git.squeep.com Git - akkoma/blob - lib/pleroma/web/twitter_api/twitter_api_controller.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.TwitterAPI.Controller do
   6   use Pleroma.Web, :controller
   7
   8   import Pleroma.Web.ControllerHelper, only: [json_response: 3]
   9
  10   alias Pleroma.Web.TwitterAPI.{TwitterAPI, UserView, ActivityView, NotificationView}
  11   alias Pleroma.Web.CommonAPI
  12   alias Pleroma.{Repo, Activity, Object, User, Notification}
  13   alias Pleroma.Web.ActivityPub.ActivityPub
  14   alias Pleroma.Web.ActivityPub.Utils
  15   alias Ecto.Changeset
  16
  17   require Logger
  18
  19   plug(:only_if_public_instance when action in [:public_timeline, :public_and_external_timeline])
  20   action_fallback(:errors)
  21
  22   def verify_credentials(%{assigns: %{user: user}} = conn, _params) do
  23     token = Phoenix.Token.sign(conn, "user socket", user.id)
  24
  25     conn
  26     |> put_view(UserView)
  27     |> render("show.json", %{user: user, token: token})
  28   end
  29
  30   def status_update(%{assigns: %{user: user}} = conn, %{"status" => _} = status_data) do
  31     with media_ids <- extract_media_ids(status_data),
  32          {:ok, activity} <-
  33            TwitterAPI.create_status(user, Map.put(status_data, "media_ids", media_ids)) do
  34       conn
  35       |> json(ActivityView.render("activity.json", activity: activity, for: user))
  36     else
  37       _ -> empty_status_reply(conn)
  38     end
  39   end
  40
  41   def status_update(conn, _status_data) do
  42     empty_status_reply(conn)
  43   end
  44
  45   defp empty_status_reply(conn) do
  46     bad_request_reply(conn, "Client must provide a 'status' parameter with a value.")
  47   end
  48
  49   defp extract_media_ids(status_data) do
  50     with media_ids when not is_nil(media_ids) <- status_data["media_ids"],
  51          split_ids <- String.split(media_ids, ","),
  52          clean_ids <- Enum.reject(split_ids, fn id -> String.length(id) == 0 end) do
  53       clean_ids
  54     else
  55       _e -> []
  56     end
  57   end
  58
  59   def public_and_external_timeline(%{assigns: %{user: user}} = conn, params) do
  60     params =
  61       params
  62       |> Map.put("type", ["Create", "Announce"])
  63       |> Map.put("blocking_user", user)
  64
  65     activities = ActivityPub.fetch_public_activities(params)
  66
  67     conn
  68     |> put_view(ActivityView)
  69     |> render("index.json", %{activities: activities, for: user})
  70   end
  71
  72   def public_timeline(%{assigns: %{user: user}} = conn, params) do
  73     params =
  74       params
  75       |> Map.put("type", ["Create", "Announce"])
  76       |> Map.put("local_only", true)
  77       |> Map.put("blocking_user", user)
  78
  79     activities = ActivityPub.fetch_public_activities(params)
  80
  81     conn
  82     |> put_view(ActivityView)
  83     |> render("index.json", %{activities: activities, for: user})
  84   end
  85
  86   def friends_timeline(%{assigns: %{user: user}} = conn, params) do
  87     params =
  88       params
  89       |> Map.put("type", ["Create", "Announce", "Follow", "Like"])
  90       |> Map.put("blocking_user", user)
  91       |> Map.put("user", user)
  92
  93     activities =
  94       ActivityPub.fetch_activities([user.ap_id | user.following], params)
  95       |> ActivityPub.contain_timeline(user)
  96
  97     conn
  98     |> put_view(ActivityView)
  99     |> render("index.json", %{activities: activities, for: user})
 100   end
 101
 102   def show_user(conn, params) do
 103     for_user = conn.assigns.user
 104
 105     with {:ok, shown} <- TwitterAPI.get_user(params),
 106          true <-
 107            User.auth_active?(shown) ||
 108              (for_user && (for_user.id == shown.id || User.superuser?(for_user))) do
 109       params =
 110         if for_user do
 111           %{user: shown, for: for_user}
 112         else
 113           %{user: shown}
 114         end
 115
 116       conn
 117       |> put_view(UserView)
 118       |> render("show.json", params)
 119     else
 120       {:error, msg} ->
 121         bad_request_reply(conn, msg)
 122
 123       false ->
 124         conn
 125         |> put_status(404)
 126         |> json(%{error: "Unconfirmed user"})
 127     end
 128   end
 129
 130   def user_timeline(%{assigns: %{user: user}} = conn, params) do
 131     case TwitterAPI.get_user(user, params) do
 132       {:ok, target_user} ->
 133         activities = ActivityPub.fetch_user_activities(target_user, user, params)
 134
 135         conn
 136         |> put_view(ActivityView)
 137         |> render("index.json", %{activities: activities, for: user})
 138
 139       {:error, msg} ->
 140         bad_request_reply(conn, msg)
 141     end
 142   end
 143
 144   def mentions_timeline(%{assigns: %{user: user}} = conn, params) do
 145     params =
 146       params
 147       |> Map.put("type", ["Create", "Announce", "Follow", "Like"])
 148       |> Map.put("blocking_user", user)
 149
 150     activities = ActivityPub.fetch_activities([user.ap_id], params)
 151
 152     conn
 153     |> put_view(ActivityView)
 154     |> render("index.json", %{activities: activities, for: user})
 155   end
 156
 157   def dm_timeline(%{assigns: %{user: user}} = conn, params) do
 158     query =
 159       ActivityPub.fetch_activities_query(
 160         [user.ap_id],
 161         Map.merge(params, %{"type" => "Create", "user" => user, visibility: "direct"})
 162       )
 163
 164     activities = Repo.all(query)
 165
 166     conn
 167     |> put_view(ActivityView)
 168     |> render("index.json", %{activities: activities, for: user})
 169   end
 170
 171   def notifications(%{assigns: %{user: user}} = conn, params) do
 172     notifications = Notification.for_user(user, params)
 173
 174     conn
 175     |> put_view(NotificationView)
 176     |> render("notification.json", %{notifications: notifications, for: user})
 177   end
 178
 179   def notifications_read(%{assigns: %{user: user}} = conn, %{"latest_id" => latest_id} = params) do
 180     Notification.set_read_up_to(user, latest_id)
 181
 182     notifications = Notification.for_user(user, params)
 183
 184     conn
 185     |> put_view(NotificationView)
 186     |> render("notification.json", %{notifications: notifications, for: user})
 187   end
 188
 189   def notifications_read(%{assigns: %{user: _user}} = conn, _) do
 190     bad_request_reply(conn, "You need to specify latest_id")
 191   end
 192
 193   def follow(%{assigns: %{user: user}} = conn, params) do
 194     case TwitterAPI.follow(user, params) do
 195       {:ok, user, followed, _activity} ->
 196         conn
 197         |> put_view(UserView)
 198         |> render("show.json", %{user: followed, for: user})
 199
 200       {:error, msg} ->
 201         forbidden_json_reply(conn, msg)
 202     end
 203   end
 204
 205   def block(%{assigns: %{user: user}} = conn, params) do
 206     case TwitterAPI.block(user, params) do
 207       {:ok, user, blocked} ->
 208         conn
 209         |> put_view(UserView)
 210         |> render("show.json", %{user: blocked, for: user})
 211
 212       {:error, msg} ->
 213         forbidden_json_reply(conn, msg)
 214     end
 215   end
 216
 217   def unblock(%{assigns: %{user: user}} = conn, params) do
 218     case TwitterAPI.unblock(user, params) do
 219       {:ok, user, blocked} ->
 220         conn
 221         |> put_view(UserView)
 222         |> render("show.json", %{user: blocked, for: user})
 223
 224       {:error, msg} ->
 225         forbidden_json_reply(conn, msg)
 226     end
 227   end
 228
 229   def delete_post(%{assigns: %{user: user}} = conn, %{"id" => id}) do
 230     with {:ok, activity} <- TwitterAPI.delete(user, id) do
 231       conn
 232       |> put_view(ActivityView)
 233       |> render("activity.json", %{activity: activity, for: user})
 234     end
 235   end
 236
 237   def unfollow(%{assigns: %{user: user}} = conn, params) do
 238     case TwitterAPI.unfollow(user, params) do
 239       {:ok, user, unfollowed} ->
 240         conn
 241         |> put_view(UserView)
 242         |> render("show.json", %{user: unfollowed, for: user})
 243
 244       {:error, msg} ->
 245         forbidden_json_reply(conn, msg)
 246     end
 247   end
 248
 249   def fetch_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
 250     with %Activity{} = activity <- Repo.get(Activity, id),
 251          true <- ActivityPub.visible_for_user?(activity, user) do
 252       conn
 253       |> put_view(ActivityView)
 254       |> render("activity.json", %{activity: activity, for: user})
 255     end
 256   end
 257
 258   def fetch_conversation(%{assigns: %{user: user}} = conn, %{"id" => id}) do
 259     id = String.to_integer(id)
 260
 261     with context when is_binary(context) <- TwitterAPI.conversation_id_to_context(id),
 262          activities <-
 263            ActivityPub.fetch_activities_for_context(context, %{
 264              "blocking_user" => user,
 265              "user" => user
 266            }) do
 267       conn
 268       |> put_view(ActivityView)
 269       |> render("index.json", %{activities: activities, for: user})
 270     end
 271   end
 272
 273   @doc """
 274   Updates metadata of uploaded media object.
 275   Derived from [Twitter API endpoint](https://developer.twitter.com/en/docs/media/upload-media/api-reference/post-media-metadata-create).
 276   """
 277   def update_media(%{assigns: %{user: user}} = conn, %{"media_id" => id} = data) do
 278     object = Repo.get(Object, id)
 279     description = get_in(data, ["alt_text", "text"]) || data["name"] || data["description"]
 280
 281     {conn, status, response_body} =
 282       cond do
 283         !object ->
 284           {halt(conn), :not_found, ""}
 285
 286         !Object.authorize_mutation(object, user) ->
 287           {halt(conn), :forbidden, "You can only update your own uploads."}
 288
 289         !is_binary(description) ->
 290           {conn, :not_modified, ""}
 291
 292         true ->
 293           new_data = Map.put(object.data, "name", description)
 294
 295           {:ok, _} =
 296             object
 297             |> Object.change(%{data: new_data})
 298             |> Repo.update()
 299
 300           {conn, :no_content, ""}
 301       end
 302
 303     conn
 304     |> put_status(status)
 305     |> json(response_body)
 306   end
 307
 308   def upload(%{assigns: %{user: user}} = conn, %{"media" => media}) do
 309     response = TwitterAPI.upload(media, user)
 310
 311     conn
 312     |> put_resp_content_type("application/atom+xml")
 313     |> send_resp(200, response)
 314   end
 315
 316   def upload_json(%{assigns: %{user: user}} = conn, %{"media" => media}) do
 317     response = TwitterAPI.upload(media, user, "json")
 318
 319     conn
 320     |> json_reply(200, response)
 321   end
 322
 323   def get_by_id_or_ap_id(id) do
 324     activity = Repo.get(Activity, id) || Activity.get_create_activity_by_object_ap_id(id)
 325
 326     if activity.data["type"] == "Create" do
 327       activity
 328     else
 329       Activity.get_create_activity_by_object_ap_id(activity.data["object"])
 330     end
 331   end
 332
 333   def favorite(%{assigns: %{user: user}} = conn, %{"id" => id}) do
 334     with {_, {:ok, id}} <- {:param_cast, Ecto.Type.cast(:integer, id)},
 335          {:ok, activity} <- TwitterAPI.fav(user, id) do
 336       conn
 337       |> put_view(ActivityView)
 338       |> render("activity.json", %{activity: activity, for: user})
 339     end
 340   end
 341
 342   def unfavorite(%{assigns: %{user: user}} = conn, %{"id" => id}) do
 343     with {_, {:ok, id}} <- {:param_cast, Ecto.Type.cast(:integer, id)},
 344          {:ok, activity} <- TwitterAPI.unfav(user, id) do
 345       conn
 346       |> put_view(ActivityView)
 347       |> render("activity.json", %{activity: activity, for: user})
 348     end
 349   end
 350
 351   def retweet(%{assigns: %{user: user}} = conn, %{"id" => id}) do
 352     with {_, {:ok, id}} <- {:param_cast, Ecto.Type.cast(:integer, id)},
 353          {:ok, activity} <- TwitterAPI.repeat(user, id) do
 354       conn
 355       |> put_view(ActivityView)
 356       |> render("activity.json", %{activity: activity, for: user})
 357     end
 358   end
 359
 360   def unretweet(%{assigns: %{user: user}} = conn, %{"id" => id}) do
 361     with {_, {:ok, id}} <- {:param_cast, Ecto.Type.cast(:integer, id)},
 362          {:ok, activity} <- TwitterAPI.unrepeat(user, id) do
 363       conn
 364       |> put_view(ActivityView)
 365       |> render("activity.json", %{activity: activity, for: user})
 366     end
 367   end
 368
 369   def register(conn, params) do
 370     with {:ok, user} <- TwitterAPI.register_user(params) do
 371       conn
 372       |> put_view(UserView)
 373       |> render("show.json", %{user: user})
 374     else
 375       {:error, errors} ->
 376         conn
 377         |> json_reply(400, Jason.encode!(errors))
 378     end
 379   end
 380
 381   def password_reset(conn, params) do
 382     nickname_or_email = params["email"] || params["nickname"]
 383
 384     with {:ok, _} <- TwitterAPI.password_reset(nickname_or_email) do
 385       json_response(conn, :no_content, "")
 386     end
 387   end
 388
 389   def confirm_email(conn, %{"user_id" => uid, "token" => token}) do
 390     with %User{} = user <- Repo.get(User, uid),
 391          true <- user.local,
 392          true <- user.info.confirmation_pending,
 393          true <- user.info.confirmation_token == token,
 394          info_change <- User.Info.confirmation_changeset(user.info, :confirmed),
 395          changeset <- Changeset.change(user) |> Changeset.put_embed(:info, info_change),
 396          {:ok, _} <- User.update_and_set_cache(changeset) do
 397       conn
 398       |> redirect(to: "/")
 399     end
 400   end
 401
 402   def resend_confirmation_email(conn, params) do
 403     nickname_or_email = params["email"] || params["nickname"]
 404
 405     with %User{} = user <- User.get_by_nickname_or_email(nickname_or_email),
 406          {:ok, _} <- User.try_send_confirmation_email(user) do
 407       conn
 408       |> json_response(:no_content, "")
 409     end
 410   end
 411
 412   def update_avatar(%{assigns: %{user: user}} = conn, params) do
 413     {:ok, object} = ActivityPub.upload(params, type: :avatar)
 414     change = Changeset.change(user, %{avatar: object.data})
 415     {:ok, user} = User.update_and_set_cache(change)
 416     CommonAPI.update(user)
 417
 418     conn
 419     |> put_view(UserView)
 420     |> render("show.json", %{user: user, for: user})
 421   end
 422
 423   def update_banner(%{assigns: %{user: user}} = conn, params) do
 424     with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}, type: :banner),
 425          new_info <- %{"banner" => object.data},
 426          info_cng <- User.Info.profile_update(user.info, new_info),
 427          changeset <- Ecto.Changeset.change(user) |> Ecto.Changeset.put_embed(:info, info_cng),
 428          {:ok, user} <- User.update_and_set_cache(changeset) do
 429       CommonAPI.update(user)
 430       %{"url" => [%{"href" => href} | _]} = object.data
 431       response = %{url: href} |> Jason.encode!()
 432
 433       conn
 434       |> json_reply(200, response)
 435     end
 436   end
 437
 438   def update_background(%{assigns: %{user: user}} = conn, params) do
 439     with {:ok, object} <- ActivityPub.upload(params, type: :background),
 440          new_info <- %{"background" => object.data},
 441          info_cng <- User.Info.profile_update(user.info, new_info),
 442          changeset <- Ecto.Changeset.change(user) |> Ecto.Changeset.put_embed(:info, info_cng),
 443          {:ok, _user} <- User.update_and_set_cache(changeset) do
 444       %{"url" => [%{"href" => href} | _]} = object.data
 445       response = %{url: href} |> Jason.encode!()
 446
 447       conn
 448       |> json_reply(200, response)
 449     end
 450   end
 451
 452   def external_profile(%{assigns: %{user: current_user}} = conn, %{"profileurl" => uri}) do
 453     with {:ok, user_map} <- TwitterAPI.get_external_profile(current_user, uri),
 454          response <- Jason.encode!(user_map) do
 455       conn
 456       |> json_reply(200, response)
 457     else
 458       _e ->
 459         conn
 460         |> put_status(404)
 461         |> json(%{error: "Can't find user"})
 462     end
 463   end
 464
 465   def followers(%{assigns: %{user: for_user}} = conn, params) do
 466     with {:ok, user} <- TwitterAPI.get_user(for_user, params),
 467          {:ok, followers} <- User.get_followers(user) do
 468       followers =
 469         cond do
 470           for_user && user.id == for_user.id -> followers
 471           user.info.hide_network -> []
 472           true -> followers
 473         end
 474
 475       conn
 476       |> put_view(UserView)
 477       |> render("index.json", %{users: followers, for: conn.assigns[:user]})
 478     else
 479       _e -> bad_request_reply(conn, "Can't get followers")
 480     end
 481   end
 482
 483   def friends(%{assigns: %{user: for_user}} = conn, params) do
 484     with {:ok, user} <- TwitterAPI.get_user(conn.assigns[:user], params),
 485          {:ok, friends} <- User.get_friends(user) do
 486       friends =
 487         cond do
 488           for_user && user.id == for_user.id -> friends
 489           user.info.hide_network -> []
 490           true -> friends
 491         end
 492
 493       conn
 494       |> put_view(UserView)
 495       |> render("index.json", %{users: friends, for: conn.assigns[:user]})
 496     else
 497       _e -> bad_request_reply(conn, "Can't get friends")
 498     end
 499   end
 500
 501   def friend_requests(conn, params) do
 502     with {:ok, user} <- TwitterAPI.get_user(conn.assigns[:user], params),
 503          {:ok, friend_requests} <- User.get_follow_requests(user) do
 504       conn
 505       |> put_view(UserView)
 506       |> render("index.json", %{users: friend_requests, for: conn.assigns[:user]})
 507     else
 508       _e -> bad_request_reply(conn, "Can't get friend requests")
 509     end
 510   end
 511
 512   def approve_friend_request(conn, %{"user_id" => uid} = _params) do
 513     with followed <- conn.assigns[:user],
 514          uid when is_number(uid) <- String.to_integer(uid),
 515          %User{} = follower <- Repo.get(User, uid),
 516          {:ok, follower} <- User.maybe_follow(follower, followed),
 517          %Activity{} = follow_activity <- Utils.fetch_latest_follow(follower, followed),
 518          {:ok, follow_activity} <- Utils.update_follow_state(follow_activity, "accept"),
 519          {:ok, _activity} <-
 520            ActivityPub.accept(%{
 521              to: [follower.ap_id],
 522              actor: followed.ap_id,
 523              object: follow_activity.data["id"],
 524              type: "Accept"
 525            }) do
 526       conn
 527       |> put_view(UserView)
 528       |> render("show.json", %{user: follower, for: followed})
 529     else
 530       e -> bad_request_reply(conn, "Can't approve user: #{inspect(e)}")
 531     end
 532   end
 533
 534   def deny_friend_request(conn, %{"user_id" => uid} = _params) do
 535     with followed <- conn.assigns[:user],
 536          uid when is_number(uid) <- String.to_integer(uid),
 537          %User{} = follower <- Repo.get(User, uid),
 538          %Activity{} = follow_activity <- Utils.fetch_latest_follow(follower, followed),
 539          {:ok, follow_activity} <- Utils.update_follow_state(follow_activity, "reject"),
 540          {:ok, _activity} <-
 541            ActivityPub.reject(%{
 542              to: [follower.ap_id],
 543              actor: followed.ap_id,
 544              object: follow_activity.data["id"],
 545              type: "Reject"
 546            }) do
 547       conn
 548       |> put_view(UserView)
 549       |> render("show.json", %{user: follower, for: followed})
 550     else
 551       e -> bad_request_reply(conn, "Can't deny user: #{inspect(e)}")
 552     end
 553   end
 554
 555   def friends_ids(%{assigns: %{user: user}} = conn, _params) do
 556     with {:ok, friends} <- User.get_friends(user) do
 557       ids =
 558         friends
 559         |> Enum.map(fn x -> x.id end)
 560         |> Jason.encode!()
 561
 562       json(conn, ids)
 563     else
 564       _e -> bad_request_reply(conn, "Can't get friends")
 565     end
 566   end
 567
 568   def empty_array(conn, _params) do
 569     json(conn, Jason.encode!([]))
 570   end
 571
 572   def raw_empty_array(conn, _params) do
 573     json(conn, [])
 574   end
 575
 576   defp build_info_cng(user, params) do
 577     info_params =
 578       ["no_rich_text", "locked", "hide_network"]
 579       |> Enum.reduce(%{}, fn key, res ->
 580         if value = params[key] do
 581           Map.put(res, key, value == "true")
 582         else
 583           res
 584         end
 585       end)
 586
 587     info_params =
 588       if value = params["default_scope"] do
 589         Map.put(info_params, "default_scope", value)
 590       else
 591         info_params
 592       end
 593
 594     User.Info.profile_update(user.info, info_params)
 595   end
 596
 597   defp parse_profile_bio(user, params) do
 598     if bio = params["description"] do
 599       Map.put(params, "bio", User.parse_bio(bio, user))
 600     else
 601       params
 602     end
 603   end
 604
 605   def update_profile(%{assigns: %{user: user}} = conn, params) do
 606     params = parse_profile_bio(user, params)
 607     info_cng = build_info_cng(user, params)
 608
 609     with changeset <- User.update_changeset(user, params),
 610          changeset <- Ecto.Changeset.put_embed(changeset, :info, info_cng),
 611          {:ok, user} <- User.update_and_set_cache(changeset) do
 612       CommonAPI.update(user)
 613
 614       conn
 615       |> put_view(UserView)
 616       |> render("user.json", %{user: user, for: user})
 617     else
 618       error ->
 619         Logger.debug("Can't update user: #{inspect(error)}")
 620         bad_request_reply(conn, "Can't update user")
 621     end
 622   end
 623
 624   def search(%{assigns: %{user: user}} = conn, %{"q" => _query} = params) do
 625     activities = TwitterAPI.search(user, params)
 626
 627     conn
 628     |> put_view(ActivityView)
 629     |> render("index.json", %{activities: activities, for: user})
 630   end
 631
 632   def search_user(%{assigns: %{user: user}} = conn, %{"query" => query}) do
 633     users = User.search(query, true)
 634
 635     conn
 636     |> put_view(UserView)
 637     |> render("index.json", %{users: users, for: user})
 638   end
 639
 640   defp bad_request_reply(conn, error_message) do
 641     json = error_json(conn, error_message)
 642     json_reply(conn, 400, json)
 643   end
 644
 645   defp json_reply(conn, status, json) do
 646     conn
 647     |> put_resp_content_type("application/json")
 648     |> send_resp(status, json)
 649   end
 650
 651   defp forbidden_json_reply(conn, error_message) do
 652     json = error_json(conn, error_message)
 653     json_reply(conn, 403, json)
 654   end
 655
 656   def only_if_public_instance(conn = %{conn: %{assigns: %{user: _user}}}, _), do: conn
 657
 658   def only_if_public_instance(conn, _) do
 659     if Keyword.get(Application.get_env(:pleroma, :instance), :public) do
 660       conn
 661     else
 662       conn
 663       |> forbidden_json_reply("Invalid credentials.")
 664       |> halt()
 665     end
 666   end
 667
 668   defp error_json(conn, error_message) do
 669     %{"error" => error_message, "request" => conn.request_path} |> Jason.encode!()
 670   end
 671
 672   def errors(conn, {:param_cast, _}) do
 673     conn
 674     |> put_status(400)
 675     |> json("Invalid parameters")
 676   end
 677
 678   def errors(conn, _) do
 679     conn
 680     |> put_status(500)
 681     |> json("Something went wrong")
 682   end
 683 end