Merge branch 'develop' of git.pleroma.social:pleroma/pleroma into feature/pinned...

diff --combined lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 2fb2943f1b942fd2f7801b3c320d2cf6d1235ceb,f739e8f7d01459607b0c82dde1956899048aa84c..e00a3fb8721849d8eaa302aed7ee23b3ff7f50b8
--- 1/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
--- 2/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@@ -256,7 -256,13 +256,7 @@@ defmodule Pleroma.Web.MastodonAPI.Masto
  
    def user_statuses(%{assigns: %{user: reading_user}} = conn, params) do
      with %User{} = user <- Repo.get(User, params["id"]) do
 -      # Since Pleroma has no "pinned" posts feature, we'll just set an empty list here
 -      activities =
 -        if params["pinned"] == "true" do
 -          []
 -        else
 -          ActivityPub.fetch_user_activities(user, reading_user, params)
 -        end
 +      activities = ActivityPub.fetch_user_activities(user, reading_user, params)
  
        conn
        |> add_link_headers(:user_statuses, activities, params["id"])
@@@ -403,27 -409,6 +403,27 @@@
      end
    end
  
 +  def pin_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
 +    with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
 +      conn
 +      |> put_view(StatusView)
 +      |> try_render("status.json", %{activity: activity, for: user, as: :activity})
 +    else
 +      {:error, reason} ->
 +        conn
 +        |> put_resp_content_type("application/json")
 +        |> send_resp(:bad_request, Jason.encode!(%{"error" => reason}))
 +    end
 +  end
 +
 +  def unpin_status(%{assigns: %{user: user}} = conn, %{"id" => ap_id_or_id}) do
 +    with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
 +      conn
 +      |> put_view(StatusView)
 +      |> try_render("status.json", %{activity: activity, for: user, as: :activity})
 +    end
 +  end
 +
    def notifications(%{assigns: %{user: user}} = conn, params) do
      notifications = Notification.for_user(user, params)
  
@@@ -740,11 -725,14 +740,14 @@@
      json(conn, %{})
    end
  
-   def status_search(query) do
+   def status_search(user, query) do
      fetched =
        if Regex.match?(~r/https?:/, query) do
-         with {:ok, object} <- ActivityPub.fetch_object_from_id(query) do
-           [Activity.get_create_activity_by_object_ap_id(object.data["id"])]
+         with {:ok, object} <- ActivityPub.fetch_object_from_id(query),
+              %Activity{} = activity <-
+                Activity.get_create_activity_by_object_ap_id(object.data["id"]),
+              true <- ActivityPub.visible_for_user?(activity, user) do
+           [activity]
          else
            _e -> []
          end
@@@ -771,7 -759,7 +774,7 @@@
    def search2(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
      accounts = User.search(query, params["resolve"] == "true")
  
-     statuses = status_search(query)
+     statuses = status_search(user, query)
  
      tags_path = Web.base_url() <> "/tag/"
  
@@@ -795,7 -783,7 +798,7 @@@
    def search(%{assigns: %{user: user}} = conn, %{"q" => query} = params) do
      accounts = User.search(query, params["resolve"] == "true")
  
-     statuses = status_search(query)
+     statuses = status_search(user, query)
  
      tags =
        String.split(query)

diff --combined test/web/mastodon_api/mastodon_api_controller_test.exs
index 7f6c9fb88c6f6ba0ded890a0c51230da9cb01c28,ce87010c8edcc112cab849db5ecb17e7eb904a96..5ff7ef25972bc0493828ee2956f7e85bd6b43d58
--- 1/test/web/mastodon_api/mastodon_api_controller_test.exs
--- 2/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@@ -1312,6 -1312,24 +1312,24 @@@ defmodule Pleroma.Web.MastodonAPI.Masto
      end)
    end
  
+   test "search doesn't show statuses that it shouldn't", %{conn: conn} do
+     {:ok, activity} =
+       CommonAPI.post(insert(:user), %{
+         "status" => "This is about 2hu, but private",
+         "visibility" => "private"
+       })
+ 
+     capture_log(fn ->
+       conn =
+         conn
+         |> get("/api/v1/search", %{"q" => activity.data["object"]["id"]})
+ 
+       assert results = json_response(conn, 200)
+ 
+       [] = results["statuses"]
+     end)
+   end
+ 
    test "search fetches remote accounts", %{conn: conn} do
      conn =
        conn
@@@ -1453,99 -1471,4 +1471,99 @@@
      user = User.get_cached_by_ap_id(user.ap_id)
      assert user.info.settings == %{"programming" => "socks"}
    end
 +
 +  describe "pinned posts" do
 +    test "returns pinned posts", %{conn: conn} do
 +      Pleroma.Config.put([:instance, :max_pinned_posts], 1)
 +      user = insert(:user)
 +
 +      {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
 +      {:ok, _} = CommonAPI.pin(activity.id, user)
 +
 +      result =
 +        conn
 +        |> assign(:user, user)
 +        |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 +        |> Map.get(:resp_body)
 +        |> Jason.decode!()
 +
 +      id_str = Integer.to_string(activity.id)
 +
 +      assert [%{"id" => ^id_str}] = result
 +    end
 +
 +    test "pin post", %{conn: conn} do
 +      Pleroma.Config.put([:instance, :max_pinned_posts], 1)
 +      user = insert(:user)
 +
 +      {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
 +      id_str = Integer.to_string(activity.id)
 +
 +      assert %{"id" => ^id_str} =
 +               conn
 +               |> assign(:user, user)
 +               |> post("/api/v1/statuses/#{activity.id}/pin")
 +               |> Map.get(:resp_body)
 +               |> Jason.decode!()
 +
 +      assert [%{"id" => ^id_str}] =
 +               conn
 +               |> assign(:user, user)
 +               |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 +               |> Map.get(:resp_body)
 +               |> Jason.decode!()
 +    end
 +
 +    test "unpin post", %{conn: conn} do
 +      Pleroma.Config.put([:instance, :max_pinned_posts], 1)
 +      user = insert(:user)
 +
 +      {:ok, activity} = CommonAPI.post(user, %{"status" => "HI!!!"})
 +      {:ok, _} = CommonAPI.pin(activity.id, user)
 +
 +      id_str = Integer.to_string(activity.id)
 +      user = User.get_by_ap_id(user.ap_id)
 +
 +      assert %{"id" => ^id_str} =
 +               conn
 +               |> assign(:user, user)
 +               |> post("/api/v1/statuses/#{activity.id}/unpin")
 +               |> Map.get(:resp_body)
 +               |> Jason.decode!()
 +
 +      assert [] =
 +               conn
 +               |> assign(:user, user)
 +               |> get("/api/v1/accounts/#{user.id}/statuses?pinned=true")
 +               |> Map.get(:resp_body)
 +               |> Jason.decode!()
 +    end
 +
 +    test "max pinned posts", %{conn: conn} do
 +      Pleroma.Config.put([:instance, :max_pinned_posts], 1)
 +
 +      user = insert(:user)
 +
 +      {:ok, activity_one} = CommonAPI.post(user, %{"status" => "HI!!!"})
 +      {:ok, activity_two} = CommonAPI.post(user, %{"status" => "HI!!!"})
 +
 +      id_str_one = Integer.to_string(activity_one.id)
 +
 +      assert %{"id" => ^id_str_one} =
 +               conn
 +               |> assign(:user, user)
 +               |> post("/api/v1/statuses/#{id_str_one}/pin")
 +               |> Map.get(:resp_body)
 +               |> Jason.decode!()
 +
 +      user = User.get_by_ap_id(user.ap_id)
 +
 +      assert %{"error" => "You have already pinned the maximum number of toots"} =
 +               conn
 +               |> assign(:user, user)
 +               |> post("/api/v1/statuses/#{activity_two.id}/pin")
 +               |> Map.get(:resp_body)
 +               |> Jason.decode!()
 +    end
 +  end
  end