1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.AccountController do
6 use Pleroma.Web, :controller
8 import Pleroma.Web.ControllerHelper,
12 assign_account_by_id: 2,
13 embed_relationships?: 1,
19 alias Pleroma.Web.ActivityPub.ActivityPub
20 alias Pleroma.Web.ActivityPub.Builder
21 alias Pleroma.Web.ActivityPub.Pipeline
22 alias Pleroma.Web.CommonAPI
23 alias Pleroma.Web.MastodonAPI.ListView
24 alias Pleroma.Web.MastodonAPI.MastodonAPI
25 alias Pleroma.Web.MastodonAPI.MastodonAPIController
26 alias Pleroma.Web.MastodonAPI.StatusView
27 alias Pleroma.Web.OAuth.OAuthController
28 alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
29 alias Pleroma.Web.Plugs.OAuthScopesPlug
30 alias Pleroma.Web.Plugs.RateLimiter
31 alias Pleroma.Web.TwitterAPI.TwitterAPI
33 plug(Pleroma.Web.ApiSpec.CastAndValidate)
35 plug(:skip_plug, [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :create)
37 plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action in [:show, :statuses])
41 %{fallback: :proceed_unauthenticated, scopes: ["read:accounts"]}
42 when action in [:show, :followers, :following]
47 %{fallback: :proceed_unauthenticated, scopes: ["read:statuses"]}
48 when action == :statuses
53 %{scopes: ["read:accounts"]}
54 when action in [:verify_credentials, :endorsements, :identity_proofs]
57 plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :update_credentials)
59 plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :lists)
63 %{scopes: ["follow", "read:blocks"]} when action == :blocks
68 %{scopes: ["follow", "write:blocks"]} when action in [:block, :unblock]
71 plug(OAuthScopesPlug, %{scopes: ["read:follows"]} when action == :relationships)
75 %{scopes: ["follow", "write:follows"]} when action in [:follow_by_uri, :follow, :unfollow]
78 plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)
80 plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])
82 @relationship_actions [:follow, :unfollow]
83 @needs_account ~W(followers following lists follow unfollow mute unmute block unblock)a
87 [name: :relation_id_action, params: [:id, :uri]] when action in @relationship_actions
90 plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
91 plug(RateLimiter, [name: :app_account_creation] when action == :create)
92 plug(:assign_account_by_id when action in @needs_account)
94 action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
96 defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AccountOperation
98 @doc "POST /api/v1/accounts"
99 def create(%{assigns: %{app: app}, body_params: params} = conn, _params) do
100 with :ok <- validate_email_param(params),
101 :ok <- TwitterAPI.validate_captcha(app, params),
102 {:ok, user} <- TwitterAPI.register_user(params),
104 {:login, OAuthController.login(user, app, app.scopes)} do
105 OAuthController.after_token_exchange(conn, %{user: user, token: token})
107 {:login, {:account_status, :confirmation_pending}} ->
108 json_response(conn, :ok, %{
109 message: "You have been registered. Please check your email for further instructions.",
110 identifier: "missing_confirmed_email"
113 {:login, {:account_status, :approval_pending}} ->
114 json_response(conn, :ok, %{
116 "You have been registered. You'll be able to log in once your account is approved.",
117 identifier: "awaiting_approval"
121 json_response(conn, :ok, %{
123 "You have been registered. Some post-registration steps may be pending. " <>
124 "Please log in manually.",
125 identifier: "manual_login_required"
129 json_response(conn, :bad_request, %{error: error})
133 def create(%{assigns: %{app: _app}} = conn, _) do
134 render_error(conn, :bad_request, "Missing parameters")
137 def create(conn, _) do
138 render_error(conn, :forbidden, "Invalid credentials")
141 defp validate_email_param(%{email: email}) when not is_nil(email), do: :ok
143 defp validate_email_param(_) do
144 case Pleroma.Config.get([:instance, :account_activation_required]) do
145 true -> {:error, dgettext("errors", "Missing parameter: %{name}", name: "email")}
150 @doc "GET /api/v1/accounts/verify_credentials"
151 def verify_credentials(%{assigns: %{user: user}} = conn, _) do
152 chat_token = Phoenix.Token.sign(conn, "user socket", user.id)
154 render(conn, "show.json",
157 with_pleroma_settings: true,
158 with_chat_token: chat_token
162 @doc "PATCH /api/v1/accounts/update_credentials"
163 def update_credentials(%{assigns: %{user: user}, body_params: params} = conn, _params) do
166 |> Enum.filter(fn {_, value} -> not is_nil(value) end)
169 # We use an empty string as a special value to reset
170 # avatars, banners, backgrounds
171 user_image_value = fn
173 value -> {:ok, value}
179 :hide_followers_count,
185 :skip_thread_containment,
186 :allow_following_move,
187 :accepts_chat_messages
189 |> Enum.reduce(%{}, fn key, acc ->
190 Maps.put_if_present(acc, key, params[key], &{:ok, truthy_param?(&1)})
192 |> Maps.put_if_present(:name, params[:display_name])
193 |> Maps.put_if_present(:bio, params[:note])
194 |> Maps.put_if_present(:raw_bio, params[:note])
195 |> Maps.put_if_present(:avatar, params[:avatar], user_image_value)
196 |> Maps.put_if_present(:banner, params[:header], user_image_value)
197 |> Maps.put_if_present(:background, params[:pleroma_background_image], user_image_value)
198 |> Maps.put_if_present(
200 params[:fields_attributes],
201 &{:ok, normalize_fields_attributes(&1)}
203 |> Maps.put_if_present(:pleroma_settings_store, params[:pleroma_settings_store])
204 |> Maps.put_if_present(:default_scope, params[:default_scope])
205 |> Maps.put_if_present(:default_scope, params["source"]["privacy"])
206 |> Maps.put_if_present(:actor_type, params[:bot], fn bot ->
207 if bot, do: {:ok, "Service"}, else: {:ok, "Person"}
209 |> Maps.put_if_present(:actor_type, params[:actor_type])
210 # Note: param name is indeed :locked (not an error)
211 |> Maps.put_if_present(:is_locked, params[:locked])
212 # Note: param name is indeed :discoverable (not an error)
213 |> Maps.put_if_present(:is_discoverable, params[:discoverable])
217 # We want to update the user through the pipeline, but the ActivityPub
218 # update information is not quite enough for this, because this also
219 # contains local settings that don't federate and don't even appear
220 # in the Update activity.
222 # So we first build the normal local changeset, then apply it to the
223 # user data, but don't persist it. With this, we generate the object
224 # data for our update activity. We feed this and the changeset as meta
225 # inforation into the pipeline, where they will be properly updated and
227 with changeset <- User.update_changeset(user, user_params),
228 {:ok, unpersisted_user} <- Ecto.Changeset.apply_action(changeset, :update),
230 Pleroma.Web.ActivityPub.UserView.render("user.json", user: unpersisted_user)
231 |> Map.delete("@context"),
232 {:ok, update_data, []} <- Builder.update(user, updated_object),
234 Pipeline.common_pipeline(update_data,
236 user_update_changeset: changeset
238 render(conn, "show.json",
239 user: unpersisted_user,
240 for: unpersisted_user,
241 with_pleroma_settings: true
244 _e -> render_error(conn, :forbidden, "Invalid request")
248 defp normalize_fields_attributes(fields) do
249 if Enum.all?(fields, &is_tuple/1) do
250 Enum.map(fields, fn {_, v} -> v end)
253 %{} = field -> %{"name" => field.name, "value" => field.value}
259 @doc "GET /api/v1/accounts/relationships"
260 def relationships(%{assigns: %{user: user}} = conn, %{id: id}) do
261 targets = User.get_all_by_ids(List.wrap(id))
263 render(conn, "relationships.json", user: user, targets: targets)
266 # Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
267 def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])
269 @doc "GET /api/v1/accounts/:id"
270 def show(%{assigns: %{user: for_user}} = conn, %{id: nickname_or_id}) do
271 with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
272 :visible <- User.visible_for(user, for_user) do
273 render(conn, "show.json", user: user, for: for_user)
275 error -> user_visibility_error(conn, error)
279 @doc "GET /api/v1/accounts/:id/statuses"
280 def statuses(%{assigns: %{user: reading_user}} = conn, params) do
281 with %User{} = user <- User.get_cached_by_nickname_or_id(params.id, for: reading_user),
282 :visible <- User.visible_for(user, reading_user) do
285 |> Map.delete(:tagged)
286 |> Map.put(:tag, params[:tagged])
288 activities = ActivityPub.fetch_user_activities(user, reading_user, params)
291 |> add_link_headers(activities)
292 |> put_view(StatusView)
293 |> render("index.json",
294 activities: activities,
297 with_muted: Map.get(params, :with_muted, false)
300 error -> user_visibility_error(conn, error)
304 defp user_visibility_error(conn, error) do
306 :restrict_unauthenticated ->
307 render_error(conn, :unauthorized, "This API requires an authenticated user")
310 render_error(conn, :not_found, "Can't find user")
314 @doc "GET /api/v1/accounts/:id/followers"
315 def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
318 |> Enum.map(fn {key, value} -> {to_string(key), value} end)
323 for_user && user.id == for_user.id -> MastodonAPI.get_followers(user, params)
324 user.hide_followers -> []
325 true -> MastodonAPI.get_followers(user, params)
329 |> add_link_headers(followers)
330 # https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
331 |> render("index.json",
335 embed_relationships: embed_relationships?(params)
339 @doc "GET /api/v1/accounts/:id/following"
340 def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
343 |> Enum.map(fn {key, value} -> {to_string(key), value} end)
348 for_user && user.id == for_user.id -> MastodonAPI.get_friends(user, params)
349 user.hide_follows -> []
350 true -> MastodonAPI.get_friends(user, params)
354 |> add_link_headers(followers)
355 # https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
356 |> render("index.json",
360 embed_relationships: embed_relationships?(params)
364 @doc "GET /api/v1/accounts/:id/lists"
365 def lists(%{assigns: %{user: user, account: account}} = conn, _params) do
366 lists = Pleroma.List.get_lists_account_belongs(user, account)
369 |> put_view(ListView)
370 |> render("index.json", lists: lists)
373 @doc "POST /api/v1/accounts/:id/follow"
374 def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
375 {:error, "Can not follow yourself"}
378 def follow(%{body_params: params, assigns: %{user: follower, account: followed}} = conn, _) do
379 with {:ok, follower} <- MastodonAPI.follow(follower, followed, params) do
380 render(conn, "relationship.json", user: follower, target: followed)
382 {:error, message} -> json_response(conn, :forbidden, %{error: message})
386 @doc "POST /api/v1/accounts/:id/unfollow"
387 def unfollow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
388 {:error, "Can not unfollow yourself"}
391 def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
392 with {:ok, follower} <- CommonAPI.unfollow(follower, followed) do
393 render(conn, "relationship.json", user: follower, target: followed)
397 @doc "POST /api/v1/accounts/:id/mute"
398 def mute(%{assigns: %{user: muter, account: muted}, body_params: params} = conn, _params) do
399 with {:ok, _user_relationships} <- User.mute(muter, muted, params) do
400 render(conn, "relationship.json", user: muter, target: muted)
402 {:error, message} -> json_response(conn, :forbidden, %{error: message})
406 @doc "POST /api/v1/accounts/:id/unmute"
407 def unmute(%{assigns: %{user: muter, account: muted}} = conn, _params) do
408 with {:ok, _user_relationships} <- User.unmute(muter, muted) do
409 render(conn, "relationship.json", user: muter, target: muted)
411 {:error, message} -> json_response(conn, :forbidden, %{error: message})
415 @doc "POST /api/v1/accounts/:id/block"
416 def block(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
417 with {:ok, _activity} <- CommonAPI.block(blocker, blocked) do
418 render(conn, "relationship.json", user: blocker, target: blocked)
420 {:error, message} -> json_response(conn, :forbidden, %{error: message})
424 @doc "POST /api/v1/accounts/:id/unblock"
425 def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
426 with {:ok, _activity} <- CommonAPI.unblock(blocker, blocked) do
427 render(conn, "relationship.json", user: blocker, target: blocked)
429 {:error, message} -> json_response(conn, :forbidden, %{error: message})
433 @doc "POST /api/v1/follows"
434 def follow_by_uri(%{body_params: %{uri: uri}} = conn, _) do
435 case User.get_cached_by_nickname(uri) do
438 |> assign(:account, user)
446 @doc "GET /api/v1/mutes"
447 def mutes(%{assigns: %{user: user}} = conn, params) do
450 |> User.muted_users_relation(_restrict_deactivated = true)
451 |> Pleroma.Pagination.fetch_paginated(Map.put(params, :skip_order, true))
454 |> add_link_headers(users)
455 |> render("index.json", users: users, for: user, as: :user)
458 @doc "GET /api/v1/blocks"
459 def blocks(%{assigns: %{user: user}} = conn, params) do
462 |> User.blocked_users_relation(_restrict_deactivated = true)
463 |> Pleroma.Pagination.fetch_paginated(Map.put(params, :skip_order, true))
466 |> add_link_headers(users)
467 |> render("index.json", users: users, for: user, as: :user)
470 @doc "GET /api/v1/endorsements"
471 def endorsements(conn, params), do: MastodonAPIController.empty_array(conn, params)
473 @doc "GET /api/v1/identity_proofs"
474 def identity_proofs(conn, params), do: MastodonAPIController.empty_array(conn, params)