No OneTemporary
Actions

Authored By

Unknown

Size

210 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/dialyzer3.skip b/changelog.d/dialyzer3.skip
	new file mode 100644
	index 000000000..e69de29bb
	diff --git a/lib/pleroma/upload.ex b/lib/pleroma/upload.ex
	index 89cd3d920..e6c484548 100644
	--- a/lib/pleroma/upload.ex
	+++ b/lib/pleroma/upload.ex
	@@ -1,283 +1,284 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Upload do
	@moduledoc """
	Manage user uploads

	Options:
	* `:type`: presets for activity type (defaults to Document) and size limits from app configuration
	* `:description`: upload alternative text
	* `:base_url`: override base url
	* `:uploader`: override uploader
	* `:filters`: override filters
	* `:size_limit`: override size limit
	* `:activity_type`: override activity type

	The `%Pleroma.Upload{}` struct: all documented fields are meant to be overwritten in filters:

	* `:id` - the upload id.
	* `:name` - the upload file name.
	* `:path` - the upload path: set at first to `id/name` but can be changed. Keep in mind that the path
	is once created permanent and changing it (especially in uploaders) is probably a bad idea!
	* `:tempfile` - path to the temporary file. Prefer in-place changes on the file rather than changing the
	path as the temporary file is also tracked by `Plug.Upload{}` and automatically deleted once the request is over.
	* `:width` - width of the media in pixels
	* `:height` - height of the media in pixels
	* `:blurhash` - string hash of the image encoded with the blurhash algorithm (https://blurha.sh/)

	Related behaviors:

	* `Pleroma.Uploaders.Uploader`
	* `Pleroma.Upload.Filter`

	"""
	alias Ecto.UUID
	alias Pleroma.Maps
	alias Pleroma.Web.ActivityPub.Utils
	require Logger

	@type source ::
	Plug.Upload.t()
	\| (data_uri_string :: String.t())
	\| {:from_local, name :: String.t(), id :: String.t(), path :: String.t()}
	\| map()

	@type option ::
	{:type, :avatar \| :banner \| :background}
	\| {:description, String.t()}
	\| {:activity_type, String.t()}
	\| {:size_limit, nil \| non_neg_integer()}
	\| {:uploader, module()}
	\| {:filters, [module()]}
	+ \| {:actor, String.t()}

	@type t :: %__MODULE__{
	id: String.t(),
	name: String.t(),
	tempfile: String.t(),
	content_type: String.t(),
	width: integer(),
	height: integer(),
	blurhash: String.t(),
	description: String.t(),
	path: String.t()
	}
	defstruct [
	:id,
	:name,
	:tempfile,
	:content_type,
	:width,
	:height,
	:blurhash,
	:description,
	:path
	]

	@config_impl Application.compile_env(:pleroma, [__MODULE__, :config_impl], Pleroma.Config)

	defp get_description(upload) do
	case {upload.description, Pleroma.Config.get([Pleroma.Upload, :default_description])} do
	{description, _} when is_binary(description) -> description
	{_, :filename} -> upload.name
	{_, str} when is_binary(str) -> str
	_ -> ""
	end
	end

	@spec store(source, options :: [option()]) :: {:ok, map()} \| {:error, any()}
	@doc "Store a file. If using a `Plug.Upload{}` as the source, be sure to use `Majic.Plug` to ensure its content_type and filename is correct."
	def store(upload, opts \\ []) do
	opts = get_opts(opts)

	with {:ok, upload} <- prepare_upload(upload, opts),
	upload = %__MODULE__{upload \| path: upload.path \|\| "#{upload.id}/#{upload.name}"},
	{:ok, upload} <- Pleroma.Upload.Filter.filter(opts.filters, upload),
	description = get_description(upload),
	{_, true} <-
	{:description_limit,
	String.length(description) <= Pleroma.Config.get([:instance, :description_limit])},
	{:ok, url_spec} <- Pleroma.Uploaders.Uploader.put_file(opts.uploader, upload) do
	{:ok,
	%{
	"id" => Utils.generate_object_id(),
	"type" => opts.activity_type,
	"mediaType" => upload.content_type,
	"url" => [
	%{
	"type" => "Link",
	"mediaType" => upload.content_type,
	"href" => url_from_spec(upload, opts.base_url, url_spec)
	}
	\|> Maps.put_if_present("width", upload.width)
	\|> Maps.put_if_present("height", upload.height)
	],
	"name" => description
	}
	\|> Maps.put_if_present("blurhash", upload.blurhash)}
	else
	{:description_limit, _} ->
	{:error, :description_too_long}

	{:error, error} ->
	Logger.error(
	"#{__MODULE__} store (using #{inspect(opts.uploader)}) failed: #{inspect(error)}"
	)

	{:error, error}
	end
	end

	def char_unescaped?(char) do
	URI.char_unreserved?(char) or char == ?/
	end

	defp get_opts(opts) do
	{size_limit, activity_type} =
	case Keyword.get(opts, :type) do
	:banner ->
	{Pleroma.Config.get!([:instance, :banner_upload_limit]), "Image"}

	:avatar ->
	{Pleroma.Config.get!([:instance, :avatar_upload_limit]), "Image"}

	:background ->
	{Pleroma.Config.get!([:instance, :background_upload_limit]), "Image"}

	_ ->
	{Pleroma.Config.get!([:instance, :upload_limit]), "Document"}
	end

	%{
	activity_type: Keyword.get(opts, :activity_type, activity_type),
	size_limit: Keyword.get(opts, :size_limit, size_limit),
	uploader: Keyword.get(opts, :uploader, Pleroma.Config.get([__MODULE__, :uploader])),
	filters: Keyword.get(opts, :filters, Pleroma.Config.get([__MODULE__, :filters])),
	description: Keyword.get(opts, :description),
	base_url: base_url()
	}
	end

	defp prepare_upload(%Plug.Upload{} = file, opts) do
	with :ok <- check_file_size(file.path, opts.size_limit) do
	{:ok,
	%__MODULE__{
	id: UUID.generate(),
	name: file.filename,
	tempfile: file.path,
	content_type: file.content_type,
	description: opts.description
	}}
	end
	end

	defp prepare_upload(%{img: "data:image/" <> image_data}, opts) do
	parsed = Regex.named_captures(~r/(?<filetype>jpeg\|png\|gif);base64,(?<data>.*)/, image_data)
	data = Base.decode64!(parsed["data"], ignore: :whitespace)
	hash = Base.encode16(:crypto.hash(:sha256, data), case: :upper)

	with :ok <- check_binary_size(data, opts.size_limit),
	tmp_path <- tempfile_for_image(data),
	{:ok, %{mime_type: content_type}} <-
	Majic.perform({:bytes, data}, pool: Pleroma.MajicPool),
	[ext \| _] <- MIME.extensions(content_type) do
	{:ok,
	%__MODULE__{
	id: UUID.generate(),
	name: hash <> "." <> ext,
	tempfile: tmp_path,
	content_type: content_type,
	description: opts.description
	}}
	end
	end

	# For Mix.Tasks.MigrateLocalUploads
	defp prepare_upload(%__MODULE__{tempfile: path} = upload, _opts) do
	with {:ok, %{mime_type: content_type}} <- Majic.perform(path, pool: Pleroma.MajicPool) do
	{:ok, %__MODULE__{upload \| content_type: content_type}}
	end
	end

	defp check_binary_size(binary, size_limit)
	when is_integer(size_limit) and size_limit > 0 and byte_size(binary) >= size_limit do
	{:error, :file_too_large}
	end

	defp check_binary_size(_, _), do: :ok

	defp check_file_size(path, size_limit) when is_integer(size_limit) and size_limit > 0 do
	with {:ok, %{size: size}} <- File.stat(path),
	true <- size <= size_limit do
	:ok
	else
	false -> {:error, :file_too_large}
	error -> error
	end
	end

	defp check_file_size(_, _), do: :ok

	# Creates a tempfile using the Plug.Upload Genserver which cleans them up
	# automatically.
	defp tempfile_for_image(data) do
	{:ok, tmp_path} = Plug.Upload.random_file("profile_pics")
	{:ok, tmp_file} = File.open(tmp_path, [:write, :raw, :binary])
	IO.binwrite(tmp_file, data)

	tmp_path
	end

	defp url_from_spec(%__MODULE__{name: name}, base_url, {:file, path}) do
	path =
	URI.encode(path, &char_unescaped?/1) <>
	if Pleroma.Config.get([__MODULE__, :link_name], false) do
	"?name=#{URI.encode(name, &char_unescaped?/1)}"
	else
	""
	end

	[base_url, path]
	\|> Path.join()
	end

	defp url_from_spec(_upload, _base_url, {:url, url}), do: url

	def base_url do
	uploader = @config_impl.get([Pleroma.Upload, :uploader])
	upload_base_url = @config_impl.get([Pleroma.Upload, :base_url])
	public_endpoint = @config_impl.get([uploader, :public_endpoint])

	case uploader do
	Pleroma.Uploaders.Local ->
	upload_base_url \|\| Pleroma.Web.Endpoint.url() <> "/media/"

	Pleroma.Uploaders.S3 ->
	bucket = @config_impl.get([Pleroma.Uploaders.S3, :bucket])
	truncated_namespace = @config_impl.get([Pleroma.Uploaders.S3, :truncated_namespace])
	namespace = @config_impl.get([Pleroma.Uploaders.S3, :bucket_namespace])

	bucket_with_namespace =
	cond do
	!is_nil(truncated_namespace) ->
	truncated_namespace

	!is_nil(namespace) ->
	namespace <> ":" <> bucket

	true ->
	bucket
	end

	if public_endpoint do
	Path.join([public_endpoint, bucket_with_namespace])
	else
	Path.join([upload_base_url, bucket_with_namespace])
	end

	_ ->
	public_endpoint \|\| upload_base_url \|\| Pleroma.Web.Endpoint.url() <> "/media/"
	end
	end
	end
	diff --git a/lib/pleroma/web/admin_api/controllers/config_controller.ex b/lib/pleroma/web/admin_api/controllers/config_controller.ex
	index a03318c0e..2c9c27294 100644
	--- a/lib/pleroma/web/admin_api/controllers/config_controller.ex
	+++ b/lib/pleroma/web/admin_api/controllers/config_controller.ex
	@@ -1,198 +1,198 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.ConfigController do
	use Pleroma.Web, :controller

	alias Pleroma.Config
	alias Pleroma.ConfigDB
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
	plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action == :update)

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:read"]}
	when action in [:show, :descriptions]
	)

	action_fallback(Pleroma.Web.AdminAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.ConfigOperation

	defp translate_descriptions(descriptions, path \\ []) do
	Enum.map(descriptions, fn desc -> translate_item(desc, path) end)
	end

	defp translate_string(str, path, type) do
	Gettext.dpgettext(
	Pleroma.Web.Gettext,
	"config_descriptions",
	Pleroma.Docs.Translator.Compiler.msgctxt_for(path, type),
	str
	)
	end

	defp maybe_put_translated(item, key, path) do
	if item[key] do
	Map.put(
	item,
	key,
	translate_string(
	item[key],
	path ++ [Pleroma.Docs.Translator.Compiler.key_for(item)],
	to_string(key)
	)
	)
	else
	item
	end
	end

	defp translate_item(item, path) do
	item
	\|> maybe_put_translated(:label, path)
	\|> maybe_put_translated(:description, path)
	\|> translate_children(path)
	end

	defp translate_children(%{children: children} = item, path) when is_list(children) do
	item
	\|> Map.put(
	:children,
	translate_descriptions(children, path ++ [Pleroma.Docs.Translator.Compiler.key_for(item)])
	)
	end

	defp translate_children(item, _path) do
	item
	end

	def descriptions(conn, _params) do
	descriptions = Enum.filter(Pleroma.Docs.JSON.compiled_descriptions(), &whitelisted_config?/1)

	json(conn, translate_descriptions(descriptions))
	end

	- def show(conn, %{only_db: true}) do
	+ def show(%{private: %{open_api_spex: %{params: %{only_db: true}}}} = conn, _) do
	with :ok <- configurable_from_database() do
	configs = Pleroma.Repo.all(ConfigDB)

	render(conn, "index.json", %{
	configs: configs,
	need_reboot: Restarter.Pleroma.need_reboot?()
	})
	end
	end

	def show(conn, _params) do
	with :ok <- configurable_from_database() do
	configs = ConfigDB.get_all_as_keyword()

	merged =
	Config.Holder.default_config()
	\|> ConfigDB.merge(configs)
	\|> Enum.map(fn {group, values} ->
	Enum.map(values, fn {key, value} ->
	db =
	if configs[group][key] do
	ConfigDB.get_db_keys(configs[group][key], key)
	end

	db_value = configs[group][key]

	merged_value =
	if not is_nil(db_value) and Keyword.keyword?(db_value) and
	ConfigDB.sub_key_full_update?(group, key, Keyword.keys(db_value)) do
	ConfigDB.merge_group(group, key, value, db_value)
	else
	value
	end

	%ConfigDB{
	group: group,
	key: key,
	value: merged_value
	}
	\|> Pleroma.Maps.put_if_present(:db, db)
	end)
	end)
	\|> List.flatten()

	render(conn, "index.json", %{
	configs: merged,
	need_reboot: Restarter.Pleroma.need_reboot?()
	})
	end
	end

	- def update(%{body_params: %{configs: configs}} = conn, _) do
	+ def update(%{private: %{open_api_spex: %{body_params: %{configs: configs}}}} = conn, _) do
	with :ok <- configurable_from_database() do
	results =
	configs
	\|> Enum.filter(&whitelisted_config?/1)
	\|> Enum.map(fn
	%{group: group, key: key, delete: true} = params ->
	ConfigDB.delete(%{group: group, key: key, subkeys: params[:subkeys]})

	%{group: group, key: key, value: value} ->
	ConfigDB.update_or_create(%{group: group, key: key, value: value})
	end)
	\|> Enum.reject(fn {result, _} -> result == :error end)

	{deleted, updated} =
	results
	\|> Enum.map(fn {:ok, %{key: key, value: value} = config} ->
	Map.put(config, :db, ConfigDB.get_db_keys(value, key))
	end)
	\|> Enum.split_with(&(Ecto.get_meta(&1, :state) == :deleted))

	Config.TransferTask.load_and_update_env(deleted, false)

	if not Restarter.Pleroma.need_reboot?() do
	changed_reboot_settings? =
	(updated ++ deleted)
	\|> Enum.any?(&Config.TransferTask.pleroma_need_restart?(&1.group, &1.key, &1.value))

	if changed_reboot_settings?, do: Restarter.Pleroma.need_reboot()
	end

	render(conn, "index.json", %{
	configs: updated,
	need_reboot: Restarter.Pleroma.need_reboot?()
	})
	end
	end

	defp configurable_from_database do
	if Config.get(:configurable_from_database) do
	:ok
	else
	{:error, "You must enable configurable_from_database in your config file."}
	end
	end

	defp whitelisted_config?(group, key) do
	if whitelisted_configs = Config.get(:database_config_whitelist) do
	Enum.any?(whitelisted_configs, fn
	{whitelisted_group} ->
	group == inspect(whitelisted_group)

	{whitelisted_group, whitelisted_key} ->
	group == inspect(whitelisted_group) && key == inspect(whitelisted_key)
	end)
	else
	true
	end
	end

	defp whitelisted_config?(%{group: group, key: key}) do
	whitelisted_config?(group, key)
	end

	defp whitelisted_config?(%{group: group} = config) do
	whitelisted_config?(group, config[:key])
	end
	end
	diff --git a/lib/pleroma/web/admin_api/controllers/instance_document_controller.ex b/lib/pleroma/web/admin_api/controllers/instance_document_controller.ex
	index 990a94313..d76a95960 100644
	--- a/lib/pleroma/web/admin_api/controllers/instance_document_controller.ex
	+++ b/lib/pleroma/web/admin_api/controllers/instance_document_controller.ex
	@@ -1,41 +1,46 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.InstanceDocumentController do
	use Pleroma.Web, :controller

	alias Pleroma.Web.InstanceDocument
	alias Pleroma.Web.Plugs.InstanceStatic
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	action_fallback(Pleroma.Web.AdminAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.InstanceDocumentOperation

	plug(OAuthScopesPlug, %{scopes: ["admin:read"]} when action == :show)
	plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action in [:update, :delete])

	- def show(conn, %{name: document_name}) do
	+ def show(%{private: %{open_api_spex: %{params: %{name: document_name}}}} = conn, _) do
	with {:ok, url} <- InstanceDocument.get(document_name),
	{:ok, content} <- File.read(InstanceStatic.file_path(url)) do
	conn
	\|> put_resp_content_type("text/html")
	\|> send_resp(200, content)
	end
	end

	- def update(%{body_params: %{file: file}} = conn, %{name: document_name}) do
	+ def update(
	+ %{
	+ private: %{open_api_spex: %{body_params: %{file: file}, params: %{name: document_name}}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, url} <- InstanceDocument.put(document_name, file.path) do
	json(conn, %{"url" => url})
	end
	end

	- def delete(conn, %{name: document_name}) do
	+ def delete(%{private: %{open_api_spex: %{params: %{name: document_name}}}} = conn, _) do
	with :ok <- InstanceDocument.delete(document_name) do
	json(conn, %{})
	end
	end
	end
	diff --git a/lib/pleroma/web/admin_api/controllers/invite_controller.ex b/lib/pleroma/web/admin_api/controllers/invite_controller.ex
	index c5d759bb5..7e3020f28 100644
	--- a/lib/pleroma/web/admin_api/controllers/invite_controller.ex
	+++ b/lib/pleroma/web/admin_api/controllers/invite_controller.ex
	@@ -1,78 +1,84 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.InviteController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	alias Pleroma.Config
	alias Pleroma.UserInviteToken
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	require Logger

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
	plug(OAuthScopesPlug, %{scopes: ["admin:read:invites"]} when action == :index)

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:write:invites"]} when action in [:create, :revoke, :email]
	)

	action_fallback(Pleroma.Web.AdminAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.InviteOperation

	@doc "Get list of created invites"
	def index(conn, _params) do
	invites = UserInviteToken.list_invites()

	render(conn, "index.json", invites: invites)
	end

	@doc "Create an account registration invite token"
	- def create(%{body_params: params} = conn, _) do
	+ def create(%{private: %{open_api_spex: %{body_params: params}}} = conn, _) do
	{:ok, invite} = UserInviteToken.create_invite(params)

	render(conn, "show.json", invite: invite)
	end

	@doc "Revokes invite by token"
	- def revoke(%{body_params: %{token: token}} = conn, _) do
	+ def revoke(%{private: %{open_api_spex: %{body_params: %{token: token}}}} = conn, _) do
	with {:ok, invite} <- UserInviteToken.find_by_token(token),
	{:ok, updated_invite} = UserInviteToken.update_invite(invite, %{used: true}) do
	render(conn, "show.json", invite: updated_invite)
	else
	nil -> {:error, :not_found}
	error -> error
	end
	end

	@doc "Sends registration invite via email"
	- def email(%{assigns: %{user: user}, body_params: %{email: email} = params} = conn, _) do
	+ def email(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{body_params: %{email: email} = params}}
	+ } = conn,
	+ _
	+ ) do
	with {_, false} <- {:registrations_open, Config.get([:instance, :registrations_open])},
	{_, true} <- {:invites_enabled, Config.get([:instance, :invites_enabled])},
	{:ok, invite_token} <- UserInviteToken.create_invite(),
	{:ok, _} <-
	user
	\|> Pleroma.Emails.UserEmail.user_invitation_email(
	invite_token,
	email,
	params[:name]
	)
	\|> Pleroma.Emails.Mailer.deliver() do
	json_response(conn, :no_content, "")
	else
	{:registrations_open, _} ->
	{:error, "To send invites you need to set the `registrations_open` option to false."}

	{:invites_enabled, _} ->
	{:error, "To send invites you need to set the `invites_enabled` option to true."}

	{:error, error} ->
	{:error, error}
	end
	end
	end
	diff --git a/lib/pleroma/web/admin_api/controllers/media_proxy_cache_controller.ex b/lib/pleroma/web/admin_api/controllers/media_proxy_cache_controller.ex
	index 4d53f5451..8b43ea90f 100644
	--- a/lib/pleroma/web/admin_api/controllers/media_proxy_cache_controller.ex
	+++ b/lib/pleroma/web/admin_api/controllers/media_proxy_cache_controller.ex
	@@ -1,76 +1,83 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.MediaProxyCacheController do
	use Pleroma.Web, :controller

	alias Pleroma.Web.ApiSpec.Admin, as: Spec
	alias Pleroma.Web.MediaProxy
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	@cachex Pleroma.Config.get([:cachex, :provider], Cachex)

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:read:media_proxy_caches"]} when action in [:index]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:write:media_proxy_caches"]} when action in [:purge, :delete]
	)

	action_fallback(Pleroma.Web.AdminAPI.FallbackController)

	defdelegate open_api_operation(action), to: Spec.MediaProxyCacheOperation

	- def index(%{assigns: %{user: _}} = conn, params) do
	+ def index(%{assigns: %{user: _}, private: %{open_api_spex: %{params: params}}} = conn, _) do
	entries = fetch_entries(params)
	urls = paginate_entries(entries, params.page, params.page_size)

	render(conn, "index.json",
	urls: urls,
	page_size: params.page_size,
	count: length(entries)
	)
	end

	defp fetch_entries(params) do
	MediaProxy.cache_table()
	\|> @cachex.stream!(Cachex.Query.create(true, :key))
	\|> filter_entries(params[:query])
	end

	defp filter_entries(stream, query) when is_binary(query) do
	regex = ~r/#{query}/i

	stream
	\|> Enum.filter(fn url -> String.match?(url, regex) end)
	\|> Enum.to_list()
	end

	defp filter_entries(stream, _), do: Enum.to_list(stream)

	defp paginate_entries(entries, page, page_size) do
	offset = page_size * (page - 1)
	Enum.slice(entries, offset, page_size)
	end

	- def delete(%{assigns: %{user: _}, body_params: %{urls: urls}} = conn, _) do
	+ def delete(
	+ %{assigns: %{user: _}, private: %{open_api_spex: %{body_params: %{urls: urls}}}} = conn,
	+ _
	+ ) do
	MediaProxy.remove_from_banned_urls(urls)
	json(conn, %{})
	end

	- def purge(%{assigns: %{user: _}, body_params: %{urls: urls, ban: ban}} = conn, _) do
	+ def purge(
	+ %{assigns: %{user: _}, private: %{open_api_spex: %{body_params: %{urls: urls, ban: ban}}}} =
	+ conn,
	+ _
	+ ) do
	MediaProxy.Invalidation.purge(urls)

	if ban do
	MediaProxy.put_in_banned_urls(urls)
	end

	json(conn, %{})
	end
	end
	diff --git a/lib/pleroma/web/admin_api/controllers/relay_controller.ex b/lib/pleroma/web/admin_api/controllers/relay_controller.ex
	index 2e83fe139..1f36d3be5 100644
	--- a/lib/pleroma/web/admin_api/controllers/relay_controller.ex
	+++ b/lib/pleroma/web/admin_api/controllers/relay_controller.ex
	@@ -1,59 +1,71 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.RelayController do
	use Pleroma.Web, :controller

	alias Pleroma.ModerationLog
	alias Pleroma.Web.ActivityPub.Relay
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	require Logger

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:write:follows"]}
	when action in [:follow, :unfollow]
	)

	plug(OAuthScopesPlug, %{scopes: ["admin:read"]} when action == :index)

	action_fallback(Pleroma.Web.AdminAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.RelayOperation

	def index(conn, _params) do
	with {:ok, list} <- Relay.list() do
	json(conn, %{relays: list})
	end
	end

	- def follow(%{assigns: %{user: admin}, body_params: %{relay_url: target}} = conn, _) do
	+ def follow(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{relay_url: target}}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, _message} <- Relay.follow(target) do
	ModerationLog.insert_log(%{action: "relay_follow", actor: admin, target: target})

	json(conn, %{actor: target, followed_back: target in Relay.following()})
	else
	_ ->
	conn
	\|> put_status(500)
	\|> json(target)
	end
	end

	- def unfollow(%{assigns: %{user: admin}, body_params: %{relay_url: target} = params} = conn, _) do
	+ def unfollow(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{relay_url: target} = params}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, _message} <- Relay.unfollow(target, %{force: params[:force]}) do
	ModerationLog.insert_log(%{action: "relay_unfollow", actor: admin, target: target})

	json(conn, target)
	else
	_ ->
	conn
	\|> put_status(500)
	\|> json(target)
	end
	end
	end
	diff --git a/lib/pleroma/web/admin_api/controllers/report_controller.ex b/lib/pleroma/web/admin_api/controllers/report_controller.ex
	index 15cbbcc3e..89d8cc820 100644
	--- a/lib/pleroma/web/admin_api/controllers/report_controller.ex
	+++ b/lib/pleroma/web/admin_api/controllers/report_controller.ex
	@@ -1,114 +1,134 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.ReportController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	alias Pleroma.Activity
	alias Pleroma.ModerationLog
	alias Pleroma.ReportNote
	alias Pleroma.Web.ActivityPub.Utils
	alias Pleroma.Web.AdminAPI
	alias Pleroma.Web.AdminAPI.Report
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	require Logger

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
	plug(OAuthScopesPlug, %{scopes: ["admin:read:reports"]} when action in [:index, :show])

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:write:reports"]}
	when action in [:update, :notes_create, :notes_delete]
	)

	action_fallback(AdminAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.ReportOperation

	- def index(conn, params) do
	+ def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
	reports = Utils.get_reports(params, params.page, params.page_size)

	render(conn, "index.json", reports: reports)
	end

	- def show(conn, %{id: id}) do
	+ def show(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with %Activity{} = report <- Activity.get_report(id) do
	render(conn, "show.json", Report.extract_report_info(report))
	else
	_ -> {:error, :not_found}
	end
	end

	- def update(%{assigns: %{user: admin}, body_params: %{reports: reports}} = conn, _) do
	+ def update(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{reports: reports}}}
	+ } = conn,
	+ _
	+ ) do
	result =
	Enum.map(reports, fn report ->
	case CommonAPI.update_report_state(report.id, report.state) do
	{:ok, activity} ->
	report = Activity.get_by_id_with_user_actor(activity.id)

	ModerationLog.insert_log(%{
	action: "report_update",
	actor: admin,
	subject: activity,
	subject_actor: report.user_actor
	})

	activity

	{:error, message} ->
	%{id: report.id, error: message}
	end
	end)

	if Enum.any?(result, &Map.has_key?(&1, :error)) do
	json_response(conn, :bad_request, result)
	else
	json_response(conn, :no_content, "")
	end
	end

	- def notes_create(%{assigns: %{user: user}, body_params: %{content: content}} = conn, %{
	- id: report_id
	- }) do
	+ def notes_create(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{body_params: %{content: content}, params: %{id: report_id}}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, _} <- ReportNote.create(user.id, report_id, content),
	report <- Activity.get_by_id_with_user_actor(report_id) do
	ModerationLog.insert_log(%{
	action: "report_note",
	actor: user,
	subject: report,
	subject_actor: report.user_actor,
	text: content
	})

	json_response(conn, :no_content, "")
	else
	_ -> json_response(conn, :bad_request, "")
	end
	end

	- def notes_delete(%{assigns: %{user: user}} = conn, %{
	- id: note_id,
	- report_id: report_id
	- }) do
	+ def notes_delete(
	+ %{
	+ assigns: %{user: user},
	+ private: %{
	+ open_api_spex: %{
	+ params: %{
	+ id: note_id,
	+ report_id: report_id
	+ }
	+ }
	+ }
	+ } = conn,
	+ _
	+ ) do
	with {:ok, note} <- ReportNote.destroy(note_id),
	report <- Activity.get_by_id_with_user_actor(report_id) do
	ModerationLog.insert_log(%{
	action: "report_note_delete",
	actor: user,
	subject: report,
	subject_actor: report.user_actor,
	text: note.content
	})

	json_response(conn, :no_content, "")
	else
	_ -> json_response(conn, :bad_request, "")
	end
	end
	end
	diff --git a/lib/pleroma/web/admin_api/controllers/user_controller.ex b/lib/pleroma/web/admin_api/controllers/user_controller.ex
	index ed93af11c..9ac275396 100644
	--- a/lib/pleroma/web/admin_api/controllers/user_controller.ex
	+++ b/lib/pleroma/web/admin_api/controllers/user_controller.ex
	@@ -1,309 +1,372 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.UserController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [fetch_integer_param: 3]

	alias Pleroma.ModerationLog
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.AdminAPI
	alias Pleroma.Web.AdminAPI.Search
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	@users_page_size 50

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:read:accounts"]}
	when action in [:index, :show]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:write:accounts"]}
	when action in [
	:delete,
	:create,
	:toggle_activation,
	:activate,
	:deactivate,
	:approve,
	:suggest,
	:unsuggest
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["admin:write:follows"]}
	when action in [:follow, :unfollow]
	)

	action_fallback(AdminAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.UserOperation

	- def delete(conn, %{nickname: nickname}) do
	+ def delete(%{private: %{open_api_spex: %{params: %{nickname: nickname}}}} = conn, _) do
	conn
	- \|> Map.put(:body_params, %{nicknames: [nickname]})
	- \|> delete(%{})
	+ \|> do_deletes([nickname])
	end

	- def delete(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
	+ def delete(
	+ %{
	+ private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
	+ } = conn,
	+ _
	+ ) do
	+ conn
	+ \|> do_deletes(nicknames)
	+ end
	+
	+ defp do_deletes(%{assigns: %{user: admin}} = conn, nicknames) when is_list(nicknames) do
	users = Enum.map(nicknames, &User.get_cached_by_nickname/1)

	Enum.each(users, fn user ->
	{:ok, delete_data, _} = Builder.delete(admin, user.ap_id)
	Pipeline.common_pipeline(delete_data, local: true)
	end)

	ModerationLog.insert_log(%{
	actor: admin,
	subject: users,
	action: "delete"
	})

	json(conn, nicknames)
	end

	def follow(
	%{
	assigns: %{user: admin},
	- body_params: %{
	- follower: follower_nick,
	- followed: followed_nick
	+ private: %{
	+ open_api_spex: %{
	+ body_params: %{
	+ follower: follower_nick,
	+ followed: followed_nick
	+ }
	+ }
	}
	} = conn,
	_
	) do
	with %User{} = follower <- User.get_cached_by_nickname(follower_nick),
	%User{} = followed <- User.get_cached_by_nickname(followed_nick) do
	User.follow(follower, followed)

	ModerationLog.insert_log(%{
	actor: admin,
	followed: followed,
	follower: follower,
	action: "follow"
	})
	end

	json(conn, "ok")
	end

	def unfollow(
	%{
	assigns: %{user: admin},
	- body_params: %{
	- follower: follower_nick,
	- followed: followed_nick
	+ private: %{
	+ open_api_spex: %{
	+ body_params: %{
	+ follower: follower_nick,
	+ followed: followed_nick
	+ }
	+ }
	}
	} = conn,
	_
	) do
	with %User{} = follower <- User.get_cached_by_nickname(follower_nick),
	%User{} = followed <- User.get_cached_by_nickname(followed_nick) do
	User.unfollow(follower, followed)

	ModerationLog.insert_log(%{
	actor: admin,
	followed: followed,
	follower: follower,
	action: "unfollow"
	})
	end

	json(conn, "ok")
	end

	- def create(%{assigns: %{user: admin}, body_params: %{users: users}} = conn, _) do
	+ def create(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{users: users}}}
	+ } = conn,
	+ _
	+ ) do
	changesets =
	users
	\|> Enum.map(fn %{nickname: nickname, email: email, password: password} ->
	user_data = %{
	nickname: nickname,
	name: nickname,
	email: email,
	password: password,
	password_confirmation: password,
	bio: "."
	}

	User.register_changeset(%User{}, user_data, need_confirmation: false)
	end)
	\|> Enum.reduce(Ecto.Multi.new(), fn changeset, multi ->
	Ecto.Multi.insert(multi, Ecto.UUID.generate(), changeset)
	end)

	case Pleroma.Repo.transaction(changesets) do
	{:ok, users_map} ->
	users =
	users_map
	\|> Map.values()
	\|> Enum.map(fn user ->
	{:ok, user} = User.post_register_action(user)

	user
	end)

	ModerationLog.insert_log(%{
	actor: admin,
	subjects: users,
	action: "create"
	})

	render(conn, "created_many.json", users: users)

	{:error, id, changeset, _} ->
	changesets =
	Enum.map(changesets.operations, fn
	{^id, {:changeset, _current_changeset, _}} ->
	changeset

	{_, {:changeset, current_changeset, _}} ->
	current_changeset
	end)

	conn
	\|> put_status(:conflict)
	\|> render("create_errors.json", changesets: changesets)
	end
	end

	- def show(%{assigns: %{user: admin}} = conn, %{nickname: nickname}) do
	+ def show(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{params: %{nickname: nickname}}}
	+ } = conn,
	+ _
	+ ) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname, for: admin) do
	render(conn, "show.json", %{user: user})
	else
	_ -> {:error, :not_found}
	end
	end

	- def toggle_activation(%{assigns: %{user: admin}} = conn, %{nickname: nickname}) do
	+ def toggle_activation(
	+ %{assigns: %{user: admin}, private: %{open_api_spex: %{params: %{nickname: nickname}}}} =
	+ conn,
	+ _
	+ ) do
	user = User.get_cached_by_nickname(nickname)

	{:ok, updated_user} = User.set_activation(user, !user.is_active)

	action = if !user.is_active, do: "activate", else: "deactivate"

	ModerationLog.insert_log(%{
	actor: admin,
	subject: [user],
	action: action
	})

	render(conn, "show.json", user: updated_user)
	end

	- def activate(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
	+ def activate(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
	+ } = conn,
	+ _
	+ ) do
	users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
	{:ok, updated_users} = User.set_activation(users, true)

	ModerationLog.insert_log(%{
	actor: admin,
	subject: users,
	action: "activate"
	})

	render(conn, "index.json", users: updated_users)
	end

	- def deactivate(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
	+ def deactivate(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
	+ } = conn,
	+ _
	+ ) do
	users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
	{:ok, updated_users} = User.set_activation(users, false)

	ModerationLog.insert_log(%{
	actor: admin,
	subject: users,
	action: "deactivate"
	})

	render(conn, "index.json", users: updated_users)
	end

	- def approve(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
	+ def approve(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
	+ } = conn,
	+ _
	+ ) do
	users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
	{:ok, updated_users} = User.approve(users)

	ModerationLog.insert_log(%{
	actor: admin,
	subject: users,
	action: "approve"
	})

	render(conn, "index.json", users: updated_users)
	end

	- def suggest(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
	+ def suggest(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
	+ } = conn,
	+ _
	+ ) do
	users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
	{:ok, updated_users} = User.set_suggestion(users, true)

	ModerationLog.insert_log(%{
	actor: admin,
	subject: users,
	action: "add_suggestion"
	})

	render(conn, "index.json", users: updated_users)
	end

	- def unsuggest(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
	+ def unsuggest(
	+ %{
	+ assigns: %{user: admin},
	+ private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
	+ } = conn,
	+ _
	+ ) do
	users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
	{:ok, updated_users} = User.set_suggestion(users, false)

	ModerationLog.insert_log(%{
	actor: admin,
	subject: users,
	action: "remove_suggestion"
	})

	render(conn, "index.json", users: updated_users)
	end

	- def index(conn, params) do
	+ def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
	{page, page_size} = page_params(params)
	filters = maybe_parse_filters(params[:filters])

	search_params =
	%{
	query: params[:query],
	page: page,
	page_size: page_size,
	tags: params[:tags],
	name: params[:name],
	email: params[:email],
	actor_types: params[:actor_types]
	}
	\|> Map.merge(filters)

	with {:ok, users, count} <- Search.user(search_params) do
	render(conn, "index.json", users: users, count: count, page_size: page_size)
	end
	end

	@filters ~w(local external active deactivated need_approval unconfirmed is_admin is_moderator)

	@spec maybe_parse_filters(String.t()) :: %{required(String.t()) => true} \| %{}
	defp maybe_parse_filters(filters) when is_nil(filters) or filters == "", do: %{}

	defp maybe_parse_filters(filters) do
	filters
	\|> String.split(",")
	\|> Enum.filter(&Enum.member?(@filters, &1))
	\|> Map.new(&{String.to_existing_atom(&1), true})
	end

	defp page_params(params) do
	{
	fetch_integer_param(params, :page, 1),
	fetch_integer_param(params, :page_size, @users_page_size)
	}
	end
	end
	diff --git a/lib/pleroma/web/controller_helper.ex b/lib/pleroma/web/controller_helper.ex
	index 36f7442b3..d3cf372dc 100644
	--- a/lib/pleroma/web/controller_helper.ex
	+++ b/lib/pleroma/web/controller_helper.ex
	@@ -1,115 +1,120 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ControllerHelper do
	use Pleroma.Web, :controller

	alias Pleroma.Pagination
	alias Pleroma.Web.Utils.Params

	def json_response(conn, status, _) when status in [204, :no_content] do
	conn
	\|> put_resp_header("content-type", "application/json")
	\|> send_resp(status, "")
	end

	def json_response(conn, status, json) do
	conn
	\|> put_status(status)
	\|> json(json)
	end

	@spec fetch_integer_param(map(), String.t(), integer() \| nil) :: integer() \| nil
	def fetch_integer_param(params, name, default \\ nil) do
	params
	\|> Map.get(name, default)
	\|> param_to_integer(default)
	end

	defp param_to_integer(val, _) when is_integer(val), do: val

	defp param_to_integer(val, default) when is_binary(val) do
	case Integer.parse(val) do
	{res, _} -> res
	_ -> default
	end
	end

	defp param_to_integer(_, default), do: default

	def add_link_headers(conn, entries, extra_params \\ %{})

	def add_link_headers(%{assigns: %{skip_link_headers: true}} = conn, _entries, _extra_params),
	do: conn

	def add_link_headers(conn, entries, extra_params) do
	case get_pagination_fields(conn, entries, extra_params) do
	%{"next" => next_url, "prev" => prev_url} ->
	put_resp_header(conn, "link", "<#{next_url}>; rel=\"next\", <#{prev_url}>; rel=\"prev\"")

	_ ->
	conn
	end
	end

	+ # TODO: Only fetch the params from open_api_spex when everything is converted
	@id_keys Pagination.page_keys() -- ["limit", "order"]
	defp build_pagination_fields(conn, min_id, max_id, extra_params) do
	params =
	- conn.params
	+ if Map.has_key?(conn.private, :open_api_spex) do
	+ get_in(conn, [Access.key(:private), Access.key(:open_api_spex), Access.key(:params)])
	+ else
	+ conn.params
	+ end
	\|> Map.drop(Map.keys(conn.path_params) \|> Enum.map(&String.to_existing_atom/1))
	\|> Map.merge(extra_params)
	\|> Map.drop(@id_keys)

	%{
	"next" => current_url(conn, Map.put(params, :max_id, max_id)),
	"prev" => current_url(conn, Map.put(params, :min_id, min_id)),
	"id" => current_url(conn)
	}
	end

	def get_pagination_fields(conn, entries, extra_params \\ %{}) do
	case List.last(entries) do
	%{pagination_id: max_id} when not is_nil(max_id) ->
	%{pagination_id: min_id} = List.first(entries)

	build_pagination_fields(conn, min_id, max_id, extra_params)

	%{id: max_id} ->
	%{id: min_id} = List.first(entries)

	build_pagination_fields(conn, min_id, max_id, extra_params)

	_ ->
	%{}
	end
	end

	- def assign_account_by_id(conn, _) do
	- case Pleroma.User.get_cached_by_id(conn.params.id) do
	+ def assign_account_by_id(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	+ case Pleroma.User.get_cached_by_id(id) do
	%Pleroma.User{} = account -> assign(conn, :account, account)
	nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) \|> halt()
	end
	end

	def try_render(conn, target, params) when is_binary(target) do
	render(conn, target, params)
	end

	def try_render(conn, _, _) do
	render_error(conn, :not_implemented, "Can't display this activity")
	end

	@doc """
	Returns true if request specifies to include embedded relationships in account objects.
	May only be used in selected account-related endpoints; has no effect for status- or
	notification-related endpoints.
	"""
	# Intended for PleromaFE: https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838
	def embed_relationships?(params) do
	# To do once OpenAPI transition mess is over: just `truthy_param?(params[:with_relationships])`
	params
	\|> Map.get(:with_relationships, params["with_relationships"])
	\|> Params.truthy_param?()
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	index 1b5de4b45..9226a2deb 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	@@ -1,593 +1,634 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [
	add_link_headers: 2,
	assign_account_by_id: 2,
	embed_relationships?: 1,
	json_response: 3
	]

	alias Pleroma.Maps
	alias Pleroma.User
	alias Pleroma.UserNote
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Builder
	alias Pleroma.Web.ActivityPub.Pipeline
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.ListView
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	alias Pleroma.Web.MastodonAPI.MastodonAPIController
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.OAuth.OAuthController
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter
	alias Pleroma.Web.TwitterAPI.TwitterAPI
	alias Pleroma.Web.Utils.Params

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(:skip_auth when action in [:create, :lookup])

	plug(:skip_public_check when action in [:show, :statuses])

	plug(
	OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["read:accounts"]}
	when action in [:show, :followers, :following]
	)

	plug(
	OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["read:statuses"]}
	when action == :statuses
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:accounts"]}
	when action in [:verify_credentials, :endorsements, :identity_proofs]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:accounts"]}
	when action in [:update_credentials, :note, :endorse, :unendorse]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :lists)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "read:blocks"]} when action == :blocks
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:blocks"]} when action in [:block, :unblock]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:follows"]} when action == :relationships)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]}
	when action in [:follow_by_uri, :follow, :unfollow, :remove_from_followers]
	)

	plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)

	plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])

	@relationship_actions [:follow, :unfollow, :remove_from_followers]
	@needs_account ~W(
	followers following lists follow unfollow mute unmute block unblock
	note endorse unendorse remove_from_followers
	)a

	plug(
	RateLimiter,
	- [name: :relation_id_action, params: [:id, :uri]] when action in @relationship_actions
	+ [name: :relation_id_action, params: ["id", "uri"]] when action in @relationship_actions
	)

	plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
	plug(RateLimiter, [name: :app_account_creation] when action == :create)
	plug(:assign_account_by_id when action in @needs_account)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AccountOperation

	@doc "POST /api/v1/accounts"
	- def create(%{assigns: %{app: app}, body_params: params} = conn, _params) do
	+ def create(
	+ %{assigns: %{app: app}, private: %{open_api_spex: %{body_params: params}}} = conn,
	+ _params
	+ ) do
	with :ok <- validate_email_param(params),
	:ok <- TwitterAPI.validate_captcha(app, params),
	{:ok, user} <- TwitterAPI.register_user(params),
	{_, {:ok, token}} <-
	{:login, OAuthController.login(user, app, app.scopes)} do
	OAuthController.after_token_exchange(conn, %{user: user, token: token})
	else
	{:login, {:account_status, :confirmation_pending}} ->
	json_response(conn, :ok, %{
	message: "You have been registered. Please check your email for further instructions.",
	identifier: "missing_confirmed_email"
	})

	{:login, {:account_status, :approval_pending}} ->
	json_response(conn, :ok, %{
	message:
	"You have been registered. You'll be able to log in once your account is approved.",
	identifier: "awaiting_approval"
	})

	{:login, _} ->
	json_response(conn, :ok, %{
	message:
	"You have been registered. Some post-registration steps may be pending. " <>
	"Please log in manually.",
	identifier: "manual_login_required"
	})

	{:error, error} ->
	json_response(conn, :bad_request, %{error: error})
	end
	end

	def create(%{assigns: %{app: _app}} = conn, _) do
	render_error(conn, :bad_request, "Missing parameters")
	end

	def create(conn, _) do
	render_error(conn, :forbidden, "Invalid credentials")
	end

	defp validate_email_param(%{email: email}) when not is_nil(email), do: :ok

	defp validate_email_param(_) do
	case Pleroma.Config.get([:instance, :account_activation_required]) do
	true -> {:error, dgettext("errors", "Missing parameter: %{name}", name: "email")}
	_ -> :ok
	end
	end

	@doc "GET /api/v1/accounts/verify_credentials"
	def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	chat_token = Phoenix.Token.sign(conn, "user socket", user.id)

	render(conn, "show.json",
	user: user,
	for: user,
	with_pleroma_settings: true,
	with_chat_token: chat_token
	)
	end

	@doc "PATCH /api/v1/accounts/update_credentials"
	- def update_credentials(%{assigns: %{user: user}, body_params: params} = conn, _params) do
	+ def update_credentials(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn,
	+ _params
	+ ) do
	params =
	params
	\|> Enum.filter(fn {_, value} -> not is_nil(value) end)
	\|> Enum.into(%{})

	# We use an empty string as a special value to reset
	# avatars, banners, backgrounds
	user_image_value = fn
	"" -> {:ok, nil}
	value -> {:ok, value}
	end

	user_params =
	[
	:no_rich_text,
	:hide_followers_count,
	:hide_follows_count,
	:hide_followers,
	:hide_follows,
	:hide_favorites,
	:show_role,
	:skip_thread_containment,
	:allow_following_move,
	:also_known_as,
	:accepts_chat_messages,
	:show_birthday
	]
	\|> Enum.reduce(%{}, fn key, acc ->
	Maps.put_if_present(acc, key, params[key], &{:ok, Params.truthy_param?(&1)})
	end)
	\|> Maps.put_if_present(:name, params[:display_name])
	\|> Maps.put_if_present(:bio, params[:note])
	\|> Maps.put_if_present(:raw_bio, params[:note])
	\|> Maps.put_if_present(:avatar, params[:avatar], user_image_value)
	\|> Maps.put_if_present(:banner, params[:header], user_image_value)
	\|> Maps.put_if_present(:background, params[:pleroma_background_image], user_image_value)
	\|> Maps.put_if_present(
	:raw_fields,
	params[:fields_attributes],
	&{:ok, normalize_fields_attributes(&1)}
	)
	\|> Maps.put_if_present(:pleroma_settings_store, params[:pleroma_settings_store])
	\|> Maps.put_if_present(:default_scope, params[:default_scope])
	\|> Maps.put_if_present(:default_scope, params["source"]["privacy"])
	\|> Maps.put_if_present(:actor_type, params[:bot], fn bot ->
	if bot, do: {:ok, "Service"}, else: {:ok, "Person"}
	end)
	\|> Maps.put_if_present(:actor_type, params[:actor_type])
	\|> Maps.put_if_present(:also_known_as, params[:also_known_as])
	# Note: param name is indeed :locked (not an error)
	\|> Maps.put_if_present(:is_locked, params[:locked])
	# Note: param name is indeed :discoverable (not an error)
	\|> Maps.put_if_present(:is_discoverable, params[:discoverable])
	\|> Maps.put_if_present(:birthday, params[:birthday])
	\|> Maps.put_if_present(:language, Pleroma.Web.Gettext.normalize_locale(params[:language]))

	# What happens here:
	#
	# We want to update the user through the pipeline, but the ActivityPub
	# update information is not quite enough for this, because this also
	# contains local settings that don't federate and don't even appear
	# in the Update activity.
	#
	# So we first build the normal local changeset, then apply it to the
	# user data, but don't persist it. With this, we generate the object
	# data for our update activity. We feed this and the changeset as meta
	# information into the pipeline, where they will be properly updated and
	# federated.
	with changeset <- User.update_changeset(user, user_params),
	{:ok, unpersisted_user} <- Ecto.Changeset.apply_action(changeset, :update),
	updated_object <-
	Pleroma.Web.ActivityPub.UserView.render("user.json", user: unpersisted_user)
	\|> Map.delete("@context"),
	{:ok, update_data, []} <- Builder.update(user, updated_object),
	{:ok, _update, _} <-
	Pipeline.common_pipeline(update_data,
	local: true,
	user_update_changeset: changeset
	) do
	render(conn, "show.json",
	user: unpersisted_user,
	for: unpersisted_user,
	with_pleroma_settings: true
	)
	else
	{:error, %Ecto.Changeset{errors: [avatar: {"file is too large", _}]}} ->
	render_error(conn, :request_entity_too_large, "File is too large")

	{:error, %Ecto.Changeset{errors: [banner: {"file is too large", _}]}} ->
	render_error(conn, :request_entity_too_large, "File is too large")

	{:error, %Ecto.Changeset{errors: [background: {"file is too large", _}]}} ->
	render_error(conn, :request_entity_too_large, "File is too large")

	{:error, %Ecto.Changeset{errors: [{:bio, {_, _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "Bio is too long")

	{:error, %Ecto.Changeset{errors: [{:name, {_, _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "Name is too long")

	{:error, %Ecto.Changeset{errors: [{:fields, {"invalid", _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "One or more field entries are too long")

	{:error, %Ecto.Changeset{errors: [{:fields, {_, _}} \| _]}} ->
	render_error(conn, :request_entity_too_large, "Too many field entries")

	_e ->
	render_error(conn, :forbidden, "Invalid request")
	end
	end

	defp normalize_fields_attributes(fields) do
	if(Enum.all?(fields, &is_tuple/1), do: Enum.map(fields, fn {_, v} -> v end), else: fields)
	\|> Enum.map(fn
	%{} = field -> %{"name" => field.name, "value" => field.value}
	field -> field
	end)
	end

	@doc "GET /api/v1/accounts/relationships"
	- def relationships(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def relationships(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	+ _
	+ ) do
	targets = User.get_all_by_ids(List.wrap(id))

	render(conn, "relationships.json", user: user, targets: targets)
	end

	# Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])

	@doc "GET /api/v1/accounts/:id"
	- def show(%{assigns: %{user: for_user}} = conn, %{id: nickname_or_id} = params) do
	+ def show(
	+ %{
	+ assigns: %{user: for_user},
	+ private: %{open_api_spex: %{params: %{id: nickname_or_id} = params}}
	+ } = conn,
	+ _params
	+ ) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
	:visible <- User.visible_for(user, for_user) do
	render(conn, "show.json",
	user: user,
	for: for_user,
	embed_relationships: embed_relationships?(params)
	)
	else
	error -> user_visibility_error(conn, error)
	end
	end

	@doc "GET /api/v1/accounts/:id/statuses"
	- def statuses(%{assigns: %{user: reading_user}} = conn, params) do
	+ def statuses(
	+ %{assigns: %{user: reading_user}, private: %{open_api_spex: %{params: params}}} = conn,
	+ _params
	+ ) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(params.id, for: reading_user),
	:visible <- User.visible_for(user, reading_user) do
	params =
	params
	\|> Map.delete(:tagged)
	\|> Map.put(:tag, params[:tagged])

	activities = ActivityPub.fetch_user_activities(user, reading_user, params)

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json",
	activities: activities,
	for: reading_user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	error -> user_visibility_error(conn, error)
	end
	end

	defp user_visibility_error(conn, error) do
	case error do
	:restrict_unauthenticated ->
	render_error(conn, :unauthorized, "This API requires an authenticated user")

	_ ->
	render_error(conn, :not_found, "Can't find user")
	end
	end

	@doc "GET /api/v1/accounts/:id/followers"
	- def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
	+ def followers(
	+ %{assigns: %{user: for_user, account: user}, private: %{open_api_spex: %{params: params}}} =
	+ conn,
	+ _params
	+ ) do
	params =
	params
	\|> Enum.map(fn {key, value} -> {to_string(key), value} end)
	\|> Enum.into(%{})

	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_followers(user, params)
	user.hide_followers -> []
	true -> MastodonAPI.get_followers(user, params)
	end

	conn
	\|> add_link_headers(followers)
	# https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
	\|> render("index.json",
	for: for_user,
	users: followers,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/accounts/:id/following"
	- def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
	+ def following(
	+ %{assigns: %{user: for_user, account: user}, private: %{open_api_spex: %{params: params}}} =
	+ conn,
	+ _params
	+ ) do
	params =
	params
	\|> Enum.map(fn {key, value} -> {to_string(key), value} end)
	\|> Enum.into(%{})

	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_friends(user, params)
	user.hide_follows -> []
	true -> MastodonAPI.get_friends(user, params)
	end

	conn
	\|> add_link_headers(followers)
	# https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
	\|> render("index.json",
	for: for_user,
	users: followers,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/accounts/:id/lists"
	def lists(%{assigns: %{user: user, account: account}} = conn, _params) do
	lists = Pleroma.List.get_lists_account_belongs(user, account)

	conn
	\|> put_view(ListView)
	\|> render("index.json", lists: lists)
	end

	@doc "POST /api/v1/accounts/:id/follow"
	def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not follow yourself"}
	end

	- def follow(%{body_params: params, assigns: %{user: follower, account: followed}} = conn, _) do
	+ def follow(
	+ %{
	+ assigns: %{user: follower, account: followed},
	+ private: %{open_api_spex: %{body_params: params}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, follower} <- MastodonAPI.follow(follower, followed, params) do
	render(conn, "relationship.json", user: follower, target: followed)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unfollow"
	def unfollow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not unfollow yourself"}
	end

	def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.unfollow(follower, followed) do
	render(conn, "relationship.json", user: follower, target: followed)
	end
	end

	@doc "POST /api/v1/accounts/:id/mute"
	- def mute(%{assigns: %{user: muter, account: muted}, body_params: params} = conn, _params) do
	+ def mute(
	+ %{
	+ assigns: %{user: muter, account: muted},
	+ private: %{open_api_spex: %{body_params: params}}
	+ } = conn,
	+ _params
	+ ) do
	params =
	params
	\|> Map.put_new(:duration, Map.get(params, :expires_in, 0))

	with {:ok, _user_relationships} <- User.mute(muter, muted, params) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unmute"
	def unmute(%{assigns: %{user: muter, account: muted}} = conn, _params) do
	with {:ok, _user_relationships} <- User.unmute(muter, muted) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/block"
	def block(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _activity} <- CommonAPI.block(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unblock"
	def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _activity} <- CommonAPI.unblock(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/note"
	def note(
	- %{assigns: %{user: noter, account: target}, body_params: %{comment: comment}} = conn,
	+ %{
	+ assigns: %{user: noter, account: target},
	+ private: %{open_api_spex: %{body_params: %{comment: comment}}}
	+ } = conn,
	_params
	) do
	with {:ok, _user_note} <- UserNote.create(noter, target, comment) do
	render(conn, "relationship.json", user: noter, target: target)
	end
	end

	@doc "POST /api/v1/accounts/:id/pin"
	def endorse(%{assigns: %{user: endorser, account: endorsed}} = conn, _params) do
	with {:ok, _user_relationships} <- User.endorse(endorser, endorsed) do
	render(conn, "relationship.json", user: endorser, target: endorsed)
	else
	{:error, message} -> json_response(conn, :bad_request, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unpin"
	def unendorse(%{assigns: %{user: endorser, account: endorsed}} = conn, _params) do
	with {:ok, _user_relationships} <- User.unendorse(endorser, endorsed) do
	render(conn, "relationship.json", user: endorser, target: endorsed)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/remove_from_followers"
	def remove_from_followers(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, "Can not unfollow yourself"}
	end

	def remove_from_followers(%{assigns: %{user: followed, account: follower}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.reject_follow_request(follower, followed) do
	render(conn, "relationship.json", user: followed, target: follower)
	else
	nil ->
	render_error(conn, :not_found, "Record not found")
	end
	end

	@doc "POST /api/v1/follows"
	- def follow_by_uri(%{body_params: %{uri: uri}} = conn, _) do
	+ def follow_by_uri(%{private: %{open_api_spex: %{body_params: %{uri: uri}}}} = conn, _) do
	case User.get_cached_by_nickname(uri) do
	%User{} = user ->
	conn
	\|> assign(:account, user)
	\|> follow(%{})

	nil ->
	{:error, :not_found}
	end
	end

	@doc "GET /api/v1/mutes"
	def mutes(%{assigns: %{user: user}} = conn, params) do
	users =
	user
	\|> User.muted_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(users)
	\|> render("index.json",
	users: users,
	for: user,
	as: :user,
	embed_relationships: embed_relationships?(params),
	mutes: true
	)
	end

	@doc "GET /api/v1/blocks"
	def blocks(%{assigns: %{user: user}} = conn, params) do
	users =
	user
	\|> User.blocked_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(users)
	\|> render("index.json",
	users: users,
	for: user,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/accounts/lookup"
	- def lookup(conn, %{acct: nickname} = _params) do
	+ def lookup(%{private: %{open_api_spex: %{params: %{acct: nickname}}}} = conn, _params) do
	with %User{} = user <- User.get_by_nickname(nickname) do
	render(conn, "show.json",
	user: user,
	skip_visibility_check: true
	)
	else
	error -> user_visibility_error(conn, error)
	end
	end

	@doc "GET /api/v1/endorsements"
	def endorsements(%{assigns: %{user: user}} = conn, params) do
	users =
	user
	\|> User.endorsed_users_relation(_restrict_deactivated = true)
	\|> Pleroma.Repo.all()

	conn
	\|> render("index.json",
	users: users,
	for: user,
	as: :user,
	embed_relationships: embed_relationships?(params)
	)
	end

	@doc "GET /api/v1/identity_proofs"
	def identity_proofs(conn, params), do: MastodonAPIController.empty_array(conn, params)
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/follow_request_controller.ex b/lib/pleroma/web/mastodon_api/controllers/follow_request_controller.ex
	index ba6d074cc..6eee55d1b 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/follow_request_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/follow_request_controller.ex
	@@ -1,59 +1,59 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.FollowRequestController do
	use Pleroma.Web, :controller

	alias Pleroma.User
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
	plug(:assign_follower when action != :index)

	action_fallback(:errors)

	plug(OAuthScopesPlug, %{scopes: ["follow", "read:follows"]} when action == :index)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]} when action != :index
	)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.FollowRequestOperation

	@doc "GET /api/v1/follow_requests"
	def index(%{assigns: %{user: followed}} = conn, _params) do
	follow_requests = User.get_follow_requests(followed)

	render(conn, "index.json", for: followed, users: follow_requests, as: :user)
	end

	@doc "POST /api/v1/follow_requests/:id/authorize"
	def authorize(%{assigns: %{user: followed, follower: follower}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.accept_follow_request(follower, followed) do
	render(conn, "relationship.json", user: followed, target: follower)
	end
	end

	@doc "POST /api/v1/follow_requests/:id/reject"
	def reject(%{assigns: %{user: followed, follower: follower}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.reject_follow_request(follower, followed) do
	render(conn, "relationship.json", user: followed, target: follower)
	end
	end

	- defp assign_follower(%{params: %{id: id}} = conn, _) do
	+ defp assign_follower(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	case User.get_cached_by_id(id) do
	%User{} = follower -> assign(conn, :follower, follower)
	nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) \|> halt()
	end
	end

	defp errors(conn, {:error, message}) do
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: message})
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/list_controller.ex b/lib/pleroma/web/mastodon_api/controllers/list_controller.ex
	index 2117aae3a..3bfc365a5 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/list_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/list_controller.ex
	@@ -1,99 +1,125 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.ListController do
	use Pleroma.Web, :controller

	alias Pleroma.User
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	@oauth_read_actions [:index, :show, :list_accounts]

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
	plug(:list_by_id_and_user when action not in [:index, :create])
	plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action in @oauth_read_actions)
	plug(OAuthScopesPlug, %{scopes: ["write:lists"]} when action not in @oauth_read_actions)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ListOperation

	# GET /api/v1/lists
	- def index(%{assigns: %{user: user}} = conn, opts) do
	- lists = Pleroma.List.for_user(user, opts)
	+ def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
	+ lists = Pleroma.List.for_user(user, params)
	render(conn, "index.json", lists: lists)
	end

	# POST /api/v1/lists
	- def create(%{assigns: %{user: user}, body_params: %{title: title}} = conn, _) do
	+ def create(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{title: title}}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, %Pleroma.List{} = list} <- Pleroma.List.create(title, user) do
	render(conn, "show.json", list: list)
	end
	end

	- # GET /api/v1/lists/:id
	+ # GET /api/v1/lists/:idOB
	def show(%{assigns: %{list: list}} = conn, _) do
	render(conn, "show.json", list: list)
	end

	# PUT /api/v1/lists/:id
	- def update(%{assigns: %{list: list}, body_params: %{title: title}} = conn, _) do
	+ def update(
	+ %{assigns: %{list: list}, private: %{open_api_spex: %{body_params: %{title: title}}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, list} <- Pleroma.List.rename(list, title) do
	render(conn, "show.json", list: list)
	end
	end

	# DELETE /api/v1/lists/:id
	def delete(%{assigns: %{list: list}} = conn, _) do
	with {:ok, _list} <- Pleroma.List.delete(list) do
	json(conn, %{})
	end
	end

	# GET /api/v1/lists/:id/accounts
	def list_accounts(%{assigns: %{user: user, list: list}} = conn, _) do
	with {:ok, users} <- Pleroma.List.get_following(list) do
	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	end
	end

	# POST /api/v1/lists/:id/accounts
	- def add_to_list(%{assigns: %{list: list}, body_params: %{account_ids: account_ids}} = conn, _) do
	+ def add_to_list(
	+ %{
	+ assigns: %{list: list},
	+ private: %{open_api_spex: %{body_params: %{account_ids: account_ids}}}
	+ } = conn,
	+ _
	+ ) do
	Enum.each(account_ids, fn account_id ->
	with %User{} = followed <- User.get_cached_by_id(account_id) do
	Pleroma.List.follow(list, followed)
	end
	end)

	json(conn, %{})
	end

	# DELETE /api/v1/lists/:id/accounts
	def remove_from_list(
	- %{assigns: %{list: list}, params: %{account_ids: account_ids}} = conn,
	+ %{
	+ private: %{open_api_spex: %{params: %{account_ids: account_ids}}}
	+ } = conn,
	_
	) do
	+ do_remove_from_list(conn, account_ids)
	+ end
	+
	+ def remove_from_list(
	+ %{private: %{open_api_spex: %{body_params: %{account_ids: account_ids}}}} = conn,
	+ _
	+ ) do
	+ do_remove_from_list(conn, account_ids)
	+ end
	+
	+ defp do_remove_from_list(%{assigns: %{list: list}} = conn, account_ids) do
	Enum.each(account_ids, fn account_id ->
	with %User{} = followed <- User.get_cached_by_id(account_id) do
	Pleroma.List.unfollow(list, followed)
	end
	end)

	json(conn, %{})
	end

	- def remove_from_list(%{body_params: params} = conn, _) do
	- remove_from_list(%{conn \| params: params}, %{})
	- end
	-
	- defp list_by_id_and_user(%{assigns: %{user: user}, params: %{id: id}} = conn, _) do
	+ defp list_by_id_and_user(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	+ _
	+ ) do
	case Pleroma.List.get(id, user) do
	%Pleroma.List{} = list -> assign(conn, :list, list)
	nil -> conn \|> render_error(:not_found, "List not found") \|> halt()
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
	index 7d9a63cf4..056bad844 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
	@@ -1,80 +1,96 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MediaController do
	use Pleroma.Web, :controller

	alias Pleroma.Object
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
	plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:create, :create2])
	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(OAuthScopesPlug, %{scopes: ["read:media"]} when action == :show)
	plug(OAuthScopesPlug, %{scopes: ["write:media"]} when action != :show)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.MediaOperation

	@doc "POST /api/v1/media"
	- def create(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
	+ def create(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file} = data}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, :description)
	) do
	attachment_data = Map.put(object.data, "id", object.id)

	render(conn, "attachment.json", %{attachment: attachment_data})
	end
	end

	def create(_conn, _data), do: {:error, :bad_request}

	@doc "POST /api/v2/media"
	- def create2(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
	+ def create2(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file} = data}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, object} <-
	ActivityPub.upload(
	file,
	actor: User.ap_id(user),
	description: Map.get(data, :description)
	) do
	attachment_data = Map.put(object.data, "id", object.id)

	conn
	\|> put_status(202)
	\|> render("attachment.json", %{attachment: attachment_data})
	end
	end

	def create2(_conn, _data), do: {:error, :bad_request}

	@doc "PUT /api/v1/media/:id"
	- def update(%{assigns: %{user: user}, body_params: %{description: description}} = conn, %{id: id}) do
	+ def update(
	+ %{
	+ assigns: %{user: user},
	+ private: %{
	+ open_api_spex: %{body_params: %{description: description}, params: %{id: id}}
	+ }
	+ } = conn,
	+ _
	+ ) do
	with %Object{} = object <- Object.get_by_id(id),
	:ok <- Object.authorize_access(object, user),
	{:ok, %Object{data: data}} <- Object.update_data(object, %{"name" => description}) do
	attachment_data = Map.put(data, "id", object.id)

	render(conn, "attachment.json", %{attachment: attachment_data})
	end
	end

	def update(conn, data), do: show(conn, data)

	@doc "GET /api/v1/media/:id"
	- def show(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with %Object{data: data, id: object_id} = object <- Object.get_by_id(id),
	:ok <- Object.authorize_access(object, user) do
	attachment_data = Map.put(data, "id", object_id)

	render(conn, "attachment.json", %{attachment: attachment_data})
	end
	end

	def show(_conn, _data), do: {:error, :bad_request}
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex b/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
	index a490e8319..e305aea94 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
	@@ -1,112 +1,127 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.NotificationController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]

	alias Pleroma.Notification
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	@oauth_read_actions [:show, :index]

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:notifications"]} when action in @oauth_read_actions
	)

	plug(OAuthScopesPlug, %{scopes: ["write:notifications"]} when action not in @oauth_read_actions)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.NotificationOperation

	+ @default_notification_types ~w{
	+ mention
	+ follow
	+ follow_request
	+ reblog
	+ favourite
	+ move
	+ pleroma:emoji_reaction
	+ poll
	+ update
	+ }
	+
	# GET /api/v1/notifications
	- def index(conn, %{account_id: account_id} = params) do
	+ def index(%{private: %{open_api_spex: %{params: %{account_id: account_id} = params}}} = conn, _) do
	case Pleroma.User.get_cached_by_id(account_id) do
	%{ap_id: account_ap_id} ->
	params =
	params
	\|> Map.delete(:account_id)
	\|> Map.put(:account_ap_id, account_ap_id)

	- index(conn, params)
	+ do_get_notifications(conn, params)

	_ ->
	conn
	\|> put_status(:not_found)
	\|> json(%{"error" => "Account is not found"})
	end
	end

	- @default_notification_types ~w{
	- mention
	- follow
	- follow_request
	- reblog
	- favourite
	- move
	- pleroma:emoji_reaction
	- poll
	- update
	- }
	- def index(%{assigns: %{user: user}} = conn, params) do
	+ def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
	+ do_get_notifications(conn, params)
	+ end
	+
	+ defp do_get_notifications(%{assigns: %{user: user}} = conn, params) do
	params =
	Map.new(params, fn {k, v} -> {to_string(k), v} end)
	\|> Map.put_new("types", Map.get(params, :include_types, @default_notification_types))

	notifications = MastodonAPI.get_notifications(user, params)

	conn
	\|> add_link_headers(notifications)
	\|> render("index.json",
	notifications: notifications,
	for: user
	)
	end

	# GET /api/v1/notifications/:id
	- def show(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with {:ok, notification} <- Notification.get(user, id) do
	render(conn, "show.json", notification: notification, for: user)
	else
	{:error, reason} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{"error" => reason})
	end
	end

	# POST /api/v1/notifications/clear
	def clear(%{assigns: %{user: user}} = conn, _params) do
	Notification.clear(user)
	json(conn, %{})
	end

	# POST /api/v1/notifications/:id/dismiss

	- def dismiss(%{assigns: %{user: user}} = conn, %{id: id} = _params) do
	- with {:ok, _notif} <- Notification.dismiss(user, id) do
	+ def dismiss(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	+ do_dismiss(conn, id)
	+ end
	+
	+ # POST /api/v1/notifications/dismiss (deprecated)
	+ def dismiss_via_body(
	+ %{private: %{open_api_spex: %{body_params: %{id: id}}}} = conn,
	+ _
	+ ) do
	+ do_dismiss(conn, id)
	+ end
	+
	+ defp do_dismiss(%{assigns: %{user: user}} = conn, notification_id) do
	+ with {:ok, _notif} <- Notification.dismiss(user, notification_id) do
	json(conn, %{})
	else
	{:error, reason} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{"error" => reason})
	end
	end

	- # POST /api/v1/notifications/dismiss (deprecated)
	- def dismiss_via_body(%{body_params: params} = conn, _) do
	- dismiss(conn, params)
	- end
	-
	# DELETE /api/v1/notifications/destroy_multiple
	- def destroy_multiple(%{assigns: %{user: user}} = conn, %{ids: ids} = _params) do
	+ def destroy_multiple(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{ids: ids}}}} = conn,
	+ _
	+ ) do
	Notification.destroy_multiple(user, ids)
	json(conn, %{})
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/poll_controller.ex b/lib/pleroma/web/mastodon_api/controllers/poll_controller.ex
	index 002c210d2..b074ee405 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/poll_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/poll_controller.ex
	@@ -1,67 +1,73 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.PollController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [try_render: 3, json_response: 3]

	alias Pleroma.Activity
	alias Pleroma.Object
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:statuses"], fallback: :proceed_unauthenticated} when action == :show
	)

	plug(OAuthScopesPlug, %{scopes: ["write:statuses"]} when action == :vote)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PollOperation

	@cachex Pleroma.Config.get([:cachex, :provider], Cachex)

	@doc "GET /api/v1/polls/:id"
	- def show(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with %Object{} = object <- Object.get_by_id_and_maybe_refetch(id, interval: 60),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "show.json", %{object: object, for: user})
	else
	error when is_nil(error) or error == false ->
	render_error(conn, :not_found, "Record not found")
	end
	end

	@doc "POST /api/v1/polls/:id/votes"
	- def vote(%{assigns: %{user: user}, body_params: %{choices: choices}} = conn, %{id: id}) do
	+ def vote(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{body_params: %{choices: choices}, params: %{id: id}}}
	+ } = conn,
	+ _
	+ ) do
	with %Object{data: %{"type" => "Question"}} = object <- Object.get_by_id(id),
	%Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _activities, object} <- get_cached_vote_or_vote(user, object, choices) do
	try_render(conn, "show.json", %{object: object, for: user})
	else
	nil -> render_error(conn, :not_found, "Record not found")
	false -> render_error(conn, :not_found, "Record not found")
	{:error, message} -> json_response(conn, :unprocessable_entity, %{error: message})
	end
	end

	defp get_cached_vote_or_vote(user, object, choices) do
	idempotency_key = "polls:#{user.id}:#{object.data["id"]}"

	@cachex.fetch!(:idempotency_cache, idempotency_key, fn _ ->
	case CommonAPI.vote(user, object, choices) do
	{:error, _message} = res -> {:ignore, res}
	res -> {:commit, res}
	end
	end)
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/scheduled_activity_controller.ex b/lib/pleroma/web/mastodon_api/controllers/scheduled_activity_controller.ex
	index 0392fcef1..1b7095ec5 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/scheduled_activity_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/scheduled_activity_controller.ex
	@@ -1,61 +1,70 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.ScheduledActivityController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]

	alias Pleroma.ScheduledActivity
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	@oauth_read_actions [:show, :index]

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
	plug(OAuthScopesPlug, %{scopes: ["read:statuses"]} when action in @oauth_read_actions)
	plug(OAuthScopesPlug, %{scopes: ["write:statuses"]} when action not in @oauth_read_actions)
	plug(:assign_scheduled_activity when action != :index)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ScheduledActivityOperation

	@doc "GET /api/v1/scheduled_statuses"
	- def index(%{assigns: %{user: user}} = conn, params) do
	+ def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
	params = Map.new(params, fn {key, value} -> {to_string(key), value} end)

	with scheduled_activities <- MastodonAPI.get_scheduled_activities(user, params) do
	conn
	\|> add_link_headers(scheduled_activities)
	\|> render("index.json", scheduled_activities: scheduled_activities)
	end
	end

	@doc "GET /api/v1/scheduled_statuses/:id"
	def show(%{assigns: %{scheduled_activity: scheduled_activity}} = conn, _params) do
	render(conn, "show.json", scheduled_activity: scheduled_activity)
	end

	@doc "PUT /api/v1/scheduled_statuses/:id"
	- def update(%{assigns: %{scheduled_activity: scheduled_activity}, body_params: params} = conn, _) do
	+ def update(
	+ %{
	+ assigns: %{scheduled_activity: scheduled_activity},
	+ private: %{open_api_spex: %{body_params: params}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, scheduled_activity} <- ScheduledActivity.update(scheduled_activity, params) do
	render(conn, "show.json", scheduled_activity: scheduled_activity)
	end
	end

	@doc "DELETE /api/v1/scheduled_statuses/:id"
	def delete(%{assigns: %{scheduled_activity: scheduled_activity}} = conn, _params) do
	with {:ok, scheduled_activity} <- ScheduledActivity.delete(scheduled_activity) do
	render(conn, "show.json", scheduled_activity: scheduled_activity)
	end
	end

	- defp assign_scheduled_activity(%{assigns: %{user: user}, params: %{id: id}} = conn, _) do
	+ defp assign_scheduled_activity(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	+ _
	+ ) do
	case ScheduledActivity.get(user, id) do
	%ScheduledActivity{} = activity -> assign(conn, :scheduled_activity, activity)
	nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) \|> halt()
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/search_controller.ex b/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
	index e4acba226..7fdf684d2 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
	@@ -1,193 +1,202 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.SearchController do
	use Pleroma.Web, :controller

	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.ControllerHelper
	alias Pleroma.Web.Endpoint
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter

	require Logger

	@search_limit 40

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	# Note: Mastodon doesn't allow unauthenticated access (requires read:accounts / read:search)
	plug(OAuthScopesPlug, %{scopes: ["read:search"], fallback: :proceed_unauthenticated})

	# Note: on private instances auth is required (EnsurePublicOrAuthenticatedPlug is not skipped)

	plug(RateLimiter, [name: :search] when action in [:search, :search2, :account_search])

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.SearchOperation

	- def account_search(%{assigns: %{user: user}} = conn, %{q: query} = params) do
	+ def account_search(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{q: query} = params}}} =
	+ conn,
	+ _
	+ ) do
	accounts = User.search(query, search_options(params, user))

	conn
	\|> put_view(AccountView)
	\|> render("index.json",
	users: accounts,
	for: user,
	as: :user
	)
	end

	def search2(conn, params), do: do_search(:v2, conn, params)
	def search(conn, params), do: do_search(:v1, conn, params)

	- defp do_search(version, %{assigns: %{user: user}} = conn, %{q: query} = params) do
	+ defp do_search(
	+ version,
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{q: query} = params}}} =
	+ conn,
	+ _
	+ ) do
	query = String.trim(query)
	options = search_options(params, user)
	timeout = Keyword.get(Repo.config(), :timeout, 15_000)
	default_values = %{"statuses" => [], "accounts" => [], "hashtags" => []}

	result =
	default_values
	\|> Enum.map(fn {resource, default_value} ->
	if params[:type] in [nil, resource] do
	{resource, fn -> resource_search(version, resource, query, options) end}
	else
	{resource, fn -> default_value end}
	end
	end)
	\|> Task.async_stream(fn {resource, f} -> {resource, with_fallback(f)} end,
	timeout: timeout,
	on_timeout: :kill_task
	)
	\|> Enum.reduce(default_values, fn
	{:ok, {resource, result}}, acc ->
	Map.put(acc, resource, result)

	_error, acc ->
	acc
	end)

	json(conn, result)
	end

	defp search_options(params, user) do
	[
	resolve: params[:resolve],
	following: params[:following],
	limit: min(params[:limit], @search_limit),
	offset: params[:offset],
	type: params[:type],
	author: get_author(params),
	embed_relationships: ControllerHelper.embed_relationships?(params),
	for_user: user
	]
	\|> Enum.filter(&elem(&1, 1))
	end

	defp resource_search(_, "accounts", query, options) do
	accounts = with_fallback(fn -> User.search(query, options) end)

	AccountView.render("index.json",
	users: accounts,
	for: options[:for_user],
	embed_relationships: options[:embed_relationships]
	)
	end

	defp resource_search(_, "statuses", query, options) do
	statuses = with_fallback(fn -> Pleroma.Search.search(query, options) end)

	StatusView.render("index.json",
	activities: statuses,
	for: options[:for_user],
	as: :activity
	)
	end

	defp resource_search(:v2, "hashtags", query, options) do
	tags_path = Endpoint.url() <> "/tag/"

	query
	\|> prepare_tags(options)
	\|> Enum.map(fn tag ->
	%{name: tag, url: tags_path <> tag}
	end)
	end

	defp resource_search(:v1, "hashtags", query, options) do
	prepare_tags(query, options)
	end

	defp prepare_tags(query, options) do
	tags =
	query
	\|> preprocess_uri_query()
	\|> String.split(~r/[^#\w]+/u, trim: true)
	\|> Enum.uniq_by(&String.downcase/1)

	explicit_tags = Enum.filter(tags, fn tag -> String.starts_with?(tag, "#") end)

	tags =
	if Enum.any?(explicit_tags) do
	explicit_tags
	else
	tags
	end

	tags = Enum.map(tags, fn tag -> String.trim_leading(tag, "#") end)

	tags =
	if Enum.empty?(explicit_tags) && !options[:skip_joined_tag] do
	add_joined_tag(tags)
	else
	tags
	end

	Pleroma.Pagination.paginate(tags, options)
	end

	defp add_joined_tag(tags) do
	tags
	\|> Kernel.++([joined_tag(tags)])
	\|> Enum.uniq_by(&String.downcase/1)
	end

	# If `query` is a URI, returns last component of its path, otherwise returns `query`
	defp preprocess_uri_query(query) do
	if query =~ ~r/https?:\/\// do
	query
	\|> String.trim_trailing("/")
	\|> URI.parse()
	\|> Map.get(:path)
	\|> String.split("/")
	\|> Enum.at(-1)
	else
	query
	end
	end

	defp joined_tag(tags) do
	tags
	\|> Enum.map(fn tag -> String.capitalize(tag) end)
	\|> Enum.join()
	end

	defp with_fallback(f, fallback \\ []) do
	try do
	f.()
	rescue
	error ->
	Logger.error("#{__MODULE__} search error: #{inspect(error)}")
	fallback
	end
	end

	defp get_author(%{account_id: account_id}) when is_binary(account_id),
	do: User.get_cached_by_id(account_id)

	defp get_author(_params), do: nil
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	index e594ea491..5aa7bddf0 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	@@ -1,498 +1,605 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.StatusController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [try_render: 3, add_link_headers: 2]

	require Ecto.Query

	alias Pleroma.Activity
	alias Pleroma.Bookmark
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.ScheduledActivityView
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(:skip_public_check when action in [:index, :show])

	@unauthenticated_access %{fallback: :proceed_unauthenticated, scopes: []}

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:statuses"]}
	when action in [
	:index,
	:show,
	:card,
	:context,
	:show_history,
	:show_source
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:statuses"]}
	when action in [
	:create,
	:delete,
	:reblog,
	:unreblog,
	:update
	]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:favourites"]} when action == :favourites)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:favourites"]} when action in [:favourite, :unfavourite]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:mutes"]} when action in [:mute_conversation, :unmute_conversation]
	)

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:accounts"]}
	when action in [:favourited_by, :reblogged_by]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action in [:pin, :unpin])

	# Note: scope not present in Mastodon: read:bookmarks
	plug(OAuthScopesPlug, %{scopes: ["read:bookmarks"]} when action == :bookmarks)

	# Note: scope not present in Mastodon: write:bookmarks
	plug(
	OAuthScopesPlug,
	%{scopes: ["write:bookmarks"]} when action in [:bookmark, :unbookmark]
	)

	@rate_limited_status_actions ~w(reblog unreblog favourite unfavourite create delete)a

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: [:id]]
	when action in ~w(reblog unreblog)a
	)

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:fav_unfav", params: [:id]]
	when action in ~w(favourite unfavourite)a
	)

	plug(RateLimiter, [name: :statuses_actions] when action in @rate_limited_status_actions)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.StatusOperation

	@doc """
	GET `/api/v1/statuses?ids[]=1&ids[]=2`

	`ids` query param is required
	"""
	- def index(%{assigns: %{user: user}} = conn, %{ids: ids} = params) do
	+ def index(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{ids: ids} = params}}} =
	+ conn,
	+ _
	+ ) do
	limit = 100

	activities =
	ids
	\|> Enum.take(limit)
	\|> Activity.all_by_ids_with_object()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))

	render(conn, "index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	end

	@doc """
	POST /api/v1/statuses
	"""
	# Creates a scheduled status when `scheduled_at` param is present and it's far enough
	def create(
	%{
	assigns: %{user: user},
	- body_params: %{status: _, scheduled_at: scheduled_at} = params
	+ private: %{
	+ open_api_spex: %{body_params: %{status: _, scheduled_at: scheduled_at} = params}
	+ }
	} = conn,
	_
	)
	when not is_nil(scheduled_at) do
	params =
	Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	\|> put_application(conn)

	attrs = %{
	params: Map.new(params, fn {key, value} -> {to_string(key), value} end),
	scheduled_at: scheduled_at
	}

	with {:far_enough, true} <- {:far_enough, ScheduledActivity.far_enough?(scheduled_at)},
	{:ok, scheduled_activity} <- ScheduledActivity.create(user, attrs) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", scheduled_activity: scheduled_activity)
	else
	{:far_enough, _} ->
	params = Map.drop(params, [:scheduled_at])
	- create(%Plug.Conn{conn \| body_params: params}, %{})
	+
	+ put_in(
	+ conn,
	+ [Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
	+ params
	+ )
	+ \|> do_create

	error ->
	error
	end
	end

	# Creates a regular status
	- def create(%{assigns: %{user: user}, body_params: %{status: _} = params} = conn, _) do
	+ def create(
	+ %{
	+ private: %{open_api_spex: %{body_params: %{status: _}}}
	+ } = conn,
	+ _
	+ ) do
	+ do_create(conn)
	+ end
	+
	+ def create(
	+ %{
	+ assigns: %{user: _user},
	+ private: %{open_api_spex: %{body_params: %{media_ids: _} = params}}
	+ } = conn,
	+ _
	+ ) do
	+ params = Map.put(params, :status, "")
	+
	+ put_in(
	+ conn,
	+ [Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
	+ params
	+ )
	+ \|> do_create
	+ end
	+
	+ defp do_create(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn
	+ ) do
	params =
	Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	\|> put_application(conn)

	with {:ok, activity} <- CommonAPI.post(user, params) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	as: :activity,
	with_direct_conversation_id: true
	)
	else
	{:error, {:reject, message}} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	- def create(%{assigns: %{user: _user}, body_params: %{media_ids: _} = params} = conn, _) do
	- params = Map.put(params, :status, "")
	- create(%Plug.Conn{conn \| body_params: params}, %{})
	- end
	-
	@doc "GET /api/v1/statuses/:id/history"
	- def show_history(%{assigns: assigns} = conn, %{id: id} = params) do
	+ def show_history(
	+ %{assigns: assigns, private: %{open_api_spex: %{params: %{id: id} = params}}} = conn,
	+ _
	+ ) do
	with user = assigns[:user],
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "history.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "GET /api/v1/statuses/:id/source"
	- def show_source(%{assigns: assigns} = conn, %{id: id} = _params) do
	+ def show_source(%{assigns: assigns, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with user = assigns[:user],
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "source.json",
	activity: activity,
	for: user
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "PUT /api/v1/statuses/:id"
	- def update(%{assigns: %{user: user}, body_params: body_params} = conn, %{id: id} = params) do
	+ def update(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{body_params: body_params, params: %{id: id} = params}}
	+ } = conn,
	+ _
	+ ) do
	with {_, %Activity{}} = {_, activity} <- {:activity, Activity.get_by_id_with_object(id)},
	{_, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	{_, true} <- {:is_create, activity.data["type"] == "Create"},
	actor <- Activity.user_actor(activity),
	{_, true} <- {:own_status, actor.id == user.id},
	changes <- body_params \|> put_application(conn),
	{_, {:ok, _update_activity}} <- {:pipeline, CommonAPI.update(user, activity, changes)},
	{_, %Activity{}} = {_, activity} <- {:refetched, Activity.get_by_id_with_object(id)} do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	{:own_status, _} -> {:error, :forbidden}
	{:pipeline, _} -> {:error, :internal_server_error}
	_ -> {:error, :not_found}
	end
	end

	@doc "GET /api/v1/statuses/:id"
	- def show(%{assigns: %{user: user}} = conn, %{id: id} = params) do
	+ def show(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id} = params}}} =
	+ conn,
	+ _
	+ ) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "DELETE /api/v1/statuses/:id"
	- def delete(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def delete(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_source: true
	)
	else
	_e -> {:error, :not_found}
	end
	end

	@doc "POST /api/v1/statuses/:id/reblog"
	- def reblog(%{assigns: %{user: user}, body_params: params} = conn, %{id: ap_id_or_id}) do
	+ def reblog(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{body_params: params, params: %{id: ap_id_or_id}}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, announce} <- CommonAPI.repeat(ap_id_or_id, user, params),
	%Activity{} = announce <- Activity.normalize(announce.data) do
	try_render(conn, "show.json", %{activity: announce, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/unreblog"
	- def unreblog(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	+ def unreblog(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, _unannounce} <- CommonAPI.unrepeat(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", %{activity: activity, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/favourite"
	- def favourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	+ def favourite(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, _fav} <- CommonAPI.favorite(user, activity_id),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unfavourite"
	- def unfavourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
	+ def unfavourite(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, _unfav} <- CommonAPI.unfavorite(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/pin"
	- def pin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
	+ def pin(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	{:error, :pinned_statuses_limit_reached} ->
	{:error, "You have already pinned the maximum number of statuses"}

	{:error, :ownership_error} ->
	{:error, :unprocessable_entity, "Someone else's status cannot be pinned"}

	{:error, :visibility_error} ->
	{:error, :unprocessable_entity, "Non-public status cannot be pinned"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/unpin"
	- def unpin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
	+ def unpin(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/bookmark"
	- def bookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def bookmark(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	+ _
	+ ) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.create(user.id, activity.id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unbookmark"
	- def unbookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def unbookmark(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	+ _
	+ ) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.destroy(user.id, activity.id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/mute"
	- def mute_conversation(%{assigns: %{user: user}, body_params: params} = conn, %{id: id}) do
	+ def mute_conversation(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{body_params: params, params: %{id: id}}}
	+ } = conn,
	+ _
	+ ) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	{:ok, activity} <- CommonAPI.add_mute(user, activity, params) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unmute"
	- def unmute_conversation(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def unmute_conversation(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{params: %{id: id}}}
	+ } = conn,
	+ _
	+ ) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	{:ok, activity} <- CommonAPI.remove_mute(user, activity) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "GET /api/v1/statuses/:id/card"
	@deprecated "https://github.com/tootsuite/mastodon/pull/11213"
	- def card(%{assigns: %{user: user}} = conn, %{id: status_id}) do
	+ def card(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: status_id}}}} = conn,
	+ _
	+ ) do
	with %Activity{} = activity <- Activity.get_by_id(status_id),
	true <- Visibility.visible_for_user?(activity, user) do
	data = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
	render(conn, "card.json", data)
	else
	_ -> render_error(conn, :not_found, "Record not found")
	end
	end

	@doc "GET /api/v1/statuses/:id/favourited_by"
	- def favourited_by(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def favourited_by(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	+ _
	+ ) do
	with true <- Pleroma.Config.get([:instance, :show_reactions]),
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"likes" => likes}} <- Object.normalize(activity, fetch: false) do
	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^likes)
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/reblogged_by"
	- def reblogged_by(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def reblogged_by(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	+ _
	+ ) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"announcements" => announces, "id" => ap_id}} <-
	Object.normalize(activity, fetch: false) do
	announces =
	"Announce"
	\|> Activity.Queries.by_type()
	\|> Ecto.Query.where([a], a.actor in ^announces)
	# this is to use the index
	\|> Activity.Queries.by_object_id(ap_id)
	\|> Repo.all()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))
	\|> Enum.map(& &1.actor)
	\|> Enum.uniq()

	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^announces)
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/context"
	- def context(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def context(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	+ _
	+ ) do
	with %Activity{} = activity <- Activity.get_by_id(id) do
	activities =
	ActivityPub.fetch_activities_for_context(activity.data["context"], %{
	blocking_user: user,
	user: user,
	exclude_id: activity.id
	})

	render(conn, "context.json", activity: activity, activities: activities, user: user)
	end
	end

	@doc "GET /api/v1/favourites"
	- def favourites(%{assigns: %{user: %User{} = user}} = conn, params) do
	+ def favourites(
	+ %{assigns: %{user: %User{} = user}, private: %{open_api_spex: %{params: params}}} = conn,
	+ _
	+ ) do
	activities = ActivityPub.fetch_favourites(user, params)

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	@doc "GET /api/v1/bookmarks"
	- def bookmarks(%{assigns: %{user: user}} = conn, params) do
	+ def bookmarks(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
	user = User.get_cached_by_id(user.id)

	bookmarks =
	user.id
	\|> Bookmark.for_user_query()
	\|> Pleroma.Pagination.fetch_paginated(params)

	activities =
	bookmarks
	\|> Enum.map(fn b -> Map.put(b.activity, :bookmark, Map.delete(b, :activity)) end)

	conn
	\|> add_link_headers(bookmarks)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	defp put_application(params, %{assigns: %{token: %Token{user: %User{} = user} = token}} = _conn) do
	if user.disclose_client do
	%{client_name: client_name, website: website} = Repo.preload(token, :app).app
	Map.put(params, :generator, %{type: "Application", name: client_name, url: website})
	else
	Map.put(params, :generator, nil)
	end
	end

	defp put_application(params, _), do: Map.put(params, :generator, nil)
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/chat_controller.ex b/lib/pleroma/web/pleroma_api/controllers/chat_controller.ex
	index 6158af60e..58780ace2 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/chat_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/chat_controller.ex
	@@ -1,193 +1,223 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only
	defmodule Pleroma.Web.PleromaAPI.ChatController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]

	alias Pleroma.Activity
	alias Pleroma.Chat
	alias Pleroma.Chat.MessageReference
	alias Pleroma.Object
	alias Pleroma.Pagination
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.PleromaAPI.Chat.MessageReferenceView
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	import Ecto.Query

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:chats"]}
	when action in [
	:post_chat_message,
	:create,
	:mark_as_read,
	:mark_message_as_read,
	:delete_message
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:chats"]} when action in [:messages, :index, :index2, :show]
	)

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ChatOperation

	- def delete_message(%{assigns: %{user: %{id: user_id} = user}} = conn, %{
	- message_id: message_id,
	- id: chat_id
	- }) do
	+ def delete_message(
	+ %{
	+ assigns: %{user: %{id: user_id} = user},
	+ private: %{
	+ open_api_spex: %{
	+ params: %{
	+ message_id: message_id,
	+ id: chat_id
	+ }
	+ }
	+ }
	+ } = conn,
	+ _
	+ ) do
	with %MessageReference{} = cm_ref <-
	MessageReference.get_by_id(message_id),
	^chat_id <- to_string(cm_ref.chat_id),
	%Chat{user_id: ^user_id} <- Chat.get_by_id(chat_id),
	{:ok, _} <- remove_or_delete(cm_ref, user) do
	conn
	\|> put_view(MessageReferenceView)
	\|> render("show.json", chat_message_reference: cm_ref)
	else
	_e ->
	{:error, :could_not_delete}
	end
	end

	defp remove_or_delete(
	%{object: %{data: %{"actor" => actor, "id" => id}}},
	%{ap_id: actor} = user
	) do
	with %Activity{} = activity <- Activity.get_create_by_object_ap_id(id) do
	CommonAPI.delete(activity.id, user)
	end
	end

	defp remove_or_delete(cm_ref, _), do: MessageReference.delete(cm_ref)

	def post_chat_message(
	- %{body_params: params, assigns: %{user: user}} = conn,
	- %{id: id}
	+ %{
	+ private: %{open_api_spex: %{body_params: params, params: %{id: id}}},
	+ assigns: %{user: user}
	+ } = conn,
	+ _
	) do
	with {:ok, chat} <- Chat.get_by_user_and_id(user, id),
	{_, %User{} = recipient} <- {:user, User.get_cached_by_ap_id(chat.recipient)},
	{:ok, activity} <-
	CommonAPI.post_chat_message(user, recipient, params[:content],
	media_id: params[:media_id],
	idempotency_key: idempotency_key(conn)
	),
	message <- Object.normalize(activity, fetch: false),
	cm_ref <- MessageReference.for_chat_and_object(chat, message) do
	conn
	\|> put_view(MessageReferenceView)
	\|> render("show.json", chat_message_reference: cm_ref)
	else
	{:reject, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: message})

	{:user, nil} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "Recipient does not exist"})
	end
	end

	def mark_message_as_read(
	- %{assigns: %{user: %{id: user_id}}} = conn,
	- %{id: chat_id, message_id: message_id}
	+ %{
	+ assigns: %{user: %{id: user_id}},
	+ private: %{open_api_spex: %{params: %{id: chat_id, message_id: message_id}}}
	+ } = conn,
	+ _
	) do
	with %MessageReference{} = cm_ref <- MessageReference.get_by_id(message_id),
	^chat_id <- to_string(cm_ref.chat_id),
	%Chat{user_id: ^user_id} <- Chat.get_by_id(chat_id),
	{:ok, cm_ref} <- MessageReference.mark_as_read(cm_ref) do
	conn
	\|> put_view(MessageReferenceView)
	\|> render("show.json", chat_message_reference: cm_ref)
	end
	end

	def mark_as_read(
	- %{body_params: %{last_read_id: last_read_id}, assigns: %{user: user}} = conn,
	- %{id: id}
	+ %{
	+ assigns: %{user: user},
	+ private: %{
	+ open_api_spex: %{
	+ body_params: %{last_read_id: last_read_id},
	+ params: %{id: id}
	+ }
	+ }
	+ } = conn,
	+ _
	) do
	with {:ok, chat} <- Chat.get_by_user_and_id(user, id),
	{_n, _} <- MessageReference.set_all_seen_for_chat(chat, last_read_id) do
	render(conn, "show.json", chat: chat)
	end
	end

	- def messages(%{assigns: %{user: user}} = conn, %{id: id} = params) do
	+ def messages(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{params: %{id: id} = params}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, chat} <- Chat.get_by_user_and_id(user, id) do
	chat_message_refs =
	chat
	\|> MessageReference.for_chat_query()
	\|> Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(chat_message_refs)
	\|> put_view(MessageReferenceView)
	\|> render("index.json", chat_message_references: chat_message_refs)
	end
	end

	- def index(%{assigns: %{user: user}} = conn, params) do
	+ def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
	chats =
	index_query(user, params)
	\|> Repo.all()

	render(conn, "index.json", chats: chats)
	end

	- def index2(%{assigns: %{user: user}} = conn, params) do
	+ def index2(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
	chats =
	index_query(user, params)
	\|> Pagination.fetch_paginated(params)

	conn
	\|> add_link_headers(chats)
	\|> render("index.json", chats: chats)
	end

	defp index_query(%{id: user_id} = user, params) do
	exclude_users =
	User.cached_blocked_users_ap_ids(user) ++
	if params[:with_muted], do: [], else: User.cached_muted_users_ap_ids(user)

	user_id
	\|> Chat.for_user_query()
	\|> where([c], c.recipient not in ^exclude_users)
	end

	- def create(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def create(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with %User{ap_id: recipient} <- User.get_cached_by_id(id),
	{:ok, %Chat{} = chat} <- Chat.get_or_create(user.id, recipient) do
	render(conn, "show.json", chat: chat)
	end
	end

	- def show(%{assigns: %{user: user}} = conn, %{id: id}) do
	+ def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with {:ok, chat} <- Chat.get_by_user_and_id(user, id) do
	render(conn, "show.json", chat: chat)
	end
	end

	defp idempotency_key(conn) do
	case get_req_header(conn, "idempotency-key") do
	[key] -> key
	_ -> nil
	end
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex
	index f854cf9c1..00fb30451 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex
	@@ -1,154 +1,170 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
	use Pleroma.Web, :controller

	alias Pleroma.Emoji.Pack
	alias Pleroma.Web.ApiSpec

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	Pleroma.Web.Plugs.OAuthScopesPlug,
	%{scopes: ["admin:write"]}
	when action in [
	:create,
	:update,
	:delete
	]
	)

	defdelegate open_api_operation(action), to: ApiSpec.PleromaEmojiFileOperation

	- def create(%{body_params: params} = conn, %{name: pack_name}) do
	+ def create(
	+ %{private: %{open_api_spex: %{body_params: params, params: %{name: pack_name}}}} = conn,
	+ _
	+ ) do
	filename = params[:filename] \|\| get_filename(params[:file])
	shortcode = params[:shortcode] \|\| Path.basename(filename, Path.extname(filename))

	with {:ok, pack} <- Pack.load_pack(pack_name),
	{:ok, file} <- get_file(params[:file]),
	{:ok, pack} <- Pack.add_file(pack, shortcode, filename, file) do
	json(conn, pack.files)
	else
	{:error, :already_exists} ->
	conn
	\|> put_status(:conflict)
	\|> json(%{error: "An emoji with the \"#{shortcode}\" shortcode already exists"})

	{:error, :empty_values} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: "pack name, shortcode or filename cannot be empty"})

	{:error, _} = error ->
	handle_error(conn, error, %{
	pack_name: pack_name,
	message: "Unexpected error occurred while adding file to pack."
	})
	end
	end

	- def update(%{body_params: %{shortcode: shortcode} = params} = conn, %{name: pack_name}) do
	+ def update(
	+ %{
	+ private: %{
	+ open_api_spex: %{
	+ body_params: %{shortcode: shortcode} = params,
	+ params: %{name: pack_name}
	+ }
	+ }
	+ } = conn,
	+ _
	+ ) do
	new_shortcode = params[:new_shortcode]
	new_filename = params[:new_filename]
	force = params[:force]

	with {:ok, pack} <- Pack.load_pack(pack_name),
	{:ok, pack} <- Pack.update_file(pack, shortcode, new_shortcode, new_filename, force) do
	json(conn, pack.files)
	else
	{:error, :already_exists} ->
	conn
	\|> put_status(:conflict)
	\|> json(%{
	error:
	"New shortcode \"#{new_shortcode}\" is already used. If you want to override emoji use 'force' option"
	})

	{:error, :empty_values} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: "new_shortcode or new_filename cannot be empty"})

	{:error, _} = error ->
	handle_error(conn, error, %{
	pack_name: pack_name,
	code: shortcode,
	message: "Unexpected error occurred while updating."
	})
	end
	end

	- def delete(conn, %{name: pack_name, shortcode: shortcode}) do
	+ def delete(
	+ %{private: %{open_api_spex: %{params: %{name: pack_name, shortcode: shortcode}}}} = conn,
	+ _
	+ ) do
	with {:ok, pack} <- Pack.load_pack(pack_name),
	{:ok, pack} <- Pack.delete_file(pack, shortcode) do
	json(conn, pack.files)
	else
	{:error, :empty_values} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: "pack name or shortcode cannot be empty"})

	{:error, _} = error ->
	handle_error(conn, error, %{
	pack_name: pack_name,
	code: shortcode,
	message: "Unexpected error occurred while deleting emoji file."
	})
	end
	end

	defp handle_error(conn, {:error, :doesnt_exist}, %{code: emoji_code}) do
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "Emoji \"#{emoji_code}\" does not exist"})
	end

	defp handle_error(conn, {:error, :enoent}, %{pack_name: pack_name}) do
	conn
	\|> put_status(:not_found)
	\|> json(%{error: "pack \"#{pack_name}\" is not found"})
	end

	defp handle_error(conn, {:error, error}, opts) do
	message =
	[
	Map.get(opts, :message, "Unexpected error occurred."),
	Pleroma.Utils.posix_error_message(error)
	]
	\|> Enum.join(" ")
	\|> String.trim()

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: message})
	end

	defp get_filename(%Plug.Upload{filename: filename}), do: filename
	defp get_filename(url) when is_binary(url), do: Path.basename(url)

	def get_file(%Plug.Upload{} = file), do: {:ok, file}

	def get_file(url) when is_binary(url) do
	with {:ok, %Tesla.Env{body: body, status: code, headers: headers}}
	when code in 200..299 <- Pleroma.HTTP.get(url) do
	path = Plug.Upload.random_file!("emoji")

	content_type =
	case List.keyfind(headers, "content-type", 0) do
	{"content-type", value} -> value
	nil -> nil
	end

	File.write(path, body)

	{:ok,
	%Plug.Upload{
	filename: Path.basename(url),
	path: path,
	content_type: content_type
	}}
	end
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
	index 420fea12c..32360d2a2 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
	@@ -1,230 +1,241 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
	use Pleroma.Web, :controller

	alias Pleroma.Emoji.Pack

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	Pleroma.Web.Plugs.OAuthScopesPlug,
	%{scopes: ["admin:write"]}
	when action in [
	:import_from_filesystem,
	:remote,
	:download,
	:create,
	:update,
	:delete
	]
	)

	plug(:skip_auth when action in [:index, :archive, :show])

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaEmojiPackOperation

	- def remote(conn, params) do
	+ def remote(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
	with {:ok, packs} <-
	Pack.list_remote(url: params.url, page_size: params.page_size, page: params.page) do
	json(conn, packs)
	else
	{:error, :not_shareable} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "The requested instance does not support sharing emoji packs"})
	end
	end

	- def index(conn, params) do
	+ def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
	emoji_path =
	[:instance, :static_dir]
	\|> Pleroma.Config.get!()
	\|> Path.join("emoji")

	with {:ok, packs, count} <- Pack.list_local(page: params.page, page_size: params.page_size) do
	json(conn, %{packs: packs, count: count})
	else
	{:error, :create_dir, e} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "Failed to create the emoji pack directory at #{emoji_path}: #{e}"})

	{:error, :ls, e} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{
	error: "Failed to get the contents of the emoji pack directory at #{emoji_path}: #{e}"
	})
	end
	end

	- def show(conn, %{name: name, page: page, page_size: page_size}) do
	+ def show(
	+ %{private: %{open_api_spex: %{params: %{name: name, page: page, page_size: page_size}}}} =
	+ conn,
	+ _
	+ ) do
	name = String.trim(name)

	with {:ok, pack} <- Pack.show(name: name, page: page, page_size: page_size) do
	json(conn, pack)
	else
	{:error, :enoent} ->
	conn
	\|> put_status(:not_found)
	\|> json(%{error: "Pack #{name} does not exist"})

	{:error, :empty_values} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "pack name cannot be empty"})

	{:error, error} ->
	error_message =
	add_posix_error(
	"Failed to get the contents of the `#{name}` pack.",
	error
	)

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error_message})
	end
	end

	- def archive(conn, %{name: name}) do
	+ def archive(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
	with {:ok, archive} <- Pack.get_archive(name) do
	send_download(conn, {:binary, archive}, filename: "#{name}.zip")
	else
	{:error, :cant_download} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{
	error:
	"Pack #{name} cannot be downloaded from this instance, either pack sharing was disabled for this pack or some files are missing"
	})

	{:error, :enoent} ->
	conn
	\|> put_status(:not_found)
	\|> json(%{error: "Pack #{name} does not exist"})
	end
	end

	- def download(%{body_params: %{url: url, name: name} = params} = conn, _) do
	+ def download(
	+ %{private: %{open_api_spex: %{body_params: %{url: url, name: name} = params}}} = conn,
	+ _
	+ ) do
	with {:ok, _pack} <- Pack.download(name, url, params[:as]) do
	json(conn, "ok")
	else
	{:error, :not_shareable} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "The requested instance does not support sharing emoji packs"})

	{:error, :invalid_checksum} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "SHA256 for the pack doesn't match the one sent by the server"})

	{:error, error} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error})
	end
	end

	- def create(conn, %{name: name}) do
	+ def create(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
	name = String.trim(name)

	with {:ok, _pack} <- Pack.create(name) do
	json(conn, "ok")
	else
	{:error, :eexist} ->
	conn
	\|> put_status(:conflict)
	\|> json(%{error: "A pack named \"#{name}\" already exists"})

	{:error, :empty_values} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "pack name cannot be empty"})

	{:error, error} ->
	error_message =
	add_posix_error(
	"Unexpected error occurred while creating pack.",
	error
	)

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error_message})
	end
	end

	- def delete(conn, %{name: name}) do
	+ def delete(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
	name = String.trim(name)

	with {:ok, deleted} when deleted != [] <- Pack.delete(name) do
	json(conn, "ok")
	else
	{:ok, []} ->
	conn
	\|> put_status(:not_found)
	\|> json(%{error: "Pack #{name} does not exist"})

	{:error, :empty_values} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "pack name cannot be empty"})

	{:error, error, _} ->
	error_message = add_posix_error("Couldn't delete the `#{name}` pack", error)

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error_message})
	end
	end

	- def update(%{body_params: %{metadata: metadata}} = conn, %{name: name}) do
	+ def update(
	+ %{private: %{open_api_spex: %{body_params: %{metadata: metadata}, params: %{name: name}}}} =
	+ conn,
	+ _
	+ ) do
	with {:ok, pack} <- Pack.update_metadata(name, metadata) do
	json(conn, pack.pack)
	else
	{:error, :incomplete} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{error: "The fallback archive does not have all files specified in pack.json"})

	{:error, error} ->
	error_message =
	add_posix_error(
	"Unexpected error occurred while updating pack metadata.",
	error
	)

	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: error_message})
	end
	end

	def import_from_filesystem(conn, _params) do
	with {:ok, names} <- Pack.import_from_filesystem() do
	json(conn, names)
	else
	{:error, :no_read_write} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "Error: emoji pack directory must be writable"})

	{:error, _} ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: "Error accessing emoji pack directory"})
	end
	end

	defp add_posix_error(msg, error) do
	[msg, Pleroma.Utils.posix_error_message(error)]
	\|> Enum.join(" ")
	\|> String.trim()
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex b/lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex
	index 2b6093753..5e412196b 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex
	@@ -1,45 +1,49 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.MascotController do
	use Pleroma.Web, :controller

	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:update])
	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
	plug(OAuthScopesPlug, %{scopes: ["read:accounts"]} when action == :show)
	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action != :show)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaMascotOperation

	@doc "GET /api/v1/pleroma/mascot"
	def show(%{assigns: %{user: user}} = conn, _params) do
	json(conn, User.get_mascot(user))
	end

	@doc "PUT /api/v1/pleroma/mascot"
	- def update(%{assigns: %{user: user}, body_params: %{file: file}} = conn, _) do
	+ def update(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file}}}} =
	+ conn,
	+ _
	+ ) do
	with {:content_type, "image" <> _} <- {:content_type, file.content_type},
	{:ok, object} <- ActivityPub.upload(file, actor: User.ap_id(user)) do
	attachment = render_attachment(object)
	{:ok, _user} = User.mascot_update(user, attachment)

	json(conn, attachment)
	else
	{:content_type, _} ->
	render_error(conn, :unsupported_media_type, "mascots can only be images")

	{:upload, {:error, _}} ->
	render_error(conn, :error, "error uploading file")
	end
	end

	defp render_attachment(object) do
	attachment_data = Map.put(object.data, "id", object.id)
	Pleroma.Web.MastodonAPI.StatusView.render("attachment.json", %{attachment: attachment_data})
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/notification_controller.ex b/lib/pleroma/web/pleroma_api/controllers/notification_controller.ex
	index 87ea81cef..f860eaf7e 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/notification_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/notification_controller.ex
	@@ -1,38 +1,48 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.NotificationController do
	use Pleroma.Web, :controller

	alias Pleroma.Notification

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(
	Pleroma.Web.Plugs.OAuthScopesPlug,
	%{scopes: ["write:notifications"]} when action == :mark_as_read
	)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaNotificationOperation

	- def mark_as_read(%{assigns: %{user: user}, body_params: %{id: notification_id}} = conn, _) do
	+ def mark_as_read(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{body_params: %{id: notification_id}}}
	+ } = conn,
	+ _
	+ ) do
	with {:ok, notification} <- Notification.read_one(user, notification_id) do
	render(conn, "show.json", notification: notification, for: user)
	else
	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{"error" => message})
	end
	end

	- def mark_as_read(%{assigns: %{user: user}, body_params: %{max_id: max_id}} = conn, _) do
	+ def mark_as_read(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{max_id: max_id}}}} =
	+ conn,
	+ _
	+ ) do
	notifications =
	user
	\|> Notification.set_read_up_to(max_id)
	\|> Enum.take(80)

	render(conn, "index.json", notifications: notifications, for: user)
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex b/lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex
	index 90428a532..96466f192 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex
	@@ -1,61 +1,82 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.UserImportController do
	use Pleroma.Web, :controller

	require Logger

	alias Pleroma.User
	alias Pleroma.Web.ApiSpec
	alias Pleroma.Web.Plugs.OAuthScopesPlug

	plug(OAuthScopesPlug, %{scopes: ["follow", "write:follows"]} when action == :follow)
	plug(OAuthScopesPlug, %{scopes: ["follow", "write:blocks"]} when action == :blocks)
	plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action == :mutes)

	- plug(Pleroma.Web.ApiSpec.CastAndValidate)
	+ plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
	defdelegate open_api_operation(action), to: ApiSpec.UserImportOperation

	- def follow(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
	- follow(%Plug.Conn{conn \| body_params: %{list: File.read!(path)}}, %{})
	+ def follow(
	+ %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
	+ _
	+ ) do
	+ list = File.read!(path)
	+ do_follow(conn, list)
	end

	- def follow(%{assigns: %{user: follower}, body_params: %{list: list}} = conn, _) do
	+ def follow(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
	+ do: do_follow(conn, list)
	+
	+ def do_follow(%{assigns: %{user: follower}} = conn, list) do
	identifiers =
	list
	\|> String.split("\n")
	\|> Enum.map(&(&1 \|> String.split(",") \|> List.first()))
	\|> List.delete("Account address")
	\|> Enum.map(&(&1 \|> String.trim() \|> String.trim_leading("@")))
	\|> Enum.reject(&(&1 == ""))

	User.Import.follow_import(follower, identifiers)
	json(conn, "job started")
	end

	- def blocks(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
	- blocks(%Plug.Conn{conn \| body_params: %{list: File.read!(path)}}, %{})
	+ def blocks(
	+ %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
	+ _
	+ ) do
	+ list = File.read!(path)
	+ do_block(conn, list)
	end

	- def blocks(%{assigns: %{user: blocker}, body_params: %{list: list}} = conn, _) do
	+ def blocks(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
	+ do: do_block(conn, list)
	+
	+ defp do_block(%{assigns: %{user: blocker}} = conn, list) do
	User.Import.blocks_import(blocker, prepare_user_identifiers(list))
	json(conn, "job started")
	end

	- def mutes(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
	- mutes(%Plug.Conn{conn \| body_params: %{list: File.read!(path)}}, %{})
	+ def mutes(
	+ %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
	+ _
	+ ) do
	+ list = File.read!(path)
	+ do_mute(conn, list)
	end

	- def mutes(%{assigns: %{user: user}, body_params: %{list: list}} = conn, _) do
	+ def mutes(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
	+ do: do_mute(conn, list)
	+
	+ defp do_mute(%{assigns: %{user: user}} = conn, list) do
	User.Import.mutes_import(user, prepare_user_identifiers(list))
	json(conn, "job started")
	end

	defp prepare_user_identifiers(list) do
	list
	\|> String.split()
	\|> Enum.map(&String.trim_leading(&1, "@"))
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/controllers/util_controller.ex b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
	index c8ecf5eff..040fa3286 100644
	--- a/lib/pleroma/web/twitter_api/controllers/util_controller.ex
	+++ b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
	@@ -1,368 +1,396 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.TwitterAPI.UtilController do
	use Pleroma.Web, :controller

	require Logger

	alias Pleroma.Activity
	alias Pleroma.Config
	alias Pleroma.Emoji
	alias Pleroma.Healthcheck
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.WebFinger

	plug(
	- Pleroma.Web.ApiSpec.CastAndValidate
	+ Pleroma.Web.ApiSpec.CastAndValidate,
	+ [replace_params: false]
	when action != :remote_subscribe and action != :show_subscribe_form
	)

	plug(
	Pleroma.Web.Plugs.FederatingPlug
	when action == :remote_subscribe
	when action == :show_subscribe_form
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:accounts"]}
	when action in [
	:change_email,
	:change_password,
	:delete_account,
	:update_notification_settings,
	:disable_account,
	:move_account,
	:add_alias,
	:delete_alias
	]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:accounts"]}
	when action in [
	:list_aliases
	]
	)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.TwitterUtilOperation

	def show_subscribe_form(conn, %{"nickname" => nick}) do
	with %User{} = user <- User.get_cached_by_nickname(nick),
	avatar = User.avatar_url(user) do
	conn
	\|> render("subscribe.html", %{nickname: nick, avatar: avatar, error: false})
	else
	_e ->
	render(conn, "subscribe.html", %{
	nickname: nick,
	avatar: nil,
	error:
	Pleroma.Web.Gettext.dpgettext(
	"static_pages",
	"remote follow error message - user not found",
	"Could not find user"
	)
	})
	end
	end

	def show_subscribe_form(conn, %{"status_id" => id}) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	{:ok, ap_id} <- get_ap_id(activity),
	%User{} = user <- User.get_cached_by_ap_id(activity.actor),
	avatar = User.avatar_url(user) do
	conn
	\|> render("status_interact.html", %{
	status_link: ap_id,
	status_id: id,
	nickname: user.nickname,
	avatar: avatar,
	error: false
	})
	else
	_e ->
	render(conn, "status_interact.html", %{
	status_id: id,
	avatar: nil,
	error:
	Pleroma.Web.Gettext.dpgettext(
	"static_pages",
	"status interact error message - status not found",
	"Could not find status"
	)
	})
	end
	end

	def remote_subscribe(conn, %{"nickname" => nick, "profile" => _}) do
	show_subscribe_form(conn, %{"nickname" => nick})
	end

	def remote_subscribe(conn, %{"status_id" => id, "profile" => _}) do
	show_subscribe_form(conn, %{"status_id" => id})
	end

	def remote_subscribe(conn, %{"user" => %{"nickname" => nick, "profile" => profile}}) do
	with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	%User{ap_id: ap_id} <- User.get_cached_by_nickname(nick) do
	conn
	\|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	else
	_e ->
	render(conn, "subscribe.html", %{
	nickname: nick,
	avatar: nil,
	error:
	Pleroma.Web.Gettext.dpgettext(
	"static_pages",
	"remote follow error message - unknown error",
	"Something went wrong."
	)
	})
	end
	end

	def remote_subscribe(conn, %{"status" => %{"status_id" => id, "profile" => profile}}) do
	with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile),
	%Activity{} = activity <- Activity.get_by_id(id),
	{:ok, ap_id} <- get_ap_id(activity) do
	conn
	\|> Phoenix.Controller.redirect(external: String.replace(template, "{uri}", ap_id))
	else
	_e ->
	render(conn, "status_interact.html", %{
	status_id: id,
	avatar: nil,
	error:
	Pleroma.Web.Gettext.dpgettext(
	"static_pages",
	"status interact error message - unknown error",
	"Something went wrong."
	)
	})
	end
	end

	- def remote_interaction(%{body_params: %{ap_id: ap_id, profile: profile}} = conn, _params) do
	+ def remote_interaction(
	+ %{private: %{open_api_spex: %{body_params: %{ap_id: ap_id, profile: profile}}}} = conn,
	+ _params
	+ ) do
	with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile) do
	conn
	\|> json(%{url: String.replace(template, "{uri}", ap_id)})
	else
	_e -> json(conn, %{error: "Couldn't find user"})
	end
	end

	defp get_ap_id(activity) do
	object = Pleroma.Object.normalize(activity, fetch: false)

	case object do
	%{data: %{"id" => ap_id}} -> {:ok, ap_id}
	_ -> {:no_ap_id, nil}
	end
	end

	def frontend_configurations(conn, _params) do
	render(conn, "frontend_configurations.json")
	end

	def emoji(conn, _params) do
	emoji =
	Enum.reduce(Emoji.get_all(), %{}, fn {code, %Emoji{file: file, tags: tags}}, acc ->
	Map.put(acc, code, %{image_url: file, tags: tags})
	end)

	json(conn, emoji)
	end

	def update_notification_settings(%{assigns: %{user: user}} = conn, params) do
	with {:ok, _} <- User.update_notification_settings(user, params) do
	json(conn, %{status: "success"})
	end
	end

	- def change_password(%{assigns: %{user: user}, body_params: body_params} = conn, %{}) do
	+ def change_password(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	+ _
	+ ) do
	case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
	{:ok, user} ->
	with {:ok, _user} <-
	User.reset_password(user, %{
	password: body_params.new_password,
	password_confirmation: body_params.new_password_confirmation
	}) do
	json(conn, %{status: "success"})
	else
	{:error, changeset} ->
	{_, {error, _}} = Enum.at(changeset.errors, 0)
	json(conn, %{error: "New password #{error}."})

	_ ->
	json(conn, %{error: "Unable to change password."})
	end

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	- def change_email(%{assigns: %{user: user}, body_params: body_params} = conn, %{}) do
	+ def change_email(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	+ _
	+ ) do
	case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
	{:ok, user} ->
	with {:ok, _user} <- User.change_email(user, body_params.email) do
	json(conn, %{status: "success"})
	else
	{:error, changeset} ->
	{_, {error, _}} = Enum.at(changeset.errors, 0)
	json(conn, %{error: "Email #{error}."})

	_ ->
	json(conn, %{error: "Unable to change email."})
	end

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	- def delete_account(%{assigns: %{user: user}, body_params: body_params} = conn, params) do
	+ def delete_account(
	+ %{
	+ assigns: %{user: user},
	+ private: %{open_api_spex: %{body_params: body_params, params: params}}
	+ } = conn,
	+ _
	+ ) do
	# This endpoint can accept a query param or JSON body for backwards-compatibility.
	# Submitting a JSON body is recommended, so passwords don't end up in server logs.
	password = body_params[:password] \|\| params[:password] \|\| ""

	case CommonAPI.Utils.confirm_current_password(user, password) do
	{:ok, user} ->
	User.delete(user)
	json(conn, %{status: "success"})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	- def disable_account(%{assigns: %{user: user}} = conn, params) do
	+ def disable_account(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn,
	+ _
	+ ) do
	case CommonAPI.Utils.confirm_current_password(user, params[:password]) do
	{:ok, user} ->
	User.set_activation_async(user, false)
	json(conn, %{status: "success"})

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	- def move_account(%{assigns: %{user: user}, body_params: body_params} = conn, %{}) do
	+ def move_account(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	+ _
	+ ) do
	case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
	{:ok, user} ->
	with {:ok, target_user} <- find_or_fetch_user_by_nickname(body_params.target_account),
	{:ok, _user} <- ActivityPub.move(user, target_user) do
	json(conn, %{status: "success"})
	else
	{:not_found, _} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Target account not found."})

	{:error, error} ->
	json(conn, %{error: error})
	end

	{:error, msg} ->
	json(conn, %{error: msg})
	end
	end

	- def add_alias(%{assigns: %{user: user}, body_params: body_params} = conn, _) do
	+ def add_alias(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	+ _
	+ ) do
	with {:ok, alias_user} <- find_user_by_nickname(body_params.alias),
	{:ok, _user} <- user \|> User.add_alias(alias_user) do
	json(conn, %{status: "success"})
	else
	{:not_found, _} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Target account does not exist."})

	{:error, error} ->
	json(conn, %{error: error})
	end
	end

	- def delete_alias(%{assigns: %{user: user}, body_params: body_params} = conn, _) do
	+ def delete_alias(
	+ %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
	+ _
	+ ) do
	with {:ok, alias_user} <- find_user_by_nickname(body_params.alias),
	{:ok, _user} <- user \|> User.delete_alias(alias_user) do
	json(conn, %{status: "success"})
	else
	{:error, :no_such_alias} ->
	conn
	\|> put_status(404)
	\|> json(%{error: "Account has no such alias."})

	{:error, error} ->
	json(conn, %{error: error})
	end
	end

	- def list_aliases(%{assigns: %{user: user}} = conn, %{}) do
	+ def list_aliases(%{assigns: %{user: user}} = conn, _) do
	alias_nicks =
	user
	\|> User.alias_users()
	\|> Enum.map(&User.full_nickname/1)

	json(conn, %{aliases: alias_nicks})
	end

	defp find_user_by_nickname(nickname) do
	user = User.get_cached_by_nickname(nickname)

	if user == nil do
	{:error, :not_found}
	else
	{:ok, user}
	end
	end

	defp find_or_fetch_user_by_nickname(nickname) do
	user = User.get_by_nickname(nickname)

	if user != nil and user.local do
	{:ok, user}
	else
	with {:ok, user} <- User.fetch_by_nickname(nickname) do
	{:ok, user}
	else
	_ ->
	{:not_found, nil}
	end
	end
	end

	def captcha(conn, _params) do
	json(conn, Pleroma.Captcha.new())
	end

	def healthcheck(conn, _params) do
	with {:cfg, true} <- {:cfg, Config.get([:instance, :healthcheck])},
	%{healthy: true} = info <- Healthcheck.system_info() do
	json(conn, info)
	else
	%{healthy: false} = info ->
	service_unavailable(conn, info)

	{:cfg, false} ->
	service_unavailable(conn, %{"error" => "Healthcheck disabled"})

	_ ->
	service_unavailable(conn, %{})
	end
	end

	defp service_unavailable(conn, info) do
	conn
	\|> put_status(:service_unavailable)
	\|> json(info)
	end
	end
	diff --git a/test/pleroma/web/admin_api/controllers/config_controller_test.exs b/test/pleroma/web/admin_api/controllers/config_controller_test.exs
	index 19ce3681c..734aca752 100644
	--- a/test/pleroma/web/admin_api/controllers/config_controller_test.exs
	+++ b/test/pleroma/web/admin_api/controllers/config_controller_test.exs
	@@ -1,1526 +1,1526 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.ConfigControllerTest do
	use Pleroma.Web.ConnCase

	import ExUnit.CaptureLog
	import Pleroma.Factory

	alias Pleroma.ConfigDB

	setup do
	admin = insert(:user, is_admin: true)
	token = insert(:oauth_admin_token, user: admin)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> assign(:token, token)

	{:ok, %{admin: admin, token: token, conn: conn}}
	end

	describe "GET /api/pleroma/admin/config" do
	setup do: clear_config(:configurable_from_database, true)

	test "when configuration from database is off", %{conn: conn} do
	clear_config(:configurable_from_database, false)
	conn = get(conn, "/api/pleroma/admin/config")

	assert json_response_and_validate_schema(conn, 400) ==
	%{
	"error" => "You must enable configurable_from_database in your config file."
	}
	end

	test "with settings only in db", %{conn: conn} do
	config1 = insert(:config)
	config2 = insert(:config)

	conn = get(conn, "/api/pleroma/admin/config?only_db=true")

	%{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => key1,
	"value" => _
	},
	%{
	"group" => ":pleroma",
	"key" => key2,
	"value" => _
	}
	]
	} = json_response_and_validate_schema(conn, 200)

	assert key1 == inspect(config1.key)
	assert key2 == inspect(config2.key)
	end

	test "db is added to settings that are in db", %{conn: conn} do
	_config = insert(:config, key: ":instance", value: [name: "Some name"])

	%{"configs" => configs} =
	conn
	\|> get("/api/pleroma/admin/config")
	\|> json_response_and_validate_schema(200)

	[instance_config] =
	Enum.filter(configs, fn %{"group" => group, "key" => key} ->
	group == ":pleroma" and key == ":instance"
	end)

	assert instance_config["db"] == [":name"]
	end

	test "merged default setting with db settings", %{conn: conn} do
	config1 = insert(:config)
	config2 = insert(:config)

	config3 =
	insert(:config,
	value: [k1: :v1, k2: :v2]
	)

	%{"configs" => configs} =
	conn
	\|> get("/api/pleroma/admin/config")
	\|> json_response_and_validate_schema(200)

	assert length(configs) > 3

	saved_configs = [config1, config2, config3]
	keys = Enum.map(saved_configs, &inspect(&1.key))

	received_configs =
	Enum.filter(configs, fn %{"group" => group, "key" => key} ->
	group == ":pleroma" and key in keys
	end)

	assert length(received_configs) == 3

	db_keys =
	config3.value
	\|> Keyword.keys()
	\|> ConfigDB.to_json_types()

	keys = Enum.map(saved_configs -- [config3], &inspect(&1.key))

	values = Enum.map(saved_configs, &ConfigDB.to_json_types(&1.value))

	mapset_keys = MapSet.new(keys ++ db_keys)

	Enum.each(received_configs, fn %{"value" => value, "db" => db} ->
	db = MapSet.new(db)
	assert MapSet.subset?(db, mapset_keys)

	assert value in values
	end)
	end

	test "subkeys with full update right merge", %{conn: conn} do
	insert(:config,
	key: ":emoji",
	value: [groups: [a: 1, b: 2], key: [a: 1]]
	)

	insert(:config,
	key: ":assets",
	value: [mascots: [a: 1, b: 2], key: [a: 1]]
	)

	%{"configs" => configs} =
	conn
	\|> get("/api/pleroma/admin/config")
	\|> json_response_and_validate_schema(200)

	vals =
	Enum.filter(configs, fn %{"group" => group, "key" => key} ->
	group == ":pleroma" and key in [":emoji", ":assets"]
	end)

	emoji = Enum.find(vals, fn %{"key" => key} -> key == ":emoji" end)
	assets = Enum.find(vals, fn %{"key" => key} -> key == ":assets" end)

	emoji_val = ConfigDB.to_elixir_types(emoji["value"])
	assets_val = ConfigDB.to_elixir_types(assets["value"])

	assert emoji_val[:groups] == [a: 1, b: 2]
	assert assets_val[:mascots] == [a: 1, b: 2]
	end

	test "with valid `admin_token` query parameter, skips OAuth scopes check" do
	clear_config([:admin_token], "password123")

	build_conn()
	\|> get("/api/pleroma/admin/config?admin_token=password123")
	\|> json_response_and_validate_schema(200)
	end
	end

	test "POST /api/pleroma/admin/config with configdb disabled", %{conn: conn} do
	clear_config(:configurable_from_database, false)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{"configs" => []})

	assert json_response_and_validate_schema(conn, 400) ==
	%{"error" => "You must enable configurable_from_database in your config file."}
	end

	describe "POST /api/pleroma/admin/config" do
	setup do
	http = Application.get_env(:pleroma, :http)

	on_exit(fn ->
	Application.delete_env(:pleroma, :key1)
	Application.delete_env(:pleroma, :key2)
	Application.delete_env(:pleroma, :key3)
	Application.delete_env(:pleroma, :key4)
	Application.delete_env(:pleroma, :keyaa1)
	Application.delete_env(:pleroma, :keyaa2)
	Application.delete_env(:pleroma, Pleroma.Web.Endpoint.NotReal)
	Application.delete_env(:pleroma, Pleroma.Captcha.NotReal)
	Application.put_env(:pleroma, :http, http)
	Application.put_env(:tesla, :adapter, Tesla.Mock)
	Restarter.Pleroma.refresh()
	end)
	end

	setup do: clear_config(:configurable_from_database, true)

	@tag capture_log: true
	test "create new config setting in db", %{conn: conn} do
	ueberauth = Application.get_env(:ueberauth, Ueberauth)
	on_exit(fn -> Application.put_env(:ueberauth, Ueberauth, ueberauth) end)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{group: ":pleroma", key: ":key1", value: "value1"},
	%{
	group: ":ueberauth",
	key: "Ueberauth",
	value: [%{"tuple" => [":consumer_secret", "aaaa"]}]
	},
	%{
	group: ":pleroma",
	key: ":key2",
	value: %{
	":nested_1" => "nested_value1",
	":nested_2" => [
	%{":nested_22" => "nested_value222"},
	%{":nested_33" => %{":nested_44" => "nested_444"}}
	]
	}
	},
	%{
	group: ":pleroma",
	key: ":key3",
	value: [
	%{"nested_3" => ":nested_3", "nested_33" => "nested_33"},
	%{"nested_4" => true}
	]
	},
	%{
	group: ":pleroma",
	key: ":key4",
	value: %{":nested_5" => ":upload", "endpoint" => "https://example.com"}
	},
	%{
	group: ":idna",
	key: ":key5",
	value: %{"tuple" => ["string", "Pleroma.Captcha.NotReal", []]}
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => "value1",
	"db" => [":key1"]
	},
	%{
	"group" => ":ueberauth",
	"key" => "Ueberauth",
	"value" => [%{"tuple" => [":consumer_secret", "aaaa"]}],
	"db" => [":consumer_secret"]
	},
	%{
	"group" => ":pleroma",
	"key" => ":key2",
	"value" => %{
	":nested_1" => "nested_value1",
	":nested_2" => [
	%{":nested_22" => "nested_value222"},
	%{":nested_33" => %{":nested_44" => "nested_444"}}
	]
	},
	"db" => [":key2"]
	},
	%{
	"group" => ":pleroma",
	"key" => ":key3",
	"value" => [
	%{"nested_3" => ":nested_3", "nested_33" => "nested_33"},
	%{"nested_4" => true}
	],
	"db" => [":key3"]
	},
	%{
	"group" => ":pleroma",
	"key" => ":key4",
	"value" => %{"endpoint" => "https://example.com", ":nested_5" => ":upload"},
	"db" => [":key4"]
	},
	%{
	"group" => ":idna",
	"key" => ":key5",
	"value" => %{"tuple" => ["string", "Pleroma.Captcha.NotReal", []]},
	"db" => [":key5"]
	}
	],
	"need_reboot" => false
	}

	assert Application.get_env(:pleroma, :key1) == "value1"

	assert Application.get_env(:pleroma, :key2) == %{
	nested_1: "nested_value1",
	nested_2: [
	%{nested_22: "nested_value222"},
	%{nested_33: %{nested_44: "nested_444"}}
	]
	}

	assert Application.get_env(:pleroma, :key3) == [
	%{"nested_3" => :nested_3, "nested_33" => "nested_33"},
	%{"nested_4" => true}
	]

	assert Application.get_env(:pleroma, :key4) == %{
	"endpoint" => "https://example.com",
	nested_5: :upload
	}

	assert Application.get_env(:idna, :key5) == {"string", Pleroma.Captcha.NotReal, []}
	end

	@tag capture_log: true
	test "save configs setting without explicit key", %{conn: conn} do
	adapter = Application.get_env(:http, :adapter)
	send_user_agent = Application.get_env(:http, :send_user_agent)
	user_agent = Application.get_env(:http, :user_agent)

	on_exit(fn ->
	Application.put_env(:http, :adapter, adapter)
	Application.put_env(:http, :send_user_agent, send_user_agent)
	Application.put_env(:http, :user_agent, user_agent)
	end)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":http",
	key: ":adapter",
	value: [":someval"]
	},
	%{
	group: ":http",
	key: ":send_user_agent",
	value: true
	},
	%{
	group: ":http",
	key: ":user_agent",
	value: [":default"]
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":http",
	"key" => ":adapter",
	"value" => [":someval"],
	"db" => [":adapter"]
	},
	%{
	"group" => ":http",
	"key" => ":send_user_agent",
	"value" => true,
	"db" => [":send_user_agent"]
	},
	%{
	"group" => ":http",
	"key" => ":user_agent",
	"value" => [":default"],
	"db" => [":user_agent"]
	}
	],
	"need_reboot" => false
	}

	assert Application.get_env(:http, :adapter) == [:someval]
	assert Application.get_env(:http, :send_user_agent) == true
	assert Application.get_env(:http, :user_agent) == [:default]
	end

	test "saving config with partial update", %{conn: conn} do
	insert(:config, key: ":key1", value: :erlang.term_to_binary(key1: 1, key2: 2))

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{group: ":pleroma", key: ":key1", value: [%{"tuple" => [":key3", 3]}]}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => [
	%{"tuple" => [":key1", 1]},
	%{"tuple" => [":key2", 2]},
	%{"tuple" => [":key3", 3]}
	],
	"db" => [":key1", ":key2", ":key3"]
	}
	],
	"need_reboot" => false
	}
	end

	test "saving config which need pleroma reboot", %{conn: conn} do
	clear_config([:shout, :enabled], true)

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post(
	"/api/pleroma/admin/config",
	%{
	configs: [
	%{group: ":pleroma", key: ":shout", value: [%{"tuple" => [":enabled", true]}]}
	]
	}
	)
	\|> json_response_and_validate_schema(200) == %{
	"configs" => [
	%{
	"db" => [":enabled"],
	"group" => ":pleroma",
	"key" => ":shout",
	"value" => [%{"tuple" => [":enabled", true]}]
	}
	],
	"need_reboot" => true
	}

	configs =
	conn
	\|> get("/api/pleroma/admin/config")
	\|> json_response_and_validate_schema(200)

	assert configs["need_reboot"]

	capture_log(fn ->
	assert conn \|> get("/api/pleroma/admin/restart") \|> json_response(200) ==
	%{}
	end) =~ "pleroma restarted"

	configs =
	conn
	\|> get("/api/pleroma/admin/config")
	\|> json_response_and_validate_schema(200)

	assert configs["need_reboot"] == false
	end

	test "update setting which need reboot, don't change reboot flag until reboot", %{conn: conn} do
	clear_config([:shout, :enabled], true)

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post(
	"/api/pleroma/admin/config",
	%{
	configs: [
	%{group: ":pleroma", key: ":shout", value: [%{"tuple" => [":enabled", true]}]}
	]
	}
	)
	\|> json_response_and_validate_schema(200) == %{
	"configs" => [
	%{
	"db" => [":enabled"],
	"group" => ":pleroma",
	"key" => ":shout",
	"value" => [%{"tuple" => [":enabled", true]}]
	}
	],
	"need_reboot" => true
	}

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{group: ":pleroma", key: ":key1", value: [%{"tuple" => [":key3", 3]}]}
	]
	})
	\|> json_response_and_validate_schema(200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => [
	%{"tuple" => [":key3", 3]}
	],
	"db" => [":key3"]
	}
	],
	"need_reboot" => true
	}

	capture_log(fn ->
	assert conn \|> get("/api/pleroma/admin/restart") \|> json_response(200) ==
	%{}
	end) =~ "pleroma restarted"

	configs =
	conn
	\|> get("/api/pleroma/admin/config")
	\|> json_response_and_validate_schema(200)

	assert configs["need_reboot"] == false
	end

	test "saving config with nested merge", %{conn: conn} do
	insert(:config, key: :key1, value: [key1: 1, key2: [k1: 1, k2: 2]])

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":pleroma",
	key: ":key1",
	value: [
	%{"tuple" => [":key3", 3]},
	%{
	"tuple" => [
	":key2",
	[
	%{"tuple" => [":k2", 1]},
	%{"tuple" => [":k3", 3]}
	]
	]
	}
	]
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => [
	%{"tuple" => [":key1", 1]},
	%{"tuple" => [":key3", 3]},
	%{
	"tuple" => [
	":key2",
	[
	%{"tuple" => [":k1", 1]},
	%{"tuple" => [":k2", 1]},
	%{"tuple" => [":k3", 3]}
	]
	]
	}
	],
	"db" => [":key1", ":key3", ":key2"]
	}
	],
	"need_reboot" => false
	}
	end

	test "saving special atoms", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => [
	%{
	"tuple" => [
	":ssl_options",
	[%{"tuple" => [":versions", [":tlsv1", ":tlsv1.1", ":tlsv1.2"]]}]
	]
	}
	]
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => [
	%{
	"tuple" => [
	":ssl_options",
	[%{"tuple" => [":versions", [":tlsv1", ":tlsv1.1", ":tlsv1.2"]]}]
	]
	}
	],
	"db" => [":ssl_options"]
	}
	],
	"need_reboot" => false
	}

	assert Application.get_env(:pleroma, :key1) == [
	ssl_options: [versions: [:tlsv1, :"tlsv1.1", :"tlsv1.2"]]
	]
	end

	test "saving full setting if value is in full_key_update list", %{conn: conn} do
	backends = Application.get_env(:logger, :backends)
	on_exit(fn -> Application.put_env(:logger, :backends, backends) end)

	insert(:config,
	group: :logger,
	key: :backends,
	value: []
	)

	Pleroma.Config.TransferTask.load_and_update_env([], false)

	assert Application.get_env(:logger, :backends) == []

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":logger",
	key: ":backends",
	value: [":console"]
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":logger",
	"key" => ":backends",
	"value" => [
	":console"
	],
	"db" => [":backends"]
	}
	],
	"need_reboot" => false
	}

	assert Application.get_env(:logger, :backends) == [
	:console
	]
	end

	test "saving full setting if value is not keyword", %{conn: conn} do
	insert(:config,
	group: :tesla,
	key: :adapter,
	value: Tesla.Adapter.Hackey
	)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{group: ":tesla", key: ":adapter", value: "Tesla.Adapter.Httpc"}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":tesla",
	"key" => ":adapter",
	"value" => "Tesla.Adapter.Httpc",
	"db" => [":adapter"]
	}
	],
	"need_reboot" => false
	}
	end

	test "update config setting & delete with fallback to default value", %{
	conn: conn,
	admin: admin,
	token: token
	} do
	ueberauth = Application.get_env(:ueberauth, Ueberauth)
	insert(:config, key: :keyaa1)
	insert(:config, key: :keyaa2)

	config3 =
	insert(:config,
	group: :ueberauth,
	key: Ueberauth
	)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{group: ":pleroma", key: ":keyaa1", value: "another_value"},
	%{group: ":pleroma", key: ":keyaa2", value: "another_value"}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":keyaa1",
	"value" => "another_value",
	"db" => [":keyaa1"]
	},
	%{
	"group" => ":pleroma",
	"key" => ":keyaa2",
	"value" => "another_value",
	"db" => [":keyaa2"]
	}
	],
	"need_reboot" => false
	}

	assert Application.get_env(:pleroma, :keyaa1) == "another_value"
	assert Application.get_env(:pleroma, :keyaa2) == "another_value"
	assert Application.get_env(:ueberauth, Ueberauth) == config3.value

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> assign(:token, token)
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{group: ":pleroma", key: ":keyaa2", delete: true},
	%{
	group: ":ueberauth",
	key: "Ueberauth",
	delete: true
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [],
	"need_reboot" => false
	}

	assert Application.get_env(:ueberauth, Ueberauth) == ueberauth
	refute Keyword.has_key?(Application.get_all_env(:pleroma), :keyaa2)
	end

	test "common config example", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	"group" => ":pleroma",
	"key" => "Pleroma.Captcha.NotReal",
	"value" => [
	%{"tuple" => [":enabled", false]},
	%{"tuple" => [":method", "Pleroma.Captcha.Kocaptcha"]},
	%{"tuple" => [":seconds_valid", 60]},
	%{"tuple" => [":path", ""]},
	%{"tuple" => [":key1", nil]},
	%{"tuple" => [":partial_chain", "&:hackney_connect.partial_chain/1"]},
	%{"tuple" => [":regex1", "~r/https:\/\/example.com/"]},
	%{"tuple" => [":regex2", "~r/https:\/\/example.com/u"]},
	%{"tuple" => [":regex3", "~r/https:\/\/example.com/i"]},
	%{"tuple" => [":regex4", "~r/https:\/\/example.com/s"]},
	%{"tuple" => [":name", "Pleroma"]}
	]
	}
	]
	})

	assert Config.get([Pleroma.Captcha.NotReal, :name]) == "Pleroma"

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => "Pleroma.Captcha.NotReal",
	"value" => [
	%{"tuple" => [":enabled", false]},
	%{"tuple" => [":method", "Pleroma.Captcha.Kocaptcha"]},
	%{"tuple" => [":seconds_valid", 60]},
	%{"tuple" => [":path", ""]},
	%{"tuple" => [":key1", nil]},
	%{"tuple" => [":partial_chain", "&:hackney_connect.partial_chain/1"]},
	%{"tuple" => [":regex1", "~r/https:\\/\\/example.com/"]},
	%{"tuple" => [":regex2", "~r/https:\\/\\/example.com/u"]},
	%{"tuple" => [":regex3", "~r/https:\\/\\/example.com/i"]},
	%{"tuple" => [":regex4", "~r/https:\\/\\/example.com/s"]},
	%{"tuple" => [":name", "Pleroma"]}
	],
	"db" => [
	":enabled",
	":method",
	":seconds_valid",
	":path",
	":key1",
	":partial_chain",
	":regex1",
	":regex2",
	":regex3",
	":regex4",
	":name"
	]
	}
	],
	"need_reboot" => false
	}
	end

	test "tuples with more than two values", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	"group" => ":pleroma",
	"key" => "Pleroma.Web.Endpoint.NotReal",
	"value" => [
	%{
	"tuple" => [
	":http",
	[
	%{
	"tuple" => [
	":key2",
	[
	%{
	"tuple" => [
	":_",
	[
	%{
	"tuple" => [
	"/api/v1/streaming",
	"Pleroma.Web.MastodonAPI.WebsocketHandler",
	[]
	]
	},
	%{
	"tuple" => [
	"/websocket",
	"Phoenix.Endpoint.CowboyWebSocket",
	%{
	"tuple" => [
	"Phoenix.Transports.WebSocket",
	%{
	"tuple" => [
	"Pleroma.Web.Endpoint",
	"Pleroma.Web.UserSocket",
	[]
	]
	}
	]
	}
	]
	},
	%{
	"tuple" => [
	":_",
	- "Phoenix.Endpoint.Cowboy2Handler",
	+ "Plug.Cowboy.Handler",
	%{"tuple" => ["Pleroma.Web.Endpoint", []]}
	]
	}
	]
	]
	}
	]
	]
	}
	]
	]
	}
	]
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => "Pleroma.Web.Endpoint.NotReal",
	"value" => [
	%{
	"tuple" => [
	":http",
	[
	%{
	"tuple" => [
	":key2",
	[
	%{
	"tuple" => [
	":_",
	[
	%{
	"tuple" => [
	"/api/v1/streaming",
	"Pleroma.Web.MastodonAPI.WebsocketHandler",
	[]
	]
	},
	%{
	"tuple" => [
	"/websocket",
	"Phoenix.Endpoint.CowboyWebSocket",
	%{
	"tuple" => [
	"Phoenix.Transports.WebSocket",
	%{
	"tuple" => [
	"Pleroma.Web.Endpoint",
	"Pleroma.Web.UserSocket",
	[]
	]
	}
	]
	}
	]
	},
	%{
	"tuple" => [
	":_",
	- "Phoenix.Endpoint.Cowboy2Handler",
	+ "Plug.Cowboy.Handler",
	%{"tuple" => ["Pleroma.Web.Endpoint", []]}
	]
	}
	]
	]
	}
	]
	]
	}
	]
	]
	}
	],
	"db" => [":http"]
	}
	],
	"need_reboot" => false
	}
	end

	test "settings with nesting map", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => [
	%{"tuple" => [":key2", "some_val"]},
	%{
	"tuple" => [
	":key3",
	%{
	":max_options" => 20,
	":max_option_chars" => 200,
	":min_expiration" => 0,
	":max_expiration" => 31_536_000,
	"nested" => %{
	":max_options" => 20,
	":max_option_chars" => 200,
	":min_expiration" => 0,
	":max_expiration" => 31_536_000
	}
	}
	]
	}
	]
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) ==
	%{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => [
	%{"tuple" => [":key2", "some_val"]},
	%{
	"tuple" => [
	":key3",
	%{
	":max_expiration" => 31_536_000,
	":max_option_chars" => 200,
	":max_options" => 20,
	":min_expiration" => 0,
	"nested" => %{
	":max_expiration" => 31_536_000,
	":max_option_chars" => 200,
	":max_options" => 20,
	":min_expiration" => 0
	}
	}
	]
	}
	],
	"db" => [":key2", ":key3"]
	}
	],
	"need_reboot" => false
	}
	end

	test "value as map", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => %{"key" => "some_val"}
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) ==
	%{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":key1",
	"value" => %{"key" => "some_val"},
	"db" => [":key1"]
	}
	],
	"need_reboot" => false
	}
	end

	test "queues key as atom", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	"group" => ":oban",
	"key" => ":queues",
	"value" => [
	%{"tuple" => [":federator_incoming", 50]},
	%{"tuple" => [":federator_outgoing", 50]},
	%{"tuple" => [":web_push", 50]},
	%{"tuple" => [":mailer", 10]},
	%{"tuple" => [":transmogrifier", 20]},
	%{"tuple" => [":scheduled_activities", 10]},
	%{"tuple" => [":background", 5]}
	]
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":oban",
	"key" => ":queues",
	"value" => [
	%{"tuple" => [":federator_incoming", 50]},
	%{"tuple" => [":federator_outgoing", 50]},
	%{"tuple" => [":web_push", 50]},
	%{"tuple" => [":mailer", 10]},
	%{"tuple" => [":transmogrifier", 20]},
	%{"tuple" => [":scheduled_activities", 10]},
	%{"tuple" => [":background", 5]}
	],
	"db" => [
	":federator_incoming",
	":federator_outgoing",
	":web_push",
	":mailer",
	":transmogrifier",
	":scheduled_activities",
	":background"
	]
	}
	],
	"need_reboot" => false
	}
	end

	test "delete part of settings by atom subkeys", %{conn: conn} do
	insert(:config,
	key: :keyaa1,
	value: [subkey1: "val1", subkey2: "val2", subkey3: "val3"]
	)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":pleroma",
	key: ":keyaa1",
	subkeys: [":subkey1", ":subkey3"],
	delete: true
	}
	]
	})

	assert json_response_and_validate_schema(conn, 200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":keyaa1",
	"value" => [%{"tuple" => [":subkey2", "val2"]}],
	"db" => [":subkey2"]
	}
	],
	"need_reboot" => false
	}
	end

	test "proxy tuple localhost", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":pleroma",
	key: ":http",
	value: [
	%{"tuple" => [":proxy_url", %{"tuple" => [":socks5", "localhost", 1234]}]}
	]
	}
	]
	})

	assert %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":http",
	"value" => value,
	"db" => db
	}
	]
	} = json_response_and_validate_schema(conn, 200)

	assert %{"tuple" => [":proxy_url", %{"tuple" => [":socks5", "localhost", 1234]}]} in value
	assert ":proxy_url" in db
	end

	test "proxy tuple domain", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":pleroma",
	key: ":http",
	value: [
	%{"tuple" => [":proxy_url", %{"tuple" => [":socks5", "domain.com", 1234]}]}
	]
	}
	]
	})

	assert %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":http",
	"value" => value,
	"db" => db
	}
	]
	} = json_response_and_validate_schema(conn, 200)

	assert %{"tuple" => [":proxy_url", %{"tuple" => [":socks5", "domain.com", 1234]}]} in value
	assert ":proxy_url" in db
	end

	test "proxy tuple ip", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":pleroma",
	key: ":http",
	value: [
	%{"tuple" => [":proxy_url", %{"tuple" => [":socks5", "127.0.0.1", 1234]}]}
	]
	}
	]
	})

	assert %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => ":http",
	"value" => value,
	"db" => db
	}
	]
	} = json_response_and_validate_schema(conn, 200)

	assert %{"tuple" => [":proxy_url", %{"tuple" => [":socks5", "127.0.0.1", 1234]}]} in value
	assert ":proxy_url" in db
	end

	@tag capture_log: true
	test "doesn't set keys not in the whitelist", %{conn: conn} do
	clear_config(:database_config_whitelist, [
	{:pleroma, :key1},
	{:pleroma, :key2},
	{:pleroma, Pleroma.Captcha.NotReal},
	{:not_real}
	])

	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{group: ":pleroma", key: ":key1", value: "value1"},
	%{group: ":pleroma", key: ":key2", value: "value2"},
	%{group: ":pleroma", key: ":key3", value: "value3"},
	%{group: ":pleroma", key: "Pleroma.Web.Endpoint.NotReal", value: "value4"},
	%{group: ":pleroma", key: "Pleroma.Captcha.NotReal", value: "value5"},
	%{group: ":not_real", key: ":anything", value: "value6"}
	]
	})

	assert Application.get_env(:pleroma, :key1) == "value1"
	assert Application.get_env(:pleroma, :key2) == "value2"
	assert Application.get_env(:pleroma, :key3) == nil
	assert Application.get_env(:pleroma, Pleroma.Web.Endpoint.NotReal) == nil
	assert Application.get_env(:pleroma, Pleroma.Captcha.NotReal) == "value5"
	assert Application.get_env(:not_real, :anything) == "value6"
	end

	test "args for Pleroma.Upload.Filter.Mogrify with custom tuples", %{conn: conn} do
	clear_config(Pleroma.Upload.Filter.Mogrify)

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":pleroma",
	key: "Pleroma.Upload.Filter.Mogrify",
	value: [
	%{"tuple" => [":args", ["auto-orient", "strip"]]}
	]
	}
	]
	})
	\|> json_response_and_validate_schema(200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => "Pleroma.Upload.Filter.Mogrify",
	"value" => [
	%{"tuple" => [":args", ["auto-orient", "strip"]]}
	],
	"db" => [":args"]
	}
	],
	"need_reboot" => false
	}

	assert Config.get(Pleroma.Upload.Filter.Mogrify) == [args: ["auto-orient", "strip"]]

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{
	configs: [
	%{
	group: ":pleroma",
	key: "Pleroma.Upload.Filter.Mogrify",
	value: [
	%{
	"tuple" => [
	":args",
	[
	"auto-orient",
	"strip",
	"{\"implode\", \"1\"}",
	"{\"resize\", \"3840x1080>\"}"
	]
	]
	}
	]
	}
	]
	})
	\|> json_response(200) == %{
	"configs" => [
	%{
	"group" => ":pleroma",
	"key" => "Pleroma.Upload.Filter.Mogrify",
	"value" => [
	%{
	"tuple" => [
	":args",
	[
	"auto-orient",
	"strip",
	"{\"implode\", \"1\"}",
	"{\"resize\", \"3840x1080>\"}"
	]
	]
	}
	],
	"db" => [":args"]
	}
	],
	"need_reboot" => false
	}

	assert Config.get(Pleroma.Upload.Filter.Mogrify) == [
	args: ["auto-orient", "strip", {"implode", "1"}, {"resize", "3840x1080>"}]
	]
	end

	test "enables the welcome messages", %{conn: conn} do
	clear_config([:welcome])

	params = %{
	"group" => ":pleroma",
	"key" => ":welcome",
	"value" => [
	%{
	"tuple" => [
	":direct_message",
	[
	%{"tuple" => [":enabled", true]},
	%{"tuple" => [":message", "Welcome to Pleroma!"]},
	%{"tuple" => [":sender_nickname", "pleroma"]}
	]
	]
	},
	%{
	"tuple" => [
	":chat_message",
	[
	%{"tuple" => [":enabled", true]},
	%{"tuple" => [":message", "Welcome to Pleroma!"]},
	%{"tuple" => [":sender_nickname", "pleroma"]}
	]
	]
	},
	%{
	"tuple" => [
	":email",
	[
	%{"tuple" => [":enabled", true]},
	%{"tuple" => [":sender", %{"tuple" => ["pleroma@dev.dev", "Pleroma"]}]},
	%{"tuple" => [":subject", "Welcome to <%= instance_name %>!"]},
	%{"tuple" => [":html", "Welcome to <%= instance_name %>!"]},
	%{"tuple" => [":text", "Welcome to <%= instance_name %>!"]}
	]
	]
	}
	]
	}

	refute Pleroma.User.WelcomeEmail.enabled?()
	refute Pleroma.User.WelcomeMessage.enabled?()
	refute Pleroma.User.WelcomeChatMessage.enabled?()

	res =
	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{"configs" => [params]})
	\|> json_response_and_validate_schema(200)

	assert Pleroma.User.WelcomeEmail.enabled?()
	assert Pleroma.User.WelcomeMessage.enabled?()
	assert Pleroma.User.WelcomeChatMessage.enabled?()

	assert res == %{
	"configs" => [
	%{
	"db" => [":direct_message", ":chat_message", ":email"],
	"group" => ":pleroma",
	"key" => ":welcome",
	"value" => params["value"]
	}
	],
	"need_reboot" => false
	}
	end

	test "custom instance thumbnail", %{conn: conn} do
	clear_config([:instance])

	params = %{
	"group" => ":pleroma",
	"key" => ":instance",
	"value" => [
	%{
	"tuple" => [
	":instance_thumbnail",
	"https://example.com/media/new_thumbnail.jpg"
	]
	}
	]
	}

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{"configs" => [params]})
	\|> json_response_and_validate_schema(200) ==
	%{
	"configs" => [
	%{
	"db" => [":instance_thumbnail"],
	"group" => ":pleroma",
	"key" => ":instance",
	"value" => params["value"]
	}
	],
	"need_reboot" => false
	}

	assert conn
	\|> get("/api/v1/instance")
	\|> json_response_and_validate_schema(200)
	\|> Map.take(["thumbnail"]) ==
	%{"thumbnail" => "https://example.com/media/new_thumbnail.jpg"}
	end

	test "Concurrent Limiter", %{conn: conn} do
	clear_config([ConcurrentLimiter])

	params = %{
	"group" => ":pleroma",
	"key" => "ConcurrentLimiter",
	"value" => [
	%{
	"tuple" => [
	"Pleroma.Web.RichMedia.Helpers",
	[
	%{"tuple" => [":max_running", 6]},
	%{"tuple" => [":max_waiting", 6]}
	]
	]
	},
	%{
	"tuple" => [
	"Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy",
	[
	%{"tuple" => [":max_running", 7]},
	%{"tuple" => [":max_waiting", 7]}
	]
	]
	}
	]
	}

	assert conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/config", %{"configs" => [params]})
	\|> json_response_and_validate_schema(200)
	end
	end

	describe "GET /api/pleroma/admin/config/descriptions" do
	test "structure", %{conn: conn} do
	conn = get(conn, "/api/pleroma/admin/config/descriptions")

	assert [child \| _others] = json_response_and_validate_schema(conn, 200)

	assert child["children"]
	assert child["key"]
	assert String.starts_with?(child["group"], ":")
	assert child["description"]
	end

	test "filters by database configuration whitelist", %{conn: conn} do
	clear_config(:database_config_whitelist, [
	{:pleroma, :instance},
	{:pleroma, :activitypub},
	{:pleroma, Pleroma.Upload}
	])

	conn = get(conn, "/api/pleroma/admin/config/descriptions")

	children = json_response_and_validate_schema(conn, 200)

	assert length(children) == 3

	assert Enum.count(children, fn c -> c["group"] == ":pleroma" end) == 3

	instance = Enum.find(children, fn c -> c["key"] == ":instance" end)
	assert instance["children"]

	activitypub = Enum.find(children, fn c -> c["key"] == ":activitypub" end)
	assert activitypub["children"]

	web_endpoint = Enum.find(children, fn c -> c["key"] == "Pleroma.Upload" end)
	assert web_endpoint["children"]
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Thu, Oct 29, 2:58 AM (3 h, 9 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1797449
Default Alt Text: (210 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions