Merge branch 'feature/reports-groups-and-multiple-state-update' into 'develop'
[akkoma] / lib / pleroma / web / pleroma_api / controllers / account_controller.ex
1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
4
5 defmodule Pleroma.Web.PleromaAPI.AccountController do
6 use Pleroma.Web, :controller
7
8 import Pleroma.Web.ControllerHelper,
9 only: [json_response: 3, add_link_headers: 2, assign_account_by_id: 2]
10
11 alias Ecto.Changeset
12 alias Pleroma.Plugs.OAuthScopesPlug
13 alias Pleroma.Plugs.RateLimiter
14 alias Pleroma.User
15 alias Pleroma.Web.ActivityPub.ActivityPub
16 alias Pleroma.Web.CommonAPI
17 alias Pleroma.Web.MastodonAPI.StatusView
18
19 require Pleroma.Constants
20
21 plug(
22 OAuthScopesPlug,
23 %{scopes: ["follow", "write:follows"]} when action in [:subscribe, :unsubscribe]
24 )
25
26 plug(
27 OAuthScopesPlug,
28 %{scopes: ["write:accounts"]}
29 # Note: the following actions are not permission-secured in Mastodon:
30 when action in [
31 :update_avatar,
32 :update_banner,
33 :update_background
34 ]
35 )
36
37 plug(OAuthScopesPlug, %{scopes: ["read:favourites"]} when action == :favourites)
38
39 # An extra safety measure for possible actions not guarded by OAuth permissions specification
40 plug(
41 Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
42 when action != :confirmation_resend
43 )
44
45 plug(RateLimiter, [name: :account_confirmation_resend] when action == :confirmation_resend)
46 plug(:assign_account_by_id when action in [:favourites, :subscribe, :unsubscribe])
47 plug(:put_view, Pleroma.Web.MastodonAPI.AccountView)
48
49 @doc "POST /api/v1/pleroma/accounts/confirmation_resend"
50 def confirmation_resend(conn, params) do
51 nickname_or_email = params["email"] || params["nickname"]
52
53 with %User{} = user <- User.get_by_nickname_or_email(nickname_or_email),
54 {:ok, _} <- User.try_send_confirmation_email(user) do
55 json_response(conn, :no_content, "")
56 end
57 end
58
59 @doc "PATCH /api/v1/pleroma/accounts/update_avatar"
60 def update_avatar(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
61 {:ok, user} =
62 user
63 |> Changeset.change(%{avatar: nil})
64 |> User.update_and_set_cache()
65
66 CommonAPI.update(user)
67
68 json(conn, %{url: nil})
69 end
70
71 def update_avatar(%{assigns: %{user: user}} = conn, params) do
72 {:ok, %{data: data}} = ActivityPub.upload(params, type: :avatar)
73 {:ok, user} = user |> Changeset.change(%{avatar: data}) |> User.update_and_set_cache()
74 %{"url" => [%{"href" => href} | _]} = data
75
76 CommonAPI.update(user)
77
78 json(conn, %{url: href})
79 end
80
81 @doc "PATCH /api/v1/pleroma/accounts/update_banner"
82 def update_banner(%{assigns: %{user: user}} = conn, %{"banner" => ""}) do
83 with {:ok, user} <- User.update_banner(user, %{}) do
84 CommonAPI.update(user)
85 json(conn, %{url: nil})
86 end
87 end
88
89 def update_banner(%{assigns: %{user: user}} = conn, params) do
90 with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}, type: :banner),
91 {:ok, user} <- User.update_banner(user, object.data) do
92 CommonAPI.update(user)
93 %{"url" => [%{"href" => href} | _]} = object.data
94
95 json(conn, %{url: href})
96 end
97 end
98
99 @doc "PATCH /api/v1/pleroma/accounts/update_background"
100 def update_background(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
101 with {:ok, _user} <- User.update_background(user, %{}) do
102 json(conn, %{url: nil})
103 end
104 end
105
106 def update_background(%{assigns: %{user: user}} = conn, params) do
107 with {:ok, object} <- ActivityPub.upload(params, type: :background),
108 {:ok, _user} <- User.update_background(user, object.data) do
109 %{"url" => [%{"href" => href} | _]} = object.data
110
111 json(conn, %{url: href})
112 end
113 end
114
115 @doc "GET /api/v1/pleroma/accounts/:id/favourites"
116 def favourites(%{assigns: %{account: %{hide_favorites: true}}} = conn, _params) do
117 render_error(conn, :forbidden, "Can't get favorites")
118 end
119
120 def favourites(%{assigns: %{user: for_user, account: user}} = conn, params) do
121 params =
122 params
123 |> Map.put("type", "Create")
124 |> Map.put("favorited_by", user.ap_id)
125 |> Map.put("blocking_user", for_user)
126
127 recipients =
128 if for_user do
129 [Pleroma.Constants.as_public()] ++ [for_user.ap_id | User.following(for_user)]
130 else
131 [Pleroma.Constants.as_public()]
132 end
133
134 activities =
135 recipients
136 |> ActivityPub.fetch_activities(params)
137 |> Enum.reverse()
138
139 conn
140 |> add_link_headers(activities)
141 |> put_view(StatusView)
142 |> render("index.json", activities: activities, for: for_user, as: :activity)
143 end
144
145 @doc "POST /api/v1/pleroma/accounts/:id/subscribe"
146 def subscribe(%{assigns: %{user: user, account: subscription_target}} = conn, _params) do
147 with {:ok, subscription_target} <- User.subscribe(user, subscription_target) do
148 render(conn, "relationship.json", user: user, target: subscription_target)
149 else
150 {:error, message} -> json_response(conn, :forbidden, %{error: message})
151 end
152 end
153
154 @doc "POST /api/v1/pleroma/accounts/:id/unsubscribe"
155 def unsubscribe(%{assigns: %{user: user, account: subscription_target}} = conn, _params) do
156 with {:ok, subscription_target} <- User.unsubscribe(user, subscription_target) do
157 render(conn, "relationship.json", user: user, target: subscription_target)
158 else
159 {:error, message} -> json_response(conn, :forbidden, %{error: message})
160 end
161 end
162 end