Merge remote-tracking branch 'origin/develop' into reactions

diff --cc CHANGELOG.md
index 3e6b791b4edfaa3cf99fb947260afc33048ff113,f480a3f72c85c1e1b03850024deb818986c5faad..2cc0cee930661cbe17e97b17b6ff1a66f56dc2e7
--- 1/CHANGELOG.md
--- 2/CHANGELOG.md
+++ b/CHANGELOG.md
@@@ -13,7 -13,8 +13,9 @@@ The format is based on [Keep a Changelo
  - Pleroma API: `POST /api/v1/pleroma/scrobble` to scrobble a media item
  - Mastodon API: Add `upload_limit`, `avatar_upload_limit`, `background_upload_limit`, and `banner_upload_limit` to `/api/v1/instance`
  - Mastodon API: Add `pleroma.unread_conversation_count` to the Account entity
+ - OAuth: support for hierarchical permissions / [Mastodon 2.4.3 OAuth permissions](https://docs.joinmastodon.org/api/permissions/)
+ - Authentication: Added rate limit for password-authorized actions / login existence checks
 +- Pleroma API: Add Emoji reactions
  
  ### Changed
  - **Breaking:** Elixir >=1.8 is now required (was >= 1.7)

diff --cc lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
index 8aee7d7c573cd22faae613b05ceb4bf8594874d2,9d50a7ca996c72f61061fa2e708917d1877eb8f6..16c581a952b4f45ab6b86e43d06147862b946924
--- 1/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
--- 2/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
@@@ -7,59 -7,28 +7,74 @@@ defmodule Pleroma.Web.PleromaAPI.Plerom
  
    import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]
  
 +  alias Pleroma.Activity
    alias Pleroma.Conversation.Participation
    alias Pleroma.Notification
 +  alias Pleroma.Object
 +  alias Pleroma.User
+   alias Pleroma.Plugs.OAuthScopesPlug
    alias Pleroma.Web.ActivityPub.ActivityPub
 +  alias Pleroma.Web.CommonAPI
 +  alias Pleroma.Web.MastodonAPI.AccountView
    alias Pleroma.Web.MastodonAPI.ConversationView
    alias Pleroma.Web.MastodonAPI.NotificationView
    alias Pleroma.Web.MastodonAPI.StatusView
  
+   plug(
+     OAuthScopesPlug,
+     %{scopes: ["read:statuses"]} when action in [:conversation, :conversation_statuses]
+   )
+ 
+   plug(
+     OAuthScopesPlug,
+     %{scopes: ["write:conversations"]} when action == :update_conversation
+   )
+ 
+   plug(OAuthScopesPlug, %{scopes: ["write:notifications"]} when action == :read_notification)
+ 
+   plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)
+ 
 +  def emoji_reactions_by(%{assigns: %{user: user}} = conn, %{"id" => activity_id}) do
 +    with %Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
 +         %Object{data: %{"reactions" => emoji_reactions}} <- Object.normalize(activity) do
 +      reactions =
 +        emoji_reactions
 +        |> Enum.map(fn {emoji, users} ->
 +          users = Enum.map(users, &User.get_cached_by_ap_id/1)
 +          {emoji, AccountView.render("index.json", %{users: users, for: user, as: :user})}
 +        end)
 +        |> Enum.into(%{})
 +
 +      conn
 +      |> json(reactions)
 +    else
 +      _e ->
 +        conn
 +        |> json(%{})
 +    end
 +  end
 +
 +  def react_with_emoji(%{assigns: %{user: user}} = conn, %{"id" => activity_id, "emoji" => emoji}) do
 +    with {:ok, _activity, _object} <- CommonAPI.react_with_emoji(activity_id, user, emoji),
 +         activity <- Activity.get_by_id(activity_id) do
 +      conn
 +      |> put_view(StatusView)
 +      |> render("show.json", %{activity: activity, for: user, as: :activity})
 +    end
 +  end
 +
 +  def unreact_with_emoji(%{assigns: %{user: user}} = conn, %{
 +        "id" => activity_id,
 +        "emoji" => emoji
 +      }) do
 +    with {:ok, _activity, _object} <- CommonAPI.unreact_with_emoji(activity_id, user, emoji),
 +         activity <- Activity.get_by_id(activity_id) do
 +      conn
 +      |> put_view(StatusView)
 +      |> render("show.json", %{activity: activity, for: user, as: :activity})
 +    end
 +  end
 +
    def conversation(%{assigns: %{user: user}} = conn, %{"id" => participation_id}) do
      with %Participation{} = participation <- Participation.get(participation_id),
           true <- user.id == participation.user_id do

diff --cc lib/pleroma/web/router.ex
index 16cf234990937426b771965151284179dfd2919a,675f485b24eaad2eb9b73f37f3746738dec01d59..f97427ff83ba9e3d47a804ef8a1c36c233a3acca
--- 1/lib/pleroma/web/router.ex
--- 2/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@@ -302,10 -260,8 +266,10 @@@ defmodule Pleroma.Web.Router d
  
      scope [] do
        pipe_through(:authenticated_api)
-       pipe_through(:oauth_write)
+ 
        patch("/conversations/:id", PleromaAPIController, :update_conversation)
 +      post("/statuses/:id/react_with_emoji", PleromaAPIController, :react_with_emoji)
 +      post("/statuses/:id/unreact_with_emoji", PleromaAPIController, :unreact_with_emoji)
        post("/notifications/read", PleromaAPIController, :read_notification)
  
        patch("/accounts/update_avatar", AccountController, :update_avatar)