git.squeep.com Git - akkoma/blob - lib/pleroma/web/admin_api/admin_api_controller.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.AdminAPI.AdminAPIController do
   6   use Pleroma.Web, :controller
   7   alias Pleroma.Activity
   8   alias Pleroma.User
   9   alias Pleroma.UserInviteToken
  10   alias Pleroma.Web.ActivityPub.ActivityPub
  11   alias Pleroma.Web.ActivityPub.Relay
  12   alias Pleroma.Web.AdminAPI.AccountView
  13   alias Pleroma.Web.AdminAPI.ReportView
  14   alias Pleroma.Web.AdminAPI.Search
  15   alias Pleroma.Web.CommonAPI
  16   alias Pleroma.Web.MastodonAPI.StatusView
  17
  18   import Pleroma.Web.ControllerHelper, only: [json_response: 3]
  19
  20   require Logger
  21
  22   @users_page_size 50
  23
  24   action_fallback(:errors)
  25
  26   def user_delete(conn, %{"nickname" => nickname}) do
  27     User.get_cached_by_nickname(nickname)
  28     |> User.delete()
  29
  30     conn
  31     |> json(nickname)
  32   end
  33
  34   def user_follow(conn, %{"follower" => follower_nick, "followed" => followed_nick}) do
  35     with %User{} = follower <- User.get_cached_by_nickname(follower_nick),
  36          %User{} = followed <- User.get_cached_by_nickname(followed_nick) do
  37       User.follow(follower, followed)
  38     end
  39
  40     conn
  41     |> json("ok")
  42   end
  43
  44   def user_unfollow(conn, %{"follower" => follower_nick, "followed" => followed_nick}) do
  45     with %User{} = follower <- User.get_cached_by_nickname(follower_nick),
  46          %User{} = followed <- User.get_cached_by_nickname(followed_nick) do
  47       User.unfollow(follower, followed)
  48     end
  49
  50     conn
  51     |> json("ok")
  52   end
  53
  54   def users_create(conn, %{"users" => users}) do
  55     changesets =
  56       Enum.map(users, fn %{"nickname" => nickname, "email" => email, "password" => password} ->
  57         user_data = %{
  58           nickname: nickname,
  59           name: nickname,
  60           email: email,
  61           password: password,
  62           password_confirmation: password,
  63           bio: "."
  64         }
  65
  66         User.register_changeset(%User{}, user_data, need_confirmation: false)
  67       end)
  68       |> Enum.reduce(Ecto.Multi.new(), fn changeset, multi ->
  69         Ecto.Multi.insert(multi, Ecto.UUID.generate(), changeset)
  70       end)
  71
  72     case Pleroma.Repo.transaction(changesets) do
  73       {:ok, users} ->
  74         res =
  75           users
  76           |> Map.values()
  77           |> Enum.map(fn user ->
  78             {:ok, user} = User.post_register_action(user)
  79             user
  80           end)
  81           |> Enum.map(&AccountView.render("created.json", %{user: &1}))
  82
  83         conn
  84         |> json(res)
  85
  86       {:error, id, changeset, _} ->
  87         res =
  88           Enum.map(changesets.operations, fn
  89             {current_id, {:changeset, _current_changeset, _}} when current_id == id ->
  90               AccountView.render("create-error.json", %{changeset: changeset})
  91
  92             {_, {:changeset, current_changeset, _}} ->
  93               AccountView.render("create-error.json", %{changeset: current_changeset})
  94           end)
  95
  96         conn
  97         |> put_status(:conflict)
  98         |> json(res)
  99     end
 100   end
 101
 102   def user_show(conn, %{"nickname" => nickname}) do
 103     with %User{} = user <- User.get_cached_by_nickname(nickname) do
 104       conn
 105       |> json(AccountView.render("show.json", %{user: user}))
 106     else
 107       _ -> {:error, :not_found}
 108     end
 109   end
 110
 111   def user_toggle_activation(conn, %{"nickname" => nickname}) do
 112     user = User.get_cached_by_nickname(nickname)
 113
 114     {:ok, updated_user} = User.deactivate(user, !user.info.deactivated)
 115
 116     conn
 117     |> json(AccountView.render("show.json", %{user: updated_user}))
 118   end
 119
 120   def tag_users(conn, %{"nicknames" => nicknames, "tags" => tags}) do
 121     with {:ok, _} <- User.tag(nicknames, tags),
 122          do: json_response(conn, :no_content, "")
 123   end
 124
 125   def untag_users(conn, %{"nicknames" => nicknames, "tags" => tags}) do
 126     with {:ok, _} <- User.untag(nicknames, tags),
 127          do: json_response(conn, :no_content, "")
 128   end
 129
 130   def list_users(conn, params) do
 131     {page, page_size} = page_params(params)
 132     filters = maybe_parse_filters(params["filters"])
 133
 134     search_params = %{
 135       query: params["query"],
 136       page: page,
 137       page_size: page_size,
 138       tags: params["tags"],
 139       name: params["name"],
 140       email: params["email"]
 141     }
 142
 143     with {:ok, users, count} <- Search.user(Map.merge(search_params, filters)),
 144          do:
 145            conn
 146            |> json(
 147              AccountView.render("index.json",
 148                users: users,
 149                count: count,
 150                page_size: page_size
 151              )
 152            )
 153   end
 154
 155   @filters ~w(local external active deactivated is_admin is_moderator)
 156
 157   @spec maybe_parse_filters(String.t()) :: %{required(String.t()) => true} | %{}
 158   defp maybe_parse_filters(filters) when is_nil(filters) or filters == "", do: %{}
 159
 160   defp maybe_parse_filters(filters) do
 161     filters
 162     |> String.split(",")
 163     |> Enum.filter(&Enum.member?(@filters, &1))
 164     |> Enum.map(&String.to_atom(&1))
 165     |> Enum.into(%{}, &{&1, true})
 166   end
 167
 168   def right_add(conn, %{"permission_group" => permission_group, "nickname" => nickname})
 169       when permission_group in ["moderator", "admin"] do
 170     user = User.get_cached_by_nickname(nickname)
 171
 172     info =
 173       %{}
 174       |> Map.put("is_" <> permission_group, true)
 175
 176     info_cng = User.Info.admin_api_update(user.info, info)
 177
 178     cng =
 179       user
 180       |> Ecto.Changeset.change()
 181       |> Ecto.Changeset.put_embed(:info, info_cng)
 182
 183     {:ok, _user} = User.update_and_set_cache(cng)
 184
 185     json(conn, info)
 186   end
 187
 188   def right_add(conn, _) do
 189     conn
 190     |> put_status(404)
 191     |> json(%{error: "No such permission_group"})
 192   end
 193
 194   def right_get(conn, %{"nickname" => nickname}) do
 195     user = User.get_cached_by_nickname(nickname)
 196
 197     conn
 198     |> json(%{
 199       is_moderator: user.info.is_moderator,
 200       is_admin: user.info.is_admin
 201     })
 202   end
 203
 204   def right_delete(
 205         %{assigns: %{user: %User{:nickname => admin_nickname}}} = conn,
 206         %{
 207           "permission_group" => permission_group,
 208           "nickname" => nickname
 209         }
 210       )
 211       when permission_group in ["moderator", "admin"] do
 212     if admin_nickname == nickname do
 213       conn
 214       |> put_status(403)
 215       |> json(%{error: "You can't revoke your own admin status."})
 216     else
 217       user = User.get_cached_by_nickname(nickname)
 218
 219       info =
 220         %{}
 221         |> Map.put("is_" <> permission_group, false)
 222
 223       info_cng = User.Info.admin_api_update(user.info, info)
 224
 225       cng =
 226         Ecto.Changeset.change(user)
 227         |> Ecto.Changeset.put_embed(:info, info_cng)
 228
 229       {:ok, _user} = User.update_and_set_cache(cng)
 230
 231       json(conn, info)
 232     end
 233   end
 234
 235   def right_delete(conn, _) do
 236     conn
 237     |> put_status(404)
 238     |> json(%{error: "No such permission_group"})
 239   end
 240
 241   def set_activation_status(conn, %{"nickname" => nickname, "status" => status}) do
 242     with {:ok, status} <- Ecto.Type.cast(:boolean, status),
 243          %User{} = user <- User.get_cached_by_nickname(nickname),
 244          {:ok, _} <- User.deactivate(user, !status),
 245          do: json_response(conn, :no_content, "")
 246   end
 247
 248   def relay_follow(conn, %{"relay_url" => target}) do
 249     with {:ok, _message} <- Relay.follow(target) do
 250       json(conn, target)
 251     else
 252       _ ->
 253         conn
 254         |> put_status(500)
 255         |> json(target)
 256     end
 257   end
 258
 259   def relay_unfollow(conn, %{"relay_url" => target}) do
 260     with {:ok, _message} <- Relay.unfollow(target) do
 261       json(conn, target)
 262     else
 263       _ ->
 264         conn
 265         |> put_status(500)
 266         |> json(target)
 267     end
 268   end
 269
 270   @doc "Sends registration invite via email"
 271   def email_invite(%{assigns: %{user: user}} = conn, %{"email" => email} = params) do
 272     with true <-
 273            Pleroma.Config.get([:instance, :invites_enabled]) &&
 274              !Pleroma.Config.get([:instance, :registrations_open]),
 275          {:ok, invite_token} <- UserInviteToken.create_invite(),
 276          email <-
 277            Pleroma.Emails.UserEmail.user_invitation_email(
 278              user,
 279              invite_token,
 280              email,
 281              params["name"]
 282            ),
 283          {:ok, _} <- Pleroma.Emails.Mailer.deliver(email) do
 284       json_response(conn, :no_content, "")
 285     end
 286   end
 287
 288   @doc "Get a account registeration invite token (base64 string)"
 289   def get_invite_token(conn, params) do
 290     options = params["invite"] || %{}
 291     {:ok, invite} = UserInviteToken.create_invite(options)
 292
 293     conn
 294     |> json(invite.token)
 295   end
 296
 297   @doc "Get list of created invites"
 298   def invites(conn, _params) do
 299     invites = UserInviteToken.list_invites()
 300
 301     conn
 302     |> json(AccountView.render("invites.json", %{invites: invites}))
 303   end
 304
 305   @doc "Revokes invite by token"
 306   def revoke_invite(conn, %{"token" => token}) do
 307     invite = UserInviteToken.find_by_token!(token)
 308     {:ok, updated_invite} = UserInviteToken.update_invite(invite, %{used: true})
 309
 310     conn
 311     |> json(AccountView.render("invite.json", %{invite: updated_invite}))
 312   end
 313
 314   @doc "Get a password reset token (base64 string) for given nickname"
 315   def get_password_reset(conn, %{"nickname" => nickname}) do
 316     (%User{local: true} = user) = User.get_cached_by_nickname(nickname)
 317     {:ok, token} = Pleroma.PasswordResetToken.create_token(user)
 318
 319     conn
 320     |> json(token.token)
 321   end
 322
 323   def list_reports(conn, params) do
 324     params =
 325       params
 326       |> Map.put("type", "Flag")
 327       |> Map.put("skip_preload", true)
 328
 329     reports =
 330       []
 331       |> ActivityPub.fetch_activities(params)
 332       |> Enum.reverse()
 333
 334     conn
 335     |> put_view(ReportView)
 336     |> render("index.json", %{reports: reports})
 337   end
 338
 339   def report_show(conn, %{"id" => id}) do
 340     with %Activity{} = report <- Activity.get_by_id(id) do
 341       conn
 342       |> put_view(ReportView)
 343       |> render("show.json", %{report: report})
 344     else
 345       _ -> {:error, :not_found}
 346     end
 347   end
 348
 349   def report_update_state(conn, %{"id" => id, "state" => state}) do
 350     with {:ok, report} <- CommonAPI.update_report_state(id, state) do
 351       conn
 352       |> put_view(ReportView)
 353       |> render("show.json", %{report: report})
 354     end
 355   end
 356
 357   def report_respond(%{assigns: %{user: user}} = conn, %{"id" => id} = params) do
 358     with false <- is_nil(params["status"]),
 359          %Activity{} <- Activity.get_by_id(id) do
 360       params =
 361         params
 362         |> Map.put("in_reply_to_status_id", id)
 363         |> Map.put("visibility", "direct")
 364
 365       {:ok, activity} = CommonAPI.post(user, params)
 366
 367       conn
 368       |> put_view(StatusView)
 369       |> render("status.json", %{activity: activity})
 370     else
 371       true ->
 372         {:param_cast, nil}
 373
 374       nil ->
 375         {:error, :not_found}
 376     end
 377   end
 378
 379   def status_update(conn, %{"id" => id} = params) do
 380     with {:ok, activity} <- CommonAPI.update_activity_scope(id, params) do
 381       conn
 382       |> put_view(StatusView)
 383       |> render("status.json", %{activity: activity})
 384     end
 385   end
 386
 387   def status_delete(%{assigns: %{user: user}} = conn, %{"id" => id}) do
 388     with {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
 389       json(conn, %{})
 390     end
 391   end
 392
 393   def errors(conn, {:error, :not_found}) do
 394     conn
 395     |> put_status(404)
 396     |> json("Not found")
 397   end
 398
 399   def errors(conn, {:error, reason}) do
 400     conn
 401     |> put_status(400)
 402     |> json(reason)
 403   end
 404
 405   def errors(conn, {:param_cast, _}) do
 406     conn
 407     |> put_status(400)
 408     |> json("Invalid parameters")
 409   end
 410
 411   def errors(conn, _) do
 412     conn
 413     |> put_status(500)
 414     |> json("Something went wrong")
 415   end
 416
 417   defp page_params(params) do
 418     {get_page(params["page"]), get_page_size(params["page_size"])}
 419   end
 420
 421   defp get_page(page_string) when is_nil(page_string), do: 1
 422
 423   defp get_page(page_string) do
 424     case Integer.parse(page_string) do
 425       {page, _} -> page
 426       :error -> 1
 427     end
 428   end
 429
 430   defp get_page_size(page_size_string) when is_nil(page_size_string), do: @users_page_size
 431
 432   defp get_page_size(page_size_string) do
 433     case Integer.parse(page_size_string) do
 434       {page_size, _} -> page_size
 435       :error -> @users_page_size
 436     end
 437   end
 438 end