aboutsummaryrefslogtreecommitdiff
path: root/lib/pleroma/web
diff options
context:
space:
mode:
Diffstat (limited to 'lib/pleroma/web')
-rw-r--r--lib/pleroma/web/activity_pub/activity_pub.ex49
-rw-r--r--lib/pleroma/web/activity_pub/publisher.ex55
-rw-r--r--lib/pleroma/web/activity_pub/utils.ex1
-rw-r--r--lib/pleroma/web/activity_pub/views/user_view.ex2
-rw-r--r--lib/pleroma/web/admin_api/admin_api_controller.ex70
-rw-r--r--lib/pleroma/web/admin_api/views/report_view.ex25
-rw-r--r--lib/pleroma/web/admin_api/views/status_view.ex42
-rw-r--r--lib/pleroma/web/mastodon_api/controllers/account_controller.ex1
-rw-r--r--lib/pleroma/web/mastodon_api/controllers/status_controller.ex12
-rw-r--r--lib/pleroma/web/mastodon_api/views/account_view.ex5
-rw-r--r--lib/pleroma/web/oauth/oauth_controller.ex10
-rw-r--r--lib/pleroma/web/oauth/scopes.ex36
-rw-r--r--lib/pleroma/web/pleroma_api/controllers/emoji_api_controller.ex2
-rw-r--r--lib/pleroma/web/router.ex6
14 files changed, 236 insertions, 80 deletions
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 1e2cc2e2b..16e6b0057 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -950,6 +950,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
blocked_ap_ids = opts["blocked_users_ap_ids"] || User.blocked_users_ap_ids(user)
domain_blocks = user.domain_blocks || []
+ following_ap_ids = User.get_friends_ap_ids(user)
+
query =
if has_named_binding?(query, :object), do: query, else: Activity.with_joined_object(query)
@@ -964,8 +966,22 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
activity.data,
^blocked_ap_ids
),
- where: fragment("not (split_part(?, '/', 3) = ANY(?))", activity.actor, ^domain_blocks),
- where: fragment("not (split_part(?->>'actor', '/', 3) = ANY(?))", o.data, ^domain_blocks)
+ where:
+ fragment(
+ "(not (split_part(?, '/', 3) = ANY(?))) or ? = ANY(?)",
+ activity.actor,
+ ^domain_blocks,
+ activity.actor,
+ ^following_ap_ids
+ ),
+ where:
+ fragment(
+ "(not (split_part(?->>'actor', '/', 3) = ANY(?))) or (?->>'actor') = ANY(?)",
+ o.data,
+ ^domain_blocks,
+ o.data,
+ ^following_ap_ids
+ )
)
end
@@ -1052,6 +1068,13 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
|> Activity.with_preloaded_bookmark(opts["user"])
end
+ defp maybe_preload_report_notes(query, %{"preload_report_notes" => true}) do
+ query
+ |> Activity.with_preloaded_report_notes()
+ end
+
+ defp maybe_preload_report_notes(query, _), do: query
+
defp maybe_set_thread_muted_field(query, %{"skip_preload" => true}), do: query
defp maybe_set_thread_muted_field(query, opts) do
@@ -1105,6 +1128,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
Activity
|> maybe_preload_objects(opts)
|> maybe_preload_bookmarks(opts)
+ |> maybe_preload_report_notes(opts)
|> maybe_set_thread_muted_field(opts)
|> maybe_order(opts)
|> restrict_recipients(recipients, opts["user"])
@@ -1141,6 +1165,25 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
|> maybe_update_cc(list_memberships, opts["user"])
end
+ @doc """
+ Fetch favorites activities of user with order by sort adds to favorites
+ """
+ @spec fetch_favourites(User.t(), map(), atom()) :: list(Activity.t())
+ def fetch_favourites(user, params \\ %{}, pagination \\ :keyset) do
+ user.ap_id
+ |> Activity.Queries.by_actor()
+ |> Activity.Queries.by_type("Like")
+ |> Activity.with_joined_object()
+ |> Object.with_joined_activity()
+ |> select([_like, object, activity], %{activity | object: object})
+ |> order_by([like, _, _], desc: like.id)
+ |> Pagination.fetch_paginated(
+ Map.merge(params, %{"skip_order" => true}),
+ pagination,
+ :object_activity
+ )
+ end
+
defp maybe_update_cc(activities, list_memberships, %User{ap_id: user_ap_id})
when is_list(list_memberships) and length(list_memberships) > 0 do
Enum.map(activities, fn
@@ -1217,6 +1260,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
data = Transmogrifier.maybe_fix_user_object(data)
discoverable = data["discoverable"] || false
invisible = data["invisible"] || false
+ actor_type = data["type"] || "Person"
user_data = %{
ap_id: data["id"],
@@ -1232,6 +1276,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
follower_address: data["followers"],
following_address: data["following"],
bio: data["summary"],
+ actor_type: actor_type,
also_known_as: Map.get(data, "alsoKnownAs", [])
}
diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex
index 4ea37fc7b..4073d3d63 100644
--- a/lib/pleroma/web/activity_pub/publisher.ex
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@@ -9,6 +9,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
alias Pleroma.HTTP
alias Pleroma.Instances
alias Pleroma.Object
+ alias Pleroma.Repo
alias Pleroma.User
alias Pleroma.Web.ActivityPub.Relay
alias Pleroma.Web.ActivityPub.Transmogrifier
@@ -188,31 +189,35 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
recipients = recipients(actor, activity)
- recipients
- |> Enum.filter(&User.ap_enabled?/1)
- |> Enum.map(fn %{source_data: data} -> data["inbox"] end)
- |> Enum.filter(fn inbox -> should_federate?(inbox, public) end)
- |> Instances.filter_reachable()
- |> Enum.each(fn {inbox, unreachable_since} ->
- %User{ap_id: ap_id} =
- Enum.find(recipients, fn %{source_data: data} -> data["inbox"] == inbox end)
-
- # Get all the recipients on the same host and add them to cc. Otherwise, a remote
- # instance would only accept a first message for the first recipient and ignore the rest.
- cc = get_cc_ap_ids(ap_id, recipients)
-
- json =
- data
- |> Map.put("cc", cc)
- |> Jason.encode!()
-
- Pleroma.Web.Federator.Publisher.enqueue_one(__MODULE__, %{
- inbox: inbox,
- json: json,
- actor_id: actor.id,
- id: activity.data["id"],
- unreachable_since: unreachable_since
- })
+ inboxes =
+ recipients
+ |> Enum.filter(&User.ap_enabled?/1)
+ |> Enum.map(fn %{source_data: data} -> data["inbox"] end)
+ |> Enum.filter(fn inbox -> should_federate?(inbox, public) end)
+ |> Instances.filter_reachable()
+
+ Repo.checkout(fn ->
+ Enum.each(inboxes, fn {inbox, unreachable_since} ->
+ %User{ap_id: ap_id} =
+ Enum.find(recipients, fn %{source_data: data} -> data["inbox"] == inbox end)
+
+ # Get all the recipients on the same host and add them to cc. Otherwise, a remote
+ # instance would only accept a first message for the first recipient and ignore the rest.
+ cc = get_cc_ap_ids(ap_id, recipients)
+
+ json =
+ data
+ |> Map.put("cc", cc)
+ |> Jason.encode!()
+
+ Pleroma.Web.Federator.Publisher.enqueue_one(__MODULE__, %{
+ inbox: inbox,
+ json: json,
+ actor_id: actor.id,
+ id: activity.data["id"],
+ unreachable_since: unreachable_since
+ })
+ end)
end)
end
diff --git a/lib/pleroma/web/activity_pub/utils.ex b/lib/pleroma/web/activity_pub/utils.ex
index 2ca805c09..e87d09134 100644
--- a/lib/pleroma/web/activity_pub/utils.ex
+++ b/lib/pleroma/web/activity_pub/utils.ex
@@ -787,6 +787,7 @@ defmodule Pleroma.Web.ActivityPub.Utils do
params
|> Map.put("type", "Flag")
|> Map.put("skip_preload", true)
+ |> Map.put("preload_report_notes", true)
|> Map.put("total", true)
|> Map.put("limit", page_size)
|> Map.put("offset", (page - 1) * page_size)
diff --git a/lib/pleroma/web/activity_pub/views/user_view.ex b/lib/pleroma/web/activity_pub/views/user_view.ex
index cf08045c9..9059aa634 100644
--- a/lib/pleroma/web/activity_pub/views/user_view.ex
+++ b/lib/pleroma/web/activity_pub/views/user_view.ex
@@ -91,7 +91,7 @@ defmodule Pleroma.Web.ActivityPub.UserView do
%{
"id" => user.ap_id,
- "type" => "Person",
+ "type" => user.actor_type,
"following" => "#{user.ap_id}/following",
"followers" => "#{user.ap_id}/followers",
"inbox" => "#{user.ap_id}/inbox",
diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex
index b003d1f35..c8abeff06 100644
--- a/lib/pleroma/web/admin_api/admin_api_controller.ex
+++ b/lib/pleroma/web/admin_api/admin_api_controller.ex
@@ -7,6 +7,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
alias Pleroma.Activity
alias Pleroma.ModerationLog
alias Pleroma.Plugs.OAuthScopesPlug
+ alias Pleroma.ReportNote
alias Pleroma.User
alias Pleroma.UserInviteToken
alias Pleroma.Web.ActivityPub.ActivityPub
@@ -30,13 +31,13 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
plug(
OAuthScopesPlug,
- %{scopes: ["read:accounts"]}
+ %{scopes: ["read:accounts"], admin: true}
when action in [:list_users, :user_show, :right_get, :invites]
)
plug(
OAuthScopesPlug,
- %{scopes: ["write:accounts"]}
+ %{scopes: ["write:accounts"], admin: true}
when action in [
:get_invite_token,
:revoke_invite,
@@ -58,35 +59,37 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
plug(
OAuthScopesPlug,
- %{scopes: ["read:reports"]} when action in [:list_reports, :report_show]
+ %{scopes: ["read:reports"], admin: true}
+ when action in [:list_reports, :report_show]
)
plug(
OAuthScopesPlug,
- %{scopes: ["write:reports"]}
+ %{scopes: ["write:reports"], admin: true}
when action in [:report_update_state, :report_respond]
)
plug(
OAuthScopesPlug,
- %{scopes: ["read:statuses"]} when action == :list_user_statuses
+ %{scopes: ["read:statuses"], admin: true}
+ when action == :list_user_statuses
)
plug(
OAuthScopesPlug,
- %{scopes: ["write:statuses"]}
+ %{scopes: ["write:statuses"], admin: true}
when action in [:status_update, :status_delete]
)
plug(
OAuthScopesPlug,
- %{scopes: ["read"]}
+ %{scopes: ["read"], admin: true}
when action in [:config_show, :migrate_to_db, :migrate_from_db, :list_log]
)
plug(
OAuthScopesPlug,
- %{scopes: ["write"]}
+ %{scopes: ["write"], admin: true}
when action in [:relay_follow, :relay_unfollow, :config_update]
)
@@ -238,7 +241,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
})
conn
- |> put_view(StatusView)
+ |> put_view(Pleroma.Web.AdminAPI.StatusView)
|> render("index.json", %{activities: activities, as: :activity})
end
@@ -641,9 +644,11 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
def list_reports(conn, params) do
{page, page_size} = page_params(params)
+ reports = Utils.get_reports(params, page, page_size)
+
conn
|> put_view(ReportView)
- |> render("index.json", %{reports: Utils.get_reports(params, page, page_size)})
+ |> render("index.json", %{reports: reports})
end
def list_grouped_reports(conn, _params) do
@@ -687,32 +692,39 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
end
end
- def report_respond(%{assigns: %{user: user}} = conn, %{"id" => id} = params) do
- with false <- is_nil(params["status"]),
- %Activity{} <- Activity.get_by_id(id) do
- params =
- params
- |> Map.put("in_reply_to_status_id", id)
- |> Map.put("visibility", "direct")
+ def report_notes_create(%{assigns: %{user: user}} = conn, %{
+ "id" => report_id,
+ "content" => content
+ }) do
+ with {:ok, _} <- ReportNote.create(user.id, report_id, content) do
+ ModerationLog.insert_log(%{
+ action: "report_note",
+ actor: user,
+ subject: Activity.get_by_id(report_id),
+ text: content
+ })
- {:ok, activity} = CommonAPI.post(user, params)
+ json_response(conn, :no_content, "")
+ else
+ _ -> json_response(conn, :bad_request, "")
+ end
+ end
+ def report_notes_delete(%{assigns: %{user: user}} = conn, %{
+ "id" => note_id,
+ "report_id" => report_id
+ }) do
+ with {:ok, note} <- ReportNote.destroy(note_id) do
ModerationLog.insert_log(%{
- action: "report_response",
+ action: "report_note_delete",
actor: user,
- subject: activity,
- text: params["status"]
+ subject: Activity.get_by_id(report_id),
+ text: note.content
})
- conn
- |> put_view(StatusView)
- |> render("show.json", %{activity: activity})
+ json_response(conn, :no_content, "")
else
- true ->
- {:param_cast, nil}
-
- nil ->
- {:error, :not_found}
+ _ -> json_response(conn, :bad_request, "")
end
end
diff --git a/lib/pleroma/web/admin_api/views/report_view.ex b/lib/pleroma/web/admin_api/views/report_view.ex
index 13602efd9..4880d2992 100644
--- a/lib/pleroma/web/admin_api/views/report_view.ex
+++ b/lib/pleroma/web/admin_api/views/report_view.ex
@@ -39,7 +39,8 @@ defmodule Pleroma.Web.AdminAPI.ReportView do
content: content,
created_at: created_at,
statuses: StatusView.render("index.json", %{activities: statuses, as: :activity}),
- state: report.data["state"]
+ state: report.data["state"],
+ notes: render(__MODULE__, "index_notes.json", %{notes: report.report_notes})
}
end
@@ -69,6 +70,28 @@ defmodule Pleroma.Web.AdminAPI.ReportView do
}
end
+ def render("index_notes.json", %{notes: notes}) when is_list(notes) do
+ Enum.map(notes, &render(__MODULE__, "show_note.json", &1))
+ end
+
+ def render("index_notes.json", _), do: []
+
+ def render("show_note.json", %{
+ id: id,
+ content: content,
+ user_id: user_id,
+ inserted_at: inserted_at
+ }) do
+ user = User.get_by_id(user_id)
+
+ %{
+ id: id,
+ content: content,
+ user: merge_account_views(user),
+ created_at: Utils.to_masto_date(inserted_at)
+ }
+ end
+
defp merge_account_views(%User{} = user) do
Pleroma.Web.MastodonAPI.AccountView.render("show.json", %{user: user})
|> Map.merge(Pleroma.Web.AdminAPI.AccountView.render("show.json", %{user: user}))
diff --git a/lib/pleroma/web/admin_api/views/status_view.ex b/lib/pleroma/web/admin_api/views/status_view.ex
new file mode 100644
index 000000000..6f2b2b09c
--- /dev/null
+++ b/lib/pleroma/web/admin_api/views/status_view.ex
@@ -0,0 +1,42 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.AdminAPI.StatusView do
+ use Pleroma.Web, :view
+
+ require Pleroma.Constants
+
+ alias Pleroma.User
+
+ def render("index.json", opts) do
+ render_many(opts.activities, __MODULE__, "show.json", opts)
+ end
+
+ def render("show.json", %{activity: %{data: %{"object" => _object}} = activity} = opts) do
+ user = get_user(activity.data["actor"])
+
+ Pleroma.Web.MastodonAPI.StatusView.render("show.json", opts)
+ |> Map.merge(%{account: merge_account_views(user)})
+ end
+
+ defp merge_account_views(%User{} = user) do
+ Pleroma.Web.MastodonAPI.AccountView.render("show.json", %{user: user})
+ |> Map.merge(Pleroma.Web.AdminAPI.AccountView.render("show.json", %{user: user}))
+ end
+
+ defp merge_account_views(_), do: %{}
+
+ defp get_user(ap_id) do
+ cond do
+ user = User.get_cached_by_ap_id(ap_id) ->
+ user
+
+ user = User.get_by_guessed_nickname(ap_id) ->
+ user
+
+ true ->
+ User.error_user(ap_id)
+ end
+ end
+end
diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
index d19029cb5..38d14256f 100644
--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
@@ -188,6 +188,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
{:ok, Map.merge(user.pleroma_settings_store, value)}
end)
|> add_if_present(params, "default_scope", :default_scope)
+ |> add_if_present(params, "actor_type", :actor_type)
emojis_text = (user_params["display_name"] || "") <> (user_params["note"] || "")
diff --git a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
index d70749dfa..287d1631c 100644
--- a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
@@ -349,15 +349,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
@doc "GET /api/v1/favourites"
def favourites(%{assigns: %{user: user}} = conn, params) do
- params =
- params
- |> Map.put("type", "Create")
- |> Map.put("favorited_by", user.ap_id)
- |> Map.put("blocking_user", user)
-
activities =
- ActivityPub.fetch_activities([], params)
- |> Enum.reverse()
+ ActivityPub.fetch_favourites(
+ user,
+ Map.take(params, Pleroma.Pagination.page_keys())
+ )
conn
|> add_link_headers(activities)
diff --git a/lib/pleroma/web/mastodon_api/views/account_view.ex b/lib/pleroma/web/mastodon_api/views/account_view.ex
index 546cc0ed5..a5420f480 100644
--- a/lib/pleroma/web/mastodon_api/views/account_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/account_view.ex
@@ -86,7 +86,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
0
end
- bot = (user.source_data["type"] || "Person") in ["Application", "Service"]
+ bot = user.actor_type in ["Application", "Service"]
emojis =
(user.source_data["tag"] || [])
@@ -137,7 +137,8 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
sensitive: false,
fields: user.raw_fields,
pleroma: %{
- discoverable: user.discoverable
+ discoverable: user.discoverable,
+ actor_type: user.actor_type
}
},
diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index 2aee8cab2..87acdec97 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -222,7 +222,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
{:user_active, true} <- {:user_active, !user.deactivated},
{:password_reset_pending, false} <-
{:password_reset_pending, user.password_reset_pending},
- {:ok, scopes} <- validate_scopes(app, params),
+ {:ok, scopes} <- validate_scopes(app, params, user),
{:ok, auth} <- Authorization.create_authorization(app, user, scopes),
{:ok, token} <- Token.exchange_token(app, auth) do
json(conn, Token.Response.build(user, token))
@@ -471,7 +471,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
{:get_user, (user && {:ok, user}) || Authenticator.get_user(conn)},
%App{} = app <- Repo.get_by(App, client_id: client_id),
true <- redirect_uri in String.split(app.redirect_uris),
- {:ok, scopes} <- validate_scopes(app, auth_attrs),
+ {:ok, scopes} <- validate_scopes(app, auth_attrs, user),
{:auth_active, true} <- {:auth_active, User.auth_active?(user)} do
Authorization.create_authorization(app, user, scopes)
end
@@ -487,12 +487,12 @@ defmodule Pleroma.Web.OAuth.OAuthController do
defp put_session_registration_id(%Plug.Conn{} = conn, registration_id),
do: put_session(conn, :registration_id, registration_id)
- @spec validate_scopes(App.t(), map()) ::
+ @spec validate_scopes(App.t(), map(), User.t()) ::
{:ok, list()} | {:error, :missing_scopes | :unsupported_scopes}
- defp validate_scopes(app, params) do
+ defp validate_scopes(%App{} = app, params, %User{} = user) do
params
|> Scopes.fetch_scopes(app.scopes)
- |> Scopes.validate(app.scopes)
+ |> Scopes.validate(app.scopes, user)
end
def default_redirect_uri(%App{} = app) do
diff --git a/lib/pleroma/web/oauth/scopes.ex b/lib/pleroma/web/oauth/scopes.ex
index 48bd14407..00da225b9 100644
--- a/lib/pleroma/web/oauth/scopes.ex
+++ b/lib/pleroma/web/oauth/scopes.ex
@@ -7,6 +7,9 @@ defmodule Pleroma.Web.OAuth.Scopes do
Functions for dealing with scopes.
"""
+ alias Pleroma.Plugs.OAuthScopesPlug
+ alias Pleroma.User
+
@doc """
Fetch scopes from request params.
@@ -53,15 +56,38 @@ defmodule Pleroma.Web.OAuth.Scopes do
@doc """
Validates scopes.
"""
- @spec validate(list() | nil, list()) ::
+ @spec validate(list() | nil, list(), User.t()) ::
{:ok, list()} | {:error, :missing_scopes | :unsupported_scopes}
- def validate([], _app_scopes), do: {:error, :missing_scopes}
- def validate(nil, _app_scopes), do: {:error, :missing_scopes}
+ def validate(blank_scopes, _app_scopes, _user) when blank_scopes in [nil, []],
+ do: {:error, :missing_scopes}
- def validate(scopes, app_scopes) do
- case Pleroma.Plugs.OAuthScopesPlug.filter_descendants(scopes, app_scopes) do
+ def validate(scopes, app_scopes, %User{} = user) do
+ with {:ok, _} <- ensure_scopes_support(scopes, app_scopes),
+ {:ok, scopes} <- authorize_admin_scopes(scopes, app_scopes, user) do
+ {:ok, scopes}
+ end
+ end
+
+ defp ensure_scopes_support(scopes, app_scopes) do
+ case OAuthScopesPlug.filter_descendants(scopes, app_scopes) do
^scopes -> {:ok, scopes}
_ -> {:error, :unsupported_scopes}
end
end
+
+ defp authorize_admin_scopes(scopes, app_scopes, %User{} = user) do
+ if user.is_admin || !contains_admin_scopes?(scopes) || !contains_admin_scopes?(app_scopes) do
+ {:ok, scopes}
+ else
+ # Gracefully dropping admin scopes from requested scopes if user isn't an admin (not raising)
+ scopes = scopes -- OAuthScopesPlug.filter_descendants(scopes, ["admin"])
+ validate(scopes, app_scopes, user)
+ end
+ end
+
+ def contains_admin_scopes?(scopes) do
+ scopes
+ |> OAuthScopesPlug.filter_descendants(["admin"])
+ |> Enum.any?()
+ end
end
diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_api_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_api_controller.ex
index a474d41d4..69dfa92e3 100644
--- a/lib/pleroma/web/pleroma_api/controllers/emoji_api_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_api_controller.ex
@@ -7,7 +7,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiAPIController do
plug(
OAuthScopesPlug,
- %{scopes: ["write"]}
+ %{scopes: ["write"], admin: true}
when action in [
:create,
:delete,
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index e6c4f6f14..f6c128283 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -187,7 +187,8 @@ defmodule Pleroma.Web.Router do
get("/grouped_reports", AdminAPIController, :list_grouped_reports)
get("/reports/:id", AdminAPIController, :report_show)
patch("/reports", AdminAPIController, :reports_update)
- post("/reports/:id/respond", AdminAPIController, :report_respond)
+ post("/reports/:id/notes", AdminAPIController, :report_notes_create)
+ delete("/reports/:report_id/notes/:id", AdminAPIController, :report_notes_delete)
put("/statuses/:id", AdminAPIController, :status_update)
delete("/statuses/:id", AdminAPIController, :status_delete)
@@ -528,7 +529,10 @@ defmodule Pleroma.Web.Router do
get("/users/:nickname/feed", Feed.FeedController, :feed)
get("/users/:nickname", Feed.FeedController, :feed_redirect)
+ end
+ scope "/", Pleroma.Web do
+ pipe_through(:browser)
get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)
end
generated by cgit v1.2.3 (git 2.26.2) at 2025-04-25 20:13:38 +0000