No OneTemporary
Actions

Size

137 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/check-attachment-attribution.security b/changelog.d/check-attachment-attribution.security
	new file mode 100644
	index 000000000..e0e46525b
	--- /dev/null
	+++ b/changelog.d/check-attachment-attribution.security
	@@ -0,0 +1 @@
	+CommonAPI: Prevent users from accessing media of other users by creating a status with reused attachment ID
	diff --git a/lib/pleroma/scheduled_activity.ex b/lib/pleroma/scheduled_activity.ex
	index a7be58512..0ed51ad07 100644
	--- a/lib/pleroma/scheduled_activity.ex
	+++ b/lib/pleroma/scheduled_activity.ex
	@@ -1,206 +1,210 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.ScheduledActivity do
	use Ecto.Schema

	alias Ecto.Multi
	alias Pleroma.Config
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.User
	alias Pleroma.Web.CommonAPI.Utils
	alias Pleroma.Workers.ScheduledActivityWorker

	import Ecto.Query
	import Ecto.Changeset

	@type t :: %__MODULE__{}

	@min_offset :timer.minutes(5)

	schema "scheduled_activities" do
	belongs_to(:user, User, type: FlakeId.Ecto.CompatType)
	field(:scheduled_at, :naive_datetime)
	field(:params, :map)

	timestamps()
	end

	def changeset(%ScheduledActivity{} = scheduled_activity, attrs) do
	scheduled_activity
	\|> cast(attrs, [:scheduled_at, :params])
	\|> validate_required([:scheduled_at, :params])
	\|> validate_scheduled_at()
	\|> with_media_attachments()
	end

	defp with_media_attachments(
	%{changes: %{params: %{"media_ids" => media_ids} = params}} = changeset
	)
	when is_list(media_ids) do
	- media_attachments = Utils.attachments_from_ids(%{media_ids: media_ids})
	+ media_attachments =
	+ Utils.attachments_from_ids(
	+ %{media_ids: media_ids},
	+ User.get_cached_by_id(changeset.data.user_id)
	+ )

	params =
	params
	\|> Map.put("media_attachments", media_attachments)
	\|> Map.put("media_ids", media_ids)

	put_change(changeset, :params, params)
	end

	defp with_media_attachments(changeset), do: changeset

	def update_changeset(%ScheduledActivity{} = scheduled_activity, attrs) do
	scheduled_activity
	\|> cast(attrs, [:scheduled_at])
	\|> validate_required([:scheduled_at])
	\|> validate_scheduled_at()
	end

	def validate_scheduled_at(changeset) do
	validate_change(changeset, :scheduled_at, fn _, scheduled_at ->
	cond do
	not far_enough?(scheduled_at) ->
	[scheduled_at: "must be at least 5 minutes from now"]

	exceeds_daily_user_limit?(changeset.data.user_id, scheduled_at) ->
	[scheduled_at: "daily limit exceeded"]

	exceeds_total_user_limit?(changeset.data.user_id) ->
	[scheduled_at: "total limit exceeded"]

	true ->
	[]
	end
	end)
	end

	def exceeds_daily_user_limit?(user_id, scheduled_at) do
	ScheduledActivity
	\|> where(user_id: ^user_id)
	\|> where([sa], type(sa.scheduled_at, :date) == type(^scheduled_at, :date))
	\|> select([sa], count(sa.id))
	\|> Repo.one()
	\|> Kernel.>=(Config.get([ScheduledActivity, :daily_user_limit]))
	end

	def exceeds_total_user_limit?(user_id) do
	ScheduledActivity
	\|> where(user_id: ^user_id)
	\|> select([sa], count(sa.id))
	\|> Repo.one()
	\|> Kernel.>=(Config.get([ScheduledActivity, :total_user_limit]))
	end

	def far_enough?(scheduled_at) when is_binary(scheduled_at) do
	with {:ok, scheduled_at} <- Ecto.Type.cast(:naive_datetime, scheduled_at) do
	far_enough?(scheduled_at)
	else
	_ -> false
	end
	end

	def far_enough?(scheduled_at) do
	now = NaiveDateTime.utc_now()
	diff = NaiveDateTime.diff(scheduled_at, now, :millisecond)
	diff > @min_offset
	end

	def new(%User{} = user, attrs) do
	changeset(%ScheduledActivity{user_id: user.id}, attrs)
	end

	@doc """
	Creates ScheduledActivity and add to queue to perform at scheduled_at date
	"""
	@spec create(User.t(), map()) :: {:ok, ScheduledActivity.t()} \| {:error, Ecto.Changeset.t()}
	def create(%User{} = user, attrs) do
	Multi.new()
	\|> Multi.insert(:scheduled_activity, new(user, attrs))
	\|> maybe_add_jobs(Config.get([ScheduledActivity, :enabled]))
	\|> Repo.transaction()
	\|> transaction_response
	end

	defp maybe_add_jobs(multi, true) do
	multi
	\|> Multi.run(:scheduled_activity_job, fn _repo, %{scheduled_activity: activity} ->
	%{activity_id: activity.id}
	\|> ScheduledActivityWorker.new(scheduled_at: activity.scheduled_at)
	\|> Oban.insert()
	end)
	end

	defp maybe_add_jobs(multi, _), do: multi

	def get(%User{} = user, scheduled_activity_id) do
	ScheduledActivity
	\|> where(user_id: ^user.id)
	\|> where(id: ^scheduled_activity_id)
	\|> Repo.one()
	end

	@spec update(ScheduledActivity.t(), map()) ::
	{:ok, ScheduledActivity.t()} \| {:error, Ecto.Changeset.t()}
	def update(%ScheduledActivity{id: id} = scheduled_activity, attrs) do
	with {:error, %Ecto.Changeset{valid?: true} = changeset} <-
	{:error, update_changeset(scheduled_activity, attrs)} do
	Multi.new()
	\|> Multi.update(:scheduled_activity, changeset)
	\|> Multi.update_all(:scheduled_job, job_query(id),
	set: [scheduled_at: get_field(changeset, :scheduled_at)]
	)
	\|> Repo.transaction()
	\|> transaction_response
	end
	end

	@doc "Deletes a ScheduledActivity and linked jobs."
	@spec delete(ScheduledActivity.t() \| binary() \| integer) ::
	{:ok, ScheduledActivity.t()} \| {:error, Ecto.Changeset.t()}
	def delete(%ScheduledActivity{id: id} = scheduled_activity) do
	Multi.new()
	\|> Multi.delete(:scheduled_activity, scheduled_activity, stale_error_field: :id)
	\|> Multi.delete_all(:jobs, job_query(id))
	\|> Repo.transaction()
	\|> transaction_response
	end

	def delete(id) when is_binary(id) or is_integer(id) do
	delete(%__MODULE__{id: id})
	end

	defp transaction_response(result) do
	case result do
	{:ok, %{scheduled_activity: scheduled_activity}} ->
	{:ok, scheduled_activity}

	{:error, _, changeset, _} ->
	{:error, changeset}
	end
	end

	def for_user_query(%User{} = user) do
	ScheduledActivity
	\|> where(user_id: ^user.id)
	end

	def due_activities(offset \\ 0) do
	naive_datetime =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(offset, :millisecond)

	ScheduledActivity
	\|> where([sa], sa.scheduled_at < ^naive_datetime)
	\|> Repo.all()
	end

	def job_query(scheduled_activity_id) do
	from(j in Oban.Job,
	where: j.queue == "scheduled_activities",
	where: fragment("args ->> 'activity_id' = ?::text", ^to_string(scheduled_activity_id))
	)
	end
	end
	diff --git a/lib/pleroma/web/common_api.ex b/lib/pleroma/web/common_api.ex
	index 89cc0d6fe..44eb00075 100644
	--- a/lib/pleroma/web/common_api.ex
	+++ b/lib/pleroma/web/common_api.ex
	@@ -1,652 +1,664 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI do
	alias Pleroma.Activity
	alias Pleroma.Conversation.Participation
	alias Pleroma.Formatter
	alias Pleroma.ModerationLog
	alias Pleroma.Object
	alias Pleroma.ThreadMute
	alias Pleroma.User
	alias Pleroma.UserRelationship
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI.ActivityDraft

	import Pleroma.Web.Gettext
	import Pleroma.Web.CommonAPI.Utils

	require Pleroma.Constants
	require Logger

	def block(blocker, blocked) do
	with {:ok, block_data, _} <- Builder.block(blocker, blocked),
	{:ok, block, _} <- Pipeline.common_pipeline(block_data, local: true) do
	{:ok, block}
	end
	end

	def post_chat_message(%User{} = user, %User{} = recipient, content, opts \\ []) do
	with maybe_attachment <- opts[:media_id] && Object.get_by_id(opts[:media_id]),
	+ :ok <- validate_chat_attachment_attribution(maybe_attachment, user),
	:ok <- validate_chat_content_length(content, !!maybe_attachment),
	{_, {:ok, chat_message_data, _meta}} <-
	{:build_object,
	Builder.chat_message(
	user,
	recipient.ap_id,
	content \|> format_chat_content,
	attachment: maybe_attachment
	)},
	{_, {:ok, create_activity_data, _meta}} <-
	{:build_create_activity, Builder.create(user, chat_message_data, [recipient.ap_id])},
	{_, {:ok, %Activity{} = activity, _meta}} <-
	{:common_pipeline,
	Pipeline.common_pipeline(create_activity_data,
	local: true,
	idempotency_key: opts[:idempotency_key]
	)} do
	{:ok, activity}
	else
	{:common_pipeline, {:reject, _} = e} -> e
	e -> e
	end
	end

	defp format_chat_content(nil), do: nil

	defp format_chat_content(content) do
	{text, _, _} =
	content
	\|> Formatter.html_escape("text/plain")
	\|> Formatter.linkify()
	\|> (fn {text, mentions, tags} ->
	{String.replace(text, ~r/\r?\n/, "<br>"), mentions, tags}
	end).()

	text
	end

	+ defp validate_chat_attachment_attribution(nil, _), do: :ok
	+
	+ defp validate_chat_attachment_attribution(attachment, user) do
	+ with :ok <- Object.authorize_access(attachment, user) do
	+ :ok
	+ else
	+ e ->
	+ e
	+ end
	+ end
	+
	defp validate_chat_content_length(_, true), do: :ok
	defp validate_chat_content_length(nil, false), do: {:error, :no_content}

	defp validate_chat_content_length(content, _) do
	if String.length(content) <= Pleroma.Config.get([:instance, :chat_limit]) do
	:ok
	else
	{:error, :content_too_long}
	end
	end

	def unblock(blocker, blocked) do
	with {_, %Activity{} = block} <- {:fetch_block, Utils.fetch_latest_block(blocker, blocked)},
	{:ok, unblock_data, _} <- Builder.undo(blocker, block),
	{:ok, unblock, _} <- Pipeline.common_pipeline(unblock_data, local: true) do
	{:ok, unblock}
	else
	{:fetch_block, nil} ->
	if User.blocks?(blocker, blocked) do
	User.unblock(blocker, blocked)
	{:ok, :no_activity}
	else
	{:error, :not_blocking}
	end

	e ->
	e
	end
	end

	def follow(follower, followed) do
	timeout = Pleroma.Config.get([:activitypub, :follow_handshake_timeout])

	with {:ok, follow_data, _} <- Builder.follow(follower, followed),
	{:ok, activity, _} <- Pipeline.common_pipeline(follow_data, local: true),
	{:ok, follower, followed} <- User.wait_and_refresh(timeout, follower, followed) do
	if activity.data["state"] == "reject" do
	{:error, :rejected}
	else
	{:ok, follower, followed, activity}
	end
	end
	end

	def unfollow(follower, unfollowed) do
	with {:ok, follower, _follow_activity} <- User.unfollow(follower, unfollowed),
	{:ok, _activity} <- ActivityPub.unfollow(follower, unfollowed),
	{:ok, _subscription} <- User.unsubscribe(follower, unfollowed),
	{:ok, _endorsement} <- User.unendorse(follower, unfollowed) do
	{:ok, follower}
	end
	end

	def accept_follow_request(follower, followed) do
	with %Activity{} = follow_activity <- Utils.fetch_latest_follow(follower, followed),
	{:ok, accept_data, _} <- Builder.accept(followed, follow_activity),
	{:ok, _activity, _} <- Pipeline.common_pipeline(accept_data, local: true) do
	{:ok, follower}
	end
	end

	def reject_follow_request(follower, followed) do
	with %Activity{} = follow_activity <- Utils.fetch_latest_follow(follower, followed),
	{:ok, reject_data, _} <- Builder.reject(followed, follow_activity),
	{:ok, _activity, _} <- Pipeline.common_pipeline(reject_data, local: true) do
	{:ok, follower}
	end
	end

	def delete(activity_id, user) do
	with {_, %Activity{data: %{"object" => _, "type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(activity_id)},
	{_, %Object{} = object, _} <-
	{:find_object, Object.normalize(activity, fetch: false), activity},
	true <- User.privileged?(user, :messages_delete) \|\| user.ap_id == object.data["actor"],
	{:ok, delete_data, _} <- Builder.delete(user, object.data["id"]),
	{:ok, delete, _} <- Pipeline.common_pipeline(delete_data, local: true) do
	if User.privileged?(user, :messages_delete) and user.ap_id != object.data["actor"] do
	action =
	if object.data["type"] == "ChatMessage" do
	"chat_message_delete"
	else
	"status_delete"
	end

	ModerationLog.insert_log(%{
	action: action,
	actor: user,
	subject_id: activity_id
	})
	end

	{:ok, delete}
	else
	{:find_activity, _} ->
	{:error, :not_found}

	{:find_object, nil, %Activity{data: %{"actor" => actor, "object" => object}}} ->
	# We have the create activity, but not the object, it was probably pruned.
	# Insert a tombstone and try again
	with {:ok, tombstone_data, _} <- Builder.tombstone(actor, object),
	{:ok, _tombstone} <- Object.create(tombstone_data) do
	delete(activity_id, user)
	else
	_ ->
	Logger.error(
	"Could not insert tombstone for missing object on deletion. Object is #{object}."
	)

	{:error, dgettext("errors", "Could not delete")}
	end

	_ ->
	{:error, dgettext("errors", "Could not delete")}
	end
	end

	def repeat(id, user, params \\ %{}) do
	with %Activity{data: %{"type" => "Create"}} = activity <- Activity.get_by_id(id),
	object = %Object{} <- Object.normalize(activity, fetch: false),
	{_, nil} <- {:existing_announce, Utils.get_existing_announce(user.ap_id, object)},
	public = public_announce?(object, params),
	{:ok, announce, _} <- Builder.announce(user, object, public: public),
	{:ok, activity, _} <- Pipeline.common_pipeline(announce, local: true) do
	{:ok, activity}
	else
	{:existing_announce, %Activity{} = announce} ->
	{:ok, announce}

	_ ->
	{:error, :not_found}
	end
	end

	def unrepeat(id, user) do
	with {_, %Activity{data: %{"type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(id)},
	%Object{} = note <- Object.normalize(activity, fetch: false),
	%Activity{} = announce <- Utils.get_existing_announce(user.ap_id, note),
	{:ok, undo, _} <- Builder.undo(user, announce),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	{:find_activity, _} -> {:error, :not_found}
	_ -> {:error, dgettext("errors", "Could not unrepeat")}
	end
	end

	@spec favorite(User.t(), binary()) :: {:ok, Activity.t() \| :already_liked} \| {:error, any()}
	def favorite(%User{} = user, id) do
	case favorite_helper(user, id) do
	{:ok, _} = res ->
	res

	{:error, :not_found} = res ->
	res

	{:error, e} ->
	Logger.error("Could not favorite #{id}. Error: #{inspect(e, pretty: true)}")
	{:error, dgettext("errors", "Could not favorite")}
	end
	end

	def favorite_helper(user, id) do
	with {_, %Activity{object: object}} <- {:find_object, Activity.get_by_id_with_object(id)},
	{_, {:ok, like_object, meta}} <- {:build_object, Builder.like(user, object)},
	{_, {:ok, %Activity{} = activity, _meta}} <-
	{:common_pipeline,
	Pipeline.common_pipeline(like_object, Keyword.put(meta, :local, true))} do
	{:ok, activity}
	else
	{:find_object, _} ->
	{:error, :not_found}

	{:common_pipeline, {:error, {:validate, {:error, changeset}}}} = e ->
	if {:object, {"already liked by this actor", []}} in changeset.errors do
	{:ok, :already_liked}
	else
	{:error, e}
	end

	e ->
	{:error, e}
	end
	end

	def unfavorite(id, user) do
	with {_, %Activity{data: %{"type" => "Create"}} = activity} <-
	{:find_activity, Activity.get_by_id(id)},
	%Object{} = note <- Object.normalize(activity, fetch: false),
	%Activity{} = like <- Utils.get_existing_like(user.ap_id, note),
	{:ok, undo, _} <- Builder.undo(user, like),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	{:find_activity, _} -> {:error, :not_found}
	_ -> {:error, dgettext("errors", "Could not unfavorite")}
	end
	end

	def react_with_emoji(id, user, emoji) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	object <- Object.normalize(activity, fetch: false),
	{:ok, emoji_react, _} <- Builder.emoji_react(user, object, emoji),
	{:ok, activity, _} <- Pipeline.common_pipeline(emoji_react, local: true) do
	{:ok, activity}
	else
	_ ->
	{:error, dgettext("errors", "Could not add reaction emoji")}
	end
	end

	def unreact_with_emoji(id, user, emoji) do
	with %Activity{} = reaction_activity <- Utils.get_latest_reaction(id, user, emoji),
	{:ok, undo, _} <- Builder.undo(user, reaction_activity),
	{:ok, activity, _} <- Pipeline.common_pipeline(undo, local: true) do
	{:ok, activity}
	else
	_ ->
	{:error, dgettext("errors", "Could not remove reaction emoji")}
	end
	end

	def vote(user, %{data: %{"type" => "Question"}} = object, choices) do
	with :ok <- validate_not_author(object, user),
	:ok <- validate_existing_votes(user, object),
	{:ok, options, choices} <- normalize_and_validate_choices(choices, object) do
	answer_activities =
	Enum.map(choices, fn index ->
	{:ok, answer_object, _meta} =
	Builder.answer(user, object, Enum.at(options, index)["name"])

	{:ok, activity_data, _meta} = Builder.create(user, answer_object, [])

	{:ok, activity, _meta} =
	activity_data
	\|> Map.put("cc", answer_object["cc"])
	\|> Map.put("context", answer_object["context"])
	\|> Pipeline.common_pipeline(local: true)

	# TODO: Do preload of Pleroma.Object in Pipeline
	Activity.normalize(activity.data)
	end)

	object = Object.get_cached_by_ap_id(object.data["id"])
	{:ok, answer_activities, object}
	end
	end

	defp validate_not_author(%{data: %{"actor" => ap_id}}, %{ap_id: ap_id}),
	do: {:error, dgettext("errors", "Poll's author can't vote")}

	defp validate_not_author(_, _), do: :ok

	defp validate_existing_votes(%{ap_id: ap_id}, object) do
	if Utils.get_existing_votes(ap_id, object) == [] do
	:ok
	else
	{:error, dgettext("errors", "Already voted")}
	end
	end

	defp get_options_and_max_count(%{data: %{"anyOf" => any_of}})
	when is_list(any_of) and any_of != [],
	do: {any_of, Enum.count(any_of)}

	defp get_options_and_max_count(%{data: %{"oneOf" => one_of}})
	when is_list(one_of) and one_of != [],
	do: {one_of, 1}

	defp normalize_and_validate_choices(choices, object) do
	choices = Enum.map(choices, fn i -> if is_binary(i), do: String.to_integer(i), else: i end)
	{options, max_count} = get_options_and_max_count(object)
	count = Enum.count(options)

	with {_, true} <- {:valid_choice, Enum.all?(choices, &(&1 < count))},
	{_, true} <- {:count_check, Enum.count(choices) <= max_count} do
	{:ok, options, choices}
	else
	{:valid_choice, _} -> {:error, dgettext("errors", "Invalid indices")}
	{:count_check, _} -> {:error, dgettext("errors", "Too many choices")}
	end
	end

	def public_announce?(_, %{visibility: visibility})
	when visibility in ~w{public unlisted private direct},
	do: visibility in ~w(public unlisted)

	def public_announce?(object, _) do
	Visibility.is_public?(object)
	end

	def get_visibility(_, _, %Participation{}), do: {"direct", "direct"}

	def get_visibility(%{visibility: visibility}, in_reply_to, _)
	when visibility in ~w{public local unlisted private direct},
	do: {visibility, get_replied_to_visibility(in_reply_to)}

	def get_visibility(%{visibility: "list:" <> list_id}, in_reply_to, _) do
	visibility = {:list, String.to_integer(list_id)}
	{visibility, get_replied_to_visibility(in_reply_to)}
	end

	def get_visibility(_, in_reply_to, _) when not is_nil(in_reply_to) do
	visibility = get_replied_to_visibility(in_reply_to)
	{visibility, visibility}
	end

	def get_visibility(_, in_reply_to, _), do: {"public", get_replied_to_visibility(in_reply_to)}

	def get_replied_to_visibility(nil), do: nil

	def get_replied_to_visibility(activity) do
	with %Object{} = object <- Object.normalize(activity, fetch: false) do
	Visibility.get_visibility(object)
	end
	end

	def check_expiry_date({:ok, nil} = res), do: res

	def check_expiry_date({:ok, in_seconds}) do
	expiry = DateTime.add(DateTime.utc_now(), in_seconds)

	if Pleroma.Workers.PurgeExpiredActivity.expires_late_enough?(expiry) do
	{:ok, expiry}
	else
	{:error, "Expiry date is too soon"}
	end
	end

	def check_expiry_date(expiry_str) do
	Ecto.Type.cast(:integer, expiry_str)
	\|> check_expiry_date()
	end

	def listen(user, data) do
	with {:ok, draft} <- ActivityDraft.listen(user, data) do
	ActivityPub.listen(draft.changes)
	end
	end

	def post(user, %{status: _} = data) do
	with {:ok, draft} <- ActivityDraft.create(user, data) do
	ActivityPub.create(draft.changes, draft.preview?)
	end
	end

	def update(user, orig_activity, changes) do
	with orig_object <- Object.normalize(orig_activity),
	{:ok, new_object} <- make_update_data(user, orig_object, changes),
	{:ok, update_data, _} <- Builder.update(user, new_object),
	{:ok, update, _} <- Pipeline.common_pipeline(update_data, local: true) do
	{:ok, update}
	else
	_ -> {:error, nil}
	end
	end

	defp make_update_data(user, orig_object, changes) do
	kept_params = %{
	visibility: Visibility.get_visibility(orig_object),
	in_reply_to_id:
	with replied_id when is_binary(replied_id) <- orig_object.data["inReplyTo"],
	%Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(replied_id) do
	activity_id
	else
	_ -> nil
	end
	}

	params = Map.merge(changes, kept_params)

	with {:ok, draft} <- ActivityDraft.create(user, params) do
	change =
	Object.Updater.make_update_object_data(orig_object.data, draft.object, Utils.make_date())

	{:ok, change}
	else
	_ -> {:error, nil}
	end
	end

	@spec pin(String.t(), User.t()) :: {:ok, Activity.t()} \| {:error, term()}
	def pin(id, %User{} = user) do
	with %Activity{} = activity <- create_activity_by_id(id),
	true <- activity_belongs_to_actor(activity, user.ap_id),
	true <- object_type_is_allowed_for_pin(activity.object),
	true <- activity_is_public(activity),
	{:ok, pin_data, _} <- Builder.pin(user, activity.object),
	{:ok, _pin, _} <-
	Pipeline.common_pipeline(pin_data,
	local: true,
	activity_id: id
	) do
	{:ok, activity}
	else
	{:error, {:side_effects, error}} -> error
	error -> error
	end
	end

	defp create_activity_by_id(id) do
	with nil <- Activity.create_by_id_with_object(id) do
	{:error, :not_found}
	end
	end

	defp activity_belongs_to_actor(%{actor: actor}, actor), do: true
	defp activity_belongs_to_actor(_, _), do: {:error, :ownership_error}

	defp object_type_is_allowed_for_pin(%{data: %{"type" => type}}) do
	with false <- type in ["Note", "Article", "Question"] do
	{:error, :not_allowed}
	end
	end

	defp activity_is_public(activity) do
	with false <- Visibility.is_public?(activity) do
	{:error, :visibility_error}
	end
	end

	@spec unpin(String.t(), User.t()) :: {:ok, User.t()} \| {:error, term()}
	def unpin(id, user) do
	with %Activity{} = activity <- create_activity_by_id(id),
	{:ok, unpin_data, _} <- Builder.unpin(user, activity.object),
	{:ok, _unpin, _} <-
	Pipeline.common_pipeline(unpin_data,
	local: true,
	activity_id: activity.id,
	expires_at: activity.data["expires_at"],
	featured_address: user.featured_address
	) do
	{:ok, activity}
	end
	end

	def add_mute(user, activity, params \\ %{}) do
	expires_in = Map.get(params, :expires_in, 0)

	with {:ok, _} <- ThreadMute.add_mute(user.id, activity.data["context"]),
	_ <- Pleroma.Notification.mark_context_as_read(user, activity.data["context"]) do
	if expires_in > 0 do
	Pleroma.Workers.MuteExpireWorker.enqueue(
	"unmute_conversation",
	%{"user_id" => user.id, "activity_id" => activity.id},
	schedule_in: expires_in
	)
	end

	{:ok, activity}
	else
	{:error, _} -> {:error, dgettext("errors", "conversation is already muted")}
	end
	end

	def remove_mute(%User{} = user, %Activity{} = activity) do
	ThreadMute.remove_mute(user.id, activity.data["context"])
	{:ok, activity}
	end

	def remove_mute(user_id, activity_id) do
	with {:user, %User{} = user} <- {:user, User.get_by_id(user_id)},
	{:activity, %Activity{} = activity} <- {:activity, Activity.get_by_id(activity_id)} do
	remove_mute(user, activity)
	else
	{what, result} = error ->
	Logger.warn(
	"CommonAPI.remove_mute/2 failed. #{what}: #{result}, user_id: #{user_id}, activity_id: #{activity_id}"
	)

	{:error, error}
	end
	end

	def thread_muted?(%User{id: user_id}, %{data: %{"context" => context}})
	when is_binary(context) do
	ThreadMute.exists?(user_id, context)
	end

	def thread_muted?(_, _), do: false

	def report(user, data) do
	with {:ok, account} <- get_reported_account(data.account_id),
	{:ok, {content_html, _, _}} <- make_report_content_html(data[:comment]),
	{:ok, statuses} <- get_report_statuses(account, data) do
	ActivityPub.flag(%{
	context: Utils.generate_context_id(),
	actor: user,
	account: account,
	statuses: statuses,
	content: content_html,
	forward: Map.get(data, :forward, false)
	})
	end
	end

	defp get_reported_account(account_id) do
	case User.get_cached_by_id(account_id) do
	%User{} = account -> {:ok, account}
	_ -> {:error, dgettext("errors", "Account not found")}
	end
	end

	def update_report_state(activity_ids, state) when is_list(activity_ids) do
	case Utils.update_report_state(activity_ids, state) do
	:ok -> {:ok, activity_ids}
	_ -> {:error, dgettext("errors", "Could not update state")}
	end
	end

	def update_report_state(activity_id, state) do
	with %Activity{} = activity <- Activity.get_by_id(activity_id) do
	Utils.update_report_state(activity, state)
	else
	nil -> {:error, :not_found}
	_ -> {:error, dgettext("errors", "Could not update state")}
	end
	end

	def update_activity_scope(activity_id, opts \\ %{}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
	{:ok, activity} <- toggle_sensitive(activity, opts) do
	set_visibility(activity, opts)
	else
	nil -> {:error, :not_found}
	{:error, reason} -> {:error, reason}
	end
	end

	defp toggle_sensitive(activity, %{sensitive: sensitive}) when sensitive in ~w(true false) do
	toggle_sensitive(activity, %{sensitive: String.to_existing_atom(sensitive)})
	end

	defp toggle_sensitive(%Activity{object: object} = activity, %{sensitive: sensitive})
	when is_boolean(sensitive) do
	new_data = Map.put(object.data, "sensitive", sensitive)

	{:ok, object} =
	object
	\|> Object.change(%{data: new_data})
	\|> Object.update_and_set_cache()

	{:ok, Map.put(activity, :object, object)}
	end

	defp toggle_sensitive(activity, _), do: {:ok, activity}

	defp set_visibility(activity, %{visibility: visibility}) do
	Utils.update_activity_visibility(activity, visibility)
	end

	defp set_visibility(activity, _), do: {:ok, activity}

	def hide_reblogs(%User{} = user, %User{} = target) do
	UserRelationship.create_reblog_mute(user, target)
	end

	def show_reblogs(%User{} = user, %User{} = target) do
	UserRelationship.delete_reblog_mute(user, target)
	end

	def get_user(ap_id, fake_record_fallback \\ true) do
	cond do
	user = User.get_cached_by_ap_id(ap_id) ->
	user

	user = User.get_by_guessed_nickname(ap_id) ->
	user

	fake_record_fallback ->
	# TODO: refactor (fake records is never a good idea)
	User.error_user(ap_id)

	true ->
	nil
	end
	end
	end
	diff --git a/lib/pleroma/web/common_api/activity_draft.ex b/lib/pleroma/web/common_api/activity_draft.ex
	index 9af635da8..63ed48a27 100644
	--- a/lib/pleroma/web/common_api/activity_draft.ex
	+++ b/lib/pleroma/web/common_api/activity_draft.ex
	@@ -1,273 +1,273 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI.ActivityDraft do
	alias Pleroma.Activity
	alias Pleroma.Conversation.Participation
	alias Pleroma.Object
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.CommonAPI.Utils

	import Pleroma.Web.Gettext

	defstruct valid?: true,
	errors: [],
	user: nil,
	params: %{},
	status: nil,
	summary: nil,
	full_payload: nil,
	attachments: [],
	in_reply_to: nil,
	in_reply_to_conversation: nil,
	visibility: nil,
	expires_at: nil,
	extra: nil,
	emoji: %{},
	content_html: nil,
	mentions: [],
	tags: [],
	to: [],
	cc: [],
	context: nil,
	sensitive: false,
	object: nil,
	preview?: false,
	changes: %{}

	def new(user, params) do
	%__MODULE__{user: user}
	\|> put_params(params)
	end

	def create(user, params) do
	user
	\|> new(params)
	\|> status()
	\|> summary()
	\|> with_valid(&attachments/1)
	\|> full_payload()
	\|> expires_at()
	\|> poll()
	\|> with_valid(&in_reply_to/1)
	\|> with_valid(&in_reply_to_conversation/1)
	\|> with_valid(&visibility/1)
	\|> content()
	\|> with_valid(&to_and_cc/1)
	\|> with_valid(&context/1)
	\|> sensitive()
	\|> with_valid(&object/1)
	\|> preview?()
	\|> with_valid(&changes/1)
	\|> validate()
	end

	def listen(user, params) do
	user
	\|> new(params)
	\|> visibility()
	\|> to_and_cc()
	\|> context()
	\|> listen_object()
	\|> with_valid(&changes/1)
	\|> validate()
	end

	defp listen_object(draft) do
	object =
	draft.params
	\|> Map.take([:album, :artist, :title, :length])
	\|> Map.new(fn {key, value} -> {to_string(key), value} end)
	\|> Map.put("type", "Audio")
	\|> Map.put("to", draft.to)
	\|> Map.put("cc", draft.cc)
	\|> Map.put("actor", draft.user.ap_id)

	%__MODULE__{draft \| object: object}
	end

	defp put_params(draft, params) do
	params = Map.put_new(params, :in_reply_to_status_id, params[:in_reply_to_id])
	%__MODULE__{draft \| params: params}
	end

	defp status(%{params: %{status: status}} = draft) do
	%__MODULE__{draft \| status: String.trim(status)}
	end

	defp summary(%{params: params} = draft) do
	%__MODULE__{draft \| summary: Map.get(params, :spoiler_text, "")}
	end

	defp full_payload(%{status: status, summary: summary} = draft) do
	full_payload = String.trim(status <> summary)

	case Utils.validate_character_limit(full_payload, draft.attachments) do
	:ok -> %__MODULE__{draft \| full_payload: full_payload}
	{:error, message} -> add_error(draft, message)
	end
	end

	defp attachments(%{params: params} = draft) do
	- attachments = Utils.attachments_from_ids(params)
	+ attachments = Utils.attachments_from_ids(params, draft.user)
	draft = %__MODULE__{draft \| attachments: attachments}

	case Utils.validate_attachments_count(attachments) do
	:ok -> draft
	{:error, message} -> add_error(draft, message)
	end
	end

	defp in_reply_to(%{params: %{in_reply_to_status_id: ""}} = draft), do: draft

	defp in_reply_to(%{params: %{in_reply_to_status_id: id}} = draft) when is_binary(id) do
	%__MODULE__{draft \| in_reply_to: Activity.get_by_id(id)}
	end

	defp in_reply_to(%{params: %{in_reply_to_status_id: %Activity{} = in_reply_to}} = draft) do
	%__MODULE__{draft \| in_reply_to: in_reply_to}
	end

	defp in_reply_to(draft), do: draft

	defp in_reply_to_conversation(draft) do
	in_reply_to_conversation = Participation.get(draft.params[:in_reply_to_conversation_id])
	%__MODULE__{draft \| in_reply_to_conversation: in_reply_to_conversation}
	end

	defp visibility(%{params: params} = draft) do
	case CommonAPI.get_visibility(params, draft.in_reply_to, draft.in_reply_to_conversation) do
	{visibility, "direct"} when visibility != "direct" ->
	add_error(draft, dgettext("errors", "The message visibility must be direct"))

	{visibility, _} ->
	%__MODULE__{draft \| visibility: visibility}
	end
	end

	defp expires_at(draft) do
	case CommonAPI.check_expiry_date(draft.params[:expires_in]) do
	{:ok, expires_at} -> %__MODULE__{draft \| expires_at: expires_at}
	{:error, message} -> add_error(draft, message)
	end
	end

	defp poll(draft) do
	case Utils.make_poll_data(draft.params) do
	{:ok, {poll, poll_emoji}} ->
	%__MODULE__{draft \| extra: poll, emoji: Map.merge(draft.emoji, poll_emoji)}

	{:error, message} ->
	add_error(draft, message)
	end
	end

	defp content(draft) do
	{content_html, mentioned_users, tags} = Utils.make_content_html(draft)

	mentions =
	mentioned_users
	\|> Enum.map(fn {_, mentioned_user} -> mentioned_user.ap_id end)
	\|> Utils.get_addressed_users(draft.params[:to])

	%__MODULE__{draft \| content_html: content_html, mentions: mentions, tags: tags}
	end

	defp to_and_cc(draft) do
	{to, cc} = Utils.get_to_and_cc(draft)
	%__MODULE__{draft \| to: to, cc: cc}
	end

	defp context(draft) do
	context = Utils.make_context(draft.in_reply_to, draft.in_reply_to_conversation)
	%__MODULE__{draft \| context: context}
	end

	defp sensitive(draft) do
	sensitive = draft.params[:sensitive]
	%__MODULE__{draft \| sensitive: sensitive}
	end

	defp object(draft) do
	emoji = Map.merge(Pleroma.Emoji.Formatter.get_emoji_map(draft.full_payload), draft.emoji)

	# Sometimes people create posts with subject containing emoji,
	# since subjects are usually copied this will result in a broken
	# subject when someone replies from an instance that does not have
	# the emoji or has it under different shortcode. This is an attempt
	# to mitigate this by copying emoji from inReplyTo if they are present
	# in the subject.
	summary_emoji =
	with %Activity{} <- draft.in_reply_to,
	%Object{data: %{"tag" => [_ \| _] = tag}} <- Object.normalize(draft.in_reply_to) do
	Enum.reduce(tag, %{}, fn
	%{"type" => "Emoji", "name" => name, "icon" => %{"url" => url}}, acc ->
	if String.contains?(draft.summary, name) do
	Map.put(acc, name, url)
	else
	acc
	end

	_, acc ->
	acc
	end)
	else
	_ -> %{}
	end

	emoji = Map.merge(emoji, summary_emoji)

	{:ok, note_data, _meta} = Builder.note(draft)

	object =
	note_data
	\|> Map.put("emoji", emoji)
	\|> Map.put("source", %{
	"content" => draft.status,
	"mediaType" => Utils.get_content_type(draft.params[:content_type])
	})
	\|> Map.put("generator", draft.params[:generator])

	%__MODULE__{draft \| object: object}
	end

	defp preview?(draft) do
	preview? = Pleroma.Web.Utils.Params.truthy_param?(draft.params[:preview])
	%__MODULE__{draft \| preview?: preview?}
	end

	defp changes(draft) do
	direct? = draft.visibility == "direct"
	additional = %{"cc" => draft.cc, "directMessage" => direct?}

	additional =
	case draft.expires_at do
	%DateTime{} = expires_at -> Map.put(additional, "expires_at", expires_at)
	_ -> additional
	end

	changes =
	%{
	to: draft.to,
	actor: draft.user,
	context: draft.context,
	object: draft.object,
	additional: additional
	}
	\|> Utils.maybe_add_list_data(draft.user, draft.visibility)

	%__MODULE__{draft \| changes: changes}
	end

	defp with_valid(%{valid?: true} = draft, func), do: func.(draft)
	defp with_valid(draft, _func), do: draft

	defp add_error(draft, message) do
	%__MODULE__{draft \| valid?: false, errors: [message \| draft.errors]}
	end

	defp validate(%{valid?: true} = draft), do: {:ok, draft}
	defp validate(%{errors: [message \| _]}), do: {:error, message}
	end
	diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
	index ff0814329..6410815ea 100644
	--- a/lib/pleroma/web/common_api/utils.ex
	+++ b/lib/pleroma/web/common_api/utils.ex
	@@ -1,485 +1,490 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI.Utils do
	import Pleroma.Web.Gettext

	alias Calendar.Strftime
	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Conversation.Participation
	alias Pleroma.Formatter
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI.ActivityDraft
	alias Pleroma.Web.MediaProxy
	alias Pleroma.Web.Plugs.AuthenticationPlug
	alias Pleroma.Web.Utils.Params

	require Logger
	require Pleroma.Constants

	- def attachments_from_ids(%{media_ids: ids, descriptions: desc}) do
	- attachments_from_ids_descs(ids, desc)
	+ def attachments_from_ids(%{media_ids: ids, descriptions: desc}, user) do
	+ attachments_from_ids_descs(ids, desc, user)
	end

	- def attachments_from_ids(%{media_ids: ids}) do
	- attachments_from_ids_no_descs(ids)
	+ def attachments_from_ids(%{media_ids: ids}, user) do
	+ attachments_from_ids_no_descs(ids, user)
	end

	- def attachments_from_ids(_), do: []
	+ def attachments_from_ids(_, _), do: []

	- def attachments_from_ids_no_descs([]), do: []
	+ def attachments_from_ids_no_descs([], _), do: []

	- def attachments_from_ids_no_descs(ids) do
	+ def attachments_from_ids_no_descs(ids, user) do
	Enum.map(ids, fn media_id ->
	- case get_attachment(media_id) do
	+ case get_attachment(media_id, user) do
	%Object{data: data} -> data
	_ -> nil
	end
	end)
	\|> Enum.reject(&is_nil/1)
	end

	- def attachments_from_ids_descs([], _), do: []
	+ def attachments_from_ids_descs([], _, _), do: []

	- def attachments_from_ids_descs(ids, descs_str) do
	+ def attachments_from_ids_descs(ids, descs_str, user) do
	{_, descs} = Jason.decode(descs_str)

	Enum.map(ids, fn media_id ->
	- with %Object{data: data} <- get_attachment(media_id) do
	+ with %Object{data: data} <- get_attachment(media_id, user) do
	Map.put(data, "name", descs[media_id])
	end
	end)
	\|> Enum.reject(&is_nil/1)
	end

	- defp get_attachment(media_id) do
	- Repo.get(Object, media_id)
	+ defp get_attachment(media_id, user) do
	+ with %Object{data: _data} = object <- Repo.get(Object, media_id),
	+ :ok <- Object.authorize_access(object, user) do
	+ object
	+ else
	+ _ -> nil
	+ end
	end

	@spec get_to_and_cc(ActivityDraft.t()) :: {list(String.t()), list(String.t())}

	def get_to_and_cc(%{in_reply_to_conversation: %Participation{} = participation}) do
	participation = Repo.preload(participation, :recipients)
	{Enum.map(participation.recipients, & &1.ap_id), []}
	end

	def get_to_and_cc(%{visibility: visibility} = draft) when visibility in ["public", "local"] do
	to =
	case visibility do
	"public" -> [Pleroma.Constants.as_public() \| draft.mentions]
	"local" -> [Utils.as_local_public() \| draft.mentions]
	end

	cc = [draft.user.follower_address]

	if draft.in_reply_to do
	{Enum.uniq([draft.in_reply_to.data["actor"] \| to]), cc}
	else
	{to, cc}
	end
	end

	def get_to_and_cc(%{visibility: "unlisted"} = draft) do
	to = [draft.user.follower_address \| draft.mentions]
	cc = [Pleroma.Constants.as_public()]

	if draft.in_reply_to do
	{Enum.uniq([draft.in_reply_to.data["actor"] \| to]), cc}
	else
	{to, cc}
	end
	end

	def get_to_and_cc(%{visibility: "private"} = draft) do
	{to, cc} = get_to_and_cc(struct(draft, visibility: "direct"))
	{[draft.user.follower_address \| to], cc}
	end

	def get_to_and_cc(%{visibility: "direct"} = draft) do
	# If the OP is a DM already, add the implicit actor.
	if draft.in_reply_to && Visibility.is_direct?(draft.in_reply_to) do
	{Enum.uniq([draft.in_reply_to.data["actor"] \| draft.mentions]), []}
	else
	{draft.mentions, []}
	end
	end

	def get_to_and_cc(%{visibility: {:list, _}, mentions: mentions}), do: {mentions, []}

	def get_addressed_users(_, to) when is_list(to) do
	User.get_ap_ids_by_nicknames(to)
	end

	def get_addressed_users(mentioned_users, _), do: mentioned_users

	def maybe_add_list_data(activity_params, user, {:list, list_id}) do
	case Pleroma.List.get(list_id, user) do
	%Pleroma.List{} = list ->
	activity_params
	\|> put_in([:additional, "bcc"], [list.ap_id])
	\|> put_in([:additional, "listMessage"], list.ap_id)
	\|> put_in([:object, "listMessage"], list.ap_id)

	_ ->
	activity_params
	end
	end

	def maybe_add_list_data(activity_params, _, _), do: activity_params

	def make_poll_data(%{"poll" => %{"expires_in" => expires_in}} = data)
	when is_binary(expires_in) do
	# In some cases mastofe sends out strings instead of integers
	data
	\|> put_in(["poll", "expires_in"], String.to_integer(expires_in))
	\|> make_poll_data()
	end

	def make_poll_data(%{poll: %{options: options, expires_in: expires_in}} = data)
	when is_list(options) do
	limits = Config.get([:instance, :poll_limits])

	with :ok <- validate_poll_expiration(expires_in, limits),
	:ok <- validate_poll_options_amount(options, limits),
	:ok <- validate_poll_options_length(options, limits) do
	{option_notes, emoji} =
	Enum.map_reduce(options, %{}, fn option, emoji ->
	note = %{
	"name" => option,
	"type" => "Note",
	"replies" => %{"type" => "Collection", "totalItems" => 0}
	}

	{note, Map.merge(emoji, Pleroma.Emoji.Formatter.get_emoji_map(option))}
	end)

	end_time =
	DateTime.utc_now()
	\|> DateTime.add(expires_in)
	\|> DateTime.to_iso8601()

	key = if Params.truthy_param?(data.poll[:multiple]), do: "anyOf", else: "oneOf"
	poll = %{"type" => "Question", key => option_notes, "closed" => end_time}

	{:ok, {poll, emoji}}
	end
	end

	def make_poll_data(%{"poll" => poll}) when is_map(poll) do
	{:error, "Invalid poll"}
	end

	def make_poll_data(_data) do
	{:ok, {%{}, %{}}}
	end

	defp validate_poll_options_amount(options, %{max_options: max_options}) do
	if Enum.count(options) > max_options do
	{:error, "Poll can't contain more than #{max_options} options"}
	else
	:ok
	end
	end

	defp validate_poll_options_length(options, %{max_option_chars: max_option_chars}) do
	if Enum.any?(options, &(String.length(&1) > max_option_chars)) do
	{:error, "Poll options cannot be longer than #{max_option_chars} characters each"}
	else
	:ok
	end
	end

	defp validate_poll_expiration(expires_in, %{min_expiration: min, max_expiration: max}) do
	cond do
	expires_in > max -> {:error, "Expiration date is too far in the future"}
	expires_in < min -> {:error, "Expiration date is too soon"}
	true -> :ok
	end
	end

	def make_content_html(%ActivityDraft{} = draft) do
	attachment_links =
	draft.params
	\|> Map.get("attachment_links", Config.get([:instance, :attachment_links]))
	\|> Params.truthy_param?()

	content_type = get_content_type(draft.params[:content_type])

	options =
	if draft.visibility == "direct" && Config.get([:instance, :safe_dm_mentions]) do
	[safe_mention: true]
	else
	[]
	end

	draft.status
	\|> format_input(content_type, options)
	\|> maybe_add_attachments(draft.attachments, attachment_links)
	end

	def get_content_type(content_type) do
	if Enum.member?(Config.get([:instance, :allowed_post_formats]), content_type) do
	content_type
	else
	"text/plain"
	end
	end

	def make_context(_, %Participation{} = participation) do
	Repo.preload(participation, :conversation).conversation.ap_id
	end

	def make_context(%Activity{data: %{"context" => context}}, _), do: context
	def make_context(_, _), do: Utils.generate_context_id()

	def maybe_add_attachments(parsed, _attachments, false = _no_links), do: parsed

	def maybe_add_attachments({text, mentions, tags}, attachments, _no_links) do
	text = add_attachments(text, attachments)
	{text, mentions, tags}
	end

	def add_attachments(text, attachments) do
	attachment_text = Enum.map(attachments, &build_attachment_link/1)
	Enum.join([text \| attachment_text], "<br>")
	end

	defp build_attachment_link(%{"url" => [%{"href" => href} \| _]} = attachment) do
	name = attachment["name"] \|\| URI.decode(Path.basename(href))
	href = MediaProxy.url(href)
	"<a href=\"#{href}\" class='attachment'>#{shortname(name)}</a>"
	end

	defp build_attachment_link(_), do: ""

	def format_input(text, format, options \\ [])

	@doc """
	Formatting text to plain text, BBCode, HTML, or Markdown
	"""
	def format_input(text, "text/plain", options) do
	text
	\|> Formatter.html_escape("text/plain")
	\|> Formatter.linkify(options)
	\|> (fn {text, mentions, tags} ->
	{String.replace(text, ~r/\r?\n/, "<br>"), mentions, tags}
	end).()
	end

	def format_input(text, "text/bbcode", options) do
	text
	\|> String.replace(~r/\r/, "")
	\|> Formatter.html_escape("text/plain")
	\|> BBCode.to_html()
	\|> (fn {:ok, html} -> html end).()
	\|> Formatter.linkify(options)
	end

	def format_input(text, "text/html", options) do
	text
	\|> Formatter.html_escape("text/html")
	\|> Formatter.linkify(options)
	end

	def format_input(text, "text/markdown", options) do
	text
	\|> Formatter.mentions_escape(options)
	\|> Formatter.markdown_to_html()
	\|> Formatter.linkify(options)
	\|> Formatter.html_escape("text/html")
	end

	def format_naive_asctime(date) do
	date \|> DateTime.from_naive!("Etc/UTC") \|> format_asctime
	end

	def format_asctime(date) do
	Strftime.strftime!(date, "%a %b %d %H:%M:%S %z %Y")
	end

	def date_to_asctime(date) when is_binary(date) do
	with {:ok, date, _offset} <- DateTime.from_iso8601(date) do
	format_asctime(date)
	else
	_e ->
	Logger.warn("Date #{date} in wrong format, must be ISO 8601")
	""
	end
	end

	def date_to_asctime(date) do
	Logger.warn("Date #{date} in wrong format, must be ISO 8601")
	""
	end

	def to_masto_date(%NaiveDateTime{} = date) do
	date
	\|> NaiveDateTime.to_iso8601()
	\|> String.replace(~r/(\.\d+)?$/, ".000Z", global: false)
	end

	def to_masto_date(date) when is_binary(date) do
	with {:ok, date} <- NaiveDateTime.from_iso8601(date) do
	to_masto_date(date)
	else
	_ -> ""
	end
	end

	def to_masto_date(_), do: ""

	defp shortname(name) do
	with max_length when max_length > 0 <-
	Config.get([Pleroma.Upload, :filename_display_max_length], 30),
	true <- String.length(name) > max_length do
	String.slice(name, 0..max_length) <> "…"
	else
	_ -> name
	end
	end

	@spec confirm_current_password(User.t(), String.t()) :: {:ok, User.t()} \| {:error, String.t()}
	def confirm_current_password(user, password) do
	with %User{local: true} = db_user <- User.get_cached_by_id(user.id),
	true <- AuthenticationPlug.checkpw(password, db_user.password_hash) do
	{:ok, db_user}
	else
	_ -> {:error, dgettext("errors", "Invalid password.")}
	end
	end

	def maybe_notify_to_recipients(
	recipients,
	%Activity{data: %{"to" => to, "type" => _type}} = _activity
	) do
	recipients ++ to
	end

	def maybe_notify_to_recipients(recipients, _), do: recipients

	def maybe_notify_mentioned_recipients(
	recipients,
	%Activity{data: %{"to" => _to, "type" => type} = data} = activity
	)
	when type == "Create" do
	object = Object.normalize(activity, fetch: false)

	object_data =
	cond do
	not is_nil(object) ->
	object.data

	is_map(data["object"]) ->
	data["object"]

	true ->
	%{}
	end

	tagged_mentions = maybe_extract_mentions(object_data)

	recipients ++ tagged_mentions
	end

	def maybe_notify_mentioned_recipients(recipients, _), do: recipients

	def maybe_notify_subscribers(
	recipients,
	%Activity{data: %{"actor" => actor, "type" => "Create"}} = activity
	) do
	# Do not notify subscribers if author is making a reply
	with %Object{data: object} <- Object.normalize(activity, fetch: false),
	nil <- object["inReplyTo"],
	%User{} = user <- User.get_cached_by_ap_id(actor) do
	subscriber_ids =
	user
	\|> User.subscriber_users()
	\|> Enum.filter(&Visibility.visible_for_user?(activity, &1))
	\|> Enum.map(& &1.ap_id)

	recipients ++ subscriber_ids
	else
	_e -> recipients
	end
	end

	def maybe_notify_subscribers(recipients, _), do: recipients

	def maybe_notify_followers(recipients, %Activity{data: %{"type" => "Move"}} = activity) do
	with %User{} = user <- User.get_cached_by_ap_id(activity.actor) do
	user
	\|> User.get_followers()
	\|> Enum.map(& &1.ap_id)
	\|> Enum.concat(recipients)
	else
	_e -> recipients
	end
	end

	def maybe_notify_followers(recipients, _), do: recipients

	def maybe_extract_mentions(%{"tag" => tag}) do
	tag
	\|> Enum.filter(fn x -> is_map(x) && x["type"] == "Mention" end)
	\|> Enum.map(fn x -> x["href"] end)
	\|> Enum.uniq()
	end

	def maybe_extract_mentions(_), do: []

	def make_report_content_html(nil), do: {:ok, {nil, [], []}}

	def make_report_content_html(comment) do
	max_size = Config.get([:instance, :max_report_comment_size], 1000)

	if String.length(comment) <= max_size do
	{:ok, format_input(comment, "text/plain")}
	else
	{:error,
	dgettext("errors", "Comment must be up to %{max_size} characters", max_size: max_size)}
	end
	end

	def get_report_statuses(%User{ap_id: actor}, %{status_ids: status_ids})
	when is_list(status_ids) do
	{:ok, Activity.all_by_actor_and_id(actor, status_ids)}
	end

	def get_report_statuses(_, _), do: {:ok, nil}

	def validate_character_limit("" = _full_payload, [] = _attachments) do
	{:error, dgettext("errors", "Cannot post an empty status without attachments")}
	end

	def validate_character_limit(full_payload, _attachments) do
	limit = Config.get([:instance, :limit])
	length = String.length(full_payload)

	if length <= limit do
	:ok
	else
	{:error, dgettext("errors", "The status is over the character limit")}
	end
	end

	def validate_attachments_count([] = _attachments) do
	:ok
	end

	def validate_attachments_count(attachments) do
	limit = Config.get([:instance, :max_media_attachments])
	count = length(attachments)

	if count <= limit do
	:ok
	else
	{:error, dgettext("errors", "Too many attachments")}
	end
	end
	end
	diff --git a/test/pleroma/web/common_api/utils_test.exs b/test/pleroma/web/common_api/utils_test.exs
	index d309c6ded..c52d3e9c5 100644
	--- a/test/pleroma/web/common_api/utils_test.exs
	+++ b/test/pleroma/web/common_api/utils_test.exs
	@@ -1,671 +1,686 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPI.UtilsTest do
	alias Pleroma.Builders.UserBuilder
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.CommonAPI.ActivityDraft
	alias Pleroma.Web.CommonAPI.Utils
	use Pleroma.DataCase

	import ExUnit.CaptureLog
	import Pleroma.Factory

	@public_address "https://www.w3.org/ns/activitystreams#Public"

	describe "add_attachments/2" do
	setup do
	name =
	"Sakura Mana – Turned on by a Senior OL with a Temptating Tight Skirt-s Full Hipline and Panty Shot- Beautiful Thick Thighs- and Erotic Ass- -2015- -- Oppaitime 8-28-2017 6-50-33 PM.png"

	attachment = %{
	"url" => [%{"href" => URI.encode(name)}]
	}

	%{name: name, attachment: attachment}
	end

	test "it adds attachment links to a given text and attachment set", %{
	name: name,
	attachment: attachment
	} do
	len = 10
	clear_config([Pleroma.Upload, :filename_display_max_length], len)

	expected =
	"<br><a href=\"#{URI.encode(name)}\" class='attachment'>#{String.slice(name, 0..len)}…</a>"

	assert Utils.add_attachments("", [attachment]) == expected
	end

	test "doesn't truncate file name if config for truncate is set to 0", %{
	name: name,
	attachment: attachment
	} do
	clear_config([Pleroma.Upload, :filename_display_max_length], 0)

	expected = "<br><a href=\"#{URI.encode(name)}\" class='attachment'>#{name}</a>"

	assert Utils.add_attachments("", [attachment]) == expected
	end
	end

	describe "it confirms the password given is the current users password" do
	test "incorrect password given" do
	{:ok, user} = UserBuilder.insert()

	assert Utils.confirm_current_password(user, "") == {:error, "Invalid password."}
	end

	test "correct password given" do
	{:ok, user} = UserBuilder.insert()
	assert Utils.confirm_current_password(user, "test") == {:ok, user}
	end
	end

	describe "format_input/3" do
	test "works for bare text/plain" do
	text = "hello world!"
	expected = "hello world!"

	{output, [], []} = Utils.format_input(text, "text/plain")

	assert output == expected

	text = "hello world!\n\nsecond paragraph!"
	expected = "hello world!<br><br>second paragraph!"

	{output, [], []} = Utils.format_input(text, "text/plain")

	assert output == expected
	end

	test "works for bare text/html" do
	text = "<p>hello world!</p>"
	expected = "<p>hello world!</p>"

	{output, [], []} = Utils.format_input(text, "text/html")

	assert output == expected

	text = "<p>hello world!</p><br/>\n<p>second paragraph</p>"
	expected = "<p>hello world!</p><br/>\n<p>second paragraph</p>"

	{output, [], []} = Utils.format_input(text, "text/html")

	assert output == expected
	end

	test "works for bare text/markdown" do
	text = "hello world"
	expected = "<p><strong>hello world</strong></p>"

	{output, [], []} = Utils.format_input(text, "text/markdown")

	assert output == expected

	text = "hello world\n\nanother paragraph"
	expected = "<p><strong>hello world</strong></p><p><em>another paragraph</em></p>"

	{output, [], []} = Utils.format_input(text, "text/markdown")

	assert output == expected

	text = """
	> cool quote

	by someone
	"""

	expected = "<blockquote><p>cool quote</p></blockquote><p>by someone</p>"

	{output, [], []} = Utils.format_input(text, "text/markdown")

	assert output == expected
	end

	test "works for bare text/bbcode" do
	text = "[b]hello world[/b]"
	expected = "<strong>hello world</strong>"

	{output, [], []} = Utils.format_input(text, "text/bbcode")

	assert output == expected

	text = "[b]hello world![/b]\n\nsecond paragraph!"
	expected = "<strong>hello world!</strong><br><br>second paragraph!"

	{output, [], []} = Utils.format_input(text, "text/bbcode")

	assert output == expected

	text = "[b]hello world![/b]\n\n<strong>second paragraph!</strong>"

	expected =
	"<strong>hello world!</strong><br><br><strong>second paragraph!</strong>"

	{output, [], []} = Utils.format_input(text, "text/bbcode")

	assert output == expected
	end

	test "works for text/markdown with mentions" do
	{:ok, user} =
	UserBuilder.insert(%{nickname: "user__test", ap_id: "http://foo.com/user__test"})

	text = "hello world\n\nanother @user__test and @user__test google.com paragraph"

	{output, _, _} = Utils.format_input(text, "text/markdown")

	assert output ==
	~s(<p><strong>hello world</strong></p><p><em>another <span class="h-card"><a class="u-url mention" data-user="#{user.id}" href="http://foo.com/user__test" rel="ugc">@<span>user__test</span></a></span> and <span class="h-card"><a class="u-url mention" data-user="#{user.id}" href="http://foo.com/user__test" rel="ugc">@<span>user__test</span></a></span> <a href="http://google.com" rel="ugc">google.com</a> paragraph</em></p>)
	end
	end

	describe "format_input/3 with markdown" do
	test "Paragraph" do
	code = ~s[Hello\n\nWorld!]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == "<p>Hello</p><p>World!</p>"
	end

	test "links" do
	code = "https://en.wikipedia.org/wiki/Animal_Crossing_(video_game)"
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><a href="#{code}">#{code}</a></p>]

	code = "https://github.com/pragdave/earmark/"
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><a href="#{code}">#{code}</a></p>]

	code = "https://github.com/~foo/bar"
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><a href="#{code}">#{code}</a></p>]
	end

	test "link with local mention" do
	insert(:user, %{nickname: "lain"})

	code = "https://example.com/@lain"
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><a href="#{code}">#{code}</a></p>]
	end

	test "local mentions" do
	mario = insert(:user, %{nickname: "mario"})
	luigi = insert(:user, %{nickname: "luigi"})

	code = "@mario @luigi yo what's up?"
	{result, _, []} = Utils.format_input(code, "text/markdown")

	assert result ==
	~s[<p><span class="h-card"><a class="u-url mention" data-user="#{mario.id}" href="#{mario.ap_id}" rel="ugc">@<span>mario</span></a></span> <span class="h-card"><a class="u-url mention" data-user="#{luigi.id}" href="#{luigi.ap_id}" rel="ugc">@<span>luigi</span></a></span> yo what’s up?</p>]
	end

	test "remote mentions" do
	mario = insert(:user, %{nickname: "mario@mushroom.world", local: false})
	luigi = insert(:user, %{nickname: "luigi@mushroom.world", local: false})

	code = "@mario@mushroom.world @luigi@mushroom.world yo what's up?"
	{result, _, []} = Utils.format_input(code, "text/markdown")

	assert result ==
	~s[<p><span class="h-card"><a class="u-url mention" data-user="#{mario.id}" href="#{mario.ap_id}" rel="ugc">@<span>mario</span></a></span> <span class="h-card"><a class="u-url mention" data-user="#{luigi.id}" href="#{luigi.ap_id}" rel="ugc">@<span>luigi</span></a></span> yo what’s up?</p>]
	end

	test "raw HTML" do
	code = ~s[<a href="http://example.org/">OwO</a><!-- what's this?-->]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<a href="http://example.org/">OwO</a>]
	end

	test "rulers" do
	code = ~s[before\n\n-----\n\nafter]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == "<p>before</p><hr/><p>after</p>"
	end

	test "blockquote" do
	code = ~s[> whoms't are you quoting?]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == "<blockquote><p>whoms’t are you quoting?</p></blockquote>"
	end

	test "code" do
	code = ~s[`mix`]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><code class="inline">mix</code></p>]

	code = ~s[``mix``]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><code class="inline">mix</code></p>]

	code = ~s[```\nputs "Hello World"\n```]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<pre><code>puts "Hello World"</code></pre>]

	code = ~s[ <div>\n </div>]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<pre><code><div>\n</div></code></pre>]
	end

	test "lists" do
	code = ~s[- one\n- two\n- three\n- four]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == "<ul><li>one</li><li>two</li><li>three</li><li>four</li></ul>"

	code = ~s[1. one\n2. two\n3. three\n4. four\n]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == "<ol><li>one</li><li>two</li><li>three</li><li>four</li></ol>"
	end

	test "delegated renderers" do
	code = ~s[aaaa~]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><em>aaaa~</em></p>]

	code = ~s[aaaa~]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><strong>aaaa~</strong></p>]

	# strikethrough
	code = ~s[~~aaaa~~~]
	{result, [], []} = Utils.format_input(code, "text/markdown")
	assert result == ~s[<p><del>aaaa</del>~</p>]
	end
	end

	describe "formats date to asctime" do
	test "when date is in ISO 8601 format" do
	date = DateTime.utc_now() \|> DateTime.to_iso8601()

	expected =
	date
	\|> DateTime.from_iso8601()
	\|> elem(1)
	\|> Calendar.Strftime.strftime!("%a %b %d %H:%M:%S %z %Y")

	assert Utils.date_to_asctime(date) == expected
	end

	test "when date is a binary in wrong format" do
	date = DateTime.utc_now()

	expected = ""

	assert capture_log(fn ->
	assert Utils.date_to_asctime(date) == expected
	end) =~ "Date #{date} in wrong format, must be ISO 8601"
	end

	test "when date is a Unix timestamp" do
	date = DateTime.utc_now() \|> DateTime.to_unix()

	expected = ""

	assert capture_log(fn ->
	assert Utils.date_to_asctime(date) == expected
	end) =~ "Date #{date} in wrong format, must be ISO 8601"
	end

	test "when date is nil" do
	expected = ""

	assert capture_log(fn ->
	assert Utils.date_to_asctime(nil) == expected
	end) =~ "Date in wrong format, must be ISO 8601"
	end

	test "when date is a random string" do
	assert capture_log(fn ->
	assert Utils.date_to_asctime("foo") == ""
	end) =~ "Date foo in wrong format, must be ISO 8601"
	end
	end

	describe "get_to_and_cc" do
	test "for public posts, not a reply" do
	user = insert(:user)
	mentioned_user = insert(:user)
	draft = %ActivityDraft{user: user, mentions: [mentioned_user.ap_id], visibility: "public"}

	{to, cc} = Utils.get_to_and_cc(draft)

	assert length(to) == 2
	assert length(cc) == 1

	assert @public_address in to
	assert mentioned_user.ap_id in to
	assert user.follower_address in cc
	end

	test "for public posts, a reply" do
	user = insert(:user)
	mentioned_user = insert(:user)
	third_user = insert(:user)
	{:ok, activity} = CommonAPI.post(third_user, %{status: "uguu"})

	draft = %ActivityDraft{
	user: user,
	mentions: [mentioned_user.ap_id],
	visibility: "public",
	in_reply_to: activity
	}

	{to, cc} = Utils.get_to_and_cc(draft)

	assert length(to) == 3
	assert length(cc) == 1

	assert @public_address in to
	assert mentioned_user.ap_id in to
	assert third_user.ap_id in to
	assert user.follower_address in cc
	end

	test "for unlisted posts, not a reply" do
	user = insert(:user)
	mentioned_user = insert(:user)
	draft = %ActivityDraft{user: user, mentions: [mentioned_user.ap_id], visibility: "unlisted"}

	{to, cc} = Utils.get_to_and_cc(draft)

	assert length(to) == 2
	assert length(cc) == 1

	assert @public_address in cc
	assert mentioned_user.ap_id in to
	assert user.follower_address in to
	end

	test "for unlisted posts, a reply" do
	user = insert(:user)
	mentioned_user = insert(:user)
	third_user = insert(:user)
	{:ok, activity} = CommonAPI.post(third_user, %{status: "uguu"})

	draft = %ActivityDraft{
	user: user,
	mentions: [mentioned_user.ap_id],
	visibility: "unlisted",
	in_reply_to: activity
	}

	{to, cc} = Utils.get_to_and_cc(draft)

	assert length(to) == 3
	assert length(cc) == 1

	assert @public_address in cc
	assert mentioned_user.ap_id in to
	assert third_user.ap_id in to
	assert user.follower_address in to
	end

	test "for private posts, not a reply" do
	user = insert(:user)
	mentioned_user = insert(:user)
	draft = %ActivityDraft{user: user, mentions: [mentioned_user.ap_id], visibility: "private"}

	{to, cc} = Utils.get_to_and_cc(draft)
	assert length(to) == 2
	assert Enum.empty?(cc)

	assert mentioned_user.ap_id in to
	assert user.follower_address in to
	end

	test "for private posts, a reply" do
	user = insert(:user)
	mentioned_user = insert(:user)
	third_user = insert(:user)
	{:ok, activity} = CommonAPI.post(third_user, %{status: "uguu"})

	draft = %ActivityDraft{
	user: user,
	mentions: [mentioned_user.ap_id],
	visibility: "private",
	in_reply_to: activity
	}

	{to, cc} = Utils.get_to_and_cc(draft)

	assert length(to) == 2
	assert Enum.empty?(cc)

	assert mentioned_user.ap_id in to
	assert user.follower_address in to
	end

	test "for direct posts, not a reply" do
	user = insert(:user)
	mentioned_user = insert(:user)
	draft = %ActivityDraft{user: user, mentions: [mentioned_user.ap_id], visibility: "direct"}

	{to, cc} = Utils.get_to_and_cc(draft)

	assert length(to) == 1
	assert Enum.empty?(cc)

	assert mentioned_user.ap_id in to
	end

	test "for direct posts, a reply" do
	user = insert(:user)
	mentioned_user = insert(:user)
	third_user = insert(:user)
	{:ok, activity} = CommonAPI.post(third_user, %{status: "uguu"})

	draft = %ActivityDraft{
	user: user,
	mentions: [mentioned_user.ap_id],
	visibility: "direct",
	in_reply_to: activity
	}

	{to, cc} = Utils.get_to_and_cc(draft)

	assert length(to) == 1
	assert Enum.empty?(cc)

	assert mentioned_user.ap_id in to

	{:ok, direct_activity} = CommonAPI.post(third_user, %{status: "uguu", visibility: "direct"})

	draft = %ActivityDraft{
	user: user,
	mentions: [mentioned_user.ap_id],
	visibility: "direct",
	in_reply_to: direct_activity
	}

	{to, cc} = Utils.get_to_and_cc(draft)

	assert length(to) == 2
	assert Enum.empty?(cc)

	assert mentioned_user.ap_id in to
	assert third_user.ap_id in to
	end
	end

	describe "to_master_date/1" do
	test "removes microseconds from date (NaiveDateTime)" do
	assert Utils.to_masto_date(~N[2015-01-23 23:50:07.123]) == "2015-01-23T23:50:07.000Z"
	end

	test "removes microseconds from date (String)" do
	assert Utils.to_masto_date("2015-01-23T23:50:07.123Z") == "2015-01-23T23:50:07.000Z"
	end

	test "returns empty string when date invalid" do
	assert Utils.to_masto_date("2015-01?23T23:50:07.123Z") == ""
	end
	end

	describe "maybe_notify_mentioned_recipients/2" do
	test "returns recipients when activity is not `Create`" do
	activity = insert(:like_activity)
	assert Utils.maybe_notify_mentioned_recipients(["test"], activity) == ["test"]
	end

	test "returns recipients from tag" do
	user = insert(:user)

	object =
	insert(:note,
	user: user,
	data: %{
	"tag" => [
	%{"type" => "Hashtag"},
	"",
	%{"type" => "Mention", "href" => "https://testing.pleroma.lol/users/lain"},
	%{"type" => "Mention", "href" => "https://shitposter.club/user/5381"},
	%{"type" => "Mention", "href" => "https://shitposter.club/user/5381"}
	]
	}
	)

	activity = insert(:note_activity, user: user, note: object)

	assert Utils.maybe_notify_mentioned_recipients(["test"], activity) == [
	"test",
	"https://testing.pleroma.lol/users/lain",
	"https://shitposter.club/user/5381"
	]
	end

	test "returns recipients when object is map" do
	user = insert(:user)
	object = insert(:note, user: user)

	activity =
	insert(:note_activity,
	user: user,
	note: object,
	data_attrs: %{
	"object" => %{
	"tag" => [
	%{"type" => "Hashtag"},
	"",
	%{"type" => "Mention", "href" => "https://testing.pleroma.lol/users/lain"},
	%{"type" => "Mention", "href" => "https://shitposter.club/user/5381"},
	%{"type" => "Mention", "href" => "https://shitposter.club/user/5381"}
	]
	}
	}
	)

	Pleroma.Repo.delete(object)

	assert Utils.maybe_notify_mentioned_recipients(["test"], activity) == [
	"test",
	"https://testing.pleroma.lol/users/lain",
	"https://shitposter.club/user/5381"
	]
	end

	test "returns recipients when object not found" do
	user = insert(:user)
	object = insert(:note, user: user)

	activity = insert(:note_activity, user: user, note: object)
	Pleroma.Repo.delete(object)

	obj_url = activity.data["object"]

	Tesla.Mock.mock(fn
	%{method: :get, url: ^obj_url} ->
	%Tesla.Env{status: 404, body: ""}
	end)

	assert Utils.maybe_notify_mentioned_recipients(["test-test"], activity) == [
	"test-test"
	]
	end
	end

	- describe "attachments_from_ids_descs/2" do
	+ describe "attachments_from_ids_descs/3" do
	test "returns [] when attachment ids is empty" do
	- assert Utils.attachments_from_ids_descs([], "{}") == []
	+ assert Utils.attachments_from_ids_descs([], "{}", nil) == []
	end

	test "returns list attachments with desc" do
	- object = insert(:note)
	+ user = insert(:user)
	+ object = insert(:note, %{user: user})
	desc = Jason.encode!(%{object.id => "test-desc"})

	- assert Utils.attachments_from_ids_descs(["#{object.id}", "34"], desc) == [
	+ assert Utils.attachments_from_ids_descs(["#{object.id}", "34"], desc, user) == [
	Map.merge(object.data, %{"name" => "test-desc"})
	]
	end
	end

	- describe "attachments_from_ids/1" do
	+ describe "attachments_from_ids/2" do
	test "returns attachments with descs" do
	- object = insert(:note)
	+ user = insert(:user)
	+ object = insert(:note, %{user: user})
	desc = Jason.encode!(%{object.id => "test-desc"})

	- assert Utils.attachments_from_ids(%{
	- media_ids: ["#{object.id}"],
	- descriptions: desc
	- }) == [
	+ assert Utils.attachments_from_ids(
	+ %{
	+ media_ids: ["#{object.id}"],
	+ descriptions: desc
	+ },
	+ user
	+ ) == [
	Map.merge(object.data, %{"name" => "test-desc"})
	]
	end

	test "returns attachments without descs" do
	- object = insert(:note)
	- assert Utils.attachments_from_ids(%{media_ids: ["#{object.id}"]}) == [object.data]
	+ user = insert(:user)
	+ object = insert(:note, %{user: user})
	+ assert Utils.attachments_from_ids(%{media_ids: ["#{object.id}"]}, user) == [object.data]
	end

	test "returns [] when not pass media_ids" do
	- assert Utils.attachments_from_ids(%{}) == []
	+ assert Utils.attachments_from_ids(%{}, nil) == []
	+ end
	+
	+ test "returns [] when media_ids not belong to current user" do
	+ user = insert(:user)
	+ user2 = insert(:user)
	+
	+ object = insert(:attachment, %{user: user})
	+
	+ assert Utils.attachments_from_ids(%{media_ids: ["#{object.id}"]}, user2) == []
	end
	end

	describe "maybe_add_list_data/3" do
	test "adds list params when found user list" do
	user = insert(:user)
	{:ok, %Pleroma.List{} = list} = Pleroma.List.create("title", user)

	assert Utils.maybe_add_list_data(%{additional: %{}, object: %{}}, user, {:list, list.id}) ==
	%{
	additional: %{"bcc" => [list.ap_id], "listMessage" => list.ap_id},
	object: %{"listMessage" => list.ap_id}
	}
	end

	test "returns original params when list not found" do
	user = insert(:user)
	{:ok, %Pleroma.List{} = list} = Pleroma.List.create("title", insert(:user))

	assert Utils.maybe_add_list_data(%{additional: %{}, object: %{}}, user, {:list, list.id}) ==
	%{additional: %{}, object: %{}}
	end
	end

	describe "maybe_add_attachments/3" do
	test "returns parsed results when attachment_links is false" do
	assert Utils.maybe_add_attachments(
	{"test", [], ["tags"]},
	[],
	false
	) == {"test", [], ["tags"]}
	end

	test "adds attachments to parsed results" do
	attachment = %{"url" => [%{"href" => "SakuraPM.png"}]}

	assert Utils.maybe_add_attachments(
	{"test", [], ["tags"]},
	[attachment],
	true
	) == {
	"test<br><a href=\"SakuraPM.png\" class='attachment'>SakuraPM.png</a>",
	[],
	["tags"]
	}
	end
	end
	end
	diff --git a/test/pleroma/web/common_api_test.exs b/test/pleroma/web/common_api_test.exs
	index 5c9103e9f..e60691995 100644
	--- a/test/pleroma/web/common_api_test.exs
	+++ b/test/pleroma/web/common_api_test.exs
	@@ -1,1727 +1,1745 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.CommonAPITest do
	use Oban.Testing, repo: Pleroma.Repo
	use Pleroma.DataCase, async: false

	alias Pleroma.Activity
	alias Pleroma.Chat
	alias Pleroma.Conversation.Participation
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.AdminAPI.AccountView
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Workers.PollWorker

	import Pleroma.Factory
	import Mock
	import Ecto.Query, only: [from: 2]

	require Pleroma.Constants

	setup_all do
	Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
	:ok
	end

	setup do: clear_config([:instance, :safe_dm_mentions])
	setup do: clear_config([:instance, :limit])
	setup do: clear_config([:instance, :max_pinned_statuses])

	describe "posting polls" do
	test "it posts a poll" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "who is the best",
	poll: %{expires_in: 600, options: ["reimu", "marisa"]}
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["type"] == "Question"
	assert object.data["oneOf"] \|> length() == 2

	assert_enqueued(
	worker: PollWorker,
	args: %{op: "poll_end", activity_id: activity.id},
	scheduled_at: NaiveDateTime.from_iso8601!(object.data["closed"])
	)
	end
	end

	describe "blocking" do
	setup do
	blocker = insert(:user)
	blocked = insert(:user, local: false)
	CommonAPI.follow(blocker, blocked)
	CommonAPI.follow(blocked, blocker)
	CommonAPI.accept_follow_request(blocker, blocked)
	CommonAPI.accept_follow_request(blocked, blocked)
	%{blocker: blocker, blocked: blocked}
	end

	test "it blocks and federates", %{blocker: blocker, blocked: blocked} do
	clear_config([:instance, :federating], true)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert User.get_follow_state(blocker, blocked) == :follow_accept
	refute is_nil(Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(blocker, blocked))

	assert {:ok, block} = CommonAPI.block(blocker, blocked)

	assert block.local
	assert User.blocks?(blocker, blocked)
	refute User.following?(blocker, blocked)
	refute User.following?(blocked, blocker)

	refute User.get_follow_state(blocker, blocked)

	assert %{data: %{"state" => "reject"}} =
	Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(blocker, blocked)

	assert called(Pleroma.Web.Federator.publish(block))
	end
	end

	test "it blocks and does not federate if outgoing blocks are disabled", %{
	blocker: blocker,
	blocked: blocked
	} do
	clear_config([:instance, :federating], true)
	clear_config([:activitypub, :outgoing_blocks], false)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert {:ok, block} = CommonAPI.block(blocker, blocked)

	assert block.local
	assert User.blocks?(blocker, blocked)
	refute User.following?(blocker, blocked)
	refute User.following?(blocked, blocker)

	refute called(Pleroma.Web.Federator.publish(block))
	end
	end
	end

	describe "posting chat messages" do
	setup do: clear_config([:instance, :chat_limit])

	test "it posts a self-chat" do
	author = insert(:user)
	recipient = author

	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"remember to buy milk when milk truk arive"
	)

	assert activity.data["type"] == "Create"
	end

	test "it posts a chat message without content but with an attachment" do
	author = insert(:user)
	recipient = insert(:user)

	file = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, upload} = ActivityPub.upload(file, actor: author.ap_id)

	with_mocks([
	{
	Pleroma.Web.Streamer,
	[],
	[
	stream: fn _, _ ->
	nil
	end
	]
	},
	{
	Pleroma.Web.Push,
	[],
	[
	send: fn _ -> nil end
	]
	}
	]) do
	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	nil,
	media_id: upload.id
	)

	notification =
	Notification.for_user_and_activity(recipient, activity)
	\|> Repo.preload(:activity)

	assert called(Pleroma.Web.Push.send(notification))
	assert called(Pleroma.Web.Streamer.stream(["user", "user:notification"], notification))
	assert called(Pleroma.Web.Streamer.stream(["user", "user:pleroma_chat"], :_))

	assert activity
	end
	end

	test "it adds html newlines" do
	author = insert(:user)
	recipient = insert(:user)

	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"uguu\nuguuu"
	)

	assert other_user.ap_id not in activity.recipients

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == "uguu<br/>uguuu"
	end

	test "it linkifies" do
	author = insert(:user)
	recipient = insert(:user)

	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"https://example.org is the site of @#{other_user.nickname} #2hu"
	)

	assert other_user.ap_id not in activity.recipients

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] ==
	"<a href=\"https://example.org\" rel=\"ugc\">https://example.org</a> is the site of <span class=\"h-card\"><a class=\"u-url mention\" data-user=\"#{other_user.id}\" href=\"#{other_user.ap_id}\" rel=\"ugc\">@<span>#{other_user.nickname}</span></a></span> <a class=\"hashtag\" data-tag=\"2hu\" href=\"http://localhost:4001/tag/2hu\">#2hu</a>"
	end

	test "it posts a chat message" do
	author = insert(:user)
	recipient = insert(:user)

	{:ok, activity} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"a test message <script>alert('uuu')</script> :firefox:"
	)

	assert activity.data["type"] == "Create"
	assert activity.local
	object = Object.normalize(activity, fetch: false)

	assert object.data["type"] == "ChatMessage"
	assert object.data["to"] == [recipient.ap_id]

	assert object.data["content"] ==
	"a test message <script>alert('uuu')</script> :firefox:"

	assert object.data["emoji"] == %{
	"firefox" => "http://localhost:4001/emoji/Firefox.gif"
	}

	assert Chat.get(author.id, recipient.ap_id)
	assert Chat.get(recipient.id, author.ap_id)

	assert :ok == Pleroma.Web.Federator.perform(:publish, activity)
	end

	test "it reject messages over the local limit" do
	clear_config([:instance, :chat_limit], 2)

	author = insert(:user)
	recipient = insert(:user)

	{:error, message} =
	CommonAPI.post_chat_message(
	author,
	recipient,
	"123"
	)

	assert message == :content_too_long
	end

	test "it reject messages via MRF" do
	clear_config([:mrf_keyword, :reject], ["GNO"])
	clear_config([:mrf, :policies], [Pleroma.Web.ActivityPub.MRF.KeywordPolicy])

	author = insert(:user)
	recipient = insert(:user)

	assert {:reject, "[KeywordPolicy] Matches with rejected keyword"} ==
	CommonAPI.post_chat_message(author, recipient, "GNO/Linux")
	end
	+
	+ test "it reject messages with attachments not belonging to user" do
	+ author = insert(:user)
	+ not_author = insert(:user)
	+ recipient = author
	+
	+ attachment = insert(:attachment, %{user: not_author})
	+
	+ {:error, message} =
	+ CommonAPI.post_chat_message(
	+ author,
	+ recipient,
	+ "123",
	+ media_id: attachment.id
	+ )
	+
	+ assert message == :forbidden
	+ end
	end

	describe "unblocking" do
	test "it works even without an existing block activity" do
	blocked = insert(:user)
	blocker = insert(:user)
	User.block(blocker, blocked)

	assert User.blocks?(blocker, blocked)
	assert {:ok, :no_activity} == CommonAPI.unblock(blocker, blocked)
	refute User.blocks?(blocker, blocked)
	end
	end

	describe "deletion" do
	test "it works with pruned objects" do
	user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	clear_config([:instance, :federating], true)

	Object.normalize(post, fetch: false)
	\|> Object.prune()

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert {:ok, delete} = CommonAPI.delete(post.id, user)
	assert delete.local
	assert called(Pleroma.Web.Federator.publish(delete))
	end

	refute Activity.get_by_id(post.id)
	end

	test "it allows users to delete their posts" do
	user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	clear_config([:instance, :federating], true)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert {:ok, delete} = CommonAPI.delete(post.id, user)
	assert delete.local
	assert called(Pleroma.Web.Federator.publish(delete))
	end

	refute Activity.get_by_id(post.id)
	end

	test "it does not allow a user to delete posts from another user" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	assert {:error, "Could not delete"} = CommonAPI.delete(post.id, other_user)
	assert Activity.get_by_id(post.id)
	end

	test "it allows privileged users to delete other user's posts" do
	clear_config([:instance, :moderator_privileges], [:messages_delete])
	user = insert(:user)
	moderator = insert(:user, is_moderator: true)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	assert {:ok, delete} = CommonAPI.delete(post.id, moderator)
	assert delete.local

	refute Activity.get_by_id(post.id)
	end

	test "it doesn't allow unprivileged mods or admins to delete other user's posts" do
	clear_config([:instance, :admin_privileges], [])
	clear_config([:instance, :moderator_privileges], [])
	user = insert(:user)
	moderator = insert(:user, is_moderator: true, is_admin: true)

	{:ok, post} = CommonAPI.post(user, %{status: "namu amida butsu"})

	assert {:error, "Could not delete"} = CommonAPI.delete(post.id, moderator)
	assert Activity.get_by_id(post.id)
	end

	test "privileged users deleting non-local posts won't federate the delete" do
	clear_config([:instance, :admin_privileges], [:messages_delete])
	# This is the user of the ingested activity
	_user =
	insert(:user,
	local: false,
	ap_id: "http://mastodon.example.org/users/admin",
	last_refreshed_at: NaiveDateTime.utc_now()
	)

	admin = insert(:user, is_admin: true)

	data =
	File.read!("test/fixtures/mastodon-post-activity.json")
	\|> Jason.decode!()

	{:ok, post} = Transmogrifier.handle_incoming(data)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	assert {:ok, delete} = CommonAPI.delete(post.id, admin)
	assert delete.local
	refute called(Pleroma.Web.Federator.publish(:_))
	end

	refute Activity.get_by_id(post.id)
	end
	end

	test "favoriting race condition" do
	user = insert(:user)
	users_serial = insert_list(10, :user)
	users = insert_list(10, :user)

	{:ok, activity} = CommonAPI.post(user, %{status: "."})

	users_serial
	\|> Enum.map(fn user ->
	CommonAPI.favorite(user, activity.id)
	end)

	object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["like_count"] == 10

	users
	\|> Enum.map(fn user ->
	Task.async(fn ->
	CommonAPI.favorite(user, activity.id)
	end)
	end)
	\|> Enum.map(&Task.await/1)

	object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["like_count"] == 20
	end

	test "repeating race condition" do
	user = insert(:user)
	users_serial = insert_list(10, :user)
	users = insert_list(10, :user)

	{:ok, activity} = CommonAPI.post(user, %{status: "."})

	users_serial
	\|> Enum.map(fn user ->
	CommonAPI.repeat(activity.id, user)
	end)

	object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["announcement_count"] == 10

	users
	\|> Enum.map(fn user ->
	Task.async(fn ->
	CommonAPI.repeat(activity.id, user)
	end)
	end)
	\|> Enum.map(&Task.await/1)

	object = Object.get_by_ap_id(activity.data["object"])
	assert object.data["announcement_count"] == 20
	end

	test "when replying to a conversation / participation, it will set the correct context id even if no explicit reply_to is given" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})

	[participation] = Participation.for_user(user)

	{:ok, convo_reply} =
	CommonAPI.post(user, %{status: ".", in_reply_to_conversation_id: participation.id})

	assert Visibility.is_direct?(convo_reply)

	assert activity.data["context"] == convo_reply.data["context"]
	end

	test "when replying to a conversation / participation, it only mentions the recipients explicitly declared in the participation" do
	har = insert(:user)
	jafnhar = insert(:user)
	tridi = insert(:user)

	{:ok, activity} =
	CommonAPI.post(har, %{
	status: "@#{jafnhar.nickname} hey",
	visibility: "direct"
	})

	assert har.ap_id in activity.recipients
	assert jafnhar.ap_id in activity.recipients

	[participation] = Participation.for_user(har)

	{:ok, activity} =
	CommonAPI.post(har, %{
	status: "I don't really like @#{tridi.nickname}",
	visibility: "direct",
	in_reply_to_status_id: activity.id,
	in_reply_to_conversation_id: participation.id
	})

	assert har.ap_id in activity.recipients
	assert jafnhar.ap_id in activity.recipients
	refute tridi.ap_id in activity.recipients
	end

	test "with the safe_dm_mention option set, it does not mention people beyond the initial tags" do
	har = insert(:user)
	jafnhar = insert(:user)
	tridi = insert(:user)

	clear_config([:instance, :safe_dm_mentions], true)

	{:ok, activity} =
	CommonAPI.post(har, %{
	status: "@#{jafnhar.nickname} hey, i never want to see @#{tridi.nickname} again",
	visibility: "direct"
	})

	refute tridi.ap_id in activity.recipients
	assert jafnhar.ap_id in activity.recipients
	end

	test "it de-duplicates tags" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "#2hu #2HU"})

	object = Object.normalize(activity, fetch: false)

	assert Object.tags(object) == ["2hu"]
	end

	test "zwnj is treated as word character" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "#ساٴين‌س"})

	object = Object.normalize(activity, fetch: false)

	assert Object.tags(object) == ["ساٴين‌س"]
	end

	test "double dot in link is allowed" do
	user = insert(:user)
	text = "https://example.to/something..mp3"
	{:ok, activity} = CommonAPI.post(user, %{status: text})

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == "<a href=\"#{text}\" rel=\"ugc\">#{text}</a>"
	end

	test "it adds emoji in the object" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: ":firefox:"})

	assert Object.normalize(activity, fetch: false).data["emoji"]["firefox"]
	end

	describe "posting" do
	test "it adds an emoji on an external site" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "hey :external_emoji:"})

	assert %{"external_emoji" => url} = Object.normalize(activity).data["emoji"]
	assert url == "https://example.com/emoji.png"

	{:ok, activity} = CommonAPI.post(user, %{status: "hey :blank:"})

	assert %{"blank" => url} = Object.normalize(activity).data["emoji"]
	assert url == "#{Pleroma.Web.Endpoint.url()}/emoji/blank.png"
	end

	test "it copies emoji from the subject of the parent post" do
	%Object{} =
	object =
	Object.normalize("https://patch.cx/objects/a399c28e-c821-4820-bc3e-4afeb044c16f",
	fetch: true
	)

	activity = Activity.get_create_by_object_ap_id(object.data["id"])
	user = insert(:user)

	{:ok, reply_activity} =
	CommonAPI.post(user, %{
	in_reply_to_id: activity.id,
	status: ":joker_disapprove:",
	spoiler_text: ":joker_smile:"
	})

	assert Object.normalize(reply_activity).data["emoji"]["joker_smile"]
	refute Object.normalize(reply_activity).data["emoji"]["joker_disapprove"]
	end

	test "deactivated users can't post" do
	user = insert(:user, is_active: false)
	assert {:error, _} = CommonAPI.post(user, %{status: "ye"})
	end

	test "it supports explicit addressing" do
	user = insert(:user)
	user_two = insert(:user)
	user_three = insert(:user)
	user_four = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status:
	"Hey, I think @#{user_three.nickname} is ugly. @#{user_four.nickname} is alright though.",
	to: [user_two.nickname, user_four.nickname, "nonexistent"]
	})

	assert user.ap_id in activity.recipients
	assert user_two.ap_id in activity.recipients
	assert user_four.ap_id in activity.recipients
	refute user_three.ap_id in activity.recipients
	end

	test "it filters out obviously bad tags when accepting a post as HTML" do
	user = insert(:user)

	post = "<p><b>2hu</b></p><script>alert('xss')</script>"

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: post,
	content_type: "text/html"
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == "<p><b>2hu</b></p>alert('xss')"
	assert object.data["source"]["content"] == post
	end

	test "it filters out obviously bad tags when accepting a post as Markdown" do
	user = insert(:user)

	post = "<p><b>2hu</b></p><script>alert('xss')</script>"

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: post,
	content_type: "text/markdown"
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["content"] == "<p><b>2hu</b></p>"
	assert object.data["source"]["content"] == post
	end

	test "it does not allow replies to direct messages that are not direct messages themselves" do
	user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{status: "suya..", visibility: "direct"})

	assert {:ok, _} =
	CommonAPI.post(user, %{
	status: "suya..",
	visibility: "direct",
	in_reply_to_status_id: activity.id
	})

	Enum.each(["public", "private", "unlisted"], fn visibility ->
	assert {:error, "The message visibility must be direct"} =
	CommonAPI.post(user, %{
	status: "suya..",
	visibility: visibility,
	in_reply_to_status_id: activity.id
	})
	end)
	end

	test "replying with a direct message will NOT auto-add the author of the reply to the recipient list" do
	user = insert(:user)
	other_user = insert(:user)
	third_user = insert(:user)

	{:ok, post} = CommonAPI.post(user, %{status: "I'm stupid"})

	{:ok, open_answer} =
	CommonAPI.post(other_user, %{status: "No ur smart", in_reply_to_status_id: post.id})

	# The OP is implicitly added
	assert user.ap_id in open_answer.recipients

	{:ok, secret_answer} =
	CommonAPI.post(other_user, %{
	status: "lol, that guy really is stupid, right, @#{third_user.nickname}?",
	in_reply_to_status_id: post.id,
	visibility: "direct"
	})

	assert third_user.ap_id in secret_answer.recipients

	# The OP is not added
	refute user.ap_id in secret_answer.recipients
	end

	test "it allows to address a list" do
	user = insert(:user)
	{:ok, list} = Pleroma.List.create("foo", user)

	{:ok, activity} = CommonAPI.post(user, %{status: "foobar", visibility: "list:#{list.id}"})

	assert activity.data["bcc"] == [list.ap_id]
	assert activity.recipients == [list.ap_id, user.ap_id]
	assert activity.data["listMessage"] == list.ap_id
	end

	test "it returns error when status is empty and no attachments" do
	user = insert(:user)

	assert {:error, "Cannot post an empty status without attachments"} =
	CommonAPI.post(user, %{status: ""})
	end

	test "it validates character limits are correctly enforced" do
	clear_config([:instance, :limit], 5)

	user = insert(:user)

	assert {:error, "The status is over the character limit"} =
	CommonAPI.post(user, %{status: "foobar"})

	assert {:ok, _activity} = CommonAPI.post(user, %{status: "12345"})
	end

	test "it validates media attachment limits are correctly enforced" do
	clear_config([:instance, :max_media_attachments], 4)

	user = insert(:user)

	file = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, upload} = ActivityPub.upload(file, actor: user.ap_id)

	assert {:error, "Too many attachments"} =
	CommonAPI.post(user, %{
	status: "",
	media_ids: List.duplicate(upload.id, 5)
	})

	assert {:ok, _activity} =
	CommonAPI.post(user, %{
	status: "",
	media_ids: [upload.id]
	})
	end

	test "it can handle activities that expire" do
	user = insert(:user)

	expires_at = DateTime.add(DateTime.utc_now(), 1_000_000)

	assert {:ok, activity} = CommonAPI.post(user, %{status: "chai", expires_in: 1_000_000})

	assert_enqueued(
	worker: Pleroma.Workers.PurgeExpiredActivity,
	args: %{activity_id: activity.id},
	scheduled_at: expires_at
	)
	end
	end

	describe "reactions" do
	test "reacting to a status with an emoji" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, reaction} = CommonAPI.react_with_emoji(activity.id, user, "👍")

	assert reaction.data["actor"] == user.ap_id
	assert reaction.data["content"] == "👍"

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:error, _} = CommonAPI.react_with_emoji(activity.id, user, ".")
	end

	test "unreacting to a status with an emoji" do
	user = insert(:user)
	other_user = insert(:user)

	clear_config([:instance, :federating], true)

	with_mock Pleroma.Web.Federator,
	publish: fn _ -> nil end do
	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})
	{:ok, reaction} = CommonAPI.react_with_emoji(activity.id, user, "👍")

	{:ok, unreaction} = CommonAPI.unreact_with_emoji(activity.id, user, "👍")

	assert unreaction.data["type"] == "Undo"
	assert unreaction.data["object"] == reaction.data["id"]
	assert unreaction.local

	# On federation, it contains the undone (and deleted) object
	unreaction_with_object = %{
	unreaction
	\| data: Map.put(unreaction.data, "object", reaction.data)
	}

	assert called(Pleroma.Web.Federator.publish(unreaction_with_object))
	end
	end

	test "repeating a status" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, %Activity{} = announce_activity} = CommonAPI.repeat(activity.id, user)
	assert Visibility.is_public?(announce_activity)
	end

	test "can't repeat a repeat" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, %Activity{} = announce} = CommonAPI.repeat(activity.id, other_user)

	refute match?({:ok, %Activity{}}, CommonAPI.repeat(announce.id, user))
	end

	test "repeating a status privately" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, %Activity{} = announce_activity} =
	CommonAPI.repeat(activity.id, user, %{visibility: "private"})

	assert Visibility.is_private?(announce_activity)
	refute Visibility.visible_for_user?(announce_activity, nil)
	end

	test "author can repeat own private statuses" do
	author = insert(:user)
	follower = insert(:user)
	CommonAPI.follow(follower, author)

	{:ok, activity} = CommonAPI.post(author, %{status: "cofe", visibility: "private"})

	{:ok, %Activity{} = announce_activity} = CommonAPI.repeat(activity.id, author)

	assert Visibility.is_private?(announce_activity)
	refute Visibility.visible_for_user?(announce_activity, nil)

	assert Visibility.visible_for_user?(activity, follower)
	assert {:error, :not_found} = CommonAPI.repeat(activity.id, follower)
	end

	test "favoriting a status" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, post_activity} = CommonAPI.post(other_user, %{status: "cofe"})

	{:ok, %Activity{data: data}} = CommonAPI.favorite(user, post_activity.id)
	assert data["type"] == "Like"
	assert data["actor"] == user.ap_id
	assert data["object"] == post_activity.data["object"]
	end

	test "retweeting a status twice returns the status" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})
	{:ok, %Activity{} = announce} = CommonAPI.repeat(activity.id, user)
	{:ok, ^announce} = CommonAPI.repeat(activity.id, user)
	end

	test "favoriting a status twice returns ok, but without the like activity" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe"})
	{:ok, %Activity{}} = CommonAPI.favorite(user, activity.id)
	assert {:ok, :already_liked} = CommonAPI.favorite(user, activity.id)
	end
	end

	describe "pinned statuses" do
	setup do
	clear_config([:instance, :max_pinned_statuses], 1)

	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "HI!!!"})

	[user: user, activity: activity]
	end

	test "activity not found error", %{user: user} do
	assert {:error, :not_found} = CommonAPI.pin("id", user)
	end

	test "pin status", %{user: user, activity: activity} do
	assert {:ok, ^activity} = CommonAPI.pin(activity.id, user)

	%{data: %{"id" => object_id}} = Object.normalize(activity)
	user = refresh_record(user)

	assert user.pinned_objects \|> Map.keys() == [object_id]
	end

	test "pin poll", %{user: user} do
	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "How is fediverse today?",
	poll: %{options: ["Absolutely outstanding", "Not good"], expires_in: 20}
	})

	assert {:ok, ^activity} = CommonAPI.pin(activity.id, user)

	%{data: %{"id" => object_id}} = Object.normalize(activity)

	user = refresh_record(user)

	assert user.pinned_objects \|> Map.keys() == [object_id]
	end

	test "unlisted statuses can be pinned", %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "HI!!!", visibility: "unlisted"})
	assert {:ok, ^activity} = CommonAPI.pin(activity.id, user)
	end

	test "only self-authored can be pinned", %{activity: activity} do
	user = insert(:user)

	assert {:error, :ownership_error} = CommonAPI.pin(activity.id, user)
	end

	test "max pinned statuses", %{user: user, activity: activity_one} do
	{:ok, activity_two} = CommonAPI.post(user, %{status: "HI!!!"})

	assert {:ok, ^activity_one} = CommonAPI.pin(activity_one.id, user)

	user = refresh_record(user)

	assert {:error, :pinned_statuses_limit_reached} = CommonAPI.pin(activity_two.id, user)
	end

	test "only public can be pinned", %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "private status", visibility: "private"})
	{:error, :visibility_error} = CommonAPI.pin(activity.id, user)
	end

	test "unpin status", %{user: user, activity: activity} do
	{:ok, activity} = CommonAPI.pin(activity.id, user)

	user = refresh_record(user)

	id = activity.id

	assert match?({:ok, %{id: ^id}}, CommonAPI.unpin(activity.id, user))

	user = refresh_record(user)

	assert user.pinned_objects == %{}
	end

	test "should unpin when deleting a status", %{user: user, activity: activity} do
	{:ok, activity} = CommonAPI.pin(activity.id, user)

	user = refresh_record(user)

	assert {:ok, _} = CommonAPI.delete(activity.id, user)

	user = refresh_record(user)

	assert user.pinned_objects == %{}
	end

	test "ephemeral activity won't be deleted if was pinned", %{user: user} do
	{:ok, activity} = CommonAPI.post(user, %{status: "Hello!", expires_in: 601})

	assert Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity.id)

	{:ok, _activity} = CommonAPI.pin(activity.id, user)
	refute Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity.id)

	user = refresh_record(user)
	{:ok, _} = CommonAPI.unpin(activity.id, user)

	# recreates expiration job on unpin
	assert Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity.id)
	end

	test "ephemeral activity deletion job won't be deleted on pinning error", %{
	user: user,
	activity: activity
	} do
	clear_config([:instance, :max_pinned_statuses], 1)

	{:ok, _activity} = CommonAPI.pin(activity.id, user)

	{:ok, activity2} = CommonAPI.post(user, %{status: "another status", expires_in: 601})

	assert Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity2.id)

	user = refresh_record(user)
	{:error, :pinned_statuses_limit_reached} = CommonAPI.pin(activity2.id, user)

	assert Pleroma.Workers.PurgeExpiredActivity.get_expiration(activity2.id)
	end
	end

	describe "mute tests" do
	setup do
	user = insert(:user)

	activity = insert(:note_activity)

	[user: user, activity: activity]
	end

	test "marks notifications as read after mute" do
	author = insert(:user)
	activity = insert(:note_activity, user: author)

	friend1 = insert(:user)
	friend2 = insert(:user)

	{:ok, reply_activity} =
	CommonAPI.post(
	friend2,
	%{
	status: "@#{author.nickname} @#{friend1.nickname} test reply",
	in_reply_to_status_id: activity.id
	}
	)

	{:ok, favorite_activity} = CommonAPI.favorite(friend2, activity.id)
	{:ok, repeat_activity} = CommonAPI.repeat(activity.id, friend1)

	assert Repo.aggregate(
	from(n in Notification, where: n.seen == false and n.user_id == ^friend1.id),
	:count
	) == 1

	unread_notifications =
	Repo.all(from(n in Notification, where: n.seen == false, where: n.user_id == ^author.id))

	assert Enum.any?(unread_notifications, fn n ->
	n.type == "favourite" && n.activity_id == favorite_activity.id
	end)

	assert Enum.any?(unread_notifications, fn n ->
	n.type == "reblog" && n.activity_id == repeat_activity.id
	end)

	assert Enum.any?(unread_notifications, fn n ->
	n.type == "mention" && n.activity_id == reply_activity.id
	end)

	{:ok, _} = CommonAPI.add_mute(author, activity)
	assert CommonAPI.thread_muted?(author, activity)

	assert Repo.aggregate(
	from(n in Notification, where: n.seen == false and n.user_id == ^friend1.id),
	:count
	) == 1

	read_notifications =
	Repo.all(from(n in Notification, where: n.seen == true, where: n.user_id == ^author.id))

	assert Enum.any?(read_notifications, fn n ->
	n.type == "favourite" && n.activity_id == favorite_activity.id
	end)

	assert Enum.any?(read_notifications, fn n ->
	n.type == "reblog" && n.activity_id == repeat_activity.id
	end)

	assert Enum.any?(read_notifications, fn n ->
	n.type == "mention" && n.activity_id == reply_activity.id
	end)
	end

	test "add mute", %{user: user, activity: activity} do
	{:ok, _} = CommonAPI.add_mute(user, activity)
	assert CommonAPI.thread_muted?(user, activity)
	end

	test "add expiring mute", %{user: user, activity: activity} do
	{:ok, _} = CommonAPI.add_mute(user, activity, %{expires_in: 60})
	assert CommonAPI.thread_muted?(user, activity)

	worker = Pleroma.Workers.MuteExpireWorker
	args = %{"op" => "unmute_conversation", "user_id" => user.id, "activity_id" => activity.id}

	assert_enqueued(
	worker: worker,
	args: args
	)

	assert :ok = perform_job(worker, args)
	refute CommonAPI.thread_muted?(user, activity)
	end

	test "remove mute", %{user: user, activity: activity} do
	CommonAPI.add_mute(user, activity)
	{:ok, _} = CommonAPI.remove_mute(user, activity)
	refute CommonAPI.thread_muted?(user, activity)
	end

	test "remove mute by ids", %{user: user, activity: activity} do
	CommonAPI.add_mute(user, activity)
	{:ok, _} = CommonAPI.remove_mute(user.id, activity.id)
	refute CommonAPI.thread_muted?(user, activity)
	end

	test "check that mutes can't be duplicate", %{user: user, activity: activity} do
	CommonAPI.add_mute(user, activity)
	{:error, _} = CommonAPI.add_mute(user, activity)
	end
	end

	describe "reports" do
	test "creates a report" do
	reporter = insert(:user)
	target_user = insert(:user)

	{:ok, activity} = CommonAPI.post(target_user, %{status: "foobar"})
	activity = Activity.normalize(activity)

	reporter_ap_id = reporter.ap_id
	target_ap_id = target_user.ap_id
	reported_object_ap_id = activity.object.data["id"]
	comment = "foobar"

	report_data = %{
	account_id: target_user.id,
	comment: comment,
	status_ids: [activity.id]
	}

	note_obj = %{
	"type" => "Note",
	"id" => reported_object_ap_id,
	"content" => "foobar",
	"published" => activity.object.data["published"],
	"actor" => AccountView.render("show.json", %{user: target_user})
	}

	assert {:ok, flag_activity} = CommonAPI.report(reporter, report_data)

	assert %Activity{
	actor: ^reporter_ap_id,
	data: %{
	"type" => "Flag",
	"content" => ^comment,
	"object" => [^target_ap_id, ^note_obj],
	"state" => "open"
	}
	} = flag_activity
	end

	test "updates report state" do
	[reporter, target_user] = insert_pair(:user)
	activity = insert(:note_activity, user: target_user)
	object = Object.normalize(activity)

	{:ok, %Activity{id: report_id}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel offended",
	status_ids: [activity.id]
	})

	{:ok, report} = CommonAPI.update_report_state(report_id, "resolved")

	assert report.data["state"] == "resolved"

	[reported_user, object_id] = report.data["object"]

	assert reported_user == target_user.ap_id
	assert object_id == object.data["id"]
	end

	test "updates report state, don't strip when report_strip_status is false" do
	clear_config([:instance, :report_strip_status], false)

	[reporter, target_user] = insert_pair(:user)
	activity = insert(:note_activity, user: target_user)

	{:ok, %Activity{id: report_id, data: report_data}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel offended",
	status_ids: [activity.id]
	})

	{:ok, report} = CommonAPI.update_report_state(report_id, "resolved")

	assert report.data["state"] == "resolved"

	[reported_user, reported_activity] = report.data["object"]

	assert reported_user == target_user.ap_id
	assert is_map(reported_activity)

	assert reported_activity["content"] ==
	report_data["object"] \|> Enum.at(1) \|> Map.get("content")
	end

	test "does not update report state when state is unsupported" do
	[reporter, target_user] = insert_pair(:user)
	activity = insert(:note_activity, user: target_user)

	{:ok, %Activity{id: report_id}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel offended",
	status_ids: [activity.id]
	})

	assert CommonAPI.update_report_state(report_id, "test") == {:error, "Unsupported state"}
	end

	test "updates state of multiple reports" do
	[reporter, target_user] = insert_pair(:user)
	activity = insert(:note_activity, user: target_user)

	{:ok, %Activity{id: first_report_id}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel offended",
	status_ids: [activity.id]
	})

	{:ok, %Activity{id: second_report_id}} =
	CommonAPI.report(reporter, %{
	account_id: target_user.id,
	comment: "I feel very offended!",
	status_ids: [activity.id]
	})

	{:ok, report_ids} =
	CommonAPI.update_report_state([first_report_id, second_report_id], "resolved")

	first_report = Activity.get_by_id(first_report_id)
	second_report = Activity.get_by_id(second_report_id)

	assert report_ids -- [first_report_id, second_report_id] == []
	assert first_report.data["state"] == "resolved"
	assert second_report.data["state"] == "resolved"
	end
	end

	describe "reblog muting" do
	setup do
	muter = insert(:user)

	muted = insert(:user)

	[muter: muter, muted: muted]
	end

	test "add a reblog mute", %{muter: muter, muted: muted} do
	{:ok, _reblog_mute} = CommonAPI.hide_reblogs(muter, muted)

	assert User.showing_reblogs?(muter, muted) == false
	end

	test "remove a reblog mute", %{muter: muter, muted: muted} do
	{:ok, _reblog_mute} = CommonAPI.hide_reblogs(muter, muted)
	{:ok, _reblog_mute} = CommonAPI.show_reblogs(muter, muted)

	assert User.showing_reblogs?(muter, muted) == true
	end
	end

	describe "follow/2" do
	test "directly follows a non-locked local user" do
	[follower, followed] = insert_pair(:user)
	{:ok, follower, followed, _} = CommonAPI.follow(follower, followed)

	assert User.following?(follower, followed)
	end
	end

	describe "unfollow/2" do
	test "also unsubscribes a user" do
	[follower, followed] = insert_pair(:user)
	{:ok, follower, followed, _} = CommonAPI.follow(follower, followed)
	{:ok, _subscription} = User.subscribe(follower, followed)

	assert User.subscribed_to?(follower, followed)

	{:ok, follower} = CommonAPI.unfollow(follower, followed)

	refute User.subscribed_to?(follower, followed)
	end

	test "also unpins a user" do
	[follower, followed] = insert_pair(:user)
	{:ok, follower, followed, _} = CommonAPI.follow(follower, followed)
	{:ok, _endorsement} = User.endorse(follower, followed)

	assert User.endorses?(follower, followed)

	{:ok, follower} = CommonAPI.unfollow(follower, followed)

	refute User.endorses?(follower, followed)
	end

	test "cancels a pending follow for a local user" do
	follower = insert(:user)
	followed = insert(:user, is_locked: true)

	assert {:ok, follower, followed, %{id: activity_id, data: %{"state" => "pending"}}} =
	CommonAPI.follow(follower, followed)

	assert User.get_follow_state(follower, followed) == :follow_pending
	assert {:ok, follower} = CommonAPI.unfollow(follower, followed)
	assert User.get_follow_state(follower, followed) == nil

	assert %{id: ^activity_id, data: %{"state" => "cancelled"}} =
	Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(follower, followed)

	assert %{
	data: %{
	"type" => "Undo",
	"object" => %{"type" => "Follow", "state" => "cancelled"}
	}
	} = Pleroma.Web.ActivityPub.Utils.fetch_latest_undo(follower)
	end

	test "cancels a pending follow for a remote user" do
	follower = insert(:user)
	followed = insert(:user, is_locked: true, local: false, ap_enabled: true)

	assert {:ok, follower, followed, %{id: activity_id, data: %{"state" => "pending"}}} =
	CommonAPI.follow(follower, followed)

	assert User.get_follow_state(follower, followed) == :follow_pending
	assert {:ok, follower} = CommonAPI.unfollow(follower, followed)
	assert User.get_follow_state(follower, followed) == nil

	assert %{id: ^activity_id, data: %{"state" => "cancelled"}} =
	Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(follower, followed)

	assert %{
	data: %{
	"type" => "Undo",
	"object" => %{"type" => "Follow", "state" => "cancelled"}
	}
	} = Pleroma.Web.ActivityPub.Utils.fetch_latest_undo(follower)
	end
	end

	describe "accept_follow_request/2" do
	test "after acceptance, it sets all existing pending follow request states to 'accept'" do
	user = insert(:user, is_locked: true)
	follower = insert(:user)
	follower_two = insert(:user)

	{:ok, _, _, follow_activity} = CommonAPI.follow(follower, user)
	{:ok, _, _, follow_activity_two} = CommonAPI.follow(follower, user)
	{:ok, _, _, follow_activity_three} = CommonAPI.follow(follower_two, user)

	assert follow_activity.data["state"] == "pending"
	assert follow_activity_two.data["state"] == "pending"
	assert follow_activity_three.data["state"] == "pending"

	{:ok, _follower} = CommonAPI.accept_follow_request(follower, user)

	assert Repo.get(Activity, follow_activity.id).data["state"] == "accept"
	assert Repo.get(Activity, follow_activity_two.id).data["state"] == "accept"
	assert Repo.get(Activity, follow_activity_three.id).data["state"] == "pending"
	end

	test "after rejection, it sets all existing pending follow request states to 'reject'" do
	user = insert(:user, is_locked: true)
	follower = insert(:user)
	follower_two = insert(:user)

	{:ok, _, _, follow_activity} = CommonAPI.follow(follower, user)
	{:ok, _, _, follow_activity_two} = CommonAPI.follow(follower, user)
	{:ok, _, _, follow_activity_three} = CommonAPI.follow(follower_two, user)

	assert follow_activity.data["state"] == "pending"
	assert follow_activity_two.data["state"] == "pending"
	assert follow_activity_three.data["state"] == "pending"

	{:ok, _follower} = CommonAPI.reject_follow_request(follower, user)

	assert Repo.get(Activity, follow_activity.id).data["state"] == "reject"
	assert Repo.get(Activity, follow_activity_two.id).data["state"] == "reject"
	assert Repo.get(Activity, follow_activity_three.id).data["state"] == "pending"
	end

	test "doesn't create a following relationship if the corresponding follow request doesn't exist" do
	user = insert(:user, is_locked: true)
	not_follower = insert(:user)
	CommonAPI.accept_follow_request(not_follower, user)

	assert Pleroma.FollowingRelationship.following?(not_follower, user) == false
	end
	end

	describe "vote/3" do
	test "does not allow to vote twice" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{
	status: "Am I cute?",
	poll: %{options: ["Yes", "No"], expires_in: 20}
	})

	object = Object.normalize(activity, fetch: false)

	{:ok, _, object} = CommonAPI.vote(other_user, object, [0])

	assert {:error, "Already voted"} == CommonAPI.vote(other_user, object, [1])
	end
	end

	describe "listen/2" do
	test "returns a valid activity" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.listen(user, %{
	title: "lain radio episode 1",
	album: "lain radio",
	artist: "lain",
	length: 180_000
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["title"] == "lain radio episode 1"

	assert Visibility.get_visibility(activity) == "public"
	end

	test "respects visibility=private" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.listen(user, %{
	title: "lain radio episode 1",
	album: "lain radio",
	artist: "lain",
	length: 180_000,
	visibility: "private"
	})

	object = Object.normalize(activity, fetch: false)

	assert object.data["title"] == "lain radio episode 1"

	assert Visibility.get_visibility(activity) == "private"
	end
	end

	describe "get_user/1" do
	test "gets user by ap_id" do
	user = insert(:user)
	assert CommonAPI.get_user(user.ap_id) == user
	end

	test "gets user by guessed nickname" do
	user = insert(:user, ap_id: "", nickname: "mario@mushroom.kingdom")
	assert CommonAPI.get_user("https://mushroom.kingdom/users/mario") == user
	end

	test "fallback" do
	assert %User{
	name: "",
	ap_id: "",
	nickname: "erroruser@example.com"
	} = CommonAPI.get_user("")
	end
	end

	describe "with `local` visibility" do
	setup do: clear_config([:instance, :federating], true)

	test "post" do
	user = insert(:user)

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	{:ok, activity} = CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})

	assert Visibility.is_local_public?(activity)
	assert_not_called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "delete" do
	user = insert(:user)

	{:ok, %Activity{id: activity_id}} =
	CommonAPI.post(user, %{status: "#2hu #2HU", visibility: "local"})

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"deleted_activity_id" => ^activity_id}} = activity} =
	CommonAPI.delete(activity_id, user)

	assert Visibility.is_local_public?(activity)
	assert_not_called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "repeat" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, %Activity{id: activity_id}} =
	CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "Announce"}} = activity} =
	CommonAPI.repeat(activity_id, user)

	assert Visibility.is_local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "unrepeat" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, %Activity{id: activity_id}} =
	CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	assert {:ok, _} = CommonAPI.repeat(activity_id, user)

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "Undo"}} = activity} =
	CommonAPI.unrepeat(activity_id, user)

	assert Visibility.is_local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "favorite" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "Like"}} = activity} =
	CommonAPI.favorite(user, activity.id)

	assert Visibility.is_local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "unfavorite" do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	{:ok, %Activity{}} = CommonAPI.favorite(user, activity.id)

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, activity} = CommonAPI.unfavorite(activity.id, user)
	assert Visibility.is_local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "react_with_emoji" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "EmojiReact"}} = activity} =
	CommonAPI.react_with_emoji(activity.id, user, "👍")

	assert Visibility.is_local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end

	test "unreact_with_emoji" do
	user = insert(:user)
	other_user = insert(:user)
	{:ok, activity} = CommonAPI.post(other_user, %{status: "cofe", visibility: "local"})

	{:ok, _reaction} = CommonAPI.react_with_emoji(activity.id, user, "👍")

	with_mock Pleroma.Web.Federator, publish: fn _ -> :ok end do
	assert {:ok, %Activity{data: %{"type" => "Undo"}} = activity} =
	CommonAPI.unreact_with_emoji(activity.id, user, "👍")

	assert Visibility.is_local_public?(activity)
	refute called(Pleroma.Web.Federator.publish(activity))
	end
	end
	end

	describe "update/3" do
	test "updates a post" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "foo1", spoiler_text: "title 1"})

	{:ok, updated} = CommonAPI.update(user, activity, %{status: "updated 2"})

	updated_object = Object.normalize(updated)
	assert updated_object.data["content"] == "updated 2"
	assert Map.get(updated_object.data, "summary", "") == ""
	assert Map.has_key?(updated_object.data, "updated")
	end

	test "does not change visibility" do
	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "foo1", spoiler_text: "title 1", visibility: "private"})

	{:ok, updated} = CommonAPI.update(user, activity, %{status: "updated 2"})

	updated_object = Object.normalize(updated)
	assert updated_object.data["content"] == "updated 2"
	assert Map.get(updated_object.data, "summary", "") == ""
	assert Visibility.get_visibility(updated_object) == "private"
	assert Visibility.get_visibility(updated) == "private"
	end

	test "updates a post with emoji" do
	[{emoji1, _}, {emoji2, _} \| _] = Pleroma.Emoji.get_all()

	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "foo1", spoiler_text: "title 1 :#{emoji1}:"})

	{:ok, updated} = CommonAPI.update(user, activity, %{status: "updated 2 :#{emoji2}:"})

	updated_object = Object.normalize(updated)
	assert updated_object.data["content"] == "updated 2 :#{emoji2}:"
	assert %{^emoji2 => _} = updated_object.data["emoji"]
	end

	test "updates a post with emoji and federate properly" do
	[{emoji1, _}, {emoji2, _} \| _] = Pleroma.Emoji.get_all()

	user = insert(:user)

	{:ok, activity} =
	CommonAPI.post(user, %{status: "foo1", spoiler_text: "title 1 :#{emoji1}:"})

	clear_config([:instance, :federating], true)

	with_mock Pleroma.Web.Federator,
	publish: fn _p -> nil end do
	{:ok, updated} = CommonAPI.update(user, activity, %{status: "updated 2 :#{emoji2}:"})

	assert updated.data["object"]["content"] == "updated 2 :#{emoji2}:"
	assert %{^emoji2 => _} = updated.data["object"]["emoji"]

	assert called(Pleroma.Web.Federator.publish(updated))
	end
	end

	test "editing a post that copied a remote title with remote emoji should keep that emoji" do
	remote_emoji_uri = "https://remote.org/emoji.png"

	note =
	insert(
	:note,
	data: %{
	"summary" => ":remoteemoji:",
	"emoji" => %{
	"remoteemoji" => remote_emoji_uri
	},
	"tag" => [
	%{
	"type" => "Emoji",
	"name" => "remoteemoji",
	"icon" => %{"url" => remote_emoji_uri}
	}
	]
	}
	)

	note_activity = insert(:note_activity, note: note)

	user = insert(:user)

	{:ok, reply} =
	CommonAPI.post(user, %{
	status: "reply",
	spoiler_text: ":remoteemoji:",
	in_reply_to_id: note_activity.id
	})

	assert reply.object.data["emoji"]["remoteemoji"] == remote_emoji_uri

	{:ok, edit} =
	CommonAPI.update(user, reply, %{status: "reply mew mew", spoiler_text: ":remoteemoji:"})

	edited_note = Pleroma.Object.normalize(edit)

	assert edited_note.data["emoji"]["remoteemoji"] == remote_emoji_uri
	end

	test "respects MRF" do
	user = insert(:user)

	clear_config([:mrf, :policies], [Pleroma.Web.ActivityPub.MRF.KeywordPolicy])
	clear_config([:mrf_keyword, :replace], [{"updated", "mewmew"}])

	{:ok, activity} = CommonAPI.post(user, %{status: "foo1", spoiler_text: "updated 1"})
	assert Object.normalize(activity).data["summary"] == "mewmew 1"

	{:ok, updated} = CommonAPI.update(user, activity, %{status: "updated 2"})

	updated_object = Object.normalize(updated)
	assert updated_object.data["content"] == "mewmew 2"
	assert Map.get(updated_object.data, "summary", "") == ""
	assert Map.has_key?(updated_object.data, "updated")
	end
	end
	end
	diff --git a/test/pleroma/web/mastodon_api/views/scheduled_activity_view_test.exs b/test/pleroma/web/mastodon_api/views/scheduled_activity_view_test.exs
	index e5e510d33..07a65a3bc 100644
	--- a/test/pleroma/web/mastodon_api/views/scheduled_activity_view_test.exs
	+++ b/test/pleroma/web/mastodon_api/views/scheduled_activity_view_test.exs
	@@ -1,69 +1,69 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.ScheduledActivityViewTest do
	use Pleroma.DataCase, async: true
	alias Pleroma.ScheduledActivity
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.CommonAPI.Utils
	alias Pleroma.Web.MastodonAPI.ScheduledActivityView
	alias Pleroma.Web.MastodonAPI.StatusView
	import Pleroma.Factory

	test "A scheduled activity with a media attachment" do
	user = insert(:user)
	{:ok, activity} = CommonAPI.post(user, %{status: "hi"})

	scheduled_at =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.minutes(10), :millisecond)
	\|> NaiveDateTime.to_iso8601()

	file = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	{:ok, upload} = ActivityPub.upload(file, actor: user.ap_id)

	attrs = %{
	params: %{
	"media_ids" => [upload.id],
	"status" => "hi",
	"sensitive" => true,
	"spoiler_text" => "spoiler",
	"visibility" => "unlisted",
	"in_reply_to_id" => to_string(activity.id)
	},
	scheduled_at: scheduled_at
	}

	{:ok, scheduled_activity} = ScheduledActivity.create(user, attrs)
	result = ScheduledActivityView.render("show.json", %{scheduled_activity: scheduled_activity})

	expected = %{
	id: to_string(scheduled_activity.id),
	media_attachments:
	%{media_ids: [upload.id]}
	- \|> Utils.attachments_from_ids()
	+ \|> Utils.attachments_from_ids(user)
	\|> Enum.map(&StatusView.render("attachment.json", %{attachment: &1})),
	params: %{
	in_reply_to_id: to_string(activity.id),
	media_ids: [upload.id],
	poll: nil,
	scheduled_at: nil,
	sensitive: true,
	spoiler_text: "spoiler",
	text: "hi",
	visibility: "unlisted",
	expires_in: nil
	},
	scheduled_at: Utils.to_masto_date(scheduled_activity.scheduled_at)
	}

	assert expected == result
	end
	end
	diff --git a/test/pleroma/web/pleroma_api/views/chat_message_reference_view_test.exs b/test/pleroma/web/pleroma_api/views/chat_message_reference_view_test.exs
	index 017c9c5c0..7ab3f5acd 100644
	--- a/test/pleroma/web/pleroma_api/views/chat_message_reference_view_test.exs
	+++ b/test/pleroma/web/pleroma_api/views/chat_message_reference_view_test.exs
	@@ -1,75 +1,75 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.ChatMessageReferenceViewTest do
	use Pleroma.DataCase

	alias Pleroma.Chat
	alias Pleroma.Chat.MessageReference
	alias Pleroma.Object
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.PleromaAPI.Chat.MessageReferenceView

	import Pleroma.Factory

	test "it displays a chat message" do
	user = insert(:user)
	recipient = insert(:user)

	file = %Plug.Upload{
	content_type: "image/jpeg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	- {:ok, upload} = ActivityPub.upload(file, actor: user.ap_id)
	+ {:ok, upload} = ActivityPub.upload(file, actor: recipient.ap_id)

	{:ok, activity} =
	CommonAPI.post_chat_message(user, recipient, "kippis :firefox:", idempotency_key: "123")

	chat = Chat.get(user.id, recipient.ap_id)

	object = Object.normalize(activity, fetch: false)

	cm_ref = MessageReference.for_chat_and_object(chat, object)

	chat_message = MessageReferenceView.render("show.json", chat_message_reference: cm_ref)

	assert chat_message[:id] == cm_ref.id
	assert chat_message[:content] == "kippis :firefox:"
	assert chat_message[:account_id] == user.id
	assert chat_message[:chat_id]
	assert chat_message[:created_at]
	assert chat_message[:unread] == false
	assert match?([%{shortcode: "firefox"}], chat_message[:emojis])
	assert chat_message[:idempotency_key] == "123"

	clear_config([:rich_media, :enabled], true)

	Tesla.Mock.mock_global(fn
	%{url: "https://example.com/ogp"} ->
	%Tesla.Env{status: 200, body: File.read!("test/fixtures/rich_media/ogp.html")}
	end)

	{:ok, activity} =
	CommonAPI.post_chat_message(recipient, user, "gkgkgk https://example.com/ogp",
	media_id: upload.id
	)

	object = Object.normalize(activity, fetch: false)

	cm_ref = MessageReference.for_chat_and_object(chat, object)

	chat_message_two = MessageReferenceView.render("show.json", chat_message_reference: cm_ref)

	assert chat_message_two[:id] == cm_ref.id
	assert chat_message_two[:content] == object.data["content"]
	assert chat_message_two[:account_id] == recipient.id
	assert chat_message_two[:chat_id] == chat_message[:chat_id]
	assert chat_message_two[:attachment]
	assert chat_message_two[:unread] == true
	assert chat_message_two[:card]
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Aug 8, 1:46 PM (1 d, 16 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1723541
Default Alt Text: (137 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions