Merge remote-tracking branch 'upstream/develop' into feature/openldap-support

diff --combined config/config.exs
index 1ed330df2f834e72cad8f3156c18f7b00473f85d,cd4c8e5627235b31bb17479aaf3a648a6086ebfc..a1e6c8def36aeb7cf8285188eb964b3f55f3faa1
--- 1/config/config.exs
--- 2/config/config.exs
+++ b/config/config.exs
@@@ -133,7 -133,14 +133,14 @@@ config :pleroma, :httpoison, Pleroma.HT
  config :tesla, adapter: Tesla.Adapter.Hackney
  
  # Configures http settings, upstream proxy etc.
- config :pleroma, :http, proxy_url: nil
+ config :pleroma, :http,
+   proxy_url: nil,
+   adapter: [
+     ssl_options: [
+       # We don't support TLS v1.3 yet
+       versions: [:tlsv1, :"tlsv1.1", :"tlsv1.2"]
+     ]
+   ]
  
  config :pleroma, :instance,
    name: "Pleroma",
@@@ -215,6 -222,9 +222,9 @@@ config :pleroma, :frontend_configuratio
      scopeCopy: true,
      subjectLineBehavior: "email",
      alwaysShowSubjectInput: true
+   },
+   masto_fe: %{
+     showInstanceSpecificPanel: true
    }
  
  config :pleroma, :activitypub,
@@@ -345,6 -355,10 +355,10 @@@ config :pleroma, Pleroma.Jobs
    federator_outgoing: [max_jobs: 50],
    mailer: [max_jobs: 10]
  
+ config :pleroma, :fetch_initial_posts,
+   enabled: false,
+   pages: 5
+ 
  config :auto_linker,
    opts: [
      scheme: true,
@@@ -355,17 -369,6 +369,17 @@@
      rel: false
    ]
  
 +config :pleroma, :ldap,
 +  enabled: System.get_env("LDAP_ENABLED") == "true",
 +  host: System.get_env("LDAP_HOST") || "localhost",
 +  port: String.to_integer(System.get_env("LDAP_PORT") || "389"),
 +  ssl: System.get_env("LDAP_SSL") == "true",
 +  sslopts: [],
 +  tls: System.get_env("LDAP_TLS") == "true",
 +  tlsopts: [],
 +  base: System.get_env("LDAP_BASE") || "dc=example,dc=com",
 +  uid: System.get_env("LDAP_UID") || "cn"
 +
  # Import environment specific config. This must remain at the bottom
  # of this file so it overrides the configuration defined above.
  import_config "#{Mix.env()}.exs"

diff --combined docs/config.md
index 7052b1eb4ccf0d52cfff4cff84633d734d18d466,a09ea95f3def569fffa666e27f30c95e84b4e98d..cf6d5db5f6058fa10327dd3e7ff1620c739555ba
--- 1/docs/config.md
--- 2/docs/config.md
+++ b/docs/config.md
@@@ -129,7 -129,7 +129,7 @@@ See: [logger’s documentation](https:/
  
  ## :frontend_configurations
  
- This can be used to configure a keyword list that keeps the configuration data for any kind of frontend. By default, settings for `pleroma_fe` are configured.
+ This can be used to configure a keyword list that keeps the configuration data for any kind of frontend. By default, settings for `pleroma_fe` and `masto_fe` are configured.
  
  Frontends can access these settings at `/api/pleroma/frontend_configurations`
  
@@@ -285,6 -285,10 +285,10 @@@ This config contains two queues: `feder
  ## :rich_media
  * `enabled`: if enabled the instance will parse metadata from attached links to generate link previews
  
+ ## :fetch_initial_posts
+ * `enabled`: if enabled, when a new user is federated with, fetch some of their latest posts
+ * `pages`: the amount of pages to fetch
+ 
  ## :hackney_pools
  
  Advanced. Tweaks Hackney (http client) connections pools.
@@@ -326,26 -330,3 +330,26 @@@ config :auto_linker
      rel: false
    ]
  ```
 +
 +## :ldap
 +
 +Use LDAP for user authentication.  When a user logs in to the Pleroma
 +instance, the name and password will be verified by trying to authenticate
 +(bind) to an LDAP server.  If a user exists in the LDAP directory but there
 +is no account with the same name yet on the Pleroma instance then a new
 +Pleroma account will be created with the same name as the LDAP user name.
 +
 +* `enabled`: enables LDAP authentication
 +* `host`: LDAP server hostname
 +* `port`: LDAP port, e.g. 389 or 636
 +* `ssl`: true to use SSL, usually implies the port 636
 +* `sslopts`: additional SSL options
 +* `tls`: true to start TLS, usually implies the port 389
 +* `tlsopts`: additional TLS options
 +* `base`: LDAP base, e.g. "dc=example,dc=com"
 +* `uid`: LDAP attribute name to authenticate the user, e.g. when "cn", the filter will be "cn=username,base"
 +
 +## Pleroma.Web.Auth.Authenticator
 +
 +* `Pleroma.Web.Auth.PleromaAuthenticator`: default database authenticator
 +* `Pleroma.Web.Auth.LDAPAuthenticator`: LDAP authentication

diff --combined lib/pleroma/web/auth/pleroma_authenticator.ex
index 36077289529027aa6c86a2cc1429529801d546eb,333446befc681c7e8d9df2b6a95f66dd3eaaa151..94a19ad49d97eaf0dd21b543e561036d2fdb2cce
--- 1/lib/pleroma/web/auth/pleroma_authenticator.ex
--- 2/lib/pleroma/web/auth/pleroma_authenticator.ex
+++ b/lib/pleroma/web/auth/pleroma_authenticator.ex
@@@ -3,20 -3,13 +3,20 @@@
  # SPDX-License-Identifier: AGPL-3.0-only
  
  defmodule Pleroma.Web.Auth.PleromaAuthenticator do
-   alias Pleroma.User
    alias Comeonin.Pbkdf2
+   alias Pleroma.User
  
    @behaviour Pleroma.Web.Auth.Authenticator
  
    def get_user(%Plug.Conn{} = conn) do
 -    %{"authorization" => %{"name" => name, "password" => password}} = conn.params
 +    {name, password} =
 +      case conn.params do
 +        %{"authorization" => %{"name" => name, "password" => password}} ->
 +          {name, password}
 +
 +        %{"grant_type" => "password", "username" => name, "password" => password} ->
 +          {name, password}
 +      end
  
      with {_, %User{} = user} <- {:user, User.get_by_nickname_or_email(name)},
           {_, true} <- {:checkpw, Pbkdf2.checkpw(password, user.password_hash)} do

diff --combined lib/pleroma/web/oauth/oauth_controller.ex
index 7d5a5b9c5c416c0fc7b5c576217698cb7604d39a,ec70b7ccc9379482510a4919cd5e2e30b55be1b8..d69383d400151df020f26711de0e714ec649db59
--- 1/lib/pleroma/web/oauth/oauth_controller.ex
--- 2/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@@ -5,12 -5,13 +5,12 @@@
  defmodule Pleroma.Web.OAuth.OAuthController do
    use Pleroma.Web, :controller
  
 -  alias Comeonin.Pbkdf2
+   alias Pleroma.Repo
+   alias Pleroma.User
    alias Pleroma.Web.Auth.Authenticator
+   alias Pleroma.Web.OAuth.App
    alias Pleroma.Web.OAuth.Authorization
    alias Pleroma.Web.OAuth.Token
-   alias Pleroma.Web.OAuth.App
-   alias Pleroma.Repo
-   alias Pleroma.User
  
    import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2]
  
@@@ -125,10 -126,11 +125,10 @@@
  
    def token_exchange(
          conn,
 -        %{"grant_type" => "password", "username" => name, "password" => password} = params
 +        %{"grant_type" => "password"} = params
        ) do
 -    with %App{} = app <- get_app_from_request(conn, params),
 -         %User{} = user <- User.get_by_nickname_or_email(name),
 -         true <- Pbkdf2.checkpw(password, user.password_hash),
 +    with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn)},
 +         %App{} = app <- get_app_from_request(conn, params),
           {:auth_active, true} <- {:auth_active, User.auth_active?(user)},
           scopes <- oauth_scopes(params, app.scopes),
           [] <- scopes -- app.scopes,