From: lain <lain@soykaf.club>
Date: Mon, 7 Oct 2019 10:30:59 +0000 (+0200)
Subject: Merge remote-tracking branch 'origin/develop' into reactions
X-Git-Url: https://git.squeep.com/?a=commitdiff_plain;h=73b6512907d205d4be49864541eeb941d259aa57;p=akkoma

Merge remote-tracking branch 'origin/develop' into reactions
---

73b6512907d205d4be49864541eeb941d259aa57
diff --cc CHANGELOG.md
index 3e6b791b4,f480a3f72..2cc0cee93
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@@ -13,7 -13,8 +13,9 @@@ The format is based on [Keep a Changelo
  - Pleroma API: `POST /api/v1/pleroma/scrobble` to scrobble a media item
  - Mastodon API: Add `upload_limit`, `avatar_upload_limit`, `background_upload_limit`, and `banner_upload_limit` to `/api/v1/instance`
  - Mastodon API: Add `pleroma.unread_conversation_count` to the Account entity
+ - OAuth: support for hierarchical permissions / [Mastodon 2.4.3 OAuth permissions](https://docs.joinmastodon.org/api/permissions/)
+ - Authentication: Added rate limit for password-authorized actions / login existence checks
 +- Pleroma API: Add Emoji reactions
  
  ### Changed
  - **Breaking:** Elixir >=1.8 is now required (was >= 1.7)
diff --cc lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
index 8aee7d7c5,9d50a7ca9..16c581a95
--- a/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
@@@ -7,59 -7,28 +7,74 @@@ defmodule Pleroma.Web.PleromaAPI.Plerom
  
    import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]
  
 +  alias Pleroma.Activity
    alias Pleroma.Conversation.Participation
    alias Pleroma.Notification
 +  alias Pleroma.Object
 +  alias Pleroma.User
+   alias Pleroma.Plugs.OAuthScopesPlug
    alias Pleroma.Web.ActivityPub.ActivityPub
 +  alias Pleroma.Web.CommonAPI
 +  alias Pleroma.Web.MastodonAPI.AccountView
    alias Pleroma.Web.MastodonAPI.ConversationView
    alias Pleroma.Web.MastodonAPI.NotificationView
    alias Pleroma.Web.MastodonAPI.StatusView
  
+   plug(
+     OAuthScopesPlug,
+     %{scopes: ["read:statuses"]} when action in [:conversation, :conversation_statuses]
+   )
+ 
+   plug(
+     OAuthScopesPlug,
+     %{scopes: ["write:conversations"]} when action == :update_conversation
+   )
+ 
+   plug(OAuthScopesPlug, %{scopes: ["write:notifications"]} when action == :read_notification)
+ 
+   plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)
+ 
 +  def emoji_reactions_by(%{assigns: %{user: user}} = conn, %{"id" => activity_id}) do
 +    with %Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
 +         %Object{data: %{"reactions" => emoji_reactions}} <- Object.normalize(activity) do
 +      reactions =
 +        emoji_reactions
 +        |> Enum.map(fn {emoji, users} ->
 +          users = Enum.map(users, &User.get_cached_by_ap_id/1)
 +          {emoji, AccountView.render("index.json", %{users: users, for: user, as: :user})}
 +        end)
 +        |> Enum.into(%{})
 +
 +      conn
 +      |> json(reactions)
 +    else
 +      _e ->
 +        conn
 +        |> json(%{})
 +    end
 +  end
 +
 +  def react_with_emoji(%{assigns: %{user: user}} = conn, %{"id" => activity_id, "emoji" => emoji}) do
 +    with {:ok, _activity, _object} <- CommonAPI.react_with_emoji(activity_id, user, emoji),
 +         activity <- Activity.get_by_id(activity_id) do
 +      conn
 +      |> put_view(StatusView)
 +      |> render("show.json", %{activity: activity, for: user, as: :activity})
 +    end
 +  end
 +
 +  def unreact_with_emoji(%{assigns: %{user: user}} = conn, %{
 +        "id" => activity_id,
 +        "emoji" => emoji
 +      }) do
 +    with {:ok, _activity, _object} <- CommonAPI.unreact_with_emoji(activity_id, user, emoji),
 +         activity <- Activity.get_by_id(activity_id) do
 +      conn
 +      |> put_view(StatusView)
 +      |> render("show.json", %{activity: activity, for: user, as: :activity})
 +    end
 +  end
 +
    def conversation(%{assigns: %{user: user}} = conn, %{"id" => participation_id}) do
      with %Participation{} = participation <- Participation.get(participation_id),
           true <- user.id == participation.user_id do
diff --cc lib/pleroma/web/router.ex
index 16cf23499,675f485b2..f97427ff8
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@@ -302,10 -260,8 +266,10 @@@ defmodule Pleroma.Web.Router d
  
      scope [] do
        pipe_through(:authenticated_api)
-       pipe_through(:oauth_write)
+ 
        patch("/conversations/:id", PleromaAPIController, :update_conversation)
 +      post("/statuses/:id/react_with_emoji", PleromaAPIController, :react_with_emoji)
 +      post("/statuses/:id/unreact_with_emoji", PleromaAPIController, :unreact_with_emoji)
        post("/notifications/read", PleromaAPIController, :read_notification)
  
        patch("/accounts/update_avatar", AccountController, :update_avatar)