1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.PleromaAPI.AccountController do
6 use Pleroma.Web, :controller
8 import Pleroma.Web.ControllerHelper,
9 only: [json_response: 3, add_link_headers: 2, assign_account_by_id: 2]
12 alias Pleroma.Plugs.OAuthScopesPlug
13 alias Pleroma.Plugs.RateLimiter
15 alias Pleroma.Web.ActivityPub.ActivityPub
16 alias Pleroma.Web.CommonAPI
17 alias Pleroma.Web.MastodonAPI.StatusView
19 require Pleroma.Constants
23 %{scopes: ["follow", "write:follows"]} when action in [:subscribe, :unsubscribe]
28 %{scopes: ["write:accounts"]}
29 # Note: the following actions are not permission-secured in Mastodon:
37 plug(OAuthScopesPlug, %{scopes: ["read:favourites"]} when action == :favourites)
39 # An extra safety measure for possible actions not guarded by OAuth permissions specification
41 Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
42 when action != :confirmation_resend
45 plug(RateLimiter, :account_confirmation_resend when action == :confirmation_resend)
46 plug(:assign_account_by_id when action in [:favourites, :subscribe, :unsubscribe])
47 plug(:put_view, Pleroma.Web.MastodonAPI.AccountView)
49 @doc "POST /api/v1/pleroma/accounts/confirmation_resend"
50 def confirmation_resend(conn, params) do
51 nickname_or_email = params["email"] || params["nickname"]
53 with %User{} = user <- User.get_by_nickname_or_email(nickname_or_email),
54 {:ok, _} <- User.try_send_confirmation_email(user) do
55 json_response(conn, :no_content, "")
59 @doc "PATCH /api/v1/pleroma/accounts/update_avatar"
60 def update_avatar(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
63 |> Changeset.change(%{avatar: nil})
64 |> User.update_and_set_cache()
66 CommonAPI.update(user)
68 json(conn, %{url: nil})
71 def update_avatar(%{assigns: %{user: user}} = conn, params) do
72 {:ok, %{data: data}} = ActivityPub.upload(params, type: :avatar)
73 {:ok, user} = user |> Changeset.change(%{avatar: data}) |> User.update_and_set_cache()
74 %{"url" => [%{"href" => href} | _]} = data
76 CommonAPI.update(user)
78 json(conn, %{url: href})
81 @doc "PATCH /api/v1/pleroma/accounts/update_banner"
82 def update_banner(%{assigns: %{user: user}} = conn, %{"banner" => ""}) do
83 new_info = %{"banner" => %{}}
85 with {:ok, user} <- User.update_info(user, &User.Info.profile_update(&1, new_info)) do
86 CommonAPI.update(user)
87 json(conn, %{url: nil})
91 def update_banner(%{assigns: %{user: user}} = conn, params) do
92 with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}, type: :banner),
93 new_info <- %{"banner" => object.data},
94 {:ok, user} <- User.update_info(user, &User.Info.profile_update(&1, new_info)) do
95 CommonAPI.update(user)
96 %{"url" => [%{"href" => href} | _]} = object.data
98 json(conn, %{url: href})
102 @doc "PATCH /api/v1/pleroma/accounts/update_background"
103 def update_background(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
104 new_info = %{"background" => %{}}
106 with {:ok, _user} <- User.update_info(user, &User.Info.profile_update(&1, new_info)) do
107 json(conn, %{url: nil})
111 def update_background(%{assigns: %{user: user}} = conn, params) do
112 with {:ok, object} <- ActivityPub.upload(params, type: :background),
113 new_info <- %{"background" => object.data},
114 {:ok, _user} <- User.update_info(user, &User.Info.profile_update(&1, new_info)) do
115 %{"url" => [%{"href" => href} | _]} = object.data
117 json(conn, %{url: href})
121 @doc "GET /api/v1/pleroma/accounts/:id/favourites"
122 def favourites(%{assigns: %{account: %{info: %{hide_favorites: true}}}} = conn, _params) do
123 render_error(conn, :forbidden, "Can't get favorites")
126 def favourites(%{assigns: %{user: for_user, account: user}} = conn, params) do
129 |> Map.put("type", "Create")
130 |> Map.put("favorited_by", user.ap_id)
131 |> Map.put("blocking_user", for_user)
135 [Pleroma.Constants.as_public()] ++ [for_user.ap_id | User.following(for_user)]
137 [Pleroma.Constants.as_public()]
142 |> ActivityPub.fetch_activities(params)
146 |> add_link_headers(activities)
147 |> put_view(StatusView)
148 |> render("index.json", activities: activities, for: for_user, as: :activity)
151 @doc "POST /api/v1/pleroma/accounts/:id/subscribe"
152 def subscribe(%{assigns: %{user: user, account: subscription_target}} = conn, _params) do
153 with {:ok, subscription_target} <- User.subscribe(user, subscription_target) do
154 render(conn, "relationship.json", user: user, target: subscription_target)
156 {:error, message} -> json_response(conn, :forbidden, %{error: message})
160 @doc "POST /api/v1/pleroma/accounts/:id/unsubscribe"
161 def unsubscribe(%{assigns: %{user: user, account: subscription_target}} = conn, _params) do
162 with {:ok, subscription_target} <- User.unsubscribe(user, subscription_target) do
163 render(conn, "relationship.json", user: user, target: subscription_target)
165 {:error, message} -> json_response(conn, :forbidden, %{error: message})