InstanceStatic.file_path("index.html")
	end

	def registration_page(conn, params) do
	redirector(conn, params)
	end

	def empty(conn, _params) do
	conn
	\|> put_status(204)
	\|> text("")
	end
	end
	diff --git a/lib/pleroma/web/templates/o_auth/o_auth/_scopes.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/_scopes.html.eex
	new file mode 100644
	index 000000000..4b8fb5dae
	--- /dev/null
	+++ b/lib/pleroma/web/templates/o_auth/o_auth/_scopes.html.eex
	@@ -0,0 +1,13 @@
	+<div class="scopes-input">
	+ <%= label @form, :scope, "Permissions" %>
	+
	+ <div class="scopes">
	+ <%= for scope <- @available_scopes do %>
	+ <%# Note: using hidden input with `unchecked_value` in order to distinguish user's empty selection from `scope` param being omitted %>
	+ <div class="scope">
	+ <%= checkbox @form, :"scope_#{scope}", value: scope in @scopes && scope, checked_value: scope, unchecked_value: "", name: assigns[:scope_param] \|\| "scope[]" %>
	+ <%= label @form, :"scope_#{scope}", String.capitalize(scope) %>
	+ </div>
	+ <% end %>
	+ </div>
	+</div>
	diff --git a/lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex
	new file mode 100644
	index 000000000..85f62ca64
	--- /dev/null
	+++ b/lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex
	@@ -0,0 +1,13 @@
	+<h2>Sign in with external provider</h2>
	+
	+<%= form_for @conn, o_auth_path(@conn, :prepare_request), [method: "get"], fn f -> %>
	+ <%= render @view_module, "_scopes.html", Map.put(assigns, :form, f) %>
	+
	+ <%= hidden_input f, :client_id, value: @client_id %>
	+ <%= hidden_input f, :redirect_uri, value: @redirect_uri %>
	+ <%= hidden_input f, :state, value: @state %>
	+
	+ <%= for strategy <- Pleroma.Config.oauth_consumer_strategies() do %>
	+ <%= submit "Sign in with #{String.capitalize(strategy)}", name: "provider", value: strategy %>
	+ <% end %>
	+<% end %>
	diff --git a/lib/pleroma/web/templates/o_auth/o_auth/register.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/register.html.eex
	new file mode 100644
	index 000000000..126390391
	--- /dev/null
	+++ b/lib/pleroma/web/templates/o_auth/o_auth/register.html.eex
	@@ -0,0 +1,43 @@
	+<%= if get_flash(@conn, :info) do %>
	+ <p class="alert alert-info" role="alert"><%= get_flash(@conn, :info) %></p>
	+<% end %>
	+<%= if get_flash(@conn, :error) do %>
	+ <p class="alert alert-danger" role="alert"><%= get_flash(@conn, :error) %></p>
	+<% end %>
	+
	+<h2>Registration Details</h2>
	+
	+<p>If you'd like to register a new account, please provide the details below.</p>
	+
	+<%= form_for @conn, o_auth_path(@conn, :register), [], fn f -> %>
	+
	+<div class="input">
	+ <%= label f, :nickname, "Nickname" %>
	+ <%= text_input f, :nickname, value: @nickname %>
	+</div>
	+<div class="input">
	+ <%= label f, :email, "Email" %>
	+ <%= text_input f, :email, value: @email %>
	+</div>
	+
	+<%= submit "Proceed as new user", name: "op", value: "register" %>
	+
	+<p>Alternatively, sign in to connect to existing account.</p>
	+
	+<div class="input">
	+ <%= label f, :auth_name, "Name or email" %>
	+ <%= text_input f, :auth_name %>
	+</div>
	+<div class="input">
	+ <%= label f, :password, "Password" %>
	+ <%= password_input f, :password %>
	+</div>
	+
	+<%= submit "Proceed as existing user", name: "op", value: "connect" %>
	+
	+<%= hidden_input f, :client_id, value: @client_id %>
	+<%= hidden_input f, :redirect_uri, value: @redirect_uri %>
	+<%= hidden_input f, :scope, value: Enum.join(@scopes, " ") %>
	+<%= hidden_input f, :state, value: @state %>
	+
	+<% end %>
	diff --git a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
	index 161333847..87278e636 100644
	--- a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
	+++ b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
	@@ -1,35 +1,31 @@
	<%= if get_flash(@conn, :info) do %>
	<p class="alert alert-info" role="alert"><%= get_flash(@conn, :info) %></p>
	<% end %>
	<%= if get_flash(@conn, :error) do %>
	<p class="alert alert-danger" role="alert"><%= get_flash(@conn, :error) %></p>
	<% end %>
	+
	<h2>OAuth Authorization</h2>
	+
	<%= form_for @conn, o_auth_path(@conn, :authorize), [as: "authorization"], fn f -> %>
	<div class="input">
	<%= label f, :name, "Name or email" %>
	<%= text_input f, :name %>
	</div>
	<div class="input">
	<%= label f, :password, "Password" %>
	<%= password_input f, :password %>
	</div>
	-<div class="scopes-input">
	-<%= label f, :scope, "Permissions" %>
	- <div class="scopes">
	- <%= for scope <- @available_scopes do %>
	- <%# Note: using hidden input with `unchecked_value` in order to distinguish user's empty selection from `scope` param being omitted %>
	- <div class="scope">
	- <%= checkbox f, :"scope_#{scope}", value: scope in @scopes && scope, checked_value: scope, unchecked_value: "", name: "authorization[scope][]" %>
	- <%= label f, :"scope_#{scope}", String.capitalize(scope) %>
	- </div>
	- <% end %>
	- </div>
	-</div>
	+
	+<%= render @view_module, "_scopes.html", Map.merge(assigns, %{form: f, scope_param: "authorization[scope][]"}) %>

	<%= hidden_input f, :client_id, value: @client_id %>
	<%= hidden_input f, :response_type, value: @response_type %>
	<%= hidden_input f, :redirect_uri, value: @redirect_uri %>
	-<%= hidden_input f, :state, value: @state%>
	+<%= hidden_input f, :state, value: @state %>
	<%= submit "Authorize" %>
	<% end %>
	+
	+<%= if Pleroma.Config.oauth_consumer_enabled?() do %>
	+ <%= render @view_module, Pleroma.Web.Auth.Authenticator.oauth_consumer_template(), assigns %>
	+<% end %>
	diff --git a/mix.exs b/mix.exs
	index ec0865c4f..26a03b70b 100644
	--- a/mix.exs
	+++ b/mix.exs
	@@ -1,169 +1,177 @@
	defmodule Pleroma.Mixfile do
	use Mix.Project

	def project do
	[
	app: :pleroma,
	version: version("0.9.0"),
	elixir: "~> 1.7",
	elixirc_paths: elixirc_paths(Mix.env()),
	compilers: [:phoenix, :gettext] ++ Mix.compilers(),
	elixirc_options: [warnings_as_errors: true],
	xref: [exclude: [:eldap]],
	start_permanent: Mix.env() == :prod,
	aliases: aliases(),
	deps: deps(),

	# Docs
	name: "Pleroma",
	source_url: "https://git.pleroma.social/pleroma/pleroma",
	source_url_pattern:
	"https://git.pleroma.social/pleroma/pleroma/blob/develop/%{path}#L%{line}",
	homepage_url: "https://pleroma.social/",
	docs: [
	logo: "priv/static/static/logo.png",
	extras: ["README.md" \| Path.wildcard("docs/*/.md")],
	groups_for_extras: [
	"Installation manuals": Path.wildcard("docs/installation/*.md"),
	Configuration: Path.wildcard("docs/config/*.md"),
	Administration: Path.wildcard("docs/admin/*.md"),
	"Pleroma's APIs and Mastodon API extensions": Path.wildcard("docs/api/*.md")
	],
	main: "readme",
	output: "priv/static/doc"
	]
	]
	end

	# Configuration for the OTP application.
	#
	# Type `mix help compile.app` for more information.
	def application do
	[
	mod: {Pleroma.Application, []},
	extra_applications: [:logger, :runtime_tools, :comeonin, :quack],
	included_applications: [:ex_syslogger]
	]
	end

	# Specifies which paths to compile per environment.
	defp elixirc_paths(:test), do: ["lib", "test/support"]
	defp elixirc_paths(_), do: ["lib"]

	# Specifies your project dependencies.
	#
	# Type `mix help deps` for examples and options.
	defp deps do
	+ oauth_strategies = String.split(System.get_env("OAUTH_CONSUMER_STRATEGIES") \|\| "")
	+
	+ oauth_deps =
	+ for s <- oauth_strategies,
	+ do: {String.to_atom("ueberauth_#{s}"), ">= 0.0.0"}
	+
	[
	{:phoenix, "~> 1.4.1"},
	{:plug_cowboy, "~> 2.0"},
	{:phoenix_pubsub, "~> 1.1"},
	{:phoenix_ecto, "~> 4.0"},
	{:ecto_sql, "~>3.0.5"},
	{:postgrex, ">= 0.13.5"},
	{:gettext, "~> 0.15"},
	{:comeonin, "~> 4.1.1"},
	{:pbkdf2_elixir, "~> 0.12.3"},
	{:trailing_format_plug, "~> 0.0.7"},
	{:html_sanitize_ex, "~> 1.3.0"},
	{:html_entities, "~> 0.4"},
	{:phoenix_html, "~> 2.10"},
	{:calendar, "~> 0.17.4"},
	{:cachex, "~> 3.0.2"},
	{:httpoison, "~> 1.2.0"},
	+ {:poison, "~> 3.0", override: true},
	{:tesla, "~> 1.2"},
	{:jason, "~> 1.0"},
	{:mogrify, "~> 0.6.1"},
	{:ex_aws, "~> 2.0"},
	{:ex_aws_s3, "~> 2.0"},
	{:earmark, "~> 1.3"},
	{:ex_machina, "~> 2.3", only: :test},
	{:credo, "~> 0.9.3", only: [:dev, :test]},
	{:mock, "~> 0.3.1", only: :test},
	{:crypt,
	git: "https://github.com/msantos/crypt", ref: "1f2b58927ab57e72910191a7ebaeff984382a1d3"},
	{:cors_plug, "~> 1.5"},
	{:ex_doc, "~> 0.19", only: :dev, runtime: false},
	{:web_push_encryption, "~> 0.2.1"},
	{:swoosh, "~> 0.20"},
	{:gen_smtp, "~> 0.13"},
	{:websocket_client, git: "https://github.com/jeremyong/websocket_client.git", only: :test},
	{:floki, "~> 0.20.0"},
	{:ex_syslogger, github: "slashmili/ex_syslogger", tag: "1.4.0"},
	{:timex, "~> 3.5"},
	+ {:ueberauth, "~> 0.4"},
	{:auto_linker,
	git: "https://git.pleroma.social/pleroma/auto_linker.git",
	ref: "479dd343f4e563ff91215c8275f3b5c67e032850"},
	{:pleroma_job_queue, "~> 0.2.0"},
	{:telemetry, "~> 0.3"},
	{:prometheus_ex, "~> 3.0"},
	{:prometheus_plugs, "~> 1.1"},
	{:prometheus_phoenix, "~> 1.2"},
	{:prometheus_ecto, "~> 1.4"},
	{:prometheus_process_collector, "~> 1.4"},
	{:recon, github: "ferd/recon", tag: "2.4.0"},
	{:quack, "~> 0.1.1"}
	- ]
	+ ] ++ oauth_deps
	end

	# Aliases are shortcuts or tasks specific to the current project.
	# For example, to create, migrate and run the seeds file at once:
	#
	# $ mix ecto.setup
	#
	# See the documentation for `Mix` for more info on aliases.
	defp aliases do
	[
	"ecto.setup": ["ecto.create", "ecto.migrate", "run priv/repo/seeds.exs"],
	"ecto.reset": ["ecto.drop", "ecto.setup"],
	test: ["ecto.create --quiet", "ecto.migrate", "test"]
	]
	end

	# Builds a version string made of:
	# * the application version
	# * a pre-release if ahead of the tag: the describe string (-count-commithash)
	# * build info:
	# * a build name if `PLEROMA_BUILD_NAME` or `:pleroma, :build_name` is defined
	# * the mix environment if different than prod
	defp version(version) do
	{git_tag, git_pre_release} =
	with {tag, 0} <- System.cmd("git", ["describe", "--tags", "--abbrev=0"]),
	tag = String.trim(tag),
	{describe, 0} <- System.cmd("git", ["describe", "--tags", "--abbrev=8"]),
	describe = String.trim(describe),
	ahead <- String.replace(describe, tag, "") do
	{String.replace_prefix(tag, "v", ""), if(ahead != "", do: String.trim(ahead))}
	else
	_ -> {nil, nil}
	end

	if git_tag && version != git_tag do
	Mix.shell().error(
	"Application version #{inspect(version)} does not match git tag #{inspect(git_tag)}"
	)
	end

	build_name =
	cond do
	name = Application.get_env(:pleroma, :build_name) -> name
	name = System.get_env("PLEROMA_BUILD_NAME") -> name
	true -> nil
	end

	env_name = if Mix.env() != :prod, do: to_string(Mix.env())

	build =
	[build_name, env_name]
	\|> Enum.filter(fn string -> string && string != "" end)
	\|> Enum.join("-")
	\|> (fn
	"" -> nil
	string -> "+" <> string
	end).()

	[version, git_pre_release, build]
	\|> Enum.filter(fn string -> string && string != "" end)
	\|> Enum.join()
	end
	end
	diff --git a/mix.lock b/mix.lock
	index 7c7e322de..bb40ebd48 100644
	--- a/mix.lock
	+++ b/mix.lock
	@@ -1,82 +1,83 @@
	%{
	"accept": {:hex, :accept, "0.3.5", "b33b127abca7cc948bbe6caa4c263369abf1347cfa9d8e699c6d214660f10cd1", [:rebar3], [], "hexpm"},
	"auto_linker": {:git, "https://git.pleroma.social/pleroma/auto_linker.git", "479dd343f4e563ff91215c8275f3b5c67e032850", [ref: "479dd343f4e563ff91215c8275f3b5c67e032850"]},
	"base64url": {:hex, :base64url, "0.0.1", "36a90125f5948e3afd7be97662a1504b934dd5dac78451ca6e9abf85a10286be", [:rebar], [], "hexpm"},
	"bunt": {:hex, :bunt, "0.2.0", "951c6e801e8b1d2cbe58ebbd3e616a869061ddadcc4863d0a2182541acae9a38", [:mix], [], "hexpm"},
	"cachex": {:hex, :cachex, "3.0.2", "1351caa4e26e29f7d7ec1d29b53d6013f0447630bbf382b4fb5d5bad0209f203", [:mix], [{:eternal, "~> 1.2", [hex: :eternal, repo: "hexpm", optional: false]}, {:unsafe, "~> 1.0", [hex: :unsafe, repo: "hexpm", optional: false]}], "hexpm"},
	"calendar": {:hex, :calendar, "0.17.4", "22c5e8d98a4db9494396e5727108dffb820ee0d18fed4b0aa8ab76e4f5bc32f1", [:mix], [{:tzdata, "~> 0.5.8 or ~> 0.1.201603", [hex: :tzdata, repo: "hexpm", optional: false]}], "hexpm"},
	- "certifi": {:hex, :certifi, "2.4.2", "75424ff0f3baaccfd34b1214184b6ef616d89e420b258bb0a5ea7d7bc628f7f0", [:rebar3], [{:parse_trans, "~>3.3", [hex: :parse_trans, repo: "hexpm", optional: false]}], "hexpm"},
	+ "certifi": {:hex, :certifi, "2.5.1", "867ce347f7c7d78563450a18a6a28a8090331e77fa02380b4a21962a65d36ee5", [:rebar3], [{:parse_trans, "~>3.3", [hex: :parse_trans, repo: "hexpm", optional: false]}], "hexpm"},
	"combine": {:hex, :combine, "0.10.0", "eff8224eeb56498a2af13011d142c5e7997a80c8f5b97c499f84c841032e429f", [:mix], [], "hexpm"},
	"comeonin": {:hex, :comeonin, "4.1.1", "c7304fc29b45b897b34142a91122bc72757bc0c295e9e824999d5179ffc08416", [:mix], [{:argon2_elixir, "~> 1.2", [hex: :argon2_elixir, repo: "hexpm", optional: true]}, {:bcrypt_elixir, "~> 0.12.1 or ~> 1.0", [hex: :bcrypt_elixir, repo: "hexpm", optional: true]}, {:pbkdf2_elixir, "~> 0.12", [hex: :pbkdf2_elixir, repo: "hexpm", optional: true]}], "hexpm"},
	"connection": {:hex, :connection, "1.0.4", "a1cae72211f0eef17705aaededacac3eb30e6625b04a6117c1b2db6ace7d5976", [:mix], [], "hexpm"},
	"cors_plug": {:hex, :cors_plug, "1.5.2", "72df63c87e4f94112f458ce9d25800900cc88608c1078f0e4faddf20933eda6e", [:mix], [{:plug, "~> 1.3 or ~> 1.4 or ~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
	"cowboy": {:hex, :cowboy, "2.6.1", "f2e06f757c337b3b311f9437e6e072b678fcd71545a7b2865bdaa154d078593f", [:rebar3], [{:cowlib, "~> 2.7.0", [hex: :cowlib, repo: "hexpm", optional: false]}, {:ranch, "~> 1.7.1", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm"},
	"cowlib": {:hex, :cowlib, "2.7.0", "3ef16e77562f9855a2605900cedb15c1462d76fb1be6a32fc3ae91973ee543d2", [:rebar3], [], "hexpm"},
	"credo": {:hex, :credo, "0.9.3", "76fa3e9e497ab282e0cf64b98a624aa11da702854c52c82db1bf24e54ab7c97a", [:mix], [{:bunt, "~> 0.2.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:poison, ">= 0.0.0", [hex: :poison, repo: "hexpm", optional: false]}], "hexpm"},
	"crypt": {:git, "https://github.com/msantos/crypt", "1f2b58927ab57e72910191a7ebaeff984382a1d3", [ref: "1f2b58927ab57e72910191a7ebaeff984382a1d3"]},
	"db_connection": {:hex, :db_connection, "2.0.5", "ddb2ba6761a08b2bb9ca0e7d260e8f4dd39067426d835c24491a321b7f92a4da", [:mix], [{:connection, "~> 1.0.2", [hex: :connection, repo: "hexpm", optional: false]}], "hexpm"},
	"decimal": {:hex, :decimal, "1.7.0", "30d6b52c88541f9a66637359ddf85016df9eb266170d53105f02e4a67e00c5aa", [:mix], [], "hexpm"},
	"earmark": {:hex, :earmark, "1.3.0", "17f0c38eaafb4800f746b457313af4b2442a8c2405b49c645768680f900be603", [:mix], [], "hexpm"},
	"ecto": {:hex, :ecto, "3.0.7", "44dda84ac6b17bbbdeb8ac5dfef08b7da253b37a453c34ab1a98de7f7e5fec7f", [:mix], [{:decimal, "~> 1.6", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:poison, "~> 2.2 or ~> 3.0", [hex: :poison, repo: "hexpm", optional: true]}], "hexpm"},
	"ecto_sql": {:hex, :ecto_sql, "3.0.5", "7e44172b4f7aca4469f38d7f6a3da394dbf43a1bcf0ca975e958cb957becd74e", [:mix], [{:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:ecto, "~> 3.0.6", [hex: :ecto, repo: "hexpm", optional: false]}, {:mariaex, "~> 0.9.1", [hex: :mariaex, repo: "hexpm", optional: true]}, {:postgrex, "~> 0.14.0", [hex: :postgrex, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.3.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm"},
	"eternal": {:hex, :eternal, "1.2.0", "e2a6b6ce3b8c248f7dc31451aefca57e3bdf0e48d73ae5043229380a67614c41", [:mix], [], "hexpm"},
	"ex_aws": {:hex, :ex_aws, "2.1.0", "b92651527d6c09c479f9013caa9c7331f19cba38a650590d82ebf2c6c16a1d8a", [:mix], [{:configparser_ex, "~> 2.0", [hex: :configparser_ex, repo: "hexpm", optional: true]}, {:hackney, "1.6.3 or 1.6.5 or 1.7.1 or 1.8.6 or ~> 1.9", [hex: :hackney, repo: "hexpm", optional: true]}, {:jsx, "~> 2.8", [hex: :jsx, repo: "hexpm", optional: true]}, {:poison, ">= 1.2.0", [hex: :poison, repo: "hexpm", optional: true]}, {:sweet_xml, "~> 0.6", [hex: :sweet_xml, repo: "hexpm", optional: true]}, {:xml_builder, "~> 0.1.0", [hex: :xml_builder, repo: "hexpm", optional: true]}], "hexpm"},
	"ex_aws_s3": {:hex, :ex_aws_s3, "2.0.1", "9e09366e77f25d3d88c5393824e613344631be8db0d1839faca49686e99b6704", [:mix], [{:ex_aws, "~> 2.0", [hex: :ex_aws, repo: "hexpm", optional: false]}, {:sweet_xml, ">= 0.0.0", [hex: :sweet_xml, repo: "hexpm", optional: true]}], "hexpm"},
	"ex_doc": {:hex, :ex_doc, "0.19.1", "519bb9c19526ca51d326c060cb1778d4a9056b190086a8c6c115828eaccea6cf", [:mix], [{:earmark, "~> 1.1", [hex: :earmark, repo: "hexpm", optional: false]}, {:makeup_elixir, "~> 0.7", [hex: :makeup_elixir, repo: "hexpm", optional: false]}], "hexpm"},
	"ex_machina": {:hex, :ex_machina, "2.3.0", "92a5ad0a8b10ea6314b876a99c8c9e3f25f4dde71a2a835845b136b9adaf199a", [:mix], [{:ecto, "~> 2.2 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: true]}, {:ecto_sql, "~> 3.0", [hex: :ecto_sql, repo: "hexpm", optional: true]}], "hexpm"},
	"ex_syslogger": {:git, "https://github.com/slashmili/ex_syslogger.git", "f3963399047af17e038897c69e20d552e6899e1d", [tag: "1.4.0"]},
	"floki": {:hex, :floki, "0.20.4", "be42ac911fece24b4c72f3b5846774b6e61b83fe685c2fc9d62093277fb3bc86", [:mix], [{:html_entities, "~> 0.4.0", [hex: :html_entities, repo: "hexpm", optional: false]}, {:mochiweb, "~> 2.15", [hex: :mochiweb, repo: "hexpm", optional: false]}], "hexpm"},
	"gen_smtp": {:hex, :gen_smtp, "0.13.0", "11f08504c4bdd831dc520b8f84a1dce5ce624474a797394e7aafd3c29f5dcd25", [:rebar3], [], "hexpm"},
	"gettext": {:hex, :gettext, "0.15.0", "40a2b8ce33a80ced7727e36768499fc9286881c43ebafccae6bab731e2b2b8ce", [:mix], [], "hexpm"},
	- "hackney": {:hex, :hackney, "1.14.3", "b5f6f5dcc4f1fba340762738759209e21914516df6be440d85772542d4a5e412", [:rebar3], [{:certifi, "2.4.2", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "6.0.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "1.0.1", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "1.0.2", [hex: :mimerl, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "1.1.4", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}], "hexpm"},
	+ "hackney": {:hex, :hackney, "1.15.1", "9f8f471c844b8ce395f7b6d8398139e26ddca9ebc171a8b91342ee15a19963f4", [:rebar3], [{:certifi, "2.5.1", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "6.0.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "1.0.1", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "~>1.1", [hex: :mimerl, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "1.1.4", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}], "hexpm"},
	"html_entities": {:hex, :html_entities, "0.4.0", "f2fee876858cf6aaa9db608820a3209e45a087c5177332799592142b50e89a6b", [:mix], [], "hexpm"},
	"html_sanitize_ex": {:hex, :html_sanitize_ex, "1.3.0", "f005ad692b717691203f940c686208aa3d8ffd9dd4bb3699240096a51fa9564e", [:mix], [{:mochiweb, "~> 2.15", [hex: :mochiweb, repo: "hexpm", optional: false]}], "hexpm"},
	"httpoison": {:hex, :httpoison, "1.2.0", "2702ed3da5fd7a8130fc34b11965c8cfa21ade2f232c00b42d96d4967c39a3a3", [:mix], [{:hackney, "~> 1.8", [hex: :hackney, repo: "hexpm", optional: false]}], "hexpm"},
	"idna": {:hex, :idna, "6.0.0", "689c46cbcdf3524c44d5f3dde8001f364cd7608a99556d8fbd8239a5798d4c10", [:rebar3], [{:unicode_util_compat, "0.4.1", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm"},
	"jason": {:hex, :jason, "1.1.2", "b03dedea67a99223a2eaf9f1264ce37154564de899fd3d8b9a21b1a6fd64afe7", [:mix], [{:decimal, "~> 1.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm"},
	"jose": {:hex, :jose, "1.8.4", "7946d1e5c03a76ac9ef42a6e6a20001d35987afd68c2107bcd8f01a84e75aa73", [:mix, :rebar3], [{:base64url, "~> 0.0.1", [hex: :base64url, repo: "hexpm", optional: false]}], "hexpm"},
	"makeup": {:hex, :makeup, "0.5.5", "9e08dfc45280c5684d771ad58159f718a7b5788596099bdfb0284597d368a882", [:mix], [{:nimble_parsec, "~> 0.4", [hex: :nimble_parsec, repo: "hexpm", optional: false]}], "hexpm"},
	"makeup_elixir": {:hex, :makeup_elixir, "0.10.0", "0f09c2ddf352887a956d84f8f7e702111122ca32fbbc84c2f0569b8b65cbf7fa", [:mix], [{:makeup, "~> 0.5.5", [hex: :makeup, repo: "hexpm", optional: false]}], "hexpm"},
	"meck": {:hex, :meck, "0.8.13", "ffedb39f99b0b99703b8601c6f17c7f76313ee12de6b646e671e3188401f7866", [:rebar3], [], "hexpm"},
	"metrics": {:hex, :metrics, "1.0.1", "25f094dea2cda98213cecc3aeff09e940299d950904393b2a29d191c346a8486", [:rebar3], [], "hexpm"},
	"mime": {:hex, :mime, "1.3.1", "30ce04ab3175b6ad0bdce0035cba77bba68b813d523d1aac73d9781b4d193cf8", [:mix], [], "hexpm"},
	- "mimerl": {:hex, :mimerl, "1.0.2", "993f9b0e084083405ed8252b99460c4f0563e41729ab42d9074fd5e52439be88", [:rebar3], [], "hexpm"},
	+ "mimerl": {:hex, :mimerl, "1.2.0", "67e2d3f571088d5cfd3e550c383094b47159f3eee8ffa08e64106cdf5e981be3", [:rebar3], [], "hexpm"},
	"mochiweb": {:hex, :mochiweb, "2.15.0", "e1daac474df07651e5d17cc1e642c4069c7850dc4508d3db7263a0651330aacc", [:rebar3], [], "hexpm"},
	"mock": {:hex, :mock, "0.3.1", "994f00150f79a0ea50dc9d86134cd9ebd0d177ad60bd04d1e46336cdfdb98ff9", [:mix], [{:meck, "~> 0.8.8", [hex: :meck, repo: "hexpm", optional: false]}], "hexpm"},
	"mogrify": {:hex, :mogrify, "0.6.1", "de1b527514f2d95a7bbe9642eb556061afb337e220cf97adbf3a4e6438ed70af", [:mix], [], "hexpm"},
	"nimble_parsec": {:hex, :nimble_parsec, "0.4.0", "ee261bb53214943679422be70f1658fff573c5d0b0a1ecd0f18738944f818efe", [:mix], [], "hexpm"},
	"parse_trans": {:hex, :parse_trans, "3.3.0", "09765507a3c7590a784615cfd421d101aec25098d50b89d7aa1d66646bc571c1", [:rebar3], [], "hexpm"},
	"pbkdf2_elixir": {:hex, :pbkdf2_elixir, "0.12.3", "6706a148809a29c306062862c803406e88f048277f6e85b68faf73291e820b84", [:mix], [], "hexpm"},
	"phoenix": {:hex, :phoenix, "1.4.1", "801f9d632808657f1f7c657c8bbe624caaf2ba91429123ebe3801598aea4c3d9", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:phoenix_pubsub, "~> 1.1", [hex: :phoenix_pubsub, repo: "hexpm", optional: false]}, {:plug, "~> 1.7", [hex: :plug, repo: "hexpm", optional: false]}, {:plug_cowboy, "~> 1.0 or ~> 2.0", [hex: :plug_cowboy, repo: "hexpm", optional: true]}], "hexpm"},
	"phoenix_ecto": {:hex, :phoenix_ecto, "4.0.0", "c43117a136e7399ea04ecaac73f8f23ee0ffe3e07acfcb8062fe5f4c9f0f6531", [:mix], [{:ecto, "~> 3.0", [hex: :ecto, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 2.9", [hex: :phoenix_html, repo: "hexpm", optional: true]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
	"phoenix_html": {:hex, :phoenix_html, "2.13.1", "fa8f034b5328e2dfa0e4131b5569379003f34bc1fafdaa84985b0b9d2f12e68b", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
	"phoenix_pubsub": {:hex, :phoenix_pubsub, "1.1.1", "6668d787e602981f24f17a5fbb69cc98f8ab085114ebfac6cc36e10a90c8e93c", [:mix], [], "hexpm"},
	"pleroma_job_queue": {:hex, :pleroma_job_queue, "0.2.0", "879e660aa1cebe8dc6f0aaaa6aa48b4875e89cd961d4a585fd128e0773b31a18", [:mix], [], "hexpm"},
	"plug": {:hex, :plug, "1.7.2", "d7b7db7fbd755e8283b6c0a50be71ec0a3d67d9213d74422d9372effc8e87fd1", [:mix], [{:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug_crypto, "~> 1.0", [hex: :plug_crypto, repo: "hexpm", optional: false]}], "hexpm"},
	"plug_cowboy": {:hex, :plug_cowboy, "2.0.1", "d798f8ee5acc86b7d42dbe4450b8b0dadf665ce588236eb0a751a132417a980e", [:mix], [{:cowboy, "~> 2.5", [hex: :cowboy, repo: "hexpm", optional: false]}, {:plug, "~> 1.7", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
	"plug_crypto": {:hex, :plug_crypto, "1.0.0", "18e49317d3fa343f24620ed22795ec29d4a5e602d52d1513ccea0b07d8ea7d4d", [:mix], [], "hexpm"},
	"poison": {:hex, :poison, "3.1.0", "d9eb636610e096f86f25d9a46f35a9facac35609a7591b3be3326e99a0484665", [:mix], [], "hexpm"},
	"poolboy": {:hex, :poolboy, "1.5.2", "392b007a1693a64540cead79830443abf5762f5d30cf50bc95cb2c1aaafa006b", [:rebar3], [], "hexpm"},
	"postgrex": {:hex, :postgrex, "0.14.1", "63247d4a5ad6b9de57a0bac5d807e1c32d41e39c04b8a4156a26c63bcd8a2e49", [:mix], [{:connection, "~> 1.0", [hex: :connection, repo: "hexpm", optional: false]}, {:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm"},
	"prometheus": {:hex, :prometheus, "4.2.2", "a830e77b79dc6d28183f4db050a7cac926a6c58f1872f9ef94a35cd989aceef8", [:mix, :rebar3], [], "hexpm"},
	"prometheus_ecto": {:hex, :prometheus_ecto, "1.4.1", "6c768ea9654de871e5b32fab2eac348467b3021604ebebbcbd8bcbe806a65ed5", [:mix], [{:ecto, "~> 2.0 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: false]}, {:prometheus_ex, "~> 1.1 or ~> 2.0 or ~> 3.0", [hex: :prometheus_ex, repo: "hexpm", optional: false]}], "hexpm"},
	"prometheus_ex": {:hex, :prometheus_ex, "3.0.5", "fa58cfd983487fc5ead331e9a3e0aa622c67232b3ec71710ced122c4c453a02f", [:mix], [{:prometheus, "~> 4.0", [hex: :prometheus, repo: "hexpm", optional: false]}], "hexpm"},
	"prometheus_phoenix": {:hex, :prometheus_phoenix, "1.2.1", "964a74dfbc055f781d3a75631e06ce3816a2913976d1df7830283aa3118a797a", [:mix], [{:phoenix, "~> 1.3", [hex: :phoenix, repo: "hexpm", optional: false]}, {:prometheus_ex, "~> 1.3 or ~> 2.0 or ~> 3.0", [hex: :prometheus_ex, repo: "hexpm", optional: false]}], "hexpm"},
	"prometheus_plugs": {:hex, :prometheus_plugs, "1.1.5", "25933d48f8af3a5941dd7b621c889749894d8a1082a6ff7c67cc99dec26377c5", [:mix], [{:accept, "~> 0.1", [hex: :accept, repo: "hexpm", optional: false]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}, {:prometheus_ex, "~> 1.1 or ~> 2.0 or ~> 3.0", [hex: :prometheus_ex, repo: "hexpm", optional: false]}, {:prometheus_process_collector, "~> 1.1", [hex: :prometheus_process_collector, repo: "hexpm", optional: true]}], "hexpm"},
	"prometheus_process_collector": {:hex, :prometheus_process_collector, "1.4.0", "6dbd39e3165b9ef1c94a7a820e9ffe08479f949dcdd431ed4aaea7b250eebfde", [:rebar3], [{:prometheus, "~> 4.0", [hex: :prometheus, repo: "hexpm", optional: false]}], "hexpm"},
	"quack": {:hex, :quack, "0.1.1", "cca7b4da1a233757fdb44b3334fce80c94785b3ad5a602053b7a002b5a8967bf", [:mix], [{:poison, ">= 1.0.0", [hex: :poison, repo: "hexpm", optional: false]}, {:tesla, "~> 1.2.0", [hex: :tesla, repo: "hexpm", optional: false]}], "hexpm"},
	"ranch": {:hex, :ranch, "1.7.1", "6b1fab51b49196860b733a49c07604465a47bdb78aa10c1c16a3d199f7f8c881", [:rebar3], [], "hexpm"},
	"recon": {:git, "https://github.com/ferd/recon.git", "75d70c7c08926d2f24f1ee6de14ee50fe8a52763", [tag: "2.4.0"]},
	"ssl_verify_fun": {:hex, :ssl_verify_fun, "1.1.4", "f0eafff810d2041e93f915ef59899c923f4568f4585904d010387ed74988e77b", [:make, :mix, :rebar3], [], "hexpm"},
	"swoosh": {:hex, :swoosh, "0.20.0", "9a6c13822c9815993c03b6f8fccc370fcffb3c158d9754f67b1fdee6b3a5d928", [:mix], [{:cowboy, "~> 1.0.1 or ~> 1.1 or ~> 2.4", [hex: :cowboy, repo: "hexpm", optional: true]}, {:gen_smtp, "~> 0.12", [hex: :gen_smtp, repo: "hexpm", optional: true]}, {:hackney, "~> 1.9", [hex: :hackney, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mime, "~> 1.1", [hex: :mime, repo: "hexpm", optional: false]}, {:plug, "~> 1.4", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm"},
	"syslog": {:git, "https://github.com/Vagabond/erlang-syslog.git", "4a6c6f2c996483e86c1320e9553f91d337bcb6aa", [tag: "1.0.5"]},
	"telemetry": {:hex, :telemetry, "0.3.0", "099a7f3ce31e4780f971b4630a3c22ec66d22208bc090fe33a2a3a6a67754a73", [:rebar3], [], "hexpm"},
	"tesla": {:hex, :tesla, "1.2.1", "864783cc27f71dd8c8969163704752476cec0f3a51eb3b06393b3971dc9733ff", [:mix], [{:exjsx, ">= 3.0.0", [hex: :exjsx, repo: "hexpm", optional: true]}, {:fuse, "~> 2.4", [hex: :fuse, repo: "hexpm", optional: true]}, {:hackney, "~> 1.6", [hex: :hackney, repo: "hexpm", optional: true]}, {:ibrowse, "~> 4.4.0", [hex: :ibrowse, repo: "hexpm", optional: true]}, {:jason, ">= 1.0.0", [hex: :jason, repo: "hexpm", optional: true]}, {:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:poison, ">= 1.0.0", [hex: :poison, repo: "hexpm", optional: true]}], "hexpm"},
	"timex": {:hex, :timex, "3.5.0", "b0a23167da02d0fe4f1a4e104d1f929a00d348502b52432c05de875d0b9cffa5", [:mix], [{:combine, "~> 0.10", [hex: :combine, repo: "hexpm", optional: false]}, {:gettext, "~> 0.10", [hex: :gettext, repo: "hexpm", optional: false]}, {:tzdata, "~> 0.1.8 or ~> 0.5", [hex: :tzdata, repo: "hexpm", optional: false]}], "hexpm"},
	"trailing_format_plug": {:hex, :trailing_format_plug, "0.0.7", "64b877f912cf7273bed03379936df39894149e35137ac9509117e59866e10e45", [:mix], [{:plug, "> 0.12.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
	"tzdata": {:hex, :tzdata, "0.5.17", "50793e3d85af49736701da1a040c415c97dc1caf6464112fd9bd18f425d3053b", [:mix], [{:hackney, "~> 1.0", [hex: :hackney, repo: "hexpm", optional: false]}], "hexpm"},
	+ "ueberauth": {:hex, :ueberauth, "0.6.1", "9e90d3337dddf38b1ca2753aca9b1e53d8a52b890191cdc55240247c89230412", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
	"unicode_util_compat": {:hex, :unicode_util_compat, "0.4.1", "d869e4c68901dd9531385bb0c8c40444ebf624e60b6962d95952775cac5e90cd", [:rebar3], [], "hexpm"},
	"unsafe": {:hex, :unsafe, "1.0.0", "7c21742cd05380c7875546b023481d3a26f52df8e5dfedcb9f958f322baae305", [:mix], [], "hexpm"},
	"web_push_encryption": {:hex, :web_push_encryption, "0.2.1", "d42cecf73420d9dc0053ba3299cc8c8d6ff2be2487d67ca2a57265868e4d9a98", [:mix], [{:httpoison, "~> 1.0", [hex: :httpoison, repo: "hexpm", optional: false]}, {:jose, "~> 1.8", [hex: :jose, repo: "hexpm", optional: false]}, {:poison, "~> 3.0", [hex: :poison, repo: "hexpm", optional: false]}], "hexpm"},
	"websocket_client": {:git, "https://github.com/jeremyong/websocket_client.git", "9a6f65d05ebf2725d62fb19262b21f1805a59fbf", []},
	}
	diff --git a/priv/repo/migrations/20190315101315_create_registrations.exs b/priv/repo/migrations/20190315101315_create_registrations.exs
	new file mode 100644
	index 000000000..6b28cbdd3
	--- /dev/null
	+++ b/priv/repo/migrations/20190315101315_create_registrations.exs
	@@ -0,0 +1,18 @@
	+defmodule Pleroma.Repo.Migrations.CreateRegistrations do
	+ use Ecto.Migration
	+
	+ def change do
	+ create table(:registrations, primary_key: false) do
	+ add :id, :uuid, primary_key: true
	+ add :user_id, references(:users, type: :uuid, on_delete: :delete_all)
	+ add :provider, :string
	+ add :uid, :string
	+ add :info, :map, default: %{}
	+
	+ timestamps()
	+ end
	+
	+ create unique_index(:registrations, [:provider, :uid])
	+ create unique_index(:registrations, [:user_id, :provider, :uid])
	+ end
	+end
	diff --git a/test/registration_test.exs b/test/registration_test.exs
	new file mode 100644
	index 000000000..6143b82c7
	--- /dev/null
	+++ b/test/registration_test.exs
	@@ -0,0 +1,59 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.RegistrationTest do
	+ use Pleroma.DataCase
	+
	+ import Pleroma.Factory
	+
	+ alias Pleroma.Registration
	+ alias Pleroma.Repo
	+
	+ describe "generic changeset" do
	+ test "requires :provider, :uid" do
	+ registration = build(:registration, provider: nil, uid: nil)
	+
	+ cs = Registration.changeset(registration, %{})
	+ refute cs.valid?
	+
	+ assert [
	+ provider: {"can't be blank", [validation: :required]},
	+ uid: {"can't be blank", [validation: :required]}
	+ ] == cs.errors
	+ end
	+
	+ test "ensures uniqueness of [:provider, :uid]" do
	+ registration = insert(:registration)
	+ registration2 = build(:registration, provider: registration.provider, uid: registration.uid)
	+
	+ cs = Registration.changeset(registration2, %{})
	+ assert cs.valid?
	+
	+ assert {:error,
	+ %Ecto.Changeset{
	+ errors: [
	+ uid:
	+ {"has already been taken",
	+ [constraint: :unique, constraint_name: "registrations_provider_uid_index"]}
	+ ]
	+ }} = Repo.insert(cs)
	+
	+ # Note: multiple :uid values per [:user_id, :provider] are intentionally allowed
	+ cs2 = Registration.changeset(registration2, %{uid: "available.uid"})
	+ assert cs2.valid?
	+ assert {:ok, _} = Repo.insert(cs2)
	+
	+ cs3 = Registration.changeset(registration2, %{provider: "provider2"})
	+ assert cs3.valid?
	+ assert {:ok, _} = Repo.insert(cs3)
	+ end
	+
	+ test "allows `nil` :user_id (user-unbound registration)" do
	+ registration = build(:registration, user_id: nil)
	+ cs = Registration.changeset(registration, %{})
	+ assert cs.valid?
	+ assert {:ok, _} = Repo.insert(cs)
	+ end
	+ end
	+end
	diff --git a/test/support/factory.ex b/test/support/factory.ex
	index 608f8d46b..ea59912cf 100644
	--- a/test/support/factory.ex
	+++ b/test/support/factory.ex
	@@ -1,278 +1,294 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Factory do
	use ExMachina.Ecto, repo: Pleroma.Repo

	def user_factory do
	user = %Pleroma.User{
	name: sequence(:name, &"Test テスト User #{&1}"),
	email: sequence(:email, &"user#{&1}@example.com"),
	nickname: sequence(:nickname, &"nick#{&1}"),
	password_hash: Comeonin.Pbkdf2.hashpwsalt("test"),
	bio: sequence(:bio, &"Tester Number #{&1}"),
	info: %{}
	}

	%{
	user
	\| ap_id: Pleroma.User.ap_id(user),
	follower_address: Pleroma.User.ap_followers(user),
	following: [Pleroma.User.ap_id(user)]
	}
	end

	def note_factory(attrs \\ %{}) do
	text = sequence(:text, &"This is :moominmamma: note #{&1}")

	user = insert(:user)

	data = %{
	"type" => "Note",
	"content" => text,
	"id" => Pleroma.Web.ActivityPub.Utils.generate_object_id(),
	"actor" => user.ap_id,
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"published" => DateTime.utc_now() \|> DateTime.to_iso8601(),
	"likes" => [],
	"like_count" => 0,
	"context" => "2hu",
	"summary" => "2hu",
	"tag" => ["2hu"],
	"emoji" => %{
	"2hu" => "corndog.png"
	}
	}

	%Pleroma.Object{
	data: merge_attributes(data, Map.get(attrs, :data, %{}))
	}
	end

	def direct_note_factory do
	user2 = insert(:user)

	%Pleroma.Object{data: data} = note_factory()
	%Pleroma.Object{data: Map.merge(data, %{"to" => [user2.ap_id]})}
	end

	def article_factory do
	note_factory()
	\|> Map.put("type", "Article")
	end

	def tombstone_factory do
	data = %{
	"type" => "Tombstone",
	"id" => Pleroma.Web.ActivityPub.Utils.generate_object_id(),
	"formerType" => "Note",
	"deleted" => DateTime.utc_now() \|> DateTime.to_iso8601()
	}

	%Pleroma.Object{
	data: data
	}
	end

	def direct_note_activity_factory do
	dm = insert(:direct_note)

	data = %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"type" => "Create",
	"actor" => dm.data["actor"],
	"to" => dm.data["to"],
	"object" => dm.data,
	"published" => DateTime.utc_now() \|> DateTime.to_iso8601(),
	"context" => dm.data["context"]
	}

	%Pleroma.Activity{
	data: data,
	actor: data["actor"],
	recipients: data["to"]
	}
	end

	def note_activity_factory(attrs \\ %{}) do
	note = attrs[:note] \|\| insert(:note)

	data = %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"type" => "Create",
	"actor" => note.data["actor"],
	"to" => note.data["to"],
	"object" => note.data,
	"published" => DateTime.utc_now() \|> DateTime.to_iso8601(),
	"context" => note.data["context"]
	}

	%Pleroma.Activity{
	data: data,
	actor: data["actor"],
	recipients: data["to"]
	}
	end

	def article_activity_factory do
	article = insert(:article)

	data = %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"type" => "Create",
	"actor" => article.data["actor"],
	"to" => article.data["to"],
	"object" => article.data,
	"published" => DateTime.utc_now() \|> DateTime.to_iso8601(),
	"context" => article.data["context"]
	}

	%Pleroma.Activity{
	data: data,
	actor: data["actor"],
	recipients: data["to"]
	}
	end

	def announce_activity_factory(attrs \\ %{}) do
	note_activity = attrs[:note_activity] \|\| insert(:note_activity)
	user = attrs[:user] \|\| insert(:user)

	data = %{
	"type" => "Announce",
	"actor" => note_activity.actor,
	"object" => note_activity.data["id"],
	"to" => [user.follower_address, note_activity.data["actor"]],
	"cc" => ["https://www.w3.org/ns/activitystreams#Public"],
	"context" => note_activity.data["context"]
	}

	%Pleroma.Activity{
	data: data,
	actor: user.ap_id,
	recipients: data["to"]
	}
	end

	def like_activity_factory do
	note_activity = insert(:note_activity)
	user = insert(:user)

	data = %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"actor" => user.ap_id,
	"type" => "Like",
	"object" => note_activity.data["object"]["id"],
	"published_at" => DateTime.utc_now() \|> DateTime.to_iso8601()
	}

	%Pleroma.Activity{
	data: data
	}
	end

	def follow_activity_factory do
	follower = insert(:user)
	followed = insert(:user)

	data = %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"actor" => follower.ap_id,
	"type" => "Follow",
	"object" => followed.ap_id,
	"published_at" => DateTime.utc_now() \|> DateTime.to_iso8601()
	}

	%Pleroma.Activity{
	data: data,
	actor: follower.ap_id
	}
	end

	def websub_subscription_factory do
	%Pleroma.Web.Websub.WebsubServerSubscription{
	topic: "http://example.org",
	callback: "http://example.org/callback",
	secret: "here's a secret",
	valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 100),
	state: "requested"
	}
	end

	def websub_client_subscription_factory do
	%Pleroma.Web.Websub.WebsubClientSubscription{
	topic: "http://example.org",
	secret: "here's a secret",
	valid_until: nil,
	state: "requested",
	subscribers: []
	}
	end

	def oauth_app_factory do
	%Pleroma.Web.OAuth.App{
	client_name: "Some client",
	redirect_uris: "https://example.com/callback",
	scopes: ["read", "write", "follow", "push"],
	website: "https://example.com",
	client_id: Ecto.UUID.generate(),
	client_secret: "aaa;/&bbb"
	}
	end

	def instance_factory do
	%Pleroma.Instances.Instance{
	host: "domain.com",
	unreachable_since: nil
	}
	end

	def oauth_token_factory do
	oauth_app = insert(:oauth_app)

	%Pleroma.Web.OAuth.Token{
	token: :crypto.strong_rand_bytes(32) \|> Base.url_encode64(),
	refresh_token: :crypto.strong_rand_bytes(32) \|> Base.url_encode64(),
	user: build(:user),
	app_id: oauth_app.id,
	valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10)
	}
	end

	def oauth_authorization_factory do
	%Pleroma.Web.OAuth.Authorization{
	token: :crypto.strong_rand_bytes(32) \|> Base.url_encode64(padding: false),
	scopes: ["read", "write", "follow", "push"],
	valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10),
	user: build(:user),
	app: build(:oauth_app)
	}
	end

	def push_subscription_factory do
	%Pleroma.Web.Push.Subscription{
	user: build(:user),
	token: build(:oauth_token),
	endpoint: "https://example.com/example/1234",
	key_auth: "8eDyX_uCN0XRhSbY5hs7Hg==",
	key_p256dh:
	"BCIWgsnyXDv1VkhqL2P7YRBvdeuDnlwAPT2guNhdIoW3IP7GmHh1SMKPLxRf7x8vJy6ZFK3ol2ohgn_-0yP7QQA=",
	data: %{}
	}
	end

	def notification_factory do
	%Pleroma.Notification{
	user: build(:user)
	}
	end

	def scheduled_activity_factory do
	%Pleroma.ScheduledActivity{
	user: build(:user),
	scheduled_at: NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(60), :millisecond),
	params: build(:note) \|> Map.from_struct() \|> Map.get(:data)
	}
	end
	+
	+ def registration_factory do
	+ user = insert(:user)
	+
	+ %Pleroma.Registration{
	+ user: user,
	+ provider: "twitter",
	+ uid: "171799000",
	+ info: %{
	+ "name" => "John Doe",
	+ "email" => "john@doe.com",
	+ "nickname" => "johndoe",
	+ "description" => "My bio"
	+ }
	+ }
	+ end
	end
	diff --git a/test/web/admin_api/admin_api_controller_test.exs b/test/web/admin_api/admin_api_controller_test.exs
	index dd2fbfb15..ca6bd0e97 100644
	--- a/test/web/admin_api/admin_api_controller_test.exs
	+++ b/test/web/admin_api/admin_api_controller_test.exs
	@@ -1,645 +1,643 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.User
	import Pleroma.Factory

	describe "/api/pleroma/admin/user" do
	test "Delete" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> delete("/api/pleroma/admin/user?nickname=#{user.nickname}")

	assert json_response(conn, 200) == user.nickname
	end

	test "Create" do
	admin = insert(:user, info: %{is_admin: true})

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> post("/api/pleroma/admin/user", %{
	"nickname" => "lain",
	"email" => "lain@example.org",
	"password" => "test"
	})

	assert json_response(conn, 200) == "lain"
	end
	end

	describe "/api/pleroma/admin/users/:nickname" do
	test "Show", %{conn: conn} do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users/#{user.nickname}")

	expected = %{
	"deactivated" => false,
	"id" => to_string(user.id),
	"local" => true,
	"nickname" => user.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"tags" => []
	}

	assert expected == json_response(conn, 200)
	end

	test "when the user doesn't exist", %{conn: conn} do
	admin = insert(:user, info: %{is_admin: true})
	user = build(:user)

	conn =
	conn
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users/#{user.nickname}")

	assert "Not found" == json_response(conn, 404)
	end
	end

	describe "/api/pleroma/admin/user/follow" do
	test "allows to force-follow another user" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user)
	follower = insert(:user)

	- conn =
	- build_conn()
	- \|> assign(:user, admin)
	- \|> put_req_header("accept", "application/json")
	- \|> post("/api/pleroma/admin/user/follow", %{
	- "follower" => follower.nickname,
	- "followed" => user.nickname
	- })
	+ build_conn()
	+ \|> assign(:user, admin)
	+ \|> put_req_header("accept", "application/json")
	+ \|> post("/api/pleroma/admin/user/follow", %{
	+ "follower" => follower.nickname,
	+ "followed" => user.nickname
	+ })

	user = User.get_by_id(user.id)
	follower = User.get_by_id(follower.id)

	assert User.following?(follower, user)
	end
	end

	describe "/api/pleroma/admin/user/unfollow" do
	test "allows to force-unfollow another user" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user)
	follower = insert(:user)

	User.follow(follower, user)

	- conn =
	- build_conn()
	- \|> assign(:user, admin)
	- \|> put_req_header("accept", "application/json")
	- \|> post("/api/pleroma/admin/user/unfollow", %{
	- "follower" => follower.nickname,
	- "followed" => user.nickname
	- })
	+ build_conn()
	+ \|> assign(:user, admin)
	+ \|> put_req_header("accept", "application/json")
	+ \|> post("/api/pleroma/admin/user/unfollow", %{
	+ "follower" => follower.nickname,
	+ "followed" => user.nickname
	+ })

	user = User.get_by_id(user.id)
	follower = User.get_by_id(follower.id)

	refute User.following?(follower, user)
	end
	end

	describe "PUT /api/pleroma/admin/users/tag" do
	setup do
	admin = insert(:user, info: %{is_admin: true})
	user1 = insert(:user, %{tags: ["x"]})
	user2 = insert(:user, %{tags: ["y"]})
	user3 = insert(:user, %{tags: ["unchanged"]})

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> put(
	"/api/pleroma/admin/users/tag?nicknames[]=#{user1.nickname}&nicknames[]=#{
	user2.nickname
	}&tags[]=foo&tags[]=bar"
	)

	%{conn: conn, user1: user1, user2: user2, user3: user3}
	end

	test "it appends specified tags to users with specified nicknames", %{
	conn: conn,
	user1: user1,
	user2: user2
	} do
	assert json_response(conn, :no_content)
	assert User.get_by_id(user1.id).tags == ["x", "foo", "bar"]
	assert User.get_by_id(user2.id).tags == ["y", "foo", "bar"]
	end

	test "it does not modify tags of not specified users", %{conn: conn, user3: user3} do
	assert json_response(conn, :no_content)
	assert User.get_by_id(user3.id).tags == ["unchanged"]
	end
	end

	describe "DELETE /api/pleroma/admin/users/tag" do
	setup do
	admin = insert(:user, info: %{is_admin: true})
	user1 = insert(:user, %{tags: ["x"]})
	user2 = insert(:user, %{tags: ["y", "z"]})
	user3 = insert(:user, %{tags: ["unchanged"]})

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> delete(
	"/api/pleroma/admin/users/tag?nicknames[]=#{user1.nickname}&nicknames[]=#{
	user2.nickname
	}&tags[]=x&tags[]=z"
	)

	%{conn: conn, user1: user1, user2: user2, user3: user3}
	end

	test "it removes specified tags from users with specified nicknames", %{
	conn: conn,
	user1: user1,
	user2: user2
	} do
	assert json_response(conn, :no_content)
	assert User.get_by_id(user1.id).tags == []
	assert User.get_by_id(user2.id).tags == ["y"]
	end

	test "it does not modify tags of not specified users", %{conn: conn, user3: user3} do
	assert json_response(conn, :no_content)
	assert User.get_by_id(user3.id).tags == ["unchanged"]
	end
	end

	describe "/api/pleroma/admin/permission_group" do
	test "GET is giving user_info" do
	admin = insert(:user, info: %{is_admin: true})

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> get("/api/pleroma/admin/permission_group/#{admin.nickname}")

	assert json_response(conn, 200) == %{
	"is_admin" => true,
	"is_moderator" => false
	}
	end

	test "/:right POST, can add to a permission group" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> post("/api/pleroma/admin/permission_group/#{user.nickname}/admin")

	assert json_response(conn, 200) == %{
	"is_admin" => true
	}
	end

	test "/:right DELETE, can remove from a permission group" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user, info: %{is_admin: true})

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> delete("/api/pleroma/admin/permission_group/#{user.nickname}/admin")

	assert json_response(conn, 200) == %{
	"is_admin" => false
	}
	end
	end

	describe "PUT /api/pleroma/admin/activation_status" do
	setup %{conn: conn} do
	admin = insert(:user, info: %{is_admin: true})

	conn =
	conn
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")

	%{conn: conn}
	end

	test "deactivates the user", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> put("/api/pleroma/admin/activation_status/#{user.nickname}", %{status: false})

	user = User.get_by_id(user.id)
	assert user.info.deactivated == true
	assert json_response(conn, :no_content)
	end

	test "activates the user", %{conn: conn} do
	user = insert(:user, info: %{deactivated: true})

	conn =
	conn
	\|> put("/api/pleroma/admin/activation_status/#{user.nickname}", %{status: true})

	user = User.get_by_id(user.id)
	assert user.info.deactivated == false
	assert json_response(conn, :no_content)
	end

	test "returns 403 when requested by a non-admin", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> put("/api/pleroma/admin/activation_status/#{user.nickname}", %{status: false})

	assert json_response(conn, :forbidden)
	end
	end

	describe "POST /api/pleroma/admin/email_invite, with valid config" do
	setup do
	registrations_open = Pleroma.Config.get([:instance, :registrations_open])
	invites_enabled = Pleroma.Config.get([:instance, :invites_enabled])
	Pleroma.Config.put([:instance, :registrations_open], false)
	Pleroma.Config.put([:instance, :invites_enabled], true)

	on_exit(fn ->
	Pleroma.Config.put([:instance, :registrations_open], registrations_open)
	Pleroma.Config.put([:instance, :invites_enabled], invites_enabled)
	:ok
	end)

	[user: insert(:user, info: %{is_admin: true})]
	end

	test "sends invitation and returns 204", %{conn: conn, user: user} do
	recipient_email = "foo@bar.com"
	recipient_name = "J. D."

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/pleroma/admin/email_invite?email=#{recipient_email}&name=#{recipient_name}")

	assert json_response(conn, :no_content)

	token_record = List.last(Pleroma.Repo.all(Pleroma.UserInviteToken))
	assert token_record
	refute token_record.used

	Swoosh.TestAssertions.assert_email_sent(
	Pleroma.UserEmail.user_invitation_email(
	user,
	token_record,
	recipient_email,
	recipient_name
	)
	)
	end

	test "it returns 403 if requested by a non-admin", %{conn: conn} do
	non_admin_user = insert(:user)

	conn =
	conn
	\|> assign(:user, non_admin_user)
	\|> post("/api/pleroma/admin/email_invite?email=foo@bar.com&name=JD")

	assert json_response(conn, :forbidden)
	end
	end

	describe "POST /api/pleroma/admin/email_invite, with invalid config" do
	setup do
	[user: insert(:user, info: %{is_admin: true})]
	end

	test "it returns 500 if `invites_enabled` is not enabled", %{conn: conn, user: user} do
	registrations_open = Pleroma.Config.get([:instance, :registrations_open])
	invites_enabled = Pleroma.Config.get([:instance, :invites_enabled])
	Pleroma.Config.put([:instance, :registrations_open], false)
	Pleroma.Config.put([:instance, :invites_enabled], false)

	on_exit(fn ->
	Pleroma.Config.put([:instance, :registrations_open], registrations_open)
	Pleroma.Config.put([:instance, :invites_enabled], invites_enabled)
	:ok
	end)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/pleroma/admin/email_invite?email=foo@bar.com&name=JD")

	assert json_response(conn, :internal_server_error)
	end

	test "it returns 500 if `registrations_open` is enabled", %{conn: conn, user: user} do
	registrations_open = Pleroma.Config.get([:instance, :registrations_open])
	invites_enabled = Pleroma.Config.get([:instance, :invites_enabled])
	Pleroma.Config.put([:instance, :registrations_open], true)
	Pleroma.Config.put([:instance, :invites_enabled], true)

	on_exit(fn ->
	Pleroma.Config.put([:instance, :registrations_open], registrations_open)
	Pleroma.Config.put([:instance, :invites_enabled], invites_enabled)
	:ok
	end)

	conn =
	conn
	\|> assign(:user, user)
	\|> post("/api/pleroma/admin/email_invite?email=foo@bar.com&name=JD")

	assert json_response(conn, :internal_server_error)
	end
	end

	test "/api/pleroma/admin/invite_token" do
	admin = insert(:user, info: %{is_admin: true})

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> get("/api/pleroma/admin/invite_token")

	assert conn.status == 200
	end

	test "/api/pleroma/admin/password_reset" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> put_req_header("accept", "application/json")
	\|> get("/api/pleroma/admin/password_reset?nickname=#{user.nickname}")

	assert conn.status == 200
	end

	describe "GET /api/pleroma/admin/users" do
	test "renders users array for the first page" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user, local: false, tags: ["foo", "bar"])

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users?page=1")

	assert json_response(conn, 200) == %{
	"count" => 2,
	"page_size" => 50,
	"users" => [
	%{
	"deactivated" => admin.info.deactivated,
	"id" => admin.id,
	"nickname" => admin.nickname,
	"roles" => %{"admin" => true, "moderator" => false},
	"local" => true,
	"tags" => []
	},
	%{
	"deactivated" => user.info.deactivated,
	"id" => user.id,
	"nickname" => user.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"local" => false,
	"tags" => ["foo", "bar"]
	}
	]
	}
	end

	test "renders empty array for the second page" do
	admin = insert(:user, info: %{is_admin: true})
	insert(:user)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users?page=2")

	assert json_response(conn, 200) == %{
	"count" => 2,
	"page_size" => 50,
	"users" => []
	}
	end

	test "regular search" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user, nickname: "bob")

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users?query=bo")

	assert json_response(conn, 200) == %{
	"count" => 1,
	"page_size" => 50,
	"users" => [
	%{
	"deactivated" => user.info.deactivated,
	"id" => user.id,
	"nickname" => user.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"local" => true,
	"tags" => []
	}
	]
	}
	end

	test "regular search with page size" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user, nickname: "aalice")
	user2 = insert(:user, nickname: "alice")

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users?query=a&page_size=1&page=1")

	assert json_response(conn, 200) == %{
	"count" => 2,
	"page_size" => 1,
	"users" => [
	%{
	"deactivated" => user.info.deactivated,
	"id" => user.id,
	"nickname" => user.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"local" => true,
	"tags" => []
	}
	]
	}

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users?query=a&page_size=1&page=2")

	assert json_response(conn, 200) == %{
	"count" => 2,
	"page_size" => 1,
	"users" => [
	%{
	"deactivated" => user2.info.deactivated,
	"id" => user2.id,
	"nickname" => user2.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"local" => true,
	"tags" => []
	}
	]
	}
	end

	test "only local users" do
	admin = insert(:user, info: %{is_admin: true}, nickname: "john")
	user = insert(:user, nickname: "bob")

	insert(:user, nickname: "bobb", local: false)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users?query=bo&filters=local")

	assert json_response(conn, 200) == %{
	"count" => 1,
	"page_size" => 50,
	"users" => [
	%{
	"deactivated" => user.info.deactivated,
	"id" => user.id,
	"nickname" => user.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"local" => true,
	"tags" => []
	}
	]
	}
	end

	test "only local users with no query" do
	admin = insert(:user, info: %{is_admin: true}, nickname: "john")
	user = insert(:user, nickname: "bob")

	insert(:user, nickname: "bobb", local: false)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users?filters=local")

	assert json_response(conn, 200) == %{
	"count" => 2,
	"page_size" => 50,
	"users" => [
	%{
	"deactivated" => user.info.deactivated,
	"id" => user.id,
	"nickname" => user.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"local" => true,
	"tags" => []
	},
	%{
	"deactivated" => admin.info.deactivated,
	"id" => admin.id,
	"nickname" => admin.nickname,
	"roles" => %{"admin" => true, "moderator" => false},
	"local" => true,
	"tags" => []
	}
	]
	}
	end

	test "it works with multiple filters" do
	admin = insert(:user, nickname: "john", info: %{is_admin: true})
	user = insert(:user, nickname: "bob", local: false, info: %{deactivated: true})

	insert(:user, nickname: "ken", local: true, info: %{deactivated: true})
	insert(:user, nickname: "bobb", local: false, info: %{deactivated: false})

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> get("/api/pleroma/admin/users?filters=deactivated,external")

	assert json_response(conn, 200) == %{
	"count" => 1,
	"page_size" => 50,
	"users" => [
	%{
	"deactivated" => user.info.deactivated,
	"id" => user.id,
	"nickname" => user.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"local" => user.local,
	"tags" => []
	}
	]
	}
	end
	end

	test "PATCH /api/pleroma/admin/users/:nickname/toggle_activation" do
	admin = insert(:user, info: %{is_admin: true})
	user = insert(:user)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> patch("/api/pleroma/admin/users/#{user.nickname}/toggle_activation")

	assert json_response(conn, 200) ==
	%{
	"deactivated" => !user.info.deactivated,
	"id" => user.id,
	"nickname" => user.nickname,
	"roles" => %{"admin" => false, "moderator" => false},
	"local" => true,
	"tags" => []
	}
	end
	end
	diff --git a/test/web/oauth/oauth_controller_test.exs b/test/web/oauth/oauth_controller_test.exs
	index a68528420..ac7843f9b 100644
	--- a/test/web/oauth/oauth_controller_test.exs
	+++ b/test/web/oauth/oauth_controller_test.exs
	@@ -1,374 +1,680 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthControllerTest do
	use Pleroma.Web.ConnCase
	import Pleroma.Factory
	+ import Mock

	+ alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Token

	- describe "GET /oauth/authorize" do
	+ @session_opts [
	+ store: :cookie,
	+ key: "_test",
	+ signing_salt: "cooldude"
	+ ]
	+
	+ describe "in OAuth consumer mode, " do
	setup do
	- session_opts = [
	- store: :cookie,
	- key: "_test",
	- signing_salt: "cooldude"
	+ oauth_consumer_strategies_path = [:auth, :oauth_consumer_strategies]
	+ oauth_consumer_strategies = Pleroma.Config.get(oauth_consumer_strategies_path)
	+ Pleroma.Config.put(oauth_consumer_strategies_path, ~w(twitter facebook))
	+
	+ on_exit(fn ->
	+ Pleroma.Config.put(oauth_consumer_strategies_path, oauth_consumer_strategies)
	+ end)
	+
	+ [
	+ app: insert(:oauth_app),
	+ conn:
	+ build_conn()
	+ \|> Plug.Session.call(Plug.Session.init(@session_opts))
	+ \|> fetch_session()
	]
	+ end
	+
	+ test "GET /oauth/authorize renders auth forms, including OAuth consumer form", %{
	+ app: app,
	+ conn: conn
	+ } do
	+ conn =
	+ get(
	+ conn,
	+ "/oauth/authorize",
	+ %{
	+ "response_type" => "code",
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "scope" => "read"
	+ }
	+ )
	+
	+ assert response = html_response(conn, 200)
	+ assert response =~ "Sign in with Twitter"
	+ assert response =~ o_auth_path(conn, :prepare_request)
	+ end

	+ test "GET /oauth/prepare_request encodes parameters as `state` and redirects", %{
	+ app: app,
	+ conn: conn
	+ } do
	+ conn =
	+ get(
	+ conn,
	+ "/oauth/prepare_request",
	+ %{
	+ "provider" => "twitter",
	+ "scope" => "read follow",
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state"
	+ }
	+ )
	+
	+ assert response = html_response(conn, 302)
	+
	+ redirect_query = URI.parse(redirected_to(conn)).query
	+ assert %{"state" => state_param} = URI.decode_query(redirect_query)
	+ assert {:ok, state_components} = Poison.decode(state_param)
	+
	+ expected_client_id = app.client_id
	+ expected_redirect_uri = app.redirect_uris
	+
	+ assert %{
	+ "scope" => "read follow",
	+ "client_id" => ^expected_client_id,
	+ "redirect_uri" => ^expected_redirect_uri,
	+ "state" => "a_state"
	+ } = state_components
	+ end
	+
	+ test "with user-bound registration, GET /oauth/<provider>/callback redirects to `redirect_uri` with `code`",
	+ %{app: app, conn: conn} do
	+ registration = insert(:registration)
	+
	+ state_params = %{
	+ "scope" => Enum.join(app.scopes, " "),
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => ""
	+ }
	+
	+ with_mock Pleroma.Web.Auth.Authenticator,
	+ get_registration: fn _, _ -> {:ok, registration} end do
	+ conn =
	+ get(
	+ conn,
	+ "/oauth/twitter/callback",
	+ %{
	+ "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	+ "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	+ "provider" => "twitter",
	+ "state" => Poison.encode!(state_params)
	+ }
	+ )
	+
	+ assert response = html_response(conn, 302)
	+ assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
	+ end
	+ end
	+
	+ test "with user-unbound registration, GET /oauth/<provider>/callback renders registration_details page",
	+ %{app: app, conn: conn} do
	+ registration = insert(:registration, user: nil)
	+
	+ state_params = %{
	+ "scope" => "read write",
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state"
	+ }
	+
	+ with_mock Pleroma.Web.Auth.Authenticator,
	+ get_registration: fn _, _ -> {:ok, registration} end do
	+ conn =
	+ get(
	+ conn,
	+ "/oauth/twitter/callback",
	+ %{
	+ "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	+ "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	+ "provider" => "twitter",
	+ "state" => Poison.encode!(state_params)
	+ }
	+ )
	+
	+ assert response = html_response(conn, 200)
	+ assert response =~ ~r/name="op" type="submit" value="register"/
	+ assert response =~ ~r/name="op" type="submit" value="connect"/
	+ assert response =~ Registration.email(registration)
	+ assert response =~ Registration.nickname(registration)
	+ end
	+ end
	+
	+ test "on authentication error, GET /oauth/<provider>/callback redirects to `redirect_uri`", %{
	+ app: app,
	+ conn: conn
	+ } do
	+ state_params = %{
	+ "scope" => Enum.join(app.scopes, " "),
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => ""
	+ }
	+
	+ conn =
	+ conn
	+ \|> assign(:ueberauth_failure, %{errors: [%{message: "(error description)"}]})
	+ \|> get(
	+ "/oauth/twitter/callback",
	+ %{
	+ "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	+ "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	+ "provider" => "twitter",
	+ "state" => Poison.encode!(state_params)
	+ }
	+ )
	+
	+ assert response = html_response(conn, 302)
	+ assert redirected_to(conn) == app.redirect_uris
	+ assert get_flash(conn, :error) == "Failed to authenticate: (error description)."
	+ end
	+
	+ test "GET /oauth/registration_details renders registration details form", %{
	+ app: app,
	+ conn: conn
	+ } do
	+ conn =
	+ get(
	+ conn,
	+ "/oauth/registration_details",
	+ %{
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "nickname" => nil,
	+ "email" => "john@doe.com"
	+ }
	+ )
	+
	+ assert response = html_response(conn, 200)
	+ assert response =~ ~r/name="op" type="submit" value="register"/
	+ assert response =~ ~r/name="op" type="submit" value="connect"/
	+ end
	+
	+ test "with valid params, POST /oauth/register?op=register redirects to `redirect_uri` with `code`",
	+ %{
	+ app: app,
	+ conn: conn
	+ } do
	+ registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
	+
	+ conn =
	+ conn
	+ \|> put_session(:registration_id, registration.id)
	+ \|> post(
	+ "/oauth/register",
	+ %{
	+ "op" => "register",
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "nickname" => "availablenick",
	+ "email" => "available@email.com"
	+ }
	+ )
	+
	+ assert response = html_response(conn, 302)
	+ assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
	+ end
	+
	+ test "with invalid params, POST /oauth/register?op=register renders registration_details page",
	+ %{
	+ app: app,
	+ conn: conn
	+ } do
	+ another_user = insert(:user)
	+ registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
	+
	+ params = %{
	+ "op" => "register",
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "nickname" => "availablenickname",
	+ "email" => "available@email.com"
	+ }
	+
	+ for {bad_param, bad_param_value} <-
	+ [{"nickname", another_user.nickname}, {"email", another_user.email}] do
	+ bad_params = Map.put(params, bad_param, bad_param_value)
	+
	+ conn =
	+ conn
	+ \|> put_session(:registration_id, registration.id)
	+ \|> post("/oauth/register", bad_params)
	+
	+ assert html_response(conn, 403) =~ ~r/name="op" type="submit" value="register"/
	+ assert get_flash(conn, :error) == "Error: #{bad_param} has already been taken."
	+ end
	+ end
	+
	+ test "with valid params, POST /oauth/register?op=connect redirects to `redirect_uri` with `code`",
	+ %{
	+ app: app,
	+ conn: conn
	+ } do
	+ user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt("testpassword"))
	+ registration = insert(:registration, user: nil)
	+
	+ conn =
	+ conn
	+ \|> put_session(:registration_id, registration.id)
	+ \|> post(
	+ "/oauth/register",
	+ %{
	+ "op" => "connect",
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "auth_name" => user.nickname,
	+ "password" => "testpassword"
	+ }
	+ )
	+
	+ assert response = html_response(conn, 302)
	+ assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
	+ end
	+
	+ test "with invalid params, POST /oauth/register?op=connect renders registration_details page",
	+ %{
	+ app: app,
	+ conn: conn
	+ } do
	+ user = insert(:user)
	+ registration = insert(:registration, user: nil)
	+
	+ params = %{
	+ "op" => "connect",
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "auth_name" => user.nickname,
	+ "password" => "wrong password"
	+ }
	+
	+ conn =
	+ conn
	+ \|> put_session(:registration_id, registration.id)
	+ \|> post("/oauth/register", params)
	+
	+ assert html_response(conn, 401) =~ ~r/name="op" type="submit" value="connect"/
	+ assert get_flash(conn, :error) == "Invalid Username/Password"
	+ end
	+ end
	+
	+ describe "GET /oauth/authorize" do
	+ setup do
	[
	app: insert(:oauth_app, redirect_uris: "https://redirect.url"),
	conn:
	build_conn()
	- \|> Plug.Session.call(Plug.Session.init(session_opts))
	+ \|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	test "renders authentication page", %{app: app, conn: conn} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "renders authentication page if user is already authenticated but `force_login` is tru-ish",
	%{app: app, conn: conn} do
	token = insert(:oauth_token, app_id: app.id)

	conn =
	conn
	\|> put_session(:oauth_token, token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read",
	"force_login" => "true"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "redirects to app if user is already authenticated", %{app: app, conn: conn} do
	token = insert(:oauth_token, app_id: app.id)

	conn =
	conn
	\|> put_session(:oauth_token, token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read"
	}
	)

	assert redirected_to(conn) == "https://redirect.url"
	end
	end

	describe "POST /oauth/authorize" do
	test "redirects with oauth authorization" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write", "follow"])

	conn =
	build_conn()
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read write",
	"state" => "statepassed"
	}
	})

	target = redirected_to(conn)
	assert target =~ app.redirect_uris

	query = URI.parse(target).query \|> URI.query_decoder() \|> Map.new()

	assert %{"state" => "statepassed", "code" => code} = query
	auth = Repo.get_by(Authorization, token: code)
	assert auth
	assert auth.scopes == ["read", "write"]
	end

	test "returns 401 for wrong credentials", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "wrong",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => "statepassed",
	"scope" => Enum.join(app.scopes, " ")
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ app.redirect_uris

	# Error message
	assert result =~ "Invalid Username/Password"
	end

	test "returns 401 for missing scopes", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => "statepassed",
	"scope" => ""
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ app.redirect_uris

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end

	test "returns 401 for scopes beyond app scopes", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => "statepassed",
	"scope" => "read write follow"
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ app.redirect_uris

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end
	end

	describe "POST /oauth/token" do
	test "issues a token for an all-body request" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => app.redirect_uris,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "me" => ap_id} = json_response(conn, 200)

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == auth.scopes
	assert user.ap_id == ap_id
	end

	test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do
	password = "testpassword"
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))

	app = insert(:oauth_app, scopes: ["read", "write"])

	# Note: "scope" param is intentionally omitted
	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token} = json_response(conn, 200)

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == app.scopes
	end

	test "issues a token for request with HTTP basic auth client credentials" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["scope1", "scope2", "scope3"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["scope1", "scope2"])
	assert auth.scopes == ["scope1", "scope2"]

	app_encoded =
	(URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
	\|> Base.encode64()

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic " <> app_encoded)
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => app.redirect_uris
	})

	assert %{"access_token" => token, "scope" => scope} = json_response(conn, 200)

	assert scope == "scope1 scope2"

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == ["scope1", "scope2"]
	end

	test "rejects token exchange with invalid client credentials" do
	user = insert(:user)
	app = insert(:oauth_app)

	{:ok, auth} = Authorization.create_authorization(app, user)

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => app.redirect_uris
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
	setting = Pleroma.Config.get([:instance, :account_activation_required])

	unless setting do
	Pleroma.Config.put([:instance, :account_activation_required], true)
	on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
	end

	password = "testpassword"
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
	info_change = Pleroma.User.Info.confirmation_changeset(user.info, :unconfirmed)

	{:ok, user} =
	user
	\|> Ecto.Changeset.change()
	\|> Ecto.Changeset.put_embed(:info, info_change)
	\|> Repo.update()

	refute Pleroma.User.auth_active?(user)

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to deactivated user" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Comeonin.Pbkdf2.hashpwsalt(password),
	info: %{deactivated: true}
	)

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects an invalid authorization code" do
	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => "Imobviouslyinvalid",
	"redirect_uri" => app.redirect_uris,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = json_response(conn, 400)
	refute Map.has_key?(resp, "access_token")
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Sep 19, 6:22 AM (1 d, 14 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1769022
Default Alt Text: (219 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions