Expose history and source apis to anon users

3 files changed, 10 insertions, 8 deletions

diff --git a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
index fa86e9dc0..e594ea491 100644
--- a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
@@ -195,8 +195,9 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/statuses/:id/history"
-  def show_history(%{assigns: %{user: user}} = conn, %{id: id} = params) do
-    with %Activity{} = activity <- Activity.get_by_id_with_object(id),
+  def show_history(%{assigns: assigns} = conn, %{id: id} = params) do
+    with user = assigns[:user],
+         %Activity{} = activity <- Activity.get_by_id_with_object(id),
          true <- Visibility.visible_for_user?(activity, user) do
       try_render(conn, "history.json",
         activity: activity,
@@ -210,8 +211,9 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/statuses/:id/source"
-  def show_source(%{assigns: %{user: user}} = conn, %{id: id} = _params) do
-    with %Activity{} = activity <- Activity.get_by_id_with_object(id),
+  def show_source(%{assigns: assigns} = conn, %{id: id} = _params) do
+    with user = assigns[:user],
+         %Activity{} = activity <- Activity.get_by_id_with_object(id),
          true <- Visibility.visible_for_user?(activity, user) do
       try_render(conn, "source.json",
         activity: activity,
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 2d2e5365e..4a999f0c2 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -552,8 +552,6 @@ defmodule Pleroma.Web.Router do
     get("/bookmarks", StatusController, :bookmarks)
 
     post("/statuses", StatusController, :create)
-    get("/statuses/:id/history", StatusController, :show_history)
-    get("/statuses/:id/source", StatusController, :show_source)
     put("/statuses/:id", StatusController, :update)
     delete("/statuses/:id", StatusController, :delete)
     post("/statuses/:id/reblog", StatusController, :reblog)
@@ -611,6 +609,8 @@ defmodule Pleroma.Web.Router do
     get("/statuses/:id/card", StatusController, :card)
     get("/statuses/:id/favourited_by", StatusController, :favourited_by)
     get("/statuses/:id/reblogged_by", StatusController, :reblogged_by)
+    get("/statuses/:id/history", StatusController, :show_history)
+    get("/statuses/:id/source", StatusController, :show_source)
 
     get("/custom_emojis", CustomEmojiController, :index)
 
diff --git a/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs b/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
index c077670ed..04f1c17db 100644
--- a/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
+++ b/test/pleroma/web/mastodon_api/controllers/status_controller_test.exs
@@ -1993,7 +1993,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusControllerTest do
 
   describe "get status history" do
     setup do
-      oauth_access(["read:statuses"])
+      %{conn: build_conn()}
     end
 
     test "unedited post", %{conn: conn} do
@@ -2039,7 +2039,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusControllerTest do
 
   describe "get status source" do
     setup do
-      oauth_access(["read:statuses"])
+      %{conn: build_conn()}
     end
 
     test "it returns the source", %{conn: conn} do