Merge branch 'develop' into 'docs/add-clients-to-ex_doc'

# Conflicts:
#   mix.exs

17 files changed, 241 insertions, 63 deletions

diff --git a/lib/pleroma/plugs/http_security_plug.ex b/lib/pleroma/plugs/http_security_plug.ex
index 3c8e6a18f..057553e24 100644
--- a/lib/pleroma/plugs/http_security_plug.ex
+++ b/lib/pleroma/plugs/http_security_plug.ex
@@ -34,6 +34,21 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
 
   defp csp_string do
     scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
+    websocket_url = String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws")
+
+    connect_src =
+      if Mix.env() == :dev do
+        "connect-src 'self' http://localhost:3035/ " <> websocket_url
+      else
+        "connect-src 'self' " <> websocket_url
+      end
+
+    script_src =
+      if Mix.env() == :dev do
+        "script-src 'self' 'unsafe-eval'"
+      else
+        "script-src 'self'"
+      end
 
     [
       "default-src 'none'",
@@ -43,9 +58,9 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
       "media-src 'self' https:",
       "style-src 'self' 'unsafe-inline'",
       "font-src 'self'",
-      "script-src 'self'",
-      "connect-src 'self' " <> String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws"),
       "manifest-src 'self'",
+      connect_src,
+      script_src,
       if scheme == "https" do
         "upgrade-insecure-requests"
       end
diff --git a/lib/pleroma/uploaders/mdii.ex b/lib/pleroma/uploaders/mdii.ex
index 320b07abd..190ed9f3a 100644
--- a/lib/pleroma/uploaders/mdii.ex
+++ b/lib/pleroma/uploaders/mdii.ex
@@ -25,7 +25,7 @@ defmodule Pleroma.Uploaders.MDII do
     query = "#{cgi}?#{extension}"
 
     with {:ok, %{status: 200, body: body}} <-
-           @httpoison.post(query, file_data, adapter: [pool: :default]) do
+           @httpoison.post(query, file_data, [], adapter: [pool: :default]) do
       remote_file_name = String.split(body) |> List.first()
       public_url = "#{files}/#{remote_file_name}.#{extension}"
       {:ok, {:url, public_url}}
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 0060d966b..3c6a9953d 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -261,6 +261,7 @@ defmodule Pleroma.User do
   def register(%Ecto.Changeset{} = changeset) do
     with {:ok, user} <- Repo.insert(changeset),
          {:ok, user} <- autofollow_users(user),
+         {:ok, _} <- Pleroma.User.WelcomeMessage.post_welcome_message_to_user(user),
          {:ok, _} <- try_send_confirmation_email(user) do
       {:ok, user}
     end
@@ -311,12 +312,12 @@ defmodule Pleroma.User do
     end
   end
 
-  @doc "A mass follow for local users. Respects blocks but does not create activities."
+  @doc "A mass follow for local users. Respects blocks in both directions but does not create activities."
   @spec follow_all(User.t(), list(User.t())) :: {atom(), User.t()}
   def follow_all(follower, followeds) do
     followed_addresses =
       followeds
-      |> Enum.reject(fn %{ap_id: ap_id} -> ap_id in follower.info.blocks end)
+      |> Enum.reject(fn followed -> blocks?(follower, followed) || blocks?(followed, follower) end)
       |> Enum.map(fn %{follower_address: fa} -> fa end)
 
     q =
@@ -731,7 +732,7 @@ defmodule Pleroma.User do
     # Strip the beginning @ off if there is a query
     query = String.trim_leading(query, "@")
 
-    if resolve, do: User.get_or_fetch_by_nickname(query)
+    if resolve, do: get_or_fetch(query)
 
     fts_results = do_search(fts_search_subquery(query), for_user)
 
diff --git a/lib/pleroma/user/welcome_message.ex b/lib/pleroma/user/welcome_message.ex
new file mode 100644
index 000000000..8018ac22f
--- /dev/null
+++ b/lib/pleroma/user/welcome_message.ex
@@ -0,0 +1,30 @@
+defmodule Pleroma.User.WelcomeMessage do
+  alias Pleroma.User
+  alias Pleroma.Web.CommonAPI
+
+  def post_welcome_message_to_user(user) do
+    with %User{} = sender_user <- welcome_user(),
+         message when is_binary(message) <- welcome_message() do
+      CommonAPI.post(sender_user, %{
+        "visibility" => "direct",
+        "status" => "@#{user.nickname}\n#{message}"
+      })
+    else
+      _ -> {:ok, nil}
+    end
+  end
+
+  defp welcome_user() do
+    with nickname when is_binary(nickname) <-
+           Pleroma.Config.get([:instance, :welcome_user_nickname]),
+         %User{local: true} = user <- User.get_cached_by_nickname(nickname) do
+      user
+    else
+      _ -> nil
+    end
+  end
+
+  defp welcome_message() do
+    Pleroma.Config.get([:instance, :welcome_message])
+  end
+end
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index c46d8233e..ab2872f56 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -818,8 +818,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     if object = Object.get_cached_by_ap_id(id) do
       {:ok, object}
     else
-      Logger.info("Fetching #{id} via AP")
-
       with {:ok, data} <- fetch_and_contain_remote_object_from_id(id),
            nil <- Object.normalize(data),
            params <- %{
@@ -851,7 +849,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
   end
 
   def fetch_and_contain_remote_object_from_id(id) do
-    Logger.info("Fetching #{id} via AP")
+    Logger.info("Fetching object #{id} via AP")
 
     with true <- String.starts_with?(id, "http"),
          {:ok, %{body: body, status: code}} when code in 200..299 <-
diff --git a/lib/pleroma/web/activity_pub/mrf/hellthread_policy.ex b/lib/pleroma/web/activity_pub/mrf/hellthread_policy.ex
index 4c6e612b2..6736f3cb9 100644
--- a/lib/pleroma/web/activity_pub/mrf/hellthread_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/hellthread_policy.ex
@@ -6,40 +6,80 @@ defmodule Pleroma.Web.ActivityPub.MRF.HellthreadPolicy do
   alias Pleroma.User
   @behaviour Pleroma.Web.ActivityPub.MRF
 
-  defp delist_message(message) do
+  defp delist_message(message, threshold) when threshold > 0 do
     follower_collection = User.get_cached_by_ap_id(message["actor"]).follower_address
 
-    message
-    |> Map.put("to", [follower_collection])
-    |> Map.put("cc", ["https://www.w3.org/ns/activitystreams#Public"])
+    follower_collection? = Enum.member?(message["to"] ++ message["cc"], follower_collection)
+
+    message =
+      case get_recipient_count(message) do
+        {:public, recipients}
+        when follower_collection? and recipients > threshold ->
+          message
+          |> Map.put("to", [follower_collection])
+          |> Map.put("cc", ["https://www.w3.org/ns/activitystreams#Public"])
+
+        {:public, recipients} when recipients > threshold ->
+          message
+          |> Map.put("to", [])
+          |> Map.put("cc", ["https://www.w3.org/ns/activitystreams#Public"])
+
+        _ ->
+          message
+      end
+
+    {:ok, message}
+  end
+
+  defp delist_message(message, _threshold), do: {:ok, message}
+
+  defp reject_message(message, threshold) when threshold > 0 do
+    with {_, recipients} <- get_recipient_count(message) do
+      if recipients > threshold do
+        {:reject, nil}
+      else
+        {:ok, message}
+      end
+    end
+  end
+
+  defp reject_message(message, _threshold), do: {:ok, message}
+
+  defp get_recipient_count(message) do
+    recipients = (message["to"] || []) ++ (message["cc"] || [])
+    follower_collection = User.get_cached_by_ap_id(message["actor"]).follower_address
+
+    if Enum.member?(recipients, "https://www.w3.org/ns/activitystreams#Public") do
+      recipients =
+        recipients
+        |> List.delete("https://www.w3.org/ns/activitystreams#Public")
+        |> List.delete(follower_collection)
+
+      {:public, length(recipients)}
+    else
+      recipients =
+        recipients
+        |> List.delete(follower_collection)
+
+      {:not_public, length(recipients)}
+    end
   end
 
   @impl true
   def filter(%{"type" => "Create"} = message) do
-    delist_threshold = Pleroma.Config.get([:mrf_hellthread, :delist_threshold])
-
     reject_threshold =
       Pleroma.Config.get(
         [:mrf_hellthread, :reject_threshold],
         Pleroma.Config.get([:mrf_hellthread, :threshold])
       )
 
-    recipients = (message["to"] || []) ++ (message["cc"] || [])
-
-    cond do
-      length(recipients) > reject_threshold and reject_threshold > 0 ->
-        {:reject, nil}
-
-      length(recipients) > delist_threshold and delist_threshold > 0 ->
-        if Enum.member?(message["to"], "https://www.w3.org/ns/activitystreams#Public") or
-             Enum.member?(message["cc"], "https://www.w3.org/ns/activitystreams#Public") do
-          {:ok, delist_message(message)}
-        else
-          {:ok, message}
-        end
+    delist_threshold = Pleroma.Config.get([:mrf_hellthread, :delist_threshold])
 
-      true ->
-        {:ok, message}
+    with {:ok, message} <- reject_message(message, reject_threshold),
+         {:ok, message} <- delist_message(message, delist_threshold) do
+      {:ok, message}
+    else
+      _e -> {:reject, nil}
     end
   end
 
diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
index 98a2af819..26b2dd575 100644
--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
@@ -649,7 +649,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
     if object = Object.normalize(id), do: {:ok, object}, else: nil
   end
 
-  def set_reply_to_uri(%{"inReplyTo" => inReplyTo} = object) do
+  def set_reply_to_uri(%{"inReplyTo" => inReplyTo} = object) when is_binary(inReplyTo) do
     with false <- String.starts_with?(inReplyTo, "http"),
          {:ok, %{data: replied_to_object}} <- get_obj_helper(inReplyTo) do
       Map.put(object, "inReplyTo", replied_to_object["external_url"] || inReplyTo)
@@ -765,12 +765,18 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
   def add_hashtags(object) do
     tags =
       (object["tag"] || [])
-      |> Enum.map(fn tag ->
-        %{
-          "href" => Pleroma.Web.Endpoint.url() <> "/tags/#{tag}",
-          "name" => "##{tag}",
-          "type" => "Hashtag"
-        }
+      |> Enum.map(fn
+        # Expand internal representation tags into AS2 tags.
+        tag when is_binary(tag) ->
+          %{
+            "href" => Pleroma.Web.Endpoint.url() <> "/tags/#{tag}",
+            "name" => "##{tag}",
+            "type" => "Hashtag"
+          }
+
+        # Do not process tags which are already AS2 tag objects.
+        tag when is_map(tag) ->
+          tag
       end)
 
     object
diff --git a/lib/pleroma/web/activity_pub/views/user_view.ex b/lib/pleroma/web/activity_pub/views/user_view.ex
index 15e6c1f68..c8e154989 100644
--- a/lib/pleroma/web/activity_pub/views/user_view.ex
+++ b/lib/pleroma/web/activity_pub/views/user_view.ex
@@ -12,9 +12,26 @@ defmodule Pleroma.Web.ActivityPub.UserView do
   alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.ActivityPub.Transmogrifier
   alias Pleroma.Web.ActivityPub.Utils
+  alias Pleroma.Web.Router.Helpers
+  alias Pleroma.Web.Endpoint
 
   import Ecto.Query
 
+  def render("endpoints.json", %{user: %User{nickname: nil, local: true} = _user}) do
+    %{"sharedInbox" => Helpers.activity_pub_url(Endpoint, :inbox)}
+  end
+
+  def render("endpoints.json", %{user: %User{local: true} = _user}) do
+    %{
+      "oauthAuthorizationEndpoint" => Helpers.o_auth_url(Endpoint, :authorize),
+      "oauthRegistrationEndpoint" => Helpers.mastodon_api_url(Endpoint, :create_app),
+      "oauthTokenEndpoint" => Helpers.o_auth_url(Endpoint, :token_exchange),
+      "sharedInbox" => Helpers.activity_pub_url(Endpoint, :inbox)
+    }
+  end
+
+  def render("endpoints.json", _), do: %{}
+
   # the instance itself is not a Person, but instead an Application
   def render("user.json", %{user: %{nickname: nil} = user}) do
     {:ok, user} = WebFinger.ensure_keys_present(user)
@@ -22,6 +39,8 @@ defmodule Pleroma.Web.ActivityPub.UserView do
     public_key = :public_key.pem_entry_encode(:SubjectPublicKeyInfo, public_key)
     public_key = :public_key.pem_encode([public_key])
 
+    endpoints = render("endpoints.json", %{user: user})
+
     %{
       "id" => user.ap_id,
       "type" => "Application",
@@ -37,9 +56,7 @@ defmodule Pleroma.Web.ActivityPub.UserView do
         "owner" => user.ap_id,
         "publicKeyPem" => public_key
       },
-      "endpoints" => %{
-        "sharedInbox" => "#{Pleroma.Web.Endpoint.url()}/inbox"
-      }
+      "endpoints" => endpoints
     }
     |> Map.merge(Utils.make_json_ld_header())
   end
@@ -50,6 +67,8 @@ defmodule Pleroma.Web.ActivityPub.UserView do
     public_key = :public_key.pem_entry_encode(:SubjectPublicKeyInfo, public_key)
     public_key = :public_key.pem_encode([public_key])
 
+    endpoints = render("endpoints.json", %{user: user})
+
     %{
       "id" => user.ap_id,
       "type" => "Person",
@@ -67,9 +86,7 @@ defmodule Pleroma.Web.ActivityPub.UserView do
         "owner" => user.ap_id,
         "publicKeyPem" => public_key
       },
-      "endpoints" => %{
-        "sharedInbox" => "#{Pleroma.Web.Endpoint.url()}/inbox"
-      },
+      "endpoints" => endpoints,
       "icon" => %{
         "type" => "Image",
         "url" => User.avatar_url(user)
@@ -88,7 +105,14 @@ defmodule Pleroma.Web.ActivityPub.UserView do
     query = from(user in query, select: [:ap_id])
     following = Repo.all(query)
 
-    collection(following, "#{user.ap_id}/following", page, !user.info.hide_follows)
+    total =
+      if !user.info.hide_follows do
+        length(following)
+      else
+        0
+      end
+
+    collection(following, "#{user.ap_id}/following", page, !user.info.hide_follows, total)
     |> Map.merge(Utils.make_json_ld_header())
   end
 
@@ -97,10 +121,17 @@ defmodule Pleroma.Web.ActivityPub.UserView do
     query = from(user in query, select: [:ap_id])
     following = Repo.all(query)
 
+    total =
+      if !user.info.hide_follows do
+        length(following)
+      else
+        0
+      end
+
     %{
       "id" => "#{user.ap_id}/following",
       "type" => "OrderedCollection",
-      "totalItems" => length(following),
+      "totalItems" => total,
       "first" => collection(following, "#{user.ap_id}/following", 1, !user.info.hide_follows)
     }
     |> Map.merge(Utils.make_json_ld_header())
@@ -111,7 +142,14 @@ defmodule Pleroma.Web.ActivityPub.UserView do
     query = from(user in query, select: [:ap_id])
     followers = Repo.all(query)
 
-    collection(followers, "#{user.ap_id}/followers", page, !user.info.hide_followers)
+    total =
+      if !user.info.hide_followers do
+        length(followers)
+      else
+        0
+      end
+
+    collection(followers, "#{user.ap_id}/followers", page, !user.info.hide_followers, total)
     |> Map.merge(Utils.make_json_ld_header())
   end
 
@@ -120,19 +158,24 @@ defmodule Pleroma.Web.ActivityPub.UserView do
     query = from(user in query, select: [:ap_id])
     followers = Repo.all(query)
 
+    total =
+      if !user.info.hide_followers do
+        length(followers)
+      else
+        0
+      end
+
     %{
       "id" => "#{user.ap_id}/followers",
       "type" => "OrderedCollection",
-      "totalItems" => length(followers),
-      "first" => collection(followers, "#{user.ap_id}/followers", 1, !user.info.hide_followers)
+      "totalItems" => total,
+      "first" =>
+        collection(followers, "#{user.ap_id}/followers", 1, !user.info.hide_followers, total)
     }
     |> Map.merge(Utils.make_json_ld_header())
   end
 
   def render("outbox.json", %{user: user, max_id: max_qid}) do
-    # XXX: technically note_count is wrong for this, but it's better than nothing
-    info = User.user_info(user)
-
     params = %{
       "limit" => "10"
     }
@@ -160,7 +203,6 @@ defmodule Pleroma.Web.ActivityPub.UserView do
       "id" => "#{iri}?max_id=#{max_id}",
       "type" => "OrderedCollectionPage",
       "partOf" => iri,
-      "totalItems" => info.note_count,
       "orderedItems" => collection,
       "next" => "#{iri}?max_id=#{min_id}"
     }
@@ -169,7 +211,6 @@ defmodule Pleroma.Web.ActivityPub.UserView do
       %{
         "id" => iri,
         "type" => "OrderedCollection",
-        "totalItems" => info.note_count,
         "first" => page
       }
       |> Map.merge(Utils.make_json_ld_header())
@@ -207,7 +248,6 @@ defmodule Pleroma.Web.ActivityPub.UserView do
       "id" => "#{iri}?max_id=#{max_id}",
       "type" => "OrderedCollectionPage",
       "partOf" => iri,
-      "totalItems" => -1,
       "orderedItems" => collection,
       "next" => "#{iri}?max_id=#{min_id}"
     }
@@ -216,7 +256,6 @@ defmodule Pleroma.Web.ActivityPub.UserView do
       %{
         "id" => iri,
         "type" => "OrderedCollection",
-        "totalItems" => -1,
         "first" => page
       }
       |> Map.merge(Utils.make_json_ld_header())
diff --git a/lib/pleroma/web/mastodon_api/views/status_view.ex b/lib/pleroma/web/mastodon_api/views/status_view.ex
index 69f5f992c..a49b381c9 100644
--- a/lib/pleroma/web/mastodon_api/views/status_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/status_view.ex
@@ -166,7 +166,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
       sensitive: sensitive,
       spoiler_text: object["summary"] || "",
       visibility: get_visibility(object),
-      media_attachments: attachments |> Enum.take(4),
+      media_attachments: attachments,
       mentions: mentions,
       tags: build_tags(tags),
       application: %{
diff --git a/lib/pleroma/web/media_proxy/media_proxy.ex b/lib/pleroma/web/media_proxy/media_proxy.ex
index 1e9da7283..39a725a69 100644
--- a/lib/pleroma/web/media_proxy/media_proxy.ex
+++ b/lib/pleroma/web/media_proxy/media_proxy.ex
@@ -19,11 +19,16 @@ defmodule Pleroma.Web.MediaProxy do
     else
       secret = Application.get_env(:pleroma, Pleroma.Web.Endpoint)[:secret_key_base]
 
+      # Must preserve `%2F` for compatibility with S3 (https://git.pleroma.social/pleroma/pleroma/issues/580)
+      replacement = get_replacement(url, ":2F:")
+
       # The URL is url-decoded and encoded again to ensure it is correctly encoded and not twice.
       base64 =
         url
+        |> String.replace("%2F", replacement)
         |> URI.decode()
         |> URI.encode()
+        |> String.replace(replacement, "%2F")
         |> Base.url_encode64(@base64_opts)
 
       sig = :crypto.hmac(:sha, secret, base64)
@@ -60,4 +65,12 @@ defmodule Pleroma.Web.MediaProxy do
     |> Enum.filter(fn value -> value end)
     |> Path.join()
   end
+
+  defp get_replacement(url, replacement) do
+    if String.contains?(url, replacement) do
+      get_replacement(url, replacement <> replacement)
+    else
+      replacement
+    end
+  end
 end
diff --git a/lib/pleroma/web/oauth/app.ex b/lib/pleroma/web/oauth/app.ex
index 3e8acde31..8b61bf3a4 100644
--- a/lib/pleroma/web/oauth/app.ex
+++ b/lib/pleroma/web/oauth/app.ex
@@ -25,8 +25,14 @@ defmodule Pleroma.Web.OAuth.App do
 
     if changeset.valid? do
       changeset
-      |> put_change(:client_id, :crypto.strong_rand_bytes(32) |> Base.url_encode64())
-      |> put_change(:client_secret, :crypto.strong_rand_bytes(32) |> Base.url_encode64())
+      |> put_change(
+        :client_id,
+        :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
+      )
+      |> put_change(
+        :client_secret,
+        :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
+      )
     else
       changeset
     end
diff --git a/lib/pleroma/web/oauth/authorization.ex b/lib/pleroma/web/oauth/authorization.ex
index 75c9ab9aa..9039b8b45 100644
--- a/lib/pleroma/web/oauth/authorization.ex
+++ b/lib/pleroma/web/oauth/authorization.ex
@@ -24,7 +24,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
   end
 
   def create_authorization(%App{} = app, %User{} = user) do
-    token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
+    token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
 
     authorization = %Authorization{
       token: token,
diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index e4d0601f8..dddfcf299 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -173,7 +173,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
     token
     |> URI.decode()
     |> Base.url_decode64!(padding: false)
-    |> Base.url_encode64()
+    |> Base.url_encode64(padding: false)
   end
 
   defp get_app_from_request(conn, params) do
diff --git a/lib/pleroma/web/oauth/token.ex b/lib/pleroma/web/oauth/token.ex
index b0bbeeb69..ca9e718ac 100644
--- a/lib/pleroma/web/oauth/token.ex
+++ b/lib/pleroma/web/oauth/token.ex
@@ -31,8 +31,8 @@ defmodule Pleroma.Web.OAuth.Token do
   end
 
   def create_token(%App{} = app, %User{} = user) do
-    token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
-    refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
+    token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
+    refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
 
     token = %Token{
       token: token,
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 5b5627ce8..d66a1c2a1 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -468,8 +468,8 @@ defmodule Pleroma.Web.Router do
 
   scope "/", Pleroma.Web.ActivityPub do
     pipe_through(:activitypub)
-    post("/users/:nickname/inbox", ActivityPubController, :inbox)
     post("/inbox", ActivityPubController, :inbox)
+    post("/users/:nickname/inbox", ActivityPubController, :inbox)
   end
 
   scope "/.well-known", Pleroma.Web do
diff --git a/lib/pleroma/web/templates/layout/app.html.eex b/lib/pleroma/web/templates/layout/app.html.eex
index 8dd3284d6..520e4b3d5 100644
--- a/lib/pleroma/web/templates/layout/app.html.eex
+++ b/lib/pleroma/web/templates/layout/app.html.eex
@@ -67,6 +67,32 @@
         font-weight: 500;
         font-size: 16px;
       }
+
+      .alert-danger {
+        box-sizing: border-box;
+        width: 100%;
+        color: #D8000C;
+        background-color: #FFD2D2;
+        border-radius: 4px;
+        border: none;
+        padding: 10px;
+        margin-top: 20px;
+        font-weight: 500;
+        font-size: 16px;
+      }
+
+      .alert-info {
+        box-sizing: border-box;
+        width: 100%;
+        color: #00529B;
+        background-color: #BDE5F8;
+        border-radius: 4px;
+        border: none;
+        padding: 10px;
+        margin-top: 20px;
+        font-weight: 500;
+        font-size: 16px;
+      }
     </style>
   </head>
   <body>
diff --git a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
index de2241ec9..32c458f0c 100644
--- a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
+++ b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
@@ -1,5 +1,9 @@
+<%= if get_flash(@conn, :info) do %>
 <p class="alert alert-info" role="alert"><%= get_flash(@conn, :info) %></p>
+<% end %>
+<%= if get_flash(@conn, :error) do %>
 <p class="alert alert-danger" role="alert"><%= get_flash(@conn, :error) %></p>
+<% end %>
 <h2>OAuth Authorization</h2>
 <%= form_for @conn, o_auth_path(@conn, :authorize), [as: "authorization"], fn f -> %>
 <%= label f, :name, "Name or email" %>