No OneTemporary
Actions

Size

114 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web/api_spec/operations/pleroma_event_operation.ex b/lib/pleroma/web/api_spec/operations/pleroma_event_operation.ex
	index 2cb25620c..ed88e2ee1 100644
	--- a/lib/pleroma/web/api_spec/operations/pleroma_event_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/pleroma_event_operation.ex
	@@ -1,250 +1,311 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.PleromaEventOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.AccountOperation
	alias Pleroma.Web.ApiSpec.Schemas.Account
	alias Pleroma.Web.ApiSpec.Schemas.ApiError
	alias Pleroma.Web.ApiSpec.Schemas.FlakeID
	alias Pleroma.Web.ApiSpec.Schemas.ParticipationRequest
	alias Pleroma.Web.ApiSpec.Schemas.Status

	import Pleroma.Web.ApiSpec.Helpers

	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	def create_operation do
	%Operation{
	tags: ["Event actions"],
	summary: "Publish new status",
	security: [%{"oAuth" => ["write"]}],
	description: "Create a new event",
	operationId: "PleromaAPI.EventController.create",
	requestBody: request_body("Parameters", create_request(), required: true),
	responses: %{
	200 => event_response(),
	422 => Operation.response("Bad Request", "application/json", ApiError)
	}
	}
	end

	+ def update_operation do
	+ %Operation{
	+ tags: ["Event actions"],
	+ summary: "Update event",
	+ description: "Change the content of an event",
	+ operationId: "PleromaAPI.EventController.update",
	+ security: [%{"oAuth" => ["write"]}],
	+ parameters: [id_param()],
	+ requestBody: request_body("Parameters", update_request(), required: true),
	+ responses: %{
	+ 200 => event_response(),
	+ 403 => Operation.response("Forbidden", "application/json", ApiError),
	+ 404 => Operation.response("Not Found", "application/json", ApiError)
	+ }
	+ }
	+ end
	+
	def participations_operation do
	%Operation{
	tags: ["Event actions"],
	summary: "Participants list",
	description: "View who joined a given event",
	operationId: "EventController.participations",
	security: [%{"oAuth" => ["read"]}],
	parameters: [id_param()],
	responses: %{
	200 =>
	Operation.response(
	"Array of Accounts",
	"application/json",
	AccountOperation.array_of_accounts()
	),
	403 => Operation.response("Error", "application/json", ApiError),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def participation_requests_operation do
	%Operation{
	tags: ["Event actions"],
	summary: "Participation requests list",
	description: "View who wants to join the event",
	operationId: "EventController.participations",
	security: [%{"oAuth" => ["read"]}],
	parameters: [id_param()],
	responses: %{
	200 =>
	Operation.response(
	"Array of participation requests",
	"application/json",
	array_of_participation_requests()
	),
	403 => Operation.response("Forbidden", "application/json", ApiError),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def join_operation do
	%Operation{
	tags: ["Event actions"],
	summary: "Participate",
	security: [%{"oAuth" => ["write"]}],
	description: "Participate in an event",
	operationId: "PleromaAPI.EventController.join",
	parameters: [id_param()],
	requestBody:
	request_body(
	"Parameters",
	%Schema{
	type: :object,
	properties: %{
	account: Account,
	participation_message: %Schema{
	type: :string,
	description: "Why the user wants to participate"
	}
	}
	},
	required: false
	),
	responses: %{
	200 => event_response(),
	400 => Operation.response("Error", "application/json", ApiError),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def leave_operation do
	%Operation{
	tags: ["Event actions"],
	summary: "Unparticipate",
	security: [%{"oAuth" => ["write"]}],
	description: "Delete event participation",
	operationId: "PleromaAPI.EventController.leave",
	parameters: [id_param()],
	responses: %{
	200 => event_response(),
	400 => Operation.response("Error", "application/json", ApiError),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def authorize_participation_request_operation do
	%Operation{
	tags: ["Event actions"],
	summary: "Accept participation",
	security: [%{"oAuth" => ["write"]}],
	description: "Accept event participation request",
	operationId: "PleromaAPI.EventController.authorize_participation_request",
	parameters: [id_param(), participant_id_param()],
	responses: %{
	200 => event_response(),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def reject_participation_request_operation do
	%Operation{
	tags: ["Event actions"],
	summary: "Reject participation",
	security: [%{"oAuth" => ["write"]}],
	description: "Reject event participation request",
	operationId: "PleromaAPI.EventController.reject_participation_request",
	parameters: [id_param(), participant_id_param()],
	responses: %{
	200 => event_response(),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	def export_ics_operation do
	%Operation{
	tags: ["Event actions"],
	summary: "Export status",
	description: "Export event to .ics",
	operationId: "PleromaAPI.EventController.export_ics",
	security: [%{"oAuth" => ["read:statuses"]}],
	parameters: [id_param()],
	responses: %{
	200 =>
	Operation.response("Event", "text/calendar; charset=utf-8", %Schema{type: :string}),
	404 => Operation.response("Not Found", "application/json", ApiError)
	}
	}
	end

	defp create_request do
	%Schema{
	title: "EventCreateRequest",
	type: :object,
	properties: %{
	name: %Schema{
	type: :string,
	description: "Name of the event."
	},
	status: %Schema{
	type: :string,
	nullable: true,
	description: "Text description of the event."
	},
	banner_id: %Schema{
	nullable: true,
	type: :string,
	description: "Attachment id to be attached as banner."
	},
	start_time: %Schema{
	type: :string,
	format: :"date-time",
	description: "Start time."
	},
	end_time: %Schema{
	type: :string,
	format: :"date-time",
	description: "End time."
	},
	join_mode: %Schema{
	type: :string,
	enum: ["free", "restricted"]
	},
	location_id: %Schema{
	type: :string,
	description: "Location ID from geospatial provider",
	nullable: true
	}
	},
	example: %{
	"name" => "Example event",
	"status" => "No information for now.",
	"start_time" => "2022-02-21T22:00:00.000Z",
	"end_time" => "2022-02-21T23:00:00.000Z"
	}
	}
	end

	+ defp update_request do
	+ %Schema{
	+ title: "EventUpdateRequest",
	+ type: :object,
	+ properties: %{
	+ name: %Schema{
	+ type: :string,
	+ description: "Name of the event."
	+ },
	+ status: %Schema{
	+ type: :string,
	+ nullable: true,
	+ description: "Text description of the event."
	+ },
	+ banner_id: %Schema{
	+ nullable: true,
	+ type: :string,
	+ description: "Attachment id to be attached as banner."
	+ },
	+ start_time: %Schema{
	+ type: :string,
	+ format: :"date-time",
	+ description: "Start time."
	+ },
	+ end_time: %Schema{
	+ type: :string,
	+ format: :"date-time",
	+ description: "End time."
	+ },
	+ location_id: %Schema{
	+ type: :string,
	+ description: "Location ID from geospatial provider",
	+ nullable: true
	+ }
	+ },
	+ example: %{
	+ "name" => "Updated event",
	+ "status" => "We had to reschedule the event.",
	+ "start_time" => "2022-02-22T22:00:00.000Z",
	+ "end_time" => "2022-02-22T23:00:00.000Z"
	+ }
	+ }
	+ end
	+
	defp event_response do
	Operation.response(
	"Status",
	"application/json",
	Status
	)
	end

	defp id_param do
	Operation.parameter(:id, :path, FlakeID, "Event ID",
	example: "9umDrYheeY451cQnEe",
	required: true
	)
	end

	defp participant_id_param do
	Operation.parameter(:participant_id, :path, FlakeID, "Event participant ID",
	example: "9umDrYheeY451cQnEe",
	required: true
	)
	end

	def array_of_participation_requests do
	%Schema{
	title: "ArrayOfParticipationRequests",
	type: :array,
	items: ParticipationRequest,
	example: [ParticipationRequest.schema().example]
	}
	end
	end
	diff --git a/lib/pleroma/web/common_api.ex b/lib/pleroma/web/common_api.ex
	index b84b6f7f1..927c62b6b 100644
	--- a/lib/pleroma/web/common_api.ex
	+++ b/lib/pleroma/web/common_api.ex
	@@ -1,745 +1,780 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI do
	alias Pleroma.Activity
	alias Pleroma.Conversation.Participation
	alias Pleroma.Formatter
	alias Pleroma.ModerationLog
	alias Pleroma.Object
	alias Pleroma.ThreadMute
	alias Pleroma.User
	alias Pleroma.UserRelationship
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI.ActivityDraft

	import Pleroma.Web.Gettext
	import Pleroma.Web.CommonAPI.Utils

	require Pleroma.Constants
	require Logger

	def block(blocker, blocked) do
	with {:ok, block_data, _} <- Builder.block(blocker, blocked),
	{:ok, block, _} <- Pipeline.common_pipeline(block_data, local: true) do
	{:ok, block}
	end
	end

	def post_chat_message(%User{} = user, %User{} = recipient, content, opts \\ []) do
	with maybe_attachment <- opts[:media_id] && Object.get_by_id(opts[:media_id]),
	:ok <- validate_chat_attachment_attribution(maybe_attachment, user),
	:ok <- validate_chat_content_length(content, !!maybe_attachment),
	{_, {:ok, chat_message_data, _meta}} <-
	{:build_object,
	Builder.chat_message(
	user,
	recipient.ap_id,
	content \|> format_chat_content,
	attachment: maybe_attachment
	)},
	{_, {:ok, create_activity_data, _meta}} <-
	{:build_create_activity, Builder.create(user, chat_message_data, [recipient.ap_id])},
	{_, {:ok, %Activity{} = activity, _meta}} <-
	{:common_pipeline,
	Pipeline.common_pipeline(create_activity_data,
	local: true,
	idempotency_key: opts[:idempotency_key]
	)} do
	{:ok, activity}
	else
	{:common_pipeline, {:reject, _} = e} -> e
	e -> e
	end
	end

	defp format_chat_content(nil), do: nil

	defp format_chat_content(content) do
	{text, _, _} =
	content
	\|> Formatter.html_escape("text/plain")
	\|> Formatter.linkify()
	\|> (fn {text, mentions, tags} ->
	{String.replace(text, ~r/\r?\n/, "<br>"), mentions, tags}
	end).()

	text
	end

	defp validate_chat_attachment_attribution(nil, _), do: :ok

	defp validate_chat_attachment_attribution(attachment, user) do
	with :ok <- Object.authorize_access(attachment, user) do
	:ok
	else
	e ->
	e
	end
	end

	defp validate_chat_content_length(_, true), do: :ok
	defp validate_chat_content_length(nil, false), do: {:error, :no_content}

	defp validate_chat_content_length(content, _) do
	if String.length(content) <= Pleroma.Config.get([:instance, :chat_limit]) do
	:ok
	else
	{:error, :content_too_long}
	end
	end

	def unblock(blocker, blocked) do
	with {_, %Activity{} = block} <- {:fetch_block, Utils.fetch_latest_block(blocker, blocked)},
	{:ok, unblock_data, _} <- Builder.undo(blocker, block),
	{:ok, unblock, _} <- Pipeline.common_pipeline(unblock_data, local: true) do
	{:ok, unblock}
	else
	{:fetch_block, nil} ->
	if User.blocks?(blocker, blocked) do
	User.unblock(blocker, blocked)
	{:ok, :no_activity}
	else
	{:error, :not_blocking}
	end

	e ->
	e
	end
	end

	def follow(follower, followed) do
	timeout = Pleroma.Config.get([:activitypub, :follow_handshake_timeout])

	with {:ok, follow_data, _} <- Builder.follow(follower, followed),
	{:ok, activity, _} <- Pipeline.common_pipeline(follow_data, local: true),
	{:ok, follower, followed} <- User.wait_and_refresh(timeout, follower, followed) do
	if activity.data["state"] == "reject" do
	{:error, :rejected}
	else
	{:ok, follower, followed, activity}
	end
	end
	end

	def unfollow(follower, unfollowed) do
	with {:ok, follower, _follow_activity} <- User.unfollow(follower, unfollowed),
	{:ok, _activity} <- ActivityPub.unfollow(follower, unfollowed),
	{:ok, _subscription} <- User.unsubscribe(follower, unfollowed),
	{:ok, _endorsement} <- User.unendorse(follower, unfollowed) do
	{:ok, follower}
	end
	end

	def accept_follow_request(follower, followed) do
	with %Activity{} = follow_activity <- Utils.fetch_latest_follow(follower, followed),
	{:ok, accept_data, _} <- Builder.accept(followed, follow_activity),
	{:ok, _activity, _} <- Pipeline.common_pipeline(accept_data, local: true) do
	{:ok, follower}
	end
	end

	def reject_follow_request(follower, followed) do
	with %Activity{} = follow_activity <- Utils.fetch_latest_follow(follower, followed),
	{:ok, reject_data, _} <- Builder.reject(followed, follow_activity),
	{:ok, _activity, _} <- Pipeline.common_pipeline(reject_data, local: true) do
	{:ok, follower}
	end
	end

	def delete(activity_id, user) do
	with {_, %Activity{data: %{"object" => _, "type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(activity_id, filter: [])},
	{_, %Object{} = object, _} <-
	{:find_object, Object.normalize(activity, fetch: false), activity},
	true <- User.privileged?(user, :messages_delete) \|\| user.ap_id == object.data["actor"],
	{:ok, delete_data, _} <- Builder.delete(user, object.data["id"]),
	{:ok, delete, _} <- Pipeline.common_pipeline(delete_data, local: true) do
	if User.privileged?(user, :messages_delete) and user.ap_id != object.data["actor"] do
	action =
	if object.data["type"] == "ChatMessage" do
	"chat_message_delete"
	else
	"status_delete"
	end

	ModerationLog.insert_log(%{
	action: action,
	actor: user,
	subject_id: activity_id
	})
	end

	{:ok, delete}
	else
	{:find_activity, _} ->
	{:error, :not_found}

	{:find_object, nil, %Activity{data: %{"actor" => actor, "object" => object}}} ->
	# We have the create activity, but not the object, it was probably pruned.
	# Insert a tombstone and try again
	with {:ok, tombstone_data, _} <- Builder.tombstone(actor, object),
	{:ok, _tombstone} <- Object.create(tombstone_data) do
	delete(activity_id, user)
	else
	_ ->
	Logger.error(
	"Could not insert tombstone for missing object on deletion. Object is #{object}."
	)

	{:error, dgettext("errors", "Could not delete")}
	end

	_ ->
	{:error, dgettext("errors", "Could not delete")}
	end
	end

	def repeat(id, user, params \\ %{}) do
	with %Activity{data: %{"type" => "Create"}} = activity <- Activity.get_by_id(id),
	object = %Object{} <- Object.normalize(activity, fetch: false),
	{_, nil} <- {:existing_announce, Utils.get_existing_announce(user.ap_id, object)},
	public = public_announce?(object, params),
	{:ok, announce, _} <- Builder.announce(user, object, public: public),
	{:ok, activity, _} <- Pipeline.common_pipeline(announce, local: true) do
	{:ok, activity}
	else
	{:existing_announce, %Activity{} = announce} ->
	{:ok, announce}

	_ ->
	{:error, :not_found}
	end
	end

	def unrepeat(id, user) do
	with {_, %Activity{data: %{"type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(id)},
	%Object{} = note <- Object.normalize(activity, fetch: false),
	%Activity{} = announce <- Utils.get_existing_announce(user.ap_id, note),
	{:ok, undo, _} <- Builder.undo(user, announce),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	{:find_activity, _} -> {:error, :not_found}
	_ -> {:error, dgettext("errors", "Could not unrepeat")}
	end
	end

	@spec favorite(User.t(), binary()) :: {:ok, Activity.t() \| :already_liked} \| {:error, any()}
	def favorite(%User{} = user, id) do
	case favorite_helper(user, id) do
	{:ok, _} = res ->
	res

	{:error, :not_found} = res ->
	res

	{:error, e} ->
	Logger.error("Could not favorite #{id}. Error: #{inspect(e, pretty: true)}")
	{:error, dgettext("errors", "Could not favorite")}
	end
	end

	def favorite_helper(user, id) do
	with {_, %Activity{object: object}} <- {:find_object, Activity.get_by_id_with_object(id)},
	{_, {:ok, like_object, meta}} <- {:build_object, Builder.like(user, object)},
	{_, {:ok, %Activity{} = activity, _meta}} <-
	{:common_pipeline,
	Pipeline.common_pipeline(like_object, Keyword.put(meta, :local, true))} do
	{:ok, activity}
	else
	{:find_object, _} ->
	{:error, :not_found}

	{:common_pipeline, {:error, {:validate, {:error, changeset}}}} = e ->
	if {:object, {"already liked by this actor", []}} in changeset.errors do
	{:ok, :already_liked}
	else
	{:error, e}
	end

	e ->
	{:error, e}
	end
	end

	def unfavorite(id, user) do
	with {_, %Activity{data: %{"type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(id)},
	%Object{} = note <- Object.normalize(activity, fetch: false),
	%Activity{} = like <- Utils.get_existing_like(user.ap_id, note),
	{:ok, undo, _} <- Builder.undo(user, like),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	{:find_activity, _} -> {:error, :not_found}
	_ -> {:error, dgettext("errors", "Could not unfavorite")}
	end
	end

	def react_with_emoji(id, user, emoji) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	object <- Object.normalize(activity, fetch: false),
	{:ok, emoji_react, _} <- Builder.emoji_react(user, object, emoji),
	{:ok, activity, _} <- Pipeline.common_pipeline(emoji_react, local: true) do
	{:ok, activity}
	else
	_ ->
	{:error, dgettext("errors", "Could not add reaction emoji")}
	end
	end

	def unreact_with_emoji(id, user, emoji) do
	with %Activity{} = reaction_activity <- Utils.get_latest_reaction(id, user, emoji),
	{:ok, undo, _} <- Builder.undo(user, reaction_activity),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	_ ->
	{:error, dgettext("errors", "Could not remove reaction emoji")}
	end
	end

	def vote(user, %{data: %{"type" => "Question"}} = object, choices) do
	with :ok <- validate_not_author(object, user),
	:ok <- validate_existing_votes(user, object),
	{:ok, options, choices} <- normalize_and_validate_choices(choices, object) do
	answer_activities =
	Enum.map(choices, fn index ->
	{:ok, answer_object, _meta} =
	Builder.answer(user, object, Enum.at(options, index)["name"])

	{:ok, activity_data, _meta} = Builder.create(user, answer_object, [])

	{:ok, activity, _meta} =
	activity_data
	\|> Map.put("cc", answer_object["cc"])
	\|> Map.put("context", answer_object["context"])
	\|> Pipeline.common_pipeline(local: true)

	# TODO: Do preload of Pleroma.Object in Pipeline
	Activity.normalize(activity.data)
	end)

	object = Object.get_cached_by_ap_id(object.data["id"])
	{:ok, answer_activities, object}
	end
	end

	def join(%User{} = user, event_id, params \\ %{}) do
	participation_message = Map.get(params, :participation_message)

	case join_helper(user, event_id, participation_message) do
	{:ok, _} = res ->
	res

	{:error, :not_found} = res ->
	res

	{:error, e} ->
	Logger.error("Could not join #{event_id}. Error: #{inspect(e, pretty: true)}")
	{:error, dgettext("errors", "Could not join")}
	end
	end

	def join_helper(user, id, participation_message) do
	with {_, %Activity{object: object}} <- {:find_object, Activity.get_by_id_with_object(id)},
	{_, {:ok, join_object, meta}} <-
	{:build_object, Builder.join(user, object, participation_message)},
	{_, {:ok, %Activity{} = activity, _meta}} <-
	{:common_pipeline,
	Pipeline.common_pipeline(join_object, Keyword.put(meta, :local, true))} do
	{:ok, activity}
	else
	{:find_object, _} ->
	{:error, :not_found}

	{:common_pipeline, {:error, {:validate, {:error, changeset}}}} = e ->
	if {:object, {"already joined by this actor", []}} in changeset.errors do
	{:ok, :already_joined}
	else
	{:error, e}
	end

	e ->
	{:error, e}
	end
	end

	def leave(%User{ap_id: participant_ap_id} = user, event_id) do
	with %Activity{data: %{"object" => event_ap_id}} <- Activity.get_by_id(event_id),
	%Activity{} = join_activity <- Utils.get_existing_join(participant_ap_id, event_ap_id),
	{:ok, undo, _} <- Builder.undo(user, join_activity),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	nil ->
	{:error, dgettext("errors", "Not participating in the event")}

	_ ->
	{:error, dgettext("errors", "Could not remove join activity")}
	end
	end

	def accept_join_request(%User{} = user, %User{ap_id: participant_ap_id} = participant, event_id) do
	with %Activity{} = join_activity <- Utils.get_existing_join(participant_ap_id, event_id),
	{:ok, accept_data, _} <- Builder.accept(user, join_activity),
	{:ok, _activity, _} <- Pipeline.common_pipeline(accept_data, local: true),
	event <- Object.get_by_ap_id(event_id),
	{:ok, _} <- Utils.update_participation_request_count_in_object(event) do
	{:ok, participant}
	end
	end

	def reject_join_request(%User{} = user, %User{ap_id: participant_ap_id} = participant, event_id) do
	with %Activity{} = join_activity <- Utils.get_existing_join(participant_ap_id, event_id),
	{:ok, reject_data, _} <- Builder.reject(user, join_activity),
	{:ok, _activity, _} <- Pipeline.common_pipeline(reject_data, local: true),
	event <- Object.get_by_ap_id(event_id),
	{:ok, _} <- Utils.update_participation_request_count_in_object(event) do
	{:ok, participant}
	end
	end

	defp validate_not_author(%{data: %{"actor" => ap_id}}, %{ap_id: ap_id}),
	do: {:error, dgettext("errors", "Poll's author can't vote")}

	defp validate_not_author(_, _), do: :ok

	defp validate_existing_votes(%{ap_id: ap_id}, object) do
	if Utils.get_existing_votes(ap_id, object) == [] do
	:ok
	else
	{:error, dgettext("errors", "Already voted")}
	end
	end

	defp get_options_and_max_count(%{data: %{"anyOf" => any_of}})
	when is_list(any_of) and any_of != [],
	do: {any_of, Enum.count(any_of)}

	defp get_options_and_max_count(%{data: %{"oneOf" => one_of}})
	when is_list(one_of) and one_of != [],
	do: {one_of, 1}

	defp normalize_and_validate_choices(choices, object) do
	choices = Enum.map(choices, fn i -> if is_binary(i), do: String.to_integer(i), else: i end)
	{options, max_count} = get_options_and_max_count(object)
	count = Enum.count(options)

	with {_, true} <- {:valid_choice, Enum.all?(choices, &(&1 < count))},
	{_, true} <- {:count_check, Enum.count(choices) <= max_count} do
	{:ok, options, choices}
	else
	{:valid_choice, _} -> {:error, dgettext("errors", "Invalid indices")}
	{:count_check, _} -> {:error, dgettext("errors", "Too many choices")}
	end
	end

	def public_announce?(_, %{visibility: visibility})
	when visibility in ~w{public unlisted private direct},
	do: visibility in ~w(public unlisted)

	def public_announce?(object, _) do
	Visibility.is_public?(object)
	end

	def get_visibility(_, _, %Participation{}), do: {"direct", "direct"}

	def get_visibility(%{visibility: visibility}, in_reply_to, _)
	when visibility in ~w{public local unlisted private direct},
	do: {visibility, get_replied_to_visibility(in_reply_to)}

	def get_visibility(%{visibility: "list:" <> list_id}, in_reply_to, _) do
	visibility = {:list, String.to_integer(list_id)}
	{visibility, get_replied_to_visibility(in_reply_to)}
	end

	def get_visibility(_, in_reply_to, _) when not is_nil(in_reply_to) do
	visibility = get_replied_to_visibility(in_reply_to)
	{visibility, visibility}
	end

	def get_visibility(_, in_reply_to, _), do: {"public", get_replied_to_visibility(in_reply_to)}

	def get_replied_to_visibility(nil), do: nil

	def get_replied_to_visibility(activity) do
	with %Object{} = object <- Object.normalize(activity, fetch: false) do
	Visibility.get_visibility(object)
	end
	end

	def check_expiry_date({:ok, nil} = res), do: res

	def check_expiry_date({:ok, in_seconds}) do
	expiry = DateTime.add(DateTime.utc_now(), in_seconds)

	if Pleroma.Workers.PurgeExpiredActivity.expires_late_enough?(expiry) do
	{:ok, expiry}
	else
	{:error, "Expiry date is too soon"}
	end
	end

	def check_expiry_date(expiry_str) do
	Ecto.Type.cast(:integer, expiry_str)
	\|> check_expiry_date()
	end

	def listen(user, data) do
	with {:ok, draft} <- ActivityDraft.listen(user, data) do
	ActivityPub.listen(draft.changes)
	end
	end

	def post(user, %{status: _} = data) do
	with {:ok, draft} <- ActivityDraft.create(user, data) do
	ActivityPub.create(draft.changes, draft.preview?)
	end
	end

	def update(user, orig_activity, changes) do
	with orig_object <- Object.normalize(orig_activity),
	{:ok, new_object} <- make_update_data(user, orig_object, changes),
	{:ok, update_data, _} <- Builder.update(user, new_object),
	{:ok, update, _} <- Pipeline.common_pipeline(update_data, local: true) do
	{:ok, update}
	else
	_ -> {:error, nil}
	end
	end

	defp make_update_data(user, orig_object, changes) do
	kept_params = %{
	visibility: Visibility.get_visibility(orig_object),
	in_reply_to_id:
	with replied_id when is_binary(replied_id) <- orig_object.data["inReplyTo"],
	%Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(replied_id) do
	activity_id
	else
	_ -> nil
	end
	}

	params = Map.merge(changes, kept_params)

	with {:ok, draft} <- ActivityDraft.create(user, params) do
	change =
	Object.Updater.make_update_object_data(orig_object.data, draft.object, Utils.make_date())

	{:ok, change}
	else
	_ -> {:error, nil}
	end
	end

	@spec pin(String.t(), User.t()) :: {:ok, Activity.t()} \| {:error, term()}
	def pin(id, %User{} = user) do
	with %Activity{} = activity <- create_activity_by_id(id),
	true <- activity_belongs_to_actor(activity, user.ap_id),
	true <- object_type_is_allowed_for_pin(activity.object),
	true <- activity_is_public(activity),
	{:ok, pin_data, _} <- Builder.pin(user, activity.object),
	{:ok, _pin, _} <-
	Pipeline.common_pipeline(pin_data,
	local: true,
	activity_id: id
	) do
	{:ok, activity}
	else
	{:error, {:side_effects, error}} -> error
	error -> error
	end
	end

	defp create_activity_by_id(id) do
	with nil <- Activity.create_by_id_with_object(id) do
	{:error, :not_found}
	end
	end

	defp activity_belongs_to_actor(%{actor: actor}, actor), do: true
	defp activity_belongs_to_actor(_, _), do: {:error, :ownership_error}

	defp object_type_is_allowed_for_pin(%{data: %{"type" => type}}) do
	with false <- type in ["Note", "Article", "Question"] do
	{:error, :not_allowed}
	end
	end

	defp activity_is_public(activity) do
	with false <- Visibility.is_public?(activity) do
	{:error, :visibility_error}
	end
	end

	@spec unpin(String.t(), User.t()) :: {:ok, User.t()} \| {:error, term()}
	def unpin(id, user) do
	with %Activity{} = activity <- create_activity_by_id(id),
	{:ok, unpin_data, _} <- Builder.unpin(user, activity.object),
	{:ok, _unpin, _} <-
	Pipeline.common_pipeline(unpin_data,
	local: true,
	activity_id: activity.id,
	expires_at: activity.data["expires_at"],
	featured_address: user.featured_address
	) do
	{:ok, activity}
	end
	end

	def add_mute(user, activity, params \\ %{}) do
	expires_in = Map.get(params, :expires_in, 0)

	with {:ok, _} <- ThreadMute.add_mute(user.id, activity.data["context"]),
	_ <- Pleroma.Notification.mark_context_as_read(user, activity.data["context"]) do
	if expires_in > 0 do
	Pleroma.Workers.MuteExpireWorker.enqueue(
	"unmute_conversation",
	%{"user_id" => user.id, "activity_id" => activity.id},
	schedule_in: expires_in
	)
	end

	{:ok, activity}
	else
	{:error, _} -> {:error, dgettext("errors", "conversation is already muted")}
	end
	end

	def remove_mute(%User{} = user, %Activity{} = activity) do
	ThreadMute.remove_mute(user.id, activity.data["context"])
	{:ok, activity}
	end

	def remove_mute(user_id, activity_id) do
	with {:user, %User{} = user} <- {:user, User.get_by_id(user_id)},
	{:activity, %Activity{} = activity} <- {:activity, Activity.get_by_id(activity_id)} do
	remove_mute(user, activity)
	else
	{what, result} = error ->
	Logger.warn(
	"CommonAPI.remove_mute/2 failed. #{what}: #{result}, user_id: #{user_id}, activity_id: #{activity_id}"
	)

	{:error, error}
	end
	end

	def thread_muted?(%User{id: user_id}, %{data: %{"context" => context}})
	when is_binary(context) do
	ThreadMute.exists?(user_id, context)
	end

	def thread_muted?(_, _), do: false

	def report(user, data) do
	with {:ok, account} <- get_reported_account(data.account_id),
	{:ok, {content_html, _, _}} <- make_report_content_html(data[:comment]),
	{:ok, statuses} <- get_report_statuses(account, data) do
	ActivityPub.flag(%{
	context: Utils.generate_context_id(),
	actor: user,
	account: account,
	statuses: statuses,
	content: content_html,
	forward: Map.get(data, :forward, false)
	})
	end
	end

	defp get_reported_account(account_id) do
	case User.get_cached_by_id(account_id) do
	%User{} = account -> {:ok, account}
	_ -> {:error, dgettext("errors", "Account not found")}
	end
	end

	def update_report_state(activity_ids, state) when is_list(activity_ids) do
	case Utils.update_report_state(activity_ids, state) do
	:ok -> {:ok, activity_ids}
	_ -> {:error, dgettext("errors", "Could not update state")}
	end
	end

	def update_report_state(activity_id, state) do
	with %Activity{} = activity <- Activity.get_by_id(activity_id, filter: []) do
	Utils.update_report_state(activity, state)
	else
	nil -> {:error, :not_found}
	_ -> {:error, dgettext("errors", "Could not update state")}
	end
	end

	def update_activity_scope(activity_id, opts \\ %{}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
	{:ok, activity} <- toggle_sensitive(activity, opts) do
	set_visibility(activity, opts)
	else
	nil -> {:error, :not_found}
	{:error, reason} -> {:error, reason}
	end
	end

	defp toggle_sensitive(activity, %{sensitive: sensitive}) when sensitive in ~w(true false) do
	toggle_sensitive(activity, %{sensitive: String.to_existing_atom(sensitive)})
	end

	defp toggle_sensitive(%Activity{object: object} = activity, %{sensitive: sensitive})
	when is_boolean(sensitive) do
	new_data = Map.put(object.data, "sensitive", sensitive)

	{:ok, object} =
	object
	\|> Object.change(%{data: new_data})
	\|> Object.update_and_set_cache()

	{:ok, Map.put(activity, :object, object)}
	end

	defp toggle_sensitive(activity, _), do: {:ok, activity}

	defp set_visibility(activity, %{visibility: visibility}) do
	Utils.update_activity_visibility(activity, visibility)
	end

	defp set_visibility(activity, _), do: {:ok, activity}

	def hide_reblogs(%User{} = user, %User{} = target) do
	UserRelationship.create_reblog_mute(user, target)
	end

	def show_reblogs(%User{} = user, %User{} = target) do
	UserRelationship.delete_reblog_mute(user, target)
	end

	def get_user(ap_id, fake_record_fallback \\ true) do
	cond do
	user = User.get_cached_by_ap_id(ap_id) ->
	user

	user = User.get_by_guessed_nickname(ap_id) ->
	user

	fake_record_fallback ->
	# TODO: refactor (fake records is never a good idea)
	User.error_user(ap_id)

	true ->
	nil
	end
	end

	def event(user, data, location \\ nil) do
	with {:ok, draft} <- ActivityDraft.event(user, data, location) do
	ActivityPub.create(draft.changes)
	end
	end
	+
	+ def update_event(user, orig_activity, changes) do
	+ with orig_object <- Object.normalize(orig_activity),
	+ {:ok, new_object} <- make_update_event_data(user, orig_object, changes),
	+ {:ok, update_data, _} <- Builder.update(user, new_object),
	+ {:ok, update, _} <- Pipeline.common_pipeline(update_data, local: true) do
	+ {:ok, update}
	+ else
	+ _ -> {:error, nil}
	+ end
	+ end
	+
	+ defp make_update_event_data(user, orig_object, changes) do
	+ kept_params = %{
	+ visibility: Visibility.get_visibility(orig_object),
	+ in_reply_to_id:
	+ with replied_id when is_binary(replied_id) <- orig_object.data["inReplyTo"],
	+ %Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(replied_id) do
	+ activity_id
	+ else
	+ _ -> nil
	+ end
	+ }
	+
	+ params = Map.merge(changes, kept_params)
	+
	+ with {:ok, draft} <- ActivityDraft.event(user, params) do
	+ change =
	+ Object.Updater.make_update_object_data(orig_object.data, draft.object, Utils.make_date())
	+
	+ {:ok, change}
	+ else
	+ _ -> {:error, nil}
	+ end
	+ end
	end
	diff --git a/lib/pleroma/web/common_api/activity_draft.ex b/lib/pleroma/web/common_api/activity_draft.ex
	index a8737538d..7ad688206 100644
	--- a/lib/pleroma/web/common_api/activity_draft.ex
	+++ b/lib/pleroma/web/common_api/activity_draft.ex
	@@ -1,436 +1,442 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI.ActivityDraft do
	alias Pleroma.Activity
	alias Pleroma.Conversation.Participation
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.CommonAPI.Utils

	import Pleroma.Web.Gettext
	import Pleroma.Web.Utils.Guards, only: [not_empty_string: 1]

	defstruct valid?: true,
	errors: [],
	user: nil,
	params: %{},
	status: nil,
	summary: nil,
	full_payload: nil,
	attachments: [],
	in_reply_to: nil,
	in_reply_to_conversation: nil,
	quote_post: nil,
	visibility: nil,
	expires_at: nil,
	extra: nil,
	emoji: %{},
	content_html: nil,
	mentions: [],
	tags: [],
	to: [],
	cc: [],
	context: nil,
	sensitive: false,
	object: nil,
	preview?: false,
	changes: %{},
	location: nil,
	start_time: nil,
	end_time: nil,
	location_id: nil,
	location_provider: nil

	def new(user, params) do
	%__MODULE__{user: user}
	\|> put_params(params)
	end

	def create(user, params) do
	user
	\|> new(params)
	\|> status()
	\|> summary()
	\|> with_valid(&attachments/1)
	\|> full_payload()
	\|> expires_at()
	\|> poll()
	\|> with_valid(&in_reply_to/1)
	\|> with_valid(&in_reply_to_conversation/1)
	\|> with_valid(&quote_post/1)
	\|> with_valid(&visibility/1)
	\|> with_valid(&quoting_visibility/1)
	\|> content()
	\|> with_valid(&to_and_cc/1)
	\|> with_valid(&context/1)
	\|> sensitive()
	\|> with_valid(&object/1)
	\|> preview?()
	\|> with_valid(&changes/1)
	\|> validate()
	end

	def listen(user, params) do
	user
	\|> new(params)
	\|> visibility()
	\|> to_and_cc()
	\|> context()
	\|> listen_object()
	\|> with_valid(&changes/1)
	\|> validate()
	end

	defp listen_object(draft) do
	object =
	draft.params
	\|> Map.take([:album, :artist, :title, :length])
	\|> Map.new(fn {key, value} -> {to_string(key), value} end)
	\|> Map.put("type", "Audio")
	\|> Map.put("to", draft.to)
	\|> Map.put("cc", draft.cc)
	\|> Map.put("actor", draft.user.ap_id)

	%__MODULE__{draft \| object: object}
	end

	@spec event(any, map) :: {:error, any} \| {:ok, %{:valid? => true, optional(any) => any}}
	def event(user, params, location \\ nil) do
	user
	\|> new(params)
	\|> status()
	\|> visibility()
	\|> content()
	\|> to_and_cc()
	\|> context()
	\|> with_valid(&event_banner/1)
	\|> event_location(location)
	\|> with_valid(&event_date/1)
	\|> event_object()
	\|> with_valid(&changes/1)
	\|> validate()
	end

	defp event_object(draft) do
	emoji = Map.merge(Pleroma.Emoji.Formatter.get_emoji_map(draft.full_payload), draft.emoji)

	object = %{
	"type" => "Event",
	"to" => draft.to,
	"cc" => draft.cc,
	"name" => draft.params[:name],
	"content" => draft.content_html,
	"context" => draft.context,
	"attachment" => draft.attachments,
	"actor" => draft.user.ap_id,
	"tag" => Keyword.values(draft.tags) \|> Enum.uniq(),
	"joinMode" => draft.params[:join_mode] \|\| "free",
	"emoji" => emoji,
	"location" => draft.location,
	"location_id" => draft.location_id,
	"location_provider" => draft.location_provider,
	"startTime" => draft.start_time,
	- "endTime" => draft.end_time
	+ "endTime" => draft.end_time,
	+ "source" => %{
	+ "content" => draft.status,
	+ "mediaType" => Utils.get_content_type(draft.params[:content_type])
	+ },
	+ "generator" => draft.params[:generator],
	+ "content_type" => draft.params[:content_type],
	}

	%__MODULE__{draft \| object: object}
	end

	defp put_params(draft, params) do
	params = Map.put_new(params, :in_reply_to_status_id, params[:in_reply_to_id])
	%__MODULE__{draft \| params: params}
	end

	defp status(%{params: %{status: status}} = draft) do
	%__MODULE__{draft \| status: String.trim(status)}
	end

	defp summary(%{params: params} = draft) do
	%__MODULE__{draft \| summary: Map.get(params, :spoiler_text, "")}
	end

	defp full_payload(%{status: status, summary: summary} = draft) do
	full_payload = String.trim(status <> summary)

	case Utils.validate_character_limit(full_payload, draft.attachments) do
	:ok -> %__MODULE__{draft \| full_payload: full_payload}
	{:error, message} -> add_error(draft, message)
	end
	end

	defp attachments(%{params: params} = draft) do
	attachments = Utils.attachments_from_ids(params, draft.user)
	draft = %__MODULE__{draft \| attachments: attachments}

	case Utils.validate_attachments_count(attachments) do
	:ok -> draft
	{:error, message} -> add_error(draft, message)
	end
	end

	defp in_reply_to(%{params: %{in_reply_to_status_id: ""}} = draft), do: draft

	defp in_reply_to(%{params: %{in_reply_to_status_id: id}} = draft) when is_binary(id) do
	%__MODULE__{draft \| in_reply_to: Activity.get_by_id(id)}
	end

	defp in_reply_to(%{params: %{in_reply_to_status_id: %Activity{} = in_reply_to}} = draft) do
	%__MODULE__{draft \| in_reply_to: in_reply_to}
	end

	defp in_reply_to(draft), do: draft

	defp quote_post(%{params: %{quote_id: id}} = draft) when not_empty_string(id) do
	case Activity.get_by_id_with_object(id) do
	%Activity{} = activity ->
	%__MODULE__{draft \| quote_post: activity}

	_ ->
	draft
	end
	end

	defp quote_post(draft), do: draft

	defp in_reply_to_conversation(draft) do
	in_reply_to_conversation = Participation.get(draft.params[:in_reply_to_conversation_id])
	%__MODULE__{draft \| in_reply_to_conversation: in_reply_to_conversation}
	end

	defp visibility(%{params: params} = draft) do
	case CommonAPI.get_visibility(params, draft.in_reply_to, draft.in_reply_to_conversation) do
	{visibility, "direct"} when visibility != "direct" ->
	add_error(draft, dgettext("errors", "The message visibility must be direct"))

	{visibility, _} ->
	%__MODULE__{draft \| visibility: visibility}
	end
	end

	defp can_quote?(_draft, _object, visibility) when visibility in ~w(public unlisted local) do
	true
	end

	defp can_quote?(draft, object, "private") do
	draft.user.ap_id == object.data["actor"]
	end

	defp can_quote?(_, _, _) do
	false
	end

	defp quoting_visibility(%{quote_post: %Activity{}} = draft) do
	with %Object{} = object <- Object.normalize(draft.quote_post, fetch: false),
	true <- can_quote?(draft, object, Visibility.get_visibility(object)) do
	draft
	else
	_ -> add_error(draft, dgettext("errors", "Cannot quote private message"))
	end
	end

	defp quoting_visibility(draft), do: draft

	defp expires_at(draft) do
	case CommonAPI.check_expiry_date(draft.params[:expires_in]) do
	{:ok, expires_at} -> %__MODULE__{draft \| expires_at: expires_at}
	{:error, message} -> add_error(draft, message)
	end
	end

	defp poll(draft) do
	case Utils.make_poll_data(draft.params) do
	{:ok, {poll, poll_emoji}} ->
	%__MODULE__{draft \| extra: poll, emoji: Map.merge(draft.emoji, poll_emoji)}

	{:error, message} ->
	add_error(draft, message)
	end
	end

	defp content(%{mentions: mentions} = draft) do
	{content_html, mentioned_users, tags} = Utils.make_content_html(draft)

	mentioned_ap_ids =
	Enum.map(mentioned_users, fn {_, mentioned_user} -> mentioned_user.ap_id end)

	mentions =
	mentions
	\|> Kernel.++(mentioned_ap_ids)
	\|> Utils.get_addressed_users(draft.params[:to])

	%__MODULE__{draft \| content_html: content_html, mentions: mentions, tags: tags}
	end

	defp to_and_cc(draft) do
	{to, cc} = Utils.get_to_and_cc(draft)
	%__MODULE__{draft \| to: to, cc: cc}
	end

	defp context(draft) do
	context = Utils.make_context(draft.in_reply_to, draft.in_reply_to_conversation)
	%__MODULE__{draft \| context: context}
	end

	defp sensitive(draft) do
	sensitive = draft.params[:sensitive]
	%__MODULE__{draft \| sensitive: sensitive}
	end

	defp object(draft) do
	emoji = Map.merge(Pleroma.Emoji.Formatter.get_emoji_map(draft.full_payload), draft.emoji)

	# Sometimes people create posts with subject containing emoji,
	# since subjects are usually copied this will result in a broken
	# subject when someone replies from an instance that does not have
	# the emoji or has it under different shortcode. This is an attempt
	# to mitigate this by copying emoji from inReplyTo if they are present
	# in the subject.
	summary_emoji =
	with %Activity{} <- draft.in_reply_to,
	%Object{data: %{"tag" => [_ \| _] = tag}} <- Object.normalize(draft.in_reply_to) do
	Enum.reduce(tag, %{}, fn
	%{"type" => "Emoji", "name" => name, "icon" => %{"url" => url}}, acc ->
	if String.contains?(draft.summary, name) do
	Map.put(acc, name, url)
	else
	acc
	end

	_, acc ->
	acc
	end)
	else
	_ -> %{}
	end

	emoji = Map.merge(emoji, summary_emoji)

	{:ok, note_data, _meta} = Builder.note(draft)

	object =
	note_data
	\|> Map.put("emoji", emoji)
	\|> Map.put("source", %{
	"content" => draft.status,
	"mediaType" => Utils.get_content_type(draft.params[:content_type])
	})
	\|> Map.put("generator", draft.params[:generator])

	%__MODULE__{draft \| object: object}
	end

	defp preview?(draft) do
	preview? = Pleroma.Web.Utils.Params.truthy_param?(draft.params[:preview])
	%__MODULE__{draft \| preview?: preview?}
	end

	defp changes(draft) do
	direct? = draft.visibility == "direct"
	additional = %{"cc" => draft.cc, "directMessage" => direct?}

	additional =
	case draft.expires_at do
	%DateTime{} = expires_at -> Map.put(additional, "expires_at", expires_at)
	_ -> additional
	end

	changes =
	%{
	to: draft.to,
	actor: draft.user,
	context: draft.context,
	object: draft.object,
	additional: additional
	}
	\|> Utils.maybe_add_list_data(draft.user, draft.visibility)

	%__MODULE__{draft \| changes: changes}
	end

	defp event_date(draft) do
	case draft.params[:start_time] do
	%DateTime{} = start_time ->
	case draft.params[:end_time] do
	%DateTime{} = end_time ->
	if DateTime.compare(end_time, start_time) == :lt do
	add_error(draft, dgettext("errors", "Event can't end before its start"))
	else
	start_time = start_time \|> DateTime.to_iso8601()
	end_time = end_time \|> DateTime.to_iso8601()

	%__MODULE__{draft \| start_time: start_time, end_time: end_time}
	end

	_ ->
	start_time = start_time \|> DateTime.to_iso8601()

	%__MODULE__{draft \| start_time: start_time}
	end

	_ ->
	add_error(draft, dgettext("errors", "Start date is required"))
	end
	end

	defp event_location(draft, %Geospatial.Address{} = address) do
	location = %{
	"type" => "Place",
	"name" => address.description,
	"id" => address.url,
	"address" => %{
	"type" => "PostalAddress",
	"streetAddress" => address.street,
	"postalCode" => address.postal_code,
	"addressLocality" => address.locality,
	"addressRegion" => address.region,
	"addressCountry" => address.country
	}
	}

	location =
	if is_nil(address.geom) do
	location
	else
	{longitude, latitude} = address.geom.coordinates

	location
	\|> Map.put("longitude", longitude)
	\|> Map.put("latitude", latitude)
	end

	%__MODULE__{
	draft
	\| location: location,
	location_id: address.origin_id,
	location_provider: address.origin_provider
	}
	end

	defp event_location(draft, _), do: draft

	defp event_banner(draft) do
	with media_id when is_binary(media_id) <- draft.params[:banner_id],
	%Object{data: data} <- Repo.get(Object, media_id) do
	banner = Map.put(data, "name", "Banner")

	%__MODULE__{draft \| attachments: [banner]}
	else
	_ -> draft
	end
	end

	defp with_valid(%{valid?: true} = draft, func), do: func.(draft)
	defp with_valid(draft, _func), do: draft

	defp add_error(draft, message) do
	%__MODULE__{draft \| valid?: false, errors: [message \| draft.errors]}
	end

	defp validate(%{valid?: true} = draft), do: {:ok, draft}
	defp validate(%{errors: [message \| _]}), do: {:error, message}
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	index e594ea491..1d2a7add9 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	@@ -1,498 +1,490 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.StatusController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [try_render: 3, add_link_headers: 2]

	require Ecto.Query

	alias Pleroma.Activity
	alias Pleroma.Bookmark
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.ScheduledActivityView
	- alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	plug(:skip_public_check when action in [:index, :show])

	@unauthenticated_access %{fallback: :proceed_unauthenticated, scopes: []}

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:statuses"]}
	when action in [
	:index,
	:show,
	:card,
	:context,
	:show_history,
	:show_source
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:statuses"]}
	when action in [
	:create,
	:delete,
	:reblog,
	:unreblog,
	:update
	]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:favourites"]} when action == :favourites)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:favourites"]} when action in [:favourite, :unfavourite]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:mutes"]} when action in [:mute_conversation, :unmute_conversation]
	)

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:accounts"]}
	when action in [:favourited_by, :reblogged_by]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action in [:pin, :unpin])

	# Note: scope not present in Mastodon: read:bookmarks
	plug(OAuthScopesPlug, %{scopes: ["read:bookmarks"]} when action == :bookmarks)

	# Note: scope not present in Mastodon: write:bookmarks
	plug(
	OAuthScopesPlug,
	%{scopes: ["write:bookmarks"]} when action in [:bookmark, :unbookmark]
	)

	@rate_limited_status_actions ~w(reblog unreblog favourite unfavourite create delete)a

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: [:id]]
	when action in ~w(reblog unreblog)a
	)

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:fav_unfav", params: [:id]]
	when action in ~w(favourite unfavourite)a
	)

	plug(RateLimiter, [name: :statuses_actions] when action in @rate_limited_status_actions)

	+ plug(Pleroma.Web.Plugs.SetApplicationPlug, [] when action in [:create, :update])
	+
	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.StatusOperation

	@doc """
	GET `/api/v1/statuses?ids[]=1&ids[]=2`

	`ids` query param is required
	"""
	def index(%{assigns: %{user: user}} = conn, %{ids: ids} = params) do
	limit = 100

	activities =
	ids
	\|> Enum.take(limit)
	\|> Activity.all_by_ids_with_object()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))

	render(conn, "index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	end

	@doc """
	POST /api/v1/statuses
	"""
	# Creates a scheduled status when `scheduled_at` param is present and it's far enough
	def create(
	%{
	assigns: %{user: user},
	body_params: %{status: _, scheduled_at: scheduled_at} = params
	} = conn,
	_
	)
	when not is_nil(scheduled_at) do
	params =
	- Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	- \|> put_application(conn)
	+ params
	+ \|> Map.put(:in_reply_to_status_id, params[:in_reply_to_id])
	+ \|> Map.put(:application, conn.assigns.application)

	attrs = %{
	params: Map.new(params, fn {key, value} -> {to_string(key), value} end),
	scheduled_at: scheduled_at
	}

	with {:far_enough, true} <- {:far_enough, ScheduledActivity.far_enough?(scheduled_at)},
	{:ok, scheduled_activity} <- ScheduledActivity.create(user, attrs) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", scheduled_activity: scheduled_activity)
	else
	{:far_enough, _} ->
	params = Map.drop(params, [:scheduled_at])
	create(%Plug.Conn{conn \| body_params: params}, %{})

	error ->
	error
	end
	end

	# Creates a regular status
	def create(%{assigns: %{user: user}, body_params: %{status: _} = params} = conn, _) do
	params =
	- Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	- \|> put_application(conn)
	+ params
	+ \|> Map.put(:in_reply_to_status_id, params[:in_reply_to_id])
	+ \|> Map.put(:application, conn.assigns.application)

	with {:ok, activity} <- CommonAPI.post(user, params) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	as: :activity,
	with_direct_conversation_id: true
	)
	else
	{:error, {:reject, message}} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	def create(%{assigns: %{user: _user}, body_params: %{media_ids: _} = params} = conn, _) do
	params = Map.put(params, :status, "")
	create(%Plug.Conn{conn \| body_params: params}, %{})
	end

	@doc "GET /api/v1/statuses/:id/history"
	def show_history(%{assigns: assigns} = conn, %{id: id} = params) do
	with user = assigns[:user],
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "history.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "GET /api/v1/statuses/:id/source"
	def show_source(%{assigns: assigns} = conn, %{id: id} = _params) do
	with user = assigns[:user],
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "source.json",
	activity: activity,
	for: user
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "PUT /api/v1/statuses/:id"
	def update(%{assigns: %{user: user}, body_params: body_params} = conn, %{id: id} = params) do
	with {_, %Activity{}} = {_, activity} <- {:activity, Activity.get_by_id_with_object(id)},
	{_, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	{_, true} <- {:is_create, activity.data["type"] == "Create"},
	actor <- Activity.user_actor(activity),
	{_, true} <- {:own_status, actor.id == user.id},
	- changes <- body_params \|> put_application(conn),
	+ changes <- body_params \|> Map.put(:application, conn.assigns.application),
	{_, {:ok, _update_activity}} <- {:pipeline, CommonAPI.update(user, activity, changes)},
	{_, %Activity{}} = {_, activity} <- {:refetched, Activity.get_by_id_with_object(id)} do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	{:own_status, _} -> {:error, :forbidden}
	{:pipeline, _} -> {:error, :internal_server_error}
	_ -> {:error, :not_found}
	end
	end

	@doc "GET /api/v1/statuses/:id"
	def show(%{assigns: %{user: user}} = conn, %{id: id} = params) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "DELETE /api/v1/statuses/:id"
	def delete(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_source: true
	)
	else
	_e -> {:error, :not_found}
	end
	end

	@doc "POST /api/v1/statuses/:id/reblog"
	def reblog(%{assigns: %{user: user}, body_params: params} = conn, %{id: ap_id_or_id}) do
	with {:ok, announce} <- CommonAPI.repeat(ap_id_or_id, user, params),
	%Activity{} = announce <- Activity.normalize(announce.data) do
	try_render(conn, "show.json", %{activity: announce, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/unreblog"
	def unreblog(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	with {:ok, _unannounce} <- CommonAPI.unrepeat(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", %{activity: activity, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/favourite"
	def favourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	with {:ok, _fav} <- CommonAPI.favorite(user, activity_id),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unfavourite"
	def unfavourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	with {:ok, _unfav} <- CommonAPI.unfavorite(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/pin"
	def pin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
	with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	{:error, :pinned_statuses_limit_reached} ->
	{:error, "You have already pinned the maximum number of statuses"}

	{:error, :ownership_error} ->
	{:error, :unprocessable_entity, "Someone else's status cannot be pinned"}

	{:error, :visibility_error} ->
	{:error, :unprocessable_entity, "Non-public status cannot be pinned"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/unpin"
	def unpin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
	with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/bookmark"
	def bookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.create(user.id, activity.id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unbookmark"
	def unbookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.destroy(user.id, activity.id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/mute"
	def mute_conversation(%{assigns: %{user: user}, body_params: params} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	{:ok, activity} <- CommonAPI.add_mute(user, activity, params) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unmute"
	def unmute_conversation(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	{:ok, activity} <- CommonAPI.remove_mute(user, activity) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "GET /api/v1/statuses/:id/card"
	@deprecated "https://github.com/tootsuite/mastodon/pull/11213"
	def card(%{assigns: %{user: user}} = conn, %{id: status_id}) do
	with %Activity{} = activity <- Activity.get_by_id(status_id),
	true <- Visibility.visible_for_user?(activity, user) do
	data = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
	render(conn, "card.json", data)
	else
	_ -> render_error(conn, :not_found, "Record not found")
	end
	end

	@doc "GET /api/v1/statuses/:id/favourited_by"
	def favourited_by(%{assigns: %{user: user}} = conn, %{id: id}) do
	with true <- Pleroma.Config.get([:instance, :show_reactions]),
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"likes" => likes}} <- Object.normalize(activity, fetch: false) do
	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^likes)
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/reblogged_by"
	def reblogged_by(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"announcements" => announces, "id" => ap_id}} <-
	Object.normalize(activity, fetch: false) do
	announces =
	"Announce"
	\|> Activity.Queries.by_type()
	\|> Ecto.Query.where([a], a.actor in ^announces)
	# this is to use the index
	\|> Activity.Queries.by_object_id(ap_id)
	\|> Repo.all()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))
	\|> Enum.map(& &1.actor)
	\|> Enum.uniq()

	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^announces)
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/context"
	def context(%{assigns: %{user: user}} = conn, %{id: id}) do
	with %Activity{} = activity <- Activity.get_by_id(id) do
	activities =
	ActivityPub.fetch_activities_for_context(activity.data["context"], %{
	blocking_user: user,
	user: user,
	exclude_id: activity.id
	})

	render(conn, "context.json", activity: activity, activities: activities, user: user)
	end
	end

	@doc "GET /api/v1/favourites"
	def favourites(%{assigns: %{user: %User{} = user}} = conn, params) do
	activities = ActivityPub.fetch_favourites(user, params)

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	@doc "GET /api/v1/bookmarks"
	def bookmarks(%{assigns: %{user: user}} = conn, params) do
	user = User.get_cached_by_id(user.id)

	bookmarks =
	user.id
	\|> Bookmark.for_user_query()
	\|> Pleroma.Pagination.fetch_paginated(params)

	activities =
	bookmarks
	\|> Enum.map(fn b -> Map.put(b.activity, :bookmark, Map.delete(b, :activity)) end)

	conn
	\|> add_link_headers(bookmarks)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end
	-
	- defp put_application(params, %{assigns: %{token: %Token{user: %User{} = user} = token}} = _conn) do
	- if user.disclose_client do
	- %{client_name: client_name, website: website} = Repo.preload(token, :app).app
	- Map.put(params, :generator, %{type: "Application", name: client_name, url: website})
	- else
	- Map.put(params, :generator, nil)
	- end
	- end
	-
	- defp put_application(params, _), do: Map.put(params, :generator, nil)
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/event_controller.ex b/lib/pleroma/web/pleroma_api/controllers/event_controller.ex
	index 75bd9c62a..f9babb570 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/event_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/event_controller.ex
	@@ -1,247 +1,276 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.EventController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [add_link_headers: 2, json_response: 3, try_render: 3]

	require Ecto.Query

	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.Pagination
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.PleromaAPI.EventView
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	plug(
	:assign_participant
	when action in [:authorize_participation_request, :reject_participation_request]
	)

	plug(
	:assign_event_activity
	when action in [
	:participations,
	:participation_requests,
	:authorize_participation_request,
	:reject_participation_request,
	:join,
	:leave,
	:export_ics
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write"]}
	when action in [
	:create,
	+ :update,
	:authorize_participation_request,
	:reject_participation_request,
	:join,
	:leave
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read"]}
	when action in [:participations, :participation_requests]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:statuses"]}
	when action in [:export_ics]
	)

	+ plug(Pleroma.Web.Plugs.SetApplicationPlug, [] when action in [:create, :update])
	+
	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaEventOperation

	def create(%{assigns: %{user: user}, body_params: params} = conn, _) do
	params =
	params
	\|> Map.put(:status, Map.get(params, :status, ""))

	with location <- get_location(params),
	{:ok, activity} <- CommonAPI.event(user, params, location) do
	conn
	\|> put_view(StatusView)
	\|> try_render("show.json",
	activity: activity,
	for: user,
	as: :activity
	)
	else
	{:error, {:reject, message}} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	+ @doc "PUT /api/v1/statuses/:id"
	+ def update(%{assigns: %{user: user}, body_params: body_params} = conn, %{id: id} = params) do
	+ with {_, %Activity{}} = {_, activity} <- {:activity, Activity.get_by_id_with_object(id)},
	+ {_, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	+ {_, true} <- {:is_create, activity.data["type"] == "Create"},
	+ actor <- Activity.user_actor(activity),
	+ {_, true} <- {:own_status, actor.id == user.id},
	+ changes <- body_params \|> Map.put(:application, conn.assigns.application),
	+ {_, {:ok, _update_activity}} <-
	+ {:pipeline, CommonAPI.update_event(user, activity, changes)},
	+ {_, %Activity{}} = {_, activity} <- {:refetched, Activity.get_by_id_with_object(id)} do
	+ conn
	+ \|> put_view(StatusView)
	+ \|> try_render("show.json",
	+ activity: activity,
	+ for: user,
	+ with_direct_conversation_id: true,
	+ with_muted: Map.get(params, :with_muted, false)
	+ )
	+ else
	+ {:own_status, _} -> {:error, :forbidden}
	+ {:pipeline, e} -> {:error, :internal_server_error}
	+ _ -> {:error, :not_found}
	+ end
	+ end
	+
	defp get_location(%{location_id: location_id}) when is_binary(location_id) do
	result = Geospatial.Service.service().get_by_id(location_id)

	result \|> List.first()
	end

	defp get_location(_), do: nil

	def participations(%{assigns: %{user: user, event_activity: activity}} = conn, _) do
	with %Object{data: %{"participations" => participations}} <-
	Object.normalize(activity, fetch: false) do
	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^participations)
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	def participation_requests(
	%{assigns: %{user: %{ap_id: user_ap_id} = for_user, event_activity: activity}} = conn,
	params
	) do
	case activity do
	%Activity{actor: ^user_ap_id, data: %{"object" => ap_id}} ->
	params =
	Map.merge(params, %{
	type: "Join",
	object: ap_id,
	state: "pending",
	skip_preload: true
	})

	activities =
	[]
	\|> ActivityPub.fetch_activities_query(params)
	\|> Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(activities)
	\|> put_view(EventView)
	\|> render("participation_requests.json",
	activities: activities,
	for: for_user,
	as: :activity
	)

	%Activity{} ->
	render_error(conn, :forbidden, "Can't get participation requests")

	{:error, error} ->
	json_response(conn, :bad_request, %{error: error})
	end
	end

	def join(%{assigns: %{user: %{ap_id: actor}, event_activity: %{actor: actor}}} = conn, _) do
	render_error(conn, :bad_request, "Can't join your own event")
	end

	def join(
	%{assigns: %{user: user, event_activity: activity}, body_params: params} = conn,
	_
	) do
	with {:ok, _} <- CommonAPI.join(user, activity.id, params) do
	conn
	\|> put_view(StatusView)
	\|> try_render("show.json", activity: activity, for: user, as: :activity)
	end
	end

	def leave(
	%{assigns: %{user: %{ap_id: actor}, event_activity: %{actor: actor}}} = conn,
	_
	) do
	render_error(conn, :bad_request, "Can't leave your own event")
	end

	def leave(%{assigns: %{user: user, event_activity: activity}} = conn, _) do
	with {:ok, _} <- CommonAPI.leave(user, activity.id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("show.json", activity: activity, for: user, as: :activity)
	else
	{:error, error} ->
	json_response(conn, :bad_request, %{error: error})
	end
	end

	def authorize_participation_request(
	%{
	assigns: %{
	user: for_user,
	participant: participant,
	event_activity: %Activity{data: %{"object" => ap_id}} = activity
	}
	} = conn,
	_
	) do
	with {:ok, _} <- CommonAPI.accept_join_request(for_user, participant, ap_id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("show.json", activity: activity, for: for_user, as: :activity)
	end
	end

	def reject_participation_request(
	%{
	assigns: %{
	user: for_user,
	participant: participant,
	event_activity: %Activity{data: %{"object" => ap_id}} = activity
	}
	} = conn,
	_
	) do
	with {:ok, _} <- CommonAPI.reject_join_request(for_user, participant, ap_id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("show.json", activity: activity, for: for_user, as: :activity)
	end
	end

	def export_ics(%{assigns: %{event_activity: activity}} = conn, _) do
	render(conn, "show.ics", activity: activity)
	end

	defp assign_participant(%{params: %{participant_id: id}} = conn, _) do
	case User.get_cached_by_id(id) do
	%User{} = participant -> assign(conn, :participant, participant)
	nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) \|> halt()
	end
	end

	defp assign_event_activity(%{assigns: %{user: user}, params: %{id: event_id}} = conn, _) do
	with %Activity{} = activity <- Activity.get_by_id(event_id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)} do
	assign(conn, :event_activity, activity)
	else
	nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) \|> halt()
	end
	end
	end
	diff --git a/lib/pleroma/web/plugs/set_application_plug.ex b/lib/pleroma/web/plugs/set_application_plug.ex
	new file mode 100644
	index 000000000..0eec3ae2b
	--- /dev/null
	+++ b/lib/pleroma/web/plugs/set_application_plug.ex
	@@ -0,0 +1,28 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.Plugs.SetApplicationPlug do
	+ import Plug.Conn, only: [assign: 3]
	+
	+ alias Pleroma.Repo
	+ alias Pleroma.User
	+ alias Pleroma.Web.OAuth.Token
	+
	+ def init(_), do: nil
	+
	+ def call(conn, _) do
	+ assign(conn, :application, get_application(conn))
	+ end
	+
	+ defp get_application(%{assigns: %{token: %Token{user: %User{} = user} = token}} = _conn) do
	+ if user.disclose_client do
	+ %{client_name: client_name, website: website} = Repo.preload(token, :app).app
	+ %{type: "Application", name: client_name, url: website}
	+ else
	+ nil
	+ end
	+ end
	+
	+ defp get_application(_), do: nil
	+end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 468a9d84d..98e8ec057 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,1039 +1,1040 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router
	import Phoenix.LiveDashboard.Router

	pipeline :accepts_html do
	plug(:accepts, ["html"])
	end

	pipeline :accepts_html_xml do
	plug(:accepts, ["html", "xml", "rss", "atom"])
	end

	pipeline :accepts_html_json do
	plug(:accepts, ["html", "activity+json", "json"])
	end

	pipeline :accepts_html_xml_json do
	plug(:accepts, ["html", "xml", "rss", "atom", "activity+json", "json"])
	end

	pipeline :accepts_xml_rss_atom do
	plug(:accepts, ["xml", "rss", "atom"])
	end

	pipeline :browser do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	end

	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Web.Plugs.OAuthPlug)
	plug(Pleroma.Web.Plugs.UserEnabledPlug)
	plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
	end

	# Note: expects _user_ authentication (user-unbound app-bound tokens don't qualify)
	pipeline :expect_user_authentication do
	plug(Pleroma.Web.Plugs.ExpectAuthenticatedCheckPlug)
	end

	# Note: expects public instance or _user_ authentication (user-unbound tokens don't qualify)
	pipeline :expect_public_instance_or_user_authentication do
	plug(Pleroma.Web.Plugs.ExpectPublicOrAuthenticatedCheckPlug)
	end

	pipeline :authenticate do
	plug(Pleroma.Web.Plugs.OAuthPlug)
	plug(Pleroma.Web.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Web.Plugs.UserFetcherPlug)
	plug(Pleroma.Web.Plugs.AuthenticationPlug)
	end

	pipeline :after_auth do
	plug(Pleroma.Web.Plugs.UserEnabledPlug)
	plug(Pleroma.Web.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
	plug(Pleroma.Web.Plugs.UserTrackingPlug)
	end

	pipeline :base_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(:authenticate)
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	end

	pipeline :no_auth_or_privacy_expectations_api do
	plug(:base_api)
	plug(:after_auth)
	plug(Pleroma.Web.Plugs.IdempotencyPlug)
	end

	# Pipeline for app-related endpoints (no user auth checks — app-bound tokens must be supported)
	pipeline :app_api do
	plug(:no_auth_or_privacy_expectations_api)
	end

	pipeline :api do
	plug(:expect_public_instance_or_user_authentication)
	plug(:no_auth_or_privacy_expectations_api)
	end

	pipeline :authenticated_api do
	plug(:expect_user_authentication)
	plug(:no_auth_or_privacy_expectations_api)
	plug(Pleroma.Web.Plugs.EnsureAuthenticatedPlug)
	end

	pipeline :admin_api do
	plug(:expect_user_authentication)
	plug(:base_api)
	plug(Pleroma.Web.Plugs.AdminSecretAuthenticationPlug)
	plug(:after_auth)
	plug(Pleroma.Web.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Web.Plugs.UserIsStaffPlug)
	plug(Pleroma.Web.Plugs.IdempotencyPlug)
	end

	pipeline :require_admin do
	plug(Pleroma.Web.Plugs.UserIsAdminPlug)
	end

	pipeline :require_privileged_role_users_delete do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_delete)
	end

	pipeline :require_privileged_role_users_manage_credentials do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_manage_credentials)
	end

	pipeline :require_privileged_role_messages_read do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :messages_read)
	end

	pipeline :require_privileged_role_users_manage_tags do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_manage_tags)
	end

	pipeline :require_privileged_role_users_manage_activation_state do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_manage_activation_state)
	end

	pipeline :require_privileged_role_users_manage_invites do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_manage_invites)
	end

	pipeline :require_privileged_role_reports_manage_reports do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :reports_manage_reports)
	end

	pipeline :require_privileged_role_users_read do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_read)
	end

	pipeline :require_privileged_role_messages_delete do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :messages_delete)
	end

	pipeline :require_privileged_role_emoji_manage_emoji do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :emoji_manage_emoji)
	end

	pipeline :require_privileged_role_instances_delete do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :instances_delete)
	end

	pipeline :require_privileged_role_moderation_log_read do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :moderation_log_read)
	end

	pipeline :require_privileged_role_statistics_read do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :statistics_read)
	end

	pipeline :require_privileged_role_announcements_manage_announcements do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :announcements_manage_announcements)
	end

	pipeline :pleroma_html do
	plug(:browser)
	plug(:authenticate)
	plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
	end

	pipeline :well_known do
	plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	pipeline :http_signature do
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	pipeline :static_fe do
	plug(Pleroma.Web.Plugs.StaticFEPlug)
	end

	scope "/api/v1/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", PasswordController, :reset, as: :reset_password)
	post("/password_reset", PasswordController, :do_reset, as: :reset_password)
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	get("/healthcheck", UtilController, :healthcheck)
	post("/remote_interaction", UtilController, :remote_interaction)
	end

	scope "/api/v1/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	# AdminAPI: only admins can perform these actions
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through([:admin_api, :require_admin])

	get("/users/:nickname/permission_group", AdminAPIController, :right_get)
	get("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_get)

	post("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_add)

	delete(
	"/users/:nickname/permission_group/:permission_group",
	AdminAPIController,
	:right_delete
	)

	post("/users/permission_group/:permission_group", AdminAPIController, :right_add_multiple)

	delete(
	"/users/permission_group/:permission_group",
	AdminAPIController,
	:right_delete_multiple
	)

	post("/users/follow", UserController, :follow)
	post("/users/unfollow", UserController, :unfollow)
	post("/users", UserController, :create)

	patch("/users/suggest", UserController, :suggest)
	patch("/users/unsuggest", UserController, :unsuggest)

	get("/relay", RelayController, :index)
	post("/relay", RelayController, :follow)
	delete("/relay", RelayController, :unfollow)

	get("/instance_document/:name", InstanceDocumentController, :show)
	patch("/instance_document/:name", InstanceDocumentController, :update)
	delete("/instance_document/:name", InstanceDocumentController, :delete)

	get("/config", ConfigController, :show)
	post("/config", ConfigController, :update)
	get("/config/descriptions", ConfigController, :descriptions)
	get("/need_reboot", AdminAPIController, :need_reboot)
	get("/restart", AdminAPIController, :restart)

	get("/oauth_app", OAuthAppController, :index)
	post("/oauth_app", OAuthAppController, :create)
	patch("/oauth_app/:id", OAuthAppController, :update)
	delete("/oauth_app/:id", OAuthAppController, :delete)

	get("/media_proxy_caches", MediaProxyCacheController, :index)
	post("/media_proxy_caches/delete", MediaProxyCacheController, :delete)
	post("/media_proxy_caches/purge", MediaProxyCacheController, :purge)

	get("/frontends", FrontendController, :index)
	post("/frontends/install", FrontendController, :install)

	post("/backups", AdminAPIController, :create_backup)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_announcements_manage_announcements)

	get("/announcements", AnnouncementController, :index)
	post("/announcements", AnnouncementController, :create)
	get("/announcements/:id", AnnouncementController, :show)
	patch("/announcements/:id", AnnouncementController, :change)
	delete("/announcements/:id", AnnouncementController, :delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_delete)

	delete("/users", UserController, :delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_manage_credentials)

	get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)
	get("/users/:nickname/credentials", AdminAPIController, :show_user_credentials)
	patch("/users/:nickname/credentials", AdminAPIController, :update_user_credentials)
	put("/users/disable_mfa", AdminAPIController, :disable_mfa)
	patch("/users/force_password_reset", AdminAPIController, :force_password_reset)
	patch("/users/confirm_email", AdminAPIController, :confirm_email)
	patch("/users/resend_confirmation_email", AdminAPIController, :resend_confirmation_email)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_messages_read)

	get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)
	get("/users/:nickname/chats", AdminAPIController, :list_user_chats)

	get("/statuses", StatusController, :index)

	get("/chats/:id", ChatController, :show)
	get("/chats/:id/messages", ChatController, :messages)

	get("/instances/:instance/statuses", InstanceController, :list_statuses)

	get("/statuses/:id", StatusController, :show)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_manage_tags)

	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_manage_activation_state)

	patch("/users/:nickname/toggle_activation", UserController, :toggle_activation)
	patch("/users/activate", UserController, :activate)
	patch("/users/deactivate", UserController, :deactivate)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_manage_invites)

	patch("/users/approve", UserController, :approve)
	post("/users/invite_token", InviteController, :create)
	get("/users/invites", InviteController, :index)
	post("/users/revoke_invite", InviteController, :revoke)
	post("/users/email_invite", InviteController, :email)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_reports_manage_reports)

	get("/reports", ReportController, :index)
	get("/reports/:id", ReportController, :show)
	patch("/reports", ReportController, :update)
	post("/reports/:id/notes", ReportController, :notes_create)
	delete("/reports/:report_id/notes/:id", ReportController, :notes_delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_read)

	get("/users", UserController, :index)
	get("/users/:nickname", UserController, :show)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_messages_delete)

	put("/statuses/:id", StatusController, :update)
	delete("/statuses/:id", StatusController, :delete)

	delete("/chats/:id/messages/:message_id", ChatController, :delete_message)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_emoji_manage_emoji)

	post("/reload_emoji", AdminAPIController, :reload_emoji)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_instances_delete)

	delete("/instances/:instance", InstanceController, :delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_moderation_log_read)

	get("/moderation_log", AdminAPIController, :list_log)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_statistics_read)

	get("/stats", AdminAPIController, :stats)
	end

	scope "/api/v1/pleroma/emoji", Pleroma.Web.PleromaAPI do
	scope "/pack" do
	pipe_through(:require_privileged_role_emoji_manage_emoji)

	post("/", EmojiPackController, :create)
	patch("/", EmojiPackController, :update)
	delete("/", EmojiPackController, :delete)
	end

	scope "/pack" do
	pipe_through(:api)

	get("/", EmojiPackController, :show)
	end

	# Modifying packs
	scope "/packs" do
	pipe_through(:require_privileged_role_emoji_manage_emoji)

	get("/import", EmojiPackController, :import_from_filesystem)
	get("/remote", EmojiPackController, :remote)
	post("/download", EmojiPackController, :download)

	post("/files", EmojiFileController, :create)
	patch("/files", EmojiFileController, :update)
	delete("/files", EmojiFileController, :delete)
	end

	# Pack info / downloading
	scope "/packs" do
	pipe_through(:api)

	get("/", EmojiPackController, :index)
	get("/archive", EmojiPackController, :archive)
	end
	end

	scope "/", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_html)

	post("/main/ostatus", UtilController, :remote_subscribe)
	get("/main/ostatus", UtilController, :show_subscribe_form)
	get("/ostatus_subscribe", RemoteFollowController, :follow)
	post("/ostatus_subscribe", RemoteFollowController, :do_follow)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:authenticated_api)

	post("/change_email", UtilController, :change_email)
	post("/change_password", UtilController, :change_password)
	post("/delete_account", UtilController, :delete_account)
	put("/notification_settings", UtilController, :update_notificaton_settings)
	post("/disable_account", UtilController, :disable_account)
	post("/move_account", UtilController, :move_account)

	put("/aliases", UtilController, :add_alias)
	get("/aliases", UtilController, :list_aliases)
	delete("/aliases", UtilController, :delete_alias)
	end

	scope "/api/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:authenticated_api)

	post("/mutes_import", UserImportController, :mutes)
	post("/blocks_import", UserImportController, :blocks)
	post("/follow_import", UserImportController, :follow)

	get("/accounts/mfa", TwoFactorAuthenticationController, :settings)
	get("/accounts/mfa/backup_codes", TwoFactorAuthenticationController, :backup_codes)
	get("/accounts/mfa/setup/:method", TwoFactorAuthenticationController, :setup)
	post("/accounts/mfa/confirm/:method", TwoFactorAuthenticationController, :confirm)
	delete("/accounts/mfa/:method", TwoFactorAuthenticationController, :disable)
	end

	scope "/oauth", Pleroma.Web.OAuth do
	# Note: use /api/v1/accounts/verify_credentials for userinfo of signed-in user

	get("/registration_details", OAuthController, :registration_details)

	post("/mfa/verify", MFAController, :verify, as: :mfa_verify)
	get("/mfa", MFAController, :show)

	scope [] do
	pipe_through(:oauth)

	get("/authorize", OAuthController, :authorize)
	post("/authorize", OAuthController, :create_authorization)
	end

	scope [] do
	pipe_through(:fetch_session)

	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	post("/mfa/challenge", MFAController, :challenge)
	end

	scope [] do
	pipe_through(:browser)

	get("/prepare_request", OAuthController, :prepare_request)
	get("/:provider", OAuthController, :request)
	get("/:provider/callback", OAuthController, :callback)
	post("/register", OAuthController, :register)
	end
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)

	get("/apps", AppController, :index)
	get("/statuses/:id/reactions/:emoji", EmojiReactionController, :index)
	get("/statuses/:id/reactions", EmojiReactionController, :index)
	end

	scope "/api/v0/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:authenticated_api)
	get("/reports", ReportController, :index)
	get("/reports/:id", ReportController, :show)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	scope [] do
	pipe_through(:authenticated_api)

	post("/chats/by-account-id/:id", ChatController, :create)
	get("/chats", ChatController, :index)
	get("/chats/:id", ChatController, :show)
	get("/chats/:id/messages", ChatController, :messages)
	post("/chats/:id/messages", ChatController, :post_chat_message)
	delete("/chats/:id/messages/:message_id", ChatController, :delete_message)
	post("/chats/:id/read", ChatController, :mark_as_read)
	post("/chats/:id/messages/:message_id/read", ChatController, :mark_message_as_read)

	get("/conversations/:id/statuses", ConversationController, :statuses)
	get("/conversations/:id", ConversationController, :show)
	post("/conversations/read", ConversationController, :mark_as_read)
	patch("/conversations/:id", ConversationController, :update)

	put("/statuses/:id/reactions/:emoji", EmojiReactionController, :create)
	delete("/statuses/:id/reactions/:emoji", EmojiReactionController, :delete)
	post("/notifications/read", NotificationController, :mark_as_read)

	get("/mascot", MascotController, :show)
	put("/mascot", MascotController, :update)

	post("/scrobble", ScrobbleController, :create)

	get("/backups", BackupController, :index)
	post("/backups", BackupController, :create)

	post("/events", EventController, :create)
	+ put("/events/:id", EventController, :update)
	get("/events/:id/participations", EventController, :participations)
	get("/events/:id/participation_requests", EventController, :participation_requests)

	post(
	"/events/:id/participation_requests/:participant_id/authorize",
	EventController,
	:authorize_participation_request
	)

	post(
	"/events/:id/participation_requests/:participant_id/reject",
	EventController,
	:reject_participation_request
	)

	post("/events/:id/join", EventController, :join)
	post("/events/:id/leave", EventController, :leave)
	get("/events/:id/ics", EventController, :export_ics)

	get("/search/location", SearchController, :location)
	end

	scope [] do
	pipe_through(:api)
	get("/accounts/:id/favourites", AccountController, :favourites)
	get("/accounts/:id/endorsements", AccountController, :endorsements)
	end

	scope [] do
	pipe_through(:authenticated_api)

	post("/accounts/:id/subscribe", AccountController, :subscribe)
	post("/accounts/:id/unsubscribe", AccountController, :unsubscribe)

	get("/birthdays", AccountController, :birthdays)
	end

	scope [] do
	pipe_through(:authenticated_api)

	get("/settings/:app", SettingsController, :show)
	patch("/settings/:app", SettingsController, :update)
	end

	post("/accounts/confirmation_resend", AccountController, :confirmation_resend)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)
	get("/accounts/:id/scrobbles", ScrobbleController, :index)
	get("/federation_status", InstancesController, :show)
	end

	scope "/api/v2/pleroma", Pleroma.Web.PleromaAPI do
	scope [] do
	pipe_through(:authenticated_api)
	get("/chats", ChatController, :index2)
	end
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	get("/accounts/verify_credentials", AccountController, :verify_credentials)
	patch("/accounts/update_credentials", AccountController, :update_credentials)

	get("/accounts/relationships", AccountController, :relationships)
	get("/accounts/:id/lists", AccountController, :lists)
	get("/accounts/:id/identity_proofs", AccountController, :identity_proofs)
	get("/endorsements", AccountController, :endorsements)
	get("/blocks", AccountController, :blocks)
	get("/mutes", AccountController, :mutes)

	post("/follows", AccountController, :follow_by_uri)
	post("/accounts/:id/follow", AccountController, :follow)
	post("/accounts/:id/unfollow", AccountController, :unfollow)
	post("/accounts/:id/block", AccountController, :block)
	post("/accounts/:id/unblock", AccountController, :unblock)
	post("/accounts/:id/mute", AccountController, :mute)
	post("/accounts/:id/unmute", AccountController, :unmute)
	post("/accounts/:id/note", AccountController, :note)
	post("/accounts/:id/pin", AccountController, :endorse)
	post("/accounts/:id/unpin", AccountController, :unendorse)
	post("/accounts/:id/remove_from_followers", AccountController, :remove_from_followers)

	get("/conversations", ConversationController, :index)
	post("/conversations/:id/read", ConversationController, :mark_as_read)
	delete("/conversations/:id", ConversationController, :delete)

	get("/domain_blocks", DomainBlockController, :index)
	post("/domain_blocks", DomainBlockController, :create)
	delete("/domain_blocks", DomainBlockController, :delete)

	get("/filters", FilterController, :index)

	post("/filters", FilterController, :create)
	get("/filters/:id", FilterController, :show)
	put("/filters/:id", FilterController, :update)
	delete("/filters/:id", FilterController, :delete)

	get("/follow_requests", FollowRequestController, :index)
	post("/follow_requests/:id/authorize", FollowRequestController, :authorize)
	post("/follow_requests/:id/reject", FollowRequestController, :reject)

	get("/lists", ListController, :index)
	get("/lists/:id", ListController, :show)
	get("/lists/:id/accounts", ListController, :list_accounts)

	delete("/lists/:id", ListController, :delete)
	post("/lists", ListController, :create)
	put("/lists/:id", ListController, :update)
	post("/lists/:id/accounts", ListController, :add_to_list)
	delete("/lists/:id/accounts", ListController, :remove_from_list)

	get("/markers", MarkerController, :index)
	post("/markers", MarkerController, :upsert)

	post("/media", MediaController, :create)
	get("/media/:id", MediaController, :show)
	put("/media/:id", MediaController, :update)

	get("/notifications", NotificationController, :index)
	get("/notifications/:id", NotificationController, :show)

	post("/notifications/:id/dismiss", NotificationController, :dismiss)
	post("/notifications/clear", NotificationController, :clear)
	delete("/notifications/destroy_multiple", NotificationController, :destroy_multiple)
	# Deprecated: was removed in Mastodon v3, use `/notifications/:id/dismiss` instead
	post("/notifications/dismiss", NotificationController, :dismiss_via_body)

	post("/polls/:id/votes", PollController, :vote)

	post("/reports", ReportController, :create)

	get("/scheduled_statuses", ScheduledActivityController, :index)
	get("/scheduled_statuses/:id", ScheduledActivityController, :show)

	put("/scheduled_statuses/:id", ScheduledActivityController, :update)
	delete("/scheduled_statuses/:id", ScheduledActivityController, :delete)

	# Unlike `GET /api/v1/accounts/:id/favourites`, demands authentication
	get("/favourites", StatusController, :favourites)
	get("/bookmarks", StatusController, :bookmarks)

	post("/statuses", StatusController, :create)
	put("/statuses/:id", StatusController, :update)
	delete("/statuses/:id", StatusController, :delete)
	post("/statuses/:id/reblog", StatusController, :reblog)
	post("/statuses/:id/unreblog", StatusController, :unreblog)
	post("/statuses/:id/favourite", StatusController, :favourite)
	post("/statuses/:id/unfavourite", StatusController, :unfavourite)
	post("/statuses/:id/pin", StatusController, :pin)
	post("/statuses/:id/unpin", StatusController, :unpin)
	post("/statuses/:id/bookmark", StatusController, :bookmark)
	post("/statuses/:id/unbookmark", StatusController, :unbookmark)
	post("/statuses/:id/mute", StatusController, :mute_conversation)
	post("/statuses/:id/unmute", StatusController, :unmute_conversation)

	post("/push/subscription", SubscriptionController, :create)
	get("/push/subscription", SubscriptionController, :show)
	put("/push/subscription", SubscriptionController, :update)
	delete("/push/subscription", SubscriptionController, :delete)

	get("/suggestions", SuggestionController, :index)
	delete("/suggestions/:account_id", SuggestionController, :dismiss)

	get("/timelines/home", TimelineController, :home)
	get("/timelines/direct", TimelineController, :direct)
	get("/timelines/list/:list_id", TimelineController, :list)

	get("/announcements", AnnouncementController, :index)
	post("/announcements/:id/dismiss", AnnouncementController, :mark_read)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:app_api)

	post("/apps", AppController, :create)
	get("/apps/verify_credentials", AppController, :verify_credentials)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	get("/accounts/search", SearchController, :account_search)
	get("/search", SearchController, :search)

	get("/accounts/lookup", AccountController, :lookup)

	get("/accounts/:id/statuses", AccountController, :statuses)
	get("/accounts/:id/followers", AccountController, :followers)
	get("/accounts/:id/following", AccountController, :following)
	get("/accounts/:id", AccountController, :show)

	post("/accounts", AccountController, :create)

	get("/instance", InstanceController, :show)
	get("/instance/peers", InstanceController, :peers)

	get("/statuses", StatusController, :index)
	get("/statuses/:id", StatusController, :show)
	get("/statuses/:id/context", StatusController, :context)
	get("/statuses/:id/card", StatusController, :card)
	get("/statuses/:id/favourited_by", StatusController, :favourited_by)
	get("/statuses/:id/reblogged_by", StatusController, :reblogged_by)
	get("/statuses/:id/history", StatusController, :show_history)
	get("/statuses/:id/source", StatusController, :show_source)

	get("/custom_emojis", CustomEmojiController, :index)

	get("/trends", MastodonAPIController, :empty_array)

	get("/timelines/public", TimelineController, :public)
	get("/timelines/tag/:tag", TimelineController, :hashtag)

	get("/polls/:id", PollController, :show)

	get("/directory", DirectoryController, :index)
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	pipe_through(:api)
	get("/search", SearchController, :search2)

	post("/media", MediaController, :create2)

	get("/suggestions", SuggestionController, :index2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	get(
	"/account/confirm_email/:user_id/:token",
	TwitterAPI.Controller,
	:confirm_email,
	as: :confirm_email
	)
	end

	scope "/api" do
	pipe_through(:base_api)

	get("/openapi", OpenApiSpex.Plug.RenderSpec, [])
	end

	scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	pipe_through(:authenticated_api)

	get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)
	end

	scope "/", Pleroma.Web do
	# Note: html format is supported only if static FE is enabled
	# Note: http signature is only considered for json requests (no auth for non-json requests)
	pipe_through([:accepts_html_json, :http_signature, :static_fe])

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)

	# Mastodon compatibility routes
	get("/users/:nickname/statuses/:id", OStatus.OStatusController, :object)
	get("/users/:nickname/statuses/:id/activity", OStatus.OStatusController, :activity)
	end

	scope "/", Pleroma.Web do
	# Note: html format is supported only if static FE is enabled
	# Note: http signature is only considered for json requests (no auth for non-json requests)
	pipe_through([:accepts_html_xml_json, :http_signature, :static_fe])

	# Note: returns user _profile_ for json requests, redirects to user _feed_ for non-json ones
	get("/users/:nickname", Feed.UserController, :feed_redirect, as: :user_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through([:accepts_html_xml])

	get("/users/:nickname/feed", Feed.UserController, :feed, as: :user_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through(:accepts_html)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)
	end

	scope "/", Pleroma.Web do
	pipe_through(:accepts_xml_rss_atom)
	get("/tags/:tag", Feed.TagController, :feed, as: :tag_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through(:browser)
	get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)
	end

	pipeline :ap_service_actor do
	plug(:accepts, ["activity+json", "json"])
	end

	# Server to Server (S2S) AP interactions
	pipeline :activitypub do
	plug(:ap_service_actor)
	plug(:http_signature)
	end

	# Client to Server (C2S) AP interactions
	pipeline :activitypub_client do
	plug(:ap_service_actor)
	plug(:fetch_session)
	plug(:authenticate)
	plug(:after_auth)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	get("/api/ap/whoami", ActivityPubController, :whoami)
	get("/users/:nickname/inbox", ActivityPubController, :read_inbox)

	get("/users/:nickname/outbox", ActivityPubController, :outbox)
	post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	post("/api/ap/upload_media", ActivityPubController, :upload_media)

	# The following two are S2S as well, see `ActivityPub.fetch_follow_information_for_user/1`:
	get("/users/:nickname/followers", ActivityPubController, :followers)
	get("/users/:nickname/following", ActivityPubController, :following)
	get("/users/:nickname/collections/featured", ActivityPubController, :pinned)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through(:activitypub)
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :relay)

	scope [] do
	pipe_through(:http_signature)
	post("/inbox", ActivityPubController, :inbox)
	end

	get("/following", ActivityPubController, :relay_following)
	get("/followers", ActivityPubController, :relay_followers)
	end

	scope "/internal/fetch", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :internal_fetch)
	post("/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web do
	pipe_through(:api)

	get("/manifest.json", ManifestController, :show)
	end

	scope "/", Pleroma.Web do
	pipe_through(:pleroma_html)

	post("/auth/password", TwitterAPI.PasswordController, :request)
	end

	scope "/proxy/", Pleroma.Web do
	get("/preview/:sig/:url", MediaProxy.MediaProxyController, :preview)
	get("/preview/:sig/:url/:filename", MediaProxy.MediaProxyController, :preview)
	get("/:sig/:url", MediaProxy.MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxy.MediaProxyController, :remote)
	end

	if Pleroma.Config.get(:env) == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	scope "/" do
	pipe_through([:pleroma_html, :authenticate, :require_admin])
	live_dashboard("/phoenix/live_dashboard")
	end

	# Test-only routes needed to test action dispatching and plug chain execution
	if Pleroma.Config.get(:env) == :test do
	@test_actions [
	:do_oauth_check,
	:fallback_oauth_check,
	:skip_oauth_check,
	:fallback_oauth_skip_publicity_check,
	:skip_oauth_skip_publicity_check,
	:missing_oauth_check_definition
	]

	scope "/test/api", Pleroma.Tests do
	pipe_through(:api)

	for action <- @test_actions do
	get("/#{action}", AuthTestController, action)
	end
	end

	scope "/test/authenticated_api", Pleroma.Tests do
	pipe_through(:authenticated_api)

	for action <- @test_actions do
	get("/#{action}", AuthTestController, action)
	end
	end
	end

	scope "/", Pleroma.Web.MongooseIM do
	get("/user_exists", MongooseIMController, :user_exists)
	get("/check_password", MongooseIMController, :check_password)
	end

	scope "/", Pleroma.Web.Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	match(:, "/api/pleroma/path", LegacyPleromaApiRerouterPlug, [])
	get("/api/*path", RedirectController, :api_not_implemented)
	get("/*path", RedirectController, :redirector_with_preload)

	options("/*path", RedirectController, :empty)
	end

	# TODO: Change to Phoenix.Router.routes/1 for Phoenix 1.6.0+
	def get_api_routes do
	__MODULE__.__routes__()
	\|> Enum.reject(fn r -> r.plug == Pleroma.Web.Fallback.RedirectController end)
	\|> Enum.map(fn r ->
	r.path
	\|> String.split("/", trim: true)
	\|> List.first()
	end)
	\|> Enum.uniq()
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Tue, Jun 24, 3:46 AM (1 h, 9 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 234660
Default Alt Text: (114 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions