No OneTemporary
Actions

Authored By

Unknown

Size

22 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web/api_spec/operations/remote_interaction_operation.ex b/lib/pleroma/web/api_spec/operations/remote_interaction_operation.ex
	index a490bd491..b5bd9d72f 100644
	--- a/lib/pleroma/web/api_spec/operations/remote_interaction_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/remote_interaction_operation.ex
	@@ -1,61 +1,109 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.RemoteInteractionOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Schema

	import Pleroma.Web.ApiSpec.Helpers

	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	- def remote_subscribe_operation do
	- %Operation{
	- tags: ["Remote interaction"],
	- summary: "Remote Subscribe",
	- operationId: "RemoteInteractionController.remote_subscribe",
	- parameters: [],
	- responses: %{200 => Operation.response("Web Page", "text/html", %Schema{type: :string})}
	- }
	- end
	-
	def remote_interaction_operation do
	%Operation{
	tags: ["Remote interaction"],
	summary: "Remote interaction",
	operationId: "RemoteInteractionController.remote_interaction",
	requestBody: request_body("Parameters", remote_interaction_request(), required: true),
	responses: %{
	200 =>
	Operation.response("Remote interaction URL", "application/json", %Schema{type: :object})
	}
	}
	end

	defp remote_interaction_request do
	%Schema{
	title: "RemoteInteractionRequest",
	description: "POST body for remote interaction",
	type: :object,
	required: [:ap_id, :profile],
	properties: %{
	ap_id: %Schema{type: :string, description: "Profile or status ActivityPub ID"},
	profile: %Schema{type: :string, description: "Remote profile webfinger"}
	}
	}
	end

	+ def follow_operation do
	+ %Operation{
	+ tags: ["Remote interaction"],
	+ summary: "Display follow form",
	+ operationId: "RemoteInteractionController.follow",
	+ parameters: [],
	+ responses: %{
	+ 200 => Operation.response("Web Page", "text/html", %Schema{type: :string}),
	+ 302 => Operation.response("Redirect to the status page", nil, nil)
	+ }
	+ }
	+ end
	+
	+ def do_follow_operation do
	+ %Operation{
	+ tags: ["Remote interaction"],
	+ summary: "Perform follow activity",
	+ operationId: "RemoteInteractionController.do_follow",
	+ parameters: [],
	+ responses: %{
	+ 200 => Operation.response("Web page", "text/html", %Schema{type: :string}),
	+ 302 => Operation.response("Redirect to the account page", nil, nil)
	+ }
	+ }
	+ end
	+
	+ def authorize_interaction_operation do
	+ %Operation{
	+ tags: ["Remote interaction"],
	+ summary: "Authorize remote interaction",
	+ operationId: "RemoteInteractionController.authorize_interaction",
	+ parameters: [],
	+ responses: %{
	+ 302 => Operation.response("Redirect to remote_interaction path", nil, nil)
	+ }
	+ }
	+ end
	+
	+ def show_subscribe_form_operation do
	+ %Operation{
	+ tags: ["Remote interaction"],
	+ summary: "Show remote subscribe form",
	+ operationId: "RemoteInteractionController.show_subscribe_form",
	+ parameters: [],
	+ responses: %{200 => Operation.response("Web Page", "text/html", %Schema{type: :string})}
	+ }
	+ end
	+
	+ def remote_subscribe_operation do
	+ %Operation{
	+ tags: ["Remote interaction"],
	+ summary: "Remote Subscribe",
	+ operationId: "RemoteInteractionController.remote_subscribe",
	+ parameters: [],
	+ responses: %{200 => Operation.response("Web Page", "text/html", %Schema{type: :string})}
	+ }
	+ end
	+
	def show_subscribe_form_operation do
	%Operation{
	tags: ["Remote interaction"],
	summary: "Show remote subscribe form",
	operationId: "RemoteInteractionController.show_subscribe_form",
	parameters: [],
	responses: %{200 => Operation.response("Web Page", "text/html", %Schema{type: :string})}
	}
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/util_controller.ex b/lib/pleroma/web/pleroma_api/controllers/util_controller.ex
	index 9528d5564..70b0b9cf6 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/util_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/util_controller.ex
	@@ -1,278 +1,278 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.UtilController do
	use Pleroma.Web, :controller

	require Logger

	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Emoji
	alias Pleroma.Healthcheck
	alias Pleroma.User
	alias Pleroma.Utils.URIEncoding
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.Auth.WrapperAuthenticator, as: Authenticator
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	- plug(Pleroma.Web.ApiSpec.CastAndValidate, [replace_params: false])
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:accounts"]}
	when action in [
	:change_email,
	:change_password,
	:delete_account,
	:update_notification_settings,
	:disable_account,
	:move_account,
	:add_alias,
	:delete_alias
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:accounts"]}
	when action in [
	:list_aliases
	]
	)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaUtilOperation

	def frontend_configurations(conn, _params) do
	render(conn, "frontend_configurations.json")
	end

	def emoji(conn, _params) do
	emoji =
	Enum.reduce(Emoji.get_all(), %{}, fn {code, %Emoji{file: file, tags: tags}}, acc ->
	file = encode_emoji_url(file)
	Map.put(acc, code, %{image_url: file, tags: tags})
	end)

	json(conn, emoji)
	end

	defp encode_emoji_url(nil), do: nil
	defp encode_emoji_url("http" <> _ = url), do: URIEncoding.encode_url(url)

	defp encode_emoji_url("/" <> _ = path),
	do: URIEncoding.encode_url(path, bypass_parse: true, bypass_decode: true)

	defp encode_emoji_url(path) when is_binary(path),
	do: URIEncoding.encode_url(path, bypass_parse: true, bypass_decode: true)

	def update_notification_settings(%{assigns: %{user: user}} = conn, params) do
	with {:ok, _} <- User.update_notification_settings(user, params) do
	json(conn, %{status: "success"})
	end
	end

	def change_password(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	with {:ok, %User{}} <-
	Authenticator.change_password(
	user,
	body_params.password,
	body_params.new_password,
	body_params.new_password_confirmation
	) do
	json(conn, %{status: "success"})
	else
	{:error, %Ecto.Changeset{} = changeset} ->
	{_, {error, _}} = Enum.at(changeset.errors, 0)
	json(conn, %{error: "New password #{error}."})

	{:error, :password_confirmation} ->
	json(conn, %{error: "New password does not match confirmation."})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def change_email(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
	{:ok, user} ->
	with {:ok, _user} <- User.change_email(user, body_params.email) do
	json(conn, %{status: "success"})
	else
	{:error, changeset} ->
	{_, {error, _}} = Enum.at(changeset.errors, 0)
	json(conn, %{error: "Email #{error}."})

	_ ->
	json(conn, %{error: "Unable to change email."})
	end

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def delete_account(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: body_params, params: params}}
	} = conn,
	_
	) do
	# This endpoint can accept a query param or JSON body for backwards-compatibility.
	# Submitting a JSON body is recommended, so passwords don't end up in server logs.
	password = body_params[:password] \|\| params[:password] \|\| ""

	case CommonAPI.Utils.confirm_current_password(user, password) do
	{:ok, user} ->
	User.delete(user)
	json(conn, %{status: "success"})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def disable_account(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn,
	_
	) do
	case CommonAPI.Utils.confirm_current_password(user, params[:password]) do
	{:ok, user} ->
	User.set_activation_async(user, false)
	json(conn, %{status: "success"})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def move_account(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
	{:ok, user} ->
	with {:ok, target_user} <- find_or_fetch_user_by_nickname(body_params.target_account),
	{:ok, _user} <- ActivityPub.move(user, target_user) do
	json(conn, %{status: "success"})
	else
	{:not_found, _} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Target account not found."})

	{:error, error} ->
	json(conn, %{error: error})
	end

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def add_alias(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	with {:ok, alias_user} <- find_user_by_nickname(body_params.alias),
	{:ok, _user} <- user \|> User.add_alias(alias_user) do
	json(conn, %{status: "success"})
	else
	{:not_found, _} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Target account does not exist."})

	{:error, error} ->
	json(conn, %{error: error})
	end
	end

	def delete_alias(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	_
	) do
	with {:ok, alias_user} <- find_user_by_nickname(body_params.alias),
	{:ok, _user} <- user \|> User.delete_alias(alias_user) do
	json(conn, %{status: "success"})
	else
	{:error, :no_such_alias} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Account has no such alias."})

	{:error, error} ->
	json(conn, %{error: error})
	end
	end

	def list_aliases(%{assigns: %{user: user}} = conn, _) do
	alias_nicks =
	user
	\|> User.alias_users()
	\|> Enum.map(&User.full_nickname/1)

	json(conn, %{aliases: alias_nicks})
	end

	defp find_user_by_nickname(nickname) do
	user = User.get_cached_by_nickname(nickname)

	if user == nil do
	{:error, :not_found}
	else
	{:ok, user}
	end
	end

	defp find_or_fetch_user_by_nickname(nickname) do
	user = User.get_by_nickname(nickname)

	if user != nil and user.local do
	{:ok, user}
	else
	with {:ok, user} <- User.fetch_by_nickname(nickname) do
	{:ok, user}
	else
	_ ->
	{:not_found, nil}
	end
	end
	end

	def captcha(conn, _params) do
	json(conn, Pleroma.Captcha.new())
	end

	def healthcheck(conn, _params) do
	with {:cfg, true} <- {:cfg, Config.get([:instance, :healthcheck])},
	%{healthy: true} = info <- Healthcheck.system_info() do
	json(conn, info)
	else
	%{healthy: false} = info ->
	service_unavailable(conn, info)

	{:cfg, false} ->
	service_unavailable(conn, %{"error" => "Healthcheck disabled"})

	_ ->
	service_unavailable(conn, %{})
	end
	end

	defp service_unavailable(conn, info) do
	conn
	\|> put_status(:service_unavailable)
	\|> json(info)
	end
	end
	diff --git a/lib/pleroma/web/remote_interaction/remote_interaction_controller.ex b/lib/pleroma/web/remote_interaction/remote_interaction_controller.ex
	index 8592fc990..90f15cdb6 100644
	--- a/lib/pleroma/web/remote_interaction/remote_interaction_controller.ex
	+++ b/lib/pleroma/web/remote_interaction/remote_interaction_controller.ex
	@@ -1,292 +1,292 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.RemoteInteraction.RemoteInteractionController do
	use Pleroma.Web, :controller

	require Logger

	alias Pleroma.Activity
	alias Pleroma.MFA
	alias Pleroma.Object.Fetcher
	alias Pleroma.User
	alias Pleroma.Web.Auth.TOTPAuthenticator
	alias Pleroma.Web.Auth.WrapperAuthenticator
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.WebFinger

	@status_types ["Article", "Event", "Note", "Video", "Page", "Question"]

	plug(
	Pleroma.Web.ApiSpec.CastAndValidate,
	[replace_params: false]
	when action == :remote_interaction
	)

	plug(Pleroma.Web.Plugs.FederatingPlug)

	# Note: follower can submit the form (with password auth) not being signed in (having no token)
	plug(
	Pleroma.Web.Plugs.OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["follow", "write:follows"]}
	- when action in [:do_follow]
	+ when action == :do_follow
	)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.RemoteInteractionOperation

	# GET /ostatus_subscribe
	#
	def follow(%{assigns: %{user: user}} = conn, %{"acct" => acct}) do
	case status?(acct) do
	true -> follow_status(conn, user, acct)
	_ -> follow_account(conn, user, acct)
	end
	end

	defp follow_status(conn, _user, acct) do
	with {:ok, object} <- Fetcher.fetch_object_from_id(acct),
	%Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(object.data["id"]) do
	redirect(conn, to: Routes.o_status_path(conn, :notice, activity_id))
	else
	error ->
	handle_follow_error(conn, error)
	end
	end

	defp follow_account(conn, user, acct) do
	with {:ok, followee} <- User.get_or_fetch(acct) do
	render(conn, follow_template(user), %{error: false, followee: followee, acct: acct})
	else
	{:error, _reason} ->
	render(conn, follow_template(user), %{error: :error})
	end
	end

	defp follow_template(%User{} = _user), do: "follow.html"
	defp follow_template(_), do: "follow_login.html"

	defp status?(acct) do
	case Fetcher.fetch_and_contain_remote_object_from_id(acct) do
	{:ok, %{"type" => type}} when type in @status_types ->
	true

	_ ->
	false
	end
	end

	# POST /ostatus_subscribe
	#
	# adds a remote account in followers if user already is signed in.
	#
	def do_follow(%{assigns: %{user: %User{} = user}} = conn, %{"user" => %{"id" => id}}) do
	with {:fetch_user, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
	{:ok, _, _, _} <- CommonAPI.follow(followee, user) do
	redirect(conn, to: "/users/#{followee.id}")
	else
	error ->
	handle_follow_error(conn, error)
	end
	end

	# POST /ostatus_subscribe
	#
	# step 1.
	# checks login\password and displays step 2 form of MFA if need.
	#
	def do_follow(conn, %{"authorization" => %{"name" => _, "password" => _, "id" => id}}) do
	with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
	{_, {:ok, user}, _} <- {:auth, WrapperAuthenticator.get_user(conn), followee},
	{_, _, _, false} <- {:mfa_required, followee, user, MFA.require?(user)},
	{:ok, _, _, _} <- CommonAPI.follow(followee, user) do
	redirect(conn, to: "/users/#{followee.id}")
	else
	error ->
	handle_follow_error(conn, error)
	end
	end

	# POST /ostatus_subscribe
	#
	# step 2
	# checks TOTP code. otherwise displays form with errors
	#
	def do_follow(conn, %{"mfa" => %{"code" => code, "token" => token, "id" => id}}) do
	with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
	{_, _, {:ok, %{user: user}}} <- {:mfa_token, followee, MFA.Token.validate(token)},
	{_, _, _, {:ok, _}} <-
	{:verify_mfa_code, followee, token, TOTPAuthenticator.verify(code, user)},
	{:ok, _, _, _} <- CommonAPI.follow(followee, user) do
	redirect(conn, to: "/users/#{followee.id}")
	else
	error ->
	handle_follow_error(conn, error)
	end
	end

	def do_follow(%{assigns: %{user: nil}} = conn, _) do
	Logger.debug("Insufficient permissions: follow \| write:follows.")
	render(conn, "followed.html", %{error: "Insufficient permissions: follow \| write:follows."})
	end

	# GET /authorize_interaction
	#
	def authorize_interaction(conn, %{"uri" => uri}) do
	conn
	\|> redirect(to: Routes.remote_interaction_path(conn, :follow, %{acct: uri}))
	end

	defp handle_follow_error(conn, {:mfa_token, followee, _} = _) do
	render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
	end

	defp handle_follow_error(conn, {:verify_mfa_code, followee, token, _} = _) do
	render(conn, "follow_mfa.html", %{
	error: "Wrong authentication code",
	followee: followee,
	mfa_token: token
	})
	end

	defp handle_follow_error(conn, {:mfa_required, followee, user, _} = _) do
	{:ok, %{token: token}} = MFA.Token.create(user)
	render(conn, "follow_mfa.html", %{followee: followee, mfa_token: token, error: false})
	end

	defp handle_follow_error(conn, {:auth, _, followee} = _) do
	render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
	end

	defp handle_follow_error(conn, {:fetch_user, error} = _) do
	Logger.debug("Remote follow failed with error #{inspect(error)}")
	render(conn, "followed.html", %{error: "Could not find user"})
	end

	defp handle_follow_error(conn, {:error, "Could not follow user:" <> _} = _) do
	render(conn, "followed.html", %{error: "Error following account"})
	end

	defp handle_follow_error(conn, error) do
	Logger.debug("Remote follow failed with error #{inspect(error)}")
	render(conn, "followed.html", %{error: "Something went wrong."})
	end

	def show_subscribe_form(conn, %{"nickname" => nick}) do
	with %User{} = user <- User.get_cached_by_nickname(nick),
	avatar = User.avatar_url(user) do
	conn
	\|> render("subscribe.html", %{nickname: nick, avatar: avatar, error: false})
	else
	_e ->
	render(conn, "subscribe.html", %{
	nickname: nick,
	avatar: nil,
	error:
	Pleroma.Web.Gettext.dpgettext(
	"static_pages",
	"remote follow error message - user not found",
	"Could not find user"
	)
	})
	end
	end

	def show_subscribe_form(conn, %{"status_id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	{:ok, ap_id} <- get_ap_id(activity),
	%User{} = user <- User.get_cached_by_ap_id(activity.actor),
	avatar = User.avatar_url(user) do
	conn
	\|> render("status_interact.html", %{
	status_link: ap_id,
	status_id: id,
	nickname: user.nickname,
	avatar: avatar,
	error: false
	})
	else
	_e ->
	render(conn, "status_interact.html", %{
	status_id: id,
	avatar: nil,
	error:
	Pleroma.Web.Gettext.dpgettext(
	"static_pages",
	"status interact error message - status not found",
	"Could not find status"
	)
	})
	end
	end

	def remote_subscribe(conn, %{"nickname" => nick, "profile" => _}) do
	show_subscribe_form(conn, %{"nickname" => nick})
	end

	def remote_subscribe(conn, %{"status_id" => id, "profile" => _}) do
	show_subscribe_form(conn, %{"status_id" => id})
	end

	def remote_subscribe(conn, %{"user" => %{"nickname" => nick, "profile" => profile}}) do
	with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	%User{ap_id: ap_id} <- User.get_cached_by_nickname(nick) do
	conn
	\|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	else
	_e ->
	render(conn, "subscribe.html", %{
	nickname: nick,
	avatar: nil,
	error:
	Pleroma.Web.Gettext.dpgettext(
	"static_pages",
	"remote follow error message - unknown error",
	"Something went wrong."
	)
	})
	end
	end

	def remote_subscribe(conn, %{"status" => %{"status_id" => id, "profile" => profile}}) do
	with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	%Activity{} = activity <- Activity.get_by_id(id),
	{:ok, ap_id} <- get_ap_id(activity) do
	conn
	\|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	else
	_e ->
	render(conn, "status_interact.html", %{
	status_id: id,
	avatar: nil,
	error:
	Pleroma.Web.Gettext.dpgettext(
	"static_pages",
	"status interact error message - unknown error",
	"Something went wrong."
	)
	})
	end
	end

	def remote_interaction(
	%{private: %{open_api_spex: %{body_params: %{ap_id: ap_id, profile: profile}}}} = conn,
	_params
	) do
	with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile) do
	conn
	\|> json(%{url: String.replace(template, "{uri}", ap_id)})
	else
	_e -> json(conn, %{error: "Couldn't find user"})
	end
	end

	defp get_ap_id(activity) do
	object = Pleroma.Object.normalize(activity, fetch: false)

	case object do
	%{data: %{"id" => ap_id}} -> {:ok, ap_id}
	_ -> {:no_ap_id, nil}
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Fri, Oct 30, 4:38 AM (1 d, 2 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1799461
Default Alt Text: (22 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions