Merge branch 'develop' into feature/admin-api-status-count-per-instance

44 files changed, 783 insertions, 201 deletions

diff --git a/lib/mix/tasks/pleroma/benchmark.ex b/lib/mix/tasks/pleroma/benchmark.ex
index 6ab7fe8ef..dd2b9c8f2 100644
--- a/lib/mix/tasks/pleroma/benchmark.ex
+++ b/lib/mix/tasks/pleroma/benchmark.ex
@@ -67,8 +67,7 @@ defmodule Mix.Tasks.Pleroma.Benchmark do
           Pleroma.Web.MastodonAPI.StatusView.render("index.json", %{
             activities: activities,
             for: user,
-            as: :activity,
-            skip_relationships: true
+            as: :activity
           })
         end
       },
diff --git a/lib/mix/tasks/pleroma/digest.ex b/lib/mix/tasks/pleroma/digest.ex
index 7d09e70c5..3595f912d 100644
--- a/lib/mix/tasks/pleroma/digest.ex
+++ b/lib/mix/tasks/pleroma/digest.ex
@@ -1,5 +1,6 @@
 defmodule Mix.Tasks.Pleroma.Digest do
   use Mix.Task
+  import Mix.Pleroma
 
   @shortdoc "Manages digest emails"
   @moduledoc File.read!("docs/administration/CLI_tasks/digest.md")
@@ -22,12 +23,10 @@ defmodule Mix.Tasks.Pleroma.Digest do
     with %Swoosh.Email{} = email <- Pleroma.Emails.UserEmail.digest_email(patched_user) do
       {:ok, _} = Pleroma.Emails.Mailer.deliver(email)
 
-      Mix.shell().info("Digest email have been sent to #{nickname} (#{user.email})")
+      shell_info("Digest email have been sent to #{nickname} (#{user.email})")
     else
       _ ->
-        Mix.shell().info(
-          "Cound't find any mentions for #{nickname} since #{last_digest_emailed_at}"
-        )
+        shell_info("Cound't find any mentions for #{nickname} since #{last_digest_emailed_at}")
     end
   end
 end
diff --git a/lib/pleroma/bbs/authenticator.ex b/lib/pleroma/bbs/authenticator.ex
index d4494b003..815de7002 100644
--- a/lib/pleroma/bbs/authenticator.ex
+++ b/lib/pleroma/bbs/authenticator.ex
@@ -4,6 +4,7 @@
 
 defmodule Pleroma.BBS.Authenticator do
   use Sshd.PasswordAuthenticator
+  alias Pleroma.Plugs.AuthenticationPlug
   alias Pleroma.User
 
   def authenticate(username, password) do
@@ -11,7 +12,7 @@ defmodule Pleroma.BBS.Authenticator do
     password = to_string(password)
 
     with %User{} = user <- User.get_by_nickname(username) do
-      Pbkdf2.verify_pass(password, user.password_hash)
+      AuthenticationPlug.checkpw(password, user.password_hash)
     else
       _e -> false
     end
diff --git a/lib/pleroma/config/config_db.ex b/lib/pleroma/config/config_db.ex
index 4097ee5b7..2b43d4c36 100644
--- a/lib/pleroma/config/config_db.ex
+++ b/lib/pleroma/config/config_db.ex
@@ -278,6 +278,8 @@ defmodule Pleroma.ConfigDB do
     }
   end
 
+  defp do_convert({:partial_chain, entity}), do: %{"tuple" => [":partial_chain", inspect(entity)]}
+
   defp do_convert(entity) when is_tuple(entity) do
     value =
       entity
@@ -321,6 +323,15 @@ defmodule Pleroma.ConfigDB do
     {:proxy_url, {do_transform_string(type), parse_host(host), port}}
   end
 
+  defp do_transform(%{"tuple" => [":partial_chain", entity]}) do
+    {partial_chain, []} =
+      entity
+      |> String.replace(~r/[^\w|^{:,[|^,|^[|^\]^}|^\/|^\.|^"]^\s/, "")
+      |> Code.eval_string()
+
+    {:partial_chain, partial_chain}
+  end
+
   defp do_transform(%{"tuple" => entity}) do
     Enum.reduce(entity, {}, fn val, acc -> Tuple.append(acc, do_transform(val)) end)
   end
diff --git a/lib/pleroma/constants.ex b/lib/pleroma/constants.ex
index 3a9eec5ea..06174f624 100644
--- a/lib/pleroma/constants.ex
+++ b/lib/pleroma/constants.ex
@@ -17,7 +17,8 @@ defmodule Pleroma.Constants do
       "announcement_count",
       "emoji",
       "context_id",
-      "deleted_activity_id"
+      "deleted_activity_id",
+      "pleroma_internal"
     ]
   )
 
diff --git a/lib/pleroma/docs/json.ex b/lib/pleroma/docs/json.ex
index 74f8b2615..d1cf1f487 100644
--- a/lib/pleroma/docs/json.ex
+++ b/lib/pleroma/docs/json.ex
@@ -18,7 +18,6 @@ defmodule Pleroma.Docs.JSON do
     with config <- Pleroma.Config.Loader.read("config/description.exs") do
       config[:pleroma][:config_description]
       |> Pleroma.Docs.Generator.convert_to_strings()
-      |> Jason.encode!()
     end
   end
 end
diff --git a/lib/pleroma/plugs/authentication_plug.ex b/lib/pleroma/plugs/authentication_plug.ex
index ae4a235bd..057ea42f1 100644
--- a/lib/pleroma/plugs/authentication_plug.ex
+++ b/lib/pleroma/plugs/authentication_plug.ex
@@ -16,6 +16,11 @@ defmodule Pleroma.Plugs.AuthenticationPlug do
     :crypt.crypt(password, password_hash) == password_hash
   end
 
+  def checkpw(password, "$2" <> _ = password_hash) do
+    # Handle bcrypt passwords for Mastodon migration
+    Bcrypt.verify_pass(password, password_hash)
+  end
+
   def checkpw(password, "$pbkdf2" <> _ = password_hash) do
     Pbkdf2.verify_pass(password, password_hash)
   end
@@ -25,6 +30,25 @@ defmodule Pleroma.Plugs.AuthenticationPlug do
     false
   end
 
+  def maybe_update_password(%User{password_hash: "$2" <> _} = user, password) do
+    do_update_password(user, password)
+  end
+
+  def maybe_update_password(%User{password_hash: "$6" <> _} = user, password) do
+    do_update_password(user, password)
+  end
+
+  def maybe_update_password(user, _), do: {:ok, user}
+
+  defp do_update_password(user, password) do
+    user
+    |> User.password_update_changeset(%{
+      "password" => password,
+      "password_confirmation" => password
+    })
+    |> Pleroma.Repo.update()
+  end
+
   def call(%{assigns: %{user: %User{}}} = conn, _), do: conn
 
   def call(
@@ -36,7 +60,9 @@ defmodule Pleroma.Plugs.AuthenticationPlug do
         } = conn,
         _
       ) do
-    if Pbkdf2.verify_pass(password, password_hash) do
+    if checkpw(password, password_hash) do
+      {:ok, auth_user} = maybe_update_password(auth_user, password)
+
       conn
       |> assign(:user, auth_user)
       |> OAuthScopesPlug.skip_plug()
diff --git a/lib/pleroma/upload.ex b/lib/pleroma/upload.ex
index 762d813d9..1be1a3a5b 100644
--- a/lib/pleroma/upload.ex
+++ b/lib/pleroma/upload.ex
@@ -134,7 +134,7 @@ defmodule Pleroma.Upload do
     end
   end
 
-  defp prepare_upload(%{"img" => "data:image/" <> image_data}, opts) do
+  defp prepare_upload(%{img: "data:image/" <> image_data}, opts) do
     parsed = Regex.named_captures(~r/(?<filetype>jpeg|png|gif);base64,(?<data>.*)/, image_data)
     data = Base.decode64!(parsed["data"], ignore: :whitespace)
     hash = String.downcase(Base.encode16(:crypto.hash(:sha256, data)))
diff --git a/lib/pleroma/user_relationship.ex b/lib/pleroma/user_relationship.ex
index 235ad427c..6dfdd2860 100644
--- a/lib/pleroma/user_relationship.ex
+++ b/lib/pleroma/user_relationship.ex
@@ -87,6 +87,22 @@ defmodule Pleroma.UserRelationship do
         source_to_target_rel_types \\ nil,
         target_to_source_rel_types \\ nil
       )
+
+  def dictionary(
+        _source_users,
+        _target_users,
+        [] = _source_to_target_rel_types,
+        [] = _target_to_source_rel_types
+      ) do
+    []
+  end
+
+  def dictionary(
+        source_users,
+        target_users,
+        source_to_target_rel_types,
+        target_to_source_rel_types
+      )
       when is_list(source_users) and is_list(target_users) do
     source_user_ids = User.binary_id(source_users)
     target_user_ids = User.binary_id(target_users)
@@ -138,11 +154,16 @@ defmodule Pleroma.UserRelationship do
 
   def view_relationships_option(%User{} = reading_user, actors, opts) do
     {source_to_target_rel_types, target_to_source_rel_types} =
-      if opts[:source_mutes_only] do
-        # This option is used for rendering statuses (FE needs `muted` flag for each one anyways)
-        {[:mute], []}
-      else
-        {[:block, :mute, :notification_mute, :reblog_mute], [:block, :inverse_subscription]}
+      case opts[:subset] do
+        :source_mutes ->
+          # Used for statuses rendering (FE needs `muted` flag for each status when statuses load)
+          {[:mute], []}
+
+        nil ->
+          {[:block, :mute, :notification_mute, :reblog_mute], [:block, :inverse_subscription]}
+
+        unknown ->
+          raise "Unsupported :subset option value: #{inspect(unknown)}"
       end
 
     user_relationships =
@@ -153,7 +174,17 @@ defmodule Pleroma.UserRelationship do
         target_to_source_rel_types
       )
 
-    following_relationships = FollowingRelationship.all_between_user_sets([reading_user], actors)
+    following_relationships =
+      case opts[:subset] do
+        :source_mutes ->
+          []
+
+        nil ->
+          FollowingRelationship.all_between_user_sets([reading_user], actors)
+
+        unknown ->
+          raise "Unsupported :subset option value: #{inspect(unknown)}"
+      end
 
     %{user_relationships: user_relationships, following_relationships: following_relationships}
   end
diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex
index 9175b1904..c896b5bd2 100644
--- a/lib/pleroma/web/admin_api/admin_api_controller.ex
+++ b/lib/pleroma/web/admin_api/admin_api_controller.ex
@@ -22,6 +22,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
   alias Pleroma.Web.ActivityPub.Pipeline
   alias Pleroma.Web.ActivityPub.Relay
   alias Pleroma.Web.ActivityPub.Utils
+  alias Pleroma.Web.AdminAPI
   alias Pleroma.Web.AdminAPI.AccountView
   alias Pleroma.Web.AdminAPI.ConfigView
   alias Pleroma.Web.AdminAPI.ModerationLogView
@@ -30,14 +31,14 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
   alias Pleroma.Web.AdminAPI.Search
   alias Pleroma.Web.CommonAPI
   alias Pleroma.Web.Endpoint
+  alias Pleroma.Web.MastodonAPI
   alias Pleroma.Web.MastodonAPI.AppView
-  alias Pleroma.Web.MastodonAPI.StatusView
   alias Pleroma.Web.OAuth.App
   alias Pleroma.Web.Router
 
   require Logger
 
-  @descriptions_json Pleroma.Docs.JSON.compile()
+  @descriptions Pleroma.Docs.JSON.compile()
   @users_page_size 50
 
   plug(
@@ -280,8 +281,8 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
       })
 
     conn
-    |> put_view(Pleroma.Web.AdminAPI.StatusView)
-    |> render("index.json", %{activities: activities, as: :activity, skip_relationships: false})
+    |> put_view(AdminAPI.StatusView)
+    |> render("index.json", %{activities: activities, as: :activity})
   end
 
   def list_user_statuses(conn, %{"nickname" => nickname} = params) do
@@ -299,8 +300,8 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
         })
 
       conn
-      |> put_view(StatusView)
-      |> render("index.json", %{activities: activities, as: :activity, skip_relationships: false})
+      |> put_view(MastodonAPI.StatusView)
+      |> render("index.json", %{activities: activities, as: :activity})
     else
       _ -> {:error, :not_found}
     end
@@ -829,14 +830,14 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
       })
 
     conn
-    |> put_view(Pleroma.Web.AdminAPI.StatusView)
-    |> render("index.json", %{activities: activities, as: :activity, skip_relationships: false})
+    |> put_view(AdminAPI.StatusView)
+    |> render("index.json", %{activities: activities, as: :activity})
   end
 
   def status_show(conn, %{"id" => id}) do
     with %Activity{} = activity <- Activity.get_by_id(id) do
       conn
-      |> put_view(StatusView)
+      |> put_view(MastodonAPI.StatusView)
       |> render("show.json", %{activity: activity})
     else
       _ -> errors(conn, {:error, :not_found})
@@ -861,7 +862,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
       })
 
       conn
-      |> put_view(StatusView)
+      |> put_view(MastodonAPI.StatusView)
       |> render("show.json", %{activity: activity})
     end
   end
@@ -897,9 +898,9 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
   end
 
   def config_descriptions(conn, _params) do
-    conn
-    |> Plug.Conn.put_resp_content_type("application/json")
-    |> Plug.Conn.send_resp(200, @descriptions_json)
+    descriptions = Enum.filter(@descriptions, &whitelisted_config?/1)
+
+    json(conn, descriptions)
   end
 
   def config_show(conn, %{"only_db" => true}) do
@@ -954,7 +955,9 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
   def config_update(conn, %{"configs" => configs}) do
     with :ok <- configurable_from_database(conn) do
       {_errors, results} =
-        Enum.map(configs, fn
+        configs
+        |> Enum.filter(&whitelisted_config?/1)
+        |> Enum.map(fn
           %{"group" => group, "key" => key, "delete" => true} = params ->
             ConfigDB.delete(%{group: group, key: key, subkeys: params["subkeys"]})
 
@@ -1016,6 +1019,28 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
     end
   end
 
+  defp whitelisted_config?(group, key) do
+    if whitelisted_configs = Config.get(:database_config_whitelist) do
+      Enum.any?(whitelisted_configs, fn
+        {whitelisted_group} ->
+          group == inspect(whitelisted_group)
+
+        {whitelisted_group, whitelisted_key} ->
+          group == inspect(whitelisted_group) && key == inspect(whitelisted_key)
+      end)
+    else
+      true
+    end
+  end
+
+  defp whitelisted_config?(%{"group" => group, "key" => key}) do
+    whitelisted_config?(group, key)
+  end
+
+  defp whitelisted_config?(%{:group => group} = config) do
+    whitelisted_config?(group, config[:key])
+  end
+
   def reload_emoji(conn, _params) do
     Pleroma.Emoji.reload()
 
diff --git a/lib/pleroma/web/admin_api/views/account_view.ex b/lib/pleroma/web/admin_api/views/account_view.ex
index a16a3ebf0..46dadb5ee 100644
--- a/lib/pleroma/web/admin_api/views/account_view.ex
+++ b/lib/pleroma/web/admin_api/views/account_view.ex
@@ -6,7 +6,9 @@ defmodule Pleroma.Web.AdminAPI.AccountView do
   use Pleroma.Web, :view
 
   alias Pleroma.User
+  alias Pleroma.Web.AdminAPI
   alias Pleroma.Web.AdminAPI.AccountView
+  alias Pleroma.Web.MastodonAPI
   alias Pleroma.Web.MediaProxy
 
   def render("index.json", %{users: users, count: count, page_size: page_size}) do
@@ -119,6 +121,13 @@ defmodule Pleroma.Web.AdminAPI.AccountView do
     }
   end
 
+  def merge_account_views(%User{} = user) do
+    MastodonAPI.AccountView.render("show.json", %{user: user})
+    |> Map.merge(AdminAPI.AccountView.render("show.json", %{user: user}))
+  end
+
+  def merge_account_views(_), do: %{}
+
   defp parse_error([]), do: ""
 
   defp parse_error(errors) do
diff --git a/lib/pleroma/web/admin_api/views/report_view.ex b/lib/pleroma/web/admin_api/views/report_view.ex
index d50969b2a..f432b8c2c 100644
--- a/lib/pleroma/web/admin_api/views/report_view.ex
+++ b/lib/pleroma/web/admin_api/views/report_view.ex
@@ -7,10 +7,13 @@ defmodule Pleroma.Web.AdminAPI.ReportView do
 
   alias Pleroma.HTML
   alias Pleroma.User
+  alias Pleroma.Web.AdminAPI
   alias Pleroma.Web.AdminAPI.Report
   alias Pleroma.Web.CommonAPI.Utils
   alias Pleroma.Web.MastodonAPI.StatusView
 
+  defdelegate merge_account_views(user), to: AdminAPI.AccountView
+
   def render("index.json", %{reports: reports}) do
     %{
       reports:
@@ -41,8 +44,7 @@ defmodule Pleroma.Web.AdminAPI.ReportView do
       statuses:
         StatusView.render("index.json", %{
           activities: statuses,
-          as: :activity,
-          skip_relationships: false
+          as: :activity
         }),
       state: report.data["state"],
       notes: render(__MODULE__, "index_notes.json", %{notes: report.report_notes})
@@ -70,11 +72,4 @@ defmodule Pleroma.Web.AdminAPI.ReportView do
       created_at: Utils.to_masto_date(inserted_at)
     }
   end
-
-  defp merge_account_views(%User{} = user) do
-    Pleroma.Web.MastodonAPI.AccountView.render("show.json", %{user: user})
-    |> Map.merge(Pleroma.Web.AdminAPI.AccountView.render("show.json", %{user: user}))
-  end
-
-  defp merge_account_views(_), do: %{}
 end
diff --git a/lib/pleroma/web/admin_api/views/status_view.ex b/lib/pleroma/web/admin_api/views/status_view.ex
index 3637dee24..500800be2 100644
--- a/lib/pleroma/web/admin_api/views/status_view.ex
+++ b/lib/pleroma/web/admin_api/views/status_view.ex
@@ -7,24 +7,19 @@ defmodule Pleroma.Web.AdminAPI.StatusView do
 
   require Pleroma.Constants
 
-  alias Pleroma.User
-  alias Pleroma.Web.MastodonAPI.StatusView
+  alias Pleroma.Web.AdminAPI
+  alias Pleroma.Web.MastodonAPI
+
+  defdelegate merge_account_views(user), to: AdminAPI.AccountView
 
   def render("index.json", opts) do
     safe_render_many(opts.activities, __MODULE__, "show.json", opts)
   end
 
   def render("show.json", %{activity: %{data: %{"object" => _object}} = activity} = opts) do
-    user = StatusView.get_user(activity.data["actor"])
+    user = MastodonAPI.StatusView.get_user(activity.data["actor"])
 
-    StatusView.render("show.json", opts)
+    MastodonAPI.StatusView.render("show.json", opts)
     |> Map.merge(%{account: merge_account_views(user)})
   end
-
-  defp merge_account_views(%User{} = user) do
-    Pleroma.Web.MastodonAPI.AccountView.render("show.json", %{user: user})
-    |> Map.merge(Pleroma.Web.AdminAPI.AccountView.render("show.json", %{user: user}))
-  end
-
-  defp merge_account_views(_), do: %{}
 end
diff --git a/lib/pleroma/web/api_spec/helpers.ex b/lib/pleroma/web/api_spec/helpers.ex
index 183df43ee..a9cfe0fed 100644
--- a/lib/pleroma/web/api_spec/helpers.ex
+++ b/lib/pleroma/web/api_spec/helpers.ex
@@ -5,6 +5,7 @@
 defmodule Pleroma.Web.ApiSpec.Helpers do
   alias OpenApiSpex.Operation
   alias OpenApiSpex.Schema
+  alias Pleroma.Web.ApiSpec.Schemas.BooleanLike
 
   def request_body(description, schema_ref, opts \\ []) do
     media_types = ["application/json", "multipart/form-data", "application/x-www-form-urlencoded"]
@@ -47,6 +48,15 @@ defmodule Pleroma.Web.ApiSpec.Helpers do
     ]
   end
 
+  def with_relationships_param do
+    Operation.parameter(
+      :with_relationships,
+      :query,
+      BooleanLike,
+      "Embed relationships into accounts."
+    )
+  end
+
   def empty_object_response do
     Operation.response("Empty object", "application/json", %Schema{type: :object, example: %{}})
   end
@@ -54,4 +64,8 @@ defmodule Pleroma.Web.ApiSpec.Helpers do
   def empty_array_response do
     Operation.response("Empty array", "application/json", %Schema{type: :array, example: []})
   end
+
+  def no_content_response do
+    Operation.response("No Content", "application/json", %Schema{type: :string, example: ""})
+  end
 end
diff --git a/lib/pleroma/web/api_spec/operations/account_operation.ex b/lib/pleroma/web/api_spec/operations/account_operation.ex
index 70069d6f9..934f6038e 100644
--- a/lib/pleroma/web/api_spec/operations/account_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/account_operation.ex
@@ -155,8 +155,10 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
       security: [%{"oAuth" => ["read:accounts"]}],
       description:
         "Accounts which follow the given account, if network is not hidden by the account owner.",
-      parameters:
-        [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}] ++ pagination_params(),
+      parameters: [
+        %Reference{"$ref": "#/components/parameters/accountIdOrNickname"},
+        with_relationships_param() | pagination_params()
+      ],
       responses: %{
         200 => Operation.response("Accounts", "application/json", array_of_accounts())
       }
@@ -171,8 +173,10 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
       security: [%{"oAuth" => ["read:accounts"]}],
       description:
         "Accounts which the given account is following, if network is not hidden by the account owner.",
-      parameters:
-        [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}] ++ pagination_params(),
+      parameters: [
+        %Reference{"$ref": "#/components/parameters/accountIdOrNickname"},
+        with_relationships_param() | pagination_params()
+      ],
       responses: %{200 => Operation.response("Accounts", "application/json", array_of_accounts())}
     }
   end
@@ -367,15 +371,18 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
       title: "AccountCreateRequest",
       description: "POST body for creating an account",
       type: :object,
+      required: [:username, :password, :agreement],
       properties: %{
         reason: %Schema{
           type: :string,
+          nullable: true,
           description:
             "Text that will be reviewed by moderators if registrations require manual approval"
         },
         username: %Schema{type: :string, description: "The desired username for the account"},
         email: %Schema{
           type: :string,
+          nullable: true,
           description:
             "The email address to be used for login. Required when `account_activation_required` is enabled.",
           format: :email
@@ -392,23 +399,33 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
         },
         locale: %Schema{
           type: :string,
+          nullable: true,
           description: "The language of the confirmation email that will be sent"
         },
         # Pleroma-specific properties:
-        fullname: %Schema{type: :string, description: "Full name"},
-        bio: %Schema{type: :string, description: "Bio", default: ""},
+        fullname: %Schema{type: :string, nullable: true, description: "Full name"},
+        bio: %Schema{type: :string, description: "Bio", nullable: true, default: ""},
         captcha_solution: %Schema{
           type: :string,
+          nullable: true,
           description: "Provider-specific captcha solution"
         },
-        captcha_token: %Schema{type: :string, description: "Provider-specific captcha token"},
-        captcha_answer_data: %Schema{type: :string, description: "Provider-specific captcha data"},
+        captcha_token: %Schema{
+          type: :string,
+          nullable: true,
+          description: "Provider-specific captcha token"
+        },
+        captcha_answer_data: %Schema{
+          type: :string,
+          nullable: true,
+          description: "Provider-specific captcha data"
+        },
         token: %Schema{
           type: :string,
+          nullable: true,
           description: "Invite token required when the registrations aren't public"
         }
       },
-      required: [:username, :password, :agreement],
       example: %{
         "username" => "cofe",
         "email" => "cofe@example.com",
@@ -447,28 +464,34 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
       properties: %{
         bot: %Schema{
           type: :boolean,
+          nullable: true,
           description: "Whether the account has a bot flag."
         },
         display_name: %Schema{
           type: :string,
+          nullable: true,
           description: "The display name to use for the profile."
         },
         note: %Schema{type: :string, description: "The account bio."},
         avatar: %Schema{
           type: :string,
+          nullable: true,
           description: "Avatar image encoded using multipart/form-data",
           format: :binary
         },
         header: %Schema{
           type: :string,
+          nullable: true,
           description: "Header image encoded using multipart/form-data",
           format: :binary
         },
         locked: %Schema{
           type: :boolean,
+          nullable: true,
           description: "Whether manual approval of follow requests is required."
         },
         fields_attributes: %Schema{
+          nullable: true,
           oneOf: [
             %Schema{type: :array, items: attribute_field()},
             %Schema{type: :object, additionalProperties: %Schema{type: attribute_field()}}
@@ -488,47 +511,65 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
         # Pleroma-specific fields
         no_rich_text: %Schema{
           type: :boolean,
+          nullable: true,
           description: "html tags are stripped from all statuses requested from the API"
         },
-        hide_followers: %Schema{type: :boolean, description: "user's followers will be hidden"},
-        hide_follows: %Schema{type: :boolean, description: "user's follows will be hidden"},
+        hide_followers: %Schema{
+          type: :boolean,
+          nullable: true,
+          description: "user's followers will be hidden"
+        },
+        hide_follows: %Schema{
+          type: :boolean,
+          nullable: true,
+          description: "user's follows will be hidden"
+        },
         hide_followers_count: %Schema{
           type: :boolean,
+          nullable: true,
           description: "user's follower count will be hidden"
         },
         hide_follows_count: %Schema{
           type: :boolean,
+          nullable: true,
           description: "user's follow count will be hidden"
         },
         hide_favorites: %Schema{
           type: :boolean,
+          nullable: true,
           description: "user's favorites timeline will be hidden"
         },
         show_role: %Schema{
           type: :boolean,
+          nullable: true,
           description: "user's role (e.g admin, moderator) will be exposed to anyone in the
         API"
         },
         default_scope: VisibilityScope,
         pleroma_settings_store: %Schema{
           type: :object,
+          nullable: true,
           description: "Opaque user settings to be saved on the backend."
         },
         skip_thread_containment: %Schema{
           type: :boolean,
+          nullable: true,
           description: "Skip filtering out broken threads"
         },
         allow_following_move: %Schema{
           type: :boolean,
+          nullable: true,
           description: "Allows automatically follow moved following accounts"
         },
         pleroma_background_image: %Schema{
           type: :string,
+          nullable: true,
           description: "Sets the background image of the user.",
           format: :binary
         },
         discoverable: %Schema{
           type: :boolean,
+          nullable: true,
           description:
             "Discovery of this account in search results and other services is allowed."
         },
@@ -624,7 +665,7 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
       description: "POST body for muting an account",
       type: :object,
       properties: %{
-        uri: %Schema{type: :string, format: :uri}
+        uri: %Schema{type: :string, nullable: true, format: :uri}
       },
       required: [:uri]
     }
@@ -638,6 +679,7 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
       properties: %{
         notifications: %Schema{
           type: :boolean,
+          nullable: true,
           description: "Mute notifications in addition to statuses? Defaults to true.",
           default: true
         }
diff --git a/lib/pleroma/web/api_spec/operations/app_operation.ex b/lib/pleroma/web/api_spec/operations/app_operation.ex
index f6ccd073f..ae01cbbec 100644
--- a/lib/pleroma/web/api_spec/operations/app_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/app_operation.ex
@@ -105,7 +105,11 @@ defmodule Pleroma.Web.ApiSpec.AppOperation do
           description: "Space separated list of scopes",
           default: "read"
         },
-        website: %Schema{type: :string, description: "A URL to the homepage of your app"}
+        website: %Schema{
+          type: :string,
+          nullable: true,
+          description: "A URL to the homepage of your app"
+        }
       },
       required: [:client_name, :redirect_uris],
       example: %{
diff --git a/lib/pleroma/web/api_spec/operations/filter_operation.ex b/lib/pleroma/web/api_spec/operations/filter_operation.ex
index 53e57b46b..7310c1c4d 100644
--- a/lib/pleroma/web/api_spec/operations/filter_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/filter_operation.ex
@@ -199,12 +199,14 @@ defmodule Pleroma.Web.ApiSpec.FilterOperation do
             "Array of enumerable strings `home`, `notifications`, `public`, `thread`. At least one context must be specified."
         },
         irreversible: %Schema{
-          type: :bolean,
+          type: :boolean,
+          nullable: true,
           description:
             "Should the server irreversibly drop matching entities from home and notifications?"
         },
         whole_word: %Schema{
-          type: :bolean,
+          type: :boolean,
+          nullable: true,
           description: "Consider word boundaries?",
           default: true
         }
diff --git a/lib/pleroma/web/api_spec/operations/marker_operation.ex b/lib/pleroma/web/api_spec/operations/marker_operation.ex
index 06620492a..714ef1f99 100644
--- a/lib/pleroma/web/api_spec/operations/marker_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/marker_operation.ex
@@ -110,14 +110,16 @@ defmodule Pleroma.Web.ApiSpec.MarkerOperation do
       properties: %{
         notifications: %Schema{
           type: :object,
+          nullable: true,
           properties: %{
-            last_read_id: %Schema{type: :string}
+            last_read_id: %Schema{nullable: true, type: :string}
           }
         },
         home: %Schema{
           type: :object,
+          nullable: true,
           properties: %{
-            last_read_id: %Schema{type: :string}
+            last_read_id: %Schema{nullable: true, type: :string}
           }
         }
       },
diff --git a/lib/pleroma/web/api_spec/operations/media_operation.ex b/lib/pleroma/web/api_spec/operations/media_operation.ex
new file mode 100644
index 000000000..d9c3c42db
--- /dev/null
+++ b/lib/pleroma/web/api_spec/operations/media_operation.ex
@@ -0,0 +1,132 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ApiSpec.MediaOperation do
+  alias OpenApiSpex.Operation
+  alias OpenApiSpex.Schema
+  alias Pleroma.Web.ApiSpec.Helpers
+  alias Pleroma.Web.ApiSpec.Schemas.ApiError
+  alias Pleroma.Web.ApiSpec.Schemas.Attachment
+
+  def open_api_operation(action) do
+    operation = String.to_existing_atom("#{action}_operation")
+    apply(__MODULE__, operation, [])
+  end
+
+  def create_operation do
+    %Operation{
+      tags: ["media"],
+      summary: "Upload media as attachment",
+      description: "Creates an attachment to be used with a new status.",
+      operationId: "MediaController.create",
+      security: [%{"oAuth" => ["write:media"]}],
+      requestBody: Helpers.request_body("Parameters", create_request()),
+      responses: %{
+        200 => Operation.response("Media", "application/json", Attachment),
+        401 => Operation.response("Media", "application/json", ApiError),
+        422 => Operation.response("Media", "application/json", ApiError)
+      }
+    }
+  end
+
+  defp create_request do
+    %Schema{
+      title: "MediaCreateRequest",
+      description: "POST body for creating an attachment",
+      type: :object,
+      required: [:file],
+      properties: %{
+        file: %Schema{
+          type: :string,
+          format: :binary,
+          description: "The file to be attached, using multipart form data."
+        },
+        description: %Schema{
+          type: :string,
+          description: "A plain-text description of the media, for accessibility purposes."
+        },
+        focus: %Schema{
+          type: :string,
+          description: "Two floating points (x,y), comma-delimited, ranging from -1.0 to 1.0."
+        }
+      }
+    }
+  end
+
+  def update_operation do
+    %Operation{
+      tags: ["media"],
+      summary: "Upload media as attachment",
+      description: "Creates an attachment to be used with a new status.",
+      operationId: "MediaController.update",
+      security: [%{"oAuth" => ["write:media"]}],
+      parameters: [id_param()],
+      requestBody: Helpers.request_body("Parameters", update_request()),
+      responses: %{
+        200 => Operation.response("Media", "application/json", Attachment),
+        400 => Operation.response("Media", "application/json", ApiError),
+        401 => Operation.response("Media", "application/json", ApiError),
+        422 => Operation.response("Media", "application/json", ApiError)
+      }
+    }
+  end
+
+  defp update_request do
+    %Schema{
+      title: "MediaUpdateRequest",
+      description: "POST body for updating an attachment",
+      type: :object,
+      properties: %{
+        file: %Schema{
+          type: :string,
+          format: :binary,
+          description: "The file to be attached, using multipart form data."
+        },
+        description: %Schema{
+          type: :string,
+          description: "A plain-text description of the media, for accessibility purposes."
+        },
+        focus: %Schema{
+          type: :string,
+          description: "Two floating points (x,y), comma-delimited, ranging from -1.0 to 1.0."
+        }
+      }
+    }
+  end
+
+  def show_operation do
+    %Operation{
+      tags: ["media"],
+      summary: "Show Uploaded media attachment",
+      operationId: "MediaController.show",
+      parameters: [id_param()],
+      security: [%{"oAuth" => ["read:media"]}],
+      responses: %{
+        200 => Operation.response("Media", "application/json", Attachment),
+        401 => Operation.response("Media", "application/json", ApiError),
+        422 => Operation.response("Media", "application/json", ApiError)
+      }
+    }
+  end
+
+  def create2_operation do
+    %Operation{
+      tags: ["media"],
+      summary: "Upload media as attachment",
+      description: "Creates an attachment to be used with a new status.",
+      operationId: "MediaController.create2",
+      security: [%{"oAuth" => ["write:media"]}],
+      requestBody: Helpers.request_body("Parameters", create_request()),
+      responses: %{
+        202 => Operation.response("Media", "application/json", Attachment),
+        422 => Operation.response("Media", "application/json", ApiError),
+        500 => Operation.response("Media", "application/json", ApiError)
+      }
+    }
+  end
+
+  defp id_param do
+    Operation.parameter(:id, :path, :string, "The ID of the Attachment entity")
+  end
+end
diff --git a/lib/pleroma/web/api_spec/operations/pleroma_account_operation.ex b/lib/pleroma/web/api_spec/operations/pleroma_account_operation.ex
new file mode 100644
index 000000000..90922c064
--- /dev/null
+++ b/lib/pleroma/web/api_spec/operations/pleroma_account_operation.ex
@@ -0,0 +1,187 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ApiSpec.PleromaAccountOperation do
+  alias OpenApiSpex.Operation
+  alias OpenApiSpex.Schema
+  alias Pleroma.Web.ApiSpec.Schemas.AccountRelationship
+  alias Pleroma.Web.ApiSpec.Schemas.ApiError
+  alias Pleroma.Web.ApiSpec.Schemas.FlakeID
+  alias Pleroma.Web.ApiSpec.StatusOperation
+
+  import Pleroma.Web.ApiSpec.Helpers
+
+  def open_api_operation(action) do
+    operation = String.to_existing_atom("#{action}_operation")
+    apply(__MODULE__, operation, [])
+  end
+
+  def confirmation_resend_operation do
+    %Operation{
+      tags: ["Accounts"],
+      summary: "Resend confirmation email. Expects `email` or `nickname`",
+      operationId: "PleromaAPI.AccountController.confirmation_resend",
+      parameters: [
+        Operation.parameter(:email, :query, :string, "Email of that needs to be verified",
+          example: "cofe@cofe.io"
+        ),
+        Operation.parameter(
+          :nickname,
+          :query,
+          :string,
+          "Nickname of user that needs to be verified",
+          example: "cofefe"
+        )
+      ],
+      responses: %{
+        204 => no_content_response()
+      }
+    }
+  end
+
+  def update_avatar_operation do
+    %Operation{
+      tags: ["Accounts"],
+      summary: "Set/clear user avatar image",
+      operationId: "PleromaAPI.AccountController.update_avatar",
+      requestBody:
+        request_body("Parameters", update_avatar_or_background_request(), required: true),
+      security: [%{"oAuth" => ["write:accounts"]}],
+      responses: %{
+        200 => update_response(),
+        403 => Operation.response("Forbidden", "application/json", ApiError)
+      }
+    }
+  end
+
+  def update_banner_operation do
+    %Operation{
+      tags: ["Accounts"],
+      summary: "Set/clear user banner image",
+      operationId: "PleromaAPI.AccountController.update_banner",
+      requestBody: request_body("Parameters", update_banner_request(), required: true),
+      security: [%{"oAuth" => ["write:accounts"]}],
+      responses: %{
+        200 => update_response()
+      }
+    }
+  end
+
+  def update_background_operation do
+    %Operation{
+      tags: ["Accounts"],
+      summary: "Set/clear user background image",
+      operationId: "PleromaAPI.AccountController.update_background",
+      security: [%{"oAuth" => ["write:accounts"]}],
+      requestBody:
+        request_body("Parameters", update_avatar_or_background_request(), required: true),
+      responses: %{
+        200 => update_response()
+      }
+    }
+  end
+
+  def favourites_operation do
+    %Operation{
+      tags: ["Accounts"],
+      summary: "Returns favorites timeline of any user",
+      operationId: "PleromaAPI.AccountController.favourites",
+      parameters: [id_param() | pagination_params()],
+      security: [%{"oAuth" => ["read:favourites"]}],
+      responses: %{
+        200 =>
+          Operation.response(
+            "Array of Statuses",
+            "application/json",
+            StatusOperation.array_of_statuses()
+          ),
+        403 => Operation.response("Forbidden", "application/json", ApiError),
+        404 => Operation.response("Not Found", "application/json", ApiError)
+      }
+    }
+  end
+
+  def subscribe_operation do
+    %Operation{
+      tags: ["Accounts"],
+      summary: "Subscribe to receive notifications for all statuses posted by a user",
+      operationId: "PleromaAPI.AccountController.subscribe",
+      parameters: [id_param()],
+      security: [%{"oAuth" => ["follow", "write:follows"]}],
+      responses: %{
+        200 => Operation.response("Relationship", "application/json", AccountRelationship),
+        404 => Operation.response("Not Found", "application/json", ApiError)
+      }
+    }
+  end
+
+  def unsubscribe_operation do
+    %Operation{
+      tags: ["Accounts"],
+      summary: "Unsubscribe to stop receiving notifications from user statuses",
+      operationId: "PleromaAPI.AccountController.unsubscribe",
+      parameters: [id_param()],
+      security: [%{"oAuth" => ["follow", "write:follows"]}],
+      responses: %{
+        200 => Operation.response("Relationship", "application/json", AccountRelationship),
+        404 => Operation.response("Not Found", "application/json", ApiError)
+      }
+    }
+  end
+
+  defp id_param do
+    Operation.parameter(:id, :path, FlakeID, "Account ID",
+      example: "9umDrYheeY451cQnEe",
+      required: true
+    )
+  end
+
+  defp update_avatar_or_background_request do
+    %Schema{
+      title: "PleromaAccountUpdateAvatarOrBackgroundRequest",
+      type: :object,
+      properties: %{
+        img: %Schema{
+          nullable: true,
+          type: :string,
+          format: :binary,
+          description: "Image encoded using `multipart/form-data` or an empty string to clear"
+        }
+      }
+    }
+  end
+
+  defp update_banner_request do
+    %Schema{
+      title: "PleromaAccountUpdateBannerRequest",
+      type: :object,
+      properties: %{
+        banner: %Schema{
+          type: :string,
+          nullable: true,
+          format: :binary,
+          description: "Image encoded using `multipart/form-data` or an empty string to clear"
+        }
+      }
+    }
+  end
+
+  defp update_response do
+    Operation.response("PleromaAccountUpdateResponse", "application/json", %Schema{
+      type: :object,
+      properties: %{
+        url: %Schema{
+          type: :string,
+          format: :uri,
+          nullable: true,
+          description: "Image URL"
+        }
+      },
+      example: %{
+        "url" =>
+          "https://cofe.party/media/9d0add56-bcb6-4c0f-8225-cbbd0b6dd773/13eadb6972c9ccd3f4ffa3b8196f0e0d38b4d2f27594457c52e52946c054cd9a.gif"
+      }
+    })
+  end
+end
diff --git a/lib/pleroma/web/api_spec/operations/report_operation.ex b/lib/pleroma/web/api_spec/operations/report_operation.ex
index da4d50703..882177c96 100644
--- a/lib/pleroma/web/api_spec/operations/report_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/report_operation.ex
@@ -37,15 +37,18 @@ defmodule Pleroma.Web.ApiSpec.ReportOperation do
         account_id: %Schema{type: :string, description: "ID of the account to report"},
         status_ids: %Schema{
           type: :array,
+          nullable: true,
           items: %Schema{type: :string},
           description: "Array of Statuses to attach to the report, for context"
         },
         comment: %Schema{
           type: :string,
+          nullable: true,
           description: "Reason for the report"
         },
         forward: %Schema{
           type: :boolean,
+          nullable: true,
           default: false,
           description:
             "If the account is remote, should the report be forwarded to the remote admin?"
diff --git a/lib/pleroma/web/api_spec/operations/search_operation.ex b/lib/pleroma/web/api_spec/operations/search_operation.ex
index 6ea00a9a8..169c36d87 100644
--- a/lib/pleroma/web/api_spec/operations/search_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/search_operation.ex
@@ -19,6 +19,7 @@ defmodule Pleroma.Web.ApiSpec.SearchOperation do
     apply(__MODULE__, operation, [])
   end
 
+  # Note: `with_relationships` param is not supported (PleromaFE uses this op for autocomplete)
   def account_search_operation do
     %Operation{
       tags: ["Search"],
@@ -96,8 +97,8 @@ defmodule Pleroma.Web.ApiSpec.SearchOperation do
           :query,
           %Schema{type: :integer},
           "Offset"
-        )
-        | pagination_params()
+        ),
+        with_relationships_param() | pagination_params()
       ],
       responses: %{
         200 => Operation.response("Results", "application/json", results())
@@ -138,8 +139,8 @@ defmodule Pleroma.Web.ApiSpec.SearchOperation do
           :query,
           %Schema{allOf: [BooleanLike], default: false},
           "Only include accounts that the user is following"
-        )
-        | pagination_params()
+        ),
+        with_relationships_param() | pagination_params()
       ],
       responses: %{
         200 => Operation.response("Results", "application/json", results2())
diff --git a/lib/pleroma/web/api_spec/operations/status_operation.ex b/lib/pleroma/web/api_spec/operations/status_operation.ex
index a6bb87560..4b284c537 100644
--- a/lib/pleroma/web/api_spec/operations/status_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/status_operation.ex
@@ -7,7 +7,6 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
   alias OpenApiSpex.Schema
   alias Pleroma.Web.ApiSpec.AccountOperation
   alias Pleroma.Web.ApiSpec.Schemas.ApiError
-  alias Pleroma.Web.ApiSpec.Schemas.BooleanLike
   alias Pleroma.Web.ApiSpec.Schemas.FlakeID
   alias Pleroma.Web.ApiSpec.Schemas.ScheduledStatus
   alias Pleroma.Web.ApiSpec.Schemas.Status
@@ -349,10 +348,7 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
       summary: "Bookmarked statuses",
       description: "Statuses the user has bookmarked",
       operationId: "StatusController.bookmarks",
-      parameters: [
-        Operation.parameter(:with_relationships, :query, BooleanLike, "Include relationships")
-        | pagination_params()
-      ],
+      parameters: pagination_params(),
       security: [%{"oAuth" => ["read:bookmarks"]}],
       responses: %{
         200 => Operation.response("Array of Statuses", "application/json", array_of_statuses())
@@ -360,7 +356,7 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
     }
   end
 
-  defp array_of_statuses do
+  def array_of_statuses do
     %Schema{type: :array, items: Status, example: [Status.schema().example]}
   end
 
@@ -371,15 +367,18 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
       properties: %{
         status: %Schema{
           type: :string,
+          nullable: true,
           description:
             "Text content of the status. If `media_ids` is provided, this becomes optional. Attaching a `poll` is optional while `status` is provided."
         },
         media_ids: %Schema{
+          nullable: true,
           type: :array,
           items: %Schema{type: :string},
           description: "Array of Attachment ids to be attached as media."
         },
         poll: %Schema{
+          nullable: true,
           type: :object,
           required: [:options],
           properties: %{
@@ -390,26 +389,35 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
             },
             expires_in: %Schema{
               type: :integer,
+              nullable: true,
               description:
                 "Duration the poll should be open, in seconds. Must be provided with `poll[options]`"
             },
-            multiple: %Schema{type: :boolean, description: "Allow multiple choices?"},
+            multiple: %Schema{
+              type: :boolean,
+              nullable: true,
+              description: "Allow multiple choices?"
+            },
             hide_totals: %Schema{
               type: :boolean,
+              nullable: true,
               description: "Hide vote counts until the poll ends?"
             }
           }
         },
         in_reply_to_id: %Schema{
+          nullable: true,
           allOf: [FlakeID],
           description: "ID of the status being replied to, if status is a reply"
         },
         sensitive: %Schema{
           type: :boolean,
+          nullable: true,
           description: "Mark status and attached media as sensitive?"
         },
         spoiler_text: %Schema{
           type: :string,
+          nullable: true,
           description:
             "Text to be shown as a warning or subject before the actual content. Statuses are generally collapsed behind this field."
         },
@@ -420,25 +428,33 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
           description:
             "ISO 8601 Datetime at which to schedule a status. Providing this paramter will cause ScheduledStatus to be returned instead of Status. Must be at least 5 minutes in the future."
         },
-        language: %Schema{type: :string, description: "ISO 639 language code for this status."},
+        language: %Schema{
+          type: :string,
+          nullable: true,
+          description: "ISO 639 language code for this status."
+        },
         # Pleroma-specific properties:
         preview: %Schema{
           type: :boolean,
+          nullable: true,
           description:
             "If set to `true` the post won't be actually posted, but the status entitiy would still be rendered back. This could be useful for previewing rich text/custom emoji, for example"
         },
         content_type: %Schema{
           type: :string,
+          nullable: true,
           description:
             "The MIME type of the status, it is transformed into HTML by the backend. You can get the list of the supported MIME types with the nodeinfo endpoint."
         },
         to: %Schema{
           type: :array,
+          nullable: true,
           items: %Schema{type: :string},
           description:
             "A list of nicknames (like `lain@soykaf.club` or `lain` on the local server) that will be used to determine who is going to be addressed by this post. Using this will disable the implicit addressing by mentioned names in the `status` body, only the people in the `to` list will be addressed. The normal rules for for post visibility are not affected by this and will still apply"
         },
         visibility: %Schema{
+          nullable: true,
           anyOf: [
             VisibilityScope,
             %Schema{type: :string, description: "`list:LIST_ID`", example: "LIST:123"}
@@ -447,11 +463,13 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
             "Visibility of the posted status. Besides standard MastoAPI values (`direct`, `private`, `unlisted` or `public`) it can be used to address a List by setting it to `list:LIST_ID`"
         },
         expires_in: %Schema{
+          nullable: true,
           type: :integer,
           description:
             "The number of seconds the posted activity should expire in. When a posted activity expires it will be deleted from the server, and a delete request for it will be federated. This needs to be longer than an hour."
         },
         in_reply_to_conversation_id: %Schema{
+          nullable: true,
           type: :string,
           description:
             "Will reply to a given conversation, addressing only the people who are part of the recipient set of that conversation. Sets the visibility to `direct`."
diff --git a/lib/pleroma/web/api_spec/operations/subscription_operation.ex b/lib/pleroma/web/api_spec/operations/subscription_operation.ex
index 663b8fa11..cf6dcb068 100644
--- a/lib/pleroma/web/api_spec/operations/subscription_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/subscription_operation.ex
@@ -109,19 +109,38 @@ defmodule Pleroma.Web.ApiSpec.SubscriptionOperation do
           required: [:endpoint, :keys]
         },
         data: %Schema{
+          nullable: true,
           type: :object,
           properties: %{
             alerts: %Schema{
+              nullable: true,
               type: :object,
               properties: %{
-                follow: %Schema{type: :boolean, description: "Receive follow notifications?"},
+                follow: %Schema{
+                  type: :boolean,
+                  nullable: true,
+                  description: "Receive follow notifications?"
+                },
                 favourite: %Schema{
                   type: :boolean,
+                  nullable: true,
                   description: "Receive favourite notifications?"
                 },
-                reblog: %Schema{type: :boolean, description: "Receive reblog notifications?"},
-                mention: %Schema{type: :boolean, description: "Receive mention notifications?"},
-                poll: %Schema{type: :boolean, description: "Receive poll notifications?"}
+                reblog: %Schema{
+                  type: :boolean,
+                  nullable: true,
+                  description: "Receive reblog notifications?"
+                },
+                mention: %Schema{
+                  type: :boolean,
+                  nullable: true,
+                  description: "Receive mention notifications?"
+                },
+                poll: %Schema{
+                  type: :boolean,
+                  nullable: true,
+                  description: "Receive poll notifications?"
+                }
               }
             }
           }
@@ -154,19 +173,38 @@ defmodule Pleroma.Web.ApiSpec.SubscriptionOperation do
       type: :object,
       properties: %{
         data: %Schema{
+          nullable: true,
           type: :object,
           properties: %{
             alerts: %Schema{
+              nullable: true,
               type: :object,
               properties: %{
-                follow: %Schema{type: :boolean, description: "Receive follow notifications?"},
+                follow: %Schema{
+                  type: :boolean,
+                  nullable: true,
+                  description: "Receive follow notifications?"
+                },
                 favourite: %Schema{
                   type: :boolean,
+                  nullable: true,
                   description: "Receive favourite notifications?"
                 },
-                reblog: %Schema{type: :boolean, description: "Receive reblog notifications?"},
-                mention: %Schema{type: :boolean, description: "Receive mention notifications?"},
-                poll: %Schema{type: :boolean, description: "Receive poll notifications?"}
+                reblog: %Schema{
+                  type: :boolean,
+                  nullable: true,
+                  description: "Receive reblog notifications?"
+                },
+                mention: %Schema{
+                  type: :boolean,
+                  nullable: true,
+                  description: "Receive mention notifications?"
+                },
+                poll: %Schema{
+                  type: :boolean,
+                  nullable: true,
+                  description: "Receive poll notifications?"
+                }
               }
             }
           }
diff --git a/lib/pleroma/web/api_spec/operations/timeline_operation.ex b/lib/pleroma/web/api_spec/operations/timeline_operation.ex
index 1b89035d4..cb9d75841 100644
--- a/lib/pleroma/web/api_spec/operations/timeline_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/timeline_operation.ex
@@ -27,8 +27,7 @@ defmodule Pleroma.Web.ApiSpec.TimelineOperation do
         local_param(),
         with_muted_param(),
         exclude_visibilities_param(),
-        reply_visibility_param(),
-        with_relationships_param() | pagination_params()
+        reply_visibility_param() | pagination_params()
       ],
       operationId: "TimelineController.home",
       responses: %{
@@ -63,8 +62,7 @@ defmodule Pleroma.Web.ApiSpec.TimelineOperation do
         only_media_param(),
         with_muted_param(),
         exclude_visibilities_param(),
-        reply_visibility_param(),
-        with_relationships_param() | pagination_params()
+        reply_visibility_param() | pagination_params()
       ],
       operationId: "TimelineController.public",
       responses: %{
@@ -109,8 +107,7 @@ defmodule Pleroma.Web.ApiSpec.TimelineOperation do
         local_param(),
         only_media_param(),
         with_muted_param(),
-        exclude_visibilities_param(),
-        with_relationships_param() | pagination_params()
+        exclude_visibilities_param() | pagination_params()
       ],
       operationId: "TimelineController.hashtag",
       responses: %{
@@ -134,8 +131,7 @@ defmodule Pleroma.Web.ApiSpec.TimelineOperation do
           required: true
         ),
         with_muted_param(),
-        exclude_visibilities_param(),
-        with_relationships_param() | pagination_params()
+        exclude_visibilities_param() | pagination_params()
       ],
       operationId: "TimelineController.list",
       responses: %{
@@ -153,10 +149,6 @@ defmodule Pleroma.Web.ApiSpec.TimelineOperation do
     }
   end
 
-  defp with_relationships_param do
-    Operation.parameter(:with_relationships, :query, BooleanLike, "Include relationships")
-  end
-
   defp local_param do
     Operation.parameter(
       :local,
diff --git a/lib/pleroma/web/api_spec/schemas/attachment.ex b/lib/pleroma/web/api_spec/schemas/attachment.ex
index c146c416e..c6edf6d36 100644
--- a/lib/pleroma/web/api_spec/schemas/attachment.ex
+++ b/lib/pleroma/web/api_spec/schemas/attachment.ex
@@ -13,7 +13,7 @@ defmodule Pleroma.Web.ApiSpec.Schemas.Attachment do
     type: :object,
     requried: [:id, :url, :preview_url],
     properties: %{
-      id: %Schema{type: :string},
+      id: %Schema{type: :string, description: "The ID of the attachment in the database."},
       url: %Schema{
         type: :string,
         format: :uri,
diff --git a/lib/pleroma/web/auth/pleroma_authenticator.ex b/lib/pleroma/web/auth/pleroma_authenticator.ex
index a8f554aa3..200ca03dc 100644
--- a/lib/pleroma/web/auth/pleroma_authenticator.ex
+++ b/lib/pleroma/web/auth/pleroma_authenticator.ex
@@ -16,7 +16,8 @@ defmodule Pleroma.Web.Auth.PleromaAuthenticator do
   def get_user(%Plug.Conn{} = conn) do
     with {:ok, {name, password}} <- fetch_credentials(conn),
          {_, %User{} = user} <- {:user, fetch_user(name)},
-         {_, true} <- {:checkpw, AuthenticationPlug.checkpw(password, user.password_hash)} do
+         {_, true} <- {:checkpw, AuthenticationPlug.checkpw(password, user.password_hash)},
+         {:ok, user} <- AuthenticationPlug.maybe_update_password(user, password) do
       {:ok, user}
     else
       {:error, _reason} = error -> error
diff --git a/lib/pleroma/web/auth/totp_authenticator.ex b/lib/pleroma/web/auth/totp_authenticator.ex
index 04e489c83..ce8a76219 100644
--- a/lib/pleroma/web/auth/totp_authenticator.ex
+++ b/lib/pleroma/web/auth/totp_authenticator.ex
@@ -5,6 +5,7 @@
 defmodule Pleroma.Web.Auth.TOTPAuthenticator do
   alias Pleroma.MFA
   alias Pleroma.MFA.TOTP
+  alias Pleroma.Plugs.AuthenticationPlug
   alias Pleroma.User
 
   @doc "Verify code or check backup code."
@@ -30,7 +31,7 @@ defmodule Pleroma.Web.Auth.TOTPAuthenticator do
         code
       )
       when is_list(codes) and is_binary(code) do
-    hash_code = Enum.find(codes, fn hash -> Pbkdf2.verify_pass(code, hash) end)
+    hash_code = Enum.find(codes, fn hash -> AuthenticationPlug.checkpw(code, hash) end)
 
     if hash_code do
       MFA.invalidate_backup_code(user, hash_code)
diff --git a/lib/pleroma/web/chat_channel.ex b/lib/pleroma/web/chat_channel.ex
index 38ec774f7..bce27897f 100644
--- a/lib/pleroma/web/chat_channel.ex
+++ b/lib/pleroma/web/chat_channel.ex
@@ -23,6 +23,7 @@ defmodule Pleroma.Web.ChatChannel do
     if String.length(text) in 1..Pleroma.Config.get([:instance, :chat_limit]) do
       author = User.get_cached_by_nickname(user_name)
       author = Pleroma.Web.MastodonAPI.AccountView.render("show.json", user: author)
+
       message = ChatChannelState.add_message(%{text: text, author: author})
 
       broadcast!(socket, "new_msg", message)
diff --git a/lib/pleroma/web/common_api/common_api.ex b/lib/pleroma/web/common_api/common_api.ex
index 601caeb46..7c94f16b6 100644
--- a/lib/pleroma/web/common_api/common_api.ex
+++ b/lib/pleroma/web/common_api/common_api.ex
@@ -25,10 +25,21 @@ defmodule Pleroma.Web.CommonAPI do
   require Logger
 
   def unblock(blocker, blocked) do
-    with %Activity{} = block <- Utils.fetch_latest_block(blocker, blocked),
+    with {_, %Activity{} = block} <- {:fetch_block, Utils.fetch_latest_block(blocker, blocked)},
          {:ok, unblock_data, _} <- Builder.undo(blocker, block),
          {:ok, unblock, _} <- Pipeline.common_pipeline(unblock_data, local: true) do
       {:ok, unblock}
+    else
+      {:fetch_block, nil} ->
+        if User.blocks?(blocker, blocked) do
+          User.unblock(blocker, blocked)
+          {:ok, :no_activity}
+        else
+          {:error, :not_blocking}
+        end
+
+      e ->
+        e
     end
   end
 
diff --git a/lib/pleroma/web/controller_helper.ex b/lib/pleroma/web/controller_helper.ex
index eb97ae975..5a1316a5f 100644
--- a/lib/pleroma/web/controller_helper.ex
+++ b/lib/pleroma/web/controller_helper.ex
@@ -5,8 +5,6 @@
 defmodule Pleroma.Web.ControllerHelper do
   use Pleroma.Web, :controller
 
-  alias Pleroma.Config
-
   # As in Mastodon API, per https://api.rubyonrails.org/classes/ActiveModel/Type/Boolean.html
   @falsy_param_values [false, 0, "0", "f", "F", "false", "False", "FALSE", "off", "OFF"]
 
@@ -106,13 +104,16 @@ defmodule Pleroma.Web.ControllerHelper do
 
   def put_if_exist(map, key, value), do: Map.put(map, key, value)
 
-  @doc "Whether to skip rendering `[:account][:pleroma][:relationship]`for statuses/notifications"
-  def skip_relationships?(params) do
-    if Config.get([:extensions, :output_relationships_in_statuses_by_default]) do
-      false
-    else
-      # BREAKING: older PleromaFE versions do not send this param but _do_ expect relationships.
-      not truthy_param?(params["with_relationships"])
-    end
+  @doc """
+  Returns true if request specifies to include embedded relationships in account objects.
+  May only be used in selected account-related endpoints; has no effect for status- or
+    notification-related endpoints.
+  """
+  # Intended for PleromaFE: https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838
+  def embed_relationships?(params) do
+    # To do once OpenAPI transition mess is over: just `truthy_param?(params[:with_relationships])`
+    params
+    |> Map.get(:with_relationships, params["with_relationships"])
+    |> truthy_param?()
   end
 end
diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
index b9ed2d7b2..ef41f9e96 100644
--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
@@ -10,8 +10,8 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
       add_link_headers: 2,
       truthy_param?: 1,
       assign_account_by_id: 2,
-      json_response: 3,
-      skip_relationships?: 1
+      embed_relationships?: 1,
+      json_response: 3
     ]
 
   alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
@@ -247,8 +247,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
       |> render("index.json",
         activities: activities,
         for: reading_user,
-        as: :activity,
-        skip_relationships: skip_relationships?(params)
+        as: :activity
       )
     else
       _e -> render_error(conn, :not_found, "Can't find user")
@@ -271,7 +270,13 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
 
     conn
     |> add_link_headers(followers)
-    |> render("index.json", for: for_user, users: followers, as: :user)
+    # https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
+    |> render("index.json",
+      for: for_user,
+      users: followers,
+      as: :user,
+      embed_relationships: embed_relationships?(params)
+    )
   end
 
   @doc "GET /api/v1/accounts/:id/following"
@@ -290,7 +295,13 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
 
     conn
     |> add_link_headers(followers)
-    |> render("index.json", for: for_user, users: followers, as: :user)
+    # https://git.pleroma.social/pleroma/pleroma-fe/-/issues/838#note_59223
+    |> render("index.json",
+      for: for_user,
+      users: followers,
+      as: :user,
+      embed_relationships: embed_relationships?(params)
+    )
   end
 
   @doc "GET /api/v1/accounts/:id/lists"
diff --git a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
index e36751220..a21233393 100644
--- a/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/media_controller.ex
@@ -11,17 +11,20 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
   alias Pleroma.Web.ActivityPub.ActivityPub
 
   action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate)
   plug(:put_view, Pleroma.Web.MastodonAPI.StatusView)
 
   plug(OAuthScopesPlug, %{scopes: ["write:media"]})
 
+  defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.MediaOperation
+
   @doc "POST /api/v1/media"
-  def create(%{assigns: %{user: user}} = conn, %{"file" => file} = data) do
+  def create(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
     with {:ok, object} <-
            ActivityPub.upload(
              file,
              actor: User.ap_id(user),
-             description: Map.get(data, "description")
+             description: Map.get(data, :description)
            ) do
       attachment_data = Map.put(object.data, "id", object.id)
 
@@ -29,9 +32,28 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
     end
   end
 
+  def create(_conn, _data), do: {:error, :bad_request}
+
+  @doc "POST /api/v2/media"
+  def create2(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
+    with {:ok, object} <-
+           ActivityPub.upload(
+             file,
+             actor: User.ap_id(user),
+             description: Map.get(data, :description)
+           ) do
+      attachment_data = Map.put(object.data, "id", object.id)
+
+      conn
+      |> put_status(202)
+      |> render("attachment.json", %{attachment: attachment_data})
+    end
+  end
+
+  def create2(_conn, _data), do: {:error, :bad_request}
+
   @doc "PUT /api/v1/media/:id"
-  def update(%{assigns: %{user: user}} = conn, %{"id" => id, "description" => description})
-      when is_binary(description) do
+  def update(%{assigns: %{user: user}, body_params: %{description: description}} = conn, %{id: id}) do
     with %Object{} = object <- Object.get_by_id(id),
          true <- Object.authorize_mutation(object, user),
          {:ok, %Object{data: data}} <- Object.update_data(object, %{"name" => description}) do
@@ -41,5 +63,16 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
     end
   end
 
-  def update(_conn, _data), do: {:error, :bad_request}
+  def update(conn, data), do: show(conn, data)
+
+  @doc "GET /api/v1/media/:id"
+  def show(conn, %{id: id}) do
+    with %Object{data: data, id: object_id} <- Object.get_by_id(id) do
+      attachment_data = Map.put(data, "id", object_id)
+
+      render(conn, "attachment.json", %{attachment: attachment_data})
+    end
+  end
+
+  def get_media(_conn, _data), do: {:error, :bad_request}
 end
diff --git a/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex b/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
index 596b85617..bcd12c73f 100644
--- a/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/notification_controller.ex
@@ -5,7 +5,7 @@
 defmodule Pleroma.Web.MastodonAPI.NotificationController do
   use Pleroma.Web, :controller
 
-  import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2, skip_relationships?: 1]
+  import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]
 
   alias Pleroma.Notification
   alias Pleroma.Plugs.OAuthScopesPlug
@@ -50,8 +50,7 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
     |> add_link_headers(notifications)
     |> render("index.json",
       notifications: notifications,
-      for: user,
-      skip_relationships: skip_relationships?(params)
+      for: user
     )
   end
 
diff --git a/lib/pleroma/web/mastodon_api/controllers/search_controller.ex b/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
index 0e0d54ba4..77e2224e4 100644
--- a/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/search_controller.ex
@@ -5,14 +5,13 @@
 defmodule Pleroma.Web.MastodonAPI.SearchController do
   use Pleroma.Web, :controller
 
-  import Pleroma.Web.ControllerHelper, only: [skip_relationships?: 1]
-
   alias Pleroma.Activity
   alias Pleroma.Plugs.OAuthScopesPlug
   alias Pleroma.Plugs.RateLimiter
   alias Pleroma.Repo
   alias Pleroma.User
   alias Pleroma.Web
+  alias Pleroma.Web.ControllerHelper
   alias Pleroma.Web.MastodonAPI.AccountView
   alias Pleroma.Web.MastodonAPI.StatusView
 
@@ -34,7 +33,11 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
 
     conn
     |> put_view(AccountView)
-    |> render("index.json", users: accounts, for: user, as: :user)
+    |> render("index.json",
+      users: accounts,
+      for: user,
+      as: :user
+    )
   end
 
   def search2(conn, params), do: do_search(:v2, conn, params)
@@ -71,13 +74,13 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
 
   defp search_options(params, user) do
     [
-      skip_relationships: skip_relationships?(params),
       resolve: params[:resolve],
       following: params[:following],
       limit: params[:limit],
       offset: params[:offset],
       type: params[:type],
       author: get_author(params),
+      embed_relationships: ControllerHelper.embed_relationships?(params),
       for_user: user
     ]
     |> Enum.filter(&elem(&1, 1))
@@ -90,7 +93,7 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
       users: accounts,
       for: options[:for_user],
       as: :user,
-      skip_relationships: false
+      embed_relationships: options[:embed_relationships]
     )
   end
 
@@ -100,8 +103,7 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
     StatusView.render("index.json",
       activities: statuses,
       for: options[:for_user],
-      as: :activity,
-      skip_relationships: options[:skip_relationships]
+      as: :activity
     )
   end
 
diff --git a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
index 25e499a77..9dbf4f33c 100644
--- a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
@@ -6,7 +6,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   use Pleroma.Web, :controller
 
   import Pleroma.Web.ControllerHelper,
-    only: [try_render: 3, add_link_headers: 2, skip_relationships?: 1]
+    only: [try_render: 3, add_link_headers: 2]
 
   require Ecto.Query
 
@@ -105,7 +105,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
 
   `ids` query param is required
   """
-  def index(%{assigns: %{user: user}} = conn, %{ids: ids} = params) do
+  def index(%{assigns: %{user: user}} = conn, %{ids: ids} = _params) do
     limit = 100
 
     activities =
@@ -117,8 +117,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
     render(conn, "index.json",
       activities: activities,
       for: user,
-      as: :activity,
-      skip_relationships: skip_relationships?(params)
+      as: :activity
     )
   end
 
@@ -383,8 +382,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
     |> render("index.json",
       activities: activities,
       for: user,
-      as: :activity,
-      skip_relationships: skip_relationships?(params)
+      as: :activity
     )
   end
 
@@ -406,8 +404,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
     |> render("index.json",
       activities: activities,
       for: user,
-      as: :activity,
-      skip_relationships: skip_relationships?(params)
+      as: :activity
     )
   end
 end
diff --git a/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex b/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
index bbd576ffd..958567510 100644
--- a/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/timeline_controller.ex
@@ -6,7 +6,7 @@ defmodule Pleroma.Web.MastodonAPI.TimelineController do
   use Pleroma.Web, :controller
 
   import Pleroma.Web.ControllerHelper,
-    only: [add_link_headers: 2, add_link_headers: 3, skip_relationships?: 1]
+    only: [add_link_headers: 2, add_link_headers: 3]
 
   alias Pleroma.Pagination
   alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
@@ -63,8 +63,7 @@ defmodule Pleroma.Web.MastodonAPI.TimelineController do
     |> render("index.json",
       activities: activities,
       for: user,
-      as: :activity,
-      skip_relationships: skip_relationships?(params)
+      as: :activity
     )
   end
 
@@ -88,8 +87,7 @@ defmodule Pleroma.Web.MastodonAPI.TimelineController do
     |> render("index.json",
       activities: activities,
       for: user,
-      as: :activity,
-      skip_relationships: skip_relationships?(params)
+      as: :activity
     )
   end
 
@@ -125,8 +123,7 @@ defmodule Pleroma.Web.MastodonAPI.TimelineController do
       |> render("index.json",
         activities: activities,
         for: user,
-        as: :activity,
-        skip_relationships: skip_relationships?(params)
+        as: :activity
       )
     end
   end
@@ -173,8 +170,7 @@ defmodule Pleroma.Web.MastodonAPI.TimelineController do
     |> render("index.json",
       activities: activities,
       for: user,
-      as: :activity,
-      skip_relationships: skip_relationships?(params)
+      as: :activity
     )
   end
 
@@ -203,8 +199,7 @@ defmodule Pleroma.Web.MastodonAPI.TimelineController do
       render(conn, "index.json",
         activities: activities,
         for: user,
-        as: :activity,
-        skip_relationships: skip_relationships?(params)
+        as: :activity
       )
     else
       _e -> render_error(conn, :forbidden, "Error.")
diff --git a/lib/pleroma/web/mastodon_api/views/account_view.ex b/lib/pleroma/web/mastodon_api/views/account_view.ex
index 835dfe9f4..45fffaad2 100644
--- a/lib/pleroma/web/mastodon_api/views/account_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/account_view.ex
@@ -15,13 +15,12 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
   def render("index.json", %{users: users} = opts) do
     reading_user = opts[:for]
 
-    # Note: :skip_relationships option is currently intentionally not supported for accounts
     relationships_opt =
       cond do
         Map.has_key?(opts, :relationships) ->
           opts[:relationships]
 
-        is_nil(reading_user) ->
+        is_nil(reading_user) || !opts[:embed_relationships] ->
           UserRelationship.view_relationships_option(nil, [])
 
         true ->
@@ -193,14 +192,14 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
       end)
 
     relationship =
-      if opts[:skip_relationships] do
-        %{}
-      else
+      if opts[:embed_relationships] do
         render("relationship.json", %{
           user: opts[:for],
           target: user,
           relationships: opts[:relationships]
         })
+      else
+        %{}
       end
 
     %{
diff --git a/lib/pleroma/web/mastodon_api/views/notification_view.ex b/lib/pleroma/web/mastodon_api/views/notification_view.ex
index 4da1ab67f..c46ddcf55 100644
--- a/lib/pleroma/web/mastodon_api/views/notification_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/notification_view.ex
@@ -51,9 +51,7 @@ defmodule Pleroma.Web.MastodonAPI.NotificationView do
             |> Enum.filter(& &1)
             |> Kernel.++(move_activities_targets)
 
-          UserRelationship.view_relationships_option(reading_user, actors,
-            source_mutes_only: opts[:skip_relationships]
-          )
+          UserRelationship.view_relationships_option(reading_user, actors, subset: :source_mutes)
       end
 
     opts =
@@ -83,15 +81,13 @@ defmodule Pleroma.Web.MastodonAPI.NotificationView do
 
     mastodon_type = Activity.mastodon_notification_type(activity)
 
-    render_opts = %{
-      relationships: opts[:relationships],
-      skip_relationships: opts[:skip_relationships]
-    }
+    # Note: :relationships contain user mutes (needed for :muted flag in :status)
+    status_render_opts = %{relationships: opts[:relationships]}
 
     with %{id: _} = account <-
            AccountView.render(
              "show.json",
-             Map.merge(render_opts, %{user: actor, for: reading_user})
+             %{user: actor, for: reading_user}
            ) do
       response = %{
         id: to_string(notification.id),
@@ -105,21 +101,20 @@ defmodule Pleroma.Web.MastodonAPI.NotificationView do
 
       case mastodon_type do
         "mention" ->
-          put_status(response, activity, reading_user, render_opts)
+          put_status(response, activity, reading_user, status_render_opts)
 
         "favourite" ->
-          put_status(response, parent_activity_fn.(), reading_user, render_opts)
+          put_status(response, parent_activity_fn.(), reading_user, status_render_opts)
 
         "reblog" ->
-          put_status(response, parent_activity_fn.(), reading_user, render_opts)
+          put_status(response, parent_activity_fn.(), reading_user, status_render_opts)
 
         "move" ->
-          # Note: :skip_relationships option being applied to _account_ rendering (here)
-          put_target(response, activity, reading_user, render_opts)
+          put_target(response, activity, reading_user, %{})
 
         "pleroma:emoji_reaction" ->
           response
-          |> put_status(parent_activity_fn.(), reading_user, render_opts)
+          |> put_status(parent_activity_fn.(), reading_user, status_render_opts)
           |> put_emoji(activity)
 
         type when type in ["follow", "follow_request"] ->
diff --git a/lib/pleroma/web/mastodon_api/views/status_view.ex b/lib/pleroma/web/mastodon_api/views/status_view.ex
index 24167f66f..05a26017a 100644
--- a/lib/pleroma/web/mastodon_api/views/status_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/status_view.ex
@@ -107,9 +107,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
             |> Enum.map(&get_user(&1.data["actor"], false))
             |> Enum.filter(& &1)
 
-          UserRelationship.view_relationships_option(reading_user, actors,
-            source_mutes_only: opts[:skip_relationships]
-          )
+          UserRelationship.view_relationships_option(reading_user, actors, subset: :source_mutes)
       end
 
     opts =
@@ -162,9 +160,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
       account:
         AccountView.render("show.json", %{
           user: user,
-          for: opts[:for],
-          relationships: opts[:relationships],
-          skip_relationships: opts[:skip_relationships]
+          for: opts[:for]
         }),
       in_reply_to_id: nil,
       in_reply_to_account_id: nil,
@@ -330,9 +326,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
       account:
         AccountView.render("show.json", %{
           user: user,
-          for: opts[:for],
-          relationships: opts[:relationships],
-          skip_relationships: opts[:skip_relationships]
+          for: opts[:for]
         }),
       in_reply_to_id: reply_to && to_string(reply_to.id),
       in_reply_to_account_id: reply_to_user && to_string(reply_to_user.id),
diff --git a/lib/pleroma/web/mongooseim/mongoose_im_controller.ex b/lib/pleroma/web/mongooseim/mongoose_im_controller.ex
index 0814b3bc3..6cbbe8fd8 100644
--- a/lib/pleroma/web/mongooseim/mongoose_im_controller.ex
+++ b/lib/pleroma/web/mongooseim/mongoose_im_controller.ex
@@ -5,6 +5,7 @@
 defmodule Pleroma.Web.MongooseIM.MongooseIMController do
   use Pleroma.Web, :controller
 
+  alias Pleroma.Plugs.AuthenticationPlug
   alias Pleroma.Plugs.RateLimiter
   alias Pleroma.Repo
   alias Pleroma.User
@@ -27,7 +28,7 @@ defmodule Pleroma.Web.MongooseIM.MongooseIMController do
   def check_password(conn, %{"user" => username, "pass" => password}) do
     with %User{password_hash: password_hash, deactivated: false} <-
            Repo.get_by(User, nickname: username, local: true),
-         true <- Pbkdf2.verify_pass(password, password_hash) do
+         true <- AuthenticationPlug.checkpw(password, password_hash) do
       conn
       |> json(true)
     else
diff --git a/lib/pleroma/web/pleroma_api/controllers/account_controller.ex b/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
index be7477867..0a3f45620 100644
--- a/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
@@ -6,7 +6,7 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
   use Pleroma.Web, :controller
 
   import Pleroma.Web.ControllerHelper,
-    only: [json_response: 3, add_link_headers: 2, assign_account_by_id: 2, skip_relationships?: 1]
+    only: [json_response: 3, add_link_headers: 2, assign_account_by_id: 2]
 
   alias Ecto.Changeset
   alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
@@ -19,6 +19,13 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
   require Pleroma.Constants
 
   plug(
+    OpenApiSpex.Plug.PutApiSpec,
+    [module: Pleroma.Web.ApiSpec] when action == :confirmation_resend
+  )
+
+  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+
+  plug(
     :skip_plug,
     [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug] when action == :confirmation_resend
   )
@@ -49,9 +56,11 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
   plug(:assign_account_by_id when action in [:favourites, :subscribe, :unsubscribe])
   plug(:put_view, Pleroma.Web.MastodonAPI.AccountView)
 
+  defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaAccountOperation
+
   @doc "POST /api/v1/pleroma/accounts/confirmation_resend"
   def confirmation_resend(conn, params) do
-    nickname_or_email = params["email"] || params["nickname"]
+    nickname_or_email = params[:email] || params[:nickname]
 
     with %User{} = user <- User.get_by_nickname_or_email(nickname_or_email),
          {:ok, _} <- User.try_send_confirmation_email(user) do
@@ -60,7 +69,7 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
   end
 
   @doc "PATCH /api/v1/pleroma/accounts/update_avatar"
-  def update_avatar(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
+  def update_avatar(%{assigns: %{user: user}, body_params: %{img: ""}} = conn, _) do
     {:ok, _user} =
       user
       |> Changeset.change(%{avatar: nil})
@@ -69,7 +78,7 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
     json(conn, %{url: nil})
   end
 
-  def update_avatar(%{assigns: %{user: user}} = conn, params) do
+  def update_avatar(%{assigns: %{user: user}, body_params: params} = conn, _params) do
     {:ok, %{data: data}} = ActivityPub.upload(params, type: :avatar)
     {:ok, _user} = user |> Changeset.change(%{avatar: data}) |> User.update_and_set_cache()
     %{"url" => [%{"href" => href} | _]} = data
@@ -78,14 +87,14 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
   end
 
   @doc "PATCH /api/v1/pleroma/accounts/update_banner"
-  def update_banner(%{assigns: %{user: user}} = conn, %{"banner" => ""}) do
+  def update_banner(%{assigns: %{user: user}, body_params: %{banner: ""}} = conn, _) do
     with {:ok, _user} <- User.update_banner(user, %{}) do
       json(conn, %{url: nil})
     end
   end
 
-  def update_banner(%{assigns: %{user: user}} = conn, params) do
-    with {:ok, object} <- ActivityPub.upload(%{"img" => params["banner"]}, type: :banner),
+  def update_banner(%{assigns: %{user: user}, body_params: params} = conn, _) do
+    with {:ok, object} <- ActivityPub.upload(%{img: params[:banner]}, type: :banner),
          {:ok, _user} <- User.update_banner(user, object.data) do
       %{"url" => [%{"href" => href} | _]} = object.data
 
@@ -94,13 +103,13 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
   end
 
   @doc "PATCH /api/v1/pleroma/accounts/update_background"
-  def update_background(%{assigns: %{user: user}} = conn, %{"img" => ""}) do
+  def update_background(%{assigns: %{user: user}, body_params: %{img: ""}} = conn, _) do
     with {:ok, _user} <- User.update_background(user, %{}) do
       json(conn, %{url: nil})
     end
   end
 
-  def update_background(%{assigns: %{user: user}} = conn, params) do
+  def update_background(%{assigns: %{user: user}, body_params: params} = conn, _) do
     with {:ok, object} <- ActivityPub.upload(params, type: :background),
          {:ok, _user} <- User.update_background(user, object.data) do
       %{"url" => [%{"href" => href} | _]} = object.data
@@ -117,6 +126,7 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
   def favourites(%{assigns: %{user: for_user, account: user}} = conn, params) do
     params =
       params
+      |> Map.new(fn {key, value} -> {to_string(key), value} end)
       |> Map.put("type", "Create")
       |> Map.put("favorited_by", user.ap_id)
       |> Map.put("blocking_user", for_user)
@@ -139,8 +149,7 @@ defmodule Pleroma.Web.PleromaAPI.AccountController do
     |> render("index.json",
       activities: activities,
       for: for_user,
-      as: :activity,
-      skip_relationships: skip_relationships?(params)
+      as: :activity
     )
   end
 
diff --git a/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex b/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
index 8bc77b75e..e834133b2 100644
--- a/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
@@ -5,7 +5,7 @@
 defmodule Pleroma.Web.PleromaAPI.PleromaAPIController do
   use Pleroma.Web, :controller
 
-  import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2, skip_relationships?: 1]
+  import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]
 
   alias Pleroma.Activity
   alias Pleroma.Conversation.Participation
@@ -69,7 +69,12 @@ defmodule Pleroma.Web.PleromaAPI.PleromaAPIController do
             %{
               name: emoji,
               count: length(users),
-              accounts: AccountView.render("index.json", %{users: users, for: user, as: :user}),
+              accounts:
+                AccountView.render("index.json", %{
+                  users: users,
+                  for: user,
+                  as: :user
+                }),
               me: !!(user && user.ap_id in user_ap_ids)
             }
           end
@@ -145,8 +150,7 @@ defmodule Pleroma.Web.PleromaAPI.PleromaAPIController do
       |> render("index.json",
         activities: activities,
         for: user,
-        as: :activity,
-        skip_relationships: skip_relationships?(params)
+        as: :activity
       )
     else
       _error ->
@@ -201,7 +205,7 @@ defmodule Pleroma.Web.PleromaAPI.PleromaAPIController do
     end
   end
 
-  def mark_notifications_as_read(%{assigns: %{user: user}} = conn, %{"max_id" => max_id} = params) do
+  def mark_notifications_as_read(%{assigns: %{user: user}} = conn, %{"max_id" => max_id}) do
     with notifications <- Notification.set_read_up_to(user, max_id) do
       notifications = Enum.take(notifications, 80)
 
@@ -209,8 +213,7 @@ defmodule Pleroma.Web.PleromaAPI.PleromaAPIController do
       |> put_view(NotificationView)
       |> render("index.json",
         notifications: notifications,
-        for: user,
-        skip_relationships: skip_relationships?(params)
+        for: user
       )
     end
   end
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 7a171f9fb..d77a61361 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -403,6 +403,7 @@ defmodule Pleroma.Web.Router do
     post("/markers", MarkerController, :upsert)
 
     post("/media", MediaController, :create)
+    get("/media/:id", MediaController, :show)
     put("/media/:id", MediaController, :update)
 
     get("/notifications", NotificationController, :index)
@@ -497,6 +498,8 @@ defmodule Pleroma.Web.Router do
   scope "/api/v2", Pleroma.Web.MastodonAPI do
     pipe_through(:api)
     get("/search", SearchController, :search2)
+
+    post("/media", MediaController, :create2)
   end
 
   scope "/api", Pleroma.Web do