No OneTemporary
Actions

Size

210 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/twitter-api.skip b/changelog.d/twitter-api.skip
	new file mode 100644
	index 000000000..e69de29bb
	diff --git a/lib/pleroma/web/api_spec/operations/twitter_util_operation.ex b/lib/pleroma/web/api_spec/operations/pleroma_util_operation.ex
	similarity index 84%
	rename from lib/pleroma/web/api_spec/operations/twitter_util_operation.ex
	rename to lib/pleroma/web/api_spec/operations/pleroma_util_operation.ex
	index 724d873c0..4bb4f112c 100644
	--- a/lib/pleroma/web/api_spec/operations/twitter_util_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/pleroma_util_operation.ex
	@@ -1,442 +1,396 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.ApiSpec.TwitterUtilOperation do
	+defmodule Pleroma.Web.ApiSpec.PleromaUtilOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.Schemas.ApiError
	alias Pleroma.Web.ApiSpec.Schemas.BooleanLike

	import Pleroma.Web.ApiSpec.Helpers

	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	def emoji_operation do
	%Operation{
	tags: ["Custom emojis"],
	summary: "List all custom emojis",
	- operationId: "UtilController.emoji",
	+ operationId: "PleromaAPI.UtilController.emoji",
	parameters: [],
	responses: %{
	200 =>
	Operation.response("List", "application/json", %Schema{
	type: :object,
	additionalProperties: %Schema{
	type: :object,
	properties: %{
	image_url: %Schema{type: :string},
	tags: %Schema{type: :array, items: %Schema{type: :string}}
	},
	extensions: %{"x-additionalPropertiesName": "Emoji name"}
	},
	example: %{
	"firefox" => %{
	"image_url" => "/emoji/firefox.png",
	"tag" => ["Fun"]
	}
	}
	})
	}
	}
	end

	def frontend_configurations_operation do
	%Operation{
	tags: ["Others"],
	summary: "Dump frontend configurations",
	- operationId: "UtilController.frontend_configurations",
	+ operationId: "PleromaAPI.UtilController.frontend_configurations",
	parameters: [],
	responses: %{
	200 =>
	Operation.response("List", "application/json", %Schema{
	type: :object,
	additionalProperties: %Schema{
	type: :object,
	description:
	"Opaque object representing the instance-wide configuration for the frontend",
	extensions: %{"x-additionalPropertiesName": "Frontend name"}
	}
	})
	}
	}
	end

	def change_password_operation do
	%Operation{
	tags: ["Account credentials"],
	summary: "Change account password",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.change_password",
	+ operationId: "PleromaAPI.UtilController.change_password",
	requestBody: request_body("Parameters", change_password_request(), required: true),
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{status: %Schema{type: :string, example: "success"}}
	}),
	400 => Operation.response("Error", "application/json", ApiError),
	403 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	defp change_password_request do
	%Schema{
	title: "ChangePasswordRequest",
	description: "POST body for changing the account's password",
	type: :object,
	required: [:password, :new_password, :new_password_confirmation],
	properties: %{
	password: %Schema{type: :string, description: "Current password"},
	new_password: %Schema{type: :string, description: "New password"},
	new_password_confirmation: %Schema{
	type: :string,
	description: "New password, confirmation"
	}
	}
	}
	end

	def change_email_operation do
	%Operation{
	tags: ["Account credentials"],
	summary: "Change account email",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.change_email",
	+ operationId: "PleromaAPI.UtilController.change_email",
	requestBody: request_body("Parameters", change_email_request(), required: true),
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{status: %Schema{type: :string, example: "success"}}
	}),
	400 => Operation.response("Error", "application/json", ApiError),
	403 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	defp change_email_request do
	%Schema{
	title: "ChangeEmailRequest",
	description: "POST body for changing the account's email",
	type: :object,
	required: [:email, :password],
	properties: %{
	email: %Schema{
	type: :string,
	description: "New email. Set to blank to remove the user's email."
	},
	password: %Schema{type: :string, description: "Current password"}
	}
	}
	end

	def update_notification_settings_operation do
	%Operation{
	tags: ["Settings"],
	summary: "Update Notification Settings",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.update_notification_settings",
	+ operationId: "PleromaAPI.UtilController.update_notification_settings",
	parameters: [
	Operation.parameter(
	:block_from_strangers,
	:query,
	BooleanLike.schema(),
	"blocks notifications from accounts you do not follow"
	),
	Operation.parameter(
	:hide_notification_contents,
	:query,
	BooleanLike.schema(),
	"removes the contents of a message from the push notification"
	)
	],
	requestBody: nil,
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{status: %Schema{type: :string, example: "success"}}
	}),
	400 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def disable_account_operation do
	%Operation{
	tags: ["Account credentials"],
	summary: "Disable Account",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.disable_account",
	+ operationId: "PleromaAPI.UtilController.disable_account",
	parameters: [
	Operation.parameter(:password, :query, :string, "Password")
	],
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{status: %Schema{type: :string, example: "success"}}
	}),
	403 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def delete_account_operation do
	%Operation{
	tags: ["Account credentials"],
	summary: "Delete Account",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.delete_account",
	+ operationId: "PleromaAPI.UtilController.delete_account",
	parameters: [
	Operation.parameter(:password, :query, :string, "Password")
	],
	requestBody: request_body("Parameters", delete_account_request(), required: false),
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{status: %Schema{type: :string, example: "success"}}
	}),
	403 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def captcha_operation do
	%Operation{
	summary: "Get a captcha",
	- operationId: "UtilController.captcha",
	+ operationId: "PleromaAPI.UtilController.captcha",
	tags: ["Others"],
	parameters: [],
	responses: %{
	200 => Operation.response("Success", "application/json", %Schema{type: :object})
	}
	}
	end

	def move_account_operation do
	%Operation{
	tags: ["Account credentials"],
	summary: "Move account",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.move_account",
	+ operationId: "PleromaAPI.UtilController.move_account",
	requestBody: request_body("Parameters", move_account_request(), required: true),
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{status: %Schema{type: :string, example: "success"}}
	}),
	400 => Operation.response("Error", "application/json", ApiError),
	403 => Operation.response("Error", "application/json", ApiError),
	404 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	defp move_account_request do
	%Schema{
	title: "MoveAccountRequest",
	description: "POST body for moving the account",
	type: :object,
	required: [:password, :target_account],
	properties: %{
	password: %Schema{type: :string, description: "Current password"},
	target_account: %Schema{
	type: :string,
	description: "The nickname of the target account to move to"
	}
	}
	}
	end

	def list_aliases_operation do
	%Operation{
	tags: ["Account credentials"],
	summary: "List account aliases",
	security: [%{"oAuth" => ["read:accounts"]}],
	- operationId: "UtilController.list_aliases",
	+ operationId: "PleromaAPI.UtilController.list_aliases",
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{
	aliases: %Schema{
	type: :array,
	items: %Schema{type: :string},
	example: ["foo@example.org"]
	}
	}
	}),
	400 => Operation.response("Error", "application/json", ApiError),
	403 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	def add_alias_operation do
	%Operation{
	tags: ["Account credentials"],
	summary: "Add an alias to this account",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.add_alias",
	+ operationId: "PleromaAPI.UtilController.add_alias",
	requestBody: request_body("Parameters", add_alias_request(), required: true),
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{
	status: %Schema{
	type: :string,
	example: "success"
	}
	}
	}),
	400 => Operation.response("Error", "application/json", ApiError),
	403 => Operation.response("Error", "application/json", ApiError),
	404 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	defp add_alias_request do
	%Schema{
	title: "AddAliasRequest",
	description: "PUT body for adding aliases",
	type: :object,
	required: [:alias],
	properties: %{
	alias: %Schema{
	type: :string,
	description: "The nickname of the account to add to aliases"
	}
	}
	}
	end

	def delete_alias_operation do
	%Operation{
	tags: ["Account credentials"],
	summary: "Delete an alias from this account",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.delete_alias",
	+ operationId: "PleromaAPI.UtilController.delete_alias",
	requestBody: request_body("Parameters", delete_alias_request(), required: true),
	responses: %{
	200 =>
	Operation.response("Success", "application/json", %Schema{
	type: :object,
	properties: %{
	status: %Schema{
	type: :string,
	example: "success"
	}
	}
	}),
	400 => Operation.response("Error", "application/json", ApiError),
	403 => Operation.response("Error", "application/json", ApiError),
	404 => Operation.response("Error", "application/json", ApiError)
	}
	}
	end

	defp delete_alias_request do
	%Schema{
	title: "DeleteAliasRequest",
	description: "PUT body for deleting aliases",
	type: :object,
	required: [:alias],
	properties: %{
	alias: %Schema{
	type: :string,
	description: "The nickname of the account to delete from aliases"
	}
	}
	}
	end

	def healthcheck_operation do
	%Operation{
	tags: ["Others"],
	summary: "Quick status check on the instance",
	security: [%{"oAuth" => ["write:accounts"]}],
	- operationId: "UtilController.healthcheck",
	+ operationId: "PleromaAPI.UtilController.healthcheck",
	parameters: [],
	responses: %{
	200 => Operation.response("Healthy", "application/json", %Schema{type: :object}),
	503 =>
	Operation.response("Disabled or Unhealthy", "application/json", %Schema{type: :object})
	}
	}
	end

	- def remote_subscribe_operation do
	- %Operation{
	- tags: ["Remote interaction"],
	- summary: "Remote Subscribe",
	- operationId: "UtilController.remote_subscribe",
	- parameters: [],
	- responses: %{200 => Operation.response("Web Page", "test/html", %Schema{type: :string})}
	- }
	- end
	-
	- def remote_interaction_operation do
	- %Operation{
	- tags: ["Remote interaction"],
	- summary: "Remote interaction",
	- operationId: "UtilController.remote_interaction",
	- requestBody: request_body("Parameters", remote_interaction_request(), required: true),
	- responses: %{
	- 200 =>
	- Operation.response("Remote interaction URL", "application/json", %Schema{type: :object})
	- }
	- }
	- end
	-
	- defp remote_interaction_request do
	- %Schema{
	- title: "RemoteInteractionRequest",
	- description: "POST body for remote interaction",
	- type: :object,
	- required: [:ap_id, :profile],
	- properties: %{
	- ap_id: %Schema{type: :string, description: "Profile or status ActivityPub ID"},
	- profile: %Schema{type: :string, description: "Remote profile webfinger"}
	- }
	- }
	- end
	-
	- def show_subscribe_form_operation do
	- %Operation{
	- tags: ["Remote interaction"],
	- summary: "Show remote subscribe form",
	- operationId: "UtilController.show_subscribe_form",
	- parameters: [],
	- responses: %{200 => Operation.response("Web Page", "test/html", %Schema{type: :string})}
	- }
	- end
	-
	defp delete_account_request do
	%Schema{
	title: "AccountDeleteRequest",
	description: "POST body for deleting one's own account",
	type: :object,
	properties: %{
	password: %Schema{
	type: :string,
	description: "The user's own password for confirmation.",
	format: :password
	}
	},
	example: %{
	"password" => "prettyp0ony1313"
	}
	}
	end
	end
	diff --git a/lib/pleroma/web/api_spec/operations/remote_interaction_operation.ex b/lib/pleroma/web/api_spec/operations/remote_interaction_operation.ex
	new file mode 100644
	index 000000000..a490bd491
	--- /dev/null
	+++ b/lib/pleroma/web/api_spec/operations/remote_interaction_operation.ex
	@@ -0,0 +1,61 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.ApiSpec.RemoteInteractionOperation do
	+ alias OpenApiSpex.Operation
	+ alias OpenApiSpex.Schema
	+
	+ import Pleroma.Web.ApiSpec.Helpers
	+
	+ def open_api_operation(action) do
	+ operation = String.to_existing_atom("#{action}_operation")
	+ apply(__MODULE__, operation, [])
	+ end
	+
	+ def remote_subscribe_operation do
	+ %Operation{
	+ tags: ["Remote interaction"],
	+ summary: "Remote Subscribe",
	+ operationId: "RemoteInteractionController.remote_subscribe",
	+ parameters: [],
	+ responses: %{200 => Operation.response("Web Page", "text/html", %Schema{type: :string})}
	+ }
	+ end
	+
	+ def remote_interaction_operation do
	+ %Operation{
	+ tags: ["Remote interaction"],
	+ summary: "Remote interaction",
	+ operationId: "RemoteInteractionController.remote_interaction",
	+ requestBody: request_body("Parameters", remote_interaction_request(), required: true),
	+ responses: %{
	+ 200 =>
	+ Operation.response("Remote interaction URL", "application/json", %Schema{type: :object})
	+ }
	+ }
	+ end
	+
	+ defp remote_interaction_request do
	+ %Schema{
	+ title: "RemoteInteractionRequest",
	+ description: "POST body for remote interaction",
	+ type: :object,
	+ required: [:ap_id, :profile],
	+ properties: %{
	+ ap_id: %Schema{type: :string, description: "Profile or status ActivityPub ID"},
	+ profile: %Schema{type: :string, description: "Remote profile webfinger"}
	+ }
	+ }
	+ end
	+
	+ def show_subscribe_form_operation do
	+ %Operation{
	+ tags: ["Remote interaction"],
	+ summary: "Show remote subscribe form",
	+ operationId: "RemoteInteractionController.show_subscribe_form",
	+ parameters: [],
	+ responses: %{200 => Operation.response("Web Page", "text/html", %Schema{type: :string})}
	+ }
	+ end
	+end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	index 6dc731ed4..6d5851029 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	@@ -1,698 +1,698 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [
	add_link_headers: 2,
	assign_account_by_id: 2,
	embed_relationships?: 1,
	json_response: 3
	]

	alias Pleroma.Maps
	alias Pleroma.User
	alias Pleroma.UserNote
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.ListView
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.OAuth.OAuthController
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter
	- alias Pleroma.Web.TwitterAPI.TwitterAPI
	+ alias Pleroma.Web.Registration
	alias Pleroma.Web.Utils.Params

	plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(:skip_auth when action in [:create])

	plug(:skip_public_check when action in [:show, :statuses])

	plug(
	OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["read:accounts"]}
	when action in [:show, :followers, :following, :lookup, :endorsements]
	)

	plug(
	OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["read:statuses"]}
	when action == :statuses
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:accounts"]}
	when action in [:verify_credentials, :endorsements, :own_endorsements]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:accounts"]}
	when action in [:update_credentials, :note, :endorse, :unendorse]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :lists)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "read:blocks"]} when action == :blocks
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:blocks"]} when action in [:block, :unblock]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:follows"]} when action in [:relationships, :familiar_followers]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]}
	when action in [:follow_by_uri, :follow, :unfollow, :remove_from_followers]
	)

	plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)

	plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])

	@relationship_actions [:follow, :unfollow, :remove_from_followers]
	@needs_account ~W(
	followers following lists follow unfollow mute unmute block unblock
	note endorse unendorse endorsements remove_from_followers
	)a

	plug(
	RateLimiter,
	[name: :relation_id_action, params: ["id", "uri"]] when action in @relationship_actions
	)

	plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
	plug(RateLimiter, [name: :app_account_creation] when action == :create)
	plug(:assign_account_by_id when action in @needs_account)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AccountOperation

	@doc "POST /api/v1/accounts"
	def create(
	%{assigns: %{app: app}, private: %{open_api_spex: %{body_params: params}}} = conn,
	_params
	) do
	with :ok <- validate_email_param(params),
	- :ok <- TwitterAPI.validate_captcha(app, params),
	- {:ok, user} <- TwitterAPI.register_user(params),
	+ :ok <- Registration.validate_captcha(app, params),
	+ {:ok, user} <- Registration.register_user(params),
	{_, {:ok, token}} <-
	{:login, OAuthController.login(user, app, app.scopes)} do
	OAuthController.after_token_exchange(conn, %{user: user, token: token})
	else
	{:login, {:account_status, :confirmation_pending}} ->
	json_response(conn, :ok, %{
	message: "You have been registered. Please check your email for further instructions.",
	identifier: "missing_confirmed_email"
	})

	{:login, {:account_status, :approval_pending}} ->
	json_response(conn, :ok, %{
	message:
	"You have been registered. You'll be able to log in once your account is approved.",
	identifier: "awaiting_approval"
	})

	{:login, _} ->
	json_response(conn, :ok, %{
	message:
	"You have been registered. Some post-registration steps may be pending. " <>
	"Please log in manually.",
	identifier: "manual_login_required"
	})

	{:error, error} ->
	json_response(conn, :bad_request, %{error: error})
	end
	end

	def create(%{assigns: %{app: _app}} = conn, _) do
	render_error(conn, :bad_request, "Missing parameters")
	end

	def create(conn, _) do
	render_error(conn, :forbidden, "Invalid credentials")
	end

	defp validate_email_param(%{email: email}) when not is_nil(email), do: :ok

	defp validate_email_param(_) do
	case Pleroma.Config.get([:instance, :account_activation_required]) do
	true -> {:error, dgettext("errors", "Missing parameter: %{name}", name: "email")}
	_ -> :ok
	end
	end

	@doc "GET /api/v1/accounts/verify_credentials"
	def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	chat_token = Phoenix.Token.sign(conn, "user socket", user.id)

	render(conn, "show.json",
	user: user,
	for: user,
	with_pleroma_settings: true,
	with_chat_token: chat_token
	)
	end

	@doc "PATCH /api/v1/accounts/update_credentials"
	def update_credentials(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn,
	_params
	) do
	params =
	params
	\|> Enum.filter(fn {_, value} -> not is_nil(value) end)
	\|> Enum.into(%{})

	# We use an empty string as a special value to reset
	# avatars, banners, backgrounds
	user_image_value = fn
	"" -> {:ok, nil}
	value -> {:ok, value}
	end

	user_params =
	[
	:no_rich_text,
	:hide_followers_count,
	:hide_follows_count,
	:hide_followers,
	:hide_follows,
	:hide_favorites,
	:show_role,
	:skip_thread_containment,
	:allow_following_move,
	:also_known_as,
	:accepts_chat_messages,
	:show_birthday
	]
	\|> Enum.reduce(%{}, fn key, acc ->
	Maps.put_if_present(acc, key, params[key], &{:ok, Params.truthy_param?(&1)})
	end)
	\|> Maps.put_if_present(:name, params[:display_name])
	\|> Maps.put_if_present(:bio, params[:note])
	\|> Maps.put_if_present(:raw_bio, params[:note])
	\|> Maps.put_if_present(:avatar, params[:avatar], user_image_value)
	\|> Maps.put_if_present(:banner, params[:header], user_image_value)
	\|> Maps.put_if_present(:background, params[:pleroma_background_image], user_image_value)
	\|> Maps.put_if_present(
	:raw_fields,
	params[:fields_attributes],
	&{:ok, normalize_fields_attributes(&1)}
	)
	\|> Maps.put_if_present(:pleroma_settings_store, params[:pleroma_settings_store])
	\|> Maps.put_if_present(:default_scope, params[:default_scope])
	\|> Maps.put_if_present(:default_scope, params["source"]["privacy"])
	\|> Maps.put_if_present(:actor_type, params[:bot], fn bot ->
	if bot, do: {:ok, "Service"}, else: {:ok, "Person"}
	end)
	\|> Maps.put_if_present(:actor_type, params[:actor_type])
	\|> Maps.put_if_present(:also_known_as, params[:also_known_as])
	# Note: param name is indeed :locked (not an error)
	\|> Maps.put_if_present(:is_locked, params[:locked])
	# Note: param name is indeed :discoverable (not an error)
	\|> Maps.put_if_present(:is_discoverable, params[:discoverable])
	\|> Maps.put_if_present(:birthday, params[:birthday])
	\|> Maps.put_if_present(:language, Pleroma.Web.Gettext.normalize_locale(params[:language]))
	\|> Maps.put_if_present(:avatar_description, params[:avatar_description])
	\|> Maps.put_if_present(:header_description, params[:header_description])

	# What happens here:
	#
	# We want to update the user through the pipeline, but the ActivityPub
	# update information is not quite enough for this, because this also
	# contains local settings that don't federate and don't even appear
	# in the Update activity.
	#
	# So we first build the normal local changeset, then apply it to the
	# user data, but don't persist it. With this, we generate the object
	# data for our update activity. We feed this and the changeset as meta
	# information into the pipeline, where they will be properly updated and
	# federated.
	with changeset <- User.update_changeset(user, user_params),
	{:ok, unpersisted_user} <- Ecto.Changeset.apply_action(changeset, :update),
	updated_object <-
	Pleroma.Web.ActivityPub.UserView.render("user.json", user: unpersisted_user)
	\|> Map.delete("@context"),
	{:ok, update_data, []} <- Builder.update(user, updated_object),
	{:ok, _update, _} <-
	Pipeline.common_pipeline(update_data,
	local: true,
	user_update_changeset: changeset
	) do
	render(conn, "show.json",
	user: unpersisted_user,
	for: unpersisted_user,
	with_pleroma_settings: true
	)
	else
	{:error, %Ecto.Changeset{errors: [avatar: {"file is too large", _}]}} ->
	render_error(conn, :request_entity_too_large, "File is too large")

	{:error, %Ecto.Changeset{errors: [banner: {"file is too large", _}]}} ->
	render_error(conn, :request_entity_too_large, "File is too large")

	{:error, %Ecto.Changeset{errors: [background: {"file is too large", _}]}} ->
	render_error(conn, :request_entity_too_large, "File is too large")

	{:error, %Ecto.Changeset{errors: [{:bio, {_, _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "Bio is too long")

	{:error, %Ecto.Changeset{errors: [{:name, {_, _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "Name is too long")

	{:error, %Ecto.Changeset{errors: [{:avatar_description, {_, _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "Avatar description is too long")

	{:error, %Ecto.Changeset{errors: [{:header_description, {_, _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "Banner description is too long")

	{:error, %Ecto.Changeset{errors: [{:fields, {"invalid", _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "One or more field entries are too long")

	{:error, %Ecto.Changeset{errors: [{:fields, {_, _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "Too many field entries")

	_e ->
	render_error(conn, :forbidden, "Invalid request")
	end
	end

	defp normalize_fields_attributes(fields) do
	if(Enum.all?(fields, &is_tuple/1), do: Enum.map(fields, fn {_, v} -> v end), else: fields)
	\|> Enum.map(fn
	%{} = field -> %{"name" => field.name, "value" => field.value}
	field -> field
	end)
	end

	@doc "GET /api/v1/accounts/relationships"
	def relationships(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	targets = User.get_all_by_ids(List.wrap(id))

	render(conn, "relationships.json", user: user, targets: targets)
	end

	# Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])

	@doc "GET /api/v1/accounts/:id"
	def show(
	%{
	assigns: %{user: for_user},
	private: %{open_api_spex: %{params: %{id: nickname_or_id} = params}}
	} = conn,
	_params
	) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
	:visible <- User.visible_for(user, for_user) do
	render(conn, "show.json",
	user: user,
	for: for_user,
	embed_relationships: embed_relationships?(params)
	)
	else
	error -> user_visibility_error(conn, error)
	end
	end

	@doc "GET /api/v1/accounts/:id/statuses"
	def statuses(
	%{assigns: %{user: reading_user}, private: %{open_api_spex: %{params: params}}} = conn,
	_params
	) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(params.id, for: reading_user),
	:visible <- User.visible_for(user, reading_user) do
	params =
	params
	\|> Map.delete(:tagged)
	\|> Map.put(:tag, params[:tagged])

	activities = ActivityPub.fetch_user_activities(user, reading_user, params)

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json",
	activities: activities,
	for: reading_user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	error -> user_visibility_error(conn, error)
	end
	end

	defp user_visibility_error(conn, error) do
	case error do
	:restrict_unauthenticated ->
	render_error(conn, :unauthorized, "This API requires an authenticated user")

	_ ->
	render_error(conn, :not_found, "Can't find user")
	end
	end

	@doc "GET /api/v1/accounts/:id/followers"
	def followers(
	%{assigns: %{user: for_user, account: user}, private: %{open_api_spex: %{params: params}}} =
	conn,
	_params
	) do
	params =
	params
	\|> Enum.map(fn {key, value} -> {to_string(key), value} end)
	\|> Enum.into(%{})

	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_followers(user, params)
	user.hide_followers -> []
	true -> MastodonAPI.get_followers(user, params)
	end

	conn
	\|> add_link_headers(followers)
	# https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
	\|> render("index.json",
	for: for_user,
	users: followers,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/accounts/:id/following"
	def following(
	%{assigns: %{user: for_user, account: user}, private: %{open_api_spex: %{params: params}}} =
	conn,
	_params
	) do
	params =
	params
	\|> Enum.map(fn {key, value} -> {to_string(key), value} end)
	\|> Enum.into(%{})

	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_friends(user, params)
	user.hide_follows -> []
	true -> MastodonAPI.get_friends(user, params)
	end

	conn
	\|> add_link_headers(followers)
	# https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
	\|> render("index.json",
	for: for_user,
	users: followers,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/accounts/:id/lists"
	def lists(%{assigns: %{user: user, account: account}} = conn, _params) do
	lists = Pleroma.List.get_lists_account_belongs(user, account)

	conn
	\|> put_view(ListView)
	\|> render("index.json", lists: lists)
	end

	@doc "POST /api/v1/accounts/:id/follow"
	def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not follow yourself"}
	end

	def follow(
	%{
	assigns: %{user: follower, account: followed},
	private: %{open_api_spex: %{body_params: params}}
	} = conn,
	_
	) do
	with {:ok, follower} <- MastodonAPI.follow(follower, followed, params) do
	render(conn, "relationship.json", user: follower, target: followed)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unfollow"
	def unfollow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not unfollow yourself"}
	end

	def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.unfollow(followed, follower) do
	render(conn, "relationship.json", user: follower, target: followed)
	end
	end

	@doc "POST /api/v1/accounts/:id/mute"
	def mute(
	%{
	assigns: %{user: muter, account: muted},
	private: %{open_api_spex: %{body_params: params}}
	} = conn,
	_params
	) do
	params =
	params
	\|> Map.put_new(:duration, Map.get(params, :expires_in, 0))

	with {:ok, _user_relationships} <- User.mute(muter, muted, params) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unmute"
	def unmute(%{assigns: %{user: muter, account: muted}} = conn, _params) do
	with {:ok, _user_relationships} <- User.unmute(muter, muted) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/block"
	def block(
	%{
	assigns: %{user: blocker, account: blocked},
	private: %{open_api_spex: %{body_params: params}}
	} = conn,
	_params
	) do
	with {:ok, _activity} <- CommonAPI.block(blocked, blocker, params) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unblock"
	def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _activity} <- CommonAPI.unblock(blocked, blocker) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/note"
	def note(
	%{
	assigns: %{user: noter, account: target},
	private: %{open_api_spex: %{body_params: %{comment: comment}}}
	} = conn,
	_params
	) do
	with {:ok, _user_note} <- UserNote.create(noter, target, comment) do
	render(conn, "relationship.json", user: noter, target: target)
	end
	end

	@doc "POST /api/v1/accounts/:id/pin"
	def endorse(%{assigns: %{user: endorser, account: endorsed}} = conn, _params) do
	with {:ok, _user_relationships} <- User.endorse(endorser, endorsed) do
	render(conn, "relationship.json", user: endorser, target: endorsed)
	else
	{:error, message} -> json_response(conn, :bad_request, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unpin"
	def unendorse(%{assigns: %{user: endorser, account: endorsed}} = conn, _params) do
	with {:ok, _user_relationships} <- User.unendorse(endorser, endorsed) do
	render(conn, "relationship.json", user: endorser, target: endorsed)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "GET /api/v1/accounts/:id/endorsements"
	def endorsements(%{assigns: %{user: for_user, account: user}} = conn, params) do
	users =
	user
	\|> User.endorsed_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Repo.all()

	conn
	\|> render("index.json",
	for: for_user,
	users: users,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "POST /api/v1/accounts/:id/remove_from_followers"
	def remove_from_followers(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not unfollow yourself"}
	end

	def remove_from_followers(%{assigns: %{user: followed, account: follower}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.reject_follow_request(follower, followed) do
	render(conn, "relationship.json", user: followed, target: follower)
	else
	nil ->
	render_error(conn, :not_found, "Record not found")
	end
	end

	@doc "POST /api/v1/follows"
	def follow_by_uri(%{private: %{open_api_spex: %{body_params: %{uri: uri}}}} = conn, _) do
	case User.get_cached_by_nickname(uri) do
	%User{} = user ->
	conn
	\|> assign(:account, user)
	\|> follow(%{})

	nil ->
	{:error, :not_found}
	end
	end

	@doc "GET /api/v1/mutes"
	def mutes(%{assigns: %{user: user}} = conn, params) do
	users =
	user
	\|> User.muted_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(users)
	\|> render("index.json",
	users: users,
	for: user,
	as: :user,
	embed_relationships: embed_relationships?(params),
	mutes: true
	)
	end

	@doc "GET /api/v1/blocks"
	def blocks(%{assigns: %{user: user}} = conn, params) do
	users =
	user
	\|> User.blocked_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(users)
	\|> render("index.json",
	users: users,
	for: user,
	as: :user,
	embed_relationships: embed_relationships?(params),
	blocks: true
	)
	end

	@doc "GET /api/v1/accounts/lookup"
	def lookup(
	%{assigns: %{user: for_user}, private: %{open_api_spex: %{params: %{acct: nickname}}}} =
	conn,
	_params
	) do
	with %User{} = user <- User.get_by_nickname(nickname),
	:visible <- User.visible_for(user, for_user) do
	render(conn, "show.json",
	user: user,
	skip_visibility_check: true
	)
	else
	error -> user_visibility_error(conn, error)
	end
	end

	@doc "GET /api/v1/endorsements"
	def own_endorsements(%{assigns: %{user: user}} = conn, params) do
	users =
	user
	\|> User.endorsed_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Repo.all()

	conn
	\|> render("index.json",
	users: users,
	for: user,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/accounts/familiar_followers"
	def familiar_followers(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_id
	) do
	users =
	User.get_all_by_ids(List.wrap(id))
	\|> Enum.map(&%{id: &1.id, accounts: get_familiar_followers(&1, user)})

	conn
	\|> render("familiar_followers.json",
	for: user,
	users: users,
	as: :user
	)
	end

	defp get_familiar_followers(%{id: id} = user, %{id: id}) do
	User.get_familiar_followers(user, user)
	end

	defp get_familiar_followers(%{hide_followers: true}, _current_user) do
	[]
	end

	defp get_familiar_followers(user, current_user) do
	User.get_familiar_followers(user, current_user)
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex b/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex
	index fbb54a171..653b5fc29 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex
	@@ -1,24 +1,24 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AuthController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	- alias Pleroma.Web.TwitterAPI.TwitterAPI
	+ alias Pleroma.Web.Registration

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	plug(Pleroma.Web.Plugs.RateLimiter, [name: :password_reset] when action == :password_reset)

	@doc "POST /auth/password"
	def password_reset(conn, params) do
	nickname_or_email = params["email"] \|\| params["nickname"]

	- TwitterAPI.password_reset(nickname_or_email)
	+ Registration.password_reset(nickname_or_email)

	json_response(conn, :no_content, "")
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/controllers/password_controller.ex b/lib/pleroma/web/o_auth/password_controller.ex
	similarity index 90%
	copy from lib/pleroma/web/twitter_api/controllers/password_controller.ex
	copy to lib/pleroma/web/o_auth/password_controller.ex
	index e5482de9d..b209e7564 100644
	--- a/lib/pleroma/web/twitter_api/controllers/password_controller.ex
	+++ b/lib/pleroma/web/o_auth/password_controller.ex
	@@ -1,52 +1,52 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.PasswordController do
	+defmodule Pleroma.Web.OAuth.PasswordController do
	@moduledoc """
	The module contains functions for password reset.
	"""

	use Pleroma.Web, :controller

	require Logger

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	alias Pleroma.PasswordResetToken
	alias Pleroma.Repo
	alias Pleroma.User
	- alias Pleroma.Web.TwitterAPI.TwitterAPI
	+ alias Pleroma.Web.Registration

	plug(Pleroma.Web.Plugs.RateLimiter, [name: :request] when action == :request)

	@doc "POST /auth/password"
	def request(conn, params) do
	nickname_or_email = params["email"] \|\| params["nickname"]

	- TwitterAPI.password_reset(nickname_or_email)
	+ Registration.password_reset(nickname_or_email)

	json_response(conn, :no_content, "")
	end

	def reset(conn, %{"token" => token}) do
	with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}),
	false <- PasswordResetToken.expired?(token),
	%User{} = user <- User.get_cached_by_id(token.user_id) do
	render(conn, "reset.html", %{
	token: token,
	user: user
	})
	else
	_e -> render(conn, "invalid_token.html")
	end
	end

	def do_reset(conn, %{"data" => data}) do
	with {:ok, _} <- PasswordResetToken.reset_password(data["token"], data) do
	render(conn, "reset_success.html")
	else
	_e -> render(conn, "reset_failed.html")
	end
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/views/password_view.ex b/lib/pleroma/web/o_auth/password_view.ex
	similarity index 83%
	rename from lib/pleroma/web/twitter_api/views/password_view.ex
	rename to lib/pleroma/web/o_auth/password_view.ex
	index 55790941f..0b85c76e8 100644
	--- a/lib/pleroma/web/twitter_api/views/password_view.ex
	+++ b/lib/pleroma/web/o_auth/password_view.ex
	@@ -1,9 +1,9 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.PasswordView do
	+defmodule Pleroma.Web.OAuth.PasswordView do
	use Pleroma.Web, :view
	import Phoenix.HTML.Form
	alias Pleroma.Web.Gettext
	end
	diff --git a/lib/pleroma/web/twitter_api/controller.ex b/lib/pleroma/web/o_auth/token_controller.ex
	similarity index 94%
	copy from lib/pleroma/web/twitter_api/controller.ex
	copy to lib/pleroma/web/o_auth/token_controller.ex
	index 6db3d6067..37d08eea3 100644
	--- a/lib/pleroma/web/twitter_api/controller.ex
	+++ b/lib/pleroma/web/o_auth/token_controller.ex
	@@ -1,59 +1,59 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.Controller do
	+defmodule Pleroma.Web.OAuth.TokenController do
	use Pleroma.Web, :controller

	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	- alias Pleroma.Web.TwitterAPI.TokenView
	+ alias Pleroma.Web.OAuth.TokenView

	require Logger

	plug(:skip_auth when action == :confirm_email)
	plug(:skip_plug, OAuthScopesPlug when action in [:oauth_tokens, :revoke_token])

	action_fallback(:errors)

	def confirm_email(conn, %{"user_id" => uid, "token" => token}) do
	with %User{} = user <- User.get_cached_by_id(uid),
	true <- user.local and !user.is_confirmed and user.confirmation_token == token,
	{:ok, _} <- User.confirm(user) do
	redirect(conn, to: "/")
	end
	end

	def oauth_tokens(%{assigns: %{user: user}} = conn, _params) do
	with oauth_tokens <- Token.get_user_tokens(user) do
	conn
	\|> put_view(TokenView)
	\|> render("index.json", %{tokens: oauth_tokens})
	end
	end

	def revoke_token(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	Token.delete_user_token(user, id)

	json_reply(conn, 201, "")
	end

	defp errors(conn, {:param_cast, _}) do
	conn
	\|> put_status(400)
	\|> json("Invalid parameters")
	end

	defp errors(conn, _) do
	conn
	\|> put_status(500)
	\|> json("Something went wrong")
	end

	defp json_reply(conn, status, json) do
	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(status, json)
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/views/token_view.ex b/lib/pleroma/web/o_auth/token_view.ex
	similarity index 81%
	rename from lib/pleroma/web/twitter_api/views/token_view.ex
	rename to lib/pleroma/web/o_auth/token_view.ex
	index 36776ce3b..f9894399a 100644
	--- a/lib/pleroma/web/twitter_api/views/token_view.ex
	+++ b/lib/pleroma/web/o_auth/token_view.ex
	@@ -1,22 +1,22 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.TokenView do
	+defmodule Pleroma.Web.OAuth.TokenView do
	use Pleroma.Web, :view

	def render("index.json", %{tokens: tokens}) do
	tokens
	- \|> render_many(Pleroma.Web.TwitterAPI.TokenView, "show.json")
	+ \|> render_many(Pleroma.Web.OAuth.TokenView, "show.json")
	\|> Enum.filter(&Enum.any?/1)
	end

	def render("show.json", %{token: token_entry}) do
	%{
	id: token_entry.id,
	valid_until: token_entry.valid_until,
	app_name: token_entry.app.client_name,
	scopes: token_entry.scopes
	}
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/controllers/password_controller.ex b/lib/pleroma/web/pleroma_api/controllers/password_controller.ex
	similarity index 90%
	rename from lib/pleroma/web/twitter_api/controllers/password_controller.ex
	rename to lib/pleroma/web/pleroma_api/controllers/password_controller.ex
	index e5482de9d..444477245 100644
	--- a/lib/pleroma/web/twitter_api/controllers/password_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/password_controller.ex
	@@ -1,52 +1,52 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.PasswordController do
	+defmodule Pleroma.Web.PleromaAPI.PasswordController do
	@moduledoc """
	The module contains functions for password reset.
	"""

	use Pleroma.Web, :controller

	require Logger

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	alias Pleroma.PasswordResetToken
	alias Pleroma.Repo
	alias Pleroma.User
	- alias Pleroma.Web.TwitterAPI.TwitterAPI
	+ alias Pleroma.Web.Registration

	plug(Pleroma.Web.Plugs.RateLimiter, [name: :request] when action == :request)

	@doc "POST /auth/password"
	def request(conn, params) do
	nickname_or_email = params["email"] \|\| params["nickname"]

	- TwitterAPI.password_reset(nickname_or_email)
	+ Registration.password_reset(nickname_or_email)

	json_response(conn, :no_content, "")
	end

	def reset(conn, %{"token" => token}) do
	with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}),
	false <- PasswordResetToken.expired?(token),
	%User{} = user <- User.get_cached_by_id(token.user_id) do
	render(conn, "reset.html", %{
	token: token,
	user: user
	})
	else
	_e -> render(conn, "invalid_token.html")
	end
	end

	def do_reset(conn, %{"data" => data}) do
	with {:ok, _} <- PasswordResetToken.reset_password(data["token"], data) do
	render(conn, "reset_success.html")
	else
	_e -> render(conn, "reset_failed.html")
	end
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/controller.ex b/lib/pleroma/web/pleroma_api/controllers/token_controller.ex
	similarity index 94%
	rename from lib/pleroma/web/twitter_api/controller.ex
	rename to lib/pleroma/web/pleroma_api/controllers/token_controller.ex
	index 6db3d6067..581dd569a 100644
	--- a/lib/pleroma/web/twitter_api/controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/token_controller.ex
	@@ -1,59 +1,59 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.Controller do
	+defmodule Pleroma.Web.PleromaAPI.TokenController do
	use Pleroma.Web, :controller

	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	- alias Pleroma.Web.TwitterAPI.TokenView
	+ alias Pleroma.Web.PleromaAPI.TokenView

	require Logger

	plug(:skip_auth when action == :confirm_email)
	plug(:skip_plug, OAuthScopesPlug when action in [:oauth_tokens, :revoke_token])

	action_fallback(:errors)

	def confirm_email(conn, %{"user_id" => uid, "token" => token}) do
	with %User{} = user <- User.get_cached_by_id(uid),
	true <- user.local and !user.is_confirmed and user.confirmation_token == token,
	{:ok, _} <- User.confirm(user) do
	redirect(conn, to: "/")
	end
	end

	def oauth_tokens(%{assigns: %{user: user}} = conn, _params) do
	with oauth_tokens <- Token.get_user_tokens(user) do
	conn
	\|> put_view(TokenView)
	\|> render("index.json", %{tokens: oauth_tokens})
	end
	end

	def revoke_token(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	Token.delete_user_token(user, id)

	json_reply(conn, 201, "")
	end

	defp errors(conn, {:param_cast, _}) do
	conn
	\|> put_status(400)
	\|> json("Invalid parameters")
	end

	defp errors(conn, _) do
	conn
	\|> put_status(500)
	\|> json("Something went wrong")
	end

	defp json_reply(conn, status, json) do
	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(status, json)
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/controllers/util_controller.ex b/lib/pleroma/web/pleroma_api/controllers/util_controller.ex
	similarity index 65%
	rename from lib/pleroma/web/twitter_api/controllers/util_controller.ex
	rename to lib/pleroma/web/pleroma_api/controllers/util_controller.ex
	index 1c072f98a..9528d5564 100644
	--- a/lib/pleroma/web/twitter_api/controllers/util_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/util_controller.ex
	@@ -1,407 +1,278 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.UtilController do
	+defmodule Pleroma.Web.PleromaAPI.UtilController do
	use Pleroma.Web, :controller

	require Logger

	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Emoji
	alias Pleroma.Healthcheck
	alias Pleroma.User
	alias Pleroma.Utils.URIEncoding
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.Auth.WrapperAuthenticator, as: Authenticator
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	- alias Pleroma.Web.WebFinger

	- plug(
	- Pleroma.Web.ApiSpec.CastAndValidate,
	- [replace_params: false]
	- when action != :remote_subscribe and action != :show_subscribe_form
	- )
	-
	- plug(
	- Pleroma.Web.Plugs.FederatingPlug
	- when action == :remote_subscribe
	- when action == :show_subscribe_form
	- )
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, [replace_params: false])

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:accounts"]}
	when action in [
	:change_email,
	:change_password,
	:delete_account,
	:update_notification_settings,
	:disable_account,
	:move_account,
	:add_alias,
	:delete_alias
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:accounts"]}
	when action in [
	:list_aliases
	]
	)

	- defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.TwitterUtilOperation
	-
	- def show_subscribe_form(conn, %{"nickname" => nick}) do
	- with %User{} = user <- User.get_cached_by_nickname(nick),
	- avatar = User.avatar_url(user) do
	- conn
	- \|> render("subscribe.html", %{nickname: nick, avatar: avatar, error: false})
	- else
	- _e ->
	- render(conn, "subscribe.html", %{
	- nickname: nick,
	- avatar: nil,
	- error:
	- Pleroma.Web.Gettext.dpgettext(
	- "static_pages",
	- "remote follow error message - user not found",
	- "Could not find user"
	- )
	- })
	- end
	- end
	-
	- def show_subscribe_form(conn, %{"status_id" => id}) do
	- with %Activity{} = activity <- Activity.get_by_id(id),
	- {:ok, ap_id} <- get_ap_id(activity),
	- %User{} = user <- User.get_cached_by_ap_id(activity.actor),
	- avatar = User.avatar_url(user) do
	- conn
	- \|> render("status_interact.html", %{
	- status_link: ap_id,
	- status_id: id,
	- nickname: user.nickname,
	- avatar: avatar,
	- error: false
	- })
	- else
	- _e ->
	- render(conn, "status_interact.html", %{
	- status_id: id,
	- avatar: nil,
	- error:
	- Pleroma.Web.Gettext.dpgettext(
	- "static_pages",
	- "status interact error message - status not found",
	- "Could not find status"
	- )
	- })
	- end
	- end
	-
	- def remote_subscribe(conn, %{"nickname" => nick, "profile" => _}) do
	- show_subscribe_form(conn, %{"nickname" => nick})
	- end
	-
	- def remote_subscribe(conn, %{"status_id" => id, "profile" => _}) do
	- show_subscribe_form(conn, %{"status_id" => id})
	- end
	-
	- def remote_subscribe(conn, %{"user" => %{"nickname" => nick, "profile" => profile}}) do
	- with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	- %User{ap_id: ap_id} <- User.get_cached_by_nickname(nick) do
	- conn
	- \|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	- else
	- _e ->
	- render(conn, "subscribe.html", %{
	- nickname: nick,
	- avatar: nil,
	- error:
	- Pleroma.Web.Gettext.dpgettext(
	- "static_pages",
	- "remote follow error message - unknown error",
	- "Something went wrong."
	- )
	- })
	- end
	- end
	-
	- def remote_subscribe(conn, %{"status" => %{"status_id" => id, "profile" => profile}}) do
	- with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	- %Activity{} = activity <- Activity.get_by_id(id),
	- {:ok, ap_id} <- get_ap_id(activity) do
	- conn
	- \|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	- else
	- _e ->
	- render(conn, "status_interact.html", %{
	- status_id: id,
	- avatar: nil,
	- error:
	- Pleroma.Web.Gettext.dpgettext(
	- "static_pages",
	- "status interact error message - unknown error",
	- "Something went wrong."
	- )
	- })
	- end
	- end
	-
	- def remote_interaction(
	- %{private: %{open_api_spex: %{body_params: %{ap_id: ap_id, profile: profile}}}} = conn,
	- _params
	- ) do
	- with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile) do
	- conn
	- \|> json(%{url: String.replace(template, "{uri}", ap_id)})
	- else
	- _e -> json(conn, %{error: "Couldn't find user"})
	- end
	- end
	-
	- defp get_ap_id(activity) do
	- object = Pleroma.Object.normalize(activity, fetch: false)
	-
	- case object do
	- %{data: %{"id" => ap_id}} -> {:ok, ap_id}
	- _ -> {:no_ap_id, nil}
	- end
	- end
	+ defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaUtilOperation

	def frontend_configurations(conn, _params) do
	render(conn, "frontend_configurations.json")
	end

	def emoji(conn, _params) do
	emoji =
	Enum.reduce(Emoji.get_all(), %{}, fn {code, %Emoji{file: file, tags: tags}}, acc ->
	file = encode_emoji_url(file)
	Map.put(acc, code, %{image_url: file, tags: tags})
	end)

	json(conn, emoji)
	end

	defp encode_emoji_url(nil), do: nil
	defp encode_emoji_url("http" <> _ = url), do: URIEncoding.encode_url(url)

	defp encode_emoji_url("/" <> _ = path),
	do: URIEncoding.encode_url(path, bypass_parse: true, bypass_decode: true)

	defp encode_emoji_url(path) when is_binary(path),
	do: URIEncoding.encode_url(path, bypass_parse: true, bypass_decode: true)

	def update_notification_settings(%{assigns: %{user: user}} = conn, params) do
	with {:ok, _} <- User.update_notification_settings(user, params) do
	json(conn, %{status: "success"})
	end
	end

	def change_password(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	with {:ok, %User{}} <-
	Authenticator.change_password(
	user,
	body_params.password,
	body_params.new_password,
	body_params.new_password_confirmation
	) do
	json(conn, %{status: "success"})
	else
	{:error, %Ecto.Changeset{} = changeset} ->
	{_, {error, _}} = Enum.at(changeset.errors, 0)
	json(conn, %{error: "New password #{error}."})

	{:error, :password_confirmation} ->
	json(conn, %{error: "New password does not match confirmation."})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def change_email(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
	{:ok, user} ->
	with {:ok, _user} <- User.change_email(user, body_params.email) do
	json(conn, %{status: "success"})
	else
	{:error, changeset} ->
	{_, {error, _}} = Enum.at(changeset.errors, 0)
	json(conn, %{error: "Email #{error}."})

	_ ->
	json(conn, %{error: "Unable to change email."})
	end

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def delete_account(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: body_params, params: params}}
	} = conn,
	_
	) do
	# This endpoint can accept a query param or JSON body for backwards-compatibility.
	# Submitting a JSON body is recommended, so passwords don't end up in server logs.
	password = body_params[:password] \|\| params[:password] \|\| ""

	case CommonAPI.Utils.confirm_current_password(user, password) do
	{:ok, user} ->
	User.delete(user)
	json(conn, %{status: "success"})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def disable_account(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn,
	_
	) do
	case CommonAPI.Utils.confirm_current_password(user, params[:password]) do
	{:ok, user} ->
	User.set_activation_async(user, false)
	json(conn, %{status: "success"})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def move_account(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
	{:ok, user} ->
	with {:ok, target_user} <- find_or_fetch_user_by_nickname(body_params.target_account),
	{:ok, _user} <- ActivityPub.move(user, target_user) do
	json(conn, %{status: "success"})
	else
	{:not_found, _} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Target account not found."})

	{:error, error} ->
	json(conn, %{error: error})
	end

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def add_alias(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	with {:ok, alias_user} <- find_user_by_nickname(body_params.alias),
	{:ok, _user} <- user \|> User.add_alias(alias_user) do
	json(conn, %{status: "success"})
	else
	{:not_found, _} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Target account does not exist."})

	{:error, error} ->
	json(conn, %{error: error})
	end
	end

	def delete_alias(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	with {:ok, alias_user} <- find_user_by_nickname(body_params.alias),
	{:ok, _user} <- user \|> User.delete_alias(alias_user) do
	json(conn, %{status: "success"})
	else
	{:error, :no_such_alias} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Account has no such alias."})

	{:error, error} ->
	json(conn, %{error: error})
	end
	end

	def list_aliases(%{assigns: %{user: user}} = conn, _) do
	alias_nicks =
	user
	\|> User.alias_users()
	\|> Enum.map(&User.full_nickname/1)

	json(conn, %{aliases: alias_nicks})
	end

	defp find_user_by_nickname(nickname) do
	user = User.get_cached_by_nickname(nickname)

	if user == nil do
	{:error, :not_found}
	else
	{:ok, user}
	end
	end

	defp find_or_fetch_user_by_nickname(nickname) do
	user = User.get_by_nickname(nickname)

	if user != nil and user.local do
	{:ok, user}
	else
	with {:ok, user} <- User.fetch_by_nickname(nickname) do
	{:ok, user}
	else
	_ ->
	{:not_found, nil}
	end
	end
	end

	def captcha(conn, _params) do
	json(conn, Pleroma.Captcha.new())
	end

	def healthcheck(conn, _params) do
	with {:cfg, true} <- {:cfg, Config.get([:instance, :healthcheck])},
	%{healthy: true} = info <- Healthcheck.system_info() do
	json(conn, info)
	else
	%{healthy: false} = info ->
	service_unavailable(conn, info)

	{:cfg, false} ->
	service_unavailable(conn, %{"error" => "Healthcheck disabled"})

	_ ->
	service_unavailable(conn, %{})
	end
	end

	defp service_unavailable(conn, info) do
	conn
	\|> put_status(:service_unavailable)
	\|> json(info)
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/views/util_view.ex b/lib/pleroma/web/pleroma_api/views/util_view.ex
	new file mode 100644
	index 000000000..b5e07c006
	--- /dev/null
	+++ b/lib/pleroma/web/pleroma_api/views/util_view.ex
	@@ -0,0 +1,13 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Web.PleromaAPI.UtilView do
	+ use Pleroma.Web, :view
	+ alias Pleroma.Config
	+
	+ def render("frontend_configurations.json", _) do
	+ Config.get(:frontend_configurations, %{})
	+ \|> Enum.into(%{})
	+ end
	+end
	diff --git a/lib/pleroma/web/preload/providers/instance.ex b/lib/pleroma/web/preload/providers/instance.ex
	index 6183f7b70..d5417af30 100644
	--- a/lib/pleroma/web/preload/providers/instance.ex
	+++ b/lib/pleroma/web/preload/providers/instance.ex
	@@ -1,59 +1,59 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Preload.Providers.Instance do
	alias Pleroma.Web.MastodonAPI.InstanceView
	alias Pleroma.Web.Nodeinfo.Nodeinfo
	alias Pleroma.Web.Plugs.InstanceStatic
	alias Pleroma.Web.Preload.Providers.Provider
	- alias Pleroma.Web.TwitterAPI.UtilView
	+ alias Pleroma.Web.PleromaAPI.UtilView

	@behaviour Provider
	@instance_url "/api/v1/instance"
	@panel_url "/instance/panel.html"
	@nodeinfo_url "/nodeinfo/2.0.json"
	@fe_config_url "/api/pleroma/frontend_configurations"

	@impl Provider
	def generate_terms(_params) do
	%{}
	\|> build_info_tag()
	\|> build_panel_tag()
	\|> build_nodeinfo_tag()
	\|> build_fe_config_tag()
	end

	defp build_info_tag(acc) do
	info_data = InstanceView.render("show.json", %{})

	Map.put(acc, @instance_url, info_data)
	end

	defp build_panel_tag(acc) do
	instance_path = InstanceStatic.file_path(@panel_url \|> to_string())

	if File.exists?(instance_path) do
	panel_data = File.read!(instance_path)
	Map.put(acc, @panel_url, panel_data)
	else
	acc
	end
	end

	defp build_nodeinfo_tag(acc) do
	case Nodeinfo.get_nodeinfo("2.0") do
	{:error, _} ->
	acc

	nodeinfo_data ->
	Map.put(acc, @nodeinfo_url, nodeinfo_data)
	end
	end

	defp build_fe_config_tag(acc) do
	fe_data = UtilView.render("frontend_configurations.json", %{})

	Map.put(acc, @fe_config_url, fe_data)
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/twitter_api.ex b/lib/pleroma/web/registration.ex
	similarity index 98%
	rename from lib/pleroma/web/twitter_api/twitter_api.ex
	rename to lib/pleroma/web/registration.ex
	index ef2eb75f4..df71300ce 100644
	--- a/lib/pleroma/web/twitter_api/twitter_api.ex
	+++ b/lib/pleroma/web/registration.ex
	@@ -1,136 +1,136 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
	+defmodule Pleroma.Web.Registration do
	import Pleroma.Web.Gettext

	alias Pleroma.Emails.Mailer
	alias Pleroma.Emails.UserEmail
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.UserInviteToken

	def register_user(params, opts \\ []) do
	fallback_language = Gettext.get_locale()

	params =
	params
	\|> Map.take([:email, :token, :password])
	\|> Map.put(:bio, params \|> Map.get(:bio, "") \|> User.parse_bio())
	\|> Map.put(:nickname, params[:username])
	\|> Map.put(:name, Map.get(params, :fullname, params[:username]))
	\|> Map.put(:password_confirmation, params[:password])
	\|> Map.put(:registration_reason, params[:reason])
	\|> Map.put(:birthday, params[:birthday])
	\|> Map.put(
	:language,
	Pleroma.Web.Gettext.normalize_locale(params[:language]) \|\| fallback_language
	)

	if Pleroma.Config.get([:instance, :registrations_open]) do
	create_user(params, opts)
	else
	create_user_with_invite(params, opts)
	end
	end

	defp create_user_with_invite(params, opts) do
	with %{token: token} when is_binary(token) <- params,
	%UserInviteToken{} = invite <- Repo.get_by(UserInviteToken, %{token: token}),
	true <- UserInviteToken.valid_invite?(invite) do
	UserInviteToken.update_usage!(invite)
	create_user(params, opts)
	else
	nil -> {:error, "Invalid token"}
	_ -> {:error, "Expired token"}
	end
	end

	defp create_user(params, opts) do
	changeset = User.register_changeset(%User{}, params, opts)

	case User.register(changeset) do
	{:ok, user} ->
	{:ok, user}

	{:error, changeset} ->
	errors =
	changeset
	\|> Ecto.Changeset.traverse_errors(fn {msg, _opts} -> msg end)
	\|> Jason.encode!()

	{:error, errors}
	end
	end

	def password_reset(nickname_or_email) do
	with true <- is_binary(nickname_or_email),
	%User{local: true, email: email, is_active: true} = user when is_binary(email) <-
	User.get_by_nickname_or_email(nickname_or_email),
	{:ok, token_record} <- Pleroma.PasswordResetToken.create_token(user) do
	user
	\|> UserEmail.password_reset_email(token_record.token)
	\|> Mailer.deliver_async()

	{:ok, :enqueued}
	else
	_ ->
	{:ok, :noop}
	end
	end

	def validate_captcha(app, params) do
	if app.trusted \|\| not Pleroma.Captcha.enabled?() do
	:ok
	else
	do_validate_captcha(params)
	end
	end

	defp do_validate_captcha(params) do
	with :ok <- validate_captcha_presence(params),
	:ok <-
	Pleroma.Captcha.validate(
	params[:captcha_token],
	params[:captcha_solution],
	params[:captcha_answer_data]
	) do
	:ok
	else
	{:error, :captcha_error} ->
	captcha_error(dgettext("errors", "CAPTCHA Error"))

	{:error, :invalid} ->
	captcha_error(dgettext("errors", "Invalid CAPTCHA"))

	{:error, :kocaptcha_service_unavailable} ->
	captcha_error(dgettext("errors", "Kocaptcha service unavailable"))

	{:error, :expired} ->
	captcha_error(dgettext("errors", "CAPTCHA expired"))

	{:error, :already_used} ->
	captcha_error(dgettext("errors", "CAPTCHA already used"))

	{:error, :invalid_answer_data} ->
	captcha_error(dgettext("errors", "Invalid answer data"))

	{:error, error} ->
	captcha_error(error)
	end
	end

	defp validate_captcha_presence(params) do
	[:captcha_solution, :captcha_token, :captcha_answer_data]
	\|> Enum.find_value(:ok, fn key ->
	unless is_binary(params[key]) do
	error = dgettext("errors", "Invalid CAPTCHA (Missing parameter: %{name})", name: key)
	{:error, error}
	end
	end)
	end

	# For some reason FE expects error message to be a serialized JSON
	defp captcha_error(error), do: {:error, Jason.encode!(%{captcha: [error]})}
	end
	diff --git a/lib/pleroma/web/twitter_api/controllers/remote_follow_controller.ex b/lib/pleroma/web/remote_interaction/remote_interaction_controller.ex
	similarity index 57%
	rename from lib/pleroma/web/twitter_api/controllers/remote_follow_controller.ex
	rename to lib/pleroma/web/remote_interaction/remote_interaction_controller.ex
	index 38ebc8c5d..8592fc990 100644
	--- a/lib/pleroma/web/twitter_api/controllers/remote_follow_controller.ex
	+++ b/lib/pleroma/web/remote_interaction/remote_interaction_controller.ex
	@@ -1,165 +1,292 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.RemoteFollowController do
	+defmodule Pleroma.Web.RemoteInteraction.RemoteInteractionController do
	use Pleroma.Web, :controller

	require Logger

	alias Pleroma.Activity
	alias Pleroma.MFA
	alias Pleroma.Object.Fetcher
	alias Pleroma.User
	alias Pleroma.Web.Auth.TOTPAuthenticator
	alias Pleroma.Web.Auth.WrapperAuthenticator
	alias Pleroma.Web.CommonAPI
	+ alias Pleroma.Web.WebFinger

	@status_types ["Article", "Event", "Note", "Video", "Page", "Question"]

	+ plug(
	+ Pleroma.Web.ApiSpec.CastAndValidate,
	+ [replace_params: false]
	+ when action == :remote_interaction
	+ )
	+
	plug(Pleroma.Web.Plugs.FederatingPlug)

	# Note: follower can submit the form (with password auth) not being signed in (having no token)
	plug(
	Pleroma.Web.Plugs.OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["follow", "write:follows"]}
	when action in [:do_follow]
	)

	+ defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.RemoteInteractionOperation
	+
	# GET /ostatus_subscribe
	#
	def follow(%{assigns: %{user: user}} = conn, %{"acct" => acct}) do
	case status?(acct) do
	true -> follow_status(conn, user, acct)
	_ -> follow_account(conn, user, acct)
	end
	end

	defp follow_status(conn, _user, acct) do
	with {:ok, object} <- Fetcher.fetch_object_from_id(acct),
	%Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(object.data["id"]) do
	redirect(conn, to: Routes.o_status_path(conn, :notice, activity_id))
	else
	error ->
	handle_follow_error(conn, error)
	end
	end

	defp follow_account(conn, user, acct) do
	with {:ok, followee} <- User.get_or_fetch(acct) do
	render(conn, follow_template(user), %{error: false, followee: followee, acct: acct})
	else
	{:error, _reason} ->
	render(conn, follow_template(user), %{error: :error})
	end
	end

	defp follow_template(%User{} = _user), do: "follow.html"
	defp follow_template(_), do: "follow_login.html"

	defp status?(acct) do
	case Fetcher.fetch_and_contain_remote_object_from_id(acct) do
	{:ok, %{"type" => type}} when type in @status_types ->
	true

	_ ->
	false
	end
	end

	# POST /ostatus_subscribe
	#
	# adds a remote account in followers if user already is signed in.
	#
	def do_follow(%{assigns: %{user: %User{} = user}} = conn, %{"user" => %{"id" => id}}) do
	with {:fetch_user, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
	{:ok, _, _, _} <- CommonAPI.follow(followee, user) do
	redirect(conn, to: "/users/#{followee.id}")
	else
	error ->
	handle_follow_error(conn, error)
	end
	end

	# POST /ostatus_subscribe
	#
	# step 1.
	# checks login\password and displays step 2 form of MFA if need.
	#
	def do_follow(conn, %{"authorization" => %{"name" => _, "password" => _, "id" => id}}) do
	with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
	{_, {:ok, user}, _} <- {:auth, WrapperAuthenticator.get_user(conn), followee},
	{_, _, _, false} <- {:mfa_required, followee, user, MFA.require?(user)},
	{:ok, _, _, _} <- CommonAPI.follow(followee, user) do
	redirect(conn, to: "/users/#{followee.id}")
	else
	error ->
	handle_follow_error(conn, error)
	end
	end

	# POST /ostatus_subscribe
	#
	# step 2
	# checks TOTP code. otherwise displays form with errors
	#
	def do_follow(conn, %{"mfa" => %{"code" => code, "token" => token, "id" => id}}) do
	with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
	{_, _, {:ok, %{user: user}}} <- {:mfa_token, followee, MFA.Token.validate(token)},
	{_, _, _, {:ok, _}} <-
	{:verify_mfa_code, followee, token, TOTPAuthenticator.verify(code, user)},
	{:ok, _, _, _} <- CommonAPI.follow(followee, user) do
	redirect(conn, to: "/users/#{followee.id}")
	else
	error ->
	handle_follow_error(conn, error)
	end
	end

	def do_follow(%{assigns: %{user: nil}} = conn, _) do
	Logger.debug("Insufficient permissions: follow \| write:follows.")
	render(conn, "followed.html", %{error: "Insufficient permissions: follow \| write:follows."})
	end

	# GET /authorize_interaction
	#
	def authorize_interaction(conn, %{"uri" => uri}) do
	conn
	- \|> redirect(to: Routes.remote_follow_path(conn, :follow, %{acct: uri}))
	+ \|> redirect(to: Routes.remote_interaction_path(conn, :follow, %{acct: uri}))
	end

	defp handle_follow_error(conn, {:mfa_token, followee, _} = _) do
	render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
	end

	defp handle_follow_error(conn, {:verify_mfa_code, followee, token, _} = _) do
	render(conn, "follow_mfa.html", %{
	error: "Wrong authentication code",
	followee: followee,
	mfa_token: token
	})
	end

	defp handle_follow_error(conn, {:mfa_required, followee, user, _} = _) do
	{:ok, %{token: token}} = MFA.Token.create(user)
	render(conn, "follow_mfa.html", %{followee: followee, mfa_token: token, error: false})
	end

	defp handle_follow_error(conn, {:auth, _, followee} = _) do
	render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
	end

	defp handle_follow_error(conn, {:fetch_user, error} = _) do
	Logger.debug("Remote follow failed with error #{inspect(error)}")
	render(conn, "followed.html", %{error: "Could not find user"})
	end

	defp handle_follow_error(conn, {:error, "Could not follow user:" <> _} = _) do
	render(conn, "followed.html", %{error: "Error following account"})
	end

	defp handle_follow_error(conn, error) do
	Logger.debug("Remote follow failed with error #{inspect(error)}")
	render(conn, "followed.html", %{error: "Something went wrong."})
	end
	+
	+ def show_subscribe_form(conn, %{"nickname" => nick}) do
	+ with %User{} = user <- User.get_cached_by_nickname(nick),
	+ avatar = User.avatar_url(user) do
	+ conn
	+ \|> render("subscribe.html", %{nickname: nick, avatar: avatar, error: false})
	+ else
	+ _e ->
	+ render(conn, "subscribe.html", %{
	+ nickname: nick,
	+ avatar: nil,
	+ error:
	+ Pleroma.Web.Gettext.dpgettext(
	+ "static_pages",
	+ "remote follow error message - user not found",
	+ "Could not find user"
	+ )
	+ })
	+ end
	+ end
	+
	+ def show_subscribe_form(conn, %{"status_id" => id}) do
	+ with %Activity{} = activity <- Activity.get_by_id(id),
	+ {:ok, ap_id} <- get_ap_id(activity),
	+ %User{} = user <- User.get_cached_by_ap_id(activity.actor),
	+ avatar = User.avatar_url(user) do
	+ conn
	+ \|> render("status_interact.html", %{
	+ status_link: ap_id,
	+ status_id: id,
	+ nickname: user.nickname,
	+ avatar: avatar,
	+ error: false
	+ })
	+ else
	+ _e ->
	+ render(conn, "status_interact.html", %{
	+ status_id: id,
	+ avatar: nil,
	+ error:
	+ Pleroma.Web.Gettext.dpgettext(
	+ "static_pages",
	+ "status interact error message - status not found",
	+ "Could not find status"
	+ )
	+ })
	+ end
	+ end
	+
	+ def remote_subscribe(conn, %{"nickname" => nick, "profile" => _}) do
	+ show_subscribe_form(conn, %{"nickname" => nick})
	+ end
	+
	+ def remote_subscribe(conn, %{"status_id" => id, "profile" => _}) do
	+ show_subscribe_form(conn, %{"status_id" => id})
	+ end
	+
	+ def remote_subscribe(conn, %{"user" => %{"nickname" => nick, "profile" => profile}}) do
	+ with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	+ %User{ap_id: ap_id} <- User.get_cached_by_nickname(nick) do
	+ conn
	+ \|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	+ else
	+ _e ->
	+ render(conn, "subscribe.html", %{
	+ nickname: nick,
	+ avatar: nil,
	+ error:
	+ Pleroma.Web.Gettext.dpgettext(
	+ "static_pages",
	+ "remote follow error message - unknown error",
	+ "Something went wrong."
	+ )
	+ })
	+ end
	+ end
	+
	+ def remote_subscribe(conn, %{"status" => %{"status_id" => id, "profile" => profile}}) do
	+ with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	+ %Activity{} = activity <- Activity.get_by_id(id),
	+ {:ok, ap_id} <- get_ap_id(activity) do
	+ conn
	+ \|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	+ else
	+ _e ->
	+ render(conn, "status_interact.html", %{
	+ status_id: id,
	+ avatar: nil,
	+ error:
	+ Pleroma.Web.Gettext.dpgettext(
	+ "static_pages",
	+ "status interact error message - unknown error",
	+ "Something went wrong."
	+ )
	+ })
	+ end
	+ end
	+
	+ def remote_interaction(
	+ %{private: %{open_api_spex: %{body_params: %{ap_id: ap_id, profile: profile}}}} = conn,
	+ _params
	+ ) do
	+ with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile) do
	+ conn
	+ \|> json(%{url: String.replace(template, "{uri}", ap_id)})
	+ else
	+ _e -> json(conn, %{error: "Couldn't find user"})
	+ end
	+ end
	+
	+ defp get_ap_id(activity) do
	+ object = Pleroma.Object.normalize(activity, fetch: false)
	+
	+ case object do
	+ %{data: %{"id" => ap_id}} -> {:ok, ap_id}
	+ _ -> {:no_ap_id, nil}
	+ end
	+ end
	end
	diff --git a/lib/pleroma/web/twitter_api/views/remote_follow_view.ex b/lib/pleroma/web/remote_interaction/remote_interaction_view.ex
	similarity index 75%
	rename from lib/pleroma/web/twitter_api/views/remote_follow_view.ex
	rename to lib/pleroma/web/remote_interaction/remote_interaction_view.ex
	index 8902261b0..6e7f40749 100644
	--- a/lib/pleroma/web/twitter_api/views/remote_follow_view.ex
	+++ b/lib/pleroma/web/remote_interaction/remote_interaction_view.ex
	@@ -1,15 +1,17 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.RemoteFollowView do
	+defmodule Pleroma.Web.RemoteInteraction.RemoteInteractionView do
	use Pleroma.Web, :view
	+ import Phoenix.HTML
	import Phoenix.HTML.Form
	+ import Phoenix.HTML.Link
	alias Pleroma.Web.Gettext

	def avatar_url(user) do
	user
	\|> Pleroma.User.avatar_url()
	\|> Pleroma.Web.MediaProxy.url()
	end
	end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 20ac1c67b..22e82568a 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,1112 +1,1116 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router
	import Phoenix.LiveDashboard.Router
	import Oban.Web.Router

	pipeline :accepts_html do
	plug(:accepts, ["html"])
	end

	pipeline :accepts_html_xml do
	plug(:accepts, ["html", "xml", "rss", "atom"])
	end

	pipeline :accepts_html_json do
	plug(:accepts, ["html", "activity+json", "json"])
	end

	pipeline :accepts_html_xml_json do
	plug(:accepts, ["html", "xml", "rss", "atom", "activity+json", "json"])
	end

	pipeline :accepts_xml_rss_atom do
	plug(:accepts, ["xml", "rss", "atom"])
	end

	pipeline :browser do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Web.Plugs.LoggerMetadataUser)
	end

	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Web.Plugs.OAuthPlug)
	plug(Pleroma.Web.Plugs.UserEnabledPlug)
	plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
	end

	# Note: expects _user_ authentication (user-unbound app-bound tokens don't qualify)
	pipeline :expect_user_authentication do
	plug(Pleroma.Web.Plugs.ExpectAuthenticatedCheckPlug)
	end

	# Note: expects public instance or _user_ authentication (user-unbound tokens don't qualify)
	pipeline :expect_public_instance_or_user_authentication do
	plug(Pleroma.Web.Plugs.ExpectPublicOrAuthenticatedCheckPlug)
	end

	pipeline :authenticate do
	plug(Pleroma.Web.Plugs.OAuthPlug)
	plug(Pleroma.Web.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Web.Plugs.UserFetcherPlug)
	plug(Pleroma.Web.Plugs.AuthenticationPlug)
	end

	pipeline :after_auth do
	plug(Pleroma.Web.Plugs.UserEnabledPlug)
	plug(Pleroma.Web.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
	plug(Pleroma.Web.Plugs.UserTrackingPlug)
	end

	pipeline :base_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(:authenticate)
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	plug(Pleroma.Web.Plugs.LoggerMetadataUser)
	end

	pipeline :no_auth_or_privacy_expectations_api do
	plug(:base_api)
	plug(:after_auth)
	plug(Pleroma.Web.Plugs.IdempotencyPlug)
	plug(Pleroma.Web.Plugs.LoggerMetadataUser)
	end

	# Pipeline for app-related endpoints (no user auth checks — app-bound tokens must be supported)
	pipeline :app_api do
	plug(:no_auth_or_privacy_expectations_api)
	end

	pipeline :api do
	plug(:expect_public_instance_or_user_authentication)
	plug(:no_auth_or_privacy_expectations_api)
	plug(Pleroma.Web.Plugs.LoggerMetadataUser)
	end

	pipeline :authenticated_api do
	plug(:expect_user_authentication)
	plug(:no_auth_or_privacy_expectations_api)
	plug(Pleroma.Web.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Web.Plugs.LoggerMetadataUser)
	end

	pipeline :admin_api do
	plug(:expect_user_authentication)
	plug(:base_api)
	plug(Pleroma.Web.Plugs.AdminSecretAuthenticationPlug)
	plug(:after_auth)
	plug(Pleroma.Web.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Web.Plugs.UserIsStaffPlug)
	plug(Pleroma.Web.Plugs.IdempotencyPlug)
	plug(Pleroma.Web.Plugs.LoggerMetadataUser)
	end

	pipeline :require_admin do
	plug(Pleroma.Web.Plugs.UserIsAdminPlug)
	end

	pipeline :require_privileged_role_users_delete do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_delete)
	end

	pipeline :require_privileged_role_users_manage_credentials do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_manage_credentials)
	end

	pipeline :require_privileged_role_messages_read do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :messages_read)
	end

	pipeline :require_privileged_role_users_manage_tags do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_manage_tags)
	end

	pipeline :require_privileged_role_users_manage_activation_state do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_manage_activation_state)
	end

	pipeline :require_privileged_role_users_manage_invites do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_manage_invites)
	end

	pipeline :require_privileged_role_reports_manage_reports do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :reports_manage_reports)
	end

	pipeline :require_privileged_role_users_read do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :users_read)
	end

	pipeline :require_privileged_role_messages_delete do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :messages_delete)
	end

	pipeline :require_privileged_role_emoji_manage_emoji do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :emoji_manage_emoji)
	end

	pipeline :require_privileged_role_instances_delete do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :instances_delete)
	end

	pipeline :require_privileged_role_moderation_log_read do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :moderation_log_read)
	end

	pipeline :require_privileged_role_statistics_read do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :statistics_read)
	end

	pipeline :require_privileged_role_announcements_manage_announcements do
	plug(:admin_api)
	plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :announcements_manage_announcements)
	end

	pipeline :pleroma_html do
	plug(:browser)
	plug(:authenticate)
	plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
	plug(Pleroma.Web.Plugs.LoggerMetadataUser)
	end

	pipeline :well_known do
	plug(:accepts, ["activity+json", "json", "jrd", "jrd+json", "xml", "xrd+xml", "html"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	plug(OpenApiSpex.Plug.PutApiSpec, module: Pleroma.Web.ApiSpec)
	plug(Pleroma.Web.Plugs.LoggerMetadataUser)
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	pipeline :http_signature do
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	pipeline :inbox_guard do
	plug(Pleroma.Web.Plugs.InboxGuardPlug)
	end

	pipeline :static_fe do
	plug(Pleroma.Web.Plugs.StaticFEPlug)
	end

	- scope "/api/v1/pleroma", Pleroma.Web.TwitterAPI do
	+ scope "/api/v1/pleroma", Pleroma.Web.OAuth do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", PasswordController, :reset, as: :reset_password)
	post("/password_reset", PasswordController, :do_reset, as: :reset_password)
	+ end
	+
	+ scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	get("/healthcheck", UtilController, :healthcheck)
	- post("/remote_interaction", UtilController, :remote_interaction)
	+
	+ get("/federation_status", InstancesController, :show)
	end

	- scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	+ scope "/api/v1/pleroma", Pleroma.Web.RemoteInteraction do
	pipe_through(:pleroma_api)

	- get("/federation_status", InstancesController, :show)
	+ post("/remote_interaction", RemoteInteractionController, :remote_interaction)
	end

	scope "/api/v1/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	# AdminAPI: only admins can perform these actions
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through([:admin_api, :require_admin])

	get("/users/:nickname/permission_group", AdminAPIController, :right_get)
	get("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_get)

	post("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_add)

	delete(
	"/users/:nickname/permission_group/:permission_group",
	AdminAPIController,
	:right_delete
	)

	post("/users/permission_group/:permission_group", AdminAPIController, :right_add_multiple)

	delete(
	"/users/permission_group/:permission_group",
	AdminAPIController,
	:right_delete_multiple
	)

	post("/users/follow", UserController, :follow)
	post("/users/unfollow", UserController, :unfollow)
	post("/users", UserController, :create)

	patch("/users/suggest", UserController, :suggest)
	patch("/users/unsuggest", UserController, :unsuggest)

	get("/relay", RelayController, :index)
	post("/relay", RelayController, :follow)
	delete("/relay", RelayController, :unfollow)

	get("/instance_document/:name", InstanceDocumentController, :show)
	patch("/instance_document/:name", InstanceDocumentController, :update)
	delete("/instance_document/:name", InstanceDocumentController, :delete)

	get("/config", ConfigController, :show)
	post("/config", ConfigController, :update)
	get("/config/descriptions", ConfigController, :descriptions)
	get("/need_reboot", AdminAPIController, :need_reboot)
	get("/restart", AdminAPIController, :restart)

	get("/oauth_app", OAuthAppController, :index)
	post("/oauth_app", OAuthAppController, :create)
	patch("/oauth_app/:id", OAuthAppController, :update)
	delete("/oauth_app/:id", OAuthAppController, :delete)

	get("/media_proxy_caches", MediaProxyCacheController, :index)
	post("/media_proxy_caches/delete", MediaProxyCacheController, :delete)
	post("/media_proxy_caches/purge", MediaProxyCacheController, :purge)

	get("/frontends", FrontendController, :index)
	post("/frontends/install", FrontendController, :install)

	post("/backups", AdminAPIController, :create_backup)

	get("/rules", RuleController, :index)
	post("/rules", RuleController, :create)
	patch("/rules/:id", RuleController, :update)
	delete("/rules/:id", RuleController, :delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_announcements_manage_announcements)

	get("/announcements", AnnouncementController, :index)
	post("/announcements", AnnouncementController, :create)
	get("/announcements/:id", AnnouncementController, :show)
	patch("/announcements/:id", AnnouncementController, :change)
	delete("/announcements/:id", AnnouncementController, :delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_delete)

	delete("/users", UserController, :delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_manage_credentials)

	get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)
	get("/users/:nickname/credentials", AdminAPIController, :show_user_credentials)
	patch("/users/:nickname/credentials", AdminAPIController, :update_user_credentials)
	put("/users/disable_mfa", AdminAPIController, :disable_mfa)
	patch("/users/force_password_reset", AdminAPIController, :force_password_reset)
	patch("/users/confirm_email", AdminAPIController, :confirm_email)
	patch("/users/resend_confirmation_email", AdminAPIController, :resend_confirmation_email)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_messages_read)

	get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)
	get("/users/:nickname/chats", AdminAPIController, :list_user_chats)

	get("/statuses", StatusController, :index)

	get("/chats/:id", ChatController, :show)
	get("/chats/:id/messages", ChatController, :messages)

	get("/instances/:instance/statuses", InstanceController, :list_statuses)

	get("/statuses/:id", StatusController, :show)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_manage_tags)

	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_manage_activation_state)

	patch("/users/:nickname/toggle_activation", UserController, :toggle_activation)
	patch("/users/activate", UserController, :activate)
	patch("/users/deactivate", UserController, :deactivate)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_manage_invites)

	patch("/users/approve", UserController, :approve)
	post("/users/invite_token", InviteController, :create)
	get("/users/invites", InviteController, :index)
	post("/users/revoke_invite", InviteController, :revoke)
	post("/users/email_invite", InviteController, :email)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_reports_manage_reports)

	get("/reports", ReportController, :index)
	get("/reports/:id", ReportController, :show)
	patch("/reports", ReportController, :update)
	post("/reports/assign_account", ReportController, :assign_account)
	post("/reports/:id/notes", ReportController, :notes_create)
	delete("/reports/:report_id/notes/:id", ReportController, :notes_delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_users_read)

	get("/users", UserController, :index)
	get("/users/:nickname", UserController, :show)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_messages_delete)

	put("/statuses/:id", StatusController, :update)
	delete("/statuses/:id", StatusController, :delete)

	delete("/chats/:id/messages/:message_id", ChatController, :delete_message)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_emoji_manage_emoji)

	post("/reload_emoji", AdminAPIController, :reload_emoji)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_instances_delete)

	delete("/instances/:instance", InstanceController, :delete)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_moderation_log_read)

	get("/moderation_log", AdminAPIController, :list_log)
	end

	# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
	scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:require_privileged_role_statistics_read)

	get("/stats", AdminAPIController, :stats)
	end

	scope "/api/v1/pleroma/emoji", Pleroma.Web.PleromaAPI do
	scope "/pack" do
	pipe_through(:require_privileged_role_emoji_manage_emoji)

	post("/", EmojiPackController, :create)
	patch("/", EmojiPackController, :update)
	delete("/", EmojiPackController, :delete)
	end

	scope "/pack" do
	pipe_through(:api)

	get("/", EmojiPackController, :show)
	end

	# Modifying packs
	scope "/packs" do
	pipe_through(:require_privileged_role_emoji_manage_emoji)

	get("/import", EmojiPackController, :import_from_filesystem)
	get("/remote", EmojiPackController, :remote)
	post("/download", EmojiPackController, :download)
	post("/download_zip", EmojiPackController, :download_zip)

	post("/files", EmojiFileController, :create)
	patch("/files", EmojiFileController, :update)
	delete("/files", EmojiFileController, :delete)
	end

	# Pack info / downloading
	scope "/packs" do
	pipe_through(:api)

	get("/", EmojiPackController, :index)
	get("/archive", EmojiPackController, :archive)
	end
	end

	- scope "/", Pleroma.Web.TwitterAPI do
	+ scope "/", Pleroma.Web.RemoteInteraction do
	pipe_through(:pleroma_html)

	- post("/main/ostatus", UtilController, :remote_subscribe)
	- get("/main/ostatus", UtilController, :show_subscribe_form)
	- get("/ostatus_subscribe", RemoteFollowController, :follow)
	- post("/ostatus_subscribe", RemoteFollowController, :do_follow)
	+ post("/main/ostatus", RemoteInteractionController, :remote_subscribe)
	+ get("/main/ostatus", RemoteInteractionController, :show_subscribe_form)
	+ get("/ostatus_subscribe", RemoteInteractionController, :follow)
	+ post("/ostatus_subscribe", RemoteInteractionController, :do_follow)

	- get("/authorize_interaction", RemoteFollowController, :authorize_interaction)
	+ get("/authorize_interaction", RemoteInteractionController, :authorize_interaction)
	end

	- scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	+ scope "/api/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:authenticated_api)

	post("/change_email", UtilController, :change_email)
	post("/change_password", UtilController, :change_password)
	post("/delete_account", UtilController, :delete_account)
	put("/notification_settings", UtilController, :update_notification_settings)
	post("/disable_account", UtilController, :disable_account)
	post("/move_account", UtilController, :move_account)

	put("/aliases", UtilController, :add_alias)
	get("/aliases", UtilController, :list_aliases)
	delete("/aliases", UtilController, :delete_alias)
	end

	scope "/api/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:authenticated_api)

	post("/mutes_import", UserImportController, :mutes)
	post("/blocks_import", UserImportController, :blocks)
	post("/follow_import", UserImportController, :follow)

	get("/accounts/mfa", TwoFactorAuthenticationController, :settings)
	get("/accounts/mfa/backup_codes", TwoFactorAuthenticationController, :backup_codes)
	get("/accounts/mfa/setup/:method", TwoFactorAuthenticationController, :setup)
	post("/accounts/mfa/confirm/:method", TwoFactorAuthenticationController, :confirm)
	delete("/accounts/mfa/:method", TwoFactorAuthenticationController, :disable)
	end

	scope "/oauth", Pleroma.Web.OAuth do
	# Note: use /api/v1/accounts/verify_credentials for userinfo of signed-in user

	get("/registration_details", OAuthController, :registration_details)

	post("/mfa/verify", MFAController, :verify, as: :mfa_verify)
	get("/mfa", MFAController, :show)

	scope [] do
	pipe_through(:oauth)

	get("/authorize", OAuthController, :authorize)
	post("/authorize", OAuthController, :create_authorization)
	end

	scope [] do
	pipe_through(:fetch_session)

	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	post("/mfa/challenge", MFAController, :challenge)
	end

	scope [] do
	pipe_through(:browser)

	get("/prepare_request", OAuthController, :prepare_request)
	get("/:provider", OAuthController, :request)
	get("/:provider/callback", OAuthController, :callback)
	post("/register", OAuthController, :register)
	end
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)

	get("/apps", AppController, :index)
	get("/statuses/:id/reactions/:emoji", EmojiReactionController, :index)
	get("/statuses/:id/reactions", EmojiReactionController, :index)

	get(
	"/preferred_frontend/available",
	FrontendSettingsController,
	:available_frontends
	)

	put(
	"/preferred_frontend",
	FrontendSettingsController,
	:update_preferred_frontend
	)
	end

	scope "/api/v0/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:authenticated_api)
	get("/reports", ReportController, :index)
	get("/reports/:id", ReportController, :show)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	scope [] do
	pipe_through(:authenticated_api)

	post("/chats/by-account-id/:id", ChatController, :create)
	get("/chats", ChatController, :index)
	get("/chats/:id", ChatController, :show)
	get("/chats/:id/messages", ChatController, :messages)
	post("/chats/:id/messages", ChatController, :post_chat_message)
	delete("/chats/:id/messages/:message_id", ChatController, :delete_message)
	post("/chats/:id/read", ChatController, :mark_as_read)
	post("/chats/:id/messages/:message_id/read", ChatController, :mark_message_as_read)
	post("/chats/:id/pin", ChatController, :pin)
	post("/chats/:id/unpin", ChatController, :unpin)

	get("/conversations/:id/statuses", ConversationController, :statuses)
	get("/conversations/:id", ConversationController, :show)
	post("/conversations/read", ConversationController, :mark_as_read)
	patch("/conversations/:id", ConversationController, :update)

	put("/statuses/:id/reactions/:emoji", EmojiReactionController, :create)
	delete("/statuses/:id/reactions/:emoji", EmojiReactionController, :delete)
	post("/notifications/read", NotificationController, :mark_as_read)

	get("/mascot", MascotController, :show)
	put("/mascot", MascotController, :update)

	post("/scrobble", ScrobbleController, :create)

	get("/backups", BackupController, :index)
	post("/backups", BackupController, :create)

	get("/bookmark_folders", BookmarkFolderController, :index)
	post("/bookmark_folders", BookmarkFolderController, :create)
	patch("/bookmark_folders/:id", BookmarkFolderController, :update)
	delete("/bookmark_folders/:id", BookmarkFolderController, :delete)

	get("/outgoing_follow_requests", FollowRequestController, :outgoing)
	end

	scope [] do
	pipe_through(:api)
	get("/accounts/:id/favourites", AccountController, :favourites)

	get("/statuses/:id/quotes", StatusController, :quotes)
	end

	scope [] do
	pipe_through(:authenticated_api)

	post("/accounts/:id/subscribe", AccountController, :subscribe)
	post("/accounts/:id/unsubscribe", AccountController, :unsubscribe)

	get("/birthdays", AccountController, :birthdays)
	end

	scope [] do
	pipe_through(:authenticated_api)

	get("/settings/:app", SettingsController, :show)
	patch("/settings/:app", SettingsController, :update)
	end

	post("/accounts/confirmation_resend", AccountController, :confirmation_resend)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)
	get("/accounts/:id/scrobbles", ScrobbleController, :index)
	end

	scope "/api/v1/pleroma", Pleroma.Web.MastodonAPI do
	pipe_through(:api)
	get("/accounts/:id/endorsements", AccountController, :endorsements)
	end

	scope "/api/v2/pleroma", Pleroma.Web.PleromaAPI do
	scope [] do
	pipe_through(:authenticated_api)
	get("/chats", ChatController, :index2)
	end
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	get("/accounts/verify_credentials", AccountController, :verify_credentials)
	patch("/accounts/update_credentials", AccountController, :update_credentials)

	get("/accounts/relationships", AccountController, :relationships)
	get("/accounts/familiar_followers", AccountController, :familiar_followers)
	get("/accounts/:id/lists", AccountController, :lists)
	get("/endorsements", AccountController, :own_endorsements)
	get("/blocks", AccountController, :blocks)
	get("/mutes", AccountController, :mutes)

	post("/follows", AccountController, :follow_by_uri)
	post("/accounts/:id/follow", AccountController, :follow)
	post("/accounts/:id/unfollow", AccountController, :unfollow)
	post("/accounts/:id/block", AccountController, :block)
	post("/accounts/:id/unblock", AccountController, :unblock)
	post("/accounts/:id/mute", AccountController, :mute)
	post("/accounts/:id/unmute", AccountController, :unmute)
	post("/accounts/:id/note", AccountController, :note)
	post("/accounts/:id/pin", AccountController, :endorse)
	post("/accounts/:id/unpin", AccountController, :unendorse)
	post("/accounts/:id/endorse", AccountController, :endorse)
	post("/accounts/:id/unendorse", AccountController, :unendorse)
	post("/accounts/:id/remove_from_followers", AccountController, :remove_from_followers)

	get("/conversations", ConversationController, :index)
	post("/conversations/:id/read", ConversationController, :mark_as_read)
	delete("/conversations/:id", ConversationController, :delete)

	get("/domain_blocks", DomainBlockController, :index)
	post("/domain_blocks", DomainBlockController, :create)
	delete("/domain_blocks", DomainBlockController, :delete)

	get("/filters", FilterController, :index)

	post("/filters", FilterController, :create)
	get("/filters/:id", FilterController, :show)
	put("/filters/:id", FilterController, :update)
	delete("/filters/:id", FilterController, :delete)

	get("/follow_requests", FollowRequestController, :index)
	post("/follow_requests/:id/authorize", FollowRequestController, :authorize)
	post("/follow_requests/:id/reject", FollowRequestController, :reject)

	get("/lists", ListController, :index)
	get("/lists/:id", ListController, :show)
	get("/lists/:id/accounts", ListController, :list_accounts)

	delete("/lists/:id", ListController, :delete)
	post("/lists", ListController, :create)
	put("/lists/:id", ListController, :update)
	post("/lists/:id/accounts", ListController, :add_to_list)
	delete("/lists/:id/accounts", ListController, :remove_from_list)

	get("/markers", MarkerController, :index)
	post("/markers", MarkerController, :upsert)

	post("/media", MediaController, :create)
	get("/media/:id", MediaController, :show)
	put("/media/:id", MediaController, :update)

	get("/notifications", NotificationController, :index)
	get("/notifications/:id", NotificationController, :show)

	post("/notifications/:id/dismiss", NotificationController, :dismiss)
	post("/notifications/clear", NotificationController, :clear)
	delete("/notifications/destroy_multiple", NotificationController, :destroy_multiple)
	# Deprecated: was removed in Mastodon v3, use `/notifications/:id/dismiss` instead
	post("/notifications/dismiss", NotificationController, :dismiss_via_body)

	post("/polls/:id/votes", PollController, :vote)

	post("/reports", ReportController, :create)

	get("/scheduled_statuses", ScheduledActivityController, :index)
	get("/scheduled_statuses/:id", ScheduledActivityController, :show)

	put("/scheduled_statuses/:id", ScheduledActivityController, :update)
	delete("/scheduled_statuses/:id", ScheduledActivityController, :delete)

	# Unlike `GET /api/v1/accounts/:id/favourites`, demands authentication
	get("/favourites", StatusController, :favourites)
	get("/bookmarks", StatusController, :bookmarks)

	post("/statuses", StatusController, :create)
	put("/statuses/:id", StatusController, :update)
	delete("/statuses/:id", StatusController, :delete)
	post("/statuses/:id/reblog", StatusController, :reblog)
	post("/statuses/:id/unreblog", StatusController, :unreblog)
	post("/statuses/:id/favourite", StatusController, :favourite)
	post("/statuses/:id/unfavourite", StatusController, :unfavourite)
	post("/statuses/:id/pin", StatusController, :pin)
	post("/statuses/:id/unpin", StatusController, :unpin)
	post("/statuses/:id/bookmark", StatusController, :bookmark)
	post("/statuses/:id/unbookmark", StatusController, :unbookmark)
	post("/statuses/:id/mute", StatusController, :mute_conversation)
	post("/statuses/:id/unmute", StatusController, :unmute_conversation)
	post("/statuses/:id/translate", StatusController, :translate)
	get("/statuses/:id/quotes", StatusController, :quotes)

	post("/push/subscription", SubscriptionController, :create)
	get("/push/subscription", SubscriptionController, :show)
	put("/push/subscription", SubscriptionController, :update)
	delete("/push/subscription", SubscriptionController, :delete)

	get("/suggestions", SuggestionController, :index)
	delete("/suggestions/:account_id", SuggestionController, :dismiss)

	get("/timelines/home", TimelineController, :home)
	get("/timelines/direct", TimelineController, :direct)
	get("/timelines/list/:list_id", TimelineController, :list)

	get("/announcements", AnnouncementController, :index)
	post("/announcements/:id/dismiss", AnnouncementController, :mark_read)

	get("/tags/:id", TagController, :show)
	post("/tags/:id/follow", TagController, :follow)
	post("/tags/:id/unfollow", TagController, :unfollow)
	get("/followed_tags", TagController, :show_followed)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:app_api)

	post("/apps", AppController, :create)
	get("/apps/verify_credentials", AppController, :verify_credentials)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	get("/accounts/search", SearchController, :account_search)
	get("/search", SearchController, :search)

	get("/accounts/lookup", AccountController, :lookup)

	get("/accounts/:id/statuses", AccountController, :statuses)
	get("/accounts/:id/followers", AccountController, :followers)
	get("/accounts/:id/following", AccountController, :following)
	get("/accounts/:id/endorsements", AccountController, :endorsements)
	get("/accounts/:id", AccountController, :show)

	post("/accounts", AccountController, :create)

	get("/instance", InstanceController, :show)
	get("/instance/peers", InstanceController, :peers)
	get("/instance/rules", InstanceController, :rules)
	get("/instance/domain_blocks", InstanceController, :domain_blocks)
	get("/instance/translation_languages", InstanceController, :translation_languages)

	get("/statuses", StatusController, :index)
	get("/statuses/:id", StatusController, :show)
	get("/statuses/:id/context", StatusController, :context)
	get("/statuses/:id/favourited_by", StatusController, :favourited_by)
	get("/statuses/:id/reblogged_by", StatusController, :reblogged_by)
	get("/statuses/:id/history", StatusController, :show_history)
	get("/statuses/:id/source", StatusController, :show_source)

	get("/custom_emojis", CustomEmojiController, :index)

	get("/trends", MastodonAPIController, :empty_array)

	get("/timelines/public", TimelineController, :public)
	get("/timelines/tag/:tag", TimelineController, :hashtag)

	get("/polls/:id", PollController, :show)

	get("/directory", DirectoryController, :index)
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	get("/search", SearchController, :search2)

	post("/media", MediaController, :create2)

	get("/suggestions", SuggestionController, :index2)

	get("/instance", InstanceController, :show2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	- get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	+ get("/pleroma/frontend_configurations", PleromaAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	get(
	"/account/confirm_email/:user_id/:token",
	- TwitterAPI.Controller,
	+ OAuth.TokenController,
	:confirm_email,
	as: :confirm_email
	)
	end

	scope "/api" do
	pipe_through(:base_api)

	get("/openapi", OpenApiSpex.Plug.RenderSpec, [])
	end

	- scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	+ scope "/api", Pleroma.Web, as: :authenticated_pleroma_api do
	pipe_through(:authenticated_api)

	- get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	- delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)
	+ get("/oauth_tokens", OAuth.TokenController, :oauth_tokens)
	+ delete("/oauth_tokens/:id", OAuth.TokenController, :revoke_token)
	end

	scope "/", Pleroma.Web do
	# Note: html format is supported only if static FE is enabled
	# Note: http signature is only considered for json requests (no auth for non-json requests)
	pipe_through([:accepts_html_json, :http_signature, :static_fe])

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)

	# Mastodon compatibility routes
	get("/users/:nickname/statuses/:id", OStatus.OStatusController, :object)
	get("/users/:nickname/statuses/:id/activity", OStatus.OStatusController, :activity)
	end

	scope "/", Pleroma.Web do
	# Note: html format is supported only if static FE is enabled
	# Note: http signature is only considered for json requests (no auth for non-json requests)
	pipe_through([:accepts_html_xml_json, :http_signature, :static_fe])

	# Note: returns user _profile_ for json requests, redirects to user _feed_ for non-json ones
	get("/users/:nickname", Feed.UserController, :feed_redirect, as: :user_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through([:accepts_html_xml])

	get("/users/:nickname/feed", Feed.UserController, :feed, as: :user_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through(:accepts_html)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)
	end

	scope "/", Pleroma.Web do
	pipe_through(:accepts_xml_rss_atom)
	get("/tags/:tag", Feed.TagController, :feed, as: :tag_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through(:browser)

	get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)

	get("/frontend_switcher", FrontendSwitcher.FrontendSwitcherController, :switch)
	post("/frontend_switcher", FrontendSwitcher.FrontendSwitcherController, :do_switch)
	end

	pipeline :ap_service_actor do
	plug(:accepts, ["activity+json", "json"])
	end

	# Server to Server (S2S) AP interactions
	pipeline :activitypub do
	plug(:ap_service_actor)
	plug(:http_signature)
	end

	# Client to Server (C2S) AP interactions
	pipeline :activitypub_client do
	plug(:ap_service_actor)
	plug(Pleroma.Web.Plugs.APClientApiEnabledPlug)
	plug(:fetch_session)
	plug(:authenticate)
	plug(:after_auth)
	end

	# AP interactions used by both S2S and C2S
	pipeline :activitypub_server_or_client do
	plug(:ap_service_actor)
	plug(:fetch_session)
	plug(:authenticate)
	plug(Pleroma.Web.Plugs.APClientApiEnabledPlug, allow_server: true)
	plug(:after_auth)
	plug(:http_signature)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	get("/api/ap/whoami", ActivityPubController, :whoami)
	get("/users/:nickname/inbox", ActivityPubController, :read_inbox)

	post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	post("/api/ap/upload_media", ActivityPubController, :upload_media)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_server_or_client])

	get("/users/:nickname/outbox", ActivityPubController, :outbox)

	get("/users/:nickname/followers", ActivityPubController, :followers)
	get("/users/:nickname/following", ActivityPubController, :following)
	get("/users/:nickname/collections/featured", ActivityPubController, :pinned)
	get("/objects/:uuid/replies", ActivityPubController, :object_replies)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub, :inbox_guard])
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :relay)

	scope [] do
	pipe_through(:http_signature)
	post("/inbox", ActivityPubController, :inbox)
	end

	get("/following", ActivityPubController, :relay_following)
	get("/followers", ActivityPubController, :relay_followers)
	end

	scope "/internal/fetch", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :internal_fetch)
	post("/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web do
	pipe_through(:api)

	get("/manifest.json", ManifestController, :show)
	end

	scope "/", Pleroma.Web do
	pipe_through(:pleroma_html)

	- post("/auth/password", TwitterAPI.PasswordController, :request)
	+ post("/auth/password", OAuth.PasswordController, :request)
	end

	scope "/proxy/", Pleroma.Web do
	get("/preview/:sig/:url", MediaProxy.MediaProxyController, :preview)
	get("/preview/:sig/:url/:filename", MediaProxy.MediaProxyController, :preview)
	get("/:sig/:url", MediaProxy.MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxy.MediaProxyController, :remote)
	end

	if Pleroma.Config.get(:env) == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	scope "/" do
	pipe_through([:pleroma_html, :authenticate, :require_admin])
	live_dashboard("/pleroma/live_dashboard", additional_pages: [oban: Oban.LiveDashboard])
	oban_dashboard("/pleroma/oban")
	end

	# Test-only routes needed to test action dispatching and plug chain execution
	if Pleroma.Config.get(:env) == :test do
	@test_actions [
	:do_oauth_check,
	:fallback_oauth_check,
	:skip_oauth_check,
	:fallback_oauth_skip_publicity_check,
	:skip_oauth_skip_publicity_check,
	:missing_oauth_check_definition
	]

	scope "/test/api", Pleroma.Tests do
	pipe_through(:api)

	for action <- @test_actions do
	get("/#{action}", AuthTestController, action)
	end
	end

	scope "/test/authenticated_api", Pleroma.Tests do
	pipe_through(:authenticated_api)

	for action <- @test_actions do
	get("/#{action}", AuthTestController, action)
	end
	end
	end

	scope "/", Pleroma.Web.MongooseIM do
	get("/user_exists", MongooseIMController, :user_exists)
	get("/check_password", MongooseIMController, :check_password)
	end

	scope "/", Pleroma.Web.Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	match(:, "/api/pleroma/path", LegacyPleromaApiRerouterPlug, [])
	get("/api/*path", RedirectController, :api_not_implemented)
	get("/phoenix/live_dashboard", RedirectController, :live_dashboard)
	get("/*path", RedirectController, :redirector_with_preload)

	options("/*path", RedirectController, :empty)
	end

	# /pleroma/{phoenix,oban}/* need to get filtered out from api routes for frontend configuration
	# to not drop admin overrides for /pleroma/admin.
	@non_api_routes ["/pleroma/live_dashboard", "/pleroma/oban"]

	def get_api_routes do
	Phoenix.Router.routes(__MODULE__)
	\|> Enum.reject(fn r -> r.plug == Pleroma.Web.Fallback.RedirectController end)
	\|> Enum.reject(fn r -> String.starts_with?(r.path, @non_api_routes) end)
	\|> Enum.map(fn r ->
	r.path
	\|> String.split("/", trim: true)
	\|> List.first()
	end)
	\|> Enum.uniq()
	end
	end
	diff --git a/lib/pleroma/web/templates/twitter_api/password/invalid_token.html.eex b/lib/pleroma/web/templates/o_auth/password/invalid_token.html.eex
	similarity index 100%
	rename from lib/pleroma/web/templates/twitter_api/password/invalid_token.html.eex
	rename to lib/pleroma/web/templates/o_auth/password/invalid_token.html.eex
	diff --git a/lib/pleroma/web/templates/twitter_api/password/reset.html.eex b/lib/pleroma/web/templates/o_auth/password/reset.html.eex
	similarity index 100%
	rename from lib/pleroma/web/templates/twitter_api/password/reset.html.eex
	rename to lib/pleroma/web/templates/o_auth/password/reset.html.eex
	diff --git a/lib/pleroma/web/templates/twitter_api/password/reset_failed.html.eex b/lib/pleroma/web/templates/o_auth/password/reset_failed.html.eex
	similarity index 100%
	rename from lib/pleroma/web/templates/twitter_api/password/reset_failed.html.eex
	rename to lib/pleroma/web/templates/o_auth/password/reset_failed.html.eex
	diff --git a/lib/pleroma/web/templates/twitter_api/password/reset_success.html.eex b/lib/pleroma/web/templates/o_auth/password/reset_success.html.eex
	similarity index 100%
	rename from lib/pleroma/web/templates/twitter_api/password/reset_success.html.eex
	rename to lib/pleroma/web/templates/o_auth/password/reset_success.html.eex
	diff --git a/lib/pleroma/web/templates/twitter_api/remote_follow/follow.html.eex b/lib/pleroma/web/templates/remote_interaction/remote_interaction/follow.html.eex
	similarity index 83%
	rename from lib/pleroma/web/templates/twitter_api/remote_follow/follow.html.eex
	rename to lib/pleroma/web/templates/remote_interaction/remote_interaction/follow.html.eex
	index e2d251fac..00cc7d383 100644
	--- a/lib/pleroma/web/templates/twitter_api/remote_follow/follow.html.eex
	+++ b/lib/pleroma/web/templates/remote_interaction/remote_interaction/follow.html.eex
	@@ -1,11 +1,11 @@
	<%= if @error == :error do %>
	<h2><%= Gettext.dpgettext("static_pages", "remote follow error", "Error fetching user") %></h2>
	<% else %>
	<h2><%= Gettext.dpgettext("static_pages", "remote follow header", "Remote follow") %></h2>
	<img height="128" width="128" src="<%= avatar_url(@followee) %>">
	<p><%= @followee.nickname %></p>
	- <%= form_for @conn, Routes.remote_follow_path(@conn, :do_follow), [as: "user"], fn f -> %>
	+ <%= form_for @conn, Routes.remote_interaction_path(@conn, :do_follow), [as: "user"], fn f -> %>
	<%= hidden_input f, :id, value: @followee.id %>
	<%= submit Gettext.dpgettext("static_pages", "remote follow authorization button", "Authorize") %>
	<% end %>
	<% end %>
	diff --git a/lib/pleroma/web/templates/twitter_api/remote_follow/follow_login.html.eex b/lib/pleroma/web/templates/remote_interaction/remote_interaction/follow_login.html.eex
	similarity index 88%
	rename from lib/pleroma/web/templates/twitter_api/remote_follow/follow_login.html.eex
	rename to lib/pleroma/web/templates/remote_interaction/remote_interaction/follow_login.html.eex
	index 26340a906..e5fe720e8 100644
	--- a/lib/pleroma/web/templates/twitter_api/remote_follow/follow_login.html.eex
	+++ b/lib/pleroma/web/templates/remote_interaction/remote_interaction/follow_login.html.eex
	@@ -1,14 +1,14 @@
	<%= if @error do %>
	<h2><%= @error %></h2>
	<% end %>
	<h2><%= Gettext.dpgettext("static_pages", "remote follow header, need login", "Log in to follow") %></h2>
	<p><%= @followee.nickname %></p>
	<img height="128" width="128" src="<%= avatar_url(@followee) %>">
	-<%= form_for @conn, Routes.remote_follow_path(@conn, :do_follow), [as: "authorization"], fn f -> %>
	+<%= form_for @conn, Routes.remote_interaction_path(@conn, :do_follow), [as: "authorization"], fn f -> %>
	<%= text_input f, :name, placeholder: Gettext.dpgettext("static_pages", "placeholder text for username entry", "Username"), required: true, autocomplete: "username" %>
	<br>
	<%= password_input f, :password, placeholder: Gettext.dpgettext("static_pages", "placeholder text for password entry", "Password"), required: true, autocomplete: "password" %>
	<br>
	<%= hidden_input f, :id, value: @followee.id %>
	<%= submit Gettext.dpgettext("static_pages", "remote follow authorization button for login", "Authorize") %>
	<% end %>
	diff --git a/lib/pleroma/web/templates/twitter_api/remote_follow/follow_mfa.html.eex b/lib/pleroma/web/templates/remote_interaction/remote_interaction/follow_mfa.html.eex
	similarity index 86%
	rename from lib/pleroma/web/templates/twitter_api/remote_follow/follow_mfa.html.eex
	rename to lib/pleroma/web/templates/remote_interaction/remote_interaction/follow_mfa.html.eex
	index 638212c1e..e5f26f104 100644
	--- a/lib/pleroma/web/templates/twitter_api/remote_follow/follow_mfa.html.eex
	+++ b/lib/pleroma/web/templates/remote_interaction/remote_interaction/follow_mfa.html.eex
	@@ -1,13 +1,13 @@
	<%= if @error do %>
	<h2><%= @error %></h2>
	<% end %>
	<h2><%= Gettext.dpgettext("static_pages", "remote follow mfa header", "Two-factor authentication") %></h2>
	<p><%= @followee.nickname %></p>
	<img height="128" width="128" src="<%= avatar_url(@followee) %>">
	-<%= form_for @conn, Routes.remote_follow_path(@conn, :do_follow), [as: "mfa"], fn f -> %>
	+<%= form_for @conn, Routes.remote_interaction_path(@conn, :do_follow), [as: "mfa"], fn f -> %>
	<%= text_input f, :code, placeholder: Gettext.dpgettext("static_pages", "placeholder text for auth code entry", "Authentication code"), required: true %>
	<br>
	<%= hidden_input f, :id, value: @followee.id %>
	<%= hidden_input f, :token, value: @mfa_token %>
	<%= submit Gettext.dpgettext("static_pages", "remote follow authorization button for mfa", "Authorize") %>
	<% end %>
	diff --git a/lib/pleroma/web/templates/twitter_api/remote_follow/followed.html.eex b/lib/pleroma/web/templates/remote_interaction/remote_interaction/followed.html.eex
	similarity index 100%
	rename from lib/pleroma/web/templates/twitter_api/remote_follow/followed.html.eex
	rename to lib/pleroma/web/templates/remote_interaction/remote_interaction/followed.html.eex
	diff --git a/lib/pleroma/web/templates/twitter_api/util/status_interact.html.eex b/lib/pleroma/web/templates/remote_interaction/remote_interaction/status_interact.html.eex
	similarity index 88%
	rename from lib/pleroma/web/templates/twitter_api/util/status_interact.html.eex
	rename to lib/pleroma/web/templates/remote_interaction/remote_interaction/status_interact.html.eex
	index d77174967..b3d590186 100644
	--- a/lib/pleroma/web/templates/twitter_api/util/status_interact.html.eex
	+++ b/lib/pleroma/web/templates/remote_interaction/remote_interaction/status_interact.html.eex
	@@ -1,10 +1,10 @@
	<%= if @error do %>
	<h2><%= Gettext.dpgettext("static_pages", "status interact error", "Error: %{error}", error: @error) %></h2>
	<% else %>
	<h2><%= raw Gettext.dpgettext("static_pages", "status interact header", "Interacting with %{nickname}'s %{status_link}", nickname: safe_to_string(html_escape(@nickname)), status_link: safe_to_string(link(Gettext.dpgettext("static_pages", "status interact header - status link text", "status"), to: @status_link))) %></h2>
	- <%= form_for @conn, Routes.util_path(@conn, :remote_subscribe), [as: "status"], fn f -> %>
	+ <%= form_for @conn, Routes.remote_interaction_path(@conn, :remote_subscribe), [as: "status"], fn f -> %>
	<%= hidden_input f, :status_id, value: @status_id %>
	<%= text_input f, :profile, placeholder: Gettext.dpgettext("static_pages", "placeholder text for account id", "Your account ID, e.g. lain@quitter.se") %>
	<%= submit Gettext.dpgettext("static_pages", "status interact authorization button", "Interact") %>
	<% end %>
	<% end %>
	diff --git a/lib/pleroma/web/templates/twitter_api/util/subscribe.html.eex b/lib/pleroma/web/templates/remote_interaction/remote_interaction/subscribe.html.eex
	similarity index 85%
	rename from lib/pleroma/web/templates/twitter_api/util/subscribe.html.eex
	rename to lib/pleroma/web/templates/remote_interaction/remote_interaction/subscribe.html.eex
	index 848660f26..7e1dd723c 100644
	--- a/lib/pleroma/web/templates/twitter_api/util/subscribe.html.eex
	+++ b/lib/pleroma/web/templates/remote_interaction/remote_interaction/subscribe.html.eex
	@@ -1,10 +1,10 @@
	<%= if @error do %>
	<h2><%= Gettext.dpgettext("static_pages", "remote follow error", "Error: %{error}", error: @error) %></h2>
	<% else %>
	<h2><%= Gettext.dpgettext("static_pages", "remote follow header", "Remotely follow %{nickname}", nickname: @nickname) %></h2>
	- <%= form_for @conn, Routes.util_path(@conn, :remote_subscribe), [as: "user"], fn f -> %>
	+ <%= form_for @conn, Routes.remote_interaction_path(@conn, :remote_subscribe), [as: "user"], fn f -> %>
	<%= hidden_input f, :nickname, value: @nickname %>
	<%= text_input f, :profile, placeholder: Gettext.dpgettext("static_pages", "placeholder text for account id", "Your account ID, e.g. lain@quitter.se") %>
	<%= submit Gettext.dpgettext("static_pages", "remote follow authorization button for following with a remote account", "Follow") %>
	<% end %>
	<% end %>
	diff --git a/lib/pleroma/web/twitter_api/views/util_view.ex b/lib/pleroma/web/twitter_api/views/util_view.ex
	deleted file mode 100644
	index 31b7c0c0c..000000000
	--- a/lib/pleroma/web/twitter_api/views/util_view.ex
	+++ /dev/null
	@@ -1,31 +0,0 @@
	-# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	-# SPDX-License-Identifier: AGPL-3.0-only
	-
	-defmodule Pleroma.Web.TwitterAPI.UtilView do
	- use Pleroma.Web, :view
	- import Phoenix.HTML
	- import Phoenix.HTML.Form
	- import Phoenix.HTML.Link
	- alias Pleroma.Config
	- alias Pleroma.Web.Endpoint
	- alias Pleroma.Web.Gettext
	-
	- def status_net_config(instance) do
	- """
	- <config>
	- <site>
	- <name>#{Keyword.get(instance, :name)}</name>
	- <site>#{Endpoint.url()}</site>
	- <textlimit>#{Keyword.get(instance, :limit)}</textlimit>
	- <closed>#{!Keyword.get(instance, :registrations_open)}</closed>
	- </site>
	- </config>
	- """
	- end
	-
	- def render("frontend_configurations.json", _) do
	- Config.get(:frontend_configurations, %{})
	- \|> Enum.into(%{})
	- end
	-end
	diff --git a/test/pleroma/web/twitter_api/password_controller_test.exs b/test/pleroma/web/o_auth/password_controller_test.exs
	similarity index 99%
	rename from test/pleroma/web/twitter_api/password_controller_test.exs
	rename to test/pleroma/web/o_auth/password_controller_test.exs
	index 26cca1345..bb61b24fd 100644
	--- a/test/pleroma/web/twitter_api/password_controller_test.exs
	+++ b/test/pleroma/web/o_auth/password_controller_test.exs
	@@ -1,213 +1,213 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.PasswordControllerTest do
	+defmodule Pleroma.Web.OAuth.PasswordControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.Config
	alias Pleroma.PasswordResetToken
	alias Pleroma.Repo
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token
	import Pleroma.Factory
	import Swoosh.TestAssertions

	describe "GET /api/pleroma/password_reset/token" do
	test "it returns error when token invalid", %{conn: conn} do
	response =
	conn
	\|> get("/api/pleroma/password_reset/token")
	\|> html_response(:ok)

	assert response =~ "<h2>Invalid Token</h2>"
	end

	test "it shows password reset form", %{conn: conn} do
	user = insert(:user)
	{:ok, token} = PasswordResetToken.create_token(user)

	response =
	conn
	\|> get("/api/pleroma/password_reset/#{token.token}")
	\|> html_response(:ok)

	assert response =~ "<h2>Password Reset for #{user.nickname}</h2>"
	end

	test "it returns an error when the token has expired", %{conn: conn} do
	clear_config([:instance, :password_reset_token_validity], 0)

	user = insert(:user)
	{:ok, token} = PasswordResetToken.create_token(user)
	{:ok, token} = time_travel(token, -2)

	response =
	conn
	\|> get("/api/pleroma/password_reset/#{token.token}")
	\|> html_response(:ok)

	assert response =~ "<h2>Invalid Token</h2>"
	end
	end

	describe "POST /api/pleroma/password_reset" do
	test "it fails for an expired token", %{conn: conn} do
	clear_config([:instance, :password_reset_token_validity], 0)

	user = insert(:user)
	{:ok, token} = PasswordResetToken.create_token(user)
	{:ok, token} = time_travel(token, -2)
	{:ok, _access_token} = Token.create(insert(:oauth_app), user, %{})

	params = %{
	"password" => "test",
	password_confirmation: "test",
	token: token.token
	}

	response =
	conn
	\|> assign(:user, user)
	\|> post("/api/pleroma/password_reset", %{data: params})
	\|> html_response(:ok)

	refute response =~ "<h2>Password changed!</h2>"
	end

	test "it returns HTTP 200", %{conn: conn} do
	user = insert(:user)
	{:ok, token} = PasswordResetToken.create_token(user)
	{:ok, _access_token} = Token.create(insert(:oauth_app), user, %{})

	params = %{
	"password" => "test",
	password_confirmation: "test",
	token: token.token
	}

	response =
	conn
	\|> assign(:user, user)
	\|> post("/api/pleroma/password_reset", %{data: params})
	\|> html_response(:ok)

	assert response =~ "<h2>Password changed!</h2>"

	user = refresh_record(user)
	assert Pleroma.Password.Pbkdf2.verify_pass("test", user.password_hash)
	assert Enum.empty?(Token.get_user_tokens(user))
	end

	test "it sets password_reset_pending to false", %{conn: conn} do
	user = insert(:user, password_reset_pending: true)

	{:ok, token} = PasswordResetToken.create_token(user)
	{:ok, _access_token} = Token.create(insert(:oauth_app), user, %{})

	params = %{
	"password" => "test",
	password_confirmation: "test",
	token: token.token
	}

	conn
	\|> assign(:user, user)
	\|> post("/api/pleroma/password_reset", %{data: params})
	\|> html_response(:ok)

	assert User.get_by_id(user.id).password_reset_pending == false
	end
	end

	describe "POST /auth/password, with valid parameters" do
	setup %{conn: conn} do
	user = insert(:user)
	conn = post(conn, "/auth/password?email=#{user.email}")
	%{conn: conn, user: user}
	end

	test "it returns 204", %{conn: conn} do
	assert empty_json_response(conn)
	end

	test "it creates a PasswordResetToken record for user", %{user: user} do
	token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)
	assert token_record
	end

	test "it sends an email to user", %{user: user} do
	ObanHelpers.perform_all()
	token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)

	email = Pleroma.Emails.UserEmail.password_reset_email(user, token_record.token)
	notify_email = Config.get([:instance, :notify_email])
	instance_name = Config.get([:instance, :name])

	assert_email_sent(
	from: {instance_name, notify_email},
	to: {user.name, user.email},
	html_body: email.html_body
	)
	end
	end

	describe "POST /auth/password, with nickname" do
	test "it returns 204", %{conn: conn} do
	user = insert(:user)

	assert conn
	\|> post("/auth/password?nickname=#{user.nickname}")
	\|> empty_json_response()

	ObanHelpers.perform_all()
	token_record = Repo.get_by(Pleroma.PasswordResetToken, user_id: user.id)

	email = Pleroma.Emails.UserEmail.password_reset_email(user, token_record.token)
	notify_email = Config.get([:instance, :notify_email])
	instance_name = Config.get([:instance, :name])

	assert_email_sent(
	from: {instance_name, notify_email},
	to: {user.name, user.email},
	html_body: email.html_body
	)
	end

	test "it doesn't fail when a user has no email", %{conn: conn} do
	user = insert(:user, %{email: nil})

	assert conn
	\|> post("/auth/password?nickname=#{user.nickname}")
	\|> empty_json_response()
	end
	end

	describe "POST /auth/password, with invalid parameters" do
	setup do
	user = insert(:user)
	{:ok, user: user}
	end

	test "it returns 204 when user is not found", %{conn: conn, user: user} do
	conn = post(conn, "/auth/password?email=nonexisting_#{user.email}")

	assert empty_json_response(conn)
	end

	test "it returns 204 when user is not local", %{conn: conn, user: user} do
	{:ok, user} = Repo.update(Ecto.Changeset.change(user, local: false))
	conn = post(conn, "/auth/password?email=#{user.email}")

	assert empty_json_response(conn)
	end

	test "it returns 204 when user is deactivated", %{conn: conn, user: user} do
	{:ok, user} = Repo.update(Ecto.Changeset.change(user, is_active: false, local: true))
	conn = post(conn, "/auth/password?email=#{user.email}")

	assert empty_json_response(conn)
	end
	end
	end
	diff --git a/test/pleroma/web/twitter_api/controller_test.exs b/test/pleroma/web/o_auth/token_controller_test.exs
	similarity index 97%
	rename from test/pleroma/web/twitter_api/controller_test.exs
	rename to test/pleroma/web/o_auth/token_controller_test.exs
	index 494be9ec7..5c64cb394 100644
	--- a/test/pleroma/web/twitter_api/controller_test.exs
	+++ b/test/pleroma/web/o_auth/token_controller_test.exs
	@@ -1,87 +1,87 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.ControllerTest do
	+defmodule Pleroma.Web.OAuth.TokenControllerTest do
	use Pleroma.Web.ConnCase, async: true

	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token

	import Pleroma.Factory

	describe "GET /api/account/confirm_email/:id/:token" do
	setup do
	{:ok, user} =
	insert(:user)
	\|> User.confirmation_changeset(set_confirmation: false)
	\|> Repo.update()

	refute user.is_confirmed

	[user: user]
	end

	test "it redirects to root url", %{conn: conn, user: user} do
	conn = get(conn, "/api/account/confirm_email/#{user.id}/#{user.confirmation_token}")

	assert 302 == conn.status
	end

	test "it confirms the user account", %{conn: conn, user: user} do
	get(conn, "/api/account/confirm_email/#{user.id}/#{user.confirmation_token}")

	user = User.get_cached_by_id(user.id)

	assert user.is_confirmed
	refute user.confirmation_token
	end

	test "it returns 500 if user cannot be found by id", %{conn: conn, user: user} do
	conn = get(conn, "/api/account/confirm_email/0/#{user.confirmation_token}")

	assert 500 == conn.status
	end

	test "it returns 500 if token is invalid", %{conn: conn, user: user} do
	conn = get(conn, "/api/account/confirm_email/#{user.id}/wrong_token")

	assert 500 == conn.status
	end
	end

	describe "GET /api/oauth_tokens" do
	setup do
	token = insert(:oauth_token) \|> Repo.preload(:user)

	%{token: token}
	end

	test "renders list", %{token: token} do
	response =
	build_conn()
	\|> assign(:user, token.user)
	\|> get("/api/oauth_tokens")

	keys =
	json_response(response, 200)
	\|> hd()
	\|> Map.keys()

	assert Enum.sort(keys) == Enum.sort(["id", "app_name", "valid_until", "scopes"])
	end

	test "revoke token", %{token: token} do
	response =
	build_conn()
	\|> assign(:user, token.user)
	\|> delete("/api/oauth_tokens/#{token.id}")

	tokens = Token.get_user_tokens(token.user)

	assert tokens == []
	assert response.status == 201
	end
	end
	end
	diff --git a/test/pleroma/web/twitter_api/util_controller_test.exs b/test/pleroma/web/pleroma_api/controllers/util_controller_test.exs
	similarity index 85%
	rename from test/pleroma/web/twitter_api/util_controller_test.exs
	rename to test/pleroma/web/pleroma_api/controllers/util_controller_test.exs
	index d06ae71aa..6e817df56 100644
	--- a/test/pleroma/web/twitter_api/util_controller_test.exs
	+++ b/test/pleroma/web/pleroma_api/controllers/util_controller_test.exs
	@@ -1,982 +1,835 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.UtilControllerTest do
	+defmodule Pleroma.Web.PleromaAPI.UtilControllerTest do
	use Pleroma.Web.ConnCase
	use Oban.Testing, repo: Pleroma.Repo

	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User

	import Pleroma.Factory
	import Mock

	setup do
	Tesla.Mock.mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	setup do: clear_config([:instance])
	setup do: clear_config([:frontend_configurations, :pleroma_fe])

	describe "PUT /api/pleroma/notification_settings" do
	setup do: oauth_access(["write:accounts"])

	test "it updates notification settings", %{user: user, conn: conn} do
	conn
	\|> put(
	"/api/pleroma/notification_settings?#{URI.encode_query(%{block_from_strangers: true})}"
	)
	\|> json_response_and_validate_schema(:ok)

	user = refresh_record(user)

	assert %Pleroma.User.NotificationSetting{
	block_from_strangers: true,
	hide_notification_contents: false
	} == user.notification_settings
	end

	test "it updates notification settings to enable hiding contents", %{user: user, conn: conn} do
	conn
	\|> put(
	"/api/pleroma/notification_settings?#{URI.encode_query(%{hide_notification_contents: 1})}"
	)
	\|> json_response_and_validate_schema(:ok)

	user = refresh_record(user)

	assert %Pleroma.User.NotificationSetting{
	block_from_strangers: false,
	hide_notification_contents: true
	} == user.notification_settings
	end
	end

	describe "GET /api/pleroma/frontend_configurations" do
	test "returns everything in :pleroma, :frontend_configurations", %{conn: conn} do
	config = [
	frontend_a: %{
	x: 1,
	y: 2
	},
	frontend_b: %{
	z: 3
	}
	]

	clear_config(:frontend_configurations, config)

	response =
	conn
	\|> get("/api/pleroma/frontend_configurations")
	\|> json_response_and_validate_schema(:ok)

	assert response == Jason.encode!(config \|> Enum.into(%{})) \|> Jason.decode!()
	end
	end

	describe "/api/pleroma/emoji" do
	test "returns json with custom emoji with tags", %{conn: conn} do
	emoji =
	conn
	\|> get("/api/pleroma/emoji")
	\|> json_response_and_validate_schema(200)

	assert Enum.all?(emoji, fn
	{_key,
	%{
	"image_url" => url,
	"tags" => tags
	}} ->
	is_binary(url) and is_list(tags)
	end)
	end
	end

	describe "GET /api/pleroma/healthcheck" do
	setup do: clear_config([:instance, :healthcheck])

	test "returns 503 when healthcheck disabled", %{conn: conn} do
	clear_config([:instance, :healthcheck], false)

	response =
	conn
	\|> get("/api/pleroma/healthcheck")
	\|> json_response_and_validate_schema(503)

	assert response == %{"error" => "Healthcheck disabled"}
	end

	test "returns 200 when healthcheck enabled and all ok", %{conn: conn} do
	clear_config([:instance, :healthcheck], true)

	with_mock Pleroma.Healthcheck,
	system_info: fn -> %Pleroma.Healthcheck{healthy: true} end do
	response =
	conn
	\|> get("/api/pleroma/healthcheck")
	\|> json_response_and_validate_schema(200)

	assert %{
	"active" => _,
	"healthy" => true,
	"idle" => _,
	"memory_used" => _,
	"pool_size" => _
	} = response
	end
	end

	test "returns 503 when healthcheck enabled and health is false", %{conn: conn} do
	clear_config([:instance, :healthcheck], true)

	with_mock Pleroma.Healthcheck,
	system_info: fn -> %Pleroma.Healthcheck{healthy: false} end do
	response =
	conn
	\|> get("/api/pleroma/healthcheck")
	\|> json_response_and_validate_schema(503)

	assert %{
	"active" => _,
	"healthy" => false,
	"idle" => _,
	"memory_used" => _,
	"pool_size" => _
	} = response
	end
	end
	end

	describe "POST /api/pleroma/disable_account" do
	setup do: oauth_access(["write:accounts"])

	test "with valid permissions and password, it disables the account", %{conn: conn, user: user} do
	response =
	conn
	\|> post("/api/pleroma/disable_account?password=test")
	\|> json_response_and_validate_schema(:ok)

	assert response == %{"status" => "success"}
	ObanHelpers.perform_all()

	user = User.get_cached_by_id(user.id)

	refute user.is_active
	end

	test "with valid permissions and invalid password, it returns an error", %{conn: conn} do
	user = insert(:user)

	response =
	conn
	\|> post("/api/pleroma/disable_account?password=test1")
	\|> json_response_and_validate_schema(:ok)

	assert response == %{"error" => "Invalid password."}
	user = User.get_cached_by_id(user.id)

	assert user.is_active
	end
	end

	- describe "POST /main/ostatus - remote_subscribe/2" do
	- setup do: clear_config([:instance, :federating], true)
	-
	- test "renders subscribe form", %{conn: conn} do
	- user = insert(:user)
	-
	- response =
	- conn
	- \|> post("/main/ostatus", %{"nickname" => user.nickname, "profile" => ""})
	- \|> response(:ok)
	-
	- refute response =~ "Could not find user"
	- assert response =~ "Remotely follow #{user.nickname}"
	- end
	-
	- test "renders subscribe form with error when user not found", %{conn: conn} do
	- response =
	- conn
	- \|> post("/main/ostatus", %{"nickname" => "nickname", "profile" => ""})
	- \|> response(:ok)
	-
	- assert response =~ "Could not find user"
	- refute response =~ "Remotely follow"
	- end
	-
	- test "it redirect to webfinger url", %{conn: conn} do
	- user = insert(:user)
	- user2 = insert(:user, ap_id: "shp@social.heldscal.la")
	-
	- conn =
	- conn
	- \|> post("/main/ostatus", %{
	- "user" => %{"nickname" => user.nickname, "profile" => user2.ap_id}
	- })
	-
	- assert redirected_to(conn) ==
	- "https://social.heldscal.la/main/ostatussub?profile=#{user.ap_id}"
	- end
	-
	- test "it renders form with error when user not found", %{conn: conn} do
	- user2 = insert(:user, ap_id: "shp@social.heldscal.la")
	-
	- response =
	- conn
	- \|> post("/main/ostatus", %{"user" => %{"nickname" => "jimm", "profile" => user2.ap_id}})
	- \|> response(:ok)
	-
	- assert response =~ "Something went wrong."
	- end
	- end
	-
	- describe "POST /main/ostatus - remote_subscribe/2 - with statuses" do
	- setup do: clear_config([:instance, :federating], true)
	-
	- test "renders subscribe form", %{conn: conn} do
	- user = insert(:user)
	- status = insert(:note_activity, %{user: user})
	- status_id = status.id
	-
	- assert is_binary(status_id)
	-
	- response =
	- conn
	- \|> post("/main/ostatus", %{"status_id" => status_id, "profile" => ""})
	- \|> response(:ok)
	-
	- refute response =~ "Could not find status"
	- assert response =~ "Interacting with"
	- end
	-
	- test "renders subscribe form with error when status not found", %{conn: conn} do
	- response =
	- conn
	- \|> post("/main/ostatus", %{"status_id" => "somerandomid", "profile" => ""})
	- \|> response(:ok)
	-
	- assert response =~ "Could not find status"
	- refute response =~ "Interacting with"
	- end
	-
	- test "it redirect to webfinger url", %{conn: conn} do
	- user = insert(:user)
	- status = insert(:note_activity, %{user: user})
	- status_id = status.id
	- status_ap_id = status.data["object"]
	-
	- assert is_binary(status_id)
	- assert is_binary(status_ap_id)
	-
	- user2 = insert(:user, ap_id: "shp@social.heldscal.la")
	-
	- conn =
	- conn
	- \|> post("/main/ostatus", %{
	- "status" => %{"status_id" => status_id, "profile" => user2.ap_id}
	- })
	-
	- assert redirected_to(conn) ==
	- "https://social.heldscal.la/main/ostatussub?profile=#{status_ap_id}"
	- end
	-
	- test "it renders form with error when status not found", %{conn: conn} do
	- user2 = insert(:user, ap_id: "shp@social.heldscal.la")
	-
	- response =
	- conn
	- \|> post("/main/ostatus", %{
	- "status" => %{"status_id" => "somerandomid", "profile" => user2.ap_id}
	- })
	- \|> response(:ok)
	-
	- assert response =~ "Something went wrong."
	- end
	- end
	-
	- describe "GET /main/ostatus - show_subscribe_form/2" do
	- setup do: clear_config([:instance, :federating], true)
	-
	- test "it works with users", %{conn: conn} do
	- user = insert(:user)
	-
	- response =
	- conn
	- \|> get("/main/ostatus", %{"nickname" => user.nickname})
	- \|> response(:ok)
	-
	- refute response =~ "Could not find user"
	- assert response =~ "Remotely follow #{user.nickname}"
	- end
	-
	- test "it works with statuses", %{conn: conn} do
	- user = insert(:user)
	- status = insert(:note_activity, %{user: user})
	- status_id = status.id
	-
	- assert is_binary(status_id)
	-
	- response =
	- conn
	- \|> get("/main/ostatus", %{"status_id" => status_id})
	- \|> response(:ok)
	-
	- refute response =~ "Could not find status"
	- assert response =~ "Interacting with"
	- end
	- end
	-
	test "it returns new captcha", %{conn: conn} do
	with_mock Pleroma.Captcha,
	new: fn -> "test_captcha" end do
	resp =
	conn
	\|> get("/api/pleroma/captcha")
	\|> response(200)

	assert resp == "\"test_captcha\""
	assert called(Pleroma.Captcha.new())
	end
	end

	describe "POST /api/pleroma/change_email" do
	setup do: oauth_access(["write:accounts"])

	test "without permissions", %{conn: conn} do
	conn =
	conn
	\|> assign(:token, nil)
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_email", %{password: "hi", email: "test@test.com"})

	assert json_response_and_validate_schema(conn, 403) == %{
	"error" => "Insufficient permissions: write:accounts."
	}
	end

	test "with proper permissions and invalid password", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_email", %{password: "hi", email: "test@test.com"})

	assert json_response_and_validate_schema(conn, 200) == %{"error" => "Invalid password."}
	end

	test "with proper permissions, valid password and invalid email", %{
	conn: conn
	} do
	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_email", %{password: "test", email: "foobar"})

	assert json_response_and_validate_schema(conn, 200) == %{
	"error" => "Email has invalid format."
	}
	end

	test "with proper permissions, valid password and no email", %{
	conn: conn
	} do
	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_email", %{password: "test"})

	assert %{"error" => "Missing field: email."} = json_response_and_validate_schema(conn, 400)
	end

	test "with proper permissions, valid password and blank email, when instance requires user email",
	%{
	conn: conn
	} do
	orig_account_activation_required =
	Pleroma.Config.get([:instance, :account_activation_required])

	Pleroma.Config.put([:instance, :account_activation_required], true)

	on_exit(fn ->
	Pleroma.Config.put(
	[:instance, :account_activation_required],
	orig_account_activation_required
	)
	end)

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_email", %{password: "test", email: ""})

	assert json_response_and_validate_schema(conn, 200) == %{"error" => "Email can't be blank."}
	end

	test "with proper permissions, valid password and blank email, when instance does not require user email",
	%{
	conn: conn
	} do
	orig_account_activation_required =
	Pleroma.Config.get([:instance, :account_activation_required])

	Pleroma.Config.put([:instance, :account_activation_required], false)

	on_exit(fn ->
	Pleroma.Config.put(
	[:instance, :account_activation_required],
	orig_account_activation_required
	)
	end)

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_email", %{password: "test", email: ""})

	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}
	end

	test "with proper permissions, valid password and non unique email", %{
	conn: conn
	} do
	user = insert(:user)

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_email", %{password: "test", email: user.email})

	assert json_response_and_validate_schema(conn, 200) == %{
	"error" => "Email has already been taken."
	}
	end

	test "with proper permissions, valid password and valid email", %{
	conn: conn
	} do
	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_email", %{password: "test", email: "cofe@foobar.com"})

	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}
	end
	end

	describe "POST /api/pleroma/change_password" do
	setup do: oauth_access(["write:accounts"])

	test "without permissions", %{conn: conn} do
	conn =
	conn
	\|> assign(:token, nil)
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_password", %{
	"password" => "hi",
	"new_password" => "newpass",
	"new_password_confirmation" => "newpass"
	})

	assert json_response_and_validate_schema(conn, 403) == %{
	"error" => "Insufficient permissions: write:accounts."
	}
	end

	test "with proper permissions and invalid password", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_password", %{
	"password" => "hi",
	"new_password" => "newpass",
	"new_password_confirmation" => "newpass"
	})

	assert json_response_and_validate_schema(conn, 200) == %{"error" => "Invalid password."}
	end

	test "with proper permissions, valid password and new password and confirmation not matching",
	%{
	conn: conn
	} do
	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_password", %{
	"password" => "test",
	"new_password" => "newpass",
	"new_password_confirmation" => "notnewpass"
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"error" => "New password does not match confirmation."
	}
	end

	test "with proper permissions, valid password and invalid new password", %{
	conn: conn
	} do
	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/change_password", %{
	password: "test",
	new_password: "",
	new_password_confirmation: ""
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"error" => "New password can't be blank."
	}
	end

	test "with proper permissions, valid password and matching new password and confirmation", %{
	conn: conn,
	user: user
	} do
	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post(
	"/api/pleroma/change_password",
	%{
	password: "test",
	new_password: "newpass",
	new_password_confirmation: "newpass"
	}
	)

	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}
	fetched_user = User.get_cached_by_id(user.id)
	assert Pleroma.Password.Pbkdf2.verify_pass("newpass", fetched_user.password_hash) == true
	end
	end

	describe "POST /api/pleroma/delete_account" do
	setup do: oauth_access(["write:accounts"])

	test "without permissions", %{conn: conn} do
	conn =
	conn
	\|> assign(:token, nil)
	\|> post("/api/pleroma/delete_account")

	assert json_response_and_validate_schema(conn, 403) ==
	%{"error" => "Insufficient permissions: write:accounts."}
	end

	test "with proper permissions and wrong or missing password", %{conn: conn} do
	for params <- [%{"password" => "hi"}, %{}] do
	ret_conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/delete_account", params)

	assert json_response_and_validate_schema(ret_conn, 200) == %{
	"error" => "Invalid password."
	}
	end
	end

	test "with proper permissions and valid password (URL query)", %{conn: conn, user: user} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/delete_account?password=test")

	ObanHelpers.perform_all()
	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}

	user = User.get_by_id(user.id)
	refute user.is_active
	assert user.name == nil
	assert user.bio == ""
	assert user.password_hash == nil
	end

	test "with proper permissions and valid password (JSON body)", %{conn: conn, user: user} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/delete_account", %{password: "test"})

	ObanHelpers.perform_all()
	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}

	user = User.get_by_id(user.id)
	refute user.is_active
	assert user.name == nil
	assert user.bio == ""
	assert user.password_hash == nil
	end
	end

	describe "POST /api/pleroma/move_account" do
	setup do: oauth_access(["write:accounts"])

	test "without permissions", %{conn: conn} do
	target_user = insert(:user)
	target_nick = target_user \|> User.full_nickname()

	conn =
	conn
	\|> assign(:token, nil)
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/move_account", %{
	"password" => "hi",
	"target_account" => target_nick
	})

	assert json_response_and_validate_schema(conn, 403) == %{
	"error" => "Insufficient permissions: write:accounts."
	}
	end

	test "with proper permissions and invalid password", %{conn: conn} do
	target_user = insert(:user)
	target_nick = target_user \|> User.full_nickname()

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/move_account", %{
	"password" => "hi",
	"target_account" => target_nick
	})

	assert json_response_and_validate_schema(conn, 200) == %{"error" => "Invalid password."}
	end

	test "with proper permissions, valid password and target account does not alias it",
	%{
	conn: conn
	} do
	target_user = insert(:user)
	target_nick = target_user \|> User.full_nickname()

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/move_account", %{
	"password" => "test",
	"target_account" => target_nick
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"error" => "Target account must have the origin in `alsoKnownAs`"
	}
	end

	test "with proper permissions, valid password and target account does not exist",
	%{
	conn: conn
	} do
	target_nick = "not_found@mastodon.social"

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/move_account", %{
	"password" => "test",
	"target_account" => target_nick
	})

	assert json_response_and_validate_schema(conn, 404) == %{
	"error" => "Target account not found."
	}
	end

	test "with proper permissions, valid password, remote target account aliases it and local cache does not exist",
	%{} do
	user = insert(:user, ap_id: "https://lm.kazv.moe/users/testuser")
	%{user: _user, conn: conn} = oauth_access(["write:accounts"], user: user)

	target_nick = "mewmew@lm.kazv.moe"

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/move_account", %{
	"password" => "test",
	"target_account" => target_nick
	})

	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}
	end

	test "with proper permissions, valid password, remote target account aliases it and local cache does not aliases it",
	%{} do
	user = insert(:user, ap_id: "https://lm.kazv.moe/users/testuser")
	%{user: _user, conn: conn} = oauth_access(["write:accounts"], user: user)

	target_user =
	insert(
	:user,
	ap_id: "https://lm.kazv.moe/users/mewmew",
	nickname: "mewmew@lm.kazv.moe",
	local: false
	)

	target_nick = target_user \|> User.full_nickname()

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/move_account", %{
	"password" => "test",
	"target_account" => target_nick
	})

	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}
	end

	test "with proper permissions, valid password, remote target account does not aliases it and local cache aliases it",
	%{
	user: user,
	conn: conn
	} do
	target_user =
	insert(
	:user,
	ap_id: "https://lm.kazv.moe/users/mewmew",
	nickname: "mewmew@lm.kazv.moe",
	local: false,
	also_known_as: [user.ap_id]
	)

	target_nick = target_user \|> User.full_nickname()

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post("/api/pleroma/move_account", %{
	"password" => "test",
	"target_account" => target_nick
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"error" => "Target account must have the origin in `alsoKnownAs`"
	}
	end

	test "with proper permissions, valid password and target account aliases it", %{
	conn: conn,
	user: user
	} do
	target_user = insert(:user, also_known_as: [user.ap_id])
	target_nick = target_user \|> User.full_nickname()
	follower = insert(:user)

	User.follow(follower, user)

	assert User.following?(follower, user)

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post(
	"/api/pleroma/move_account",
	%{
	password: "test",
	target_account: target_nick
	}
	)

	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}

	params = %{
	"op" => "move_following",
	"origin_id" => user.id,
	"target_id" => target_user.id
	}

	assert_enqueued(worker: Pleroma.Workers.BackgroundWorker, args: params)

	Pleroma.Workers.BackgroundWorker.perform(%Oban.Job{args: params})

	refute User.following?(follower, user)
	assert User.following?(follower, target_user)
	end

	test "prefix nickname by @ should work", %{
	conn: conn,
	user: user
	} do
	target_user = insert(:user, also_known_as: [user.ap_id])
	target_nick = target_user \|> User.full_nickname()
	follower = insert(:user)

	User.follow(follower, user)

	assert User.following?(follower, user)

	conn =
	conn
	\|> put_req_header("content-type", "multipart/form-data")
	\|> post(
	"/api/pleroma/move_account",
	%{
	password: "test",
	target_account: "@" <> target_nick
	}
	)

	assert json_response_and_validate_schema(conn, 200) == %{"status" => "success"}

	params = %{
	"op" => "move_following",
	"origin_id" => user.id,
	"target_id" => target_user.id
	}

	assert_enqueued(worker: Pleroma.Workers.BackgroundWorker, args: params)

	Pleroma.Workers.BackgroundWorker.perform(%Oban.Job{args: params})

	refute User.following?(follower, user)
	assert User.following?(follower, target_user)
	end
	end

	describe "GET /api/pleroma/aliases" do
	setup do: oauth_access(["read:accounts"])

	test "without permissions", %{conn: conn} do
	conn =
	conn
	\|> assign(:token, nil)
	\|> get("/api/pleroma/aliases")

	assert json_response_and_validate_schema(conn, 403) == %{
	"error" => "Insufficient permissions: read:accounts."
	}
	end

	test "with permissions", %{
	conn: conn
	} do
	assert %{"aliases" => []} =
	conn
	\|> get("/api/pleroma/aliases")
	\|> json_response_and_validate_schema(200)
	end

	test "with permissions and aliases", %{} do
	user = insert(:user)
	user2 = insert(:user)

	assert {:ok, user} = user \|> User.add_alias(user2)

	%{user: _user, conn: conn} = oauth_access(["read:accounts"], user: user)

	assert %{"aliases" => aliases} =
	conn
	\|> get("/api/pleroma/aliases")
	\|> json_response_and_validate_schema(200)

	assert aliases == [user2 \|> User.full_nickname()]
	end
	end

	describe "PUT /api/pleroma/aliases" do
	setup do: oauth_access(["write:accounts"])

	test "without permissions", %{conn: conn} do
	conn =
	conn
	\|> assign(:token, nil)
	\|> put_req_header("content-type", "application/json")
	\|> put("/api/pleroma/aliases", %{alias: "none"})

	assert json_response_and_validate_schema(conn, 403) == %{
	"error" => "Insufficient permissions: write:accounts."
	}
	end

	test "with permissions, no alias param", %{
	conn: conn
	} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> put("/api/pleroma/aliases", %{})

	assert %{"error" => "Missing field: alias."} = json_response_and_validate_schema(conn, 400)
	end

	test "with permissions, with alias param", %{
	conn: conn
	} do
	user2 = insert(:user)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> put("/api/pleroma/aliases", %{alias: user2 \|> User.full_nickname()})

	assert json_response_and_validate_schema(conn, 200) == %{
	"status" => "success"
	}
	end
	end

	describe "DELETE /api/pleroma/aliases" do
	setup do
	alias_user = insert(:user)
	non_alias_user = insert(:user)
	user = insert(:user, also_known_as: [alias_user.ap_id])

	oauth_access(["write:accounts"], user: user)
	\|> Map.put(:alias_user, alias_user)
	\|> Map.put(:non_alias_user, non_alias_user)
	end

	test "without permissions", %{conn: conn} do
	conn =
	conn
	\|> assign(:token, nil)
	\|> put_req_header("content-type", "application/json")
	\|> delete("/api/pleroma/aliases", %{alias: "none"})

	assert json_response_and_validate_schema(conn, 403) == %{
	"error" => "Insufficient permissions: write:accounts."
	}
	end

	test "with permissions, no alias param", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> delete("/api/pleroma/aliases", %{})

	assert %{"error" => "Missing field: alias."} = json_response_and_validate_schema(conn, 400)
	end

	test "with permissions, account does not have such alias", %{
	conn: conn,
	non_alias_user: non_alias_user
	} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> delete("/api/pleroma/aliases", %{alias: non_alias_user \|> User.full_nickname()})

	assert %{"error" => "Account has no such alias."} =
	json_response_and_validate_schema(conn, 404)
	end

	test "with permissions, account does have such alias", %{
	conn: conn,
	alias_user: alias_user
	} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> delete("/api/pleroma/aliases", %{alias: alias_user \|> User.full_nickname()})

	assert %{"status" => "success"} = json_response_and_validate_schema(conn, 200)
	end
	end
	end
	diff --git a/test/pleroma/web/twitter_api/twitter_api_test.exs b/test/pleroma/web/registration_test.exs
	similarity index 90%
	rename from test/pleroma/web/twitter_api/twitter_api_test.exs
	rename to test/pleroma/web/registration_test.exs
	index b3cd80146..896e1a600 100644
	--- a/test/pleroma/web/twitter_api/twitter_api_test.exs
	+++ b/test/pleroma/web/registration_test.exs
	@@ -1,424 +1,424 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.TwitterAPITest do
	+defmodule Pleroma.Web.RegistrationTest do
	use Pleroma.DataCase
	import Pleroma.Factory
	alias Pleroma.Repo
	alias Pleroma.Tests.ObanHelpers
	alias Pleroma.User
	alias Pleroma.UserInviteToken
	- alias Pleroma.Web.TwitterAPI.TwitterAPI
	+ alias Pleroma.Web.Registration

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	test "it registers a new user and returns the user." do
	data = %{
	:username => "lain",
	:email => "lain@wired.jp",
	:fullname => "lain iwakura",
	:password => "bear",
	:confirm => "bear"
	}

	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)

	assert user == User.get_cached_by_nickname("lain")
	end

	test "it registers a new user with empty string in bio and returns the user" do
	data = %{
	:username => "lain",
	:email => "lain@wired.jp",
	:fullname => "lain iwakura",
	:bio => "",
	:password => "bear",
	:confirm => "bear"
	}

	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)

	assert user == User.get_cached_by_nickname("lain")
	end

	test "it sends confirmation email if :account_activation_required is specified in instance config" do
	clear_config([:instance, :account_activation_required], true)

	data = %{
	:username => "lain",
	:email => "lain@wired.jp",
	:fullname => "lain iwakura",
	:bio => "",
	:password => "bear",
	:confirm => "bear"
	}

	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)
	ObanHelpers.perform_all()

	refute user.is_confirmed

	email = Pleroma.Emails.UserEmail.account_confirmation_email(user)

	notify_email = Pleroma.Config.get([:instance, :notify_email])
	instance_name = Pleroma.Config.get([:instance, :name])

	Swoosh.TestAssertions.assert_email_sent(
	from: {instance_name, notify_email},
	to: {user.name, user.email},
	html_body: email.html_body
	)
	end

	test "it sends an admin email if :account_approval_required is specified in instance config" do
	clear_config([:instance, :account_approval_required], true)

	admin = insert(:user, is_admin: true)

	data = %{
	:username => "lain",
	:email => "lain@wired.jp",
	:fullname => "lain iwakura",
	:bio => "",
	:password => "bear",
	:confirm => "bear",
	:reason => "I love anime"
	}

	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)
	ObanHelpers.perform_all()

	refute user.is_approved

	user_email = Pleroma.Emails.UserEmail.approval_pending_email(user)
	admin_email = Pleroma.Emails.AdminEmail.new_unapproved_registration(admin, user)

	notify_email = Pleroma.Config.get([:instance, :notify_email])
	instance_name = Pleroma.Config.get([:instance, :name])

	# User approval email
	Swoosh.TestAssertions.assert_email_sent(
	from: {instance_name, notify_email},
	to: {user.name, user.email},
	html_body: user_email.html_body
	)

	# Admin email
	Swoosh.TestAssertions.assert_email_sent(
	from: {instance_name, notify_email},
	to: {admin.name, admin.email},
	html_body: admin_email.html_body
	)
	end

	test "it registers a new user and parses mentions in the bio" do
	data1 = %{
	:username => "john",
	:email => "john@gmail.com",
	:fullname => "John Doe",
	:bio => "test",
	:password => "bear",
	:confirm => "bear"
	}

	- {:ok, user1} = TwitterAPI.register_user(data1)
	+ {:ok, user1} = Registration.register_user(data1)

	data2 = %{
	:username => "lain",
	:email => "lain@wired.jp",
	:fullname => "lain iwakura",
	:bio => "@john test",
	:password => "bear",
	:confirm => "bear"
	}

	- {:ok, user2} = TwitterAPI.register_user(data2)
	+ {:ok, user2} = Registration.register_user(data2)

	expected_text =
	~s(<span class="h-card"><a class="u-url mention" data-user="#{user1.id}" href="#{user1.ap_id}" rel="ugc">@<span>john</span></a></span> test)

	assert user2.bio == expected_text
	end

	describe "register with one time token" do
	setup do: clear_config([:instance, :registrations_open], false)

	test "returns user on success" do
	{:ok, invite} = UserInviteToken.create_invite()

	data = %{
	:username => "vinny",
	:email => "pasta@pizza.vs",
	:fullname => "Vinny Vinesauce",
	:bio => "streamer",
	:password => "hiptofbees",
	:confirm => "hiptofbees",
	:token => invite.token
	}

	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)

	assert user == User.get_cached_by_nickname("vinny")

	invite = Repo.get_by(UserInviteToken, token: invite.token)
	assert invite.used == true
	end

	test "returns error on invalid token" do
	data = %{
	:username => "GrimReaper",
	:email => "death@reapers.afterlife",
	:fullname => "Reaper Grim",
	:bio => "Your time has come",
	:password => "scythe",
	:confirm => "scythe",
	:token => "DudeLetMeInImAFairy"
	}

	- {:error, msg} = TwitterAPI.register_user(data)
	+ {:error, msg} = Registration.register_user(data)

	assert msg == "Invalid token"
	refute User.get_cached_by_nickname("GrimReaper")
	end

	test "returns error on expired token" do
	{:ok, invite} = UserInviteToken.create_invite()
	UserInviteToken.update_invite!(invite, used: true)

	data = %{
	:username => "GrimReaper",
	:email => "death@reapers.afterlife",
	:fullname => "Reaper Grim",
	:bio => "Your time has come",
	:password => "scythe",
	:confirm => "scythe",
	:token => invite.token
	}

	- {:error, msg} = TwitterAPI.register_user(data)
	+ {:error, msg} = Registration.register_user(data)

	assert msg == "Expired token"
	refute User.get_cached_by_nickname("GrimReaper")
	end
	end

	describe "registers with date limited token" do
	setup do: clear_config([:instance, :registrations_open], false)

	setup do
	data = %{
	:username => "vinny",
	:email => "pasta@pizza.vs",
	:fullname => "Vinny Vinesauce",
	:bio => "streamer",
	:password => "hiptofbees",
	:confirm => "hiptofbees"
	}

	check_fn = fn invite ->
	data = Map.put(data, :token, invite.token)
	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)

	assert user == User.get_cached_by_nickname("vinny")
	end

	{:ok, data: data, check_fn: check_fn}
	end

	test "returns user on success", %{check_fn: check_fn} do
	{:ok, invite} = UserInviteToken.create_invite(%{expires_at: Date.utc_today()})

	check_fn.(invite)

	invite = Repo.get_by(UserInviteToken, token: invite.token)

	refute invite.used
	end

	test "returns user on token which expired tomorrow", %{check_fn: check_fn} do
	{:ok, invite} = UserInviteToken.create_invite(%{expires_at: Date.add(Date.utc_today(), 1)})

	check_fn.(invite)

	invite = Repo.get_by(UserInviteToken, token: invite.token)

	refute invite.used
	end

	test "returns an error on overdue date", %{data: data} do
	{:ok, invite} = UserInviteToken.create_invite(%{expires_at: Date.add(Date.utc_today(), -1)})

	data = Map.put(data, "token", invite.token)

	- {:error, msg} = TwitterAPI.register_user(data)
	+ {:error, msg} = Registration.register_user(data)

	assert msg == "Expired token"
	refute User.get_cached_by_nickname("vinny")
	invite = Repo.get_by(UserInviteToken, token: invite.token)

	refute invite.used
	end
	end

	describe "registers with reusable token" do
	setup do: clear_config([:instance, :registrations_open], false)

	test "returns user on success, after him registration fails" do
	{:ok, invite} = UserInviteToken.create_invite(%{max_use: 100})

	UserInviteToken.update_invite!(invite, uses: 99)

	data = %{
	:username => "vinny",
	:email => "pasta@pizza.vs",
	:fullname => "Vinny Vinesauce",
	:bio => "streamer",
	:password => "hiptofbees",
	:confirm => "hiptofbees",
	:token => invite.token
	}

	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)
	assert user == User.get_cached_by_nickname("vinny")

	invite = Repo.get_by(UserInviteToken, token: invite.token)
	assert invite.used == true

	data = %{
	:username => "GrimReaper",
	:email => "death@reapers.afterlife",
	:fullname => "Reaper Grim",
	:bio => "Your time has come",
	:password => "scythe",
	:confirm => "scythe",
	:token => invite.token
	}

	- {:error, msg} = TwitterAPI.register_user(data)
	+ {:error, msg} = Registration.register_user(data)

	assert msg == "Expired token"
	refute User.get_cached_by_nickname("GrimReaper")
	end
	end

	describe "registers with reusable date limited token" do
	setup do: clear_config([:instance, :registrations_open], false)

	test "returns user on success" do
	{:ok, invite} = UserInviteToken.create_invite(%{expires_at: Date.utc_today(), max_use: 100})

	data = %{
	:username => "vinny",
	:email => "pasta@pizza.vs",
	:fullname => "Vinny Vinesauce",
	:bio => "streamer",
	:password => "hiptofbees",
	:confirm => "hiptofbees",
	:token => invite.token
	}

	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)
	assert user == User.get_cached_by_nickname("vinny")

	invite = Repo.get_by(UserInviteToken, token: invite.token)
	refute invite.used
	end

	test "error after max uses" do
	{:ok, invite} = UserInviteToken.create_invite(%{expires_at: Date.utc_today(), max_use: 100})

	UserInviteToken.update_invite!(invite, uses: 99)

	data = %{
	:username => "vinny",
	:email => "pasta@pizza.vs",
	:fullname => "Vinny Vinesauce",
	:bio => "streamer",
	:password => "hiptofbees",
	:confirm => "hiptofbees",
	:token => invite.token
	}

	- {:ok, user} = TwitterAPI.register_user(data)
	+ {:ok, user} = Registration.register_user(data)
	assert user == User.get_cached_by_nickname("vinny")

	invite = Repo.get_by(UserInviteToken, token: invite.token)
	assert invite.used == true

	data = %{
	:username => "GrimReaper",
	:email => "death@reapers.afterlife",
	:fullname => "Reaper Grim",
	:bio => "Your time has come",
	:password => "scythe",
	:confirm => "scythe",
	:token => invite.token
	}

	- {:error, msg} = TwitterAPI.register_user(data)
	+ {:error, msg} = Registration.register_user(data)

	assert msg == "Expired token"
	refute User.get_cached_by_nickname("GrimReaper")
	end

	test "returns error on overdue date" do
	{:ok, invite} =
	UserInviteToken.create_invite(%{expires_at: Date.add(Date.utc_today(), -1), max_use: 100})

	data = %{
	:username => "GrimReaper",
	:email => "death@reapers.afterlife",
	:fullname => "Reaper Grim",
	:bio => "Your time has come",
	:password => "scythe",
	:confirm => "scythe",
	:token => invite.token
	}

	- {:error, msg} = TwitterAPI.register_user(data)
	+ {:error, msg} = Registration.register_user(data)

	assert msg == "Expired token"
	refute User.get_cached_by_nickname("GrimReaper")
	end

	test "returns error on with overdue date and after max" do
	{:ok, invite} =
	UserInviteToken.create_invite(%{expires_at: Date.add(Date.utc_today(), -1), max_use: 100})

	UserInviteToken.update_invite!(invite, uses: 100)

	data = %{
	:username => "GrimReaper",
	:email => "death@reapers.afterlife",
	:fullname => "Reaper Grim",
	:bio => "Your time has come",
	:password => "scythe",
	:confirm => "scythe",
	:token => invite.token
	}

	- {:error, msg} = TwitterAPI.register_user(data)
	+ {:error, msg} = Registration.register_user(data)

	assert msg == "Expired token"
	refute User.get_cached_by_nickname("GrimReaper")
	end
	end

	test "it returns the error on registration problems" do
	data = %{
	:username => "lain",
	:email => "lain@wired.jp",
	:fullname => "lain iwakura",
	:bio => "close the world."
	}

	- {:error, error} = TwitterAPI.register_user(data)
	+ {:error, error} = Registration.register_user(data)

	assert is_binary(error)
	refute User.get_cached_by_nickname("lain")
	end
	end
	diff --git a/test/pleroma/web/twitter_api/remote_follow_controller_test.exs b/test/pleroma/web/remote_interaction/remote_interaction_controller_test.exs
	similarity index 68%
	rename from test/pleroma/web/twitter_api/remote_follow_controller_test.exs
	rename to test/pleroma/web/remote_interaction/remote_interaction_controller_test.exs
	index f762b1356..116609013 100644
	--- a/test/pleroma/web/twitter_api/remote_follow_controller_test.exs
	+++ b/test/pleroma/web/remote_interaction/remote_interaction_controller_test.exs
	@@ -1,497 +1,649 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	-defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
	+defmodule Pleroma.Web.RemoteInteraction.RemoteInteractionControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.MFA
	alias Pleroma.MFA.TOTP
	alias Pleroma.UnstubbedConfigMock, as: ConfigMock
	alias Pleroma.User
	alias Pleroma.Web.CommonAPI

	import Ecto.Query
	import ExUnit.CaptureLog
	import Mox
	import Pleroma.Factory

	+ setup do
	+ Tesla.Mock.mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
	+ :ok
	+ end
	+
	setup_all do: clear_config([:instance, :federating], true)
	setup do: clear_config([:user, :deny_follow_blocked])

	describe "GET /ostatus_subscribe - remote_follow/2" do
	test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/emelie/statuses/101849165031453009"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/status.emelie.json")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	File.read!("test/fixtures/users_mock/masto_featured.json")
	\|> String.replace("{{domain}}", "mastodon.social")
	\|> String.replace("{{nickname}}", "emelie")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/emelie.json")
	}
	end)

	assert conn
	\|> get(
	- remote_follow_path(conn, :follow, %{
	+ remote_interaction_path(conn, :follow, %{
	acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
	})
	)
	\|> redirected_to() =~ "/notice/"
	end

	test "show follow account page if the `acct` is a account link", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/emelie"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/emelie.json")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	File.read!("test/fixtures/users_mock/masto_featured.json")
	\|> String.replace("{{domain}}", "mastodon.social")
	\|> String.replace("{{nickname}}", "emelie")
	}
	end)

	response =
	conn
	- \|> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
	+ \|> get(remote_interaction_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
	\|> html_response(200)

	assert response =~ "Log in to follow"
	end

	test "show follow page if the `acct` is a account link", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/emelie"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/emelie.json")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	File.read!("test/fixtures/users_mock/masto_featured.json")
	\|> String.replace("{{domain}}", "mastodon.social")
	\|> String.replace("{{nickname}}", "emelie")
	}
	end)

	user = insert(:user)

	response =
	conn
	\|> assign(:user, user)
	- \|> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
	+ \|> get(remote_interaction_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
	\|> html_response(200)

	assert response =~ "Remote follow"
	end

	test "show follow page with error when user can not be fetched by `acct` link", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/not_found"} ->
	%Tesla.Env{
	status: 404
	}
	end)

	user = insert(:user)

	assert capture_log(fn ->
	response =
	conn
	\|> assign(:user, user)
	\|> get(
	- remote_follow_path(conn, :follow, %{
	+ remote_interaction_path(conn, :follow, %{
	acct: "https://mastodon.social/users/not_found"
	})
	)
	\|> html_response(200)

	assert response =~ "Error fetching user"
	end) =~ ":not_found"
	end
	end

	describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
	test "required `follow \| write:follows` scope", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)
	read_token = insert(:oauth_token, user: user, scopes: ["read"])

	assert capture_log(fn ->
	response =
	conn
	\|> assign(:user, user)
	\|> assign(:token, read_token)
	- \|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	+ \|> post(remote_interaction_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	\|> response(200)

	assert response =~ "Error following account"
	end) =~ "Insufficient permissions: follow \| write:follows."
	end

	test "follows user", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
	- \|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	+ \|> post(remote_interaction_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})

	assert redirected_to(conn) == "/users/#{user2.id}"
	end

	test "returns error when user is deactivated", %{conn: conn} do
	user = insert(:user, is_active: false)
	user2 = insert(:user)

	response =
	conn
	\|> assign(:user, user)
	- \|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	+ \|> post(remote_interaction_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	\|> response(200)

	assert response =~ "Error following account"
	end

	test "returns error when user is blocked", %{conn: conn} do
	clear_config([:user, :deny_follow_blocked], true)
	user = insert(:user)
	user2 = insert(:user)

	{:ok, _user_block} = Pleroma.User.block(user2, user)

	response =
	conn
	\|> assign(:user, user)
	- \|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	+ \|> post(remote_interaction_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	\|> response(200)

	assert response =~ "Error following account"
	end

	test "returns error when followee not found", %{conn: conn} do
	user = insert(:user)

	response =
	conn
	\|> assign(:user, user)
	- \|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
	+ \|> post(remote_interaction_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
	\|> response(200)

	assert response =~ "Error following account"
	end

	test "returns success result when user already in followers", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)
	{:ok, _, _, _} = CommonAPI.follow(user2, user)

	conn =
	conn
	\|> assign(:user, refresh_record(user))
	\|> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
	- \|> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
	+ \|> post(remote_interaction_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})

	assert redirected_to(conn) == "/users/#{user2.id}"
	end
	end

	describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
	test "render the MFA login form", %{conn: conn} do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	user2 = insert(:user)

	response =
	conn
	- \|> post(remote_follow_path(conn, :do_follow), %{
	+ \|> post(remote_interaction_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
	})
	\|> response(200)

	mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))

	assert response =~ "Two-factor authentication"
	assert response =~ "Authentication code"
	assert response =~ mfa_token.token
	refute user2.follower_address in User.following(user)
	end

	test "returns error when password is incorrect", %{conn: conn} do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	user2 = insert(:user)

	response =
	conn
	- \|> post(remote_follow_path(conn, :do_follow), %{
	+ \|> post(remote_interaction_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
	})
	\|> response(200)

	assert response =~ "Wrong username or password"
	refute user2.follower_address in User.following(user)
	end

	test "follows", %{conn: conn} do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	{:ok, %{token: token}} = MFA.Token.create(user)

	user2 = insert(:user)
	otp_token = TOTP.generate_token(otp_secret)

	conn =
	conn
	\|> post(
	- remote_follow_path(conn, :do_follow),
	+ remote_interaction_path(conn, :do_follow),
	%{
	"mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
	}
	)

	assert redirected_to(conn) == "/users/#{user2.id}"
	assert user2.follower_address in User.following(user)
	end

	test "returns error when auth code is incorrect", %{conn: conn} do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	{:ok, %{token: token}} = MFA.Token.create(user)

	user2 = insert(:user)
	otp_token = TOTP.generate_token(TOTP.generate_secret())

	response =
	conn
	\|> post(
	- remote_follow_path(conn, :do_follow),
	+ remote_interaction_path(conn, :do_follow),
	%{
	"mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
	}
	)
	\|> response(200)

	assert response =~ "Wrong authentication code"
	refute user2.follower_address in User.following(user)
	end
	end

	describe "POST /ostatus_subscribe - follow/2 without assigned user " do
	test "follows", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)

	conn =
	conn
	- \|> post(remote_follow_path(conn, :do_follow), %{
	+ \|> post(remote_interaction_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
	})

	assert redirected_to(conn) == "/users/#{user2.id}"
	assert user2.follower_address in User.following(user)
	end

	test "returns error when followee not found", %{conn: conn} do
	user = insert(:user)

	response =
	conn
	- \|> post(remote_follow_path(conn, :do_follow), %{
	+ \|> post(remote_interaction_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
	})
	\|> response(200)

	assert response =~ "Error following account"
	end

	test "returns error when login invalid", %{conn: conn} do
	user = insert(:user)

	response =
	conn
	- \|> post(remote_follow_path(conn, :do_follow), %{
	+ \|> post(remote_interaction_path(conn, :do_follow), %{
	"authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
	})
	\|> response(200)

	assert response =~ "Wrong username or password"
	end

	test "returns error when password invalid", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)

	response =
	conn
	- \|> post(remote_follow_path(conn, :do_follow), %{
	+ \|> post(remote_interaction_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
	})
	\|> response(200)

	assert response =~ "Wrong username or password"
	end

	test "returns error when user is blocked", %{conn: conn} do
	clear_config([:user, :deny_follow_blocked], true)
	user = insert(:user)
	user2 = insert(:user)
	{:ok, _user_block} = Pleroma.User.block(user2, user)

	response =
	conn
	- \|> post(remote_follow_path(conn, :do_follow), %{
	+ \|> post(remote_interaction_path(conn, :do_follow), %{
	"authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
	})
	\|> response(200)

	assert response =~ "Error following account"
	end
	end

	describe "avatar url" do
	test "without media proxy" do
	clear_config([:media_proxy, :enabled], false)

	user =
	insert(:user, %{
	local: false,
	avatar: %{"url" => [%{"href" => "https://remote.org/avatar.png"}]}
	})

	- avatar_url = Pleroma.Web.TwitterAPI.RemoteFollowView.avatar_url(user)
	+ avatar_url = Pleroma.Web.PleromaAPI.RemoteFollowView.avatar_url(user)

	assert avatar_url == "https://remote.org/avatar.png"
	end

	test "with media proxy" do
	clear_config([:media_proxy, :enabled], true)

	ConfigMock
	\|> stub_with(Pleroma.Test.StaticConfig)

	user =
	insert(:user, %{
	local: false,
	avatar: %{"url" => [%{"href" => "https://remote.org/avatar.png"}]}
	})

	- avatar_url = Pleroma.Web.TwitterAPI.RemoteFollowView.avatar_url(user)
	+ avatar_url = Pleroma.Web.PleromaAPI.RemoteFollowView.avatar_url(user)
	url = Pleroma.Web.Endpoint.url()

	assert String.starts_with?(avatar_url, url)
	end

	test "local avatar is not proxied" do
	clear_config([:media_proxy, :enabled], true)

	user =
	insert(:user, %{
	local: true,
	avatar: %{"url" => [%{"href" => "#{Pleroma.Web.Endpoint.url()}/localuser/avatar.png"}]}
	})

	- avatar_url = Pleroma.Web.TwitterAPI.RemoteFollowView.avatar_url(user)
	+ avatar_url = Pleroma.Web.PleromaAPI.RemoteFollowView.avatar_url(user)

	assert avatar_url == "#{Pleroma.Web.Endpoint.url()}/localuser/avatar.png"
	end
	end

	describe "GET /authorize_interaction - authorize_interaction/2" do
	test "redirects to /ostatus_subscribe", %{conn: conn} do
	Tesla.Mock.mock(fn
	%{method: :get, url: "https://mastodon.social/users/emelie"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body: File.read!("test/fixtures/tesla_mock/emelie.json")
	}

	%{method: :get, url: "https://mastodon.social/users/emelie/collections/featured"} ->
	%Tesla.Env{
	status: 200,
	headers: [{"content-type", "application/activity+json"}],
	body:
	File.read!("test/fixtures/users_mock/masto_featured.json")
	\|> String.replace("{{domain}}", "mastodon.social")
	\|> String.replace("{{nickname}}", "emelie")
	}
	end)

	conn =
	conn
	\|> get(
	- remote_follow_path(conn, :authorize_interaction, %{
	+ remote_interaction_path(conn, :authorize_interaction, %{
	uri: "https://mastodon.social/users/emelie"
	})
	)

	assert redirected_to(conn) ==
	- remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"})
	+ remote_interaction_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"})
	+ end
	+ end
	+
	+ describe "POST /main/ostatus - remote_subscribe/2" do
	+ setup do: clear_config([:instance, :federating], true)
	+
	+ test "renders subscribe form", %{conn: conn} do
	+ user = insert(:user)
	+
	+ response =
	+ conn
	+ \|> post("/main/ostatus", %{"nickname" => user.nickname, "profile" => ""})
	+ \|> response(:ok)
	+
	+ refute response =~ "Could not find user"
	+ assert response =~ "Remotely follow #{user.nickname}"
	+ end
	+
	+ test "renders subscribe form with error when user not found", %{conn: conn} do
	+ response =
	+ conn
	+ \|> post("/main/ostatus", %{"nickname" => "nickname", "profile" => ""})
	+ \|> response(:ok)
	+
	+ assert response =~ "Could not find user"
	+ refute response =~ "Remotely follow"
	+ end
	+
	+ test "it redirect to webfinger url", %{conn: conn} do
	+ user = insert(:user)
	+ user2 = insert(:user, ap_id: "shp@social.heldscal.la")
	+
	+ conn =
	+ conn
	+ \|> post("/main/ostatus", %{
	+ "user" => %{"nickname" => user.nickname, "profile" => user2.ap_id}
	+ })
	+
	+ assert redirected_to(conn) ==
	+ "https://social.heldscal.la/main/ostatussub?profile=#{user.ap_id}"
	+ end
	+
	+ test "it renders form with error when user not found", %{conn: conn} do
	+ user2 = insert(:user, ap_id: "shp@social.heldscal.la")
	+
	+ response =
	+ conn
	+ \|> post("/main/ostatus", %{"user" => %{"nickname" => "jimm", "profile" => user2.ap_id}})
	+ \|> response(:ok)
	+
	+ assert response =~ "Something went wrong."
	+ end
	+ end
	+
	+ describe "POST /main/ostatus - remote_subscribe/2 - with statuses" do
	+ setup do: clear_config([:instance, :federating], true)
	+
	+ test "renders subscribe form", %{conn: conn} do
	+ user = insert(:user)
	+ status = insert(:note_activity, %{user: user})
	+ status_id = status.id
	+
	+ assert is_binary(status_id)
	+
	+ response =
	+ conn
	+ \|> post("/main/ostatus", %{"status_id" => status_id, "profile" => ""})
	+ \|> response(:ok)
	+
	+ refute response =~ "Could not find status"
	+ assert response =~ "Interacting with"
	+ end
	+
	+ test "renders subscribe form with error when status not found", %{conn: conn} do
	+ response =
	+ conn
	+ \|> post("/main/ostatus", %{"status_id" => "somerandomid", "profile" => ""})
	+ \|> response(:ok)
	+
	+ assert response =~ "Could not find status"
	+ refute response =~ "Interacting with"
	+ end
	+
	+ test "it redirect to webfinger url", %{conn: conn} do
	+ user = insert(:user)
	+ status = insert(:note_activity, %{user: user})
	+ status_id = status.id
	+ status_ap_id = status.data["object"]
	+
	+ assert is_binary(status_id)
	+ assert is_binary(status_ap_id)
	+
	+ user2 = insert(:user, ap_id: "shp@social.heldscal.la")
	+
	+ conn =
	+ conn
	+ \|> post("/main/ostatus", %{
	+ "status" => %{"status_id" => status_id, "profile" => user2.ap_id}
	+ })
	+
	+ assert redirected_to(conn) ==
	+ "https://social.heldscal.la/main/ostatussub?profile=#{status_ap_id}"
	+ end
	+
	+ test "it renders form with error when status not found", %{conn: conn} do
	+ user2 = insert(:user, ap_id: "shp@social.heldscal.la")
	+
	+ response =
	+ conn
	+ \|> post("/main/ostatus", %{
	+ "status" => %{"status_id" => "somerandomid", "profile" => user2.ap_id}
	+ })
	+ \|> response(:ok)
	+
	+ assert response =~ "Something went wrong."
	+ end
	+ end
	+
	+ describe "GET /main/ostatus - show_subscribe_form/2" do
	+ setup do: clear_config([:instance, :federating], true)
	+
	+ test "it works with users", %{conn: conn} do
	+ user = insert(:user)
	+
	+ response =
	+ conn
	+ \|> get("/main/ostatus", %{"nickname" => user.nickname})
	+ \|> response(:ok)
	+
	+ refute response =~ "Could not find user"
	+ assert response =~ "Remotely follow #{user.nickname}"
	+ end
	+
	+ test "it works with statuses", %{conn: conn} do
	+ user = insert(:user)
	+ status = insert(:note_activity, %{user: user})
	+ status_id = status.id
	+
	+ assert is_binary(status_id)
	+
	+ response =
	+ conn
	+ \|> get("/main/ostatus", %{"status_id" => status_id})
	+ \|> response(:ok)
	+
	+ refute response =~ "Could not find status"
	+ assert response =~ "Interacting with"
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Aug 29, 1:30 AM (1 d, 2 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1736748
Default Alt Text: (210 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions