git.squeep.com Git - akkoma/blob - lib/pleroma/web/mastodon_api/controllers/account_controller.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.AccountController do
   6   use Pleroma.Web, :controller
   7
   8   import Pleroma.Web.ControllerHelper,
   9     only: [
  10       add_link_headers: 2,
  11       truthy_param?: 1,
  12       assign_account_by_id: 2,
  13       embed_relationships?: 1,
  14       json_response: 3
  15     ]
  16
  17   alias Pleroma.Maps
  18   alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
  19   alias Pleroma.Plugs.OAuthScopesPlug
  20   alias Pleroma.Plugs.RateLimiter
  21   alias Pleroma.User
  22   alias Pleroma.Web.ActivityPub.ActivityPub
  23   alias Pleroma.Web.CommonAPI
  24   alias Pleroma.Web.MastodonAPI.ListView
  25   alias Pleroma.Web.MastodonAPI.MastodonAPI
  26   alias Pleroma.Web.MastodonAPI.MastodonAPIController
  27   alias Pleroma.Web.MastodonAPI.StatusView
  28   alias Pleroma.Web.OAuth.Token
  29   alias Pleroma.Web.TwitterAPI.TwitterAPI
  30
  31   plug(Pleroma.Web.ApiSpec.CastAndValidate)
  32
  33   plug(:skip_plug, [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :create)
  34
  35   plug(:skip_plug, EnsurePublicOrAuthenticatedPlug when action in [:show, :statuses])
  36
  37   plug(
  38     OAuthScopesPlug,
  39     %{fallback: :proceed_unauthenticated, scopes: ["read:accounts"]}
  40     when action in [:show, :followers, :following]
  41   )
  42
  43   plug(
  44     OAuthScopesPlug,
  45     %{fallback: :proceed_unauthenticated, scopes: ["read:statuses"]}
  46     when action == :statuses
  47   )
  48
  49   plug(
  50     OAuthScopesPlug,
  51     %{scopes: ["read:accounts"]}
  52     when action in [:verify_credentials, :endorsements, :identity_proofs]
  53   )
  54
  55   plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :update_credentials)
  56
  57   plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :lists)
  58
  59   plug(
  60     OAuthScopesPlug,
  61     %{scopes: ["follow", "read:blocks"]} when action == :blocks
  62   )
  63
  64   plug(
  65     OAuthScopesPlug,
  66     %{scopes: ["follow", "write:blocks"]} when action in [:block, :unblock]
  67   )
  68
  69   plug(OAuthScopesPlug, %{scopes: ["read:follows"]} when action == :relationships)
  70
  71   plug(
  72     OAuthScopesPlug,
  73     %{scopes: ["follow", "write:follows"]} when action in [:follow_by_uri, :follow, :unfollow]
  74   )
  75
  76   plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)
  77
  78   plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])
  79
  80   @relationship_actions [:follow, :unfollow]
  81   @needs_account ~W(followers following lists follow unfollow mute unmute block unblock)a
  82
  83   plug(
  84     RateLimiter,
  85     [name: :relation_id_action, params: [:id, :uri]] when action in @relationship_actions
  86   )
  87
  88   plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
  89   plug(RateLimiter, [name: :app_account_creation] when action == :create)
  90   plug(:assign_account_by_id when action in @needs_account)
  91
  92   action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
  93
  94   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AccountOperation
  95
  96   @doc "POST /api/v1/accounts"
  97   def create(%{assigns: %{app: app}, body_params: params} = conn, _params) do
  98     with :ok <- validate_email_param(params),
  99          :ok <- TwitterAPI.validate_captcha(app, params),
 100          {:ok, user} <- TwitterAPI.register_user(params, need_confirmation: true),
 101          {:ok, token} <- Token.create_token(app, user, %{scopes: app.scopes}) do
 102       json(conn, %{
 103         token_type: "Bearer",
 104         access_token: token.token,
 105         scope: app.scopes,
 106         created_at: Token.Utils.format_created_at(token)
 107       })
 108     else
 109       {:error, error} -> json_response(conn, :bad_request, %{error: error})
 110     end
 111   end
 112
 113   def create(%{assigns: %{app: _app}} = conn, _) do
 114     render_error(conn, :bad_request, "Missing parameters")
 115   end
 116
 117   def create(conn, _) do
 118     render_error(conn, :forbidden, "Invalid credentials")
 119   end
 120
 121   defp validate_email_param(%{email: email}) when not is_nil(email), do: :ok
 122
 123   defp validate_email_param(_) do
 124     case Pleroma.Config.get([:instance, :account_activation_required]) do
 125       true -> {:error, dgettext("errors", "Missing parameter: %{name}", name: "email")}
 126       _ -> :ok
 127     end
 128   end
 129
 130   @doc "GET /api/v1/accounts/verify_credentials"
 131   def verify_credentials(%{assigns: %{user: user}} = conn, _) do
 132     chat_token = Phoenix.Token.sign(conn, "user socket", user.id)
 133
 134     render(conn, "show.json",
 135       user: user,
 136       for: user,
 137       with_pleroma_settings: true,
 138       with_chat_token: chat_token
 139     )
 140   end
 141
 142   @doc "PATCH /api/v1/accounts/update_credentials"
 143   def update_credentials(%{assigns: %{user: user}, body_params: params} = conn, _params) do
 144     params =
 145       params
 146       |> Enum.filter(fn {_, value} -> not is_nil(value) end)
 147       |> Enum.into(%{})
 148
 149     user_params =
 150       [
 151         :no_rich_text,
 152         :locked,
 153         :hide_followers_count,
 154         :hide_follows_count,
 155         :hide_followers,
 156         :hide_follows,
 157         :hide_favorites,
 158         :show_role,
 159         :skip_thread_containment,
 160         :allow_following_move,
 161         :discoverable
 162       ]
 163       |> Enum.reduce(%{}, fn key, acc ->
 164         Maps.put_if_present(acc, key, params[key], &{:ok, truthy_param?(&1)})
 165       end)
 166       |> Maps.put_if_present(:name, params[:display_name])
 167       |> Maps.put_if_present(:bio, params[:note])
 168       |> Maps.put_if_present(:raw_bio, params[:note])
 169       |> Maps.put_if_present(:avatar, params[:avatar])
 170       |> Maps.put_if_present(:banner, params[:header])
 171       |> Maps.put_if_present(:background, params[:pleroma_background_image])
 172       |> Maps.put_if_present(
 173         :raw_fields,
 174         params[:fields_attributes],
 175         &{:ok, normalize_fields_attributes(&1)}
 176       )
 177       |> Maps.put_if_present(:pleroma_settings_store, params[:pleroma_settings_store])
 178       |> Maps.put_if_present(:default_scope, params[:default_scope])
 179       |> Maps.put_if_present(:default_scope, params["source"]["privacy"])
 180       |> Maps.put_if_present(:actor_type, params[:bot], fn bot ->
 181         if bot, do: {:ok, "Service"}, else: {:ok, "Person"}
 182       end)
 183       |> Maps.put_if_present(:actor_type, params[:actor_type])
 184
 185     changeset = User.update_changeset(user, user_params)
 186
 187     with {:ok, user} <- User.update_and_set_cache(changeset) do
 188       user
 189       |> build_update_activity_params()
 190       |> ActivityPub.update()
 191
 192       render(conn, "show.json", user: user, for: user, with_pleroma_settings: true)
 193     else
 194       _e -> render_error(conn, :forbidden, "Invalid request")
 195     end
 196   end
 197
 198   # Hotfix, handling will be redone with the pipeline
 199   defp build_update_activity_params(user) do
 200     object =
 201       Pleroma.Web.ActivityPub.UserView.render("user.json", user: user)
 202       |> Map.delete("@context")
 203
 204     %{
 205       local: true,
 206       to: [user.follower_address],
 207       cc: [],
 208       object: object,
 209       actor: user.ap_id
 210     }
 211   end
 212
 213   defp normalize_fields_attributes(fields) do
 214     if Enum.all?(fields, &is_tuple/1) do
 215       Enum.map(fields, fn {_, v} -> v end)
 216     else
 217       Enum.map(fields, fn
 218         %{} = field -> %{"name" => field.name, "value" => field.value}
 219         field -> field
 220       end)
 221     end
 222   end
 223
 224   @doc "GET /api/v1/accounts/relationships"
 225   def relationships(%{assigns: %{user: user}} = conn, %{id: id}) do
 226     targets = User.get_all_by_ids(List.wrap(id))
 227
 228     render(conn, "relationships.json", user: user, targets: targets)
 229   end
 230
 231   # Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
 232   def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])
 233
 234   @doc "GET /api/v1/accounts/:id"
 235   def show(%{assigns: %{user: for_user}} = conn, %{id: nickname_or_id}) do
 236     with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
 237          true <- User.visible_for?(user, for_user) do
 238       render(conn, "show.json", user: user, for: for_user)
 239     else
 240       _e -> render_error(conn, :not_found, "Can't find user")
 241     end
 242   end
 243
 244   @doc "GET /api/v1/accounts/:id/statuses"
 245   def statuses(%{assigns: %{user: reading_user}} = conn, params) do
 246     with %User{} = user <- User.get_cached_by_nickname_or_id(params.id, for: reading_user),
 247          true <- User.visible_for?(user, reading_user) do
 248       params =
 249         params
 250         |> Map.delete(:tagged)
 251         |> Map.put(:tag, params[:tagged])
 252
 253       activities = ActivityPub.fetch_user_activities(user, reading_user, params)
 254
 255       conn
 256       |> add_link_headers(activities)
 257       |> put_view(StatusView)
 258       |> render("index.json",
 259         activities: activities,
 260         for: reading_user,
 261         as: :activity
 262       )
 263     else
 264       _e -> render_error(conn, :not_found, "Can't find user")
 265     end
 266   end
 267
 268   @doc "GET /api/v1/accounts/:id/followers"
 269   def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
 270     params =
 271       params
 272       |> Enum.map(fn {key, value} -> {to_string(key), value} end)
 273       |> Enum.into(%{})
 274
 275     followers =
 276       cond do
 277         for_user && user.id == for_user.id -> MastodonAPI.get_followers(user, params)
 278         user.hide_followers -> []
 279         true -> MastodonAPI.get_followers(user, params)
 280       end
 281
 282     conn
 283     |> add_link_headers(followers)
 284     # https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
 285     |> render("index.json",
 286       for: for_user,
 287       users: followers,
 288       as: :user,
 289       embed_relationships: embed_relationships?(params)
 290     )
 291   end
 292
 293   @doc "GET /api/v1/accounts/:id/following"
 294   def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
 295     params =
 296       params
 297       |> Enum.map(fn {key, value} -> {to_string(key), value} end)
 298       |> Enum.into(%{})
 299
 300     followers =
 301       cond do
 302         for_user && user.id == for_user.id -> MastodonAPI.get_friends(user, params)
 303         user.hide_follows -> []
 304         true -> MastodonAPI.get_friends(user, params)
 305       end
 306
 307     conn
 308     |> add_link_headers(followers)
 309     # https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
 310     |> render("index.json",
 311       for: for_user,
 312       users: followers,
 313       as: :user,
 314       embed_relationships: embed_relationships?(params)
 315     )
 316   end
 317
 318   @doc "GET /api/v1/accounts/:id/lists"
 319   def lists(%{assigns: %{user: user, account: account}} = conn, _params) do
 320     lists = Pleroma.List.get_lists_account_belongs(user, account)
 321
 322     conn
 323     |> put_view(ListView)
 324     |> render("index.json", lists: lists)
 325   end
 326
 327   @doc "POST /api/v1/accounts/:id/follow"
 328   def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
 329     {:error, "Can not follow yourself"}
 330   end
 331
 332   def follow(%{assigns: %{user: follower, account: followed}} = conn, params) do
 333     with {:ok, follower} <- MastodonAPI.follow(follower, followed, params) do
 334       render(conn, "relationship.json", user: follower, target: followed)
 335     else
 336       {:error, message} -> json_response(conn, :forbidden, %{error: message})
 337     end
 338   end
 339
 340   @doc "POST /api/v1/accounts/:id/unfollow"
 341   def unfollow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
 342     {:error, "Can not unfollow yourself"}
 343   end
 344
 345   def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
 346     with {:ok, follower} <- CommonAPI.unfollow(follower, followed) do
 347       render(conn, "relationship.json", user: follower, target: followed)
 348     end
 349   end
 350
 351   @doc "POST /api/v1/accounts/:id/mute"
 352   def mute(%{assigns: %{user: muter, account: muted}, body_params: params} = conn, _params) do
 353     with {:ok, _user_relationships} <- User.mute(muter, muted, params.notifications) do
 354       render(conn, "relationship.json", user: muter, target: muted)
 355     else
 356       {:error, message} -> json_response(conn, :forbidden, %{error: message})
 357     end
 358   end
 359
 360   @doc "POST /api/v1/accounts/:id/unmute"
 361   def unmute(%{assigns: %{user: muter, account: muted}} = conn, _params) do
 362     with {:ok, _user_relationships} <- User.unmute(muter, muted) do
 363       render(conn, "relationship.json", user: muter, target: muted)
 364     else
 365       {:error, message} -> json_response(conn, :forbidden, %{error: message})
 366     end
 367   end
 368
 369   @doc "POST /api/v1/accounts/:id/block"
 370   def block(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
 371     with {:ok, _user_block} <- User.block(blocker, blocked),
 372          {:ok, _activity} <- ActivityPub.block(blocker, blocked) do
 373       render(conn, "relationship.json", user: blocker, target: blocked)
 374     else
 375       {:error, message} -> json_response(conn, :forbidden, %{error: message})
 376     end
 377   end
 378
 379   @doc "POST /api/v1/accounts/:id/unblock"
 380   def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
 381     with {:ok, _activity} <- CommonAPI.unblock(blocker, blocked) do
 382       render(conn, "relationship.json", user: blocker, target: blocked)
 383     else
 384       {:error, message} -> json_response(conn, :forbidden, %{error: message})
 385     end
 386   end
 387
 388   @doc "POST /api/v1/follows"
 389   def follow_by_uri(%{body_params: %{uri: uri}} = conn, _) do
 390     case User.get_cached_by_nickname(uri) do
 391       %User{} = user ->
 392         conn
 393         |> assign(:account, user)
 394         |> follow(%{})
 395
 396       nil ->
 397         {:error, :not_found}
 398     end
 399   end
 400
 401   @doc "GET /api/v1/mutes"
 402   def mutes(%{assigns: %{user: user}} = conn, _) do
 403     users = User.muted_users(user, _restrict_deactivated = true)
 404     render(conn, "index.json", users: users, for: user, as: :user)
 405   end
 406
 407   @doc "GET /api/v1/blocks"
 408   def blocks(%{assigns: %{user: user}} = conn, _) do
 409     users = User.blocked_users(user, _restrict_deactivated = true)
 410     render(conn, "index.json", users: users, for: user, as: :user)
 411   end
 412
 413   @doc "GET /api/v1/endorsements"
 414   def endorsements(conn, params), do: MastodonAPIController.empty_array(conn, params)
 415
 416   @doc "GET /api/v1/identity_proofs"
 417   def identity_proofs(conn, params), do: MastodonAPIController.empty_array(conn, params)
 418 end