No OneTemporary
Actions

Size

207 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/plugs/oauth_scopes_plug.ex b/lib/pleroma/plugs/oauth_scopes_plug.ex
	index 41403047e..e0d61c4eb 100644
	--- a/lib/pleroma/plugs/oauth_scopes_plug.ex
	+++ b/lib/pleroma/plugs/oauth_scopes_plug.ex
	@@ -1,59 +1,69 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Plugs.OAuthScopesPlug do
	import Plug.Conn
	import Pleroma.Web.Gettext

	+ alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
	+
	@behaviour Plug

	def init(%{scopes: _} = options), do: options

	def call(%Plug.Conn{assigns: assigns} = conn, %{scopes: scopes} = options) do
	op = options[:op] \|\| :\|
	token = assigns[:token]
	matched_scopes = token && filter_descendants(scopes, token.scopes)

	cond do
	is_nil(token) ->
	- conn
	+ maybe_perform_instance_privacy_check(conn, options)

	op == :\| && Enum.any?(matched_scopes) ->
	conn

	op == :& && matched_scopes == scopes ->
	conn

	options[:fallback] == :proceed_unauthenticated ->
	conn
	\|> assign(:user, nil)
	\|> assign(:token, nil)
	+ \|> maybe_perform_instance_privacy_check(options)

	true ->
	missing_scopes = scopes -- matched_scopes
	permissions = Enum.join(missing_scopes, " #{op} ")

	error_message =
	dgettext("errors", "Insufficient permissions: %{permissions}.", permissions: permissions)

	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(:forbidden, Jason.encode!(%{error: error_message}))
	\|> halt()
	end
	end

	@doc "Filters descendants of supported scopes"
	def filter_descendants(scopes, supported_scopes) do
	Enum.filter(
	scopes,
	fn scope ->
	Enum.find(
	supported_scopes,
	&(scope == &1 \|\| String.starts_with?(scope, &1 <> ":"))
	)
	end
	)
	end
	+
	+ defp maybe_perform_instance_privacy_check(%Plug.Conn{} = conn, options) do
	+ case options[:skip_instance_privacy_check] do
	+ true -> conn
	+ _ -> EnsurePublicOrAuthenticatedPlug.call(conn, [])
	+ end
	+ end
	end
	diff --git a/lib/pleroma/web/activity_pub/activity_pub_controller.ex b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	index 08bf1c752..7047b8254 100644
	--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
	@@ -1,381 +1,386 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ActivityPub.ActivityPubController do
	use Pleroma.Web, :controller

	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.Object.Fetcher
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.InternalFetchActor
	alias Pleroma.Web.ActivityPub.ObjectView
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.ActivityPub.Transmogrifier
	alias Pleroma.Web.ActivityPub.UserView
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.Federator

	require Logger

	action_fallback(:errors)

	+ plug(
	+ Pleroma.Plugs.OAuthScopesPlug,
	+ %{scopes: ["read:accounts"]} when action in [:followers, :following]
	+ )
	+
	plug(Pleroma.Web.FederatingPlug when action in [:inbox, :relay])
	plug(:set_requester_reachable when action in [:inbox])
	plug(:relay_active? when action in [:relay])

	def relay_active?(conn, _) do
	if Pleroma.Config.get([:instance, :allow_relay]) do
	conn
	else
	conn
	\|> render_error(:not_found, "not found")
	\|> halt()
	end
	end

	def user(conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("user.json", %{user: user}))
	else
	nil -> {:error, :not_found}
	end
	end

	def object(conn, %{"uuid" => uuid}) do
	with ap_id <- o_status_url(conn, :object, uuid),
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(object)} do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(ObjectView.render("object.json", %{object: object}))
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	def object_likes(conn, %{"uuid" => uuid, "page" => page}) do
	with ap_id <- o_status_url(conn, :object, uuid),
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(object)},
	likes <- Utils.get_object_likes(object) do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(ObjectView.render("likes.json", ap_id, likes, page))
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	def object_likes(conn, %{"uuid" => uuid}) do
	with ap_id <- o_status_url(conn, :object, uuid),
	%Object{} = object <- Object.get_cached_by_ap_id(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(object)},
	likes <- Utils.get_object_likes(object) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(ObjectView.render("likes.json", ap_id, likes))
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	def activity(conn, %{"uuid" => uuid}) do
	with ap_id <- o_status_url(conn, :activity, uuid),
	%Activity{} = activity <- Activity.normalize(ap_id),
	{_, true} <- {:public?, Visibility.is_public?(activity)} do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(ObjectView.render("object.json", %{object: activity}))
	else
	{:public?, false} ->
	{:error, :not_found}
	end
	end

	# GET /relay/following
	def following(%{assigns: %{relay: true}} = conn, _params) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("following.json", %{user: Relay.get_actor()}))
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
	{:show_follows, true} <-
	{:show_follows, (for_user && for_user == user) \|\| !user.info.hide_follows} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("following.json", %{user: user, page: page, for: for_user}))
	else
	{:show_follows, _} ->
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> send_resp(403, "")
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("following.json", %{user: user, for: for_user}))
	end
	end

	# GET /relay/followers
	def followers(%{assigns: %{relay: true}} = conn, _params) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("followers.json", %{user: Relay.get_actor()}))
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname, "page" => page}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user),
	{:show_followers, true} <-
	{:show_followers, (for_user && for_user == user) \|\| !user.info.hide_followers} do
	{page, _} = Integer.parse(page)

	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("followers.json", %{user: user, page: page, for: for_user}))
	else
	{:show_followers, _} ->
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> send_resp(403, "")
	end
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{user, for_user} <- ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("followers.json", %{user: user, for: for_user}))
	end
	end

	def outbox(conn, %{"nickname" => nickname} = params) do
	with %User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("outbox.json", %{user: user, max_id: params["max_id"]}))
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, %{"nickname" => nickname} = params) do
	with %User{} = recipient <- User.get_cached_by_nickname(nickname),
	{:ok, %User{} = actor} <- User.get_or_fetch_by_ap_id(params["actor"]),
	true <- Utils.recipient_in_message(recipient, actor, params),
	params <- Utils.maybe_splice_recipient(recipient.ap_id, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end
	end

	def inbox(%{assigns: %{valid_signature: true}} = conn, params) do
	Federator.incoming_ap_doc(params)
	json(conn, "ok")
	end

	# only accept relayed Creates
	def inbox(conn, %{"type" => "Create"} = params) do
	Logger.info(
	"Signature missing or not from author, relayed Create message, fetching object from source"
	)

	Fetcher.fetch_object_from_id(params["object"]["id"])

	json(conn, "ok")
	end

	def inbox(conn, params) do
	headers = Enum.into(conn.req_headers, %{})

	if String.contains?(headers["signature"], params["actor"]) do
	Logger.info(
	"Signature validation error for: #{params["actor"]}, make sure you are forwarding the HTTP Host header!"
	)

	Logger.info(inspect(conn.req_headers))
	end

	json(conn, dgettext("errors", "error"))
	end

	defp represent_service_actor(%User{} = user, conn) do
	with {:ok, user} <- User.ensure_keys_present(user) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("user.json", %{user: user}))
	else
	nil -> {:error, :not_found}
	end
	end

	defp represent_service_actor(nil, _), do: {:error, :not_found}

	def relay(conn, _params) do
	Relay.get_actor()
	\|> represent_service_actor(conn)
	end

	def internal_fetch(conn, _params) do
	InternalFetchActor.get_actor()
	\|> represent_service_actor(conn)
	end

	def whoami(%{assigns: %{user: %User{} = user}} = conn, _params) do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("user.json", %{user: user}))
	end

	def whoami(_conn, _params), do: {:error, :not_found}

	def read_inbox(%{assigns: %{user: user}} = conn, %{"nickname" => nickname} = params) do
	if nickname == user.nickname do
	conn
	\|> put_resp_content_type("application/activity+json")
	\|> json(UserView.render("inbox.json", %{user: user, max_id: params["max_id"]}))
	else
	err =
	dgettext("errors", "can't read inbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: user.nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end
	end

	def handle_user_activity(user, %{"type" => "Create"} = params) do
	object =
	params["object"]
	\|> Map.merge(Map.take(params, ["to", "cc"]))
	\|> Map.put("attributedTo", user.ap_id())
	\|> Transmogrifier.fix_object()

	ActivityPub.create(%{
	to: params["to"],
	actor: user,
	context: object["context"],
	object: object,
	additional: Map.take(params, ["cc"])
	})
	end

	def handle_user_activity(user, %{"type" => "Delete"} = params) do
	with %Object{} = object <- Object.normalize(params["object"]),
	true <- user.info.is_moderator \|\| user.ap_id == object.data["actor"],
	{:ok, delete} <- ActivityPub.delete(object) do
	{:ok, delete}
	else
	_ -> {:error, dgettext("errors", "Can't delete object")}
	end
	end

	def handle_user_activity(user, %{"type" => "Like"} = params) do
	with %Object{} = object <- Object.normalize(params["object"]),
	{:ok, activity, _object} <- ActivityPub.like(user, object) do
	{:ok, activity}
	else
	_ -> {:error, dgettext("errors", "Can't like object")}
	end
	end

	def handle_user_activity(_, _) do
	{:error, dgettext("errors", "Unhandled activity type")}
	end

	def update_outbox(
	%{assigns: %{user: %User{nickname: nickname} = user}} = conn,
	%{"nickname" => nickname} = params
	) do
	actor = user.ap_id()

	params =
	params
	\|> Map.drop(["id"])
	\|> Map.put("actor", actor)
	\|> Transmogrifier.fix_addressing()

	with {:ok, %Activity{} = activity} <- handle_user_activity(user, params) do
	conn
	\|> put_status(:created)
	\|> put_resp_header("location", activity.data["id"])
	\|> json(activity.data)
	else
	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(message)
	end
	end

	def update_outbox(%{assigns: %{user: user}} = conn, %{"nickname" => nickname} = _) do
	err =
	dgettext("errors", "can't update outbox of %{nickname} as %{as_nickname}",
	nickname: nickname,
	as_nickname: user.nickname
	)

	conn
	\|> put_status(:forbidden)
	\|> json(err)
	end

	def errors(conn, {:error, :not_found}) do
	conn
	\|> put_status(:not_found)
	\|> json(dgettext("errors", "Not found"))
	end

	def errors(conn, _e) do
	conn
	\|> put_status(:internal_server_error)
	\|> json(dgettext("errors", "error"))
	end

	defp set_requester_reachable(%Plug.Conn{} = conn, _) do
	with actor <- conn.params["actor"],
	true <- is_binary(actor) do
	Pleroma.Instances.set_reachable(actor)
	end

	conn
	end

	defp ensure_user_keys_present_and_maybe_refresh_for_user(user, for_user) do
	{:ok, new_user} = User.ensure_keys_present(user)

	for_user =
	if new_user != user and match?(%User{}, for_user) do
	User.get_cached_by_nickname(for_user.nickname)
	else
	for_user
	end

	{new_user, for_user}
	end
	end
	diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex
	index 544b9d7d8..0a508d40e 100644
	--- a/lib/pleroma/web/admin_api/admin_api_controller.ex
	+++ b/lib/pleroma/web/admin_api/admin_api_controller.ex
	@@ -1,639 +1,690 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.AdminAPIController do
	use Pleroma.Web, :controller
	alias Pleroma.Activity
	alias Pleroma.ModerationLog
	+ alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.User
	alias Pleroma.UserInviteToken
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.AdminAPI.AccountView
	alias Pleroma.Web.AdminAPI.Config
	alias Pleroma.Web.AdminAPI.ConfigView
	alias Pleroma.Web.AdminAPI.ModerationLogView
	alias Pleroma.Web.AdminAPI.ReportView
	alias Pleroma.Web.AdminAPI.Search
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.StatusView

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	require Logger

	+ plug(OAuthScopesPlug, %{scopes: ["read:statuses"]} when action == :list_user_statuses)
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:statuses"]} when action in [:status_update, :status_delete]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["read"]}
	+ when action in [
	+ :list_reports,
	+ :report_show,
	+ :right_get,
	+ :get_invite_token,
	+ :invites,
	+ :get_password_reset,
	+ :list_users,
	+ :user_show,
	+ :config_show,
	+ :migrate_to_db,
	+ :migrate_from_db,
	+ :list_log
	+ ]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write"]}
	+ when action in [
	+ :report_update_state,
	+ :report_respond,
	+ :user_follow,
	+ :user_unfollow,
	+ :user_delete,
	+ :users_create,
	+ :user_toggle_activation,
	+ :tag_users,
	+ :untag_users,
	+ :right_add,
	+ :right_delete,
	+ :set_activation_status,
	+ :relay_follow,
	+ :relay_unfollow,
	+ :revoke_invite,
	+ :email_invite,
	+ :config_update
	+ ]
	+ )
	+
	@users_page_size 50

	action_fallback(:errors)

	def user_delete(%{assigns: %{user: admin}} = conn, %{"nickname" => nickname}) do
	user = User.get_cached_by_nickname(nickname)
	User.delete(user)

	ModerationLog.insert_log(%{
	actor: admin,
	subject: user,
	action: "delete"
	})

	conn
	\|> json(nickname)
	end

	def user_follow(%{assigns: %{user: admin}} = conn, %{
	"follower" => follower_nick,
	"followed" => followed_nick
	}) do
	with %User{} = follower <- User.get_cached_by_nickname(follower_nick),
	%User{} = followed <- User.get_cached_by_nickname(followed_nick) do
	User.follow(follower, followed)

	ModerationLog.insert_log(%{
	actor: admin,
	followed: followed,
	follower: follower,
	action: "follow"
	})
	end

	conn
	\|> json("ok")
	end

	def user_unfollow(%{assigns: %{user: admin}} = conn, %{
	"follower" => follower_nick,
	"followed" => followed_nick
	}) do
	with %User{} = follower <- User.get_cached_by_nickname(follower_nick),
	%User{} = followed <- User.get_cached_by_nickname(followed_nick) do
	User.unfollow(follower, followed)

	ModerationLog.insert_log(%{
	actor: admin,
	followed: followed,
	follower: follower,
	action: "unfollow"
	})
	end

	conn
	\|> json("ok")
	end

	def users_create(%{assigns: %{user: admin}} = conn, %{"users" => users}) do
	changesets =
	Enum.map(users, fn %{"nickname" => nickname, "email" => email, "password" => password} ->
	user_data = %{
	nickname: nickname,
	name: nickname,
	email: email,
	password: password,
	password_confirmation: password,
	bio: "."
	}

	User.register_changeset(%User{}, user_data, need_confirmation: false)
	end)
	\|> Enum.reduce(Ecto.Multi.new(), fn changeset, multi ->
	Ecto.Multi.insert(multi, Ecto.UUID.generate(), changeset)
	end)

	case Pleroma.Repo.transaction(changesets) do
	{:ok, users} ->
	res =
	users
	\|> Map.values()
	\|> Enum.map(fn user ->
	{:ok, user} = User.post_register_action(user)

	user
	end)
	\|> Enum.map(&AccountView.render("created.json", %{user: &1}))

	ModerationLog.insert_log(%{
	actor: admin,
	subjects: Map.values(users),
	action: "create"
	})

	conn
	\|> json(res)

	{:error, id, changeset, _} ->
	res =
	Enum.map(changesets.operations, fn
	{current_id, {:changeset, _current_changeset, _}} when current_id == id ->
	AccountView.render("create-error.json", %{changeset: changeset})

	{_, {:changeset, current_changeset, _}} ->
	AccountView.render("create-error.json", %{changeset: current_changeset})
	end)

	conn
	\|> put_status(:conflict)
	\|> json(res)
	end
	end

	def user_show(conn, %{"nickname" => nickname}) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname) do
	conn
	\|> json(AccountView.render("show.json", %{user: user}))
	else
	_ -> {:error, :not_found}
	end
	end

	def list_user_statuses(conn, %{"nickname" => nickname} = params) do
	godmode = params["godmode"] == "true" \|\| params["godmode"] == true

	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname) do
	{_, page_size} = page_params(params)

	activities =
	ActivityPub.fetch_user_activities(user, nil, %{
	"limit" => page_size,
	"godmode" => godmode
	})

	conn
	\|> json(StatusView.render("index.json", %{activities: activities, as: :activity}))
	else
	_ -> {:error, :not_found}
	end
	end

	def user_toggle_activation(%{assigns: %{user: admin}} = conn, %{"nickname" => nickname}) do
	user = User.get_cached_by_nickname(nickname)

	{:ok, updated_user} = User.deactivate(user, !user.info.deactivated)

	action = if user.info.deactivated, do: "activate", else: "deactivate"

	ModerationLog.insert_log(%{
	actor: admin,
	subject: user,
	action: action
	})

	conn
	\|> json(AccountView.render("show.json", %{user: updated_user}))
	end

	def tag_users(%{assigns: %{user: admin}} = conn, %{"nicknames" => nicknames, "tags" => tags}) do
	with {:ok, _} <- User.tag(nicknames, tags) do
	ModerationLog.insert_log(%{
	actor: admin,
	nicknames: nicknames,
	tags: tags,
	action: "tag"
	})

	json_response(conn, :no_content, "")
	end
	end

	def untag_users(%{assigns: %{user: admin}} = conn, %{"nicknames" => nicknames, "tags" => tags}) do
	with {:ok, _} <- User.untag(nicknames, tags) do
	ModerationLog.insert_log(%{
	actor: admin,
	nicknames: nicknames,
	tags: tags,
	action: "untag"
	})

	json_response(conn, :no_content, "")
	end
	end

	def list_users(conn, params) do
	{page, page_size} = page_params(params)
	filters = maybe_parse_filters(params["filters"])

	search_params = %{
	query: params["query"],
	page: page,
	page_size: page_size,
	tags: params["tags"],
	name: params["name"],
	email: params["email"]
	}

	with {:ok, users, count} <- Search.user(Map.merge(search_params, filters)),
	do:
	conn
	\|> json(
	AccountView.render("index.json",
	users: users,
	count: count,
	page_size: page_size
	)
	)
	end

	@filters ~w(local external active deactivated is_admin is_moderator)

	@spec maybe_parse_filters(String.t()) :: %{required(String.t()) => true} \| %{}
	defp maybe_parse_filters(filters) when is_nil(filters) or filters == "", do: %{}

	defp maybe_parse_filters(filters) do
	filters
	\|> String.split(",")
	\|> Enum.filter(&Enum.member?(@filters, &1))
	\|> Enum.map(&String.to_atom(&1))
	\|> Enum.into(%{}, &{&1, true})
	end

	def right_add(%{assigns: %{user: admin}} = conn, %{
	"permission_group" => permission_group,
	"nickname" => nickname
	})
	when permission_group in ["moderator", "admin"] do
	user = User.get_cached_by_nickname(nickname)

	info =
	%{}
	\|> Map.put("is_" <> permission_group, true)

	info_cng = User.Info.admin_api_update(user.info, info)

	cng =
	user
	\|> Ecto.Changeset.change()
	\|> Ecto.Changeset.put_embed(:info, info_cng)

	ModerationLog.insert_log(%{
	action: "grant",
	actor: admin,
	subject: user,
	permission: permission_group
	})

	{:ok, _user} = User.update_and_set_cache(cng)

	json(conn, info)
	end

	def right_add(conn, _) do
	render_error(conn, :not_found, "No such permission_group")
	end

	def right_get(conn, %{"nickname" => nickname}) do
	user = User.get_cached_by_nickname(nickname)

	conn
	\|> json(%{
	is_moderator: user.info.is_moderator,
	is_admin: user.info.is_admin
	})
	end

	def right_delete(
	%{assigns: %{user: %User{:nickname => admin_nickname} = admin}} = conn,
	%{
	"permission_group" => permission_group,
	"nickname" => nickname
	}
	)
	when permission_group in ["moderator", "admin"] do
	if admin_nickname == nickname do
	render_error(conn, :forbidden, "You can't revoke your own admin status.")
	else
	user = User.get_cached_by_nickname(nickname)

	info =
	%{}
	\|> Map.put("is_" <> permission_group, false)

	info_cng = User.Info.admin_api_update(user.info, info)

	cng =
	Ecto.Changeset.change(user)
	\|> Ecto.Changeset.put_embed(:info, info_cng)

	{:ok, _user} = User.update_and_set_cache(cng)

	ModerationLog.insert_log(%{
	action: "revoke",
	actor: admin,
	subject: user,
	permission: permission_group
	})

	json(conn, info)
	end
	end

	def right_delete(conn, _) do
	render_error(conn, :not_found, "No such permission_group")
	end

	def set_activation_status(%{assigns: %{user: admin}} = conn, %{
	"nickname" => nickname,
	"status" => status
	}) do
	with {:ok, status} <- Ecto.Type.cast(:boolean, status),
	%User{} = user <- User.get_cached_by_nickname(nickname),
	{:ok, _} <- User.deactivate(user, !status) do
	action = if(user.info.deactivated, do: "activate", else: "deactivate")

	ModerationLog.insert_log(%{
	actor: admin,
	subject: user,
	action: action
	})

	json_response(conn, :no_content, "")
	end
	end

	def relay_follow(%{assigns: %{user: admin}} = conn, %{"relay_url" => target}) do
	with {:ok, _message} <- Relay.follow(target) do
	ModerationLog.insert_log(%{
	action: "relay_follow",
	actor: admin,
	target: target
	})

	json(conn, target)
	else
	_ ->
	conn
	\|> put_status(500)
	\|> json(target)
	end
	end

	def relay_unfollow(%{assigns: %{user: admin}} = conn, %{"relay_url" => target}) do
	with {:ok, _message} <- Relay.unfollow(target) do
	ModerationLog.insert_log(%{
	action: "relay_unfollow",
	actor: admin,
	target: target
	})

	json(conn, target)
	else
	_ ->
	conn
	\|> put_status(500)
	\|> json(target)
	end
	end

	@doc "Sends registration invite via email"
	def email_invite(%{assigns: %{user: user}} = conn, %{"email" => email} = params) do
	with true <-
	Pleroma.Config.get([:instance, :invites_enabled]) &&
	!Pleroma.Config.get([:instance, :registrations_open]),
	{:ok, invite_token} <- UserInviteToken.create_invite(),
	email <-
	Pleroma.Emails.UserEmail.user_invitation_email(
	user,
	invite_token,
	email,
	params["name"]
	),
	{:ok, _} <- Pleroma.Emails.Mailer.deliver(email) do
	json_response(conn, :no_content, "")
	end
	end

	@doc "Get a account registeration invite token (base64 string)"
	def get_invite_token(conn, params) do
	options = params["invite"] \|\| %{}
	{:ok, invite} = UserInviteToken.create_invite(options)

	conn
	\|> json(invite.token)
	end

	@doc "Get list of created invites"
	def invites(conn, _params) do
	invites = UserInviteToken.list_invites()

	conn
	\|> json(AccountView.render("invites.json", %{invites: invites}))
	end

	@doc "Revokes invite by token"
	def revoke_invite(conn, %{"token" => token}) do
	with {:ok, invite} <- UserInviteToken.find_by_token(token),
	{:ok, updated_invite} = UserInviteToken.update_invite(invite, %{used: true}) do
	conn
	\|> json(AccountView.render("invite.json", %{invite: updated_invite}))
	else
	nil -> {:error, :not_found}
	end
	end

	@doc "Get a password reset token (base64 string) for given nickname"
	def get_password_reset(conn, %{"nickname" => nickname}) do
	(%User{local: true} = user) = User.get_cached_by_nickname(nickname)
	{:ok, token} = Pleroma.PasswordResetToken.create_token(user)

	conn
	\|> json(token.token)
	end

	def list_reports(conn, params) do
	params =
	params
	\|> Map.put("type", "Flag")
	\|> Map.put("skip_preload", true)

	reports =
	[]
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> put_view(ReportView)
	\|> render("index.json", %{reports: reports})
	end

	def report_show(conn, %{"id" => id}) do
	with %Activity{} = report <- Activity.get_by_id(id) do
	conn
	\|> put_view(ReportView)
	\|> render("show.json", %{report: report})
	else
	_ -> {:error, :not_found}
	end
	end

	def report_update_state(%{assigns: %{user: admin}} = conn, %{"id" => id, "state" => state}) do
	with {:ok, report} <- CommonAPI.update_report_state(id, state) do
	ModerationLog.insert_log(%{
	action: "report_update",
	actor: admin,
	subject: report
	})

	conn
	\|> put_view(ReportView)
	\|> render("show.json", %{report: report})
	end
	end

	def report_respond(%{assigns: %{user: user}} = conn, %{"id" => id} = params) do
	with false <- is_nil(params["status"]),
	%Activity{} <- Activity.get_by_id(id) do
	params =
	params
	\|> Map.put("in_reply_to_status_id", id)
	\|> Map.put("visibility", "direct")

	{:ok, activity} = CommonAPI.post(user, params)

	ModerationLog.insert_log(%{
	action: "report_response",
	actor: user,
	subject: activity,
	text: params["status"]
	})

	conn
	\|> put_view(StatusView)
	\|> render("status.json", %{activity: activity})
	else
	true ->
	{:param_cast, nil}

	nil ->
	{:error, :not_found}
	end
	end

	def status_update(%{assigns: %{user: admin}} = conn, %{"id" => id} = params) do
	with {:ok, activity} <- CommonAPI.update_activity_scope(id, params) do
	{:ok, sensitive} = Ecto.Type.cast(:boolean, params["sensitive"])

	ModerationLog.insert_log(%{
	action: "status_update",
	actor: admin,
	subject: activity,
	sensitive: sensitive,
	visibility: params["visibility"]
	})

	conn
	\|> put_view(StatusView)
	\|> render("status.json", %{activity: activity})
	end
	end

	def status_delete(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	ModerationLog.insert_log(%{
	action: "status_delete",
	actor: user,
	subject_id: id
	})

	json(conn, %{})
	end
	end

	def list_log(conn, params) do
	{page, page_size} = page_params(params)

	log = ModerationLog.get_all(page, page_size)

	conn
	\|> put_view(ModerationLogView)
	\|> render("index.json", %{log: log})
	end

	def migrate_to_db(conn, _params) do
	Mix.Tasks.Pleroma.Config.run(["migrate_to_db"])
	json(conn, %{})
	end

	def migrate_from_db(conn, _params) do
	Mix.Tasks.Pleroma.Config.run(["migrate_from_db", Pleroma.Config.get(:env), "true"])
	json(conn, %{})
	end

	def config_show(conn, _params) do
	configs = Pleroma.Repo.all(Config)

	conn
	\|> put_view(ConfigView)
	\|> render("index.json", %{configs: configs})
	end

	def config_update(conn, %{"configs" => configs}) do
	updated =
	if Pleroma.Config.get([:instance, :dynamic_configuration]) do
	updated =
	Enum.map(configs, fn
	%{"group" => group, "key" => key, "delete" => "true"} = params ->
	{:ok, config} = Config.delete(%{group: group, key: key, subkeys: params["subkeys"]})
	config

	%{"group" => group, "key" => key, "value" => value} ->
	{:ok, config} = Config.update_or_create(%{group: group, key: key, value: value})
	config
	end)
	\|> Enum.reject(&is_nil(&1))

	Pleroma.Config.TransferTask.load_and_update_env()
	Mix.Tasks.Pleroma.Config.run(["migrate_from_db", Pleroma.Config.get(:env), "false"])
	updated
	else
	[]
	end

	conn
	\|> put_view(ConfigView)
	\|> render("index.json", %{configs: updated})
	end

	def errors(conn, {:error, :not_found}) do
	conn
	\|> put_status(:not_found)
	\|> json(dgettext("errors", "Not found"))
	end

	def errors(conn, {:error, reason}) do
	conn
	\|> put_status(:bad_request)
	\|> json(reason)
	end

	def errors(conn, {:param_cast, _}) do
	conn
	\|> put_status(:bad_request)
	\|> json(dgettext("errors", "Invalid parameters"))
	end

	def errors(conn, _) do
	conn
	\|> put_status(:internal_server_error)
	\|> json(dgettext("errors", "Something went wrong"))
	end

	defp page_params(params) do
	{get_page(params["page"]), get_page_size(params["page_size"])}
	end

	defp get_page(page_string) when is_nil(page_string), do: 1

	defp get_page(page_string) do
	case Integer.parse(page_string) do
	{page, _} -> page
	:error -> 1
	end
	end

	defp get_page_size(page_size_string) when is_nil(page_size_string), do: @users_page_size

	defp get_page_size(page_size_string) do
	case Integer.parse(page_size_string) do
	{page_size, _} -> page_size
	:error -> @users_page_size
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/list_controller.ex b/lib/pleroma/web/mastodon_api/controllers/list_controller.ex
	index 2873deda8..be7089630 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/list_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/list_controller.ex
	@@ -1,84 +1,93 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.ListController do
	use Pleroma.Web, :controller

	+ alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.User
	alias Pleroma.Web.MastodonAPI.AccountView

	plug(:list_by_id_and_user when action not in [:index, :create])

	+ plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action in [:index, :show, :list_accounts])
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:lists"]}
	+ when action in [:create, :update, :delete, :add_to_list, :remove_from_list]
	+ )
	+
	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	# GET /api/v1/lists
	def index(%{assigns: %{user: user}} = conn, opts) do
	lists = Pleroma.List.for_user(user, opts)
	render(conn, "index.json", lists: lists)
	end

	# POST /api/v1/lists
	def create(%{assigns: %{user: user}} = conn, %{"title" => title}) do
	with {:ok, %Pleroma.List{} = list} <- Pleroma.List.create(title, user) do
	render(conn, "show.json", list: list)
	end
	end

	# GET /api/v1/lists/:id
	def show(%{assigns: %{list: list}} = conn, _) do
	render(conn, "show.json", list: list)
	end

	# PUT /api/v1/lists/:id
	def update(%{assigns: %{list: list}} = conn, %{"title" => title}) do
	with {:ok, list} <- Pleroma.List.rename(list, title) do
	render(conn, "show.json", list: list)
	end
	end

	# DELETE /api/v1/lists/:id
	def delete(%{assigns: %{list: list}} = conn, _) do
	with {:ok, _list} <- Pleroma.List.delete(list) do
	json(conn, %{})
	end
	end

	# GET /api/v1/lists/:id/accounts
	def list_accounts(%{assigns: %{user: user, list: list}} = conn, _) do
	with {:ok, users} <- Pleroma.List.get_following(list) do
	conn
	\|> put_view(AccountView)
	\|> render("accounts.json", for: user, users: users, as: :user)
	end
	end

	# POST /api/v1/lists/:id/accounts
	def add_to_list(%{assigns: %{list: list}} = conn, %{"account_ids" => account_ids}) do
	Enum.each(account_ids, fn account_id ->
	with %User{} = followed <- User.get_cached_by_id(account_id) do
	Pleroma.List.follow(list, followed)
	end
	end)

	json(conn, %{})
	end

	# DELETE /api/v1/lists/:id/accounts
	def remove_from_list(%{assigns: %{list: list}} = conn, %{"account_ids" => account_ids}) do
	Enum.each(account_ids, fn account_id ->
	with %User{} = followed <- User.get_cached_by_id(account_id) do
	Pleroma.List.unfollow(list, followed)
	end
	end)

	json(conn, %{})
	end

	defp list_by_id_and_user(%{assigns: %{user: user}, params: %{"id" => id}} = conn, _) do
	case Pleroma.List.get(id, user) do
	%Pleroma.List{} = list -> assign(conn, :list, list)
	nil -> conn \|> render_error(:not_found, "List not found") \|> halt()
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	index 118446c85..704664f5f 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	@@ -1,1736 +1,1863 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [json_response: 3, add_link_headers: 5, add_link_headers: 4, add_link_headers: 3]

	alias Ecto.Changeset
	alias Pleroma.Activity
	alias Pleroma.Bookmark
	alias Pleroma.Config
	alias Pleroma.Conversation.Participation
	alias Pleroma.Filter
	alias Pleroma.Formatter
	alias Pleroma.HTTP
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Pagination
	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.Plugs.RateLimiter
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.Stats
	alias Pleroma.User
	alias Pleroma.Web
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.AppView
	alias Pleroma.Web.MastodonAPI.ConversationView
	alias Pleroma.Web.MastodonAPI.FilterView
	alias Pleroma.Web.MastodonAPI.ListView
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	alias Pleroma.Web.MastodonAPI.MastodonView
	alias Pleroma.Web.MastodonAPI.NotificationView
	alias Pleroma.Web.MastodonAPI.ReportView
	alias Pleroma.Web.MastodonAPI.ScheduledActivityView
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.MediaProxy
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Scopes
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.TwitterAPI

	alias Pleroma.Web.ControllerHelper
	import Ecto.Query

	require Logger
	require Pleroma.Constants

	+ plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug when action != :index)
	+
	+ @unauthenticated_access %{fallback: :proceed_unauthenticated, scopes: []}
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["read"], skip_instance_privacy_check: true} when action == :index
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["read"]} when action in [:suggestions, :verify_app_credentials]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:accounts"]}
	+ # Note: the following actions are not permission-secured in Mastodon:
	+ when action in [
	+ :put_settings,
	+ :update_avatar,
	+ :update_banner,
	+ :update_background,
	+ :set_mascot
	+ ]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:accounts"]}
	+ when action in [:pin_status, :unpin_status, :update_credentials]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["read:statuses"]}
	+ when action in [
	+ :conversations,
	+ :scheduled_statuses,
	+ :show_scheduled_status,
	+ :home_timeline,
	+ :dm_timeline
	+ ]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{@unauthenticated_access \| scopes: ["read:statuses"]}
	+ when action in [:user_statuses, :get_status, :get_context, :status_card, :get_poll]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:statuses"]}
	+ when action in [
	+ :update_scheduled_status,
	+ :delete_scheduled_status,
	+ :post_status,
	+ :delete_status,
	+ :reblog_status,
	+ :unreblog_status,
	+ :poll_vote
	+ ]
	+ )
	+
	+ plug(OAuthScopesPlug, %{scopes: ["write:conversations"]} when action == :conversation_read)
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["read:accounts"]}
	+ when action in [:endorsements, :verify_credentials, :followers, :following, :get_mascot]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{@unauthenticated_access \| scopes: ["read:accounts"]}
	+ when action in [:user, :favourited_by, :reblogged_by]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["read:favourites"]} when action in [:favourites, :user_favourites]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:favourites"]} when action in [:fav_status, :unfav_status]
	+ )
	+
	+ plug(OAuthScopesPlug, %{scopes: ["read:filters"]} when action in [:get_filters, :get_filter])
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:filters"]} when action in [:create_filter, :update_filter, :delete_filter]
	+ )
	+
	+ plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action in [:account_lists, :list_timeline])
	+
	+ plug(OAuthScopesPlug, %{scopes: ["write:media"]} when action in [:upload, :update_media])
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["read:notifications"]} when action in [:notifications, :get_notification]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:notifications"]}
	+ when action in [:clear_notifications, :dismiss_notification, :destroy_multiple_notifications]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:reports"]}
	+ when action in [:create_report, :report_update_state, :report_respond]
	+ )
	+
	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "read:blocks"]} when action in [:blocks, :domain_blocks]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:blocks"]}
	when action in [:block, :unblock, :block_domain, :unblock_domain]
	)

	+ plug(OAuthScopesPlug, %{scopes: ["read:follows"]} when action == :relationships)
	plug(OAuthScopesPlug, %{scopes: ["follow", "read:follows"]} when action == :follow_requests)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]}
	when action in [
	:follow,
	:unfollow,
	:subscribe,
	:unsubscribe,
	:authorize_follow_request,
	:reject_follow_request
	]
	)

	plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)
	plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])

	plug(
	OAuthScopesPlug,
	- %{scopes: ["write:mutes"]}
	- when action in [:mute_conversation, :unmute_conversation]
	+ %{scopes: ["write:mutes"]} when action in [:mute_conversation, :unmute_conversation]
	+ )
	+
	+ # Note: scopes not present in Mastodon: read:bookmarks, write:bookmarks
	+ plug(OAuthScopesPlug, %{scopes: ["read:bookmarks"]} when action == :bookmarks)
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:bookmarks"]} when action in [:bookmark_status, :unbookmark_status]
	)

	@rate_limited_relations_actions ~w(follow unfollow)a

	@rate_limited_status_actions ~w(reblog_status unreblog_status fav_status unfav_status
	post_status delete_status)a

	plug(
	RateLimiter,
	{:status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: ["id"]}
	when action in ~w(reblog_status unreblog_status)a
	)

	plug(
	RateLimiter,
	{:status_id_action, bucket_name: "status_id_action:fav_unfav", params: ["id"]}
	when action in ~w(fav_status unfav_status)a
	)

	plug(
	RateLimiter,
	{:relations_id_action, params: ["id", "uri"]} when action in @rate_limited_relations_actions
	)

	plug(RateLimiter, :relations_actions when action in @rate_limited_relations_actions)
	plug(RateLimiter, :statuses_actions when action in @rate_limited_status_actions)
	plug(RateLimiter, :app_account_creation when action == :account_register)
	plug(RateLimiter, :search when action in [:search, :search2, :account_search])
	plug(RateLimiter, :password_reset when action == :password_reset)
	plug(RateLimiter, :account_confirmation_resend when action == :account_confirmation_resend)

	@local_mastodon_name "Mastodon-Local"

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	def create_app(conn, params) do
	scopes = Scopes.fetch_scopes(params, ["read"])

	app_attrs =
	params
	\|> Map.drop(["scope", "scopes"])
	\|> Map.put("scopes", scopes)

	with cs <- App.register_changeset(%App{}, app_attrs),
	false <- cs.changes[:client_name] == @local_mastodon_name,
	{:ok, app} <- Repo.insert(cs) do
	conn
	\|> put_view(AppView)
	\|> render("show.json", %{app: app})
	end
	end

	defp add_if_present(
	map,
	params,
	params_field,
	map_field,
	value_function \\ fn x -> {:ok, x} end
	) do
	if Map.has_key?(params, params_field) do
	case value_function.(params[params_field]) do
	{:ok, new_value} -> Map.put(map, map_field, new_value)
	:error -> map
	end
	else
	map
	end
	end

	def update_credentials(%{assigns: %{user: user}} = conn, params) do
	original_user = user

	user_params =
	%{}
	\|> add_if_present(params, "display_name", :name)
	\|> add_if_present(params, "note", :bio, fn value -> {:ok, User.parse_bio(value, user)} end)
	\|> add_if_present(params, "avatar", :avatar, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :avatar) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)

	emojis_text = (user_params["display_name"] \|\| "") <> (user_params["note"] \|\| "")

	user_info_emojis =
	user.info
	\|> Map.get(:emoji, [])
	\|> Enum.concat(Formatter.get_emoji_map(emojis_text))
	\|> Enum.dedup()

	info_params =
	[
	:no_rich_text,
	:locked,
	:hide_followers,
	:hide_follows,
	:hide_favorites,
	:show_role,
	:skip_thread_containment
	]
	\|> Enum.reduce(%{}, fn key, acc ->
	add_if_present(acc, params, to_string(key), key, fn value ->
	{:ok, ControllerHelper.truthy_param?(value)}
	end)
	end)
	\|> add_if_present(params, "default_scope", :default_scope)
	\|> add_if_present(params, "fields", :fields, fn fields ->
	fields = Enum.map(fields, fn f -> Map.update!(f, "value", &AutoLinker.link(&1)) end)

	{:ok, fields}
	end)
	\|> add_if_present(params, "fields", :raw_fields)
	\|> add_if_present(params, "pleroma_settings_store", :pleroma_settings_store, fn value ->
	{:ok, Map.merge(user.info.pleroma_settings_store, value)}
	end)
	\|> add_if_present(params, "header", :banner, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :banner) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)
	\|> add_if_present(params, "pleroma_background_image", :background, fn value ->
	with %Plug.Upload{} <- value,
	{:ok, object} <- ActivityPub.upload(value, type: :background) do
	{:ok, object.data}
	else
	_ -> :error
	end
	end)
	\|> Map.put(:emoji, user_info_emojis)

	info_cng = User.Info.profile_update(user.info, info_params)

	with changeset <- User.update_changeset(user, user_params),
	changeset <- Changeset.put_embed(changeset, :info, info_cng),
	{:ok, user} <- User.update_and_set_cache(changeset) do
	if original_user != user do
	CommonAPI.update(user)
	end

	json(
	conn,
	AccountView.render("account.json", %{user: user, for: user, with_pleroma_settings: true})
	)
	else
	_e -> render_error(conn, :forbidden, "Invalid request")
	end
	end

	def update_avatar(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
	change = Changeset.change(user, %{avatar: nil})
	{:ok, user} = User.update_and_set_cache(change)
	CommonAPI.update(user)

	json(conn, %{url: nil})
	end

	def update_avatar(%{assigns: %{user: user}} = conn, params) do
	{:ok, object} = ActivityPub.upload(params, type: :avatar)
	change = Changeset.change(user, %{avatar: object.data})
	{:ok, user} = User.update_and_set_cache(change)
	CommonAPI.update(user)
	%{"url" => [%{"href" => href} \| _]} = object.data

	json(conn, %{url: href})
	end

	def update_banner(%{assigns: %{user: user}} = conn, %{"banner" => ""}) do
	with new_info <- %{"banner" => %{}},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Changeset.change(user) \|> Changeset.put_embed(:info, info_cng),
	{:ok, user} <- User.update_and_set_cache(changeset) do
	CommonAPI.update(user)

	json(conn, %{url: nil})
	end
	end

	def update_banner(%{assigns: %{user: user}} = conn, params) do
	with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}, type: :banner),
	new_info <- %{"banner" => object.data},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Changeset.change(user) \|> Changeset.put_embed(:info, info_cng),
	{:ok, user} <- User.update_and_set_cache(changeset) do
	CommonAPI.update(user)
	%{"url" => [%{"href" => href} \| _]} = object.data

	json(conn, %{url: href})
	end
	end

	def update_background(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
	with new_info <- %{"background" => %{}},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Changeset.change(user) \|> Changeset.put_embed(:info, info_cng),
	{:ok, _user} <- User.update_and_set_cache(changeset) do
	json(conn, %{url: nil})
	end
	end

	def update_background(%{assigns: %{user: user}} = conn, params) do
	with {:ok, object} <- ActivityPub.upload(params, type: :background),
	new_info <- %{"background" => object.data},
	info_cng <- User.Info.profile_update(user.info, new_info),
	changeset <- Changeset.change(user) \|> Changeset.put_embed(:info, info_cng),
	{:ok, _user} <- User.update_and_set_cache(changeset) do
	%{"url" => [%{"href" => href} \| _]} = object.data

	json(conn, %{url: href})
	end
	end

	def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	chat_token = Phoenix.Token.sign(conn, "user socket", user.id)

	account =
	AccountView.render("account.json", %{
	user: user,
	for: user,
	with_pleroma_settings: true,
	with_chat_token: chat_token
	})

	json(conn, account)
	end

	def verify_app_credentials(%{assigns: %{user: _user, token: token}} = conn, _) do
	with %Token{app: %App{} = app} <- Repo.preload(token, :app) do
	conn
	\|> put_view(AppView)
	\|> render("short.json", %{app: app})
	end
	end

	def user(%{assigns: %{user: for_user}} = conn, %{"id" => nickname_or_id}) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
	true <- User.auth_active?(user) \|\| user.id == for_user.id \|\| User.superuser?(for_user) do
	account = AccountView.render("account.json", %{user: user, for: for_user})
	json(conn, account)
	else
	_e -> render_error(conn, :not_found, "Can't find user")
	end
	end

	@mastodon_api_level "2.7.2"

	def masto_instance(conn, _params) do
	instance = Config.get(:instance)

	response = %{
	uri: Web.base_url(),
	title: Keyword.get(instance, :name),
	description: Keyword.get(instance, :description),
	version: "#{@mastodon_api_level} (compatible; #{Pleroma.Application.named_version()})",
	email: Keyword.get(instance, :email),
	urls: %{
	streaming_api: Pleroma.Web.Endpoint.websocket_url()
	},
	stats: Stats.get_stats(),
	thumbnail: Web.base_url() <> "/instance/thumbnail.jpeg",
	languages: ["en"],
	registrations: Pleroma.Config.get([:instance, :registrations_open]),
	# Extra (not present in Mastodon):
	max_toot_chars: Keyword.get(instance, :limit),
	poll_limits: Keyword.get(instance, :poll_limits)
	}

	json(conn, response)
	end

	def peers(conn, _params) do
	json(conn, Stats.get_peers())
	end

	defp mastodonized_emoji do
	Pleroma.Emoji.get_all()
	\|> Enum.map(fn {shortcode, relative_url, tags} ->
	url = to_string(URI.merge(Web.base_url(), relative_url))

	%{
	"shortcode" => shortcode,
	"static_url" => url,
	"visible_in_picker" => true,
	"url" => url,
	"tags" => tags,
	# Assuming that a comma is authorized in the category name
	"category" => (tags -- ["Custom"]) \|> Enum.join(",")
	}
	end)
	end

	def custom_emojis(conn, _params) do
	mastodon_emoji = mastodonized_emoji()
	json(conn, mastodon_emoji)
	end

	def home_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", ["Create", "Announce"])
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("user", user)

	activities =
	[user.ap_id \| user.following]
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:home_timeline, activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def public_timeline(%{assigns: %{user: user}} = conn, params) do
	local_only = params["local"] in [true, "True", "true", "1"]

	activities =
	params
	\|> Map.put("type", ["Create", "Announce"])
	\|> Map.put("local_only", local_only)
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("user", user)
	\|> ActivityPub.fetch_public_activities()
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:public_timeline, activities, false, %{"local" => local_only})
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def user_statuses(%{assigns: %{user: reading_user}} = conn, params) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(params["id"], for: reading_user) do
	params =
	params
	\|> Map.put("tag", params["tagged"])

	activities = ActivityPub.fetch_user_activities(user, reading_user, params)

	conn
	\|> add_link_headers(:user_statuses, activities, params["id"])
	\|> put_view(StatusView)
	\|> render("index.json", %{
	activities: activities,
	for: reading_user,
	as: :activity
	})
	end
	end

	def dm_timeline(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("blocking_user", user)
	\|> Map.put("user", user)
	\|> Map.put(:visibility, "direct")

	activities =
	[user.ap_id]
	\|> ActivityPub.fetch_activities_query(params)
	\|> Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(:dm_timeline, activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def get_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user})
	end
	end

	def get_context(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	activities <-
	ActivityPub.fetch_activities_for_context(activity.data["context"], %{
	"blocking_user" => user,
	"user" => user,
	"exclude_id" => activity.id
	}),
	grouped_activities <- Enum.group_by(activities, fn %{id: id} -> id < activity.id end) do
	result = %{
	ancestors:
	StatusView.render(
	"index.json",
	for: user,
	activities: grouped_activities[true] \|\| [],
	as: :activity
	)
	\|> Enum.reverse(),
	# credo:disable-for-previous-line Credo.Check.Refactor.PipeChainStart
	descendants:
	StatusView.render(
	"index.json",
	for: user,
	activities: grouped_activities[false] \|\| [],
	as: :activity
	)
	\|> Enum.reverse()
	# credo:disable-for-previous-line Credo.Check.Refactor.PipeChainStart
	}

	json(conn, result)
	end
	end

	def get_poll(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Object{} = object <- Object.get_by_id(id),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
	true <- Visibility.visible_for_user?(activity, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("poll.json", %{object: object, for: user})
	else
	error when is_nil(error) or error == false ->
	render_error(conn, :not_found, "Record not found")
	end
	end

	defp get_cached_vote_or_vote(user, object, choices) do
	idempotency_key = "polls:#{user.id}:#{object.data["id"]}"

	{_, res} =
	Cachex.fetch(:idempotency_cache, idempotency_key, fn _ ->
	case CommonAPI.vote(user, object, choices) do
	{:error, _message} = res -> {:ignore, res}
	res -> {:commit, res}
	end
	end)

	res
	end

	def poll_vote(%{assigns: %{user: user}} = conn, %{"id" => id, "choices" => choices}) do
	with %Object{} = object <- Object.get_by_id(id),
	true <- object.data["type"] == "Question",
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _activities, object} <- get_cached_vote_or_vote(user, object, choices) do
	conn
	\|> put_view(StatusView)
	\|> try_render("poll.json", %{object: object, for: user})
	else
	nil ->
	render_error(conn, :not_found, "Record not found")

	false ->
	render_error(conn, :not_found, "Record not found")

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	def scheduled_statuses(%{assigns: %{user: user}} = conn, params) do
	with scheduled_activities <- MastodonAPI.get_scheduled_activities(user, params) do
	conn
	\|> add_link_headers(:scheduled_statuses, scheduled_activities)
	\|> put_view(ScheduledActivityView)
	\|> render("index.json", %{scheduled_activities: scheduled_activities})
	end
	end

	def show_scheduled_status(%{assigns: %{user: user}} = conn, %{"id" => scheduled_activity_id}) do
	with %ScheduledActivity{} = scheduled_activity <-
	ScheduledActivity.get(user, scheduled_activity_id) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", %{scheduled_activity: scheduled_activity})
	else
	_ -> {:error, :not_found}
	end
	end

	def update_scheduled_status(
	%{assigns: %{user: user}} = conn,
	%{"id" => scheduled_activity_id} = params
	) do
	with %ScheduledActivity{} = scheduled_activity <-
	ScheduledActivity.get(user, scheduled_activity_id),
	{:ok, scheduled_activity} <- ScheduledActivity.update(scheduled_activity, params) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", %{scheduled_activity: scheduled_activity})
	else
	nil -> {:error, :not_found}
	error -> error
	end
	end

	def delete_scheduled_status(%{assigns: %{user: user}} = conn, %{"id" => scheduled_activity_id}) do
	with %ScheduledActivity{} = scheduled_activity <-
	ScheduledActivity.get(user, scheduled_activity_id),
	{:ok, scheduled_activity} <- ScheduledActivity.delete(scheduled_activity) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", %{scheduled_activity: scheduled_activity})
	else
	nil -> {:error, :not_found}
	error -> error
	end
	end

	def post_status(%{assigns: %{user: user}} = conn, %{"status" => _} = params) do
	params =
	params
	\|> Map.put("in_reply_to_status_id", params["in_reply_to_id"])

	scheduled_at = params["scheduled_at"]

	if scheduled_at && ScheduledActivity.far_enough?(scheduled_at) do
	with {:ok, scheduled_activity} <-
	ScheduledActivity.create(user, %{"params" => params, "scheduled_at" => scheduled_at}) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", %{scheduled_activity: scheduled_activity})
	end
	else
	params = Map.drop(params, ["scheduled_at"])

	case CommonAPI.post(user, params) do
	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:ok, activity} ->
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end
	end

	def delete_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	json(conn, %{})
	else
	_e -> render_error(conn, :forbidden, "Can't delete this post")
	end
	end

	def reblog_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, announce, _activity} <- CommonAPI.repeat(ap_id_or_id, user),
	%Activity{} = announce <- Activity.normalize(announce.data) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: announce, for: user, as: :activity})
	end
	end

	def unreblog_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, _unannounce, %{data: %{"id" => id}}} <- CommonAPI.unrepeat(ap_id_or_id, user),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id_with_object(id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def fav_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, _fav, %{data: %{"id" => id}}} <- CommonAPI.favorite(ap_id_or_id, user),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def unfav_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, _, _, %{data: %{"id" => id}}} <- CommonAPI.unfavorite(ap_id_or_id, user),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def pin_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def unpin_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
	with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def bookmark_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.create(user.id, activity.id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def unbookmark_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.destroy(user.id, activity.id) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def mute_conversation(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	activity = Activity.get_by_id(id)

	with {:ok, activity} <- CommonAPI.add_mute(user, activity) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def unmute_conversation(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	activity = Activity.get_by_id(id)

	with {:ok, activity} <- CommonAPI.remove_mute(user, activity) do
	conn
	\|> put_view(StatusView)
	\|> try_render("status.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def notifications(%{assigns: %{user: user}} = conn, params) do
	notifications = MastodonAPI.get_notifications(user, params)

	conn
	\|> add_link_headers(:notifications, notifications)
	\|> put_view(NotificationView)
	\|> render("index.json", %{notifications: notifications, for: user})
	end

	def get_notification(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	with {:ok, notification} <- Notification.get(user, id) do
	conn
	\|> put_view(NotificationView)
	\|> render("show.json", %{notification: notification, for: user})
	else
	{:error, reason} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{"error" => reason})
	end
	end

	def clear_notifications(%{assigns: %{user: user}} = conn, _params) do
	Notification.clear(user)
	json(conn, %{})
	end

	def dismiss_notification(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	with {:ok, _notif} <- Notification.dismiss(user, id) do
	json(conn, %{})
	else
	{:error, reason} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{"error" => reason})
	end
	end

	- def destroy_multiple(%{assigns: %{user: user}} = conn, %{"ids" => ids} = _params) do
	+ def destroy_multiple_notifications(%{assigns: %{user: user}} = conn, %{"ids" => ids} = _params) do
	Notification.destroy_multiple(user, ids)
	json(conn, %{})
	end

	def relationships(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	id = List.wrap(id)
	q = from(u in User, where: u.id in ^id)
	targets = Repo.all(q)

	conn
	\|> put_view(AccountView)
	\|> render("relationships.json", %{user: user, targets: targets})
	end

	# Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])

	def update_media(%{assigns: %{user: user}} = conn, data) do
	with %Object{} = object <- Repo.get(Object, data["id"]),
	true <- Object.authorize_mutation(object, user),
	true <- is_binary(data["description"]),
	description <- data["description"] do
	new_data = %{object.data \| "name" => description}

	{:ok, _} =
	object
	\|> Object.change(%{data: new_data})
	\|> Repo.update()

	attachment_data = Map.put(new_data, "id", object.id)

	conn
	\|> put_view(StatusView)
	\|> render("attachment.json", %{attachment: attachment_data})
	end
	end

	def upload(%{assigns: %{user: user}} = conn, %{"file" => file} = data) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, "description")
	) do
	attachment_data = Map.put(object.data, "id", object.id)

	conn
	\|> put_view(StatusView)
	\|> render("attachment.json", %{attachment: attachment_data})
	end
	end

	def set_mascot(%{assigns: %{user: user}} = conn, %{"file" => file}) do
	with {:ok, object} <- ActivityPub.upload(file, actor: User.ap_id(user)),
	%{} = attachment_data <- Map.put(object.data, "id", object.id),
	%{type: type} = rendered <-
	StatusView.render("attachment.json", %{attachment: attachment_data}) do
	# Reject if not an image
	if type == "image" do
	# Sure!
	# Save to the user's info
	info_changeset = User.Info.mascot_update(user.info, rendered)

	user_changeset =
	user
	\|> Changeset.change()
	\|> Changeset.put_embed(:info, info_changeset)

	{:ok, _user} = User.update_and_set_cache(user_changeset)

	conn
	\|> json(rendered)
	else
	render_error(conn, :unsupported_media_type, "mascots can only be images")
	end
	end
	end

	def get_mascot(%{assigns: %{user: user}} = conn, _params) do
	mascot = User.get_mascot(user)

	conn
	\|> json(mascot)
	end

	def favourited_by(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%Object{data: %{"likes" => likes}} <- Object.normalize(activity) do
	q = from(u in User, where: u.ap_id in ^likes)

	users =
	Repo.all(q)
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: user, users: users, as: :user})
	else
	_ -> json(conn, [])
	end
	end

	def reblogged_by(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%Object{data: %{"announcements" => announces}} <- Object.normalize(activity) do
	q = from(u in User, where: u.ap_id in ^announces)

	users =
	Repo.all(q)
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: user, users: users, as: :user})
	else
	_ -> json(conn, [])
	end
	end

	def hashtag_timeline(%{assigns: %{user: user}} = conn, params) do
	local_only = params["local"] in [true, "True", "true", "1"]

	tags =
	[params["tag"], params["any"]]
	\|> List.flatten()
	\|> Enum.uniq()
	\|> Enum.filter(& &1)
	\|> Enum.map(&String.downcase(&1))

	tag_all =
	params["all"] \|\|
	[]
	\|> Enum.map(&String.downcase(&1))

	tag_reject =
	params["none"] \|\|
	[]
	\|> Enum.map(&String.downcase(&1))

	activities =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("local_only", local_only)
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("user", user)
	\|> Map.put("tag", tags)
	\|> Map.put("tag_all", tag_all)
	\|> Map.put("tag_reject", tag_reject)
	\|> ActivityPub.fetch_public_activities()
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:hashtag_timeline, activities, params["tag"], %{"local" => local_only})
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def followers(%{assigns: %{user: for_user}} = conn, %{"id" => id} = params) do
	with %User{} = user <- User.get_cached_by_id(id),
	followers <- MastodonAPI.get_followers(user, params) do
	followers =
	cond do
	for_user && user.id == for_user.id -> followers
	user.info.hide_followers -> []
	true -> followers
	end

	conn
	\|> add_link_headers(:followers, followers, user)
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: for_user, users: followers, as: :user})
	end
	end

	def following(%{assigns: %{user: for_user}} = conn, %{"id" => id} = params) do
	with %User{} = user <- User.get_cached_by_id(id),
	followers <- MastodonAPI.get_friends(user, params) do
	followers =
	cond do
	for_user && user.id == for_user.id -> followers
	user.info.hide_follows -> []
	true -> followers
	end

	conn
	\|> add_link_headers(:following, followers, user)
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: for_user, users: followers, as: :user})
	end
	end

	def follow_requests(%{assigns: %{user: followed}} = conn, _params) do
	with {:ok, follow_requests} <- User.get_follow_requests(followed) do
	conn
	\|> put_view(AccountView)
	\|> render("accounts.json", %{for: followed, users: follow_requests, as: :user})
	end
	end

	def authorize_follow_request(%{assigns: %{user: followed}} = conn, %{"id" => id}) do
	with %User{} = follower <- User.get_cached_by_id(id),
	{:ok, follower} <- CommonAPI.accept_follow_request(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: followed, target: follower})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def reject_follow_request(%{assigns: %{user: followed}} = conn, %{"id" => id}) do
	with %User{} = follower <- User.get_cached_by_id(id),
	{:ok, follower} <- CommonAPI.reject_follow_request(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: followed, target: follower})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def follow(%{assigns: %{user: follower}} = conn, %{"id" => id}) do
	with {_, %User{} = followed} <- {:followed, User.get_cached_by_id(id)},
	{_, true} <- {:followed, follower.id != followed.id},
	{:ok, follower} <- MastodonAPI.follow(follower, followed, conn.params) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: follower, target: followed})
	else
	{:followed, _} ->
	{:error, :not_found}

	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def follow(%{assigns: %{user: follower}} = conn, %{"uri" => uri}) do
	with {_, %User{} = followed} <- {:followed, User.get_cached_by_nickname(uri)},
	{_, true} <- {:followed, follower.id != followed.id},
	{:ok, follower, followed, _} <- CommonAPI.follow(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("account.json", %{user: followed, for: follower})
	else
	{:followed, _} ->
	{:error, :not_found}

	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def unfollow(%{assigns: %{user: follower}} = conn, %{"id" => id}) do
	with {_, %User{} = followed} <- {:followed, User.get_cached_by_id(id)},
	{_, true} <- {:followed, follower.id != followed.id},
	{:ok, follower} <- CommonAPI.unfollow(follower, followed) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: follower, target: followed})
	else
	{:followed, _} ->
	{:error, :not_found}

	error ->
	error
	end
	end

	def mute(%{assigns: %{user: muter}} = conn, %{"id" => id} = params) do
	notifications =
	if Map.has_key?(params, "notifications"),
	do: params["notifications"] in [true, "True", "true", "1"],
	else: true

	with %User{} = muted <- User.get_cached_by_id(id),
	{:ok, muter} <- User.mute(muter, muted, notifications) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: muter, target: muted})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def unmute(%{assigns: %{user: muter}} = conn, %{"id" => id}) do
	with %User{} = muted <- User.get_cached_by_id(id),
	{:ok, muter} <- User.unmute(muter, muted) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: muter, target: muted})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def mutes(%{assigns: %{user: user}} = conn, _) do
	with muted_accounts <- User.muted_users(user) do
	res = AccountView.render("accounts.json", users: muted_accounts, for: user, as: :user)
	json(conn, res)
	end
	end

	def block(%{assigns: %{user: blocker}} = conn, %{"id" => id}) do
	with %User{} = blocked <- User.get_cached_by_id(id),
	{:ok, blocker} <- User.block(blocker, blocked),
	{:ok, _activity} <- ActivityPub.block(blocker, blocked) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: blocker, target: blocked})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def unblock(%{assigns: %{user: blocker}} = conn, %{"id" => id}) do
	with %User{} = blocked <- User.get_cached_by_id(id),
	{:ok, blocker} <- User.unblock(blocker, blocked),
	{:ok, _activity} <- ActivityPub.unblock(blocker, blocked) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: blocker, target: blocked})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def blocks(%{assigns: %{user: user}} = conn, _) do
	with blocked_accounts <- User.blocked_users(user) do
	res = AccountView.render("accounts.json", users: blocked_accounts, for: user, as: :user)
	json(conn, res)
	end
	end

	def domain_blocks(%{assigns: %{user: %{info: info}}} = conn, _) do
	json(conn, info.domain_blocks \|\| [])
	end

	def block_domain(%{assigns: %{user: blocker}} = conn, %{"domain" => domain}) do
	User.block_domain(blocker, domain)
	json(conn, %{})
	end

	def unblock_domain(%{assigns: %{user: blocker}} = conn, %{"domain" => domain}) do
	User.unblock_domain(blocker, domain)
	json(conn, %{})
	end

	def subscribe(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %User{} = subscription_target <- User.get_cached_by_id(id),
	{:ok, subscription_target} = User.subscribe(user, subscription_target) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: user, target: subscription_target})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def unsubscribe(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	with %User{} = subscription_target <- User.get_cached_by_id(id),
	{:ok, subscription_target} = User.unsubscribe(user, subscription_target) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: user, target: subscription_target})
	else
	{:error, message} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end

	def favourites(%{assigns: %{user: user}} = conn, params) do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("favorited_by", user.ap_id)
	\|> Map.put("blocking_user", user)

	activities =
	ActivityPub.fetch_activities([], params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:favourites, activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def user_favourites(%{assigns: %{user: for_user}} = conn, %{"id" => id} = params) do
	with %User{} = user <- User.get_by_id(id),
	false <- user.info.hide_favorites do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("favorited_by", user.ap_id)
	\|> Map.put("blocking_user", for_user)

	recipients =
	if for_user do
	[Pleroma.Constants.as_public()] ++ [for_user.ap_id \| for_user.following]
	else
	[Pleroma.Constants.as_public()]
	end

	activities =
	recipients
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(:favourites, activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: for_user, as: :activity})
	else
	nil -> {:error, :not_found}
	true -> render_error(conn, :forbidden, "Can't get favorites")
	end
	end

	def bookmarks(%{assigns: %{user: user}} = conn, params) do
	user = User.get_cached_by_id(user.id)

	bookmarks =
	Bookmark.for_user_query(user.id)
	\|> Pagination.fetch_paginated(params)

	activities =
	bookmarks
	\|> Enum.map(fn b -> Map.put(b.activity, :bookmark, Map.delete(b, :activity)) end)

	conn
	\|> add_link_headers(:bookmarks, bookmarks)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end

	def account_lists(%{assigns: %{user: user}} = conn, %{"id" => account_id}) do
	lists = Pleroma.List.get_lists_account_belongs(user, account_id)
	res = ListView.render("lists.json", lists: lists)
	json(conn, res)
	end

	def list_timeline(%{assigns: %{user: user}} = conn, %{"list_id" => id} = params) do
	with %Pleroma.List{title: _title, following: following} <- Pleroma.List.get(id, user) do
	params =
	params
	\|> Map.put("type", "Create")
	\|> Map.put("blocking_user", user)
	\|> Map.put("user", user)
	\|> Map.put("muting_user", user)

	# we must filter the following list for the user to avoid leaking statuses the user
	# does not actually have permission to see (for more info, peruse security issue #270).
	activities =
	following
	\|> Enum.filter(fn x -> x in user.following end)
	\|> ActivityPub.fetch_activities_bounded(following, params)
	\|> Enum.reverse()

	conn
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	else
	_e -> render_error(conn, :forbidden, "Error.")
	end
	end

	def index(%{assigns: %{user: user}} = conn, _params) do
	token = get_session(conn, :oauth_token)

	if user && token do
	mastodon_emoji = mastodonized_emoji()

	limit = Config.get([:instance, :limit])

	accounts =
	Map.put(%{}, user.id, AccountView.render("account.json", %{user: user, for: user}))

	initial_state =
	%{
	meta: %{
	streaming_api_base_url: Pleroma.Web.Endpoint.websocket_url(),
	access_token: token,
	locale: "en",
	domain: Pleroma.Web.Endpoint.host(),
	admin: "1",
	me: "#{user.id}",
	unfollow_modal: false,
	boost_modal: false,
	delete_modal: true,
	auto_play_gif: false,
	display_sensitive_media: false,
	reduce_motion: false,
	max_toot_chars: limit,
	mascot: User.get_mascot(user)["url"]
	},
	poll_limits: Config.get([:instance, :poll_limits]),
	rights: %{
	delete_others_notice: present?(user.info.is_moderator),
	admin: present?(user.info.is_admin)
	},
	compose: %{
	me: "#{user.id}",
	default_privacy: user.info.default_scope,
	default_sensitive: false,
	allow_content_types: Config.get([:instance, :allowed_post_formats])
	},
	media_attachments: %{
	accept_content_types: [
	".jpg",
	".jpeg",
	".png",
	".gif",
	".webm",
	".mp4",
	".m4v",
	"image\/jpeg",
	"image\/png",
	"image\/gif",
	"video\/webm",
	"video\/mp4"
	]
	},
	settings:
	user.info.settings \|\|
	%{
	onboarded: true,
	home: %{
	shows: %{
	reblog: true,
	reply: true
	}
	},
	notifications: %{
	alerts: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	},
	shows: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	},
	sounds: %{
	follow: true,
	favourite: true,
	reblog: true,
	mention: true
	}
	}
	},
	push_subscription: nil,
	accounts: accounts,
	custom_emojis: mastodon_emoji,
	char_limit: limit
	}
	\|> Jason.encode!()

	conn
	\|> put_layout(false)
	\|> put_view(MastodonView)
	\|> render("index.html", %{initial_state: initial_state})
	else
	conn
	\|> put_session(:return_to, conn.request_path)
	\|> redirect(to: "/web/login")
	end
	end

	def put_settings(%{assigns: %{user: user}} = conn, %{"data" => settings} = _params) do
	info_cng = User.Info.mastodon_settings_update(user.info, settings)

	with changeset <- Changeset.change(user),
	changeset <- Changeset.put_embed(changeset, :info, info_cng),
	{:ok, _user} <- User.update_and_set_cache(changeset) do
	json(conn, %{})
	else
	e ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: inspect(e)})
	end
	end

	def login(%{assigns: %{user: %User{}}} = conn, _params) do
	redirect(conn, to: local_mastodon_root_path(conn))
	end

	@doc "Local Mastodon FE login init action"
	def login(conn, %{"code" => auth_token}) do
	with {:ok, app} <- get_or_make_app(),
	%Authorization{} = auth <- Repo.get_by(Authorization, token: auth_token, app_id: app.id),
	{:ok, token} <- Token.exchange_token(app, auth) do
	conn
	\|> put_session(:oauth_token, token.token)
	\|> redirect(to: local_mastodon_root_path(conn))
	end
	end

	@doc "Local Mastodon FE callback action"
	def login(conn, _) do
	with {:ok, app} <- get_or_make_app() do
	path =
	o_auth_path(
	conn,
	:authorize,
	response_type: "code",
	client_id: app.client_id,
	redirect_uri: ".",
	scope: Enum.join(app.scopes, " ")
	)

	redirect(conn, to: path)
	end
	end

	defp local_mastodon_root_path(conn) do
	case get_session(conn, :return_to) do
	nil ->
	mastodon_api_path(conn, :index, ["getting-started"])

	return_to ->
	delete_session(conn, :return_to)
	return_to
	end
	end

	defp get_or_make_app do
	find_attrs = %{client_name: @local_mastodon_name, redirect_uris: "."}
	scopes = ["read", "write", "follow", "push"]

	with %App{} = app <- Repo.get_by(App, find_attrs) do
	{:ok, app} =
	if app.scopes == scopes do
	{:ok, app}
	else
	app
	\|> Changeset.change(%{scopes: scopes})
	\|> Repo.update()
	end

	{:ok, app}
	else
	_e ->
	cs =
	App.register_changeset(
	%App{},
	Map.put(find_attrs, :scopes, scopes)
	)

	Repo.insert(cs)
	end
	end

	def logout(conn, _) do
	conn
	\|> clear_session
	\|> redirect(to: "/")
	end

	def relationship_noop(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	Logger.debug("Unimplemented, returning unmodified relationship")

	with %User{} = target <- User.get_cached_by_id(id) do
	conn
	\|> put_view(AccountView)
	\|> render("relationship.json", %{user: user, target: target})
	end
	end

	def empty_array(conn, _) do
	Logger.debug("Unimplemented, returning an empty array")
	json(conn, [])
	end

	def empty_object(conn, _) do
	Logger.debug("Unimplemented, returning an empty object")
	json(conn, %{})
	end

	+ def endorsements(conn, params), do: empty_array(conn, params)
	+
	def get_filters(%{assigns: %{user: user}} = conn, _) do
	filters = Filter.get_filters(user)
	res = FilterView.render("filters.json", filters: filters)
	json(conn, res)
	end

	def create_filter(
	%{assigns: %{user: user}} = conn,
	%{"phrase" => phrase, "context" => context} = params
	) do
	query = %Filter{
	user_id: user.id,
	phrase: phrase,
	context: context,
	hide: Map.get(params, "irreversible", false),
	whole_word: Map.get(params, "boolean", true)
	# expires_at
	}

	{:ok, response} = Filter.create(query)
	res = FilterView.render("filter.json", filter: response)
	json(conn, res)
	end

	def get_filter(%{assigns: %{user: user}} = conn, %{"id" => filter_id}) do
	filter = Filter.get(filter_id, user)
	res = FilterView.render("filter.json", filter: filter)
	json(conn, res)
	end

	def update_filter(
	%{assigns: %{user: user}} = conn,
	%{"phrase" => phrase, "context" => context, "id" => filter_id} = params
	) do
	query = %Filter{
	user_id: user.id,
	filter_id: filter_id,
	phrase: phrase,
	context: context,
	hide: Map.get(params, "irreversible", nil),
	whole_word: Map.get(params, "boolean", true)
	# expires_at
	}

	{:ok, response} = Filter.update(query)
	res = FilterView.render("filter.json", filter: response)
	json(conn, res)
	end

	def delete_filter(%{assigns: %{user: user}} = conn, %{"id" => filter_id}) do
	query = %Filter{
	user_id: user.id,
	filter_id: filter_id
	}

	{:ok, _} = Filter.delete(query)
	json(conn, %{})
	end

	def suggestions(%{assigns: %{user: user}} = conn, _) do
	suggestions = Config.get(:suggestions)

	if Keyword.get(suggestions, :enabled, false) do
	api = Keyword.get(suggestions, :third_party_engine, "")
	timeout = Keyword.get(suggestions, :timeout, 5000)
	limit = Keyword.get(suggestions, :limit, 23)

	host = Config.get([Pleroma.Web.Endpoint, :url, :host])

	user = user.nickname

	url =
	api
	\|> String.replace("{{host}}", host)
	\|> String.replace("{{user}}", user)

	with {:ok, %{status: 200, body: body}} <-
	HTTP.get(url, [], adapter: [recv_timeout: timeout, pool: :default]),
	{:ok, data} <- Jason.decode(body) do
	data =
	data
	\|> Enum.slice(0, limit)
	\|> Enum.map(fn x ->
	x
	\|> Map.put("id", fetch_suggestion_id(x))
	\|> Map.put("avatar", MediaProxy.url(x["avatar"]))
	\|> Map.put("avatar_static", MediaProxy.url(x["avatar_static"]))
	end)

	json(conn, data)
	else
	e ->
	Logger.error("Could not retrieve suggestions at fetch #{url}, #{inspect(e)}")
	end
	else
	json(conn, [])
	end
	end

	defp fetch_suggestion_id(attrs) do
	case User.get_or_fetch(attrs["acct"]) do
	{:ok, %User{id: id}} -> id
	_ -> 0
	end
	end

	def status_card(%{assigns: %{user: user}} = conn, %{"id" => status_id}) do
	with %Activity{} = activity <- Activity.get_by_id(status_id),
	true <- Visibility.visible_for_user?(activity, user) do
	data =
	StatusView.render(
	"card.json",
	Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
	)

	json(conn, data)
	else
	_e ->
	%{}
	end
	end

	- def reports(%{assigns: %{user: user}} = conn, params) do
	+ def create_report(%{assigns: %{user: user}} = conn, params) do
	case CommonAPI.report(user, params) do
	{:ok, activity} ->
	conn
	\|> put_view(ReportView)
	\|> try_render("report.json", %{activity: activity})

	{:error, err} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: err})
	end
	end

	def account_register(
	%{assigns: %{app: app}} = conn,
	%{"username" => nickname, "email" => _, "password" => _, "agreement" => true} = params
	) do
	params =
	params
	\|> Map.take([
	"email",
	"captcha_solution",
	"captcha_token",
	"captcha_answer_data",
	"token",
	"password"
	])
	\|> Map.put("nickname", nickname)
	\|> Map.put("fullname", params["fullname"] \|\| nickname)
	\|> Map.put("bio", params["bio"] \|\| "")
	\|> Map.put("confirm", params["password"])

	with {:ok, user} <- TwitterAPI.register_user(params, need_confirmation: true),
	{:ok, token} <- Token.create_token(app, user, %{scopes: app.scopes}) do
	json(conn, %{
	token_type: "Bearer",
	access_token: token.token,
	scope: app.scopes,
	created_at: Token.Utils.format_created_at(token)
	})
	else
	{:error, errors} ->
	conn
	\|> put_status(:bad_request)
	\|> json(errors)
	end
	end

	def account_register(%{assigns: %{app: _app}} = conn, _params) do
	render_error(conn, :bad_request, "Missing parameters")
	end

	def account_register(conn, _) do
	render_error(conn, :forbidden, "Invalid credentials")
	end

	def conversations(%{assigns: %{user: user}} = conn, params) do
	participations = Participation.for_user_with_last_activity_id(user, params)

	conversations =
	Enum.map(participations, fn participation ->
	ConversationView.render("participation.json", %{participation: participation, for: user})
	end)

	conn
	\|> add_link_headers(:conversations, participations)
	\|> json(conversations)
	end

	def conversation_read(%{assigns: %{user: user}} = conn, %{"id" => participation_id}) do
	with %Participation{} = participation <-
	Repo.get_by(Participation, id: participation_id, user_id: user.id),
	{:ok, participation} <- Participation.mark_as_read(participation) do
	participation_view =
	ConversationView.render("participation.json", %{participation: participation, for: user})

	conn
	\|> json(participation_view)
	end
	end

	def password_reset(conn, params) do
	nickname_or_email = params["email"] \|\| params["nickname"]

	with {:ok, _} <- TwitterAPI.password_reset(nickname_or_email) do
	conn
	\|> put_status(:no_content)
	\|> json("")
	else
	{:error, "unknown user"} ->
	send_resp(conn, :not_found, "")

	{:error, _} ->
	send_resp(conn, :bad_request, "")
	end
	end

	def account_confirmation_resend(conn, params) do
	nickname_or_email = params["email"] \|\| params["nickname"]

	with %User{} = user <- User.get_by_nickname_or_email(nickname_or_email),
	{:ok, _} <- User.try_send_confirmation_email(user) do
	conn
	\|> json_response(:no_content, "")
	end
	end

	def try_render(conn, target, params)
	when is_binary(target) do
	case render(conn, target, params) do
	nil -> render_error(conn, :not_implemented, "Can't display this activity")
	res -> res
	end
	end

	def try_render(conn, _, _) do
	render_error(conn, :not_implemented, "Can't display this activity")
	end

	defp present?(nil), do: false
	defp present?(false), do: false
	defp present?(_), do: true
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/search_controller.ex b/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
	index 9072aa7a4..f49ca89ed 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
	@@ -1,120 +1,125 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.SearchController do
	use Pleroma.Web, :controller

	alias Pleroma.Activity
	+ alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.Plugs.RateLimiter
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web
	alias Pleroma.Web.ControllerHelper
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.StatusView

	require Logger
	+
	+ # Note: Mastodon doesn't allow unauthenticated access (requires read:accounts / read:search)
	+ plug(OAuthScopesPlug, %{scopes: ["read:search"], fallback: :proceed_unauthenticated})
	+
	plug(RateLimiter, :search when action in [:search, :search2, :account_search])

	def account_search(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
	accounts = User.search(query, search_options(params, user))
	res = AccountView.render("accounts.json", users: accounts, for: user, as: :user)

	json(conn, res)
	end

	def search2(conn, params), do: do_search(:v2, conn, params)
	def search(conn, params), do: do_search(:v1, conn, params)

	defp do_search(version, %{assigns: %{user: user}} = conn, %{"q" => query} = params) do
	options = search_options(params, user)
	timeout = Keyword.get(Repo.config(), :timeout, 15_000)
	default_values = %{"statuses" => [], "accounts" => [], "hashtags" => []}

	result =
	default_values
	\|> Enum.map(fn {resource, default_value} ->
	if params["type"] == nil or params["type"] == resource do
	{resource, fn -> resource_search(version, resource, query, options) end}
	else
	{resource, fn -> default_value end}
	end
	end)
	\|> Task.async_stream(fn {resource, f} -> {resource, with_fallback(f)} end,
	timeout: timeout,
	on_timeout: :kill_task
	)
	\|> Enum.reduce(default_values, fn
	{:ok, {resource, result}}, acc ->
	Map.put(acc, resource, result)

	_error, acc ->
	acc
	end)

	json(conn, result)
	end

	defp search_options(params, user) do
	[
	resolve: params["resolve"] == "true",
	following: params["following"] == "true",
	limit: ControllerHelper.fetch_integer_param(params, "limit"),
	offset: ControllerHelper.fetch_integer_param(params, "offset"),
	type: params["type"],
	author: get_author(params),
	for_user: user
	]
	\|> Enum.filter(&elem(&1, 1))
	end

	defp resource_search(_, "accounts", query, options) do
	accounts = with_fallback(fn -> User.search(query, options) end)
	AccountView.render("accounts.json", users: accounts, for: options[:for_user], as: :user)
	end

	defp resource_search(_, "statuses", query, options) do
	statuses = with_fallback(fn -> Activity.search(options[:for_user], query, options) end)
	StatusView.render("index.json", activities: statuses, for: options[:for_user], as: :activity)
	end

	defp resource_search(:v2, "hashtags", query, _options) do
	tags_path = Web.base_url() <> "/tag/"

	query
	\|> prepare_tags()
	\|> Enum.map(fn tag ->
	tag = String.trim_leading(tag, "#")
	%{name: tag, url: tags_path <> tag}
	end)
	end

	defp resource_search(:v1, "hashtags", query, _options) do
	query
	\|> prepare_tags()
	\|> Enum.map(fn tag -> String.trim_leading(tag, "#") end)
	end

	defp prepare_tags(query) do
	query
	\|> String.split()
	\|> Enum.uniq()
	\|> Enum.filter(fn tag -> String.starts_with?(tag, "#") end)
	end

	defp with_fallback(f, fallback \\ []) do
	try do
	f.()
	rescue
	error ->
	Logger.error("#{__MODULE__} search error: #{inspect(error)}")
	fallback
	end
	end

	defp get_author(%{"account_id" => account_id}) when is_binary(account_id),
	do: User.get_cached_by_id(account_id)

	defp get_author(_params), do: nil
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/subscription_controller.ex b/lib/pleroma/web/mastodon_api/controllers/subscription_controller.ex
	index e2b17aab1..287eebf92 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/subscription_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/subscription_controller.ex
	@@ -1,69 +1,71 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.SubscriptionController do
	@moduledoc "The module represents functions to manage user subscriptions."
	use Pleroma.Web, :controller

	alias Pleroma.Web.Push
	alias Pleroma.Web.Push.Subscription
	alias Pleroma.Web.MastodonAPI.PushSubscriptionView, as: View

	action_fallback(:errors)

	+ plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["push"]})
	+
	# Creates PushSubscription
	# POST /api/v1/push/subscription
	#
	def create(%{assigns: %{user: user, token: token}} = conn, params) do
	with true <- Push.enabled(),
	{:ok, _} <- Subscription.delete_if_exists(user, token),
	{:ok, subscription} <- Subscription.create(user, token, params) do
	view = View.render("push_subscription.json", subscription: subscription)
	json(conn, view)
	end
	end

	# Gets PushSubscription
	# GET /api/v1/push/subscription
	#
	def get(%{assigns: %{user: user, token: token}} = conn, _params) do
	with true <- Push.enabled(),
	{:ok, subscription} <- Subscription.get(user, token) do
	view = View.render("push_subscription.json", subscription: subscription)
	json(conn, view)
	end
	end

	# Updates PushSubscription
	# PUT /api/v1/push/subscription
	#
	def update(%{assigns: %{user: user, token: token}} = conn, params) do
	with true <- Push.enabled(),
	{:ok, subscription} <- Subscription.update(user, token, params) do
	view = View.render("push_subscription.json", subscription: subscription)
	json(conn, view)
	end
	end

	# Deletes PushSubscription
	# DELETE /api/v1/push/subscription
	#
	def delete(%{assigns: %{user: user, token: token}} = conn, _params) do
	with true <- Push.enabled(),
	{:ok, _response} <- Subscription.delete(user, token),
	do: json(conn, %{})
	end

	# fallback action
	#
	def errors(conn, {:error, :not_found}) do
	conn
	\|> put_status(:not_found)
	\|> json(dgettext("errors", "Not found"))
	end

	def errors(conn, _) do
	Pleroma.Web.MastodonAPI.FallbackController.call(conn, nil)
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/pleroma_api_controller.ex b/lib/pleroma/web/pleroma_api/pleroma_api_controller.ex
	index f4df3b024..17c568a9d 100644
	--- a/lib/pleroma/web/pleroma_api/pleroma_api_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/pleroma_api_controller.ex
	@@ -1,98 +1,111 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.PleromaAPIController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [add_link_headers: 7]

	alias Pleroma.Conversation.Participation
	alias Pleroma.Notification
	+ alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.MastodonAPI.ConversationView
	alias Pleroma.Web.MastodonAPI.NotificationView
	alias Pleroma.Web.MastodonAPI.StatusView

	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["read:statuses"]} when action in [:conversation, :conversation_statuses]
	+ )
	+
	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:conversations"]} when action in [:conversations, :conversation_read]
	+ )
	+
	+ plug(OAuthScopesPlug, %{scopes: ["write:notifications"]} when action == :read_notification)
	+
	def conversation(%{assigns: %{user: user}} = conn, %{"id" => participation_id}) do
	with %Participation{} = participation <- Participation.get(participation_id),
	true <- user.id == participation.user_id do
	conn
	\|> put_view(ConversationView)
	\|> render("participation.json", %{participation: participation, for: user})
	end
	end

	def conversation_statuses(
	%{assigns: %{user: user}} = conn,
	%{"id" => participation_id} = params
	) do
	params =
	params
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("user", user)

	participation =
	participation_id
	\|> Participation.get(preload: [:conversation])

	if user.id == participation.user_id do
	activities =
	participation.conversation.ap_id
	\|> ActivityPub.fetch_activities_for_context(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(
	:conversation_statuses,
	activities,
	participation_id,
	params,
	nil,
	&pleroma_api_url/4
	)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	end
	end

	def update_conversation(
	%{assigns: %{user: user}} = conn,
	%{"id" => participation_id, "recipients" => recipients}
	) do
	participation =
	participation_id
	\|> Participation.get()

	with true <- user.id == participation.user_id,
	{:ok, participation} <- Participation.set_recipients(participation, recipients) do
	conn
	\|> put_view(ConversationView)
	\|> render("participation.json", %{participation: participation, for: user})
	end
	end

	def read_notification(%{assigns: %{user: user}} = conn, %{"id" => notification_id}) do
	with {:ok, notification} <- Notification.read_one(user, notification_id) do
	conn
	\|> put_view(NotificationView)
	\|> render("show.json", %{notification: notification, for: user})
	else
	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{"error" => message})
	end
	end

	def read_notification(%{assigns: %{user: user}} = conn, %{"max_id" => max_id}) do
	with notifications <- Notification.set_read_up_to(user, max_id) do
	notifications = Enum.take(notifications, 80)

	conn
	\|> put_view(NotificationView)
	\|> render("index.json", %{notifications: notifications, for: user})
	end
	end
	end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 8c93e535e..593da01fd 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,652 +1,591 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router

	pipeline :browser do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	end

	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	end

	pipeline :api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :authenticated_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :admin_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.AdminSecretAuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.UserIsAdminPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :mastodon_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :pleroma_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	- pipeline :oauth_read_or_public do
	- plug(Pleroma.Plugs.OAuthScopesPlug, %{
	- scopes: ["read"],
	- fallback: :proceed_unauthenticated
	- })
	-
	- plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)
	- end
	-
	- pipeline :oauth_read do
	- plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["read"]})
	- end
	-
	- pipeline :oauth_write do
	- plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["write"]})
	- end
	-
	- pipeline :oauth_push do
	- plug(Pleroma.Plugs.OAuthScopesPlug, %{scopes: ["push"]})
	- end
	-
	pipeline :well_known do
	plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	pipeline :http_signature do
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", PasswordController, :reset, as: :reset_password)
	post("/password_reset", PasswordController, :do_reset, as: :reset_password)
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	get("/healthcheck", UtilController, :healthcheck)
	end

	scope "/api/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	scope "/api/pleroma/admin", Pleroma.Web.AdminAPI do
	- pipe_through([:admin_api, :oauth_write])
	+ pipe_through(:admin_api)
	+
	+ get("/reports", AdminAPIController, :list_reports)
	+ get("/reports/:id", AdminAPIController, :report_show)
	+ put("/reports/:id", AdminAPIController, :report_update_state)
	+ post("/reports/:id/respond", AdminAPIController, :report_respond)

	post("/users/follow", AdminAPIController, :user_follow)
	post("/users/unfollow", AdminAPIController, :user_unfollow)

	delete("/users", AdminAPIController, :user_delete)
	post("/users", AdminAPIController, :users_create)
	patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)

	get("/users/:nickname/permission_group", AdminAPIController, :right_get)
	get("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_get)
	post("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_add)

	delete(
	"/users/:nickname/permission_group/:permission_group",
	AdminAPIController,
	:right_delete
	)

	put("/users/:nickname/activation_status", AdminAPIController, :set_activation_status)

	post("/relay", AdminAPIController, :relay_follow)
	delete("/relay", AdminAPIController, :relay_unfollow)

	get("/users/invite_token", AdminAPIController, :get_invite_token)
	get("/users/invites", AdminAPIController, :invites)
	post("/users/revoke_invite", AdminAPIController, :revoke_invite)
	post("/users/email_invite", AdminAPIController, :email_invite)

	get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)

	get("/users", AdminAPIController, :list_users)
	get("/users/:nickname", AdminAPIController, :user_show)
	- get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)
	-
	- get("/reports", AdminAPIController, :list_reports)
	- get("/reports/:id", AdminAPIController, :report_show)
	- put("/reports/:id", AdminAPIController, :report_update_state)
	- post("/reports/:id/respond", AdminAPIController, :report_respond)
	-
	- put("/statuses/:id", AdminAPIController, :status_update)
	- delete("/statuses/:id", AdminAPIController, :status_delete)

	get("/config", AdminAPIController, :config_show)
	post("/config", AdminAPIController, :config_update)
	get("/config/migrate_to_db", AdminAPIController, :migrate_to_db)
	get("/config/migrate_from_db", AdminAPIController, :migrate_from_db)

	get("/moderation_log", AdminAPIController, :list_log)
	+
	+ get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)
	+ put("/statuses/:id", AdminAPIController, :status_update)
	+ delete("/statuses/:id", AdminAPIController, :status_delete)
	end

	scope "/", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_html)

	post("/main/ostatus", UtilController, :remote_subscribe)
	get("/ostatus_subscribe", UtilController, :remote_follow)
	post("/ostatus_subscribe", UtilController, :do_remote_follow)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:authenticated_api)

	- scope [] do
	- pipe_through(:oauth_write)
	+ post("/change_password", UtilController, :change_password)
	+ post("/delete_account", UtilController, :delete_account)
	+ put("/notification_settings", UtilController, :update_notificaton_settings)
	+ post("/disable_account", UtilController, :disable_account)

	- post("/change_password", UtilController, :change_password)
	- post("/delete_account", UtilController, :delete_account)
	- put("/notification_settings", UtilController, :update_notificaton_settings)
	- post("/disable_account", UtilController, :disable_account)
	- end
	-
	- scope [] do
	- post("/blocks_import", UtilController, :blocks_import)
	- post("/follow_import", UtilController, :follow_import)
	- end
	+ post("/blocks_import", UtilController, :blocks_import)
	+ post("/follow_import", UtilController, :follow_import)
	end

	scope "/oauth", Pleroma.Web.OAuth do
	scope [] do
	pipe_through(:oauth)
	get("/authorize", OAuthController, :authorize)
	end

	post("/authorize", OAuthController, :create_authorization)
	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	get("/registration_details", OAuthController, :registration_details)

	scope [] do
	pipe_through(:browser)

	get("/prepare_request", OAuthController, :prepare_request)
	get("/:provider", OAuthController, :request)
	get("/:provider/callback", OAuthController, :callback)
	post("/register", OAuthController, :register)
	end
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:authenticated_api)

	- scope [] do
	- pipe_through(:oauth_read)
	- get("/conversations/:id/statuses", PleromaAPIController, :conversation_statuses)
	- get("/conversations/:id", PleromaAPIController, :conversation)
	- end
	-
	- scope [] do
	- pipe_through(:oauth_write)
	- patch("/conversations/:id", PleromaAPIController, :update_conversation)
	- post("/notifications/read", PleromaAPIController, :read_notification)
	- end
	+ get("/conversations/:id/statuses", PleromaAPIController, :conversation_statuses)
	+ get("/conversations/:id", PleromaAPIController, :conversation)
	+ patch("/conversations/:id", PleromaAPIController, :update_conversation)
	+ post("/notifications/read", PleromaAPIController, :read_notification)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	- scope [] do
	- pipe_through(:oauth_read)
	-
	- get("/accounts/verify_credentials", MastodonAPIController, :verify_credentials)
	-
	- get("/accounts/relationships", MastodonAPIController, :relationships)
	+ get("/blocks", MastodonAPIController, :blocks)
	+ get("/mutes", MastodonAPIController, :mutes)
	+ get("/domain_blocks", MastodonAPIController, :domain_blocks)

	- get("/accounts/:id/lists", MastodonAPIController, :account_lists)
	- get("/accounts/:id/identity_proofs", MastodonAPIController, :empty_array)
	+ get("/accounts/:id/lists", MastodonAPIController, :account_lists)
	+ get("/lists", ListController, :index)
	+ get("/lists/:id", ListController, :show)
	+ get("/lists/:id/accounts", ListController, :list_accounts)

	- get("/follow_requests", MastodonAPIController, :follow_requests)
	- get("/blocks", MastodonAPIController, :blocks)
	- get("/mutes", MastodonAPIController, :mutes)
	+ post("/notifications/clear", MastodonAPIController, :clear_notifications)
	+ post("/notifications/dismiss", MastodonAPIController, :dismiss_notification)
	+ get("/notifications", MastodonAPIController, :notifications)
	+ get("/notifications/:id", MastodonAPIController, :get_notification)

	- get("/timelines/home", MastodonAPIController, :home_timeline)
	- get("/timelines/direct", MastodonAPIController, :dm_timeline)
	+ delete(
	+ "/notifications/destroy_multiple",
	+ MastodonAPIController,
	+ :destroy_multiple_notifications
	+ )

	- get("/favourites", MastodonAPIController, :favourites)
	- get("/bookmarks", MastodonAPIController, :bookmarks)
	+ # Note: not present in Mastodon
	+ get("/bookmarks", MastodonAPIController, :bookmarks)

	- post("/notifications/clear", MastodonAPIController, :clear_notifications)
	- post("/notifications/dismiss", MastodonAPIController, :dismiss_notification)
	- get("/notifications", MastodonAPIController, :notifications)
	- get("/notifications/:id", MastodonAPIController, :get_notification)
	- delete("/notifications/destroy_multiple", MastodonAPIController, :destroy_multiple)
	+ get("/accounts/:id/identity_proofs", MastodonAPIController, :empty_array)

	- get("/scheduled_statuses", MastodonAPIController, :scheduled_statuses)
	- get("/scheduled_statuses/:id", MastodonAPIController, :show_scheduled_status)
	+ get("/favourites", MastodonAPIController, :favourites)

	- get("/lists", ListController, :index)
	- get("/lists/:id", ListController, :show)
	- get("/lists/:id/accounts", ListController, :list_accounts)
	+ get("/accounts/relationships", MastodonAPIController, :relationships)

	- get("/domain_blocks", MastodonAPIController, :domain_blocks)
	+ get("/accounts/verify_credentials", MastodonAPIController, :verify_credentials)

	- get("/filters", MastodonAPIController, :get_filters)
	+ get("/timelines/home", MastodonAPIController, :home_timeline)
	+ get("/timelines/direct", MastodonAPIController, :dm_timeline)

	- get("/suggestions", MastodonAPIController, :suggestions)
	+ get("/suggestions", MastodonAPIController, :suggestions)
	+ get("/scheduled_statuses", MastodonAPIController, :scheduled_statuses)
	+ get("/scheduled_statuses/:id", MastodonAPIController, :show_scheduled_status)
	+ get("/follow_requests", MastodonAPIController, :follow_requests)
	+ get("/filters", MastodonAPIController, :get_filters)
	+ get("/endorsements", MastodonAPIController, :endorsements)
	+ get("/conversations", MastodonAPIController, :conversations)
	+ post("/conversations/:id/read", MastodonAPIController, :conversation_read)

	- get("/conversations", MastodonAPIController, :conversations)
	- post("/conversations/:id/read", MastodonAPIController, :conversation_read)
	+ delete("/lists/:id", ListController, :delete)
	+ post("/lists", ListController, :create)
	+ put("/lists/:id", ListController, :update)

	- get("/endorsements", MastodonAPIController, :empty_array)
	- end
	+ post("/lists/:id/accounts", ListController, :add_to_list)
	+ delete("/lists/:id/accounts", ListController, :remove_from_list)

	- scope [] do
	- pipe_through(:oauth_write)
	+ post("/reports", MastodonAPIController, :create_report)

	- patch("/accounts/update_credentials", MastodonAPIController, :update_credentials)
	+ patch("/pleroma/accounts/update_avatar", MastodonAPIController, :update_avatar)
	+ patch("/pleroma/accounts/update_banner", MastodonAPIController, :update_banner)
	+ patch("/pleroma/accounts/update_background", MastodonAPIController, :update_background)

	- post("/statuses", MastodonAPIController, :post_status)
	- delete("/statuses/:id", MastodonAPIController, :delete_status)
	+ get("/pleroma/mascot", MastodonAPIController, :get_mascot)
	+ put("/pleroma/mascot", MastodonAPIController, :set_mascot)

	- post("/statuses/:id/reblog", MastodonAPIController, :reblog_status)
	- post("/statuses/:id/unreblog", MastodonAPIController, :unreblog_status)
	- post("/statuses/:id/favourite", MastodonAPIController, :fav_status)
	- post("/statuses/:id/unfavourite", MastodonAPIController, :unfav_status)
	- post("/statuses/:id/pin", MastodonAPIController, :pin_status)
	- post("/statuses/:id/unpin", MastodonAPIController, :unpin_status)
	- post("/statuses/:id/bookmark", MastodonAPIController, :bookmark_status)
	- post("/statuses/:id/unbookmark", MastodonAPIController, :unbookmark_status)
	- post("/statuses/:id/mute", MastodonAPIController, :mute_conversation)
	- post("/statuses/:id/unmute", MastodonAPIController, :unmute_conversation)
	+ post("/media", MastodonAPIController, :upload)
	+ put("/media/:id", MastodonAPIController, :update_media)

	- put("/scheduled_statuses/:id", MastodonAPIController, :update_scheduled_status)
	- delete("/scheduled_statuses/:id", MastodonAPIController, :delete_scheduled_status)
	+ patch("/accounts/update_credentials", MastodonAPIController, :update_credentials)

	- post("/polls/:id/votes", MastodonAPIController, :poll_vote)
	+ post("/polls/:id/votes", MastodonAPIController, :poll_vote)

	- post("/media", MastodonAPIController, :upload)
	- put("/media/:id", MastodonAPIController, :update_media)
	+ post("/statuses/:id/reblog", MastodonAPIController, :reblog_status)
	+ post("/statuses/:id/unreblog", MastodonAPIController, :unreblog_status)

	- delete("/lists/:id", ListController, :delete)
	- post("/lists", ListController, :create)
	- put("/lists/:id", ListController, :update)
	+ post("/statuses/:id/pin", MastodonAPIController, :pin_status)
	+ post("/statuses/:id/unpin", MastodonAPIController, :unpin_status)

	- post("/lists/:id/accounts", ListController, :add_to_list)
	- delete("/lists/:id/accounts", ListController, :remove_from_list)
	+ post("/statuses/:id/mute", MastodonAPIController, :mute_conversation)
	+ post("/statuses/:id/unmute", MastodonAPIController, :unmute_conversation)

	- post("/filters", MastodonAPIController, :create_filter)
	- get("/filters/:id", MastodonAPIController, :get_filter)
	- put("/filters/:id", MastodonAPIController, :update_filter)
	- delete("/filters/:id", MastodonAPIController, :delete_filter)
	+ post("/statuses/:id/favourite", MastodonAPIController, :fav_status)
	+ post("/statuses/:id/unfavourite", MastodonAPIController, :unfav_status)

	- patch("/pleroma/accounts/update_avatar", MastodonAPIController, :update_avatar)
	- patch("/pleroma/accounts/update_banner", MastodonAPIController, :update_banner)
	- patch("/pleroma/accounts/update_background", MastodonAPIController, :update_background)
	+ post("/statuses", MastodonAPIController, :post_status)
	+ delete("/statuses/:id", MastodonAPIController, :delete_status)

	- get("/pleroma/mascot", MastodonAPIController, :get_mascot)
	- put("/pleroma/mascot", MastodonAPIController, :set_mascot)
	+ put("/scheduled_statuses/:id", MastodonAPIController, :update_scheduled_status)
	+ delete("/scheduled_statuses/:id", MastodonAPIController, :delete_scheduled_status)

	- post("/reports", MastodonAPIController, :reports)
	- end
	+ post("/filters", MastodonAPIController, :create_filter)
	+ get("/filters/:id", MastodonAPIController, :get_filter)
	+ put("/filters/:id", MastodonAPIController, :update_filter)
	+ delete("/filters/:id", MastodonAPIController, :delete_filter)

	- scope [] do
	- post("/follows", MastodonAPIController, :follow)
	- post("/accounts/:id/follow", MastodonAPIController, :follow)
	+ post("/follows", MastodonAPIController, :follow)
	+ post("/accounts/:id/follow", MastodonAPIController, :follow)

	- post("/accounts/:id/unfollow", MastodonAPIController, :unfollow)
	- post("/accounts/:id/block", MastodonAPIController, :block)
	- post("/accounts/:id/unblock", MastodonAPIController, :unblock)
	- post("/accounts/:id/mute", MastodonAPIController, :mute)
	- post("/accounts/:id/unmute", MastodonAPIController, :unmute)
	+ post("/accounts/:id/unfollow", MastodonAPIController, :unfollow)
	+ post("/accounts/:id/block", MastodonAPIController, :block)
	+ post("/accounts/:id/unblock", MastodonAPIController, :unblock)
	+ post("/accounts/:id/mute", MastodonAPIController, :mute)
	+ post("/accounts/:id/unmute", MastodonAPIController, :unmute)

	- post("/follow_requests/:id/authorize", MastodonAPIController, :authorize_follow_request)
	- post("/follow_requests/:id/reject", MastodonAPIController, :reject_follow_request)
	+ post("/follow_requests/:id/authorize", MastodonAPIController, :authorize_follow_request)
	+ post("/follow_requests/:id/reject", MastodonAPIController, :reject_follow_request)

	- post("/domain_blocks", MastodonAPIController, :block_domain)
	- delete("/domain_blocks", MastodonAPIController, :unblock_domain)
	+ post("/domain_blocks", MastodonAPIController, :block_domain)
	+ delete("/domain_blocks", MastodonAPIController, :unblock_domain)

	- post("/pleroma/accounts/:id/subscribe", MastodonAPIController, :subscribe)
	- post("/pleroma/accounts/:id/unsubscribe", MastodonAPIController, :unsubscribe)
	- end
	+ post("/pleroma/accounts/:id/subscribe", MastodonAPIController, :subscribe)
	+ post("/pleroma/accounts/:id/unsubscribe", MastodonAPIController, :unsubscribe)

	- scope [] do
	- pipe_through(:oauth_push)
	+ post("/push/subscription", SubscriptionController, :create)
	+ get("/push/subscription", SubscriptionController, :get)
	+ put("/push/subscription", SubscriptionController, :update)
	+ delete("/push/subscription", SubscriptionController, :delete)

	- post("/push/subscription", SubscriptionController, :create)
	- get("/push/subscription", SubscriptionController, :get)
	- put("/push/subscription", SubscriptionController, :update)
	- delete("/push/subscription", SubscriptionController, :delete)
	- end
	+ # Note: not present in Mastodon: bookmark, unbookmark
	+ post("/statuses/:id/bookmark", MastodonAPIController, :bookmark_status)
	+ post("/statuses/:id/unbookmark", MastodonAPIController, :unbookmark_status)
	end

	scope "/api/web", Pleroma.Web.MastodonAPI do
	- pipe_through([:authenticated_api, :oauth_write])
	+ pipe_through(:authenticated_api)

	put("/settings", MastodonAPIController, :put_settings)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	post("/accounts", MastodonAPIController, :account_register)

	get("/instance", MastodonAPIController, :masto_instance)
	get("/instance/peers", MastodonAPIController, :peers)
	post("/apps", MastodonAPIController, :create_app)
	get("/apps/verify_credentials", MastodonAPIController, :verify_app_credentials)
	get("/custom_emojis", MastodonAPIController, :custom_emojis)

	get("/statuses/:id/card", MastodonAPIController, :status_card)

	get("/statuses/:id/favourited_by", MastodonAPIController, :favourited_by)
	get("/statuses/:id/reblogged_by", MastodonAPIController, :reblogged_by)

	get("/trends", MastodonAPIController, :empty_array)

	get("/accounts/search", SearchController, :account_search)

	post(
	"/pleroma/accounts/confirmation_resend",
	MastodonAPIController,
	:account_confirmation_resend
	)

	- scope [] do
	- pipe_through(:oauth_read_or_public)
	+ get("/timelines/public", MastodonAPIController, :public_timeline)
	+ get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline)

	- get("/timelines/public", MastodonAPIController, :public_timeline)
	- get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline)
	- get("/timelines/list/:list_id", MastodonAPIController, :list_timeline)
	+ get("/pleroma/accounts/:id/favourites", MastodonAPIController, :user_favourites)

	- get("/statuses/:id", MastodonAPIController, :get_status)
	- get("/statuses/:id/context", MastodonAPIController, :get_context)
	+ get("/search", SearchController, :search)

	- get("/polls/:id", MastodonAPIController, :get_poll)
	+ get("/polls/:id", MastodonAPIController, :get_poll)

	- get("/accounts/:id/statuses", MastodonAPIController, :user_statuses)
	- get("/accounts/:id/followers", MastodonAPIController, :followers)
	- get("/accounts/:id/following", MastodonAPIController, :following)
	- get("/accounts/:id", MastodonAPIController, :user)
	+ get("/accounts/:id/followers", MastodonAPIController, :followers)
	+ get("/accounts/:id/following", MastodonAPIController, :following)

	- get("/search", SearchController, :search)
	+ get("/timelines/list/:list_id", MastodonAPIController, :list_timeline)

	- get("/pleroma/accounts/:id/favourites", MastodonAPIController, :user_favourites)
	- end
	+ get("/accounts/:id", MastodonAPIController, :user)
	+
	+ get("/accounts/:id/statuses", MastodonAPIController, :user_statuses)
	+ get("/statuses/:id", MastodonAPIController, :get_status)
	+ get("/statuses/:id/context", MastodonAPIController, :get_context)
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	- pipe_through([:api, :oauth_read_or_public])
	+ pipe_through(:api)
	get("/search", SearchController, :search2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	get("/help/test", TwitterAPI.UtilController, :help_test)
	post("/help/test", TwitterAPI.UtilController, :help_test)
	get("/statusnet/config", TwitterAPI.UtilController, :config)
	get("/statusnet/version", TwitterAPI.UtilController, :version)
	get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	get(
	"/account/confirm_email/:user_id/:token",
	TwitterAPI.Controller,
	:confirm_email,
	as: :confirm_email
	)
	end

	scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	pipe_through(:authenticated_api)

	get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)
	-
	- scope [] do
	- pipe_through(:oauth_read)
	-
	- post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read)
	- end
	+ post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read)
	end

	pipeline :ap_service_actor do
	plug(:accepts, ["activity+json", "json"])
	end

	pipeline :ostatus do
	plug(:accepts, ["html", "xml", "atom", "activity+json", "json"])
	end

	pipeline :oembed do
	plug(:accepts, ["json", "xml"])
	end

	scope "/", Pleroma.Web do
	pipe_through(:ostatus)

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)
	get("/users/:nickname/feed", OStatus.OStatusController, :feed)
	get("/users/:nickname", OStatus.OStatusController, :feed_redirect)

	post("/users/:nickname/salmon", OStatus.OStatusController, :salmon_incoming)
	post("/push/hub/:nickname", Websub.WebsubController, :websub_subscription_request)
	get("/push/subscriptions/:id", Websub.WebsubController, :websub_subscription_confirmation)
	post("/push/subscriptions/:id", Websub.WebsubController, :websub_incoming)

	get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)
	end

	pipeline :activitypub do
	plug(:accepts, ["activity+json", "json"])
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	# XXX: not really ostatus
	pipe_through(:ostatus)

	get("/users/:nickname/outbox", ActivityPubController, :outbox)
	get("/objects/:uuid/likes", ActivityPubController, :object_likes)
	end

	pipeline :activitypub_client do
	plug(:accepts, ["activity+json", "json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	- scope [] do
	- pipe_through(:oauth_read)
	- get("/api/ap/whoami", ActivityPubController, :whoami)
	- get("/users/:nickname/inbox", ActivityPubController, :read_inbox)
	- end
	-
	- scope [] do
	- pipe_through(:oauth_write)
	- post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	- end
	-
	- scope [] do
	- pipe_through(:oauth_read_or_public)
	- get("/users/:nickname/followers", ActivityPubController, :followers)
	- get("/users/:nickname/following", ActivityPubController, :following)
	- end
	+ get("/api/ap/whoami", ActivityPubController, :whoami)
	+ get("/users/:nickname/inbox", ActivityPubController, :read_inbox)
	+ post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	+ get("/users/:nickname/followers", ActivityPubController, :followers)
	+ get("/users/:nickname/following", ActivityPubController, :following)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through(:activitypub)
	+
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :relay)

	scope [] do
	pipe_through(:http_signature)
	post("/inbox", ActivityPubController, :inbox)
	end

	get("/following", ActivityPubController, :following, assigns: %{relay: true})
	get("/followers", ActivityPubController, :followers, assigns: %{relay: true})
	end

	scope "/internal/fetch", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :internal_fetch)
	post("/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web.MastodonAPI do
	pipe_through(:mastodon_html)

	get("/web/login", MastodonAPIController, :login)
	delete("/auth/sign_out", MastodonAPIController, :logout)

	post("/auth/password", MastodonAPIController, :password_reset)

	- scope [] do
	- pipe_through(:oauth_read)
	- get("/web/*path", MastodonAPIController, :index)
	- end
	+ get("/web/*path", MastodonAPIController, :index)
	end

	pipeline :remote_media do
	end

	scope "/proxy/", Pleroma.Web.MediaProxy do
	pipe_through(:remote_media)

	get("/:sig/:url", MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxyController, :remote)
	end

	if Pleroma.Config.get(:env) == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	scope "/", Pleroma.Web.MongooseIM do
	get("/user_exists", MongooseIMController, :user_exists)
	get("/check_password", MongooseIMController, :check_password)
	end

	scope "/", Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	get("/api*path", RedirectController, :api_not_implemented)
	get("/*path", RedirectController, :redirector)

	options("/*path", RedirectController, :empty)
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/controllers/util_controller.ex b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
	index 1c6ad5057..82ed0c287 100644
	--- a/lib/pleroma/web/twitter_api/controllers/util_controller.ex
	+++ b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
	@@ -1,370 +1,381 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.TwitterAPI.UtilController do
	use Pleroma.Web, :controller

	require Logger

	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Emoji
	alias Pleroma.Healthcheck
	alias Pleroma.Notification
	alias Pleroma.Plugs.AuthenticationPlug
	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.User
	alias Pleroma.Web
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.WebFinger

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]}
	when action in [:do_remote_follow, :follow_import]
	)

	plug(OAuthScopesPlug, %{scopes: ["follow", "write:blocks"]} when action == :blocks_import)

	+ plug(
	+ OAuthScopesPlug,
	+ %{scopes: ["write:accounts"]}
	+ when action in [
	+ :change_password,
	+ :delete_account,
	+ :update_notificaton_settings,
	+ :disable_account
	+ ]
	+ )
	+
	plug(Pleroma.Plugs.SetFormatPlug when action in [:config, :version])

	def help_test(conn, _params) do
	json(conn, "ok")
	end

	def remote_subscribe(conn, %{"nickname" => nick, "profile" => _}) do
	with %User{} = user <- User.get_cached_by_nickname(nick),
	avatar = User.avatar_url(user) do
	conn
	\|> render("subscribe.html", %{nickname: nick, avatar: avatar, error: false})
	else
	_e ->
	render(conn, "subscribe.html", %{
	nickname: nick,
	avatar: nil,
	error: "Could not find user"
	})
	end
	end

	def remote_subscribe(conn, %{"user" => %{"nickname" => nick, "profile" => profile}}) do
	with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	%User{ap_id: ap_id} <- User.get_cached_by_nickname(nick) do
	conn
	\|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	else
	_e ->
	render(conn, "subscribe.html", %{
	nickname: nick,
	avatar: nil,
	error: "Something went wrong."
	})
	end
	end

	def remote_follow(%{assigns: %{user: user}} = conn, %{"acct" => acct}) do
	if is_status?(acct) do
	{:ok, object} = Pleroma.Object.Fetcher.fetch_object_from_id(acct)
	%Activity{id: activity_id} = Activity.get_create_by_object_ap_id(object.data["id"])
	redirect(conn, to: "/notice/#{activity_id}")
	else
	with {:ok, followee} <- User.get_or_fetch(acct) do
	conn
	\|> render(follow_template(user), %{
	error: false,
	acct: acct,
	avatar: User.avatar_url(followee),
	name: followee.nickname,
	id: followee.id
	})
	else
	{:error, _reason} ->
	render(conn, follow_template(user), %{error: :error})
	end
	end
	end

	defp follow_template(%User{} = _user), do: "follow.html"
	defp follow_template(_), do: "follow_login.html"

	defp is_status?(acct) do
	case Pleroma.Object.Fetcher.fetch_and_contain_remote_object_from_id(acct) do
	{:ok, %{"type" => type}} when type in ["Article", "Note", "Video", "Page", "Question"] ->
	true

	_ ->
	false
	end
	end

	def do_remote_follow(conn, %{
	"authorization" => %{"name" => username, "password" => password, "id" => id}
	}) do
	with %User{} = followee <- User.get_cached_by_id(id),
	{_, %User{} = user, _} <- {:auth, User.get_cached_by_nickname(username), followee},
	{_, true, _} <- {
	:auth,
	AuthenticationPlug.checkpw(password, user.password_hash),
	followee
	},
	{:ok, _follower, _followee, _activity} <- CommonAPI.follow(user, followee) do
	conn
	\|> render("followed.html", %{error: false})
	else
	# Was already following user
	{:error, "Could not follow user:" <> _rest} ->
	render(conn, "followed.html", %{error: "Error following account"})

	{:auth, _, followee} ->
	conn
	\|> render("follow_login.html", %{
	error: "Wrong username or password",
	id: id,
	name: followee.nickname,
	avatar: User.avatar_url(followee)
	})

	e ->
	Logger.debug("Remote follow failed with error #{inspect(e)}")
	render(conn, "followed.html", %{error: "Something went wrong."})
	end
	end

	def do_remote_follow(%{assigns: %{user: user}} = conn, %{"user" => %{"id" => id}}) do
	with {:fetch_user, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
	{:ok, _follower, _followee, _activity} <- CommonAPI.follow(user, followee) do
	conn
	\|> render("followed.html", %{error: false})
	else
	# Was already following user
	{:error, "Could not follow user:" <> _rest} ->
	render(conn, "followed.html", %{error: "Error following account"})

	{:fetch_user, error} ->
	Logger.debug("Remote follow failed with error #{inspect(error)}")
	render(conn, "followed.html", %{error: "Could not find user"})

	e ->
	Logger.debug("Remote follow failed with error #{inspect(e)}")
	render(conn, "followed.html", %{error: "Something went wrong."})
	end
	end

	def notifications_read(%{assigns: %{user: user}} = conn, %{"id" => notification_id}) do
	with {:ok, _} <- Notification.read_one(user, notification_id) do
	json(conn, %{status: "success"})
	else
	{:error, message} ->
	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(403, Jason.encode!(%{"error" => message}))
	end
	end

	def config(%{assigns: %{format: "xml"}} = conn, _params) do
	instance = Pleroma.Config.get(:instance)

	response = """
	<config>
	<site>
	<name>#{Keyword.get(instance, :name)}</name>
	<site>#{Web.base_url()}</site>
	<textlimit>#{Keyword.get(instance, :limit)}</textlimit>
	<closed>#{!Keyword.get(instance, :registrations_open)}</closed>
	</site>
	</config>
	"""

	conn
	\|> put_resp_content_type("application/xml")
	\|> send_resp(200, response)
	end

	def config(conn, _params) do
	instance = Pleroma.Config.get(:instance)

	vapid_public_key = Keyword.get(Pleroma.Web.Push.vapid_config(), :public_key)

	uploadlimit = %{
	uploadlimit: to_string(Keyword.get(instance, :upload_limit)),
	avatarlimit: to_string(Keyword.get(instance, :avatar_upload_limit)),
	backgroundlimit: to_string(Keyword.get(instance, :background_upload_limit)),
	bannerlimit: to_string(Keyword.get(instance, :banner_upload_limit))
	}

	data = %{
	name: Keyword.get(instance, :name),
	description: Keyword.get(instance, :description),
	server: Web.base_url(),
	textlimit: to_string(Keyword.get(instance, :limit)),
	uploadlimit: uploadlimit,
	closed: bool_to_val(Keyword.get(instance, :registrations_open), "0", "1"),
	private: bool_to_val(Keyword.get(instance, :public, true), "0", "1"),
	vapidPublicKey: vapid_public_key,
	accountActivationRequired:
	bool_to_val(Keyword.get(instance, :account_activation_required, false)),
	invitesEnabled: bool_to_val(Keyword.get(instance, :invites_enabled, false)),
	safeDMMentionsEnabled: bool_to_val(Pleroma.Config.get([:instance, :safe_dm_mentions]))
	}

	managed_config = Keyword.get(instance, :managed_config)

	data =
	if managed_config do
	pleroma_fe = Pleroma.Config.get([:frontend_configurations, :pleroma_fe])
	Map.put(data, "pleromafe", pleroma_fe)
	else
	data
	end

	json(conn, %{site: data})
	end

	defp bool_to_val(true), do: "1"
	defp bool_to_val(_), do: "0"
	defp bool_to_val(true, val, _), do: val
	defp bool_to_val(_, _, val), do: val

	def frontend_configurations(conn, _params) do
	config =
	Pleroma.Config.get(:frontend_configurations, %{})
	\|> Enum.into(%{})

	json(conn, config)
	end

	def version(%{assigns: %{format: "xml"}} = conn, _params) do
	version = Pleroma.Application.named_version()

	conn
	\|> put_resp_content_type("application/xml")
	\|> send_resp(200, "<version>#{version}</version>")
	end

	def version(conn, _params) do
	json(conn, Pleroma.Application.named_version())
	end

	def emoji(conn, _params) do
	emoji =
	Emoji.get_all()
	\|> Enum.map(fn {short_code, path, tags} ->
	{short_code, %{image_url: path, tags: tags}}
	end)
	\|> Enum.into(%{})

	json(conn, emoji)
	end

	def update_notificaton_settings(%{assigns: %{user: user}} = conn, params) do
	with {:ok, _} <- User.update_notification_settings(user, params) do
	json(conn, %{status: "success"})
	end
	end

	def follow_import(conn, %{"list" => %Plug.Upload{} = listfile}) do
	follow_import(conn, %{"list" => File.read!(listfile.path)})
	end

	def follow_import(%{assigns: %{user: follower}} = conn, %{"list" => list}) do
	with lines <- String.split(list, "\n"),
	followed_identifiers <-
	Enum.map(lines, fn line ->
	String.split(line, ",") \|> List.first()
	end)
	\|> List.delete("Account address") do
	PleromaJobQueue.enqueue(:background, User, [
	:follow_import,
	follower,
	followed_identifiers
	])

	json(conn, "job started")
	end
	end

	def blocks_import(conn, %{"list" => %Plug.Upload{} = listfile}) do
	blocks_import(conn, %{"list" => File.read!(listfile.path)})
	end

	def blocks_import(%{assigns: %{user: blocker}} = conn, %{"list" => list}) do
	with blocked_identifiers <- String.split(list) do
	PleromaJobQueue.enqueue(:background, User, [
	:blocks_import,
	blocker,
	blocked_identifiers
	])

	json(conn, "job started")
	end
	end

	def change_password(%{assigns: %{user: user}} = conn, params) do
	case CommonAPI.Utils.confirm_current_password(user, params["password"]) do
	{:ok, user} ->
	with {:ok, _user} <-
	User.reset_password(user, %{
	password: params["new_password"],
	password_confirmation: params["new_password_confirmation"]
	}) do
	json(conn, %{status: "success"})
	else
	{:error, changeset} ->
	{_, {error, _}} = Enum.at(changeset.errors, 0)
	json(conn, %{error: "New password #{error}."})

	_ ->
	json(conn, %{error: "Unable to change password."})
	end

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def delete_account(%{assigns: %{user: user}} = conn, params) do
	case CommonAPI.Utils.confirm_current_password(user, params["password"]) do
	{:ok, user} ->
	User.delete(user)
	json(conn, %{status: "success"})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def disable_account(%{assigns: %{user: user}} = conn, params) do
	case CommonAPI.Utils.confirm_current_password(user, params["password"]) do
	{:ok, user} ->
	User.deactivate_async(user)
	json(conn, %{status: "success"})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	def captcha(conn, _params) do
	json(conn, Pleroma.Captcha.new())
	end

	def healthcheck(conn, _params) do
	with true <- Config.get([:instance, :healthcheck]),
	%{healthy: true} = info <- Healthcheck.system_info() do
	json(conn, info)
	else
	%{healthy: false} = info ->
	service_unavailable(conn, info)

	_ ->
	service_unavailable(conn, %{})
	end
	end

	defp service_unavailable(conn, info) do
	conn
	\|> put_status(:service_unavailable)
	\|> json(info)
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	index 42234ae09..42bd74eb5 100644
	--- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	+++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	@@ -1,86 +1,89 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.TwitterAPI.Controller do
	use Pleroma.Web, :controller

	alias Ecto.Changeset
	alias Pleroma.Notification
	+ alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.TokenView

	require Logger

	+ plug(OAuthScopesPlug, %{scopes: ["write:notifications"]} when action == :notifications_read)
	+
	action_fallback(:errors)

	def confirm_email(conn, %{"user_id" => uid, "token" => token}) do
	with %User{} = user <- User.get_cached_by_id(uid),
	true <- user.local,
	true <- user.info.confirmation_pending,
	true <- user.info.confirmation_token == token,
	info_change <- User.Info.confirmation_changeset(user.info, need_confirmation: false),
	changeset <- Changeset.change(user) \|> Changeset.put_embed(:info, info_change),
	{:ok, _} <- User.update_and_set_cache(changeset) do
	conn
	\|> redirect(to: "/")
	end
	end

	def oauth_tokens(%{assigns: %{user: user}} = conn, _params) do
	with oauth_tokens <- Token.get_user_tokens(user) do
	conn
	\|> put_view(TokenView)
	\|> render("index.json", %{tokens: oauth_tokens})
	end
	end

	def revoke_token(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	Token.delete_user_token(user, id)

	json_reply(conn, 201, "")
	end

	def errors(conn, {:param_cast, _}) do
	conn
	\|> put_status(400)
	\|> json("Invalid parameters")
	end

	def errors(conn, _) do
	conn
	\|> put_status(500)
	\|> json("Something went wrong")
	end

	defp json_reply(conn, status, json) do
	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(status, json)
	end

	def notifications_read(%{assigns: %{user: user}} = conn, %{"latest_id" => latest_id} = params) do
	Notification.set_read_up_to(user, latest_id)

	notifications = Notification.for_user(user, params)

	conn
	# XXX: This is a hack because pleroma-fe still uses that API.
	\|> put_view(Pleroma.Web.MastodonAPI.NotificationView)
	\|> render("index.json", %{notifications: notifications, for: user})
	end

	def notifications_read(%{assigns: %{user: _user}} = conn, _) do
	bad_request_reply(conn, "You need to specify latest_id")
	end

	defp bad_request_reply(conn, error_message) do
	json = error_json(conn, error_message)
	json_reply(conn, 400, json)
	end

	defp error_json(conn, error_message) do
	%{"error" => error_message, "request" => conn.request_path} \|> Jason.encode!()
	end
	end
	diff --git a/test/support/factory.ex b/test/support/factory.ex
	index 719115003..c14c8ddb3 100644
	--- a/test/support/factory.ex
	+++ b/test/support/factory.ex
	@@ -1,358 +1,359 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Factory do
	use ExMachina.Ecto, repo: Pleroma.Repo
	alias Pleroma.Object
	alias Pleroma.User

	def participation_factory do
	conversation = insert(:conversation)
	user = insert(:user)

	%Pleroma.Conversation.Participation{
	conversation: conversation,
	user: user,
	read: false
	}
	end

	def conversation_factory do
	%Pleroma.Conversation{
	ap_id: sequence(:ap_id, &"https://some_conversation/#{&1}")
	}
	end

	def user_factory do
	user = %User{
	name: sequence(:name, &"Test テスト User #{&1}"),
	email: sequence(:email, &"user#{&1}@example.com"),
	nickname: sequence(:nickname, &"nick#{&1}"),
	password_hash: Comeonin.Pbkdf2.hashpwsalt("test"),
	bio: sequence(:bio, &"Tester Number #{&1}"),
	info: %{},
	last_digest_emailed_at: NaiveDateTime.utc_now()
	}

	%{
	user
	\| ap_id: User.ap_id(user),
	follower_address: User.ap_followers(user),
	following_address: User.ap_following(user),
	following: [User.ap_id(user)]
	}
	end

	def note_factory(attrs \\ %{}) do
	text = sequence(:text, &"This is :moominmamma: note #{&1}")

	user = attrs[:user] \|\| insert(:user)

	data = %{
	"type" => "Note",
	"content" => text,
	"id" => Pleroma.Web.ActivityPub.Utils.generate_object_id(),
	"actor" => user.ap_id,
	"to" => ["https://www.w3.org/ns/activitystreams#Public"],
	"published" => DateTime.utc_now() \|> DateTime.to_iso8601(),
	"likes" => [],
	"like_count" => 0,
	"context" => "2hu",
	"summary" => "2hu",
	"tag" => ["2hu"],
	"emoji" => %{
	"2hu" => "corndog.png"
	}
	}

	%Pleroma.Object{
	data: merge_attributes(data, Map.get(attrs, :data, %{}))
	}
	end

	def direct_note_factory do
	user2 = insert(:user)

	%Pleroma.Object{data: data} = note_factory()
	%Pleroma.Object{data: Map.merge(data, %{"to" => [user2.ap_id]})}
	end

	def article_factory do
	note_factory()
	\|> Map.put("type", "Article")
	end

	def tombstone_factory do
	data = %{
	"type" => "Tombstone",
	"id" => Pleroma.Web.ActivityPub.Utils.generate_object_id(),
	"formerType" => "Note",
	"deleted" => DateTime.utc_now() \|> DateTime.to_iso8601()
	}

	%Pleroma.Object{
	data: data
	}
	end

	def direct_note_activity_factory do
	dm = insert(:direct_note)

	data = %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"type" => "Create",
	"actor" => dm.data["actor"],
	"to" => dm.data["to"],
	"object" => dm.data,
	"published" => DateTime.utc_now() \|> DateTime.to_iso8601(),
	"context" => dm.data["context"]
	}

	%Pleroma.Activity{
	data: data,
	actor: data["actor"],
	recipients: data["to"]
	}
	end

	def note_activity_factory(attrs \\ %{}) do
	user = attrs[:user] \|\| insert(:user)
	note = attrs[:note] \|\| insert(:note, user: user)

	data_attrs = attrs[:data_attrs] \|\| %{}
	attrs = Map.drop(attrs, [:user, :note, :data_attrs])

	data =
	%{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"type" => "Create",
	"actor" => note.data["actor"],
	"to" => note.data["to"],
	"object" => note.data["id"],
	"published" => DateTime.utc_now() \|> DateTime.to_iso8601(),
	"context" => note.data["context"]
	}
	\|> Map.merge(data_attrs)

	%Pleroma.Activity{
	data: data,
	actor: data["actor"],
	recipients: data["to"]
	}
	\|> Map.merge(attrs)
	end

	defp expiration_offset_by_minutes(attrs, minutes) do
	scheduled_at =
	NaiveDateTime.utc_now()
	\|> NaiveDateTime.add(:timer.minutes(minutes), :millisecond)
	\|> NaiveDateTime.truncate(:second)

	%Pleroma.ActivityExpiration{}
	\|> Map.merge(attrs)
	\|> Map.put(:scheduled_at, scheduled_at)
	end

	def expiration_in_the_past_factory(attrs \\ %{}) do
	expiration_offset_by_minutes(attrs, -60)
	end

	def expiration_in_the_future_factory(attrs \\ %{}) do
	expiration_offset_by_minutes(attrs, 61)
	end

	def article_activity_factory do
	article = insert(:article)

	data = %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"type" => "Create",
	"actor" => article.data["actor"],
	"to" => article.data["to"],
	"object" => article.data,
	"published" => DateTime.utc_now() \|> DateTime.to_iso8601(),
	"context" => article.data["context"]
	}

	%Pleroma.Activity{
	data: data,
	actor: data["actor"],
	recipients: data["to"]
	}
	end

	def announce_activity_factory(attrs \\ %{}) do
	note_activity = attrs[:note_activity] \|\| insert(:note_activity)
	user = attrs[:user] \|\| insert(:user)

	data = %{
	"type" => "Announce",
	"actor" => note_activity.actor,
	"object" => note_activity.data["id"],
	"to" => [user.follower_address, note_activity.data["actor"]],
	"cc" => ["https://www.w3.org/ns/activitystreams#Public"],
	"context" => note_activity.data["context"]
	}

	%Pleroma.Activity{
	data: data,
	actor: user.ap_id,
	recipients: data["to"]
	}
	end

	def like_activity_factory(attrs \\ %{}) do
	note_activity = attrs[:note_activity] \|\| insert(:note_activity)
	object = Object.normalize(note_activity)
	user = insert(:user)

	data =
	%{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"actor" => user.ap_id,
	"type" => "Like",
	"object" => object.data["id"],
	"published_at" => DateTime.utc_now() \|> DateTime.to_iso8601()
	}
	\|> Map.merge(attrs[:data_attrs] \|\| %{})

	%Pleroma.Activity{
	data: data
	}
	end

	def follow_activity_factory do
	follower = insert(:user)
	followed = insert(:user)

	data = %{
	"id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
	"actor" => follower.ap_id,
	"type" => "Follow",
	"object" => followed.ap_id,
	"published_at" => DateTime.utc_now() \|> DateTime.to_iso8601()
	}

	%Pleroma.Activity{
	data: data,
	actor: follower.ap_id
	}
	end

	def websub_subscription_factory do
	%Pleroma.Web.Websub.WebsubServerSubscription{
	topic: "http://example.org",
	callback: "http://example.org/callback",
	secret: "here's a secret",
	valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 100),
	state: "requested"
	}
	end

	def websub_client_subscription_factory do
	%Pleroma.Web.Websub.WebsubClientSubscription{
	topic: "http://example.org",
	secret: "here's a secret",
	valid_until: nil,
	state: "requested",
	subscribers: []
	}
	end

	def oauth_app_factory do
	%Pleroma.Web.OAuth.App{
	client_name: "Some client",
	redirect_uris: "https://example.com/callback",
	scopes: ["read", "write", "follow", "push"],
	website: "https://example.com",
	client_id: Ecto.UUID.generate(),
	client_secret: "aaa;/&bbb"
	}
	end

	def instance_factory do
	%Pleroma.Instances.Instance{
	host: "domain.com",
	unreachable_since: nil
	}
	end

	def oauth_token_factory do
	oauth_app = insert(:oauth_app)

	%Pleroma.Web.OAuth.Token{
	token: :crypto.strong_rand_bytes(32) \|> Base.url_encode64(),
	+ scopes: ["read"],
	refresh_token: :crypto.strong_rand_bytes(32) \|> Base.url_encode64(),
	user: build(:user),
	app_id: oauth_app.id,
	valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10)
	}
	end

	def oauth_authorization_factory do
	%Pleroma.Web.OAuth.Authorization{
	token: :crypto.strong_rand_bytes(32) \|> Base.url_encode64(padding: false),
	scopes: ["read", "write", "follow", "push"],
	valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10),
	user: build(:user),
	app: build(:oauth_app)
	}
	end

	def push_subscription_factory do
	%Pleroma.Web.Push.Subscription{
	user: build(:user),
	token: build(:oauth_token),
	endpoint: "https://example.com/example/1234",
	key_auth: "8eDyX_uCN0XRhSbY5hs7Hg==",
	key_p256dh:
	"BCIWgsnyXDv1VkhqL2P7YRBvdeuDnlwAPT2guNhdIoW3IP7GmHh1SMKPLxRf7x8vJy6ZFK3ol2ohgn_-0yP7QQA=",
	data: %{}
	}
	end

	def notification_factory do
	%Pleroma.Notification{
	user: build(:user)
	}
	end

	def scheduled_activity_factory do
	%Pleroma.ScheduledActivity{
	user: build(:user),
	scheduled_at: NaiveDateTime.add(NaiveDateTime.utc_now(), :timer.minutes(60), :millisecond),
	params: build(:note) \|> Map.from_struct() \|> Map.get(:data)
	}
	end

	def registration_factory do
	user = insert(:user)

	%Pleroma.Registration{
	user: user,
	provider: "twitter",
	uid: "171799000",
	info: %{
	"name" => "John Doe",
	"email" => "john@doe.com",
	"nickname" => "johndoe",
	"description" => "My bio"
	}
	}
	end

	def config_factory do
	%Pleroma.Web.AdminAPI.Config{
	key: sequence(:key, &"some_key_#{&1}"),
	group: "pleroma",
	value:
	sequence(
	:value,
	fn key ->
	:erlang.term_to_binary(%{another_key: "#{key}somevalue", another: "#{key}somevalue"})
	end
	)
	}
	end
	end
	diff --git a/test/web/mastodon_api/controllers/mastodon_api_controller/update_credentials_test.exs b/test/web/mastodon_api/controllers/mastodon_api_controller/update_credentials_test.exs
	index 87ee82050..1680ec122 100644
	--- a/test/web/mastodon_api/controllers/mastodon_api_controller/update_credentials_test.exs
	+++ b/test/web/mastodon_api/controllers/mastodon_api_controller/update_credentials_test.exs
	@@ -1,369 +1,370 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIController.UpdateCredentialsTest do
	alias Pleroma.Repo
	alias Pleroma.User

	use Pleroma.Web.ConnCase

	import Pleroma.Factory
	clear_config([:instance, :max_account_fields])

	describe "updating credentials" do
	test "sets user settings in a generic way", %{conn: conn} do
	user = insert(:user)

	res_conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{
	"pleroma_settings_store" => %{
	pleroma_fe: %{
	theme: "bla"
	}
	}
	})

	assert user = json_response(res_conn, 200)
	assert user["pleroma"]["settings_store"] == %{"pleroma_fe" => %{"theme" => "bla"}}

	user = Repo.get(User, user["id"])

	res_conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{
	"pleroma_settings_store" => %{
	masto_fe: %{
	theme: "bla"
	}
	}
	})

	assert user = json_response(res_conn, 200)

	assert user["pleroma"]["settings_store"] ==
	%{
	"pleroma_fe" => %{"theme" => "bla"},
	"masto_fe" => %{"theme" => "bla"}
	}

	user = Repo.get(User, user["id"])

	res_conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{
	"pleroma_settings_store" => %{
	masto_fe: %{
	theme: "blub"
	}
	}
	})

	assert user = json_response(res_conn, 200)

	assert user["pleroma"]["settings_store"] ==
	%{
	"pleroma_fe" => %{"theme" => "bla"},
	"masto_fe" => %{"theme" => "blub"}
	}
	end

	test "updates the user's bio", %{conn: conn} do
	user = insert(:user)
	user2 = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{
	"note" => "I drink #cofe with @#{user2.nickname}"
	})

	assert user = json_response(conn, 200)

	assert user["note"] ==
	~s(I drink <a class="hashtag" data-tag="cofe" href="http://localhost:4001/tag/cofe" rel="tag">#cofe</a> with <span class="h-card"><a data-user=") <>
	user2.id <>
	~s(" class="u-url mention" href=") <>
	user2.ap_id <> ~s(">@<span>) <> user2.nickname <> ~s(</span></a></span>)
	end

	test "updates the user's locking status", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{locked: "true"})

	assert user = json_response(conn, 200)
	assert user["locked"] == true
	end

	test "updates the user's default scope", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{default_scope: "cofe"})

	assert user = json_response(conn, 200)
	assert user["source"]["privacy"] == "cofe"
	end

	test "updates the user's hide_followers status", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{hide_followers: "true"})

	assert user = json_response(conn, 200)
	assert user["pleroma"]["hide_followers"] == true
	end

	test "updates the user's skip_thread_containment option", %{conn: conn} do
	user = insert(:user)

	response =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{skip_thread_containment: "true"})
	\|> json_response(200)

	assert response["pleroma"]["skip_thread_containment"] == true
	assert refresh_record(user).info.skip_thread_containment
	end

	test "updates the user's hide_follows status", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{hide_follows: "true"})

	assert user = json_response(conn, 200)
	assert user["pleroma"]["hide_follows"] == true
	end

	test "updates the user's hide_favorites status", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{hide_favorites: "true"})

	assert user = json_response(conn, 200)
	assert user["pleroma"]["hide_favorites"] == true
	end

	test "updates the user's show_role status", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{show_role: "false"})

	assert user = json_response(conn, 200)
	assert user["source"]["pleroma"]["show_role"] == false
	end

	test "updates the user's no_rich_text status", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{no_rich_text: "true"})

	assert user = json_response(conn, 200)
	assert user["source"]["pleroma"]["no_rich_text"] == true
	end

	test "updates the user's name", %{conn: conn} do
	user = insert(:user)

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{"display_name" => "markorepairs"})

	assert user = json_response(conn, 200)
	assert user["display_name"] == "markorepairs"
	end

	test "updates the user's avatar", %{conn: conn} do
	user = insert(:user)

	new_avatar = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{"avatar" => new_avatar})

	assert user_response = json_response(conn, 200)
	assert user_response["avatar"] != User.avatar_url(user)
	end

	test "updates the user's banner", %{conn: conn} do
	user = insert(:user)

	new_header = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{"header" => new_header})

	assert user_response = json_response(conn, 200)
	assert user_response["header"] != User.banner_url(user)
	end

	test "updates the user's background", %{conn: conn} do
	user = insert(:user)

	new_header = %Plug.Upload{
	content_type: "image/jpg",
	path: Path.absname("test/fixtures/image.jpg"),
	filename: "an_image.jpg"
	}

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{
	"pleroma_background_image" => new_header
	})

	assert user_response = json_response(conn, 200)
	assert user_response["pleroma"]["background_image"]
	end

	- test "requires 'write' permission", %{conn: conn} do
	+ test "requires 'write:accounts' permission", %{conn: conn} do
	token1 = insert(:oauth_token, scopes: ["read"])
	token2 = insert(:oauth_token, scopes: ["write", "follow"])

	for token <- [token1, token2] do
	conn =
	conn
	\|> put_req_header("authorization", "Bearer #{token.token}")
	\|> patch("/api/v1/accounts/update_credentials", %{})

	if token == token1 do
	- assert %{"error" => "Insufficient permissions: write."} == json_response(conn, 403)
	+ assert %{"error" => "Insufficient permissions: write:accounts."} ==
	+ json_response(conn, 403)
	else
	assert json_response(conn, 200)
	end
	end
	end

	test "updates profile emojos", %{conn: conn} do
	user = insert(:user)

	note = "sips :blank:"
	name = "I am :firefox:"

	conn =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{
	"note" => note,
	"display_name" => name
	})

	assert json_response(conn, 200)

	conn =
	conn
	\|> get("/api/v1/accounts/#{user.id}")

	assert user = json_response(conn, 200)

	assert user["note"] == note
	assert user["display_name"] == name
	assert [%{"shortcode" => "blank"}, %{"shortcode" => "firefox"}] = user["emojis"]
	end

	test "update fields", %{conn: conn} do
	user = insert(:user)

	fields = [
	%{"name" => "<a href=\"http://google.com\">foo</a>", "value" => "<script>bar</script>"},
	%{"name" => "link", "value" => "cofe.io"}
	]

	account =
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{"fields" => fields})
	\|> json_response(200)

	assert account["fields"] == [
	%{"name" => "foo", "value" => "bar"},
	%{"name" => "link", "value" => "<a href=\"http://cofe.io\">cofe.io</a>"}
	]

	assert account["source"]["fields"] == [
	%{
	"name" => "<a href=\"http://google.com\">foo</a>",
	"value" => "<script>bar</script>"
	},
	%{"name" => "link", "value" => "cofe.io"}
	]

	name_limit = Pleroma.Config.get([:instance, :account_field_name_length])
	value_limit = Pleroma.Config.get([:instance, :account_field_value_length])

	long_value = Enum.map(0..value_limit, fn _ -> "x" end) \|> Enum.join()

	fields = [%{"name" => "<b>foo<b>", "value" => long_value}]

	assert %{"error" => "Invalid request"} ==
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{"fields" => fields})
	\|> json_response(403)

	long_name = Enum.map(0..name_limit, fn _ -> "x" end) \|> Enum.join()

	fields = [%{"name" => long_name, "value" => "bar"}]

	assert %{"error" => "Invalid request"} ==
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{"fields" => fields})
	\|> json_response(403)

	Pleroma.Config.put([:instance, :max_account_fields], 1)

	fields = [
	%{"name" => "<b>foo<b>", "value" => "<i>bar</i>"},
	%{"name" => "link", "value" => "cofe.io"}
	]

	assert %{"error" => "Invalid request"} ==
	conn
	\|> assign(:user, user)
	\|> patch("/api/v1/accounts/update_credentials", %{"fields" => fields})
	\|> json_response(403)
	end
	end
	end
	diff --git a/test/web/oauth/oauth_controller_test.exs b/test/web/oauth/oauth_controller_test.exs
	index b492c7794..e919ea112 100644
	--- a/test/web/oauth/oauth_controller_test.exs
	+++ b/test/web/oauth/oauth_controller_test.exs
	@@ -1,1041 +1,1041 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthControllerTest do
	use Pleroma.Web.ConnCase
	import Pleroma.Factory

	alias Pleroma.Repo
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.OAuthController
	alias Pleroma.Web.OAuth.Token

	@session_opts [
	store: :cookie,
	key: "_test",
	signing_salt: "cooldude"
	]
	clear_config_all([:instance, :account_activation_required])

	describe "in OAuth consumer mode, " do
	setup do
	[
	app: insert(:oauth_app),
	conn:
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	clear_config([:auth, :oauth_consumer_strategies]) do
	Pleroma.Config.put(
	[:auth, :oauth_consumer_strategies],
	~w(twitter facebook)
	)
	end

	test "GET /oauth/authorize renders auth forms, including OAuth consumer form", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ "Sign in with Twitter"
	assert response =~ o_auth_path(conn, :prepare_request)
	end

	test "GET /oauth/prepare_request encodes parameters as `state` and redirects", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/prepare_request",
	%{
	"provider" => "twitter",
	"authorization" => %{
	"scope" => "read follow",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state"
	}
	}
	)

	assert response = html_response(conn, 302)

	redirect_query = URI.parse(redirected_to(conn)).query
	assert %{"state" => state_param} = URI.decode_query(redirect_query)
	assert {:ok, state_components} = Poison.decode(state_param)

	expected_client_id = app.client_id
	expected_redirect_uri = app.redirect_uris

	assert %{
	"scope" => "read follow",
	"client_id" => ^expected_client_id,
	"redirect_uri" => ^expected_redirect_uri,
	"state" => "a_state"
	} = state_components
	end

	test "with user-bound registration, GET /oauth/<provider>/callback redirects to `redirect_uri` with `code`",
	%{app: app, conn: conn} do
	registration = insert(:registration)
	redirect_uri = OAuthController.default_redirect_uri(app)

	state_params = %{
	"scope" => Enum.join(app.scopes, " "),
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => ""
	}

	conn =
	conn
	\|> assign(:ueberauth_auth, %{provider: registration.provider, uid: registration.uid})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Poison.encode!(state_params)
	}
	)

	assert response = html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with user-unbound registration, GET /oauth/<provider>/callback renders registration_details page",
	%{app: app, conn: conn} do
	user = insert(:user)

	state_params = %{
	"scope" => "read write",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state"
	}

	conn =
	conn
	\|> assign(:ueberauth_auth, %{
	provider: "twitter",
	uid: "171799000",
	info: %{nickname: user.nickname, email: user.email, name: user.name, description: nil}
	})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Poison.encode!(state_params)
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ ~r/name="op" type="submit" value="register"/
	assert response =~ ~r/name="op" type="submit" value="connect"/
	assert response =~ user.email
	assert response =~ user.nickname
	end

	test "on authentication error, GET /oauth/<provider>/callback redirects to `redirect_uri`", %{
	app: app,
	conn: conn
	} do
	state_params = %{
	"scope" => Enum.join(app.scopes, " "),
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => ""
	}

	conn =
	conn
	\|> assign(:ueberauth_failure, %{errors: [%{message: "(error description)"}]})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Poison.encode!(state_params)
	}
	)

	assert response = html_response(conn, 302)
	assert redirected_to(conn) == app.redirect_uris
	assert get_flash(conn, :error) == "Failed to authenticate: (error description)."
	end

	test "GET /oauth/registration_details renders registration details form", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/registration_details",
	%{
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"nickname" => nil,
	"email" => "john@doe.com"
	}
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ ~r/name="op" type="submit" value="register"/
	assert response =~ ~r/name="op" type="submit" value="connect"/
	end

	test "with valid params, POST /oauth/register?op=register redirects to `redirect_uri` with `code`",
	%{
	app: app,
	conn: conn
	} do
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "a_state",
	"nickname" => "availablenick",
	"email" => "available@email.com"
	}
	}
	)

	assert response = html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with unlisted `redirect_uri`, POST /oauth/register?op=register results in HTTP 401",
	%{
	app: app,
	conn: conn
	} do
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
	unlisted_redirect_uri = "http://cross-site-request.com"

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "a_state",
	"nickname" => "availablenick",
	"email" => "available@email.com"
	}
	}
	)

	assert response = html_response(conn, 401)
	end

	test "with invalid params, POST /oauth/register?op=register renders registration_details page",
	%{
	app: app,
	conn: conn
	} do
	another_user = insert(:user)
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})

	params = %{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"nickname" => "availablenickname",
	"email" => "available@email.com"
	}
	}

	for {bad_param, bad_param_value} <-
	[{"nickname", another_user.nickname}, {"email", another_user.email}] do
	bad_registration_attrs = %{
	"authorization" => Map.put(params["authorization"], bad_param, bad_param_value)
	}

	bad_params = Map.merge(params, bad_registration_attrs)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post("/oauth/register", bad_params)

	assert html_response(conn, 403) =~ ~r/name="op" type="submit" value="register"/
	assert get_flash(conn, :error) == "Error: #{bad_param} has already been taken."
	end
	end

	test "with valid params, POST /oauth/register?op=connect redirects to `redirect_uri` with `code`",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt("testpassword"))
	registration = insert(:registration, user: nil)
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "testpassword"
	}
	}
	)

	assert response = html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with unlisted `redirect_uri`, POST /oauth/register?op=connect results in HTTP 401`",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt("testpassword"))
	registration = insert(:registration, user: nil)
	unlisted_redirect_uri = "http://cross-site-request.com"

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "testpassword"
	}
	}
	)

	assert response = html_response(conn, 401)
	end

	test "with invalid params, POST /oauth/register?op=connect renders registration_details page",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user)
	registration = insert(:registration, user: nil)

	params = %{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "wrong password"
	}
	}

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post("/oauth/register", params)

	assert html_response(conn, 401) =~ ~r/name="op" type="submit" value="connect"/
	assert get_flash(conn, :error) == "Invalid Username/Password"
	end
	end

	describe "GET /oauth/authorize" do
	setup do
	[
	app: insert(:oauth_app, redirect_uris: "https://redirect.url"),
	conn:
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	test "renders authentication page", %{app: app, conn: conn} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "properly handles internal calls with `authorization`-wrapped params", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"authorization" => %{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "renders authentication page if user is already authenticated but `force_login` is tru-ish",
	%{app: app, conn: conn} do
	token = insert(:oauth_token, app_id: app.id)

	conn =
	conn
	\|> put_session(:oauth_token, token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read",
	"force_login" => "true"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "with existing authentication and non-OOB `redirect_uri`, redirects to app with `token` and `state` params",
	%{
	app: app,
	conn: conn
	} do
	token = insert(:oauth_token, app_id: app.id)

	conn =
	conn
	\|> put_session(:oauth_token, token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "specific_client_state",
	"scope" => "read"
	}
	)

	assert URI.decode(redirected_to(conn)) ==
	"https://redirect.url?access_token=#{token.token}&state=specific_client_state"
	end

	test "with existing authentication and unlisted non-OOB `redirect_uri`, redirects without credentials",
	%{
	app: app,
	conn: conn
	} do
	unlisted_redirect_uri = "http://cross-site-request.com"
	token = insert(:oauth_token, app_id: app.id)

	conn =
	conn
	\|> put_session(:oauth_token, token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "specific_client_state",
	"scope" => "read"
	}
	)

	assert redirected_to(conn) == unlisted_redirect_uri
	end

	test "with existing authentication and OOB `redirect_uri`, redirects to app with `token` and `state` params",
	%{
	app: app,
	conn: conn
	} do
	token = insert(:oauth_token, app_id: app.id)

	conn =
	conn
	\|> put_session(:oauth_token, token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ "Authorization exists"
	end
	end

	describe "POST /oauth/authorize" do
	test "redirects with oauth authorization" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write", "follow"])
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	build_conn()
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	- "scope" => "read write",
	+ "scope" => "read:subscope write",
	"state" => "statepassed"
	}
	})

	target = redirected_to(conn)
	assert target =~ redirect_uri

	query = URI.parse(target).query \|> URI.query_decoder() \|> Map.new()

	assert %{"state" => "statepassed", "code" => code} = query
	auth = Repo.get_by(Authorization, token: code)
	assert auth
	- assert auth.scopes == ["read", "write"]
	+ assert auth.scopes == ["read:subscope", "write"]
	end

	test "returns 401 for wrong credentials", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app)
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "wrong",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => Enum.join(app.scopes, " ")
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "Invalid Username/Password"
	end

	test "returns 401 for missing scopes", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app)
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => ""
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end

	- test "returns 401 for scopes beyond app scopes", %{conn: conn} do
	+ test "returns 401 for scopes beyond app scopes hierarchy", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => "read write follow"
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end
	end

	describe "POST /oauth/token" do
	test "issues a token for an all-body request" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "me" => ap_id} = json_response(conn, 200)

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == auth.scopes
	assert user.ap_id == ap_id
	end

	test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do
	password = "testpassword"
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))

	app = insert(:oauth_app, scopes: ["read", "write"])

	# Note: "scope" param is intentionally omitted
	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token} = json_response(conn, 200)

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == app.scopes
	end

	test "issues a token for request with HTTP basic auth client credentials" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["scope1", "scope2", "scope3"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["scope1", "scope2"])
	assert auth.scopes == ["scope1", "scope2"]

	app_encoded =
	(URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
	\|> Base.encode64()

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic " <> app_encoded)
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app)
	})

	assert %{"access_token" => token, "scope" => scope} = json_response(conn, 200)

	assert scope == "scope1 scope2"

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == ["scope1", "scope2"]
	end

	test "issue a token for client_credentials grant type" do
	app = insert(:oauth_app, scopes: ["read", "write"])

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "client_credentials",
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
	json_response(conn, 200)

	assert token
	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	assert refresh
	assert scope == "read write"
	end

	test "rejects token exchange with invalid client credentials" do
	user = insert(:user)
	app = insert(:oauth_app)

	{:ok, auth} = Authorization.create_authorization(app, user)

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app)
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
	Pleroma.Config.put([:instance, :account_activation_required], true)

	password = "testpassword"
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
	info_change = Pleroma.User.Info.confirmation_changeset(user.info, need_confirmation: true)

	{:ok, user} =
	user
	\|> Ecto.Changeset.change()
	\|> Ecto.Changeset.put_embed(:info, info_change)
	\|> Repo.update()

	refute Pleroma.User.auth_active?(user)

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to deactivated user" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Comeonin.Pbkdf2.hashpwsalt(password),
	info: %{deactivated: true}
	)

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects an invalid authorization code" do
	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => "Imobviouslyinvalid",
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = json_response(conn, 400)
	refute Map.has_key?(resp, "access_token")
	end
	end

	describe "POST /oauth/token - refresh token" do
	clear_config([:oauth2, :issue_new_refresh_token])

	test "issues a new access token with keep fresh token" do
	Pleroma.Config.put([:oauth2, :issue_new_refresh_token], true)
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"expires_in" => 600,
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	new_token = Repo.get_by(Token, token: response["access_token"])
	assert new_token.refresh_token == token.refresh_token
	assert new_token.scopes == auth.scopes
	assert new_token.user_id == user.id
	assert new_token.app_id == app.id
	end

	test "issues a new access token with new fresh token" do
	Pleroma.Config.put([:oauth2, :issue_new_refresh_token], false)
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"expires_in" => 600,
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	new_token = Repo.get_by(Token, token: response["access_token"])
	refute new_token.refresh_token == token.refresh_token
	assert new_token.scopes == auth.scopes
	assert new_token.user_id == user.id
	assert new_token.app_id == app.id
	end

	test "returns 400 if we try use access token" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(400)

	assert %{"error" => "Invalid credentials"} == response
	end

	test "returns 400 if refresh_token invalid" do
	app = insert(:oauth_app, scopes: ["read", "write"])

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => "token.refresh_token",
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(400)

	assert %{"error" => "Invalid credentials"} == response
	end

	test "issues a new token if token expired" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	change =
	Ecto.Changeset.change(
	token,
	%{valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), -86_400 * 30)}
	)

	{:ok, access_token} = Repo.update(change)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => access_token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"expires_in" => 600,
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	token = Repo.get_by(Token, token: response["access_token"])
	assert token
	assert token.scopes == auth.scopes
	assert token.user_id == user.id
	assert token.app_id == app.id
	end
	end

	describe "POST /oauth/token - bad request" do
	test "returns 500" do
	response =
	build_conn()
	\|> post("/oauth/token", %{})
	\|> json_response(500)

	assert %{"error" => "Bad request"} == response
	end
	end

	describe "POST /oauth/revoke - bad request" do
	test "returns 500" do
	response =
	build_conn()
	\|> post("/oauth/revoke", %{})
	\|> json_response(500)

	assert %{"error" => "Bad request"} == response
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Wed, May 14, 7:42 AM (1 d, 19 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 166799
Default Alt Text: (207 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions