From eb84de01439c4ee25f59390e5be4ffa7f36e01b8 Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Mon, 4 Mar 2019 19:55:11 +0700
Subject: allow users to disable their own account

---
 config/config.exs                                  |  3 +-
 lib/mix/tasks/pleroma/user.ex                      | 20 ++++++-
 lib/pleroma/activity.ex                            | 16 +++++-
 lib/pleroma/gopher/server.ex                       |  3 +-
 lib/pleroma/notification.ex                        | 32 +++++------
 lib/pleroma/user.ex                                | 64 +++++++++++++++++-----
 lib/pleroma/user/info.ex                           |  9 +++
 lib/pleroma/web/activity_pub/activity_pub.ex       |  1 +
 lib/pleroma/web/admin_api/admin_api_controller.ex  | 10 ++++
 lib/pleroma/web/common_api/utils.ex                |  4 +-
 .../web/mastodon_api/mastodon_api_controller.ex    | 12 ++--
 lib/pleroma/web/router.ex                          |  2 +
 .../web/twitter_api/controllers/util_controller.ex | 11 ++++
 lib/pleroma/web/twitter_api/twitter_api.ex         | 20 ++++---
 .../web/twitter_api/twitter_api_controller.ex      |  4 +-
 .../20190228121252_users_add_disabled_index.exs    |  7 +++
 16 files changed, 167 insertions(+), 51 deletions(-)
 create mode 100644 priv/repo/migrations/20190228121252_users_add_disabled_index.exs

diff --git a/config/config.exs b/config/config.exs
index a620e7451..d9ed43dda 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -343,7 +343,8 @@ config :pleroma, Pleroma.Web.Federator.RetryQueue,
 config :pleroma, Pleroma.Jobs,
   federator_incoming: [max_jobs: 50],
   federator_outgoing: [max_jobs: 50],
-  mailer: [max_jobs: 10]
+  mailer: [max_jobs: 10],
+  user: [max_jobs: 10]
 
 config :auto_linker,
   opts: [
diff --git a/lib/mix/tasks/pleroma/user.ex b/lib/mix/tasks/pleroma/user.ex
index 037e44716..297332bc4 100644
--- a/lib/mix/tasks/pleroma/user.ex
+++ b/lib/mix/tasks/pleroma/user.ex
@@ -23,7 +23,7 @@ defmodule Mix.Tasks.Pleroma.User do
   - `--password PASSWORD` - the user's password
   - `--moderator`/`--no-moderator` - whether the user is a moderator
   - `--admin`/`--no-admin` - whether the user is an admin
-  - `-y`, `--assume-yes`/`--no-assume-yes` - whether to assume yes to all questions 
+  - `-y`, `--assume-yes`/`--no-assume-yes` - whether to assume yes to all questions
 
   ## Generate an invite link.
 
@@ -37,6 +37,10 @@ defmodule Mix.Tasks.Pleroma.User do
 
       mix pleroma.user toggle_activated NICKNAME
 
+  ## Disable or enable the user's account.
+
+      mix pleroma.user toggle_disabled NICKNAME
+
   ## Unsubscribe local users from user's account and deactivate it
 
       mix pleroma.user unsubscribe NICKNAME
@@ -170,6 +174,20 @@ defmodule Mix.Tasks.Pleroma.User do
     end
   end
 
+  def run(["toggle_disabled", nickname]) do
+    Common.start_pleroma()
+
+    case User.get_by_nickname(nickname) do
+      %User{} = user ->
+        {:ok, user} = User.disable(user, !user.info.disabled)
+        status = if(user.info.disabled, do: "ON", else: "OFF")
+        Mix.shell().info("Disabled status of #{nickname}: #{status}")
+
+      _ ->
+        Mix.shell().error("No user #{nickname}")
+    end
+  end
+
   def run(["reset_password", nickname]) do
     Common.start_pleroma()
 
diff --git a/lib/pleroma/activity.ex b/lib/pleroma/activity.ex
index 66854dc2d..c466bff7f 100644
--- a/lib/pleroma/activity.ex
+++ b/lib/pleroma/activity.ex
@@ -42,7 +42,10 @@ defmodule Pleroma.Activity do
   end
 
   def get_by_id(id) do
-    Repo.get(Activity, id)
+    Activity
+    |> where([a], a.id == ^id)
+    |> restrict_disabled_users()
+    |> Repo.one()
   end
 
   def by_object_ap_id(ap_id) do
@@ -92,6 +95,7 @@ defmodule Pleroma.Activity do
 
   def get_create_by_object_ap_id(ap_id) when is_binary(ap_id) do
     create_by_object_ap_id(ap_id)
+    |> restrict_disabled_users()
     |> Repo.one()
   end
 
@@ -123,4 +127,14 @@ defmodule Pleroma.Activity do
     |> where([s], s.actor == ^actor)
     |> Repo.all()
   end
+
+  def restrict_disabled_users(query) do
+    from(activity in query,
+      where:
+        fragment(
+          "? not in (SELECT ap_id FROM users WHERE info->'disabled' @> 'true')",
+          activity.actor
+        )
+    )
+  end
 end
diff --git a/lib/pleroma/gopher/server.ex b/lib/pleroma/gopher/server.ex
index ba9614029..24190574e 100644
--- a/lib/pleroma/gopher/server.ex
+++ b/lib/pleroma/gopher/server.ex
@@ -41,7 +41,6 @@ defmodule Pleroma.Gopher.Server.ProtocolHandler do
   alias Pleroma.Activity
   alias Pleroma.HTML
   alias Pleroma.User
-  alias Pleroma.Repo
 
   def start_link(ref, socket, transport, opts) do
     pid = spawn_link(__MODULE__, :init, [ref, socket, transport, opts])
@@ -110,7 +109,7 @@ defmodule Pleroma.Gopher.Server.ProtocolHandler do
   end
 
   def response("/notices/" <> id) do
-    with %Activity{} = activity <- Repo.get(Activity, id),
+    with %Activity{} = activity <- Activity.get_by_id(id),
          true <- Visibility.is_public?(activity) do
       activities =
         ActivityPub.fetch_activities_for_context(activity.data["context"])
diff --git a/lib/pleroma/notification.ex b/lib/pleroma/notification.ex
index c88512567..0f9f74b1e 100644
--- a/lib/pleroma/notification.ex
+++ b/lib/pleroma/notification.ex
@@ -36,22 +36,22 @@ defmodule Pleroma.Notification do
   defp restrict_since(query, _), do: query
 
   def for_user(user, opts \\ %{}) do
-    query =
-      from(
-        n in Notification,
-        where: n.user_id == ^user.id,
-        order_by: [desc: n.id],
-        join: activity in assoc(n, :activity),
-        preload: [activity: activity],
-        limit: 20
-      )
-
-    query =
-      query
-      |> restrict_since(opts)
-      |> restrict_max(opts)
-
-    Repo.all(query)
+    from(
+      n in Notification,
+      where: n.user_id == ^user.id,
+      order_by: [desc: n.id],
+      join: activity in assoc(n, :activity),
+      preload: [activity: activity],
+      limit: 20,
+      where:
+        fragment(
+          "? not in (SELECT ap_id FROM users WHERE info->'disabled' @> 'true')",
+          activity.actor
+        )
+    )
+    |> restrict_since(opts)
+    |> restrict_max(opts)
+    |> Repo.all()
   end
 
   def set_read_up_to(%{id: user_id} = _user, id) do
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 50e7e7ccd..f02051174 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -108,10 +108,8 @@ defmodule Pleroma.User do
   end
 
   def user_info(%User{} = user) do
-    oneself = if user.local, do: 1, else: 0
-
     %{
-      following_count: length(user.following) - oneself,
+      following_count: following_count(user),
       note_count: user.info.note_count,
       follower_count: user.info.follower_count,
       locked: user.info.locked,
@@ -120,6 +118,23 @@ defmodule Pleroma.User do
     }
   end
 
+  defp restrict_disabled(query) do
+    from(u in query,
+      where: not fragment("? \\? 'disabled' AND ?->'disabled' @> 'true'", u.info, u.info)
+    )
+  end
+
+  def following_count(%User{following: []}), do: 0
+
+  def following_count(%User{following: following, id: id}) do
+    from(u in User,
+      where: u.follower_address in ^following,
+      where: u.id != ^id
+    )
+    |> restrict_disabled()
+    |> Repo.aggregate(:count, :id)
+  end
+
   def remote_user_creation(params) do
     params =
       params
@@ -545,6 +560,7 @@ defmodule Pleroma.User do
       where: fragment("? <@ ?", ^[follower_address], u.following),
       where: u.id != ^id
     )
+    |> restrict_disabled()
   end
 
   def get_followers_query(user, page) do
@@ -572,6 +588,7 @@ defmodule Pleroma.User do
       where: u.follower_address in ^following,
       where: u.id != ^id
     )
+    |> restrict_disabled()
   end
 
   def get_friends_query(user, page) do
@@ -681,11 +698,10 @@ defmodule Pleroma.User do
 
     info_cng = User.Info.set_note_count(user.info, note_count)
 
-    cng =
-      change(user)
-      |> put_embed(:info, info_cng)
-
-    update_and_set_cache(cng)
+    user
+    |> change()
+    |> put_embed(:info, info_cng)
+    |> update_and_set_cache()
   end
 
   def update_follower_count(%User{} = user) do
@@ -694,6 +710,7 @@ defmodule Pleroma.User do
       |> where([u], ^user.follower_address in u.following)
       |> where([u], u.id != ^user.id)
       |> select([u], %{count: count(u.id)})
+      |> restrict_disabled()
 
     User
     |> where(id: ^user.id)
@@ -860,6 +877,7 @@ defmodule Pleroma.User do
           ^processed_query
         )
     )
+    |> restrict_disabled()
   end
 
   defp trigram_search_subquery(term) do
@@ -876,6 +894,7 @@ defmodule Pleroma.User do
       },
       where: fragment("trim(? || ' ' || coalesce(?, '')) % ?", u.nickname, u.name, ^term)
     )
+    |> restrict_disabled()
   end
 
   defp boost_search_results(results, nil), do: results
@@ -1062,11 +1081,10 @@ defmodule Pleroma.User do
   def deactivate(%User{} = user, status \\ true) do
     info_cng = User.Info.set_activation_status(user.info, status)
 
-    cng =
-      change(user)
-      |> put_embed(:info, info_cng)
-
-    update_and_set_cache(cng)
+    user
+    |> change()
+    |> put_embed(:info, info_cng)
+    |> update_and_set_cache()
   end
 
   def delete(%User{} = user) do
@@ -1100,6 +1118,26 @@ defmodule Pleroma.User do
     {:ok, user}
   end
 
+  def disable_async(user, status \\ true) do
+    Pleroma.Jobs.enqueue(:user, __MODULE__, [:disable_async, user, status])
+  end
+
+  def disable(%User{} = user, status \\ true) do
+    with {:ok, user} <- User.deactivate(user, status),
+         info_cng <- User.Info.set_disabled_status(user.info, status),
+         {:ok, user} <-
+           user
+           |> change()
+           |> put_embed(:info, info_cng)
+           |> update_and_set_cache(),
+         {:ok, friends} <- User.get_friends(user) do
+      Enum.each(friends, &update_follower_count(&1))
+      {:ok, user}
+    end
+  end
+
+  def perform(:disable_async, user, status), do: disable(user, status)
+
   def html_filter_policy(%User{info: %{no_rich_text: true}}) do
     Pleroma.HTML.Scrubber.TwitterText
   end
diff --git a/lib/pleroma/user/info.ex b/lib/pleroma/user/info.ex
index 818b64645..1ec356ba9 100644
--- a/lib/pleroma/user/info.ex
+++ b/lib/pleroma/user/info.ex
@@ -36,6 +36,7 @@ defmodule Pleroma.User.Info do
     field(:hide_follows, :boolean, default: false)
     field(:pinned_activities, {:array, :string}, default: [])
     field(:flavour, :string, default: nil)
+    field(:disabled, :boolean, default: false)
 
     # Found in the wild
     # ap_id -> Where is this used?
@@ -54,6 +55,14 @@ defmodule Pleroma.User.Info do
     |> validate_required([:deactivated])
   end
 
+  def set_disabled_status(info, disabled) do
+    params = %{disabled: disabled}
+
+    info
+    |> cast(params, [:disabled])
+    |> validate_required([:disabled])
+  end
+
   def add_to_note_count(info, number) do
     set_note_count(info, info.note_count + number)
   end
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 783491b67..aa20990f3 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -703,6 +703,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     |> restrict_replies(opts)
     |> restrict_reblogs(opts)
     |> restrict_pinned(opts)
+    |> Activity.restrict_disabled_users()
   end
 
   def fetch_activities(recipients, opts \\ %{}) do
diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex
index aae02cab8..1b94f0609 100644
--- a/lib/pleroma/web/admin_api/admin_api_controller.ex
+++ b/lib/pleroma/web/admin_api/admin_api_controller.ex
@@ -44,6 +44,16 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
     |> json(user.nickname)
   end
 
+  def user_toggle_disabled(conn, %{"nickname" => nickname}) do
+    user = User.get_by_nickname(nickname)
+
+    {:ok, updated_user} = User.disable(user, !user.info.disabled)
+
+    conn
+    |> put_view(AccountView)
+    |> render("show.json", %{user: updated_user})
+  end
+
   def user_toggle_activation(conn, %{"nickname" => nickname}) do
     user = User.get_by_nickname(nickname)
 
diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index e4b9102c5..60d1185d3 100644
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -17,7 +17,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
 
   # This is a hack for twidere.
   def get_by_id_or_ap_id(id) do
-    activity = Repo.get(Activity, id) || Activity.get_create_by_object_ap_id(id)
+    activity = Activity.get_by_id(id) || Activity.get_create_by_object_ap_id(id)
 
     activity &&
       if activity.data["type"] == "Create" do
@@ -30,7 +30,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
   def get_replied_to_activity(""), do: nil
 
   def get_replied_to_activity(id) when not is_nil(id) do
-    Repo.get(Activity, id)
+    Activity.get_by_id(id)
   end
 
   def get_replied_to_activity(_), do: nil
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 056be49b0..00a0f1351 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -307,7 +307,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   end
 
   def get_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
-    with %Activity{} = activity <- Repo.get(Activity, id),
+    with %Activity{} = activity <- Activity.get_by_id(id),
          true <- Visibility.visible_for_user?(activity, user) do
       conn
       |> put_view(StatusView)
@@ -316,7 +316,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   end
 
   def get_context(%{assigns: %{user: user}} = conn, %{"id" => id}) do
-    with %Activity{} = activity <- Repo.get(Activity, id),
+    with %Activity{} = activity <- Activity.get_by_id(id),
          activities <-
            ActivityPub.fetch_activities_for_context(activity.data["context"], %{
              "blocking_user" => user,
@@ -448,7 +448,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   end
 
   def bookmark_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
-    with %Activity{} = activity <- Repo.get(Activity, id),
+    with %Activity{} = activity <- Activity.get_by_id(id),
          %User{} = user <- User.get_by_nickname(user.nickname),
          true <- Visibility.visible_for_user?(activity, user),
          {:ok, user} <- User.bookmark(user, activity.data["object"]["id"]) do
@@ -459,7 +459,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   end
 
   def unbookmark_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
-    with %Activity{} = activity <- Repo.get(Activity, id),
+    with %Activity{} = activity <- Activity.get_by_id(id),
          %User{} = user <- User.get_by_nickname(user.nickname),
          true <- Visibility.visible_for_user?(activity, user),
          {:ok, user} <- User.unbookmark(user, activity.data["object"]["id"]) do
@@ -583,7 +583,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   end
 
   def favourited_by(conn, %{"id" => id}) do
-    with %Activity{data: %{"object" => %{"likes" => likes}}} <- Repo.get(Activity, id) do
+    with %Activity{data: %{"object" => %{"likes" => likes}}} <- Activity.get_by_id(id) do
       q = from(u in User, where: u.ap_id in ^likes)
       users = Repo.all(q)
 
@@ -596,7 +596,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   end
 
   def reblogged_by(conn, %{"id" => id}) do
-    with %Activity{data: %{"object" => %{"announcements" => announces}}} <- Repo.get(Activity, id) do
+    with %Activity{data: %{"object" => %{"announcements" => announces}}} <- Activity.get_by_id(id) do
       q = from(u in User, where: u.ap_id in ^announces)
       users = Repo.all(q)
 
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 6fcb46878..5033b5446 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -143,6 +143,7 @@ defmodule Pleroma.Web.Router do
     get("/users/search", AdminAPIController, :search_users)
     delete("/user", AdminAPIController, :user_delete)
     patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
+    patch("/users/:nickname/toggle_disabled", AdminAPIController, :user_toggle_disabled)
     post("/user", AdminAPIController, :user_create)
     put("/users/tag", AdminAPIController, :tag_users)
     delete("/users/tag", AdminAPIController, :untag_users)
@@ -183,6 +184,7 @@ defmodule Pleroma.Web.Router do
 
       post("/change_password", UtilController, :change_password)
       post("/delete_account", UtilController, :delete_account)
+      post("/disable_account", UtilController, :disable_account)
     end
 
     scope [] do
diff --git a/lib/pleroma/web/twitter_api/controllers/util_controller.ex b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
index e2fdedb25..0006d53e8 100644
--- a/lib/pleroma/web/twitter_api/controllers/util_controller.ex
+++ b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
@@ -311,6 +311,17 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
     end
   end
 
+  def disable_account(%{assigns: %{user: user}} = conn, params) do
+    case CommonAPI.Utils.confirm_current_password(user, params["password"]) do
+      {:ok, user} ->
+        User.disable_async(user)
+        json(conn, %{status: "success"})
+
+      {:error, msg} ->
+        json(conn, %{error: msg})
+    end
+  end
+
   def captcha(conn, _params) do
     json(conn, Pleroma.Captcha.new())
   end
diff --git a/lib/pleroma/web/twitter_api/twitter_api.ex b/lib/pleroma/web/twitter_api/twitter_api.ex
index ab6470d78..615a34be9 100644
--- a/lib/pleroma/web/twitter_api/twitter_api.ex
+++ b/lib/pleroma/web/twitter_api/twitter_api.ex
@@ -21,7 +21,7 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
   end
 
   def delete(%User{} = user, id) do
-    with %Activity{data: %{"type" => _type}} <- Repo.get(Activity, id),
+    with %Activity{data: %{"type" => _type}} <- Activity.get_by_id(id),
          {:ok, activity} <- CommonAPI.delete(id, user) do
       {:ok, activity}
     end
@@ -232,21 +232,27 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
   def get_user(user \\ nil, params) do
     case params do
       %{"user_id" => user_id} ->
-        case target = User.get_cached_by_nickname_or_id(user_id) do
+        case User.get_cached_by_nickname_or_id(user_id) do
           nil ->
             {:error, "No user with such user_id"}
 
-          _ ->
-            {:ok, target}
+          %User{info: %{disabled: true}} ->
+            {:error, "User has been disabled"}
+
+          user ->
+            {:ok, user}
         end
 
       %{"screen_name" => nickname} ->
-        case target = Repo.get_by(User, nickname: nickname) do
+        case User.get_by_nickname(nickname) do
           nil ->
             {:error, "No user with such screen_name"}
 
-          _ ->
-            {:ok, target}
+          %User{info: %{disabled: true}} ->
+            {:error, "User has been disabled"}
+
+          user ->
+            {:ok, user}
         end
 
       _ ->
diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
index de7b9f24c..0769f8698 100644
--- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex
+++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
@@ -269,7 +269,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
   end
 
   def fetch_status(%{assigns: %{user: user}} = conn, %{"id" => id}) do
-    with %Activity{} = activity <- Repo.get(Activity, id),
+    with %Activity{} = activity <- Activity.get_by_id(id),
          true <- Visibility.visible_for_user?(activity, user) do
       conn
       |> put_view(ActivityView)
@@ -341,7 +341,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
   end
 
   def get_by_id_or_ap_id(id) do
-    activity = Repo.get(Activity, id) || Activity.get_create_by_object_ap_id(id)
+    activity = Activity.get_by_id(id) || Activity.get_create_by_object_ap_id(id)
 
     if activity.data["type"] == "Create" do
       activity
diff --git a/priv/repo/migrations/20190228121252_users_add_disabled_index.exs b/priv/repo/migrations/20190228121252_users_add_disabled_index.exs
new file mode 100644
index 000000000..7b921d3e7
--- /dev/null
+++ b/priv/repo/migrations/20190228121252_users_add_disabled_index.exs
@@ -0,0 +1,7 @@
+defmodule Pleroma.Repo.Migrations.UsersAddDisabledIndex do
+  use Ecto.Migration
+
+  def change do
+    create(index(:users, ["(info->'disabled')"], name: :users_disabled_index, using: :gin))
+  end
+end
-- 
cgit v1.2.3


From db4badc6aa71df4cb9372ef4aff699399516ffb2 Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Thu, 11 Apr 2019 17:22:42 +0700
Subject: move user disable into deactivation

---
 lib/mix/tasks/pleroma/user.ex                      | 18 --------
 lib/pleroma/activity.ex                            |  8 ++--
 lib/pleroma/notification.ex                        |  2 +-
 lib/pleroma/user.ex                                | 51 +++++++++-------------
 lib/pleroma/user/info.ex                           |  9 ----
 lib/pleroma/web/activity_pub/activity_pub.ex       |  2 +-
 lib/pleroma/web/admin_api/admin_api_controller.ex  | 10 -----
 lib/pleroma/web/router.ex                          |  1 -
 .../web/twitter_api/controllers/util_controller.ex |  2 +-
 lib/pleroma/web/twitter_api/twitter_api.ex         |  2 +-
 .../20190228121252_users_add_disabled_index.exs    |  7 ---
 ...11094120_add_index_on_user_info_deactivated.exs |  7 +++
 12 files changed, 36 insertions(+), 83 deletions(-)
 delete mode 100644 priv/repo/migrations/20190228121252_users_add_disabled_index.exs
 create mode 100644 priv/repo/migrations/20190411094120_add_index_on_user_info_deactivated.exs

diff --git a/lib/mix/tasks/pleroma/user.ex b/lib/mix/tasks/pleroma/user.ex
index 78493231c..441168df2 100644
--- a/lib/mix/tasks/pleroma/user.ex
+++ b/lib/mix/tasks/pleroma/user.ex
@@ -53,10 +53,6 @@ defmodule Mix.Tasks.Pleroma.User do
 
       mix pleroma.user toggle_activated NICKNAME
 
-  ## Disable or enable the user's account.
-
-      mix pleroma.user toggle_disabled NICKNAME
-
   ## Unsubscribe local users from user's account and deactivate it
 
       mix pleroma.user unsubscribe NICKNAME
@@ -190,20 +186,6 @@ defmodule Mix.Tasks.Pleroma.User do
     end
   end
 
-  def run(["toggle_disabled", nickname]) do
-    Common.start_pleroma()
-
-    case User.get_by_nickname(nickname) do
-      %User{} = user ->
-        {:ok, user} = User.disable(user, !user.info.disabled)
-        status = if(user.info.disabled, do: "ON", else: "OFF")
-        Mix.shell().info("Disabled status of #{nickname}: #{status}")
-
-      _ ->
-        Mix.shell().error("No user #{nickname}")
-    end
-  end
-
   def run(["reset_password", nickname]) do
     Common.start_pleroma()
 
diff --git a/lib/pleroma/activity.ex b/lib/pleroma/activity.ex
index c8c7f0d04..d06fd917d 100644
--- a/lib/pleroma/activity.ex
+++ b/lib/pleroma/activity.ex
@@ -100,7 +100,7 @@ defmodule Pleroma.Activity do
   def get_by_id(id) do
     Activity
     |> where([a], a.id == ^id)
-    |> restrict_disabled_users()
+    |> restrict_deactivated_users()
     |> Repo.one()
   end
 
@@ -169,7 +169,7 @@ defmodule Pleroma.Activity do
 
   def get_create_by_object_ap_id(ap_id) when is_binary(ap_id) do
     create_by_object_ap_id(ap_id)
-    |> restrict_disabled_users()
+    |> restrict_deactivated_users()
     |> Repo.one()
   end
 
@@ -296,11 +296,11 @@ defmodule Pleroma.Activity do
     end
   end
 
-  def restrict_disabled_users(query) do
+  def restrict_deactivated_users(query) do
     from(activity in query,
       where:
         fragment(
-          "? not in (SELECT ap_id FROM users WHERE info->'disabled' @> 'true')",
+          "? not in (SELECT ap_id FROM users WHERE info->'deactivated' @> 'true')",
           activity.actor
         )
     )
diff --git a/lib/pleroma/notification.ex b/lib/pleroma/notification.ex
index 7de2d4c18..941218eea 100644
--- a/lib/pleroma/notification.ex
+++ b/lib/pleroma/notification.ex
@@ -36,7 +36,7 @@ defmodule Pleroma.Notification do
     |> where(
       [n, a],
       fragment(
-        "? not in (SELECT ap_id FROM users WHERE info->'disabled' @> 'true')",
+        "? not in (SELECT ap_id FROM users WHERE info->'deactivated' @> 'true')",
         a.actor
       )
     )
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 1f2aca235..c08d3a171 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -117,9 +117,9 @@ defmodule Pleroma.User do
     }
   end
 
-  defp restrict_disabled(query) do
+  defp restrict_deactivated(query) do
     from(u in query,
-      where: not fragment("? \\? 'disabled' AND ?->'disabled' @> 'true'", u.info, u.info)
+      where: not fragment("? \\? 'deactivated' AND ?->'deactivated' @> 'true'", u.info, u.info)
     )
   end
 
@@ -130,7 +130,7 @@ defmodule Pleroma.User do
       where: u.follower_address in ^following,
       where: u.id != ^id
     )
-    |> restrict_disabled()
+    |> restrict_deactivated()
     |> Repo.aggregate(:count, :id)
   end
 
@@ -584,7 +584,7 @@ defmodule Pleroma.User do
       where: fragment("? <@ ?", ^[follower_address], u.following),
       where: u.id != ^id
     )
-    |> restrict_disabled()
+    |> restrict_deactivated()
   end
 
   def get_followers_query(user, page) do
@@ -612,7 +612,7 @@ defmodule Pleroma.User do
       where: u.follower_address in ^following,
       where: u.id != ^id
     )
-    |> restrict_disabled()
+    |> restrict_deactivated()
   end
 
   def get_friends_query(user, page) do
@@ -736,7 +736,7 @@ defmodule Pleroma.User do
       |> where([u], ^user.follower_address in u.following)
       |> where([u], u.id != ^user.id)
       |> select([u], %{count: count(u.id)})
-      |> restrict_disabled()
+      |> restrict_deactivated()
 
     User
     |> where(id: ^user.id)
@@ -887,7 +887,7 @@ defmodule Pleroma.User do
           ^processed_query
         )
     )
-    |> restrict_disabled()
+    |> restrict_deactivated()
   end
 
   defp trigram_search_subquery(term) do
@@ -906,7 +906,7 @@ defmodule Pleroma.User do
       },
       where: fragment("trim(? || ' ' || coalesce(?, '')) % ?", u.nickname, u.name, ^term)
     )
-    |> restrict_disabled()
+    |> restrict_deactivated()
   end
 
   def blocks_import(%User{} = blocker, blocked_identifiers) when is_list(blocked_identifiers) do
@@ -1150,13 +1150,24 @@ defmodule Pleroma.User do
     )
   end
 
+
+  def deactivate_async(user, status \\ true) do
+    PleromaJobQueue.enqueue(:user, __MODULE__, [:deactivate_async, user, status])
+  end
+
+  def perform(:deactivate_async, user, status), do: deactivate(user, status)
+
   def deactivate(%User{} = user, status \\ true) do
     info_cng = User.Info.set_activation_status(user.info, status)
 
-    user
+    with {:ok, user} <- user
     |> change()
     |> put_embed(:info, info_cng)
-    |> update_and_set_cache()
+    |> update_and_set_cache(),
+    {:ok, friends} <- User.get_friends(user) do
+      Enum.each(friends, &update_follower_count(&1))
+      {:ok, user}
+    end
   end
 
   def update_notification_settings(%User{} = user, settings \\ %{}) do
@@ -1199,26 +1210,6 @@ defmodule Pleroma.User do
     {:ok, user}
   end
 
-  def disable_async(user, status \\ true) do
-    PleromaJobQueue.enqueue(:user, __MODULE__, [:disable_async, user, status])
-  end
-
-  def disable(%User{} = user, status \\ true) do
-    with {:ok, user} <- User.deactivate(user, status),
-         info_cng <- User.Info.set_disabled_status(user.info, status),
-         {:ok, user} <-
-           user
-           |> change()
-           |> put_embed(:info, info_cng)
-           |> update_and_set_cache(),
-         {:ok, friends} <- User.get_friends(user) do
-      Enum.each(friends, &update_follower_count(&1))
-      {:ok, user}
-    end
-  end
-
-  def perform(:disable_async, user, status), do: disable(user, status)
-
   def html_filter_policy(%User{info: %{no_rich_text: true}}) do
     Pleroma.HTML.Scrubber.TwitterText
   end
diff --git a/lib/pleroma/user/info.ex b/lib/pleroma/user/info.ex
index 07825a1c4..5afa7988c 100644
--- a/lib/pleroma/user/info.ex
+++ b/lib/pleroma/user/info.ex
@@ -40,7 +40,6 @@ defmodule Pleroma.User.Info do
     field(:hide_follows, :boolean, default: false)
     field(:pinned_activities, {:array, :string}, default: [])
     field(:flavour, :string, default: nil)
-    field(:disabled, :boolean, default: false)
 
     field(:notification_settings, :map,
       default: %{"remote" => true, "local" => true, "followers" => true, "follows" => true}
@@ -76,14 +75,6 @@ defmodule Pleroma.User.Info do
     |> validate_required([:notification_settings])
   end
 
-  def set_disabled_status(info, disabled) do
-    params = %{disabled: disabled}
-
-    info
-    |> cast(params, [:disabled])
-    |> validate_required([:disabled])
-  end
-
   def add_to_note_count(info, number) do
     set_note_count(info, info.note_count + number)
   end
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index dd51d63c8..e749a80aa 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -804,7 +804,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     |> restrict_reblogs(opts)
     |> restrict_pinned(opts)
     |> restrict_muted_reblogs(opts)
-    |> Activity.restrict_disabled_users()
+    |> Activity.restrict_deactivated_users()
   end
 
   def fetch_activities(recipients, opts \\ %{}) do
diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex
index fb43d0b01..70a5b5c5d 100644
--- a/lib/pleroma/web/admin_api/admin_api_controller.ex
+++ b/lib/pleroma/web/admin_api/admin_api_controller.ex
@@ -75,16 +75,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
     end
   end
 
-  def user_toggle_disabled(conn, %{"nickname" => nickname}) do
-    user = User.get_by_nickname(nickname)
-
-    {:ok, updated_user} = User.disable(user, !user.info.disabled)
-
-    conn
-    |> put_view(AccountView)
-    |> render("show.json", %{user: updated_user})
-  end
-
   def user_toggle_activation(conn, %{"nickname" => nickname}) do
     user = User.get_by_nickname(nickname)
 
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index dd23d7fd5..c331098b4 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -153,7 +153,6 @@ defmodule Pleroma.Web.Router do
 
     delete("/user", AdminAPIController, :user_delete)
     patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
-    patch("/users/:nickname/toggle_disabled", AdminAPIController, :user_toggle_disabled)
     post("/user", AdminAPIController, :user_create)
     put("/users/tag", AdminAPIController, :tag_users)
     delete("/users/tag", AdminAPIController, :untag_users)
diff --git a/lib/pleroma/web/twitter_api/controllers/util_controller.ex b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
index 317f2b0ff..44f4b183b 100644
--- a/lib/pleroma/web/twitter_api/controllers/util_controller.ex
+++ b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
@@ -358,7 +358,7 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
   def disable_account(%{assigns: %{user: user}} = conn, params) do
     case CommonAPI.Utils.confirm_current_password(user, params["password"]) do
       {:ok, user} ->
-        User.disable_async(user)
+        User.deactivate_async(user)
         json(conn, %{status: "success"})
 
       {:error, msg} ->
diff --git a/lib/pleroma/web/twitter_api/twitter_api.ex b/lib/pleroma/web/twitter_api/twitter_api.ex
index 156f5d40f..bf1051afd 100644
--- a/lib/pleroma/web/twitter_api/twitter_api.ex
+++ b/lib/pleroma/web/twitter_api/twitter_api.ex
@@ -235,7 +235,7 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
           nil ->
             {:error, "No user with such user_id"}
 
-          %User{info: %{disabled: true}} ->
+          %User{info: %{deactivated: true}} ->
             {:error, "User has been disabled"}
 
           user ->
diff --git a/priv/repo/migrations/20190228121252_users_add_disabled_index.exs b/priv/repo/migrations/20190228121252_users_add_disabled_index.exs
deleted file mode 100644
index 7b921d3e7..000000000
--- a/priv/repo/migrations/20190228121252_users_add_disabled_index.exs
+++ /dev/null
@@ -1,7 +0,0 @@
-defmodule Pleroma.Repo.Migrations.UsersAddDisabledIndex do
-  use Ecto.Migration
-
-  def change do
-    create(index(:users, ["(info->'disabled')"], name: :users_disabled_index, using: :gin))
-  end
-end
diff --git a/priv/repo/migrations/20190411094120_add_index_on_user_info_deactivated.exs b/priv/repo/migrations/20190411094120_add_index_on_user_info_deactivated.exs
new file mode 100644
index 000000000..d701dcecc
--- /dev/null
+++ b/priv/repo/migrations/20190411094120_add_index_on_user_info_deactivated.exs
@@ -0,0 +1,7 @@
+defmodule Pleroma.Repo.Migrations.AddIndexOnUserInfoDeactivated do
+  use Ecto.Migration
+
+  def change do
+    create(index(:users, ["(info->'deactivated')"], name: :users_deactivated_index, using: :gin))
+  end
+end
-- 
cgit v1.2.3


From 46bd5c1d875934370621375957fa33a10e2d3507 Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Thu, 11 Apr 2019 17:28:12 +0700
Subject: fix format

---
 lib/pleroma/user.ex | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index c08d3a171..a8e902bf3 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1150,7 +1150,6 @@ defmodule Pleroma.User do
     )
   end
 
-
   def deactivate_async(user, status \\ true) do
     PleromaJobQueue.enqueue(:user, __MODULE__, [:deactivate_async, user, status])
   end
@@ -1160,11 +1159,12 @@ defmodule Pleroma.User do
   def deactivate(%User{} = user, status \\ true) do
     info_cng = User.Info.set_activation_status(user.info, status)
 
-    with {:ok, user} <- user
-    |> change()
-    |> put_embed(:info, info_cng)
-    |> update_and_set_cache(),
-    {:ok, friends} <- User.get_friends(user) do
+    with {:ok, user} <-
+           user
+           |> change()
+           |> put_embed(:info, info_cng)
+           |> update_and_set_cache(),
+         {:ok, friends} <- User.get_friends(user) do
       Enum.each(friends, &update_follower_count(&1))
       {:ok, user}
     end
-- 
cgit v1.2.3


From dd097a406baf15e983454ab8f13635b4af2a8de4 Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Fri, 12 Apr 2019 16:38:32 +0700
Subject: add tests

---
 lib/pleroma/user.ex |  9 ++++---
 test/user_test.exs  | 78 ++++++++++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 75 insertions(+), 12 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index a8e902bf3..95f5c6d21 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1159,13 +1159,16 @@ defmodule Pleroma.User do
   def deactivate(%User{} = user, status \\ true) do
     info_cng = User.Info.set_activation_status(user.info, status)
 
-    with {:ok, user} <-
+    with {:ok, friends} <- User.get_friends(user),
+         {:ok, followers} <- User.get_followers(user),
+         {:ok, user} <-
            user
            |> change()
            |> put_embed(:info, info_cng)
-           |> update_and_set_cache(),
-         {:ok, friends} <- User.get_friends(user) do
+           |> update_and_set_cache() do
+      Enum.each(followers, &invalidate_cache(&1))
       Enum.each(friends, &update_follower_count(&1))
+
       {:ok, user}
     end
   end
diff --git a/test/user_test.exs b/test/user_test.exs
index d2167a970..ac1675d0f 100644
--- a/test/user_test.exs
+++ b/test/user_test.exs
@@ -5,8 +5,10 @@
 defmodule Pleroma.UserTest do
   alias Pleroma.Activity
   alias Pleroma.Builders.UserBuilder
+  alias Pleroma.Notification
   alias Pleroma.Repo
   alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.CommonAPI
 
   use Pleroma.DataCase
@@ -212,8 +214,8 @@ defmodule Pleroma.UserTest do
   test "fetches correct profile for nickname beginning with number" do
     # Use old-style integer ID to try to reproduce the problem
     user = insert(:user, %{id: 1080})
-    userwithnumbers = insert(:user, %{nickname: "#{user.id}garbage"})
-    assert userwithnumbers == User.get_cached_by_nickname_or_id(userwithnumbers.nickname)
+    user_with_numbers = insert(:user, %{nickname: "#{user.id}garbage"})
+    assert user_with_numbers == User.get_cached_by_nickname_or_id(user_with_numbers.nickname)
   end
 
   describe "user registration" do
@@ -815,13 +817,71 @@ defmodule Pleroma.UserTest do
     assert addressed in recipients
   end
 
-  test ".deactivate can de-activate then re-activate a user" do
-    user = insert(:user)
-    assert false == user.info.deactivated
-    {:ok, user} = User.deactivate(user)
-    assert true == user.info.deactivated
-    {:ok, user} = User.deactivate(user, false)
-    assert false == user.info.deactivated
+  describe ".deactivate" do
+    test "can de-activate then re-activate a user" do
+      user = insert(:user)
+      assert false == user.info.deactivated
+      {:ok, user} = User.deactivate(user)
+      assert true == user.info.deactivated
+      {:ok, user} = User.deactivate(user, false)
+      assert false == user.info.deactivated
+    end
+
+    test "hide a user from followers " do
+      user = insert(:user)
+      user2 = insert(:user)
+
+      {:ok, user} = User.follow(user, user2)
+      {:ok, _user} = User.deactivate(user)
+
+      info = User.get_cached_user_info(user2)
+
+      assert info.follower_count == 0
+      assert {:ok, []} = User.get_followers(user2)
+    end
+
+    test "hide a user from friends" do
+      user = insert(:user)
+      user2 = insert(:user)
+
+      {:ok, user2} = User.follow(user2, user)
+      assert User.following_count(user2) == 1
+
+      {:ok, _user} = User.deactivate(user)
+
+      info = User.get_cached_user_info(user2)
+
+      assert info.following_count == 0
+      assert User.following_count(user2) == 0
+      assert {:ok, []} = User.get_friends(user2)
+    end
+
+    test "hide a user's statuses from timelines and notifications" do
+      user = insert(:user)
+      user2 = insert(:user)
+
+      {:ok, user2} = User.follow(user2, user)
+
+      {:ok, activity} = CommonAPI.post(user, %{"status" => "hey @#{user2.nickname}"})
+
+      [notification] = Notification.for_user(user2)
+      assert notification.activity == activity
+
+      assert [activity] == ActivityPub.fetch_public_activities(%{})
+
+      assert [activity] ==
+               ActivityPub.fetch_activities([user2.ap_id | user2.following], %{"user" => user2})
+               |> ActivityPub.contain_timeline(user2)
+
+      {:ok, _user} = User.deactivate(user)
+
+      assert [] == ActivityPub.fetch_public_activities(%{})
+      assert [] == Notification.for_user(user2)
+
+      assert [] ==
+               ActivityPub.fetch_activities([user2.ap_id | user2.following], %{"user" => user2})
+               |> ActivityPub.contain_timeline(user2)
+    end
   end
 
   test ".delete_user_activities deletes all create activities" do
-- 
cgit v1.2.3


From d0304b4f925ac9b3b57f294ef091b96b071e97b9 Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Fri, 12 Apr 2019 16:51:28 +0700
Subject: more tests

---
 test/web/twitter_api/util_controller_test.exs | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/test/web/twitter_api/util_controller_test.exs b/test/web/twitter_api/util_controller_test.exs
index a4b3d651a..66d89eee0 100644
--- a/test/web/twitter_api/util_controller_test.exs
+++ b/test/web/twitter_api/util_controller_test.exs
@@ -230,4 +230,22 @@ defmodule Pleroma.Web.TwitterAPI.UtilControllerTest do
       assert html_response(response, 200) =~ "Log in to follow"
     end
   end
+
+  describe "POST /api/pleroma/disable_account" do
+    test "it returns HTTP 200", %{conn: conn} do
+      user = insert(:user)
+
+      response =
+        conn
+        |> assign(:user, user)
+        |> post("/api/pleroma/disable_account", %{"password" => "test"})
+        |> json_response(:ok)
+
+      assert response == %{"status" => "success"}
+
+      user = User.get_cached_by_id(user.id)
+
+      assert user.info.deactivated == true
+    end
+  end
 end
-- 
cgit v1.2.3


From 38926a063a39c4d4387049f5d364f72a9f8bd2de Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Mon, 15 Apr 2019 16:39:42 +0700
Subject: add `/api/pleroma/disable_account` to `docs/api/pleroma_api.md`

---
 docs/api/pleroma_api.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/api/pleroma_api.md b/docs/api/pleroma_api.md
index dbe250300..b9622f586 100644
--- a/docs/api/pleroma_api.md
+++ b/docs/api/pleroma_api.md
@@ -61,6 +61,15 @@ Request parameters can be passed via [query strings](https://en.wikipedia.org/wi
 * Response: JSON. Returns `{"status": "success"}` if the deletion was successful, `{"error": "[error message]"}` otherwise
 * Example response: `{"error": "Invalid password."}`
 
+## `/api/pleroma/disable_account`
+### Disable an account
+* Method `POST`
+* Authentication: required
+* Params:
+    * `password`: user's password
+* Response: JSON. Returns `{"status": "success"}` if the account was successfully disabled, `{"error": "[error message]"}` otherwise
+* Example response: `{"error": "Invalid password."}`
+
 ## `/api/account/register`
 ### Register a new user
 * Method `POST`
-- 
cgit v1.2.3


From fcf2f38d20eed40a53b03374467d9e52b013da07 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 8 May 2019 17:37:00 +0200
Subject: Conversations: Add a function to 'import' old DMs.

---
 lib/pleroma/conversation.ex                  | 14 ++++++++++++++
 lib/pleroma/web/activity_pub/activity_pub.ex |  6 ++++++
 test/conversation_test.exs                   | 18 ++++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/lib/pleroma/conversation.ex b/lib/pleroma/conversation.ex
index 6e26c5fd4..aa73edd75 100644
--- a/lib/pleroma/conversation.ex
+++ b/lib/pleroma/conversation.ex
@@ -72,4 +72,18 @@ defmodule Pleroma.Conversation do
       e -> {:error, e}
     end
   end
+
+  @doc """
+  This is only meant to be run by a mix task. It creates conversations/participations for all direct messages in the database.
+  """
+  def bump_for_all_activities() do
+    stream =
+      Pleroma.Web.ActivityPub.ActivityPub.fetch_direct_messages_query()
+      |> Repo.stream()
+
+    Repo.transaction(fn ->
+      stream
+      |> Enum.each(&create_or_bump_for/1)
+    end)
+  end
 end
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 8f8c23a9b..23cf4e9c4 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -1061,4 +1061,10 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
       contain_activity(activity, user)
     end)
   end
+
+  def fetch_direct_messages_query() do
+    Activity
+    |> restrict_type(%{"type" => "Create"})
+    |> restrict_visibility(%{visibility: "direct"})
+  end
 end
diff --git a/test/conversation_test.exs b/test/conversation_test.exs
index f3300e7d1..59368b0e7 100644
--- a/test/conversation_test.exs
+++ b/test/conversation_test.exs
@@ -9,6 +9,24 @@ defmodule Pleroma.ConversationTest do
 
   import Pleroma.Factory
 
+  test "it goes through old direct conversations" do
+    user = insert(:user)
+    other_user = insert(:user)
+
+    {:ok, _activity} =
+      CommonAPI.post(user, %{"visibility" => "direct", "status" => "hey @#{other_user.nickname}"})
+
+    Repo.delete_all(Conversation)
+    Repo.delete_all(Conversation.Participation)
+
+    refute Repo.one(Conversation)
+
+    Conversation.bump_for_all_activities()
+
+    assert Repo.one(Conversation)
+    assert length(Repo.all(Conversation.Participation)) == 2
+  end
+
   test "it creates a conversation for given ap_id" do
     assert {:ok, %Conversation{} = conversation} =
              Conversation.create_for_ap_id("https://some_ap_id")
-- 
cgit v1.2.3


From 920bd4705526d8dfa8ada516853bbb4e5438cbf1 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 8 May 2019 17:40:24 +0200
Subject: ActivityPub: Remove leftover printf debugging.

---
 lib/pleroma/web/activity_pub/activity_pub.ex | 42 +++++++++++-----------------
 1 file changed, 16 insertions(+), 26 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 23cf4e9c4..cd8495035 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -533,22 +533,17 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
   defp restrict_visibility(query, %{visibility: visibility})
        when is_list(visibility) do
     if Enum.all?(visibility, &(&1 in @valid_visibilities)) do
-      query =
-        from(
-          a in query,
-          where:
-            fragment(
-              "activity_visibility(?, ?, ?) = ANY (?)",
-              a.actor,
-              a.recipients,
-              a.data,
-              ^visibility
-            )
-        )
-
-      Ecto.Adapters.SQL.to_sql(:all, Repo, query)
-
-      query
+      from(
+        a in query,
+        where:
+          fragment(
+            "activity_visibility(?, ?, ?) = ANY (?)",
+            a.actor,
+            a.recipients,
+            a.data,
+            ^visibility
+          )
+      )
     else
       Logger.error("Could not restrict visibility to #{visibility}")
     end
@@ -556,16 +551,11 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
 
   defp restrict_visibility(query, %{visibility: visibility})
        when visibility in @valid_visibilities do
-    query =
-      from(
-        a in query,
-        where:
-          fragment("activity_visibility(?, ?, ?) = ?", a.actor, a.recipients, a.data, ^visibility)
-      )
-
-    Ecto.Adapters.SQL.to_sql(:all, Repo, query)
-
-    query
+    from(
+      a in query,
+      where:
+        fragment("activity_visibility(?, ?, ?) = ?", a.actor, a.recipients, a.data, ^visibility)
+    )
   end
 
   defp restrict_visibility(_query, %{visibility: visibility})
-- 
cgit v1.2.3


From a4598b5e8bc640ffc1a052438e21f3573ff837ee Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 8 May 2019 18:08:50 +0200
Subject: Visibility: Make it more resilient.

---
 lib/pleroma/web/activity_pub/visibility.ex |  9 +++++----
 test/web/activity_pub/visibilty_test.exs   | 10 ++++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/visibility.ex b/lib/pleroma/web/activity_pub/visibility.ex
index 6dee61dd6..e7613a5c8 100644
--- a/lib/pleroma/web/activity_pub/visibility.ex
+++ b/lib/pleroma/web/activity_pub/visibility.ex
@@ -13,11 +13,12 @@ defmodule Pleroma.Web.ActivityPub.Visibility do
   end
 
   def is_private?(activity) do
-    unless is_public?(activity) do
-      follower_address = User.get_cached_by_ap_id(activity.data["actor"]).follower_address
-      Enum.any?(activity.data["to"], &(&1 == follower_address))
+    with false <- is_public?(activity),
+         %User{follower_address: follower_address} <-
+           User.get_cached_by_ap_id(activity.data["actor"]) do
+      follower_address in activity.data["to"]
     else
-      false
+      _ -> false
     end
   end
 
diff --git a/test/web/activity_pub/visibilty_test.exs b/test/web/activity_pub/visibilty_test.exs
index 24b96c4aa..ff0e72401 100644
--- a/test/web/activity_pub/visibilty_test.exs
+++ b/test/web/activity_pub/visibilty_test.exs
@@ -95,4 +95,14 @@ defmodule Pleroma.Web.ActivityPub.VisibilityTest do
     refute Visibility.visible_for_user?(private, unrelated)
     refute Visibility.visible_for_user?(direct, unrelated)
   end
+
+  test "doesn't die when the user doesn't exist",
+       %{
+         direct: direct,
+         user: user
+       } do
+    Repo.delete(user)
+    Cachex.clear(:user_cache)
+    refute Visibility.is_private?(direct)
+  end
 end
-- 
cgit v1.2.3


From 6d19bb4eae43270099a68f749519ba0f323da01a Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 8 May 2019 18:09:07 +0200
Subject: Conversations: Add mix task to 'import' old DMs.

---
 lib/mix/tasks/pleroma/conversations.ex | 23 +++++++++++++++++++++++
 lib/pleroma/conversation.ex            | 11 +++++++----
 2 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 lib/mix/tasks/pleroma/conversations.ex

diff --git a/lib/mix/tasks/pleroma/conversations.ex b/lib/mix/tasks/pleroma/conversations.ex
new file mode 100644
index 000000000..125d8851a
--- /dev/null
+++ b/lib/mix/tasks/pleroma/conversations.ex
@@ -0,0 +1,23 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Mix.Tasks.Pleroma.Conversations do
+  use Mix.Task
+  alias Mix.Tasks.Pleroma.Common
+  alias Pleroma.Conversation
+
+  @shortdoc "Manages Pleroma users"
+  @moduledoc """
+  Manages Pleroma conversations.
+
+  ## Create a conversation for all existing DMs. Can be safely re-run.
+
+      mix pleroma.conversations bump_all
+
+  """
+  def run(["bump_all"]) do
+    Common.start_pleroma()
+    Conversation.bump_for_all_activities()
+  end
+end
diff --git a/lib/pleroma/conversation.ex b/lib/pleroma/conversation.ex
index aa73edd75..10c2403e8 100644
--- a/lib/pleroma/conversation.ex
+++ b/lib/pleroma/conversation.ex
@@ -81,9 +81,12 @@ defmodule Pleroma.Conversation do
       Pleroma.Web.ActivityPub.ActivityPub.fetch_direct_messages_query()
       |> Repo.stream()
 
-    Repo.transaction(fn ->
-      stream
-      |> Enum.each(&create_or_bump_for/1)
-    end)
+    Repo.transaction(
+      fn ->
+        stream
+        |> Enum.each(&create_or_bump_for/1)
+      end,
+      timeout: :infinity
+    )
   end
 end
-- 
cgit v1.2.3


From e6d7f8d223b2604df38f8efa8baf09e2c607c487 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 8 May 2019 18:19:20 +0200
Subject: Credo fixes.

---
 lib/pleroma/conversation.ex                  | 2 +-
 lib/pleroma/web/activity_pub/activity_pub.ex | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/conversation.ex b/lib/pleroma/conversation.ex
index 10c2403e8..0c6ca9f72 100644
--- a/lib/pleroma/conversation.ex
+++ b/lib/pleroma/conversation.ex
@@ -76,7 +76,7 @@ defmodule Pleroma.Conversation do
   @doc """
   This is only meant to be run by a mix task. It creates conversations/participations for all direct messages in the database.
   """
-  def bump_for_all_activities() do
+  def bump_for_all_activities do
     stream =
       Pleroma.Web.ActivityPub.ActivityPub.fetch_direct_messages_query()
       |> Repo.stream()
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index cd8495035..8137ac83b 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -1052,7 +1052,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     end)
   end
 
-  def fetch_direct_messages_query() do
+  def fetch_direct_messages_query do
     Activity
     |> restrict_type(%{"type" => "Create"})
     |> restrict_visibility(%{visibility: "direct"})
-- 
cgit v1.2.3


From a33bec7d58091059d578f6b7537513de11eb0679 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Thu, 9 May 2019 16:39:28 +0200
Subject: Conversations: Import order, import as read.

---
 lib/pleroma/conversation.ex                  |  6 +++---
 lib/pleroma/conversation/participation.ex    | 10 ++++++----
 lib/pleroma/web/activity_pub/activity_pub.ex |  1 +
 test/conversation_test.exs                   |  4 +++-
 4 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/lib/pleroma/conversation.ex b/lib/pleroma/conversation.ex
index 0c6ca9f72..5f6ab902c 100644
--- a/lib/pleroma/conversation.ex
+++ b/lib/pleroma/conversation.ex
@@ -45,7 +45,7 @@ defmodule Pleroma.Conversation do
   2. Create a participation for all the people involved who don't have one already
   3. Bump all relevant participations to 'unread'
   """
-  def create_or_bump_for(activity) do
+  def create_or_bump_for(activity, opts \\ []) do
     with true <- Pleroma.Web.ActivityPub.Visibility.is_direct?(activity),
          object <- Pleroma.Object.normalize(activity),
          "Create" <- activity.data["type"],
@@ -58,7 +58,7 @@ defmodule Pleroma.Conversation do
       participations =
         Enum.map(users, fn user ->
           {:ok, participation} =
-            Participation.create_for_user_and_conversation(user, conversation)
+            Participation.create_for_user_and_conversation(user, conversation, opts)
 
           participation
         end)
@@ -84,7 +84,7 @@ defmodule Pleroma.Conversation do
     Repo.transaction(
       fn ->
         stream
-        |> Enum.each(&create_or_bump_for/1)
+        |> Enum.each(fn a -> create_or_bump_for(a, read: true) end)
       end,
       timeout: :infinity
     )
diff --git a/lib/pleroma/conversation/participation.ex b/lib/pleroma/conversation/participation.ex
index 61021fb18..2a11f9069 100644
--- a/lib/pleroma/conversation/participation.ex
+++ b/lib/pleroma/conversation/participation.ex
@@ -22,15 +22,17 @@ defmodule Pleroma.Conversation.Participation do
 
   def creation_cng(struct, params) do
     struct
-    |> cast(params, [:user_id, :conversation_id])
+    |> cast(params, [:user_id, :conversation_id, :read])
     |> validate_required([:user_id, :conversation_id])
   end
 
-  def create_for_user_and_conversation(user, conversation) do
+  def create_for_user_and_conversation(user, conversation, opts \\ []) do
+    read = !!opts[:read]
+
     %__MODULE__{}
-    |> creation_cng(%{user_id: user.id, conversation_id: conversation.id})
+    |> creation_cng(%{user_id: user.id, conversation_id: conversation.id, read: read})
     |> Repo.insert(
-      on_conflict: [set: [read: false, updated_at: NaiveDateTime.utc_now()]],
+      on_conflict: [set: [read: read, updated_at: NaiveDateTime.utc_now()]],
       returning: true,
       conflict_target: [:user_id, :conversation_id]
     )
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 8137ac83b..728761ebd 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -1056,5 +1056,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     Activity
     |> restrict_type(%{"type" => "Create"})
     |> restrict_visibility(%{visibility: "direct"})
+    |> order_by([activity], asc: activity.id)
   end
 end
diff --git a/test/conversation_test.exs b/test/conversation_test.exs
index 59368b0e7..cdec18f0f 100644
--- a/test/conversation_test.exs
+++ b/test/conversation_test.exs
@@ -24,7 +24,9 @@ defmodule Pleroma.ConversationTest do
     Conversation.bump_for_all_activities()
 
     assert Repo.one(Conversation)
-    assert length(Repo.all(Conversation.Participation)) == 2
+    [participation, _p2] = Repo.all(Conversation.Participation)
+
+    assert participation.read
   end
 
   test "it creates a conversation for given ap_id" do
-- 
cgit v1.2.3


From 01c45ddc9ead715131b3c583caa14fcf20845354 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Sat, 11 May 2019 11:26:46 +0200
Subject: Search: Use RUM index.

---
 .../web/mastodon_api/mastodon_api_controller.ex    |  6 ++--
 ...20190510135645_add_fts_index_to_objects_two.exs | 33 ++++++++++++++++++++++
 2 files changed, 36 insertions(+), 3 deletions(-)
 create mode 100644 priv/repo/migrations/20190510135645_add_fts_index_to_objects_two.exs

diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 956736780..32677df95 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -1019,12 +1019,12 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
         where: "https://www.w3.org/ns/activitystreams#Public" in a.recipients,
         where:
           fragment(
-            "to_tsvector('english', ?->>'content') @@ plainto_tsquery('english', ?)",
-            o.data,
+            "? @@ plainto_tsquery('english', ?)",
+            o.fts_content,
             ^query
           ),
         limit: 20,
-        order_by: [desc: :id]
+        order_by: [fragment("? <=> now()::date", o.inserted_at)]
       )
 
     Repo.all(q) ++ fetched
diff --git a/priv/repo/migrations/20190510135645_add_fts_index_to_objects_two.exs b/priv/repo/migrations/20190510135645_add_fts_index_to_objects_two.exs
new file mode 100644
index 000000000..14b964847
--- /dev/null
+++ b/priv/repo/migrations/20190510135645_add_fts_index_to_objects_two.exs
@@ -0,0 +1,33 @@
+defmodule Pleroma.Repo.Migrations.AddFtsIndexToObjectsTwo do
+  use Ecto.Migration
+
+  def up do
+    drop_if_exists index(:objects, ["(to_tsvector('english', data->>'content'))"], using: :gin, name: :objects_fts)
+    alter table(:objects) do
+      add(:fts_content, :tsvector)
+    end
+
+    execute("CREATE FUNCTION objects_fts_update() RETURNS trigger AS $$
+    begin
+      new.fts_content := to_tsvector('english', new.data->>'content');
+      return new;
+    end
+    $$ LANGUAGE plpgsql")
+    execute("create index objects_fts on objects using RUM (fts_content rum_tsvector_addon_ops, inserted_at) with (attach = 'inserted_at', to = 'fts_content');")
+
+    execute("CREATE TRIGGER tsvectorupdate BEFORE INSERT OR UPDATE ON objects
+    FOR EACH ROW EXECUTE PROCEDURE objects_fts_update()")
+
+    execute("UPDATE objects SET updated_at = NOW()")
+  end
+
+  def down do
+    execute "drop index objects_fts"
+    execute "drop trigger tsvectorupdate on objects"
+    execute "drop function objects_fts_update()"
+    alter table(:objects) do
+      remove(:fts_content, :tsvector)
+    end
+    create index(:objects, ["(to_tsvector('english', data->>'content'))"], using: :gin, name: :objects_fts)
+  end
+end
-- 
cgit v1.2.3


From b9f84a382a0e4bbee09e21346f9293962b80917c Mon Sep 17 00:00:00 2001
From: rinpatch <rinpatch@sdf.org>
Date: Sun, 12 May 2019 03:01:42 +0300
Subject: Normalize the object only after ensuring the activity type is Create

---
 lib/pleroma/conversation.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/conversation.ex b/lib/pleroma/conversation.ex
index 6e26c5fd4..0db195988 100644
--- a/lib/pleroma/conversation.ex
+++ b/lib/pleroma/conversation.ex
@@ -47,8 +47,8 @@ defmodule Pleroma.Conversation do
   """
   def create_or_bump_for(activity) do
     with true <- Pleroma.Web.ActivityPub.Visibility.is_direct?(activity),
-         object <- Pleroma.Object.normalize(activity),
          "Create" <- activity.data["type"],
+         object <- Pleroma.Object.normalize(activity),
          "Note" <- object.data["type"],
          ap_id when is_binary(ap_id) and byte_size(ap_id) > 0 <- object.data["context"] do
       {:ok, conversation} = create_for_ap_id(ap_id)
-- 
cgit v1.2.3


From e7d292f80ee03d6eabf30792640a7a40e041a796 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 02:41:34 +0000
Subject: federator: add publisher module defining a contract for publishing
 behaviours

---
 lib/pleroma/web/federator/publisher.ex | 38 ++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 lib/pleroma/web/federator/publisher.ex

diff --git a/lib/pleroma/web/federator/publisher.ex b/lib/pleroma/web/federator/publisher.ex
new file mode 100644
index 000000000..36277fd7e
--- /dev/null
+++ b/lib/pleroma/web/federator/publisher.ex
@@ -0,0 +1,38 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Federator.Publisher do
+  @moduledoc """
+  Defines the contract used by federation implementations to publish messages to
+  their peers.
+  """
+
+  @doc """
+  Determine whether an activity can be relayed using the federation module.
+  """
+  @callback is_representable?(Pleroma.Activity.t()) :: boolean()
+
+  @doc """
+  Relays an activity to a specified peer, determined by the parameters.  The
+  parameters used are controlled by the federation module.
+  """
+  @callback publish_one(Map.t()) :: {:ok, Map.t()} | {:error, any()}
+
+  @doc """
+  Relays an activity to all specified peers.
+  """
+  @callback publish(Pleroma.User.t(), Pleroma.Activity.t()) :: :ok | {:error, any()}
+
+  @doc """
+  Enqueues work generated by the federation module.
+  """
+  @spec enqueue(module(), keyword()) :: :ok
+  def enqueue(module, args), do: PleromaJobQueue.enqueue(:federation_outgoing, module, args)
+
+  @doc """
+  Enqueue publishing a single activity.
+  """
+  @spec enqueue_one(module(), Map.t()) :: :ok
+  def enqueue_one(module, %{} = args), do: enqueue(module, [:publish_one, args])
+end
-- 
cgit v1.2.3


From 566a968ab35562aeccd2ec3b13a4d70de37968d6 Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Sun, 12 May 2019 04:35:50 +0200
Subject: pleroma-fox-tan-shy.png: Add another version of pleroma-tan

Commissioned by https://shitposter.club/users/moonman and
drawn by https://shpposter.club/users/Nightingalle

Intended to be used when mastofe crashes out and allows to report a bug
among other things.

Should require a bit of modification on mastofe to use the image as it's more
of a vanilla flavour thing.
---
 COPYING                                    |   8 ++++++++
 priv/static/images/pleroma-fox-tan-shy.png | Bin 0 -> 1038613 bytes
 2 files changed, 8 insertions(+)
 create mode 100644 priv/static/images/pleroma-fox-tan-shy.png

diff --git a/COPYING b/COPYING
index eceb68efe..0aede0fba 100644
--- a/COPYING
+++ b/COPYING
@@ -15,6 +15,14 @@ priv/static/images/pleroma-tan.png
 
 ---
 
+The following files are copyright © 2019 shitposter.club, and are distributed
+under the Creative Commons Attribution 4.0 International license, you should
+have received a copy of the license file as CC-BY-4.0.
+
+priv/static/images/pleroma-fox-tan-shy.png
+
+---
+
 The following files are copyright © 2017-2019 Pleroma Authors
 <https://pleroma.social/>, and are distributed under the Creative Commons
 Attribution-ShareAlike 4.0 International license, you should have received
diff --git a/priv/static/images/pleroma-fox-tan-shy.png b/priv/static/images/pleroma-fox-tan-shy.png
new file mode 100644
index 000000000..6e24be1e3
Binary files /dev/null and b/priv/static/images/pleroma-fox-tan-shy.png differ
-- 
cgit v1.2.3


From ef1f9e8d4e4bd2bae0483523c7d31a20c086207e Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 03:09:05 +0000
Subject: activitypub: split out outgoing federation into a federation module

---
 lib/pleroma/web/activity_pub/activity_pub.ex |  87 ------------------
 lib/pleroma/web/activity_pub/publisher.ex    | 131 +++++++++++++++++++++++++++
 2 files changed, 131 insertions(+), 87 deletions(-)
 create mode 100644 lib/pleroma/web/activity_pub/publisher.ex

diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 8f8c23a9b..11777c220 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -5,7 +5,6 @@
 defmodule Pleroma.Web.ActivityPub.ActivityPub do
   alias Pleroma.Activity
   alias Pleroma.Conversation
-  alias Pleroma.Instances
   alias Pleroma.Notification
   alias Pleroma.Object
   alias Pleroma.Object.Fetcher
@@ -15,7 +14,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
   alias Pleroma.User
   alias Pleroma.Web.ActivityPub.MRF
   alias Pleroma.Web.ActivityPub.Transmogrifier
-  alias Pleroma.Web.Federator
   alias Pleroma.Web.WebFinger
 
   import Ecto.Query
@@ -24,8 +22,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
 
   require Logger
 
-  @httpoison Application.get_env(:pleroma, :httpoison)
-
   # For Announce activities, we filter the recipients based on following status for any actors
   # that match actual users.  See issue #164 for more information about why this is necessary.
   defp get_recipients(%{"type" => "Announce"} = data) do
@@ -961,89 +957,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     end
   end
 
-  def should_federate?(inbox, public) do
-    if public do
-      true
-    else
-      inbox_info = URI.parse(inbox)
-      !Enum.member?(Pleroma.Config.get([:instance, :quarantined_instances], []), inbox_info.host)
-    end
-  end
-
-  def publish(actor, activity) do
-    remote_followers =
-      if actor.follower_address in activity.recipients do
-        {:ok, followers} = User.get_followers(actor)
-        followers |> Enum.filter(&(!&1.local))
-      else
-        []
-      end
-
-    public = is_public?(activity)
-
-    {:ok, data} = Transmogrifier.prepare_outgoing(activity.data)
-    json = Jason.encode!(data)
-
-    (Pleroma.Web.Salmon.remote_users(activity) ++ remote_followers)
-    |> Enum.filter(fn user -> User.ap_enabled?(user) end)
-    |> Enum.map(fn %{info: %{source_data: data}} ->
-      (is_map(data["endpoints"]) && Map.get(data["endpoints"], "sharedInbox")) || data["inbox"]
-    end)
-    |> Enum.uniq()
-    |> Enum.filter(fn inbox -> should_federate?(inbox, public) end)
-    |> Instances.filter_reachable()
-    |> Enum.each(fn {inbox, unreachable_since} ->
-      Federator.publish_single_ap(%{
-        inbox: inbox,
-        json: json,
-        actor: actor,
-        id: activity.data["id"],
-        unreachable_since: unreachable_since
-      })
-    end)
-  end
-
-  def publish_one(%{inbox: inbox, json: json, actor: actor, id: id} = params) do
-    Logger.info("Federating #{id} to #{inbox}")
-    host = URI.parse(inbox).host
-
-    digest = "SHA-256=" <> (:crypto.hash(:sha256, json) |> Base.encode64())
-
-    date =
-      NaiveDateTime.utc_now()
-      |> Timex.format!("{WDshort}, {0D} {Mshort} {YYYY} {h24}:{m}:{s} GMT")
-
-    signature =
-      Pleroma.Web.HTTPSignatures.sign(actor, %{
-        host: host,
-        "content-length": byte_size(json),
-        digest: digest,
-        date: date
-      })
-
-    with {:ok, %{status: code}} when code in 200..299 <-
-           result =
-             @httpoison.post(
-               inbox,
-               json,
-               [
-                 {"Content-Type", "application/activity+json"},
-                 {"Date", date},
-                 {"signature", signature},
-                 {"digest", digest}
-               ]
-             ) do
-      if !Map.has_key?(params, :unreachable_since) || params[:unreachable_since],
-        do: Instances.set_reachable(inbox)
-
-      result
-    else
-      {_post_result, response} ->
-        unless params[:unreachable_since], do: Instances.set_unreachable(inbox)
-        {:error, response}
-    end
-  end
-
   # filter out broken threads
   def contain_broken_threads(%Activity{} = activity, %User{} = user) do
     entire_thread_visible_for_user?(activity, user)
diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex
new file mode 100644
index 000000000..ee9f0fdd3
--- /dev/null
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@@ -0,0 +1,131 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Publisher do
+  alias Pleroma.Activity
+  alias Pleroma.Instances
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Transmogrifier
+
+  import Pleroma.Web.ActivityPub.Visibility
+
+  @behaviour Pleroma.Web.Federator.Publisher
+
+  require Logger
+
+  @httpoison Application.get_env(:pleroma, :httpoison)
+
+  @moduledoc """
+  ActivityPub outgoing federation module.
+  """
+
+  @doc """
+  Determine if an activity can be represented by running it through Transmogrifier.
+  """
+  def is_representable?(%Activity{} = activity) do
+    with %{} = _data <- Transmogrifier.prepare_outgoing(activity.data) do
+      true
+    else
+      _e -> false
+    end
+  end
+
+  @doc """
+  Publish a single message to a peer.  Takes a struct with the following
+  parameters set:
+
+  * `inbox`: the inbox to publish to
+  * `json`: the JSON message body representing the ActivityPub message
+  * `actor`: the actor which is signing the message
+  * `id`: the ActivityStreams URI of the message
+  """
+  def publish_one(%{inbox: inbox, json: json, actor: %User{} = actor, id: id} = params) do
+    Logger.info("Federating #{id} to #{inbox}")
+    host = URI.parse(inbox).host
+
+    digest = "SHA-256=" <> (:crypto.hash(:sha256, json) |> Base.encode64())
+
+    date =
+      NaiveDateTime.utc_now()
+      |> Timex.format!("{WDshort}, {0D} {Mshort} {YYYY} {h24}:{m}:{s} GMT")
+
+    signature =
+      Pleroma.Web.HTTPSignatures.sign(actor, %{
+        host: host,
+        "content-length": byte_size(json),
+        digest: digest,
+        date: date
+      })
+
+    with {:ok, %{status: code}} when code in 200..299 <-
+           result =
+             @httpoison.post(
+               inbox,
+               json,
+               [
+                 {"Content-Type", "application/activity+json"},
+                 {"Date", date},
+                 {"signature", signature},
+                 {"digest", digest}
+               ]
+             ) do
+      if !Map.has_key?(params, :unreachable_since) || params[:unreachable_since],
+        do: Instances.set_reachable(inbox)
+
+      result
+    else
+      {_post_result, response} ->
+        unless params[:unreachable_since], do: Instances.set_unreachable(inbox)
+        {:error, response}
+    end
+  end
+
+  defp should_federate?(inbox, public) do
+    if public do
+      true
+    else
+      inbox_info = URI.parse(inbox)
+      !Enum.member?(Pleroma.Config.get([:instance, :quarantined_instances], []), inbox_info.host)
+    end
+  end
+
+  @doc """
+  Publishes an activity to all relevant peers.
+  """
+  def publish(%User{} = actor, %Activity{} = activity) do
+    remote_followers =
+      if actor.follower_address in activity.recipients do
+        {:ok, followers} = User.get_followers(actor)
+        followers |> Enum.filter(&(!&1.local))
+      else
+        []
+      end
+
+    public = is_public?(activity)
+
+    {:ok, data} = Transmogrifier.prepare_outgoing(activity.data)
+    json = Jason.encode!(data)
+
+    (Pleroma.Web.Salmon.remote_users(activity) ++ remote_followers)
+    |> Enum.filter(fn user -> User.ap_enabled?(user) end)
+    |> Enum.map(fn %{info: %{source_data: data}} ->
+      (is_map(data["endpoints"]) && Map.get(data["endpoints"], "sharedInbox")) || data["inbox"]
+    end)
+    |> Enum.uniq()
+    |> Enum.filter(fn inbox -> should_federate?(inbox, public) end)
+    |> Instances.filter_reachable()
+    |> Enum.each(fn {inbox, unreachable_since} ->
+      Pleroma.Web.Federator.Publisher.enqueue_one(
+        __MODULE__,
+        %{
+          inbox: inbox,
+          json: json,
+          actor: actor,
+          id: activity.data["id"],
+          unreachable_since: unreachable_since
+        }
+      )
+    end)
+  end
+end
-- 
cgit v1.2.3


From 0afc8d7856c9fe37de338d1e9365563d986c9319 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 03:43:53 +0000
Subject: federator: publisher: integrate job queue, simplify publish_one logic

---
 lib/pleroma/web/federator/publisher.ex | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/lib/pleroma/web/federator/publisher.ex b/lib/pleroma/web/federator/publisher.ex
index 36277fd7e..2e533ae94 100644
--- a/lib/pleroma/web/federator/publisher.ex
+++ b/lib/pleroma/web/federator/publisher.ex
@@ -3,6 +3,10 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Web.Federator.Publisher do
+  alias Pleroma.Web.Federator.RetryQueue
+
+  require Logger
+
   @moduledoc """
   Defines the contract used by federation implementations to publish messages to
   their peers.
@@ -24,15 +28,26 @@ defmodule Pleroma.Web.Federator.Publisher do
   """
   @callback publish(Pleroma.User.t(), Pleroma.Activity.t()) :: :ok | {:error, any()}
 
-  @doc """
-  Enqueues work generated by the federation module.
-  """
-  @spec enqueue(module(), keyword()) :: :ok
-  def enqueue(module, args), do: PleromaJobQueue.enqueue(:federation_outgoing, module, args)
-
   @doc """
   Enqueue publishing a single activity.
   """
   @spec enqueue_one(module(), Map.t()) :: :ok
-  def enqueue_one(module, %{} = args), do: enqueue(module, [:publish_one, args])
+  def enqueue_one(module, %{} = params),
+    do: PleromaJobQueue.enqueue(:federation_outgoing, __MODULE__, [:publish_one, module, params])
+
+  @spec perform(atom(), module(), any()) :: {:ok, any()} | {:error, any()}
+  def perform(:publish_one, module, params) do
+    case apply(module, :publish_one, [params]) do
+      {:ok, _} ->
+        :ok
+
+      {:error, _} ->
+        RetryQueue.enqueue(params, module)
+    end
+  end
+
+  def perform(type, _, _) do
+    Logger.debug("Unknown task: #{type}")
+    {:error, "Don't know what to do with this"}
+  end
 end
-- 
cgit v1.2.3


From 10695a28d28d74f4b6b9bba20af66b506b662c07 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 03:55:17 +0000
Subject: federator: publisher: add publish() wrapper

---
 config/config.exs                      |  3 +++
 lib/pleroma/web/federator/publisher.ex | 24 +++++++++++++++++++-----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/config/config.exs b/config/config.exs
index 1e64b79a7..37803383a 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -212,6 +212,9 @@ config :pleroma, :instance,
   registrations_open: true,
   federating: true,
   federation_reachability_timeout_days: 7,
+  federation_publisher_modules: [
+    Pleroma.Web.ActivityPub.Publisher
+  ],
   allow_relay: true,
   rewrite_policy: Pleroma.Web.ActivityPub.MRF.NoOpPolicy,
   public: true,
diff --git a/lib/pleroma/web/federator/publisher.ex b/lib/pleroma/web/federator/publisher.ex
index 2e533ae94..8777a3deb 100644
--- a/lib/pleroma/web/federator/publisher.ex
+++ b/lib/pleroma/web/federator/publisher.ex
@@ -3,6 +3,9 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Web.Federator.Publisher do
+  alias Pleroma.Activity
+  alias Pleroma.Config
+  alias Pleroma.User
   alias Pleroma.Web.Federator.RetryQueue
 
   require Logger
@@ -23,11 +26,6 @@ defmodule Pleroma.Web.Federator.Publisher do
   """
   @callback publish_one(Map.t()) :: {:ok, Map.t()} | {:error, any()}
 
-  @doc """
-  Relays an activity to all specified peers.
-  """
-  @callback publish(Pleroma.User.t(), Pleroma.Activity.t()) :: :ok | {:error, any()}
-
   @doc """
   Enqueue publishing a single activity.
   """
@@ -50,4 +48,20 @@ defmodule Pleroma.Web.Federator.Publisher do
     Logger.debug("Unknown task: #{type}")
     {:error, "Don't know what to do with this"}
   end
+
+  @doc """
+  Relays an activity to all specified peers.
+  """
+  @callback publish(Pleroma.User.t(), Pleroma.Activity.t()) :: :ok | {:error, any()}
+
+  @spec publish(Pleroma.User.t(), Pleroma.Activity.t()) :: :ok
+  def publish(%User{} = user, %Activity{} = activity) do
+    Config.get([:instance, :federation_publisher_modules])
+    |> Enum.each(fn module ->
+      Logger.info("Publishing #{activity.data["id"]} using #{inspect(module)}")
+      module.publish(user, activity)
+    end)
+
+    :ok
+  end
 end
-- 
cgit v1.2.3


From f7a6a37c4eb98e354fbcd98ea19c9207d891e993 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 03:56:49 +0000
Subject: federator: remove no longer used :publish_single_ap

---
 lib/pleroma/web/federator/federator.ex | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/lib/pleroma/web/federator/federator.ex b/lib/pleroma/web/federator/federator.ex
index 29e178ba9..d8534b365 100644
--- a/lib/pleroma/web/federator/federator.ex
+++ b/lib/pleroma/web/federator/federator.ex
@@ -42,10 +42,6 @@ defmodule Pleroma.Web.Federator do
     PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:publish, activity], priority)
   end
 
-  def publish_single_ap(params) do
-    PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:publish_single_ap, params])
-  end
-
   def publish_single_websub(websub) do
     PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:publish_single_websub, websub])
   end
@@ -157,16 +153,6 @@ defmodule Pleroma.Web.Federator do
     Salmon.send_to_user(params)
   end
 
-  def perform(:publish_single_ap, params) do
-    case ActivityPub.publish_one(params) do
-      {:ok, _} ->
-        :ok
-
-      {:error, _} ->
-        RetryQueue.enqueue(params, ActivityPub)
-    end
-  end
-
   def perform(
         :publish_single_websub,
         %{xml: _xml, topic: _topic, callback: _callback, secret: _secret} = params
-- 
cgit v1.2.3


From 676752bb8367ec6b5831c7dbd2aad993b1fe45aa Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 03:57:10 +0000
Subject: federator: hook up Publisher.publish()

---
 lib/pleroma/web/federator/federator.ex | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/web/federator/federator.ex b/lib/pleroma/web/federator/federator.ex
index d8534b365..ef2708c07 100644
--- a/lib/pleroma/web/federator/federator.ex
+++ b/lib/pleroma/web/federator/federator.ex
@@ -11,6 +11,7 @@ defmodule Pleroma.Web.Federator do
   alias Pleroma.Web.ActivityPub.Transmogrifier
   alias Pleroma.Web.ActivityPub.Utils
   alias Pleroma.Web.ActivityPub.Visibility
+  alias Pleroma.Web.Federator.Publisher
   alias Pleroma.Web.Federator.RetryQueue
   alias Pleroma.Web.OStatus
   alias Pleroma.Web.Salmon
@@ -106,8 +107,7 @@ defmodule Pleroma.Web.Federator do
         end
       end
 
-      Logger.info(fn -> "Sending #{activity.data["id"]} out via AP" end)
-      Pleroma.Web.ActivityPub.ActivityPub.publish(actor, activity)
+      Publisher.publish(actor, activity)
     end
   end
 
-- 
cgit v1.2.3


From 85377c0b67cf82fdf7e49608b94aec80ace74c4d Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 04:00:55 +0000
Subject: federator: move activitypub relaying to the AP publisher module

---
 lib/pleroma/web/activity_pub/publisher.ex | 7 +++++++
 lib/pleroma/web/federator/federator.ex    | 6 ------
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex
index ee9f0fdd3..11e54b77d 100644
--- a/lib/pleroma/web/activity_pub/publisher.ex
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@@ -4,8 +4,10 @@
 
 defmodule Pleroma.Web.ActivityPub.Publisher do
   alias Pleroma.Activity
+  alias Pleroma.Config
   alias Pleroma.Instances
   alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Relay
   alias Pleroma.Web.ActivityPub.Transmogrifier
 
   import Pleroma.Web.ActivityPub.Visibility
@@ -104,6 +106,11 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
 
     public = is_public?(activity)
 
+    if public && Config.get([:instance, :allow_relay]) do
+      Logger.info(fn -> "Relaying #{activity.data["id"]} out" end)
+      Relay.publish(activity)
+    end
+
     {:ok, data} = Transmogrifier.prepare_outgoing(activity.data)
     json = Jason.encode!(data)
 
diff --git a/lib/pleroma/web/federator/federator.ex b/lib/pleroma/web/federator/federator.ex
index ef2708c07..252d3b009 100644
--- a/lib/pleroma/web/federator/federator.ex
+++ b/lib/pleroma/web/federator/federator.ex
@@ -7,7 +7,6 @@ defmodule Pleroma.Web.Federator do
   alias Pleroma.Object.Containment
   alias Pleroma.User
   alias Pleroma.Web.ActivityPub.ActivityPub
-  alias Pleroma.Web.ActivityPub.Relay
   alias Pleroma.Web.ActivityPub.Transmogrifier
   alias Pleroma.Web.ActivityPub.Utils
   alias Pleroma.Web.ActivityPub.Visibility
@@ -100,11 +99,6 @@ defmodule Pleroma.Web.Federator do
           Logger.info(fn -> "Sending #{activity.data["id"]} out via Salmon" end)
           Pleroma.Web.Salmon.publish(actor, activity)
         end
-
-        if Keyword.get(Application.get_env(:pleroma, :instance), :allow_relay) do
-          Logger.info(fn -> "Relaying #{activity.data["id"]} out" end)
-          Relay.publish(activity)
-        end
       end
 
       Publisher.publish(actor, activity)
-- 
cgit v1.2.3


From 69158f10652e735e3300335dba3856a0233da89f Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 04:04:50 +0000
Subject: ostatus: only as:Public activities are representable

---
 lib/pleroma/web/ostatus/ostatus.ex | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/pleroma/web/ostatus/ostatus.ex b/lib/pleroma/web/ostatus/ostatus.ex
index 4744c6d83..61515b31e 100644
--- a/lib/pleroma/web/ostatus/ostatus.ex
+++ b/lib/pleroma/web/ostatus/ostatus.ex
@@ -16,6 +16,7 @@ defmodule Pleroma.Web.OStatus do
   alias Pleroma.Web
   alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.ActivityPub.Transmogrifier
+  alias Pleroma.Web.ActivityPub.Visibility
   alias Pleroma.Web.OStatus.DeleteHandler
   alias Pleroma.Web.OStatus.FollowHandler
   alias Pleroma.Web.OStatus.NoteHandler
@@ -30,7 +31,7 @@ defmodule Pleroma.Web.OStatus do
       is_nil(object) ->
         false
 
-      object.data["type"] == "Note" ->
+      Visibility.is_public?(activity) && object.data["type"] == "Note" ->
         true
 
       true ->
-- 
cgit v1.2.3


From 2aee62a4565d36983484ead9dda187e9e8188971 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 04:17:17 +0000
Subject: federator: publisher: only attempt publishing if we know the activity
 is representable

---
 lib/pleroma/web/federator/publisher.ex | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/pleroma/web/federator/publisher.ex b/lib/pleroma/web/federator/publisher.ex
index 8777a3deb..67f4b7ba7 100644
--- a/lib/pleroma/web/federator/publisher.ex
+++ b/lib/pleroma/web/federator/publisher.ex
@@ -39,7 +39,7 @@ defmodule Pleroma.Web.Federator.Publisher do
       {:ok, _} ->
         :ok
 
-      {:error, _} ->
+      {:error, _e} ->
         RetryQueue.enqueue(params, module)
     end
   end
@@ -58,8 +58,10 @@ defmodule Pleroma.Web.Federator.Publisher do
   def publish(%User{} = user, %Activity{} = activity) do
     Config.get([:instance, :federation_publisher_modules])
     |> Enum.each(fn module ->
-      Logger.info("Publishing #{activity.data["id"]} using #{inspect(module)}")
-      module.publish(user, activity)
+      if module.is_representable?(activity) do
+        Logger.info("Publishing #{activity.data["id"]} using #{inspect(module)}")
+        module.publish(user, activity)
+      end
     end)
 
     :ok
-- 
cgit v1.2.3


From 179293e51c2e381fdc15c0a291b735750f9cd656 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 04:27:01 +0000
Subject: salmon: refactor to work as a federator publishing module

---
 config/config.exs                      |  3 ++-
 lib/pleroma/web/federator/federator.ex | 12 ------------
 lib/pleroma/web/salmon/salmon.ex       | 34 ++++++++++++++++++++++------------
 3 files changed, 24 insertions(+), 25 deletions(-)

diff --git a/config/config.exs b/config/config.exs
index 37803383a..3dcff3c46 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -213,7 +213,8 @@ config :pleroma, :instance,
   federating: true,
   federation_reachability_timeout_days: 7,
   federation_publisher_modules: [
-    Pleroma.Web.ActivityPub.Publisher
+    Pleroma.Web.ActivityPub.Publisher,
+    Pleroma.Web.Salmon
   ],
   allow_relay: true,
   rewrite_policy: Pleroma.Web.ActivityPub.MRF.NoOpPolicy,
diff --git a/lib/pleroma/web/federator/federator.ex b/lib/pleroma/web/federator/federator.ex
index 252d3b009..c9b245933 100644
--- a/lib/pleroma/web/federator/federator.ex
+++ b/lib/pleroma/web/federator/federator.ex
@@ -13,7 +13,6 @@ defmodule Pleroma.Web.Federator do
   alias Pleroma.Web.Federator.Publisher
   alias Pleroma.Web.Federator.RetryQueue
   alias Pleroma.Web.OStatus
-  alias Pleroma.Web.Salmon
   alias Pleroma.Web.WebFinger
   alias Pleroma.Web.Websub
 
@@ -58,10 +57,6 @@ defmodule Pleroma.Web.Federator do
     PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:refresh_subscriptions])
   end
 
-  def publish_single_salmon(params) do
-    PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:publish_single_salmon, params])
-  end
-
   # Job Worker Callbacks
 
   def perform(:refresh_subscriptions) do
@@ -95,9 +90,6 @@ defmodule Pleroma.Web.Federator do
         if OStatus.is_representable?(activity) do
           Logger.info(fn -> "Sending #{activity.data["id"]} out via WebSub" end)
           Websub.publish(Pleroma.Web.OStatus.feed_path(actor), actor, activity)
-
-          Logger.info(fn -> "Sending #{activity.data["id"]} out via Salmon" end)
-          Pleroma.Web.Salmon.publish(actor, activity)
         end
       end
 
@@ -143,10 +135,6 @@ defmodule Pleroma.Web.Federator do
     end
   end
 
-  def perform(:publish_single_salmon, params) do
-    Salmon.send_to_user(params)
-  end
-
   def perform(
         :publish_single_websub,
         %{xml: _xml, topic: _topic, callback: _callback, secret: _secret} = params
diff --git a/lib/pleroma/web/salmon/salmon.ex b/lib/pleroma/web/salmon/salmon.ex
index 0a9e51656..7b59609c0 100644
--- a/lib/pleroma/web/salmon/salmon.ex
+++ b/lib/pleroma/web/salmon/salmon.ex
@@ -3,12 +3,17 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Web.Salmon do
+  @behaviour Pleroma.Web.Federator.Publisher
+
   @httpoison Application.get_env(:pleroma, :httpoison)
 
   use Bitwise
 
+  alias Pleroma.Activity
   alias Pleroma.Instances
   alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Visibility
+  alias Pleroma.Web.Federator.Publisher
   alias Pleroma.Web.OStatus.ActivityRepresenter
   alias Pleroma.Web.XML
 
@@ -165,12 +170,12 @@ defmodule Pleroma.Web.Salmon do
   end
 
   @doc "Pushes an activity to remote account."
-  def send_to_user(%{recipient: %{info: %{salmon: salmon}}} = params),
-    do: send_to_user(Map.put(params, :recipient, salmon))
+  def publish_one(%{recipient: %{info: %{salmon: salmon}}} = params),
+    do: publish_one(Map.put(params, :recipient, salmon))
 
-  def send_to_user(%{recipient: url, feed: feed, poster: poster} = params) when is_binary(url) do
+  def publish_one(%{recipient: url, feed: feed} = params) when is_binary(url) do
     with {:ok, %{status: code}} when code in 200..299 <-
-           poster.(
+           @httpoison.post(
              url,
              feed,
              [{"Content-Type", "application/magic-envelope+xml"}]
@@ -184,11 +189,11 @@ defmodule Pleroma.Web.Salmon do
       e ->
         unless params[:unreachable_since], do: Instances.set_reachable(url)
         Logger.debug(fn -> "Pushing Salmon to #{url} failed, #{inspect(e)}" end)
-        :error
+        {:error, "Unreachable instance"}
     end
   end
 
-  def send_to_user(_), do: :noop
+  def publish_one(_), do: :noop
 
   @supported_activities [
     "Create",
@@ -199,13 +204,19 @@ defmodule Pleroma.Web.Salmon do
     "Delete"
   ]
 
+  def is_representable?(%Activity{data: %{"type" => type}} = activity)
+      when type in @supported_activities,
+      do: Visibility.is_public?(activity)
+
+  def is_representable?(_), do: false
+
   @doc """
   Publishes an activity to remote accounts
   """
-  @spec publish(User.t(), Pleroma.Activity.t(), Pleroma.HTTP.t()) :: none
-  def publish(user, activity, poster \\ &@httpoison.post/3)
+  @spec publish(User.t(), Pleroma.Activity.t()) :: none
+  def publish(user, activity)
 
-  def publish(%{info: %{keys: keys}} = user, %{data: %{"type" => type}} = activity, poster)
+  def publish(%{info: %{keys: keys}} = user, %{data: %{"type" => type}} = activity)
       when type in @supported_activities do
     feed = ActivityRepresenter.to_simple_form(activity, user, true)
 
@@ -229,15 +240,14 @@ defmodule Pleroma.Web.Salmon do
       |> Enum.each(fn remote_user ->
         Logger.debug(fn -> "Sending Salmon to #{remote_user.ap_id}" end)
 
-        Pleroma.Web.Federator.publish_single_salmon(%{
+        Publisher.enqueue_one(__MODULE__, %{
           recipient: remote_user,
           feed: feed,
-          poster: poster,
           unreachable_since: reachable_urls_metadata[remote_user.info.salmon]
         })
       end)
     end
   end
 
-  def publish(%{id: id}, _, _), do: Logger.debug(fn -> "Keys missing for user #{id}" end)
+  def publish(%{id: id}, _), do: Logger.debug(fn -> "Keys missing for user #{id}" end)
 end
-- 
cgit v1.2.3


From fedaca15a3932897d86f73d836b6b6c2f7860f59 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 04:34:55 +0000
Subject: websub: adapt to work as a federator publishing module

---
 config/config.exs                      |  1 +
 lib/pleroma/web/federator/federator.ex |  4 ----
 lib/pleroma/web/websub/websub.ex       | 16 +++++++++++++++-
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/config/config.exs b/config/config.exs
index 3dcff3c46..6f2aaf297 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -214,6 +214,7 @@ config :pleroma, :instance,
   federation_reachability_timeout_days: 7,
   federation_publisher_modules: [
     Pleroma.Web.ActivityPub.Publisher,
+    Pleroma.Web.Websub,
     Pleroma.Web.Salmon
   ],
   allow_relay: true,
diff --git a/lib/pleroma/web/federator/federator.ex b/lib/pleroma/web/federator/federator.ex
index c9b245933..9a377da68 100644
--- a/lib/pleroma/web/federator/federator.ex
+++ b/lib/pleroma/web/federator/federator.ex
@@ -41,10 +41,6 @@ defmodule Pleroma.Web.Federator do
     PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:publish, activity], priority)
   end
 
-  def publish_single_websub(websub) do
-    PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:publish_single_websub, websub])
-  end
-
   def verify_websub(websub) do
     PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:verify_websub, websub])
   end
diff --git a/lib/pleroma/web/websub/websub.ex b/lib/pleroma/web/websub/websub.ex
index 3ffa6b416..1fb993282 100644
--- a/lib/pleroma/web/websub/websub.ex
+++ b/lib/pleroma/web/websub/websub.ex
@@ -4,10 +4,13 @@
 
 defmodule Pleroma.Web.Websub do
   alias Ecto.Changeset
+  alias Pleroma.Activity
   alias Pleroma.Instances
   alias Pleroma.Repo
+  alias Pleroma.Web.ActivityPub.Visibility
   alias Pleroma.Web.Endpoint
   alias Pleroma.Web.Federator
+  alias Pleroma.Web.Federator.Publisher
   alias Pleroma.Web.OStatus
   alias Pleroma.Web.OStatus.FeedRepresenter
   alias Pleroma.Web.Router.Helpers
@@ -18,6 +21,8 @@ defmodule Pleroma.Web.Websub do
 
   import Ecto.Query
 
+  @behaviour Pleroma.Web.Federator.Publisher
+
   @httpoison Application.get_env(:pleroma, :httpoison)
 
   def verify(subscription, getter \\ &@httpoison.get/3) do
@@ -56,6 +61,13 @@ defmodule Pleroma.Web.Websub do
     "Undo",
     "Delete"
   ]
+
+  def is_representable?(%Activity{data: %{"type" => type}} = activity)
+      when type in @supported_activities,
+      do: Visibility.is_public?(activity)
+
+  def is_representable?(_), do: false
+
   def publish(topic, user, %{data: %{"type" => type}} = activity)
       when type in @supported_activities do
     response =
@@ -88,12 +100,14 @@ defmodule Pleroma.Web.Websub do
         unreachable_since: reachable_callbacks_metadata[sub.callback]
       }
 
-      Federator.publish_single_websub(data)
+      Publisher.enqueue_one(__MODULE__, data)
     end)
   end
 
   def publish(_, _, _), do: ""
 
+  def publish(actor, activity), do: publish(Pleroma.Web.OStatus.feed_path(actor), actor, activity)
+
   def sign(secret, doc) do
     :crypto.hmac(:sha, secret, to_string(doc)) |> Base.encode16() |> String.downcase()
   end
-- 
cgit v1.2.3


From c23276a59aa57a89e27c2e2f46d701392917b9a0 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 05:01:00 +0000
Subject: activitypub: publisher: fixups

---
 lib/pleroma/web/activity_pub/publisher.ex | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex
index 11e54b77d..5d72299a5 100644
--- a/lib/pleroma/web/activity_pub/publisher.ex
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@@ -26,10 +26,11 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
   Determine if an activity can be represented by running it through Transmogrifier.
   """
   def is_representable?(%Activity{} = activity) do
-    with %{} = _data <- Transmogrifier.prepare_outgoing(activity.data) do
+    with {:ok, _data} <- Transmogrifier.prepare_outgoing(activity.data) do
       true
     else
-      _e -> false
+      _e ->
+        false
     end
   end
 
-- 
cgit v1.2.3


From 55fa4b812a30feddc0c60d7ade03d50193871d22 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 05:01:15 +0000
Subject: federator: websub removal

---
 lib/pleroma/web/federator/federator.ex | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/lib/pleroma/web/federator/federator.ex b/lib/pleroma/web/federator/federator.ex
index 9a377da68..8621eda95 100644
--- a/lib/pleroma/web/federator/federator.ex
+++ b/lib/pleroma/web/federator/federator.ex
@@ -9,10 +9,8 @@ defmodule Pleroma.Web.Federator do
   alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.ActivityPub.Transmogrifier
   alias Pleroma.Web.ActivityPub.Utils
-  alias Pleroma.Web.ActivityPub.Visibility
   alias Pleroma.Web.Federator.Publisher
   alias Pleroma.Web.Federator.RetryQueue
-  alias Pleroma.Web.OStatus
   alias Pleroma.Web.WebFinger
   alias Pleroma.Web.Websub
 
@@ -82,13 +80,6 @@ defmodule Pleroma.Web.Federator do
     with actor when not is_nil(actor) <- User.get_cached_by_ap_id(activity.data["actor"]) do
       {:ok, actor} = WebFinger.ensure_keys_present(actor)
 
-      if Visibility.is_public?(activity) do
-        if OStatus.is_representable?(activity) do
-          Logger.info(fn -> "Sending #{activity.data["id"]} out via WebSub" end)
-          Websub.publish(Pleroma.Web.OStatus.feed_path(actor), actor, activity)
-        end
-      end
-
       Publisher.publish(actor, activity)
     end
   end
-- 
cgit v1.2.3


From 2b847d4addc5d018fdb23c38e5b5afa66c8ac772 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 04:08:41 +0000
Subject: tests: chase federator publish_single_foo removals

---
 test/web/federator_test.exs | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/test/web/federator_test.exs b/test/web/federator_test.exs
index 52729eb50..0f43bc8f2 100644
--- a/test/web/federator_test.exs
+++ b/test/web/federator_test.exs
@@ -58,7 +58,7 @@ defmodule Pleroma.Web.FederatorTest do
 
   describe "Targets reachability filtering in `publish`" do
     test_with_mock "it federates only to reachable instances via AP",
-                   Federator,
+                   Pleroma.Web.ActivityPub.Publisher,
                    [:passthrough],
                    [] do
       user = insert(:user)
@@ -88,13 +88,18 @@ defmodule Pleroma.Web.FederatorTest do
       {:ok, _activity} =
         CommonAPI.post(user, %{"status" => "HI @nick1@domain.com, @nick2@domain2.com!"})
 
-      assert called(Federator.publish_single_ap(%{inbox: inbox1, unreachable_since: dt}))
+      assert called(
+               Pleroma.Web.ActivityPub.Publisher.publish_one(%{
+                 inbox: inbox1,
+                 unreachable_since: dt
+               })
+             )
 
-      refute called(Federator.publish_single_ap(%{inbox: inbox2}))
+      refute called(Pleroma.Web.ActivityPub.Publisher.publish_one(%{inbox: inbox2}))
     end
 
     test_with_mock "it federates only to reachable instances via Websub",
-                   Federator,
+                   Pleroma.Web.Websub,
                    [:passthrough],
                    [] do
       user = insert(:user)
@@ -122,17 +127,17 @@ defmodule Pleroma.Web.FederatorTest do
       {:ok, _activity} = CommonAPI.post(user, %{"status" => "HI"})
 
       assert called(
-               Federator.publish_single_websub(%{
+               Pleroma.Web.Websub.publish_one(%{
                  callback: sub2.callback,
                  unreachable_since: dt
                })
              )
 
-      refute called(Federator.publish_single_websub(%{callback: sub1.callback}))
+      refute called(Pleroma.Web.Websub.publish_one(%{callback: sub1.callback}))
     end
 
     test_with_mock "it federates only to reachable instances via Salmon",
-                   Federator,
+                   Pleroma.Web.Salmon,
                    [:passthrough],
                    [] do
       user = insert(:user)
@@ -162,13 +167,13 @@ defmodule Pleroma.Web.FederatorTest do
         CommonAPI.post(user, %{"status" => "HI @nick1@domain.com, @nick2@domain2.com!"})
 
       assert called(
-               Federator.publish_single_salmon(%{
+               Pleroma.Web.Salmon.publish_one(%{
                  recipient: remote_user2,
                  unreachable_since: dt
                })
              )
 
-      refute called(Federator.publish_single_websub(%{recipient: remote_user1}))
+      refute called(Pleroma.Web.Salmon.publish_one(%{recipient: remote_user1}))
     end
   end
 
-- 
cgit v1.2.3


From 2a4e41acb4383f6a9dd60a65d8251b27130fe7cc Mon Sep 17 00:00:00 2001
From: Sachin Joshi <satchin.joshi@gmail.com>
Date: Sun, 12 May 2019 12:50:23 +0545
Subject: update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b0a761c4a..b9c9538b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -61,6 +61,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Deps: Updated Ecto to 3.0.7
 - Don't ship finmoji by default, they can be installed as an emoji pack
 - Mastodon API: Added support max_id & since_id for bookmark timeline endpoints.
+- Admin API: Move the user related API to `api/pleroma/admin/users`
 
 ### Fixed
 - Added an FTS index on objects. Running `vacuum analyze` and setting a larger `work_mem` is recommended.
-- 
cgit v1.2.3


From d823eb921b6710affe5e30a683155b645a5bd1d2 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 14:35:38 +0000
Subject: tests: fix salmon tests

---
 test/web/salmon/salmon_test.exs | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/test/web/salmon/salmon_test.exs b/test/web/salmon/salmon_test.exs
index 7532578ca..232082779 100644
--- a/test/web/salmon/salmon_test.exs
+++ b/test/web/salmon/salmon_test.exs
@@ -7,7 +7,9 @@ defmodule Pleroma.Web.Salmon.SalmonTest do
   alias Pleroma.Activity
   alias Pleroma.Repo
   alias Pleroma.User
+  alias Pleroma.Web.Federator.Publisher
   alias Pleroma.Web.Salmon
+  import Mock
   import Pleroma.Factory
 
   @magickey "RSA.pu0s-halox4tu7wmES1FVSx6u-4wc0YrUFXcqWXZG4-27UmbCOpMQftRCldNRfyA-qLbz-eqiwQhh-1EwUvjsD4cYbAHNGHwTvDOyx5AKthQUP44ykPv7kjKGh3DWKySJvcs9tlUG87hlo7AvnMo9pwRS_Zz2CacQ-MKaXyDepk=.AQAB"
@@ -77,7 +79,10 @@ defmodule Pleroma.Web.Salmon.SalmonTest do
              "RSA.uzg6r1peZU0vXGADWxGJ0PE34WvmhjUmydbX5YYdOiXfODVLwCMi1umGoqUDm-mRu4vNEdFBVJU1CpFA7dKzWgIsqsa501i2XqElmEveXRLvNRWFB6nG03Q5OUY2as8eE54BJm0p20GkMfIJGwP6TSFb-ICp3QjzbatuSPJ6xCE=.AQAB"
   end
 
-  test "it pushes an activity to remote accounts it's addressed to" do
+  test_with_mock "it pushes an activity to remote accounts it's addressed to",
+                 Publisher,
+                 [:passthrough],
+                 [] do
     user_data = %{
       info: %{
         salmon: "http://test-example.org/salmon"
@@ -102,10 +107,8 @@ defmodule Pleroma.Web.Salmon.SalmonTest do
     user = User.get_cached_by_ap_id(activity.data["actor"])
     {:ok, user} = Pleroma.Web.WebFinger.ensure_keys_present(user)
 
-    poster = fn url, _data, _headers ->
-      assert url == "http://test-example.org/salmon"
-    end
+    Salmon.publish(user, activity)
 
-    Salmon.publish(user, activity, poster)
+    assert called(Publisher.enqueue_one(Salmon, %{recipient: mentioned_user}))
   end
 end
-- 
cgit v1.2.3


From 582bd9d170446d3ef5312f3266d960b1e22a9d18 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 14:38:40 +0000
Subject: tests: fix AP test failures

---
 test/web/activity_pub/activity_pub_test.exs | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/test/web/activity_pub/activity_pub_test.exs b/test/web/activity_pub/activity_pub_test.exs
index 1e056b7ee..0f90aa1ac 100644
--- a/test/web/activity_pub/activity_pub_test.exs
+++ b/test/web/activity_pub/activity_pub_test.exs
@@ -10,6 +10,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
   alias Pleroma.Object
   alias Pleroma.User
   alias Pleroma.Web.ActivityPub.ActivityPub
+  alias Pleroma.Web.ActivityPub.Publisher
   alias Pleroma.Web.ActivityPub.Utils
   alias Pleroma.Web.CommonAPI
 
@@ -963,8 +964,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
 
       private_activity_1 = Activity.get_by_ap_id_with_object(private_activity_1.data["id"])
 
-      assert [public_activity, private_activity_1, private_activity_3] ==
-               activities
+      assert [public_activity, private_activity_1, private_activity_3] == activities
 
       assert length(activities) == 3
 
@@ -1057,7 +1057,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       actor = insert(:user)
       inbox = "http://200.site/users/nick1/inbox"
 
-      assert {:ok, _} = ActivityPub.publish_one(%{inbox: inbox, json: "{}", actor: actor, id: 1})
+      assert {:ok, _} = Publisher.publish_one(%{inbox: inbox, json: "{}", actor: actor, id: 1})
 
       assert called(Instances.set_reachable(inbox))
     end
@@ -1070,7 +1070,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       inbox = "http://200.site/users/nick1/inbox"
 
       assert {:ok, _} =
-               ActivityPub.publish_one(%{
+               Publisher.publish_one(%{
                  inbox: inbox,
                  json: "{}",
                  actor: actor,
@@ -1089,7 +1089,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       inbox = "http://200.site/users/nick1/inbox"
 
       assert {:ok, _} =
-               ActivityPub.publish_one(%{
+               Publisher.publish_one(%{
                  inbox: inbox,
                  json: "{}",
                  actor: actor,
@@ -1107,8 +1107,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       actor = insert(:user)
       inbox = "http://404.site/users/nick1/inbox"
 
-      assert {:error, _} =
-               ActivityPub.publish_one(%{inbox: inbox, json: "{}", actor: actor, id: 1})
+      assert {:error, _} = Publisher.publish_one(%{inbox: inbox, json: "{}", actor: actor, id: 1})
 
       assert called(Instances.set_unreachable(inbox))
     end
@@ -1120,8 +1119,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       actor = insert(:user)
       inbox = "http://connrefused.site/users/nick1/inbox"
 
-      assert {:error, _} =
-               ActivityPub.publish_one(%{inbox: inbox, json: "{}", actor: actor, id: 1})
+      assert {:error, _} = Publisher.publish_one(%{inbox: inbox, json: "{}", actor: actor, id: 1})
 
       assert called(Instances.set_unreachable(inbox))
     end
@@ -1133,7 +1131,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       actor = insert(:user)
       inbox = "http://200.site/users/nick1/inbox"
 
-      assert {:ok, _} = ActivityPub.publish_one(%{inbox: inbox, json: "{}", actor: actor, id: 1})
+      assert {:ok, _} = Publisher.publish_one(%{inbox: inbox, json: "{}", actor: actor, id: 1})
 
       refute called(Instances.set_unreachable(inbox))
     end
@@ -1146,7 +1144,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       inbox = "http://connrefused.site/users/nick1/inbox"
 
       assert {:error, _} =
-               ActivityPub.publish_one(%{
+               Publisher.publish_one(%{
                  inbox: inbox,
                  json: "{}",
                  actor: actor,
-- 
cgit v1.2.3


From 80759f012eb2183bc24f84c4a1f2a5dbe94762ce Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 19:04:37 +0000
Subject: xml builder: properly escape quotes

---
 lib/xml_builder.ex | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/xml_builder.ex b/lib/xml_builder.ex
index 88f8ce2a3..b58602c7b 100644
--- a/lib/xml_builder.ex
+++ b/lib/xml_builder.ex
@@ -35,6 +35,7 @@ defmodule Pleroma.XmlBuilder do
   defp make_open_tag(tag, attributes) do
     attributes_string =
       for {attribute, value} <- attributes do
+        value = String.replace(value, "\"", "&quot;")
         "#{attribute}=\"#{value}\""
       end
       |> Enum.join(" ")
-- 
cgit v1.2.3


From 28f7f4c6dec681ae292767623cbad553b2a0f5b5 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 19:05:03 +0000
Subject: webfinger: build the response based on enabled federation modules

---
 lib/pleroma/web/activity_pub/publisher.ex | 11 ++++++
 lib/pleroma/web/federator/publisher.ex    | 13 ++++++
 lib/pleroma/web/salmon/salmon.ex          | 14 +++++++
 lib/pleroma/web/web_finger/web_finger.ex  | 66 +++++++++----------------------
 lib/pleroma/web/websub/websub.ex          | 15 +++++++
 5 files changed, 71 insertions(+), 48 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex
index 5d72299a5..5c97485c8 100644
--- a/lib/pleroma/web/activity_pub/publisher.ex
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@@ -136,4 +136,15 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       )
     end)
   end
+
+  def gather_webfinger_links(%User{} = user) do
+    [
+      %{"rel" => "self", "type" => "application/activity+json", "href" => user.ap_id},
+      %{
+        "rel" => "self",
+        "type" => "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"",
+        "href" => user.ap_id
+      }
+    ]
+  end
 end
diff --git a/lib/pleroma/web/federator/publisher.ex b/lib/pleroma/web/federator/publisher.ex
index 67f4b7ba7..112a0574f 100644
--- a/lib/pleroma/web/federator/publisher.ex
+++ b/lib/pleroma/web/federator/publisher.ex
@@ -66,4 +66,17 @@ defmodule Pleroma.Web.Federator.Publisher do
 
     :ok
   end
+
+  @doc """
+  Gathers links used by an outgoing federation module for WebFinger output.
+  """
+  @callback gather_webfinger_links(Pleroma.User.t()) :: list()
+
+  @spec gather_webfinger_links(Pleroma.User.t()) :: list()
+  def gather_webfinger_links(%User{} = user) do
+    Config.get([:instance, :federation_publisher_modules])
+    |> Enum.reduce([], fn module, links ->
+      links ++ module.gather_webfinger_links(user)
+    end)
+  end
 end
diff --git a/lib/pleroma/web/salmon/salmon.ex b/lib/pleroma/web/salmon/salmon.ex
index 7b59609c0..92e85b5e9 100644
--- a/lib/pleroma/web/salmon/salmon.ex
+++ b/lib/pleroma/web/salmon/salmon.ex
@@ -14,6 +14,7 @@ defmodule Pleroma.Web.Salmon do
   alias Pleroma.User
   alias Pleroma.Web.ActivityPub.Visibility
   alias Pleroma.Web.Federator.Publisher
+  alias Pleroma.Web.OStatus
   alias Pleroma.Web.OStatus.ActivityRepresenter
   alias Pleroma.Web.XML
 
@@ -250,4 +251,17 @@ defmodule Pleroma.Web.Salmon do
   end
 
   def publish(%{id: id}, _), do: Logger.debug(fn -> "Keys missing for user #{id}" end)
+
+  def gather_webfinger_links(%User{} = user) do
+    {:ok, _private, public} = keys_from_pem(user.info.keys)
+    magic_key = encode_key(public)
+
+    [
+      %{"rel" => "salmon", "href" => OStatus.salmon_path(user)},
+      %{
+        "rel" => "magic-public-key",
+        "href" => "data:application/magic-public-key,#{magic_key}"
+      }
+    ]
+  end
 end
diff --git a/lib/pleroma/web/web_finger/web_finger.ex b/lib/pleroma/web/web_finger/web_finger.ex
index a3b0bf999..3a3b98a10 100644
--- a/lib/pleroma/web/web_finger/web_finger.ex
+++ b/lib/pleroma/web/web_finger/web_finger.ex
@@ -7,7 +7,7 @@ defmodule Pleroma.Web.WebFinger do
 
   alias Pleroma.User
   alias Pleroma.Web
-  alias Pleroma.Web.OStatus
+  alias Pleroma.Web.Federator.Publisher
   alias Pleroma.Web.Salmon
   alias Pleroma.Web.XML
   alias Pleroma.XmlBuilder
@@ -50,70 +50,40 @@ defmodule Pleroma.Web.WebFinger do
     end
   end
 
+  defp gather_links(%User{} = user) do
+    [
+      %{
+        "rel" => "http://webfinger.net/rel/profile-page",
+        "type" => "text/html",
+        "href" => user.ap_id
+      }
+    ] ++ Publisher.gather_webfinger_links(user)
+  end
+
   def represent_user(user, "JSON") do
     {:ok, user} = ensure_keys_present(user)
-    {:ok, _private, public} = Salmon.keys_from_pem(user.info.keys)
-    magic_key = Salmon.encode_key(public)
 
     %{
       "subject" => "acct:#{user.nickname}@#{Pleroma.Web.Endpoint.host()}",
       "aliases" => [user.ap_id],
-      "links" => [
-        %{
-          "rel" => "http://schemas.google.com/g/2010#updates-from",
-          "type" => "application/atom+xml",
-          "href" => OStatus.feed_path(user)
-        },
-        %{
-          "rel" => "http://webfinger.net/rel/profile-page",
-          "type" => "text/html",
-          "href" => user.ap_id
-        },
-        %{"rel" => "salmon", "href" => OStatus.salmon_path(user)},
-        %{
-          "rel" => "magic-public-key",
-          "href" => "data:application/magic-public-key,#{magic_key}"
-        },
-        %{"rel" => "self", "type" => "application/activity+json", "href" => user.ap_id},
-        %{
-          "rel" => "self",
-          "type" => "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"",
-          "href" => user.ap_id
-        },
-        %{
-          "rel" => "http://ostatus.org/schema/1.0/subscribe",
-          "template" => OStatus.remote_follow_path()
-        }
-      ]
+      "links" => gather_links(user)
     }
   end
 
   def represent_user(user, "XML") do
     {:ok, user} = ensure_keys_present(user)
-    {:ok, _private, public} = Salmon.keys_from_pem(user.info.keys)
-    magic_key = Salmon.encode_key(public)
+
+    links =
+      gather_links(user)
+      |> Enum.map(fn link -> {:Link, link} end)
 
     {
       :XRD,
       %{xmlns: "http://docs.oasis-open.org/ns/xri/xrd-1.0"},
       [
         {:Subject, "acct:#{user.nickname}@#{Pleroma.Web.Endpoint.host()}"},
-        {:Alias, user.ap_id},
-        {:Link,
-         %{
-           rel: "http://schemas.google.com/g/2010#updates-from",
-           type: "application/atom+xml",
-           href: OStatus.feed_path(user)
-         }},
-        {:Link,
-         %{rel: "http://webfinger.net/rel/profile-page", type: "text/html", href: user.ap_id}},
-        {:Link, %{rel: "salmon", href: OStatus.salmon_path(user)}},
-        {:Link,
-         %{rel: "magic-public-key", href: "data:application/magic-public-key,#{magic_key}"}},
-        {:Link, %{rel: "self", type: "application/activity+json", href: user.ap_id}},
-        {:Link,
-         %{rel: "http://ostatus.org/schema/1.0/subscribe", template: OStatus.remote_follow_path()}}
-      ]
+        {:Alias, user.ap_id}
+      ] ++ links
     }
     |> XmlBuilder.to_doc()
   end
diff --git a/lib/pleroma/web/websub/websub.ex b/lib/pleroma/web/websub/websub.ex
index 1fb993282..2ce6dcc19 100644
--- a/lib/pleroma/web/websub/websub.ex
+++ b/lib/pleroma/web/websub/websub.ex
@@ -7,6 +7,7 @@ defmodule Pleroma.Web.Websub do
   alias Pleroma.Activity
   alias Pleroma.Instances
   alias Pleroma.Repo
+  alias Pleroma.User
   alias Pleroma.Web.ActivityPub.Visibility
   alias Pleroma.Web.Endpoint
   alias Pleroma.Web.Federator
@@ -313,4 +314,18 @@ defmodule Pleroma.Web.Websub do
         {:error, response}
     end
   end
+
+  def gather_webfinger_links(%User{} = user) do
+    [
+      %{
+        "rel" => "http://schemas.google.com/g/2010#updates-from",
+        "type" => "application/atom+xml",
+        "href" => OStatus.feed_path(user)
+      },
+      %{
+        "rel" => "http://ostatus.org/schema/1.0/subscribe",
+        "template" => OStatus.remote_follow_path()
+      }
+    ]
+  end
 end
-- 
cgit v1.2.3


From 44b182732efe2d8571aa54e6062637e7e42021ce Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 12 May 2019 19:15:29 +0000
Subject: nodeinfo: gather supported protocol names from federation modules

---
 lib/pleroma/web/activity_pub/publisher.ex       |  2 ++
 lib/pleroma/web/federator/publisher.ex          | 13 +++++++++++++
 lib/pleroma/web/nodeinfo/nodeinfo_controller.ex |  3 ++-
 lib/pleroma/web/salmon/salmon.ex                |  2 ++
 lib/pleroma/web/websub/websub.ex                |  2 ++
 5 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex
index 5c97485c8..8e3af0a81 100644
--- a/lib/pleroma/web/activity_pub/publisher.ex
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@@ -147,4 +147,6 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       }
     ]
   end
+
+  def gather_nodeinfo_protocol_names, do: ["activitypub"]
 end
diff --git a/lib/pleroma/web/federator/publisher.ex b/lib/pleroma/web/federator/publisher.ex
index 112a0574f..916bcdcba 100644
--- a/lib/pleroma/web/federator/publisher.ex
+++ b/lib/pleroma/web/federator/publisher.ex
@@ -79,4 +79,17 @@ defmodule Pleroma.Web.Federator.Publisher do
       links ++ module.gather_webfinger_links(user)
     end)
   end
+
+  @doc """
+  Gathers nodeinfo protocol names supported by the federation module.
+  """
+  @callback gather_nodeinfo_protocol_names() :: list()
+
+  @spec gather_nodeinfo_protocol_names() :: list()
+  def gather_nodeinfo_protocol_names do
+    Config.get([:instance, :federation_publisher_modules])
+    |> Enum.reduce([], fn module, links ->
+      links ++ module.gather_nodeinfo_protocol_names()
+    end)
+  end
 end
diff --git a/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex b/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
index 216a962bd..3bf2a0fbc 100644
--- a/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
+++ b/lib/pleroma/web/nodeinfo/nodeinfo_controller.ex
@@ -10,6 +10,7 @@ defmodule Pleroma.Web.Nodeinfo.NodeinfoController do
   alias Pleroma.User
   alias Pleroma.Web
   alias Pleroma.Web.ActivityPub.MRF
+  alias Pleroma.Web.Federator.Publisher
 
   plug(Pleroma.Web.FederatingPlug)
 
@@ -137,7 +138,7 @@ defmodule Pleroma.Web.Nodeinfo.NodeinfoController do
         name: Pleroma.Application.name() |> String.downcase(),
         version: Pleroma.Application.version()
       },
-      protocols: ["ostatus", "activitypub"],
+      protocols: Publisher.gather_nodeinfo_protocol_names(),
       services: %{
         inbound: [],
         outbound: []
diff --git a/lib/pleroma/web/salmon/salmon.ex b/lib/pleroma/web/salmon/salmon.ex
index 92e85b5e9..42709ab47 100644
--- a/lib/pleroma/web/salmon/salmon.ex
+++ b/lib/pleroma/web/salmon/salmon.ex
@@ -264,4 +264,6 @@ defmodule Pleroma.Web.Salmon do
       }
     ]
   end
+
+  def gather_nodeinfo_protocol_names, do: []
 end
diff --git a/lib/pleroma/web/websub/websub.ex b/lib/pleroma/web/websub/websub.ex
index 2ce6dcc19..7ad0414ab 100644
--- a/lib/pleroma/web/websub/websub.ex
+++ b/lib/pleroma/web/websub/websub.ex
@@ -328,4 +328,6 @@ defmodule Pleroma.Web.Websub do
       }
     ]
   end
+
+  def gather_nodeinfo_protocol_names, do: ["ostatus"]
 end
-- 
cgit v1.2.3


From 15cda998f3bdc03f58c30e34e35ebc026a90cf29 Mon Sep 17 00:00:00 2001
From: rinpatch <rinpatch@sdf.org>
Date: Mon, 13 May 2019 10:32:04 +0300
Subject: Add a test to ensure create_or_bump_for does not normalize objects
 before checking the activity type

---
 test/conversation_test.exs | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/test/conversation_test.exs b/test/conversation_test.exs
index f3300e7d1..864b2eb03 100644
--- a/test/conversation_test.exs
+++ b/test/conversation_test.exs
@@ -4,7 +4,9 @@
 
 defmodule Pleroma.ConversationTest do
   use Pleroma.DataCase
+  alias Pleroma.Activity
   alias Pleroma.Conversation
+  alias Pleroma.Object
   alias Pleroma.Web.CommonAPI
 
   import Pleroma.Factory
@@ -134,4 +136,40 @@ defmodule Pleroma.ConversationTest do
 
     assert {:error, _} = Conversation.create_or_bump_for(activity)
   end
+
+  test "create_or_bump_for does not normalize objects before checking the activity type" do
+    note = insert(:note)
+    note_id = note.data["id"]
+    Repo.delete(note)
+    refute Object.get_by_ap_id(note_id)
+
+    Tesla.Mock.mock(fn env ->
+      case env.url do
+        ^note_id ->
+          # TODO: add attributedTo and tag to the note factory
+          body =
+            note.data
+            |> Map.put("attributedTo", note.data["actor"])
+            |> Map.put("tag", [])
+            |> Jason.encode!()
+
+          %Tesla.Env{status: 200, body: body}
+      end
+    end)
+
+    undo = %Activity{
+      id: "fake",
+      data: %{
+        "id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
+        "actor" => note.data["actor"],
+        "to" => [note.data["actor"]],
+        "object" => note_id,
+        "type" => "Undo"
+      }
+    }
+
+    Conversation.create_or_bump_for(undo)
+
+    refute Object.get_by_ap_id(note_id)
+  end
 end
-- 
cgit v1.2.3


From 786f2c7a849bc4fa2bd4aac18de59ef6b2ed18c5 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Mon, 13 May 2019 11:16:54 -0500
Subject: Update shortdoc description

---
 lib/mix/tasks/pleroma/conversations.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/mix/tasks/pleroma/conversations.ex b/lib/mix/tasks/pleroma/conversations.ex
index 125d8851a..b52b9921a 100644
--- a/lib/mix/tasks/pleroma/conversations.ex
+++ b/lib/mix/tasks/pleroma/conversations.ex
@@ -7,7 +7,7 @@ defmodule Mix.Tasks.Pleroma.Conversations do
   alias Mix.Tasks.Pleroma.Common
   alias Pleroma.Conversation
 
-  @shortdoc "Manages Pleroma users"
+  @shortdoc "Manages Pleroma conversations."
   @moduledoc """
   Manages Pleroma conversations.
 
-- 
cgit v1.2.3


From 7701a4c84191a445e0b62e8a241e8af86f86e16a Mon Sep 17 00:00:00 2001
From: Sachin Joshi <satchin.joshi@gmail.com>
Date: Mon, 13 May 2019 23:50:33 +0545
Subject: Make irreversible field default to false in filters

---
 CHANGELOG.md                                                     | 1 +
 lib/pleroma/web/mastodon_api/mastodon_api_controller.ex          | 2 +-
 .../20190513175809_change_hide_column_in_filter_table.exs        | 9 +++++++++
 test/web/mastodon_api/mastodon_api_controller_test.exs           | 1 +
 4 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 priv/repo/migrations/20190513175809_change_hide_column_in_filter_table.exs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b9c9538b0..76e6f6b39 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -92,6 +92,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Mastodon API: Handling of `reblogs` in `/api/v1/accounts/:id/follow`
 - Mastodon API: Correct `reblogged`, `favourited`, and `bookmarked` values in the reblog status JSON
 - Mastodon API: Exposing default scope of the user to anyone
+- Mastodon API: Make `irreversible` field default to `false` [`POST /api/v1/filters`]
 
 ## [0.9.9999] - 2019-04-05
 ### Security
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 956736780..fd595031d 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -1536,7 +1536,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
       user_id: user.id,
       phrase: phrase,
       context: context,
-      hide: Map.get(params, "irreversible", nil),
+      hide: Map.get(params, "irreversible", false),
       whole_word: Map.get(params, "boolean", true)
       # expires_at
     }
diff --git a/priv/repo/migrations/20190513175809_change_hide_column_in_filter_table.exs b/priv/repo/migrations/20190513175809_change_hide_column_in_filter_table.exs
new file mode 100644
index 000000000..2ffb88cc9
--- /dev/null
+++ b/priv/repo/migrations/20190513175809_change_hide_column_in_filter_table.exs
@@ -0,0 +1,9 @@
+defmodule Pleroma.Repo.Migrations.ChangeHideColumnInFilterTable do
+  use Ecto.Migration
+
+  def change do
+    alter table(:filters) do
+      modify :hide, :boolean, default: false
+    end
+  end
+end
diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 505e45010..537cd98d5 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -572,6 +572,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
       assert response = json_response(conn, 200)
       assert response["phrase"] == filter.phrase
       assert response["context"] == filter.context
+      assert response["irreversible"] == false
       assert response["id"] != nil
       assert response["id"] != ""
     end
-- 
cgit v1.2.3


From a2be420f940fb8f181feeb9b0fb9759d433dcae1 Mon Sep 17 00:00:00 2001
From: Alexander Strizhakov <alex.strizhakov@gmail.com>
Date: Mon, 13 May 2019 18:35:45 +0000
Subject: differences_in_mastoapi_responses.md: fullname & bio are optionnal

[ci skip]
---
 CHANGELOG.md                                       |   3 +-
 config/config.exs                                  |   2 +
 docs/api/differences_in_mastoapi_responses.md      |  10 ++
 docs/config.md                                     |   6 +
 lib/mix/tasks/pleroma/user.ex                      |   2 +-
 lib/pleroma/plugs/oauth_plug.ex                    |  48 ++++++--
 lib/pleroma/plugs/rate_limit_plug.ex               |  36 ++++++
 lib/pleroma/user.ex                                |  11 +-
 lib/pleroma/user/info.ex                           |  30 ++---
 lib/pleroma/web/admin_api/admin_api_controller.ex  |   2 +-
 lib/pleroma/web/auth/pleroma_authenticator.ex      |   2 +-
 .../web/mastodon_api/mastodon_api_controller.ex    |  57 ++++++++++
 lib/pleroma/web/oauth/app.ex                       |   1 +
 lib/pleroma/web/oauth/authorization.ex             |  39 +++++--
 lib/pleroma/web/oauth/oauth_controller.ex          |  22 ++++
 lib/pleroma/web/oauth/token.ex                     |  11 +-
 lib/pleroma/web/router.ex                          |   2 +
 lib/pleroma/web/twitter_api/twitter_api.ex         |  29 +++--
 .../web/twitter_api/twitter_api_controller.ex      |   2 +-
 mix.exs                                            |   1 +
 mix.lock                                           |   2 +
 test/plugs/rate_limit_plug_test.exs                |  50 ++++++++
 test/user_test.exs                                 |   2 +-
 .../mastodon_api/mastodon_api_controller_test.exs  | 126 +++++++++++++++++++++
 test/web/oauth/oauth_controller_test.exs           |  23 +++-
 .../twitter_api/twitter_api_controller_test.exs    |   4 +-
 test/web/views/error_view_test.exs                 |  19 +++-
 27 files changed, 476 insertions(+), 66 deletions(-)
 create mode 100644 lib/pleroma/plugs/rate_limit_plug.ex
 create mode 100644 test/plugs/rate_limit_plug_test.exs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 76e6f6b39..cb934dab4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Mastodon API: `/api/v1/notifications/destroy_multiple` (glitch-soc extension)
 - Mastodon API: `/api/v1/pleroma/accounts/:id/favourites` (API extension)
 - Mastodon API: [Reports](https://docs.joinmastodon.org/api/rest/reports/)
+- Mastodon API: REST API for creating an account
 - ActivityPub C2S: OAuth endpoints
 - Metadata RelMe provider
 - OAuth: added support for refresh tokens
@@ -57,10 +58,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Mastodon API: Add `with_muted` parameter to timeline endpoints
 - Mastodon API: Actual reblog hiding instead of a dummy
 - Mastodon API: Remove attachment limit in the Status entity
+- Mastodon API: Added support max_id & since_id for bookmark timeline endpoints.
 - Deps: Updated Cowboy to 2.6
 - Deps: Updated Ecto to 3.0.7
 - Don't ship finmoji by default, they can be installed as an emoji pack
-- Mastodon API: Added support max_id & since_id for bookmark timeline endpoints.
 - Admin API: Move the user related API to `api/pleroma/admin/users`
 
 ### Fixed
diff --git a/config/config.exs b/config/config.exs
index 1e64b79a7..e8aad855c 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -234,6 +234,8 @@ config :pleroma, :instance,
   safe_dm_mentions: false,
   healthcheck: false
 
+config :pleroma, :app_account_creation, enabled: false, max_requests: 5, interval: 1800
+
 config :pleroma, :markup,
   # XXX - unfortunately, inline images must be enabled by default right now, because
   # of custom emoji.  Issue #275 discusses defanging that somehow.
diff --git a/docs/api/differences_in_mastoapi_responses.md b/docs/api/differences_in_mastoapi_responses.md
index d3ba41b6a..36b47608e 100644
--- a/docs/api/differences_in_mastoapi_responses.md
+++ b/docs/api/differences_in_mastoapi_responses.md
@@ -87,3 +87,13 @@ Additional parameters can be added to the JSON body/Form data:
 
 `POST /oauth/token`
 Post here request with grant_type=refresh_token to obtain new access token. Returns an access token.
+
+## Account Registration
+`POST /api/v1/accounts`
+
+Has theses additionnal parameters (which are the same as in Pleroma-API):
+    * `fullname`: optional
+    * `bio`: optional
+    * `captcha_solution`: optional, contains provider-specific captcha solution,
+    * `captcha_token`: optional, contains provider-specific captcha token
+    * `token`: invite token required when the registerations aren't public.
diff --git a/docs/config.md b/docs/config.md
index 43ea24d80..470f71b7c 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -105,6 +105,12 @@ config :pleroma, Pleroma.Emails.Mailer,
 * `safe_dm_mentions`: If set to true, only mentions at the beginning of a post will be used to address people in direct messages. This is to prevent accidental mentioning of people when talking about them (e.g. "@friend hey i really don't like @enemy"). (Default: `false`)
 * `healthcheck`: if set to true, system data will be shown on ``/api/pleroma/healthcheck``.
 
+## :app_account_creation
+REST API for creating an account settings
+* `enabled`: Enable/disable registration
+* `max_requests`: Number of requests allowed for creating accounts
+* `interval`: Interval for restricting requests for one ip (seconds)
+
 ## :logger
 * `backends`: `:console` is used to send logs to stdout, `{ExSyslogger, :ex_syslogger}` to log to syslog, and `Quack.Logger` to log to Slack
 
diff --git a/lib/mix/tasks/pleroma/user.ex b/lib/mix/tasks/pleroma/user.ex
index 6a83a8c0d..d130ff8c9 100644
--- a/lib/mix/tasks/pleroma/user.ex
+++ b/lib/mix/tasks/pleroma/user.ex
@@ -138,7 +138,7 @@ defmodule Mix.Tasks.Pleroma.User do
         bio: bio
       }
 
-      changeset = User.register_changeset(%User{}, params, confirmed: true)
+      changeset = User.register_changeset(%User{}, params, need_confirmation: false)
       {:ok, _user} = User.register(changeset)
 
       Mix.shell().info("User #{nickname} created")
diff --git a/lib/pleroma/plugs/oauth_plug.ex b/lib/pleroma/plugs/oauth_plug.ex
index 9d43732eb..86bc4aa3a 100644
--- a/lib/pleroma/plugs/oauth_plug.ex
+++ b/lib/pleroma/plugs/oauth_plug.ex
@@ -8,6 +8,7 @@ defmodule Pleroma.Plugs.OAuthPlug do
 
   alias Pleroma.Repo
   alias Pleroma.User
+  alias Pleroma.Web.OAuth.App
   alias Pleroma.Web.OAuth.Token
 
   @realm_reg Regex.compile!("Bearer\:?\s+(.*)$", "i")
@@ -22,18 +23,39 @@ defmodule Pleroma.Plugs.OAuthPlug do
       |> assign(:token, token_record)
       |> assign(:user, user)
     else
-      _ -> conn
+      _ ->
+        # token found, but maybe only with app
+        with {:ok, app, token_record} <- fetch_app_and_token(access_token) do
+          conn
+          |> assign(:token, token_record)
+          |> assign(:app, app)
+        else
+          _ -> conn
+        end
     end
   end
 
   def call(conn, _) do
-    with {:ok, token_str} <- fetch_token_str(conn),
-         {:ok, user, token_record} <- fetch_user_and_token(token_str) do
-      conn
-      |> assign(:token, token_record)
-      |> assign(:user, user)
-    else
-      _ -> conn
+    case fetch_token_str(conn) do
+      {:ok, token} ->
+        with {:ok, user, token_record} <- fetch_user_and_token(token) do
+          conn
+          |> assign(:token, token_record)
+          |> assign(:user, user)
+        else
+          _ ->
+            # token found, but maybe only with app
+            with {:ok, app, token_record} <- fetch_app_and_token(token) do
+              conn
+              |> assign(:token, token_record)
+              |> assign(:app, app)
+            else
+              _ -> conn
+            end
+        end
+
+      _ ->
+        conn
     end
   end
 
@@ -54,6 +76,16 @@ defmodule Pleroma.Plugs.OAuthPlug do
     end
   end
 
+  @spec fetch_app_and_token(String.t()) :: {:ok, App.t(), Token.t()} | nil
+  defp fetch_app_and_token(token) do
+    query =
+      from(t in Token, where: t.token == ^token, join: app in assoc(t, :app), preload: [app: app])
+
+    with %Token{app: app} = token_record <- Repo.one(query) do
+      {:ok, app, token_record}
+    end
+  end
+
   # Gets token from session by :oauth_token key
   #
   @spec fetch_token_from_session(Plug.Conn.t()) :: :no_token_found | {:ok, String.t()}
diff --git a/lib/pleroma/plugs/rate_limit_plug.ex b/lib/pleroma/plugs/rate_limit_plug.ex
new file mode 100644
index 000000000..466f64a79
--- /dev/null
+++ b/lib/pleroma/plugs/rate_limit_plug.ex
@@ -0,0 +1,36 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Plugs.RateLimitPlug do
+  import Phoenix.Controller, only: [json: 2]
+  import Plug.Conn
+
+  def init(opts), do: opts
+
+  def call(conn, opts) do
+    enabled? = Pleroma.Config.get([:app_account_creation, :enabled])
+
+    case check_rate(conn, Map.put(opts, :enabled, enabled?)) do
+      {:ok, _count} -> conn
+      {:error, _count} -> render_error(conn)
+      %Plug.Conn{} = conn -> conn
+    end
+  end
+
+  defp check_rate(conn, %{enabled: true} = opts) do
+    max_requests = opts[:max_requests]
+    bucket_name = conn.remote_ip |> Tuple.to_list() |> Enum.join(".")
+
+    ExRated.check_rate(bucket_name, opts[:interval] * 1000, max_requests)
+  end
+
+  defp check_rate(conn, _), do: conn
+
+  defp render_error(conn) do
+    conn
+    |> put_status(:forbidden)
+    |> json(%{error: "Rate limit exceeded."})
+    |> halt()
+  end
+end
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 427400aa1..474de9ba5 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -204,14 +204,15 @@ defmodule Pleroma.User do
   end
 
   def register_changeset(struct, params \\ %{}, opts \\ []) do
-    confirmation_status =
-      if opts[:confirmed] || !Pleroma.Config.get([:instance, :account_activation_required]) do
-        :confirmed
+    need_confirmation? =
+      if is_nil(opts[:need_confirmation]) do
+        Pleroma.Config.get([:instance, :account_activation_required])
       else
-        :unconfirmed
+        opts[:need_confirmation]
       end
 
-    info_change = User.Info.confirmation_changeset(%User.Info{}, confirmation_status)
+    info_change =
+      User.Info.confirmation_changeset(%User.Info{}, need_confirmation: need_confirmation?)
 
     changeset =
       struct
diff --git a/lib/pleroma/user/info.ex b/lib/pleroma/user/info.ex
index 1b81619ce..5a50ee639 100644
--- a/lib/pleroma/user/info.ex
+++ b/lib/pleroma/user/info.ex
@@ -8,6 +8,8 @@ defmodule Pleroma.User.Info do
 
   alias Pleroma.User.Info
 
+  @type t :: %__MODULE__{}
+
   embedded_schema do
     field(:banner, :map, default: %{})
     field(:background, :map, default: %{})
@@ -210,21 +212,23 @@ defmodule Pleroma.User.Info do
     ])
   end
 
-  def confirmation_changeset(info, :confirmed) do
-    confirmation_changeset(info, %{
-      confirmation_pending: false,
-      confirmation_token: nil
-    })
-  end
+  @spec confirmation_changeset(Info.t(), keyword()) :: Ecto.Changerset.t()
+  def confirmation_changeset(info, opts) do
+    need_confirmation? = Keyword.get(opts, :need_confirmation)
 
-  def confirmation_changeset(info, :unconfirmed) do
-    confirmation_changeset(info, %{
-      confirmation_pending: true,
-      confirmation_token: :crypto.strong_rand_bytes(32) |> Base.url_encode64()
-    })
-  end
+    params =
+      if need_confirmation? do
+        %{
+          confirmation_pending: true,
+          confirmation_token: :crypto.strong_rand_bytes(32) |> Base.url_encode64()
+        }
+      else
+        %{
+          confirmation_pending: false,
+          confirmation_token: nil
+        }
+      end
 
-  def confirmation_changeset(info, params) do
     cast(info, params, [:confirmation_pending, :confirmation_token])
   end
 
diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex
index b553d96a8..e00b33aba 100644
--- a/lib/pleroma/web/admin_api/admin_api_controller.ex
+++ b/lib/pleroma/web/admin_api/admin_api_controller.ex
@@ -59,7 +59,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
       bio: "."
     }
 
-    changeset = User.register_changeset(%User{}, user_data, confirmed: true)
+    changeset = User.register_changeset(%User{}, user_data, need_confirmation: false)
     {:ok, user} = User.register(changeset)
 
     conn
diff --git a/lib/pleroma/web/auth/pleroma_authenticator.ex b/lib/pleroma/web/auth/pleroma_authenticator.ex
index dd79cdcf7..c4a6fce08 100644
--- a/lib/pleroma/web/auth/pleroma_authenticator.ex
+++ b/lib/pleroma/web/auth/pleroma_authenticator.ex
@@ -74,7 +74,7 @@ defmodule Pleroma.Web.Auth.PleromaAuthenticator do
                password_confirmation: random_password
              },
              external: true,
-             confirmed: true
+             need_confirmation: false
            )
            |> Repo.insert(),
          {:ok, _} <-
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index fd595031d..defd88a44 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -39,12 +39,22 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   alias Pleroma.Web.OAuth.Authorization
   alias Pleroma.Web.OAuth.Scopes
   alias Pleroma.Web.OAuth.Token
+  alias Pleroma.Web.TwitterAPI.TwitterAPI
 
   alias Pleroma.Web.ControllerHelper
   import Ecto.Query
 
   require Logger
 
+  plug(
+    Pleroma.Plugs.RateLimitPlug,
+    %{
+      max_requests: Config.get([:app_account_creation, :max_requests]),
+      interval: Config.get([:app_account_creation, :interval])
+    }
+    when action in [:account_register]
+  )
+
   @httpoison Application.get_env(:pleroma, :httpoison)
   @local_mastodon_name "Mastodon-Local"
 
@@ -1693,6 +1703,53 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
     end
   end
 
+  def account_register(
+        %{assigns: %{app: app}} = conn,
+        %{"username" => nickname, "email" => _, "password" => _, "agreement" => true} = params
+      ) do
+    params =
+      params
+      |> Map.take([
+        "email",
+        "captcha_solution",
+        "captcha_token",
+        "captcha_answer_data",
+        "token",
+        "password"
+      ])
+      |> Map.put("nickname", nickname)
+      |> Map.put("fullname", params["fullname"] || nickname)
+      |> Map.put("bio", params["bio"] || "")
+      |> Map.put("confirm", params["password"])
+
+    with {:ok, user} <- TwitterAPI.register_user(params, need_confirmation: true),
+         {:ok, token} <- Token.create_token(app, user, %{scopes: app.scopes}) do
+      json(conn, %{
+        token_type: "Bearer",
+        access_token: token.token,
+        scope: app.scopes,
+        created_at: Token.Utils.format_created_at(token)
+      })
+    else
+      {:error, errors} ->
+        conn
+        |> put_status(400)
+        |> json(Jason.encode!(errors))
+    end
+  end
+
+  def account_register(%{assigns: %{app: _app}} = conn, _params) do
+    conn
+    |> put_status(400)
+    |> json(%{error: "Missing parameters"})
+  end
+
+  def account_register(conn, _) do
+    conn
+    |> put_status(403)
+    |> json(%{error: "Invalid credentials"})
+  end
+
   def conversations(%{assigns: %{user: user}} = conn, params) do
     participations = Participation.for_user_with_last_activity_id(user, params)
 
diff --git a/lib/pleroma/web/oauth/app.ex b/lib/pleroma/web/oauth/app.ex
index bccc2ac96..ddcdb1871 100644
--- a/lib/pleroma/web/oauth/app.ex
+++ b/lib/pleroma/web/oauth/app.ex
@@ -7,6 +7,7 @@ defmodule Pleroma.Web.OAuth.App do
   import Ecto.Changeset
 
   @type t :: %__MODULE__{}
+
   schema "apps" do
     field(:client_name, :string)
     field(:redirect_uris, :string)
diff --git a/lib/pleroma/web/oauth/authorization.ex b/lib/pleroma/web/oauth/authorization.ex
index ca3901cc4..b47688de1 100644
--- a/lib/pleroma/web/oauth/authorization.ex
+++ b/lib/pleroma/web/oauth/authorization.ex
@@ -14,6 +14,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
   import Ecto.Query
 
   @type t :: %__MODULE__{}
+
   schema "oauth_authorizations" do
     field(:token, :string)
     field(:scopes, {:array, :string}, default: [])
@@ -25,28 +26,45 @@ defmodule Pleroma.Web.OAuth.Authorization do
     timestamps()
   end
 
+  @spec create_authorization(App.t(), User.t() | %{}, [String.t()] | nil) ::
+          {:ok, Authorization.t()} | {:error, Changeset.t()}
   def create_authorization(%App{} = app, %User{} = user, scopes \\ nil) do
-    scopes = scopes || app.scopes
-    token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
-
-    authorization = %Authorization{
-      token: token,
-      used: false,
+    %{
+      scopes: scopes || app.scopes,
       user_id: user.id,
-      app_id: app.id,
-      scopes: scopes,
-      valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10)
+      app_id: app.id
     }
+    |> create_changeset()
+    |> Repo.insert()
+  end
+
+  @spec create_changeset(map()) :: Changeset.t()
+  def create_changeset(attrs \\ %{}) do
+    %Authorization{}
+    |> cast(attrs, [:user_id, :app_id, :scopes, :valid_until])
+    |> validate_required([:app_id, :scopes])
+    |> add_token()
+    |> add_lifetime()
+  end
+
+  defp add_token(changeset) do
+    token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
+    put_change(changeset, :token, token)
+  end
 
-    Repo.insert(authorization)
+  defp add_lifetime(changeset) do
+    put_change(changeset, :valid_until, NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10))
   end
 
+  @spec use_changeset(Authtorizatiton.t(), map()) :: Changeset.t()
   def use_changeset(%Authorization{} = auth, params) do
     auth
     |> cast(params, [:used])
     |> validate_required([:used])
   end
 
+  @spec use_token(Authorization.t()) ::
+          {:ok, Authorization.t()} | {:error, Changeset.t()} | {:error, String.t()}
   def use_token(%Authorization{used: false, valid_until: valid_until} = auth) do
     if NaiveDateTime.diff(NaiveDateTime.utc_now(), valid_until) < 0 do
       Repo.update(use_changeset(auth, %{used: true}))
@@ -57,6 +75,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
 
   def use_token(%Authorization{used: true}), do: {:error, "already used"}
 
+  @spec delete_user_authorizations(User.t()) :: {integer(), any()}
   def delete_user_authorizations(%User{id: user_id}) do
     from(
       a in Pleroma.Web.OAuth.Authorization,
diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index 8ee0da667..862b8f8c9 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -218,6 +218,28 @@ defmodule Pleroma.Web.OAuth.OAuthController do
     token_exchange(conn, params)
   end
 
+  def token_exchange(conn, %{"grant_type" => "client_credentials"} = params) do
+    with %App{} = app <- get_app_from_request(conn, params),
+         {:ok, auth} <- Authorization.create_authorization(app, %User{}),
+         {:ok, token} <- Token.exchange_token(app, auth),
+         {:ok, inserted_at} <- DateTime.from_naive(token.inserted_at, "Etc/UTC") do
+      response = %{
+        token_type: "Bearer",
+        access_token: token.token,
+        refresh_token: token.refresh_token,
+        created_at: DateTime.to_unix(inserted_at),
+        expires_in: 60 * 10,
+        scope: Enum.join(token.scopes, " ")
+      }
+
+      json(conn, response)
+    else
+      _error ->
+        put_status(conn, 400)
+        |> json(%{error: "Invalid credentials"})
+    end
+  end
+
   # Bad request
   def token_exchange(conn, params), do: bad_request(conn, params)
 
diff --git a/lib/pleroma/web/oauth/token.ex b/lib/pleroma/web/oauth/token.ex
index 4e5d1d118..ef047d565 100644
--- a/lib/pleroma/web/oauth/token.ex
+++ b/lib/pleroma/web/oauth/token.ex
@@ -45,12 +45,16 @@ defmodule Pleroma.Web.OAuth.Token do
     |> Repo.find_resource()
   end
 
+  @spec exchange_token(App.t(), Authorization.t()) ::
+          {:ok, Token.t()} | {:error, Changeset.t()}
   def exchange_token(app, auth) do
     with {:ok, auth} <- Authorization.use_token(auth),
          true <- auth.app_id == app.id do
+      user = if auth.user_id, do: User.get_cached_by_id(auth.user_id), else: %User{}
+
       create_token(
         app,
-        User.get_cached_by_id(auth.user_id),
+        user,
         %{scopes: auth.scopes}
       )
     end
@@ -81,12 +85,13 @@ defmodule Pleroma.Web.OAuth.Token do
     |> validate_required([:valid_until])
   end
 
+  @spec create_token(App.t(), User.t(), map()) :: {:ok, Token} | {:error, Changeset.t()}
   def create_token(%App{} = app, %User{} = user, attrs \\ %{}) do
     %__MODULE__{user_id: user.id, app_id: app.id}
     |> cast(%{scopes: attrs[:scopes] || app.scopes}, [:scopes])
-    |> validate_required([:scopes, :user_id, :app_id])
+    |> validate_required([:scopes, :app_id])
     |> put_valid_until(attrs)
-    |> put_token
+    |> put_token()
     |> put_refresh_token(attrs)
     |> Repo.insert()
   end
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 8b84fbbad..51146d010 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -385,6 +385,8 @@ defmodule Pleroma.Web.Router do
   scope "/api/v1", Pleroma.Web.MastodonAPI do
     pipe_through(:api)
 
+    post("/accounts", MastodonAPIController, :account_register)
+
     get("/instance", MastodonAPIController, :masto_instance)
     get("/instance/peers", MastodonAPIController, :peers)
     post("/apps", MastodonAPIController, :create_app)
diff --git a/lib/pleroma/web/twitter_api/twitter_api.ex b/lib/pleroma/web/twitter_api/twitter_api.ex
index 3a7774647..1362ef57c 100644
--- a/lib/pleroma/web/twitter_api/twitter_api.ex
+++ b/lib/pleroma/web/twitter_api/twitter_api.ex
@@ -128,7 +128,7 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
     end
   end
 
-  def register_user(params) do
+  def register_user(params, opts \\ []) do
     token = params["token"]
 
     params = %{
@@ -162,13 +162,22 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
       # I have no idea how this error handling works
       {:error, %{error: Jason.encode!(%{captcha: [error]})}}
     else
-      registrations_open = Pleroma.Config.get([:instance, :registrations_open])
-      registration_process(registrations_open, params, token)
+      registration_process(
+        params,
+        %{
+          registrations_open: Pleroma.Config.get([:instance, :registrations_open]),
+          token: token
+        },
+        opts
+      )
     end
   end
 
-  defp registration_process(registration_open, params, token)
-       when registration_open == false or is_nil(registration_open) do
+  defp registration_process(params, %{registrations_open: true}, opts) do
+    create_user(params, opts)
+  end
+
+  defp registration_process(params, %{token: token}, opts) do
     invite =
       unless is_nil(token) do
         Repo.get_by(UserInviteToken, %{token: token})
@@ -182,19 +191,15 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPI do
 
       invite when valid_invite? ->
         UserInviteToken.update_usage!(invite)
-        create_user(params)
+        create_user(params, opts)
 
       _ ->
         {:error, "Expired token"}
     end
   end
 
-  defp registration_process(true, params, _token) do
-    create_user(params)
-  end
-
-  defp create_user(params) do
-    changeset = User.register_changeset(%User{}, params)
+  defp create_user(params, opts) do
+    changeset = User.register_changeset(%User{}, params, opts)
 
     case User.register(changeset) do
       {:ok, user} ->
diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
index 21e6c555a..3c5a70be9 100644
--- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex
+++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
@@ -440,7 +440,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
          true <- user.local,
          true <- user.info.confirmation_pending,
          true <- user.info.confirmation_token == token,
-         info_change <- User.Info.confirmation_changeset(user.info, :confirmed),
+         info_change <- User.Info.confirmation_changeset(user.info, need_confirmation: false),
          changeset <- Changeset.change(user) |> Changeset.put_embed(:info, info_change),
          {:ok, _} <- User.update_and_set_cache(changeset) do
       conn
diff --git a/mix.exs b/mix.exs
index 5600aaa42..b7b9d534d 100644
--- a/mix.exs
+++ b/mix.exs
@@ -114,6 +114,7 @@ defmodule Pleroma.Mixfile do
       {:quack, "~> 0.1.1"},
       {:benchee, "~> 1.0"},
       {:esshd, "~> 0.1.0"},
+      {:ex_rated, "~> 1.2"},
       {:plug_static_index_html, "~> 1.0.0"}
     ] ++ oauth_deps
   end
diff --git a/mix.lock b/mix.lock
index 981cc1747..0b24818c5 100644
--- a/mix.lock
+++ b/mix.lock
@@ -24,10 +24,12 @@
   "ecto_sql": {:hex, :ecto_sql, "3.0.5", "7e44172b4f7aca4469f38d7f6a3da394dbf43a1bcf0ca975e958cb957becd74e", [:mix], [{:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:ecto, "~> 3.0.6", [hex: :ecto, repo: "hexpm", optional: false]}, {:mariaex, "~> 0.9.1", [hex: :mariaex, repo: "hexpm", optional: true]}, {:postgrex, "~> 0.14.0", [hex: :postgrex, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.3.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm"},
   "esshd": {:hex, :esshd, "0.1.0", "6f93a2062adb43637edad0ea7357db2702a4b80dd9683482fe00f5134e97f4c1", [:mix], [], "hexpm"},
   "eternal": {:hex, :eternal, "1.2.0", "e2a6b6ce3b8c248f7dc31451aefca57e3bdf0e48d73ae5043229380a67614c41", [:mix], [], "hexpm"},
+  "ex2ms": {:hex, :ex2ms, "1.5.0", "19e27f9212be9a96093fed8cdfbef0a2b56c21237196d26760f11dfcfae58e97", [:mix], [], "hexpm"},
   "ex_aws": {:hex, :ex_aws, "2.1.0", "b92651527d6c09c479f9013caa9c7331f19cba38a650590d82ebf2c6c16a1d8a", [:mix], [{:configparser_ex, "~> 2.0", [hex: :configparser_ex, repo: "hexpm", optional: true]}, {:hackney, "1.6.3 or 1.6.5 or 1.7.1 or 1.8.6 or ~> 1.9", [hex: :hackney, repo: "hexpm", optional: true]}, {:jsx, "~> 2.8", [hex: :jsx, repo: "hexpm", optional: true]}, {:poison, ">= 1.2.0", [hex: :poison, repo: "hexpm", optional: true]}, {:sweet_xml, "~> 0.6", [hex: :sweet_xml, repo: "hexpm", optional: true]}, {:xml_builder, "~> 0.1.0", [hex: :xml_builder, repo: "hexpm", optional: true]}], "hexpm"},
   "ex_aws_s3": {:hex, :ex_aws_s3, "2.0.1", "9e09366e77f25d3d88c5393824e613344631be8db0d1839faca49686e99b6704", [:mix], [{:ex_aws, "~> 2.0", [hex: :ex_aws, repo: "hexpm", optional: false]}, {:sweet_xml, ">= 0.0.0", [hex: :sweet_xml, repo: "hexpm", optional: true]}], "hexpm"},
   "ex_doc": {:hex, :ex_doc, "0.20.2", "1bd0dfb0304bade58beb77f20f21ee3558cc3c753743ae0ddbb0fd7ba2912331", [:mix], [{:earmark, "~> 1.3", [hex: :earmark, repo: "hexpm", optional: false]}, {:makeup_elixir, "~> 0.10", [hex: :makeup_elixir, repo: "hexpm", optional: false]}], "hexpm"},
   "ex_machina": {:hex, :ex_machina, "2.3.0", "92a5ad0a8b10ea6314b876a99c8c9e3f25f4dde71a2a835845b136b9adaf199a", [:mix], [{:ecto, "~> 2.2 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: true]}, {:ecto_sql, "~> 3.0", [hex: :ecto_sql, repo: "hexpm", optional: true]}], "hexpm"},
+  "ex_rated": {:hex, :ex_rated, "1.3.2", "6aeb32abb46ea6076f417a9ce8cb1cf08abf35fb2d42375beaad4dd72b550bf1", [:mix], [{:ex2ms, "~> 1.5", [hex: :ex2ms, repo: "hexpm", optional: false]}], "hexpm"},
   "ex_syslogger": {:git, "https://github.com/slashmili/ex_syslogger.git", "f3963399047af17e038897c69e20d552e6899e1d", [tag: "1.4.0"]},
   "floki": {:hex, :floki, "0.20.4", "be42ac911fece24b4c72f3b5846774b6e61b83fe685c2fc9d62093277fb3bc86", [:mix], [{:html_entities, "~> 0.4.0", [hex: :html_entities, repo: "hexpm", optional: false]}, {:mochiweb, "~> 2.15", [hex: :mochiweb, repo: "hexpm", optional: false]}], "hexpm"},
   "gen_smtp": {:hex, :gen_smtp, "0.13.0", "11f08504c4bdd831dc520b8f84a1dce5ce624474a797394e7aafd3c29f5dcd25", [:rebar3], [], "hexpm"},
diff --git a/test/plugs/rate_limit_plug_test.exs b/test/plugs/rate_limit_plug_test.exs
new file mode 100644
index 000000000..2ec9a8fb7
--- /dev/null
+++ b/test/plugs/rate_limit_plug_test.exs
@@ -0,0 +1,50 @@
+defmodule Pleroma.Plugs.RateLimitPlugTest do
+  use ExUnit.Case, async: true
+  use Plug.Test
+
+  alias Pleroma.Plugs.RateLimitPlug
+
+  @opts RateLimitPlug.init(%{max_requests: 5, interval: 1})
+
+  setup do
+    enabled = Pleroma.Config.get([:app_account_creation, :enabled])
+
+    Pleroma.Config.put([:app_account_creation, :enabled], true)
+
+    on_exit(fn ->
+      Pleroma.Config.put([:app_account_creation, :enabled], enabled)
+    end)
+
+    :ok
+  end
+
+  test "it restricts by opts" do
+    conn = conn(:get, "/")
+    bucket_name = conn.remote_ip |> Tuple.to_list() |> Enum.join(".")
+    ms = 1000
+
+    conn = RateLimitPlug.call(conn, @opts)
+    {1, 4, _, _, _} = ExRated.inspect_bucket(bucket_name, ms, 5)
+    conn = RateLimitPlug.call(conn, @opts)
+    {2, 3, _, _, _} = ExRated.inspect_bucket(bucket_name, ms, 5)
+    conn = RateLimitPlug.call(conn, @opts)
+    {3, 2, _, _, _} = ExRated.inspect_bucket(bucket_name, ms, 5)
+    conn = RateLimitPlug.call(conn, @opts)
+    {4, 1, _, _, _} = ExRated.inspect_bucket(bucket_name, ms, 5)
+    conn = RateLimitPlug.call(conn, @opts)
+    {5, 0, to_reset, _, _} = ExRated.inspect_bucket(bucket_name, ms, 5)
+    conn = RateLimitPlug.call(conn, @opts)
+    assert conn.status == 403
+    assert conn.halted
+    assert conn.resp_body == "{\"error\":\"Rate limit exceeded.\"}"
+
+    Process.sleep(to_reset)
+
+    conn = conn(:get, "/")
+    conn = RateLimitPlug.call(conn, @opts)
+    {1, 4, _, _, _} = ExRated.inspect_bucket(bucket_name, ms, 5)
+    refute conn.status == 403
+    refute conn.halted
+    refute conn.resp_body
+  end
+end
diff --git a/test/user_test.exs b/test/user_test.exs
index adc77a264..60de0206e 100644
--- a/test/user_test.exs
+++ b/test/user_test.exs
@@ -349,7 +349,7 @@ defmodule Pleroma.UserTest do
     end
 
     test "it creates confirmed user if :confirmed option is given" do
-      changeset = User.register_changeset(%User{}, @full_user_data, confirmed: true)
+      changeset = User.register_changeset(%User{}, @full_user_data, need_confirmation: false)
       assert changeset.valid?
 
       {:ok, user} = Repo.insert(changeset)
diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 537cd98d5..5c79ee633 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -16,6 +16,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
   alias Pleroma.Web.CommonAPI
   alias Pleroma.Web.MastodonAPI.FilterView
   alias Pleroma.Web.OAuth.App
+  alias Pleroma.Web.OAuth.Token
   alias Pleroma.Web.OStatus
   alias Pleroma.Web.Push
   alias Pleroma.Web.TwitterAPI.TwitterAPI
@@ -3216,4 +3217,129 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
     replied_to_user = User.get_by_ap_id(replied_to.data["actor"])
     assert reblogged_activity["reblog"]["in_reply_to_account_id"] == replied_to_user.id
   end
+
+  describe "create account by app" do
+    setup do
+      enabled = Pleroma.Config.get([:app_account_creation, :enabled])
+      max_requests = Pleroma.Config.get([:app_account_creation, :max_requests])
+      interval = Pleroma.Config.get([:app_account_creation, :interval])
+
+      Pleroma.Config.put([:app_account_creation, :enabled], true)
+      Pleroma.Config.put([:app_account_creation, :max_requests], 5)
+      Pleroma.Config.put([:app_account_creation, :interval], 1)
+
+      on_exit(fn ->
+        Pleroma.Config.put([:app_account_creation, :enabled], enabled)
+        Pleroma.Config.put([:app_account_creation, :max_requests], max_requests)
+        Pleroma.Config.put([:app_account_creation, :interval], interval)
+      end)
+
+      :ok
+    end
+
+    test "Account registration via Application", %{conn: conn} do
+      conn =
+        conn
+        |> post("/api/v1/apps", %{
+          client_name: "client_name",
+          redirect_uris: "urn:ietf:wg:oauth:2.0:oob",
+          scopes: "read, write, follow"
+        })
+
+      %{
+        "client_id" => client_id,
+        "client_secret" => client_secret,
+        "id" => _,
+        "name" => "client_name",
+        "redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
+        "vapid_key" => _,
+        "website" => nil
+      } = json_response(conn, 200)
+
+      conn =
+        conn
+        |> post("/oauth/token", %{
+          grant_type: "client_credentials",
+          client_id: client_id,
+          client_secret: client_secret
+        })
+
+      assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
+               json_response(conn, 200)
+
+      assert token
+      token_from_db = Repo.get_by(Token, token: token)
+      assert token_from_db
+      assert refresh
+      assert scope == "read write follow"
+
+      conn =
+        build_conn()
+        |> put_req_header("authorization", "Bearer " <> token)
+        |> post("/api/v1/accounts", %{
+          username: "lain",
+          email: "lain@example.org",
+          password: "PlzDontHackLain",
+          agreement: true
+        })
+
+      %{
+        "access_token" => token,
+        "created_at" => _created_at,
+        "scope" => _scope,
+        "token_type" => "Bearer"
+      } = json_response(conn, 200)
+
+      token_from_db = Repo.get_by(Token, token: token)
+      assert token_from_db
+      token_from_db = Repo.preload(token_from_db, :user)
+      assert token_from_db.user
+
+      assert token_from_db.user.info.confirmation_pending
+    end
+
+    test "rate limit", %{conn: conn} do
+      app_token = insert(:oauth_token, user: nil)
+
+      conn =
+        put_req_header(conn, "authorization", "Bearer " <> app_token.token)
+        |> Map.put(:remote_ip, {15, 15, 15, 15})
+
+      for i <- 1..5 do
+        conn =
+          conn
+          |> post("/api/v1/accounts", %{
+            username: "#{i}lain",
+            email: "#{i}lain@example.org",
+            password: "PlzDontHackLain",
+            agreement: true
+          })
+
+        %{
+          "access_token" => token,
+          "created_at" => _created_at,
+          "scope" => _scope,
+          "token_type" => "Bearer"
+        } = json_response(conn, 200)
+
+        token_from_db = Repo.get_by(Token, token: token)
+        assert token_from_db
+        token_from_db = Repo.preload(token_from_db, :user)
+        assert token_from_db.user
+
+        assert token_from_db.user.info.confirmation_pending
+      end
+
+      conn =
+        conn
+        |> post("/api/v1/accounts", %{
+          username: "6lain",
+          email: "6lain@example.org",
+          password: "PlzDontHackLain",
+          agreement: true
+        })
+
+      assert json_response(conn, 403) == %{"error" => "Rate limit exceeded."}
+    end
+  end
 end
diff --git a/test/web/oauth/oauth_controller_test.exs b/test/web/oauth/oauth_controller_test.exs
index cb6836983..1c04ac9ad 100644
--- a/test/web/oauth/oauth_controller_test.exs
+++ b/test/web/oauth/oauth_controller_test.exs
@@ -614,6 +614,27 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
       assert token.scopes == ["scope1", "scope2"]
     end
 
+    test "issue a token for client_credentials grant type" do
+      app = insert(:oauth_app, scopes: ["read", "write"])
+
+      conn =
+        build_conn()
+        |> post("/oauth/token", %{
+          "grant_type" => "client_credentials",
+          "client_id" => app.client_id,
+          "client_secret" => app.client_secret
+        })
+
+      assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
+               json_response(conn, 200)
+
+      assert token
+      token_from_db = Repo.get_by(Token, token: token)
+      assert token_from_db
+      assert refresh
+      assert scope == "read write"
+    end
+
     test "rejects token exchange with invalid client credentials" do
       user = insert(:user)
       app = insert(:oauth_app)
@@ -644,7 +665,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
 
       password = "testpassword"
       user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
-      info_change = Pleroma.User.Info.confirmation_changeset(user.info, :unconfirmed)
+      info_change = Pleroma.User.Info.confirmation_changeset(user.info, need_confirmation: true)
 
       {:ok, user} =
         user
diff --git a/test/web/twitter_api/twitter_api_controller_test.exs b/test/web/twitter_api/twitter_api_controller_test.exs
index 90718cfb4..e194f14fb 100644
--- a/test/web/twitter_api/twitter_api_controller_test.exs
+++ b/test/web/twitter_api/twitter_api_controller_test.exs
@@ -1094,7 +1094,7 @@ defmodule Pleroma.Web.TwitterAPI.ControllerTest do
   describe "GET /api/account/confirm_email/:id/:token" do
     setup do
       user = insert(:user)
-      info_change = User.Info.confirmation_changeset(user.info, :unconfirmed)
+      info_change = User.Info.confirmation_changeset(user.info, need_confirmation: true)
 
       {:ok, user} =
         user
@@ -1145,7 +1145,7 @@ defmodule Pleroma.Web.TwitterAPI.ControllerTest do
       end
 
       user = insert(:user)
-      info_change = User.Info.confirmation_changeset(user.info, :unconfirmed)
+      info_change = User.Info.confirmation_changeset(user.info, need_confirmation: true)
 
       {:ok, user} =
         user
diff --git a/test/web/views/error_view_test.exs b/test/web/views/error_view_test.exs
index d529fd2c3..3857d585f 100644
--- a/test/web/views/error_view_test.exs
+++ b/test/web/views/error_view_test.exs
@@ -4,6 +4,7 @@
 
 defmodule Pleroma.Web.ErrorViewTest do
   use Pleroma.Web.ConnCase, async: true
+  import ExUnit.CaptureLog
 
   # Bring render/3 and render_to_string/3 for testing custom views
   import Phoenix.View
@@ -13,17 +14,23 @@ defmodule Pleroma.Web.ErrorViewTest do
   end
 
   test "render 500.json" do
-    assert render(Pleroma.Web.ErrorView, "500.json", []) ==
-             %{errors: %{detail: "Internal server error", reason: "nil"}}
+    assert capture_log(fn ->
+             assert render(Pleroma.Web.ErrorView, "500.json", []) ==
+                      %{errors: %{detail: "Internal server error", reason: "nil"}}
+           end) =~ "[error] Internal server error: nil"
   end
 
   test "render any other" do
-    assert render(Pleroma.Web.ErrorView, "505.json", []) ==
-             %{errors: %{detail: "Internal server error", reason: "nil"}}
+    assert capture_log(fn ->
+             assert render(Pleroma.Web.ErrorView, "505.json", []) ==
+                      %{errors: %{detail: "Internal server error", reason: "nil"}}
+           end) =~ "[error] Internal server error: nil"
   end
 
   test "render 500.json with reason" do
-    assert render(Pleroma.Web.ErrorView, "500.json", reason: "test reason") ==
-             %{errors: %{detail: "Internal server error", reason: "\"test reason\""}}
+    assert capture_log(fn ->
+             assert render(Pleroma.Web.ErrorView, "500.json", reason: "test reason") ==
+                      %{errors: %{detail: "Internal server error", reason: "\"test reason\""}}
+           end) =~ "[error] Internal server error: \"test reason\""
   end
 end
-- 
cgit v1.2.3


From 32d4630c9ca1c89e655b37b3b939d728f569dc9f Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 13 May 2019 01:58:30 +0000
Subject: user: move initial post fetching to job queue

---
 lib/pleroma/user.ex | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 474de9ba5..a79da4dd8 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -552,8 +552,7 @@ defmodule Pleroma.User do
         with [_nick, _domain] <- String.split(nickname, "@"),
              {:ok, user} <- fetch_by_nickname(nickname) do
           if Pleroma.Config.get([:fetch_initial_posts, :enabled]) do
-            # TODO turn into job
-            {:ok, _} = Task.start(__MODULE__, :fetch_initial_posts, [user])
+            fetch_initial_posts(user)
           end
 
           {:ok, user}
@@ -564,15 +563,8 @@ defmodule Pleroma.User do
   end
 
   @doc "Fetch some posts when the user has just been federated with"
-  def fetch_initial_posts(user) do
-    pages = Pleroma.Config.get!([:fetch_initial_posts, :pages])
-
-    Enum.each(
-      # Insert all the posts in reverse order, so they're in the right order on the timeline
-      Enum.reverse(Utils.fetch_ordered_collection(user.info.source_data["outbox"], pages)),
-      &Pleroma.Web.Federator.incoming_ap_doc/1
-    )
-  end
+  def fetch_initial_posts(user),
+    do: PleromaJobQueue.enqueue(:background, __MODULE__, [:fetch_initial_posts, user])
 
   @spec get_followers_query(User.t(), pos_integer() | nil) :: Ecto.Query.t()
   def get_followers_query(%User{} = user, nil) do
@@ -1077,6 +1069,19 @@ defmodule Pleroma.User do
     delete_user_activities(user)
   end
 
+  @spec perform(atom(), User.t()) :: {:ok, User.t()}
+  def perform(:fetch_initial_posts, %User{} = user) do
+    pages = Pleroma.Config.get!([:fetch_initial_posts, :pages])
+
+    Enum.each(
+      # Insert all the posts in reverse order, so they're in the right order on the timeline
+      Enum.reverse(Utils.fetch_ordered_collection(user.info.source_data["outbox"], pages)),
+      &Pleroma.Web.Federator.incoming_ap_doc/1
+    )
+
+    {:ok, user}
+  end
+
   def delete_user_activities(%User{ap_id: ap_id} = user) do
     stream =
       ap_id
@@ -1130,8 +1135,8 @@ defmodule Pleroma.User do
       resp = fetch_by_ap_id(ap_id)
 
       if should_fetch_initial do
-        with {:ok, %User{} = user} = resp do
-          {:ok, _} = Task.start(__MODULE__, :fetch_initial_posts, [user])
+        with {:ok, %User{} = user} <- resp do
+          fetch_initial_posts(user)
         end
       end
 
-- 
cgit v1.2.3


From 57d11ac9dbe4f3befd288cb0f59f368968474f93 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 13 May 2019 02:02:00 +0000
Subject: activitypub: move post rich media fetching to job queue

---
 lib/pleroma/web/activity_pub/activity_pub.ex | 4 +---
 lib/pleroma/web/rich_media/helpers.ex        | 2 ++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 11777c220..d7c0ab4d3 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -133,9 +133,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
           activity
         end
 
-      Task.start(fn ->
-        Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
-      end)
+      PleromaJobQueue.enqueue(:background, Pleroma.Web.RichMedia.Helpers, [:fetch, activity])
 
       Notification.create_notifications(activity)
 
diff --git a/lib/pleroma/web/rich_media/helpers.ex b/lib/pleroma/web/rich_media/helpers.ex
index f67aaf58b..0162a5be9 100644
--- a/lib/pleroma/web/rich_media/helpers.ex
+++ b/lib/pleroma/web/rich_media/helpers.ex
@@ -34,4 +34,6 @@ defmodule Pleroma.Web.RichMedia.Helpers do
   end
 
   def fetch_data_for_activity(_), do: %{}
+
+  def perform(:fetch, %Activity{} = activity), do: fetch_data_for_activity(activity)
 end
-- 
cgit v1.2.3


From 69a9e0563cc441a772c4884d747bb755ddf58c45 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 13 May 2019 02:09:28 +0000
Subject: user: migrate follow/blocks import to job queue

---
 lib/pleroma/user.ex                                | 73 +++++++++++-----------
 .../web/twitter_api/controllers/util_controller.ex | 14 ++++-
 2 files changed, 50 insertions(+), 37 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index a79da4dd8..c94660de4 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -413,24 +413,6 @@ defmodule Pleroma.User do
     Enum.member?(follower.following, followed.follower_address)
   end
 
-  def follow_import(%User{} = follower, followed_identifiers)
-      when is_list(followed_identifiers) do
-    Enum.map(
-      followed_identifiers,
-      fn followed_identifier ->
-        with {:ok, %User{} = followed} <- get_or_fetch(followed_identifier),
-             {:ok, follower} <- maybe_direct_follow(follower, followed),
-             {:ok, _} <- ActivityPub.follow(follower, followed) do
-          followed
-        else
-          err ->
-            Logger.debug("follow_import failed for #{followed_identifier} with: #{inspect(err)}")
-            err
-        end
-      end
-    )
-  end
-
   def locked?(%User{} = user) do
     user.info.locked || false
   end
@@ -844,23 +826,6 @@ defmodule Pleroma.User do
     )
   end
 
-  def blocks_import(%User{} = blocker, blocked_identifiers) when is_list(blocked_identifiers) do
-    Enum.map(
-      blocked_identifiers,
-      fn blocked_identifier ->
-        with {:ok, %User{} = blocked} <- get_or_fetch(blocked_identifier),
-             {:ok, blocker} <- block(blocker, blocked),
-             {:ok, _} <- ActivityPub.block(blocker, blocked) do
-          blocked
-        else
-          err ->
-            Logger.debug("blocks_import failed for #{blocked_identifier} with: #{inspect(err)}")
-            err
-        end
-      end
-    )
-  end
-
   def mute(muter, %User{ap_id: ap_id}) do
     info_cng =
       muter.info
@@ -1082,6 +1047,44 @@ defmodule Pleroma.User do
     {:ok, user}
   end
 
+  @spec perform(atom(), User.t(), list()) :: list() | {:error, any()}
+  def perform(:blocks_import, %User{} = blocker, blocked_identifiers)
+      when is_list(blocked_identifiers) do
+    Enum.map(
+      blocked_identifiers,
+      fn blocked_identifier ->
+        with {:ok, %User{} = blocked} <- get_or_fetch(blocked_identifier),
+             {:ok, blocker} <- block(blocker, blocked),
+             {:ok, _} <- ActivityPub.block(blocker, blocked) do
+          blocked
+        else
+          err ->
+            Logger.debug("blocks_import failed for #{blocked_identifier} with: #{inspect(err)}")
+            err
+        end
+      end
+    )
+  end
+
+  @spec perform(atom(), User.t(), list()) :: list() | {:error, any()}
+  def perform(:follow_import, %User{} = follower, followed_identifiers)
+      when is_list(followed_identifiers) do
+    Enum.map(
+      followed_identifiers,
+      fn followed_identifier ->
+        with {:ok, %User{} = followed} <- get_or_fetch(followed_identifier),
+             {:ok, follower} <- maybe_direct_follow(follower, followed),
+             {:ok, _} <- ActivityPub.follow(follower, followed) do
+          followed
+        else
+          err ->
+            Logger.debug("follow_import failed for #{followed_identifier} with: #{inspect(err)}")
+            err
+        end
+      end
+    )
+  end
+
   def delete_user_activities(%User{ap_id: ap_id} = user) do
     stream =
       ap_id
diff --git a/lib/pleroma/web/twitter_api/controllers/util_controller.ex b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
index c03f8ab3a..143960206 100644
--- a/lib/pleroma/web/twitter_api/controllers/util_controller.ex
+++ b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
@@ -310,7 +310,12 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
              String.split(line, ",") |> List.first()
            end)
            |> List.delete("Account address"),
-         {:ok, _} = Task.start(fn -> User.follow_import(follower, followed_identifiers) end) do
+         :ok <-
+           PleromaJobQueue.enqueue(:background, User, [
+             :follow_import,
+             follower,
+             followed_identifiers
+           ]) do
       json(conn, "job started")
     end
   end
@@ -321,7 +326,12 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
 
   def blocks_import(%{assigns: %{user: blocker}} = conn, %{"list" => list}) do
     with blocked_identifiers <- String.split(list),
-         {:ok, _} = Task.start(fn -> User.blocks_import(blocker, blocked_identifiers) end) do
+         :ok <-
+           PleromaJobQueue.enqueue(:background, User, [
+             :blocks_import,
+             blocker,
+             blocked_identifiers
+           ]) do
       json(conn, "job started")
     end
   end
-- 
cgit v1.2.3


From 498bfdf403b6d20f92363a4b650dd0b926351e17 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Mon, 13 May 2019 15:37:38 -0500
Subject: Switch to Jason over Poison

---
 lib/mix/tasks/pleroma/emoji.ex            | 12 ++++++------
 lib/pleroma/captcha/kocaptcha.ex          |  2 +-
 lib/pleroma/uploaders/swift/keystone.ex   |  4 ++--
 lib/pleroma/web/activity_pub/utils.ex     |  2 +-
 lib/pleroma/web/federator/federator.ex    |  2 +-
 lib/pleroma/web/oauth/oauth_controller.ex |  4 ++--
 6 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/lib/mix/tasks/pleroma/emoji.ex b/lib/mix/tasks/pleroma/emoji.ex
index 5cb54c3ca..d2ddf450a 100644
--- a/lib/mix/tasks/pleroma/emoji.ex
+++ b/lib/mix/tasks/pleroma/emoji.ex
@@ -137,7 +137,7 @@ defmodule Mix.Tasks.Pleroma.Emoji do
           ])
         )
 
-        files = Tesla.get!(client(), files_url).body |> Poison.decode!()
+        files = Tesla.get!(client(), files_url).body |> Jason.decode!()
 
         IO.puts(IO.ANSI.format(["Unpacking ", :bright, pack_name]))
 
@@ -239,7 +239,7 @@ defmodule Mix.Tasks.Pleroma.Emoji do
 
     emoji_map = Pleroma.Emoji.make_shortcode_to_file_map(tmp_pack_dir, exts)
 
-    File.write!(files_name, Poison.encode!(emoji_map, pretty: true))
+    File.write!(files_name, Jason.encode!(emoji_map, pretty: true))
 
     IO.puts("""
 
@@ -248,11 +248,11 @@ defmodule Mix.Tasks.Pleroma.Emoji do
     """)
 
     if File.exists?("index.json") do
-      existing_data = File.read!("index.json") |> Poison.decode!()
+      existing_data = File.read!("index.json") |> Jason.decode!()
 
       File.write!(
         "index.json",
-        Poison.encode!(
+        Jason.encode!(
           Map.merge(
             existing_data,
             pack_json
@@ -263,14 +263,14 @@ defmodule Mix.Tasks.Pleroma.Emoji do
 
       IO.puts("index.json file has been update with the #{name} pack")
     else
-      File.write!("index.json", Poison.encode!(pack_json, pretty: true))
+      File.write!("index.json", Jason.encode!(pack_json, pretty: true))
 
       IO.puts("index.json has been created with the #{name} pack")
     end
   end
 
   defp fetch_manifest(from) do
-    Poison.decode!(
+    Jason.decode!(
       if String.starts_with?(from, "http") do
         Tesla.get!(client(), from).body
       else
diff --git a/lib/pleroma/captcha/kocaptcha.ex b/lib/pleroma/captcha/kocaptcha.ex
index 61688e778..18931d5a0 100644
--- a/lib/pleroma/captcha/kocaptcha.ex
+++ b/lib/pleroma/captcha/kocaptcha.ex
@@ -15,7 +15,7 @@ defmodule Pleroma.Captcha.Kocaptcha do
         %{error: "Kocaptcha service unavailable"}
 
       {:ok, res} ->
-        json_resp = Poison.decode!(res.body)
+        json_resp = Jason.decode!(res.body)
 
         %{
           type: :kocaptcha,
diff --git a/lib/pleroma/uploaders/swift/keystone.ex b/lib/pleroma/uploaders/swift/keystone.ex
index 3046cdbd2..dd44c7561 100644
--- a/lib/pleroma/uploaders/swift/keystone.ex
+++ b/lib/pleroma/uploaders/swift/keystone.ex
@@ -14,7 +14,7 @@ defmodule Pleroma.Uploaders.Swift.Keystone do
 
   def process_response_body(body) do
     body
-    |> Poison.decode!()
+    |> Jason.decode!()
   end
 
   def get_token do
@@ -38,7 +38,7 @@ defmodule Pleroma.Uploaders.Swift.Keystone do
   end
 
   def make_auth_body(username, password, tenant) do
-    Poison.encode!(%{
+    Jason.encode!(%{
       :auth => %{
         :passwordCredentials => %{
           :username => username,
diff --git a/lib/pleroma/web/activity_pub/utils.ex b/lib/pleroma/web/activity_pub/utils.ex
index 581b9d1ab..236d1b4ac 100644
--- a/lib/pleroma/web/activity_pub/utils.ex
+++ b/lib/pleroma/web/activity_pub/utils.ex
@@ -682,7 +682,7 @@ defmodule Pleroma.Web.ActivityPub.Utils do
   """
   def fetch_ordered_collection(from, pages_left, acc \\ []) do
     with {:ok, response} <- Tesla.get(from),
-         {:ok, collection} <- Poison.decode(response.body) do
+         {:ok, collection} <- Jason.decode(response.body) do
       case collection["type"] do
         "OrderedCollection" ->
           # If we've encountered the OrderedCollection and not the page,
diff --git a/lib/pleroma/web/federator/federator.ex b/lib/pleroma/web/federator/federator.ex
index 8621eda95..169fdf4dc 100644
--- a/lib/pleroma/web/federator/federator.ex
+++ b/lib/pleroma/web/federator/federator.ex
@@ -117,7 +117,7 @@ defmodule Pleroma.Web.Federator do
       _e ->
         # Just drop those for now
         Logger.info("Unhandled activity")
-        Logger.info(Poison.encode!(params, pretty: 2))
+        Logger.info(Jason.encode!(params, pretty: true))
         :error
     end
   end
diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index 862b8f8c9..4ee8339e2 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -274,7 +274,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
       auth_attrs
       |> Map.delete("scopes")
       |> Map.put("scope", scope)
-      |> Poison.encode!()
+      |> Jason.encode!()
 
     params =
       auth_attrs
@@ -338,7 +338,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
   end
 
   defp callback_params(%{"state" => state} = params) do
-    Map.merge(params, Poison.decode!(state))
+    Map.merge(params, Jason.decode!(state))
   end
 
   def registration_details(conn, %{"authorization" => auth_attrs}) do
-- 
cgit v1.2.3


From bbacdf235299e0c26c61f9b4784d4638093be343 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Mon, 13 May 2019 15:52:16 -0500
Subject: Bump Mastodon API level

---
 lib/pleroma/web/mastodon_api/mastodon_api_controller.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index defd88a44..87e597074 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -178,7 +178,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
     end
   end
 
-  @mastodon_api_level "2.6.5"
+  @mastodon_api_level "2.7.2"
 
   def masto_instance(conn, _params) do
     instance = Config.get(:instance)
-- 
cgit v1.2.3


From 6e1538cb76f7338e8bcb535e0d4989dc7aed84e8 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Mon, 13 May 2019 16:11:06 -0500
Subject: Document AdminFE in changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb934dab4..5c0baa317 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Metadata RelMe provider
 - OAuth: added support for refresh tokens
 - Emoji packs and emoji pack manager
+- AdminFE: initial release with basic user management accessible at /pleroma/admin/
 
 ### Changed
 - **Breaking:** Configuration: move from Pleroma.Mailer to Pleroma.Emails.Mailer
-- 
cgit v1.2.3


From a18b2c0b12b413c9a8d0aa0d4fd3b15e0e843cdf Mon Sep 17 00:00:00 2001
From: Aaron Tinio <aptinio@gmail.com>
Date: Tue, 14 May 2019 06:40:59 +0800
Subject: Fix Pleroma.Config.get!/1 raising an error when value is false

---
 lib/pleroma/config.ex |  8 ++++++--
 test/config_test.exs  | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/config.ex b/lib/pleroma/config.ex
index 189faa15f..71a47b9fb 100644
--- a/lib/pleroma/config.ex
+++ b/lib/pleroma/config.ex
@@ -12,8 +12,12 @@ defmodule Pleroma.Config do
   def get([key], default), do: get(key, default)
 
   def get([parent_key | keys], default) do
-    Application.get_env(:pleroma, parent_key)
-    |> get_in(keys) || default
+    case :pleroma
+         |> Application.get_env(parent_key)
+         |> get_in(keys) do
+      nil -> default
+      any -> any
+    end
   end
 
   def get(key, default) do
diff --git a/test/config_test.exs b/test/config_test.exs
index 0a6f0395a..73f3fcb0a 100644
--- a/test/config_test.exs
+++ b/test/config_test.exs
@@ -28,6 +28,15 @@ defmodule Pleroma.ConfigTest do
     assert Pleroma.Config.get([:azerty, :uiop], true) == true
   end
 
+  test "get/1 when value is false" do
+    Pleroma.Config.put([:instance, :false_test], false)
+    Pleroma.Config.put([:instance, :nested], [])
+    Pleroma.Config.put([:instance, :nested, :false_test], false)
+
+    assert Pleroma.Config.get([:instance, :false_test]) == false
+    assert Pleroma.Config.get([:instance, :nested, :false_test]) == false
+  end
+
   test "get!/1" do
     assert Pleroma.Config.get!(:instance) == Application.get_env(:pleroma, :instance)
 
@@ -43,6 +52,15 @@ defmodule Pleroma.ConfigTest do
     end)
   end
 
+  test "get!/1 when value is false" do
+    Pleroma.Config.put([:instance, :false_test], false)
+    Pleroma.Config.put([:instance, :nested], [])
+    Pleroma.Config.put([:instance, :nested, :false_test], false)
+
+    assert Pleroma.Config.get!([:instance, :false_test]) == false
+    assert Pleroma.Config.get!([:instance, :nested, :false_test]) == false
+  end
+
   test "put/2 with a key" do
     Pleroma.Config.put(:config_test, true)
 
-- 
cgit v1.2.3


From b92c004ea8a9ecd066b8eddf755a07a175338416 Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Tue, 14 May 2019 18:29:10 +0700
Subject: Reuse query from User.restrict_deactivated/1

---
 lib/pleroma/user.ex       | 2 +-
 lib/pleroma/user/query.ex | 4 +---
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index cf378d467..3eb684c3a 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -115,7 +115,7 @@ defmodule Pleroma.User do
     }
   end
 
-  defp restrict_deactivated(query) do
+  def restrict_deactivated(query) do
     from(u in query,
       where: not fragment("? \\? 'deactivated' AND ?->'deactivated' @> 'true'", u.info, u.info)
     )
diff --git a/lib/pleroma/user/query.ex b/lib/pleroma/user/query.ex
index 3873ef80c..ace9c05f2 100644
--- a/lib/pleroma/user/query.ex
+++ b/lib/pleroma/user/query.ex
@@ -119,9 +119,7 @@ defmodule Pleroma.User.Query do
   end
 
   defp compose_query({:deactivated, false}, query) do
-    from(u in query,
-      where: not fragment("? \\? 'deactivated' AND ?->'deactivated' @> 'true'", u.info, u.info)
-    )
+    User.restrict_deactivated(query)
   end
 
   defp compose_query({:deactivated, true}, query) do
-- 
cgit v1.2.3


From c1665fd94de456768ddd59b8873d1bd26878970d Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Tue, 14 May 2019 18:40:21 +0700
Subject: Update CHANGELOG

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c0baa317..17e913648 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -64,6 +64,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Deps: Updated Ecto to 3.0.7
 - Don't ship finmoji by default, they can be installed as an emoji pack
 - Admin API: Move the user related API to `api/pleroma/admin/users`
+- Hide deactivated users and their statuses
 
 ### Fixed
 - Added an FTS index on objects. Running `vacuum analyze` and setting a larger `work_mem` is recommended.
-- 
cgit v1.2.3


From 52297920e74ad7f51bcd3b118522e5e3a8e1c794 Mon Sep 17 00:00:00 2001
From: Maksim <parallel588@gmail.com>
Date: Tue, 14 May 2019 14:49:45 +0000
Subject: Refactoring  oauth response.

---
 lib/pleroma/web/oauth/oauth_controller.ex | 77 ++++++-------------------------
 lib/pleroma/web/oauth/token/response.ex   | 32 +++++++++++++
 lib/pleroma/web/oauth/token/utils.ex      | 38 +++++++++++++++
 test/web/oauth/token/utils_test.exs       | 53 +++++++++++++++++++++
 4 files changed, 136 insertions(+), 64 deletions(-)
 create mode 100644 lib/pleroma/web/oauth/token/response.ex
 create mode 100644 test/web/oauth/token/utils_test.exs

diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index 4ee8339e2..ae2b80d95 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -19,8 +19,6 @@ defmodule Pleroma.Web.OAuth.OAuthController do
 
   if Pleroma.Config.oauth_consumer_enabled?(), do: plug(Ueberauth)
 
-  @expires_in Pleroma.Config.get([:oauth2, :token_expires_in], 600)
-
   plug(:fetch_session)
   plug(:fetch_flash)
 
@@ -144,14 +142,14 @@ defmodule Pleroma.Web.OAuth.OAuthController do
   @doc "Renew access_token with refresh_token"
   def token_exchange(
         conn,
-        %{"grant_type" => "refresh_token", "refresh_token" => token} = params
+        %{"grant_type" => "refresh_token", "refresh_token" => token} = _params
       ) do
-    with %App{} = app <- get_app_from_request(conn, params),
+    with {:ok, app} <- Token.Utils.fetch_app(conn),
          {:ok, %{user: user} = token} <- Token.get_by_refresh_token(app, token),
          {:ok, token} <- RefreshToken.grant(token) do
       response_attrs = %{created_at: Token.Utils.format_created_at(token)}
 
-      json(conn, response_token(user, token, response_attrs))
+      json(conn, Token.Response.build(user, token, response_attrs))
     else
       _error ->
         put_status(conn, 400)
@@ -160,14 +158,14 @@ defmodule Pleroma.Web.OAuth.OAuthController do
   end
 
   def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do
-    with %App{} = app <- get_app_from_request(conn, params),
+    with {:ok, app} <- Token.Utils.fetch_app(conn),
          fixed_token = Token.Utils.fix_padding(params["code"]),
          {:ok, auth} <- Authorization.get_by_token(app, fixed_token),
          %User{} = user <- User.get_cached_by_id(auth.user_id),
          {:ok, token} <- Token.exchange_token(app, auth) do
       response_attrs = %{created_at: Token.Utils.format_created_at(token)}
 
-      json(conn, response_token(user, token, response_attrs))
+      json(conn, Token.Response.build(user, token, response_attrs))
     else
       _error ->
         put_status(conn, 400)
@@ -179,14 +177,14 @@ defmodule Pleroma.Web.OAuth.OAuthController do
         conn,
         %{"grant_type" => "password"} = params
       ) do
-    with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn)},
-         %App{} = app <- get_app_from_request(conn, params),
+    with {:ok, %User{} = user} <- Authenticator.get_user(conn),
+         {:ok, app} <- Token.Utils.fetch_app(conn),
          {:auth_active, true} <- {:auth_active, User.auth_active?(user)},
          {:user_active, true} <- {:user_active, !user.info.deactivated},
          {:ok, scopes} <- validate_scopes(app, params),
          {:ok, auth} <- Authorization.create_authorization(app, user, scopes),
          {:ok, token} <- Token.exchange_token(app, auth) do
-      json(conn, response_token(user, token))
+      json(conn, Token.Response.build(user, token))
     else
       {:auth_active, false} ->
         # Per https://github.com/tootsuite/mastodon/blob/
@@ -218,21 +216,11 @@ defmodule Pleroma.Web.OAuth.OAuthController do
     token_exchange(conn, params)
   end
 
-  def token_exchange(conn, %{"grant_type" => "client_credentials"} = params) do
-    with %App{} = app <- get_app_from_request(conn, params),
+  def token_exchange(conn, %{"grant_type" => "client_credentials"} = _params) do
+    with {:ok, app} <- Token.Utils.fetch_app(conn),
          {:ok, auth} <- Authorization.create_authorization(app, %User{}),
-         {:ok, token} <- Token.exchange_token(app, auth),
-         {:ok, inserted_at} <- DateTime.from_naive(token.inserted_at, "Etc/UTC") do
-      response = %{
-        token_type: "Bearer",
-        access_token: token.token,
-        refresh_token: token.refresh_token,
-        created_at: DateTime.to_unix(inserted_at),
-        expires_in: 60 * 10,
-        scope: Enum.join(token.scopes, " ")
-      }
-
-      json(conn, response)
+         {:ok, token} <- Token.exchange_token(app, auth) do
+      json(conn, Token.Response.build_for_client_credentials(token))
     else
       _error ->
         put_status(conn, 400)
@@ -244,7 +232,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
   def token_exchange(conn, params), do: bad_request(conn, params)
 
   def token_revoke(conn, %{"token" => _token} = params) do
-    with %App{} = app <- get_app_from_request(conn, params),
+    with {:ok, app} <- Token.Utils.fetch_app(conn),
          {:ok, _token} <- RevokeToken.revoke(app, params) do
       json(conn, %{})
     else
@@ -427,33 +415,6 @@ defmodule Pleroma.Web.OAuth.OAuthController do
     end
   end
 
-  defp get_app_from_request(conn, params) do
-    conn
-    |> fetch_client_credentials(params)
-    |> fetch_client
-  end
-
-  defp fetch_client({id, secret}) when is_binary(id) and is_binary(secret) do
-    Repo.get_by(App, client_id: id, client_secret: secret)
-  end
-
-  defp fetch_client({_id, _secret}), do: nil
-
-  defp fetch_client_credentials(conn, params) do
-    # Per RFC 6749, HTTP Basic is preferred to body params
-    with ["Basic " <> encoded] <- get_req_header(conn, "authorization"),
-         {:ok, decoded} <- Base.decode64(encoded),
-         [id, secret] <-
-           Enum.map(
-             String.split(decoded, ":"),
-             fn s -> URI.decode_www_form(s) end
-           ) do
-      {id, secret}
-    else
-      _ -> {params["client_id"], params["client_secret"]}
-    end
-  end
-
   # Special case: Local MastodonFE
   defp redirect_uri(conn, "."), do: mastodon_api_url(conn, :login)
 
@@ -464,18 +425,6 @@ defmodule Pleroma.Web.OAuth.OAuthController do
   defp put_session_registration_id(conn, registration_id),
     do: put_session(conn, :registration_id, registration_id)
 
-  defp response_token(%User{} = user, token, opts \\ %{}) do
-    %{
-      token_type: "Bearer",
-      access_token: token.token,
-      refresh_token: token.refresh_token,
-      expires_in: @expires_in,
-      scope: Enum.join(token.scopes, " "),
-      me: user.ap_id
-    }
-    |> Map.merge(opts)
-  end
-
   @spec validate_scopes(App.t(), map()) ::
           {:ok, list()} | {:error, :missing_scopes | :unsupported_scopes}
   defp validate_scopes(app, params) do
diff --git a/lib/pleroma/web/oauth/token/response.ex b/lib/pleroma/web/oauth/token/response.ex
new file mode 100644
index 000000000..64e78b183
--- /dev/null
+++ b/lib/pleroma/web/oauth/token/response.ex
@@ -0,0 +1,32 @@
+defmodule Pleroma.Web.OAuth.Token.Response do
+  @moduledoc false
+
+  alias Pleroma.User
+  alias Pleroma.Web.OAuth.Token.Utils
+
+  @expires_in Pleroma.Config.get([:oauth2, :token_expires_in], 600)
+
+  @doc false
+  def build(%User{} = user, token, opts \\ %{}) do
+    %{
+      token_type: "Bearer",
+      access_token: token.token,
+      refresh_token: token.refresh_token,
+      expires_in: @expires_in,
+      scope: Enum.join(token.scopes, " "),
+      me: user.ap_id
+    }
+    |> Map.merge(opts)
+  end
+
+  def build_for_client_credentials(token) do
+    %{
+      token_type: "Bearer",
+      access_token: token.token,
+      refresh_token: token.refresh_token,
+      created_at: Utils.format_created_at(token),
+      expires_in: @expires_in,
+      scope: Enum.join(token.scopes, " ")
+    }
+  end
+end
diff --git a/lib/pleroma/web/oauth/token/utils.ex b/lib/pleroma/web/oauth/token/utils.ex
index a81560a1c..7a4fddafd 100644
--- a/lib/pleroma/web/oauth/token/utils.ex
+++ b/lib/pleroma/web/oauth/token/utils.ex
@@ -3,6 +3,44 @@ defmodule Pleroma.Web.OAuth.Token.Utils do
   Auxiliary functions for dealing with tokens.
   """
 
+  alias Pleroma.Repo
+  alias Pleroma.Web.OAuth.App
+
+  @doc "Fetch app by client credentials from request"
+  @spec fetch_app(Plug.Conn.t()) :: {:ok, App.t()} | {:error, :not_found}
+  def fetch_app(conn) do
+    res =
+      conn
+      |> fetch_client_credentials()
+      |> fetch_client
+
+    case res do
+      %App{} = app -> {:ok, app}
+      _ -> {:error, :not_found}
+    end
+  end
+
+  defp fetch_client({id, secret}) when is_binary(id) and is_binary(secret) do
+    Repo.get_by(App, client_id: id, client_secret: secret)
+  end
+
+  defp fetch_client({_id, _secret}), do: nil
+
+  defp fetch_client_credentials(conn) do
+    # Per RFC 6749, HTTP Basic is preferred to body params
+    with ["Basic " <> encoded] <- Plug.Conn.get_req_header(conn, "authorization"),
+         {:ok, decoded} <- Base.decode64(encoded),
+         [id, secret] <-
+           Enum.map(
+             String.split(decoded, ":"),
+             fn s -> URI.decode_www_form(s) end
+           ) do
+      {id, secret}
+    else
+      _ -> {conn.params["client_id"], conn.params["client_secret"]}
+    end
+  end
+
   @doc "convert token inserted_at to unix timestamp"
   def format_created_at(%{inserted_at: inserted_at} = _token) do
     inserted_at
diff --git a/test/web/oauth/token/utils_test.exs b/test/web/oauth/token/utils_test.exs
new file mode 100644
index 000000000..20e338cab
--- /dev/null
+++ b/test/web/oauth/token/utils_test.exs
@@ -0,0 +1,53 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.OAuth.Token.UtilsTest do
+  use Pleroma.DataCase
+  alias Pleroma.Web.OAuth.Token.Utils
+  import Pleroma.Factory
+
+  describe "fetch_app/1" do
+    test "returns error when credentials is invalid" do
+      assert {:error, :not_found} =
+               Utils.fetch_app(%Plug.Conn{params: %{"client_id" => 1, "client_secret" => "x"}})
+    end
+
+    test "returns App by params credentails" do
+      app = insert(:oauth_app)
+
+      assert {:ok, load_app} =
+               Utils.fetch_app(%Plug.Conn{
+                 params: %{"client_id" => app.client_id, "client_secret" => app.client_secret}
+               })
+
+      assert load_app == app
+    end
+
+    test "returns App by header credentails" do
+      app = insert(:oauth_app)
+      header = "Basic " <> Base.encode64("#{app.client_id}:#{app.client_secret}")
+
+      conn =
+        %Plug.Conn{}
+        |> Plug.Conn.put_req_header("authorization", header)
+
+      assert {:ok, load_app} = Utils.fetch_app(conn)
+      assert load_app == app
+    end
+  end
+
+  describe "format_created_at/1" do
+    test "returns formatted created at" do
+      token = insert(:oauth_token)
+      date = Utils.format_created_at(token)
+
+      token_date =
+        token.inserted_at
+        |> DateTime.from_naive!("Etc/UTC")
+        |> DateTime.to_unix()
+
+      assert token_date == date
+    end
+  end
+end
-- 
cgit v1.2.3


From ac3a3abf6bfae5a6217e0a212abd6be0b4a17309 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Tue, 14 May 2019 15:07:38 +0000
Subject: clean up follow/block imports a little

---
 lib/pleroma/user.ex                                | 16 +++++++++++++
 .../web/twitter_api/controllers/util_controller.ex | 28 +++++++++++-----------
 2 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index c94660de4..417d57d72 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1085,6 +1085,22 @@ defmodule Pleroma.User do
     )
   end
 
+  def blocks_import(%User{} = blocker, blocked_identifiers) when is_list(blocked_identifiers),
+    do:
+      PleromaJobQueue.enqueue(:background, __MODULE__, [
+        :blocks_import,
+        blocker,
+        blocked_identifiers
+      ])
+
+  def follow_import(%User{} = follower, followed_identifiers) when is_list(followed_identifiers),
+    do:
+      PleromaJobQueue.enqueue(:background, __MODULE__, [
+        :follow_import,
+        follower,
+        followed_identifiers
+      ])
+
   def delete_user_activities(%User{ap_id: ap_id} = user) do
     stream =
       ap_id
diff --git a/lib/pleroma/web/twitter_api/controllers/util_controller.ex b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
index 143960206..deaacd946 100644
--- a/lib/pleroma/web/twitter_api/controllers/util_controller.ex
+++ b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
@@ -309,13 +309,13 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
            Enum.map(lines, fn line ->
              String.split(line, ",") |> List.first()
            end)
-           |> List.delete("Account address"),
-         :ok <-
-           PleromaJobQueue.enqueue(:background, User, [
-             :follow_import,
-             follower,
-             followed_identifiers
-           ]) do
+           |> List.delete("Account address") do
+      PleromaJobQueue.enqueue(:background, User, [
+        :follow_import,
+        follower,
+        followed_identifiers
+      ])
+
       json(conn, "job started")
     end
   end
@@ -325,13 +325,13 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
   end
 
   def blocks_import(%{assigns: %{user: blocker}} = conn, %{"list" => list}) do
-    with blocked_identifiers <- String.split(list),
-         :ok <-
-           PleromaJobQueue.enqueue(:background, User, [
-             :blocks_import,
-             blocker,
-             blocked_identifiers
-           ]) do
+    with blocked_identifiers <- String.split(list) do
+      PleromaJobQueue.enqueue(:background, User, [
+        :blocks_import,
+        blocker,
+        blocked_identifiers
+      ])
+
       json(conn, "job started")
     end
   end
-- 
cgit v1.2.3


From 51325fd60cf96e2ae99e09f53264f2ca1e69781b Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Tue, 14 May 2019 15:35:06 +0000
Subject: gopher: fix rendering of post content (closes #895)

---
 lib/pleroma/gopher/server.ex | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/pleroma/gopher/server.ex b/lib/pleroma/gopher/server.ex
index 1d2e0785c..b3319e137 100644
--- a/lib/pleroma/gopher/server.ex
+++ b/lib/pleroma/gopher/server.ex
@@ -77,13 +77,13 @@ defmodule Pleroma.Gopher.Server.ProtocolHandler do
       user = User.get_cached_by_ap_id(activity.data["actor"])
 
       object = Object.normalize(activity)
-      like_count = object["like_count"] || 0
-      announcement_count = object["announcement_count"] || 0
+      like_count = object.data["like_count"] || 0
+      announcement_count = object.data["announcement_count"] || 0
 
       link("Post ##{activity.id} by #{user.nickname}", "/notices/#{activity.id}") <>
         info("#{like_count} likes, #{announcement_count} repeats") <>
         "i\tfake\t(NULL)\t0\r\n" <>
-        info(HTML.strip_tags(String.replace(object["content"], "<br>", "\r")))
+        info(HTML.strip_tags(String.replace(object.data["content"], "<br>", "\r")))
     end)
     |> Enum.join("i\tfake\t(NULL)\t0\r\n")
   end
-- 
cgit v1.2.3


From 1caa6331eaba71db5a04b2097ef06fd6e4a54739 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Tue, 14 May 2019 12:33:03 -0500
Subject: Group def perform() together to fix the build

---
 lib/pleroma/user.ex | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 19f91d63c..c6a562a61 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1014,8 +1014,6 @@ defmodule Pleroma.User do
     PleromaJobQueue.enqueue(:background, __MODULE__, [:deactivate_async, user, status])
   end
 
-  def perform(:deactivate_async, user, status), do: deactivate(user, status)
-
   def deactivate(%User{} = user, status \\ true) do
     info_cng = User.Info.set_activation_status(user.info, status)
 
@@ -1074,6 +1072,8 @@ defmodule Pleroma.User do
     {:ok, user}
   end
 
+  def perform(:deactivate_async, user, status), do: deactivate(user, status)
+
   @spec perform(atom(), User.t(), list()) :: list() | {:error, any()}
   def perform(:blocks_import, %User{} = blocker, blocked_identifiers)
       when is_list(blocked_identifiers) do
-- 
cgit v1.2.3


From 38f3393e934330454fb942048c19ee5640563a08 Mon Sep 17 00:00:00 2001
From: rinpatch <rinpatch@sdf.org>
Date: Tue, 14 May 2019 22:47:23 +0300
Subject: Make rate limiting for Mastodon Registration API less agressive and
 enable it by default.

As discussed on irc. Unlike Mastodon our web interface for registrations
is using the same APIs regular apps would be using, so 5 requests per 30
minutes per IP could hurt valid use-cases when Pleroma-FE switches to
it. Also enable the endpoint by default, it makes no sense to
have it disabled when
1. TwitterAPI endpoint is there and always enabled
2. Unlike Mastodon, there is no way to get an account without using the APIs (makes me wonder why the setting is even there)

Also in this commit: minor changelog improvements.
---
 CHANGELOG.md      | 12 ++++++------
 config/config.exs |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17e913648..c563c39da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,16 +22,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Admin API: Endpoints for listing/revoking invite tokens
 - Admin API: Endpoints for making users follow/unfollow each other
 - Admin API: added filters (role, tags, email, name) for users endpoint
+- AdminFE: initial release with basic user management accessible at /pleroma/admin/
 - Mastodon API: [Scheduled statuses](https://docs.joinmastodon.org/api/rest/scheduled-statuses/)
 - Mastodon API: `/api/v1/notifications/destroy_multiple` (glitch-soc extension)
 - Mastodon API: `/api/v1/pleroma/accounts/:id/favourites` (API extension)
 - Mastodon API: [Reports](https://docs.joinmastodon.org/api/rest/reports/)
-- Mastodon API: REST API for creating an account
+- Mastodon API: `POST /api/v1/accounts` (account creation API)
 - ActivityPub C2S: OAuth endpoints
-- Metadata RelMe provider
+- Metadata: RelMe provider
 - OAuth: added support for refresh tokens
 - Emoji packs and emoji pack manager
-- AdminFE: initial release with basic user management accessible at /pleroma/admin/
 
 ### Changed
 - **Breaking:** Configuration: move from Pleroma.Mailer to Pleroma.Emails.Mailer
@@ -44,8 +44,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Federation: Removed `inReplyToStatusId` from objects
 - Configuration: Dedupe enabled by default
 - Configuration: Added `extra_cookie_attrs` for setting non-standard cookie attributes. Defaults to ["SameSite=Lax"] so that remote follows work.
-- Pleroma API: Support for emoji tags in `/api/pleroma/emoji` resulting in a breaking API change
 - Timelines: Messages involving people you have blocked will be excluded from the timeline in all cases instead of just repeats.
+- Admin API: Move the user related API to `api/pleroma/admin/users`
+- Pleroma API: Support for emoji tags in `/api/pleroma/emoji` resulting in a breaking API change
 - Mastodon API: Support for `exclude_types`, `limit` and `min_id` in `/api/v1/notifications`
 - Mastodon API: Add `languages` and `registrations` to `/api/v1/instance`
 - Mastodon API: Provide plaintext versions of cw/content in the Status entity
@@ -63,7 +64,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Deps: Updated Cowboy to 2.6
 - Deps: Updated Ecto to 3.0.7
 - Don't ship finmoji by default, they can be installed as an emoji pack
-- Admin API: Move the user related API to `api/pleroma/admin/users`
 - Hide deactivated users and their statuses
 
 ### Fixed
@@ -71,7 +71,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Followers counter not being updated when a follower is blocked
 - Deactivated users being able to request an access token
 - Limit on request body in rich media/relme parsers being ignored resulting in a possible memory leak
-- proper Twitter Card generation instead of a dummy
+- Proper Twitter Card generation instead of a dummy
 - Deletions failing for users with a large number of posts
 - NodeInfo: Include admins in `staffAccounts`
 - ActivityPub: Crashing when requesting empty local user's outbox
diff --git a/config/config.exs b/config/config.exs
index 8d44c96de..32c7fecb8 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -239,7 +239,7 @@ config :pleroma, :instance,
   safe_dm_mentions: false,
   healthcheck: false
 
-config :pleroma, :app_account_creation, enabled: false, max_requests: 5, interval: 1800
+config :pleroma, :app_account_creation, enabled: true, max_requests: 25, interval: 1800
 
 config :pleroma, :markup,
   # XXX - unfortunately, inline images must be enabled by default right now, because
-- 
cgit v1.2.3


From 071f78733aaa8a6546c9267d14381be9c0af0333 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Tue, 14 May 2019 20:03:13 +0000
Subject: switch to pleroma/http_signatures library

---
 config/config.exs                                  |   3 +
 lib/pleroma/plugs/http_signature.ex                |   1 -
 lib/pleroma/signature.ex                           |  41 +++++
 lib/pleroma/web/activity_pub/publisher.ex          |   2 +-
 lib/pleroma/web/http_signatures/http_signatures.ex |  91 ----------
 mix.exs                                            |   3 +
 mix.lock                                           |   1 +
 test/web/http_sigs/http_sig_test.exs               | 194 ---------------------
 test/web/http_sigs/priv.key                        |  15 --
 test/web/http_sigs/pub.key                         |   6 -
 10 files changed, 49 insertions(+), 308 deletions(-)
 create mode 100644 lib/pleroma/signature.ex
 delete mode 100644 lib/pleroma/web/http_signatures/http_signatures.ex
 delete mode 100644 test/web/http_sigs/http_sig_test.exs
 delete mode 100644 test/web/http_sigs/priv.key
 delete mode 100644 test/web/http_sigs/pub.key

diff --git a/config/config.exs b/config/config.exs
index 8d44c96de..b75a370f1 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -484,6 +484,9 @@ config :pleroma, :oauth2,
   token_expires_in: 600,
   issue_new_refresh_token: true
 
+config :http_signatures,
+  adapter: Pleroma.Signature
+
 # Import environment specific config. This must remain at the bottom
 # of this file so it overrides the configuration defined above.
 import_config "#{Mix.env()}.exs"
diff --git a/lib/pleroma/plugs/http_signature.ex b/lib/pleroma/plugs/http_signature.ex
index 21c195713..e2874c469 100644
--- a/lib/pleroma/plugs/http_signature.ex
+++ b/lib/pleroma/plugs/http_signature.ex
@@ -4,7 +4,6 @@
 
 defmodule Pleroma.Web.Plugs.HTTPSignaturePlug do
   alias Pleroma.Web.ActivityPub.Utils
-  alias Pleroma.Web.HTTPSignatures
   import Plug.Conn
   require Logger
 
diff --git a/lib/pleroma/signature.ex b/lib/pleroma/signature.ex
new file mode 100644
index 000000000..b7ecf00a0
--- /dev/null
+++ b/lib/pleroma/signature.ex
@@ -0,0 +1,41 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Signature do
+  @behaviour HTTPSignatures.Adapter
+
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.ActivityPub
+  alias Pleroma.Web.ActivityPub.Utils
+  alias Pleroma.Web.Salmon
+  alias Pleroma.Web.WebFinger
+
+  def fetch_public_key(conn) do
+    with actor_id <- Utils.get_ap_id(conn.params["actor"]),
+         {:ok, public_key} <- User.get_public_key_for_ap_id(actor_id) do
+      {:ok, public_key}
+    else
+      e ->
+        {:error, e}
+    end
+  end
+
+  def refetch_public_key(conn) do
+    with actor_id <- Utils.get_ap_id(conn.params["actor"]),
+         {:ok, _user} <- ActivityPub.make_user_from_ap_id(actor_id),
+         {:ok, public_key} <- User.get_public_key_for_ap_id(actor_id) do
+      {:ok, public_key}
+    else
+      e ->
+        {:error, e}
+    end
+  end
+
+  def sign(%User{} = user, headers) do
+    with {:ok, %{info: %{keys: keys}}} <- WebFinger.ensure_keys_present(user),
+         {:ok, private_key, _} <- Salmon.keys_from_pem(keys) do
+      HTTPSignatures.sign(private_key, user.ap_id <> "#main-key", headers)
+    end
+  end
+end
diff --git a/lib/pleroma/web/activity_pub/publisher.ex b/lib/pleroma/web/activity_pub/publisher.ex
index 8e3af0a81..11dba87de 100644
--- a/lib/pleroma/web/activity_pub/publisher.ex
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@@ -54,7 +54,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       |> Timex.format!("{WDshort}, {0D} {Mshort} {YYYY} {h24}:{m}:{s} GMT")
 
     signature =
-      Pleroma.Web.HTTPSignatures.sign(actor, %{
+      Pleroma.Signature.sign(actor, %{
         host: host,
         "content-length": byte_size(json),
         digest: digest,
diff --git a/lib/pleroma/web/http_signatures/http_signatures.ex b/lib/pleroma/web/http_signatures/http_signatures.ex
deleted file mode 100644
index 8e2e2a44b..000000000
--- a/lib/pleroma/web/http_signatures/http_signatures.ex
+++ /dev/null
@@ -1,91 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-# https://tools.ietf.org/html/draft-cavage-http-signatures-08
-defmodule Pleroma.Web.HTTPSignatures do
-  alias Pleroma.User
-  alias Pleroma.Web.ActivityPub.ActivityPub
-  alias Pleroma.Web.ActivityPub.Utils
-
-  require Logger
-
-  def split_signature(sig) do
-    default = %{"headers" => "date"}
-
-    sig =
-      sig
-      |> String.trim()
-      |> String.split(",")
-      |> Enum.reduce(default, fn part, acc ->
-        [key | rest] = String.split(part, "=")
-        value = Enum.join(rest, "=")
-        Map.put(acc, key, String.trim(value, "\""))
-      end)
-
-    Map.put(sig, "headers", String.split(sig["headers"], ~r/\s/))
-  end
-
-  def validate(headers, signature, public_key) do
-    sigstring = build_signing_string(headers, signature["headers"])
-    Logger.debug("Signature: #{signature["signature"]}")
-    Logger.debug("Sigstring: #{sigstring}")
-    {:ok, sig} = Base.decode64(signature["signature"])
-    :public_key.verify(sigstring, :sha256, sig, public_key)
-  end
-
-  def validate_conn(conn) do
-    # TODO: How to get the right key and see if it is actually valid for that request.
-    # For now, fetch the key for the actor.
-    with actor_id <- Utils.get_ap_id(conn.params["actor"]),
-         {:ok, public_key} <- User.get_public_key_for_ap_id(actor_id) do
-      if validate_conn(conn, public_key) do
-        true
-      else
-        Logger.debug("Could not validate, re-fetching user and trying one more time")
-        # Fetch user anew and try one more time
-        with actor_id <- Utils.get_ap_id(conn.params["actor"]),
-             {:ok, _user} <- ActivityPub.make_user_from_ap_id(actor_id),
-             {:ok, public_key} <- User.get_public_key_for_ap_id(actor_id) do
-          validate_conn(conn, public_key)
-        end
-      end
-    else
-      _e ->
-        Logger.debug("Could not public key!")
-        false
-    end
-  end
-
-  def validate_conn(conn, public_key) do
-    headers = Enum.into(conn.req_headers, %{})
-    signature = split_signature(headers["signature"])
-    validate(headers, signature, public_key)
-  end
-
-  def build_signing_string(headers, used_headers) do
-    used_headers
-    |> Enum.map(fn header -> "#{header}: #{headers[header]}" end)
-    |> Enum.join("\n")
-  end
-
-  def sign(user, headers) do
-    with {:ok, %{info: %{keys: keys}}} <- Pleroma.Web.WebFinger.ensure_keys_present(user),
-         {:ok, private_key, _} = Pleroma.Web.Salmon.keys_from_pem(keys) do
-      sigstring = build_signing_string(headers, Map.keys(headers))
-
-      signature =
-        :public_key.sign(sigstring, :sha256, private_key)
-        |> Base.encode64()
-
-      [
-        keyId: user.ap_id <> "#main-key",
-        algorithm: "rsa-sha256",
-        headers: Map.keys(headers) |> Enum.join(" "),
-        signature: signature
-      ]
-      |> Enum.map(fn {k, v} -> "#{k}=\"#{v}\"" end)
-      |> Enum.join(",")
-    end
-  end
-end
diff --git a/mix.exs b/mix.exs
index b7b9d534d..033d86bb3 100644
--- a/mix.exs
+++ b/mix.exs
@@ -103,6 +103,9 @@ defmodule Pleroma.Mixfile do
       {:auto_linker,
        git: "https://git.pleroma.social/pleroma/auto_linker.git",
        ref: "c00c4e75b35367fa42c95ffd9b8c455bf9995829"},
+      {:http_signatures,
+       git: "https://git.pleroma.social/pleroma/http_signatures.git",
+       ref: "9789401987096ead65646b52b5a2ca6bf52fc531"},
       {:pleroma_job_queue, "~> 0.2.0"},
       {:telemetry, "~> 0.3"},
       {:prometheus_ex, "~> 3.0"},
diff --git a/mix.lock b/mix.lock
index 0b24818c5..a28d9f353 100644
--- a/mix.lock
+++ b/mix.lock
@@ -37,6 +37,7 @@
   "hackney": {:hex, :hackney, "1.15.1", "9f8f471c844b8ce395f7b6d8398139e26ddca9ebc171a8b91342ee15a19963f4", [:rebar3], [{:certifi, "2.5.1", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "6.0.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "1.0.1", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "~>1.1", [hex: :mimerl, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "1.1.4", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}], "hexpm"},
   "html_entities": {:hex, :html_entities, "0.4.0", "f2fee876858cf6aaa9db608820a3209e45a087c5177332799592142b50e89a6b", [:mix], [], "hexpm"},
   "html_sanitize_ex": {:hex, :html_sanitize_ex, "1.3.0", "f005ad692b717691203f940c686208aa3d8ffd9dd4bb3699240096a51fa9564e", [:mix], [{:mochiweb, "~> 2.15", [hex: :mochiweb, repo: "hexpm", optional: false]}], "hexpm"},
+  "http_signatures": {:git, "https://git.pleroma.social/pleroma/http_signatures.git", "9789401987096ead65646b52b5a2ca6bf52fc531", [ref: "9789401987096ead65646b52b5a2ca6bf52fc531"]},
   "httpoison": {:hex, :httpoison, "1.2.0", "2702ed3da5fd7a8130fc34b11965c8cfa21ade2f232c00b42d96d4967c39a3a3", [:mix], [{:hackney, "~> 1.8", [hex: :hackney, repo: "hexpm", optional: false]}], "hexpm"},
   "idna": {:hex, :idna, "6.0.0", "689c46cbcdf3524c44d5f3dde8001f364cd7608a99556d8fbd8239a5798d4c10", [:rebar3], [{:unicode_util_compat, "0.4.1", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm"},
   "jason": {:hex, :jason, "1.1.2", "b03dedea67a99223a2eaf9f1264ce37154564de899fd3d8b9a21b1a6fd64afe7", [:mix], [{:decimal, "~> 1.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm"},
diff --git a/test/web/http_sigs/http_sig_test.exs b/test/web/http_sigs/http_sig_test.exs
deleted file mode 100644
index c4d2eaf78..000000000
--- a/test/web/http_sigs/http_sig_test.exs
+++ /dev/null
@@ -1,194 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-# http signatures
-# Test data from https://tools.ietf.org/html/draft-cavage-http-signatures-08#appendix-C
-defmodule Pleroma.Web.HTTPSignaturesTest do
-  use Pleroma.DataCase
-  alias Pleroma.Web.HTTPSignatures
-  import Pleroma.Factory
-  import Tesla.Mock
-
-  setup do
-    mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
-    :ok
-  end
-
-  @public_key hd(:public_key.pem_decode(File.read!("test/web/http_sigs/pub.key")))
-              |> :public_key.pem_entry_decode()
-
-  @headers %{
-    "(request-target)" => "post /foo?param=value&pet=dog",
-    "host" => "example.com",
-    "date" => "Thu, 05 Jan 2014 21:31:40 GMT",
-    "content-type" => "application/json",
-    "digest" => "SHA-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=",
-    "content-length" => "18"
-  }
-
-  @default_signature """
-  keyId="Test",algorithm="rsa-sha256",signature="jKyvPcxB4JbmYY4mByyBY7cZfNl4OW9HpFQlG7N4YcJPteKTu4MWCLyk+gIr0wDgqtLWf9NLpMAMimdfsH7FSWGfbMFSrsVTHNTk0rK3usrfFnti1dxsM4jl0kYJCKTGI/UWkqiaxwNiKqGcdlEDrTcUhhsFsOIo8VhddmZTZ8w="
-  """
-
-  @basic_signature """
-  keyId="Test",algorithm="rsa-sha256",headers="(request-target) host date",signature="HUxc9BS3P/kPhSmJo+0pQ4IsCo007vkv6bUm4Qehrx+B1Eo4Mq5/6KylET72ZpMUS80XvjlOPjKzxfeTQj4DiKbAzwJAb4HX3qX6obQTa00/qPDXlMepD2JtTw33yNnm/0xV7fQuvILN/ys+378Ysi082+4xBQFwvhNvSoVsGv4="
-  """
-
-  @all_headers_signature """
-  keyId="Test",algorithm="rsa-sha256",headers="(request-target) host date content-type digest content-length",signature="Ef7MlxLXoBovhil3AlyjtBwAL9g4TN3tibLj7uuNB3CROat/9KaeQ4hW2NiJ+pZ6HQEOx9vYZAyi+7cmIkmJszJCut5kQLAwuX+Ms/mUFvpKlSo9StS2bMXDBNjOh4Auj774GFj4gwjS+3NhFeoqyr/MuN6HsEnkvn6zdgfE2i0="
-  """
-
-  test "split up a signature" do
-    expected = %{
-      "keyId" => "Test",
-      "algorithm" => "rsa-sha256",
-      "signature" =>
-        "jKyvPcxB4JbmYY4mByyBY7cZfNl4OW9HpFQlG7N4YcJPteKTu4MWCLyk+gIr0wDgqtLWf9NLpMAMimdfsH7FSWGfbMFSrsVTHNTk0rK3usrfFnti1dxsM4jl0kYJCKTGI/UWkqiaxwNiKqGcdlEDrTcUhhsFsOIo8VhddmZTZ8w=",
-      "headers" => ["date"]
-    }
-
-    assert HTTPSignatures.split_signature(@default_signature) == expected
-  end
-
-  test "validates the default case" do
-    signature = HTTPSignatures.split_signature(@default_signature)
-    assert HTTPSignatures.validate(@headers, signature, @public_key)
-  end
-
-  test "validates the basic case" do
-    signature = HTTPSignatures.split_signature(@basic_signature)
-    assert HTTPSignatures.validate(@headers, signature, @public_key)
-  end
-
-  test "validates the all-headers case" do
-    signature = HTTPSignatures.split_signature(@all_headers_signature)
-    assert HTTPSignatures.validate(@headers, signature, @public_key)
-  end
-
-  test "it contructs a signing string" do
-    expected = "date: Thu, 05 Jan 2014 21:31:40 GMT\ncontent-length: 18"
-    assert expected == HTTPSignatures.build_signing_string(@headers, ["date", "content-length"])
-  end
-
-  test "it validates a conn" do
-    public_key_pem =
-      "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnGb42rPZIapY4Hfhxrgn\nxKVJczBkfDviCrrYaYjfGxawSw93dWTUlenCVTymJo8meBlFgIQ70ar4rUbzl6GX\nMYvRdku072d1WpglNHXkjKPkXQgngFDrh2sGKtNB/cEtJcAPRO8OiCgPFqRtMiNM\nc8VdPfPdZuHEIZsJ/aUM38EnqHi9YnVDQik2xxDe3wPghOhqjxUM6eLC9jrjI+7i\naIaEygUdyst9qVg8e2FGQlwAeS2Eh8ygCxn+bBlT5OyV59jSzbYfbhtF2qnWHtZy\nkL7KOOwhIfGs7O9SoR2ZVpTEQ4HthNzainIe/6iCR5HGrao/T8dygweXFYRv+k5A\nPQIDAQAB\n-----END PUBLIC KEY-----\n"
-
-    [public_key] = :public_key.pem_decode(public_key_pem)
-
-    public_key =
-      public_key
-      |> :public_key.pem_entry_decode()
-
-    conn = %{
-      req_headers: [
-        {"host", "localtesting.pleroma.lol"},
-        {"connection", "close"},
-        {"content-length", "2316"},
-        {"user-agent", "http.rb/2.2.2 (Mastodon/2.1.0.rc3; +http://mastodon.example.org/)"},
-        {"date", "Sun, 10 Dec 2017 14:23:49 GMT"},
-        {"digest", "SHA-256=x/bHADMW8qRrq2NdPb5P9fl0lYpKXXpe5h5maCIL0nM="},
-        {"content-type", "application/activity+json"},
-        {"(request-target)", "post /users/demiurge/inbox"},
-        {"signature",
-         "keyId=\"http://mastodon.example.org/users/admin#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) user-agent host date digest content-type\",signature=\"i0FQvr51sj9BoWAKydySUAO1RDxZmNY6g7M62IA7VesbRSdFZZj9/fZapLp6YSuvxUF0h80ZcBEq9GzUDY3Chi9lx6yjpUAS2eKb+Am/hY3aswhnAfYd6FmIdEHzsMrpdKIRqO+rpQ2tR05LwiGEHJPGS0p528NvyVxrxMT5H5yZS5RnxY5X2HmTKEgKYYcvujdv7JWvsfH88xeRS7Jlq5aDZkmXvqoR4wFyfgnwJMPLel8P/BUbn8BcXglH/cunR0LUP7sflTxEz+Rv5qg+9yB8zgBsB4C0233WpcJxjeD6Dkq0EcoJObBR56F8dcb7NQtUDu7x6xxzcgSd7dHm5w==\""}
-      ]
-    }
-
-    assert HTTPSignatures.validate_conn(conn, public_key)
-  end
-
-  test "it validates a conn and fetches the key" do
-    conn = %{
-      params: %{"actor" => "http://mastodon.example.org/users/admin"},
-      req_headers: [
-        {"host", "localtesting.pleroma.lol"},
-        {"x-forwarded-for", "127.0.0.1"},
-        {"connection", "close"},
-        {"content-length", "2307"},
-        {"user-agent", "http.rb/2.2.2 (Mastodon/2.1.0.rc3; +http://mastodon.example.org/)"},
-        {"date", "Sun, 11 Feb 2018 17:12:01 GMT"},
-        {"digest", "SHA-256=UXsAnMtR9c7mi1FOf6HRMtPgGI1yi2e9nqB/j4rZ99I="},
-        {"content-type", "application/activity+json"},
-        {"signature",
-         "keyId=\"http://mastodon.example.org/users/admin#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) user-agent host date digest content-type\",signature=\"qXKqpQXUpC3d9bZi2ioEeAqP8nRMD021CzH1h6/w+LRk4Hj31ARJHDwQM+QwHltwaLDUepshMfz2WHSXAoLmzWtvv7xRwY+mRqe+NGk1GhxVZ/LSrO/Vp7rYfDpfdVtkn36LU7/Bzwxvvaa4ZWYltbFsRBL0oUrqsfmJFswNCQIG01BB52BAhGSCORHKtQyzo1IZHdxl8y80pzp/+FOK2SmHkqWkP9QbaU1qTZzckL01+7M5btMW48xs9zurEqC2sM5gdWMQSZyL6isTV5tmkTZrY8gUFPBJQZgihK44v3qgfWojYaOwM8ATpiv7NG8wKN/IX7clDLRMA8xqKRCOKw==\""},
-        {"(request-target)", "post /users/demiurge/inbox"}
-      ]
-    }
-
-    assert HTTPSignatures.validate_conn(conn)
-  end
-
-  test "validate this" do
-    conn = %{
-      params: %{"actor" => "https://niu.moe/users/rye"},
-      req_headers: [
-        {"x-forwarded-for", "149.202.73.191"},
-        {"host", "testing.pleroma.lol"},
-        {"x-cluster-client-ip", "149.202.73.191"},
-        {"connection", "upgrade"},
-        {"content-length", "2396"},
-        {"user-agent", "http.rb/3.0.0 (Mastodon/2.2.0; +https://niu.moe/)"},
-        {"date", "Sun, 18 Feb 2018 20:31:51 GMT"},
-        {"digest", "SHA-256=dzH+vLyhxxALoe9RJdMl4hbEV9bGAZnSfddHQzeidTU="},
-        {"content-type", "application/activity+json"},
-        {"signature",
-         "keyId=\"https://niu.moe/users/rye#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) user-agent host date digest content-type\",signature=\"wtxDg4kIpW7nsnUcVJhBk6SgJeDZOocr8yjsnpDRqE52lR47SH6X7G16r7L1AUJdlnbfx7oqcvomoIJoHB3ghP6kRnZW6MyTMZ2jPoi3g0iC5RDqv6oAmDSO14iw6U+cqZbb3P/odS5LkbThF0UNXcfenVNfsKosIJycFjhNQc54IPCDXYq/7SArEKJp8XwEgzmiC2MdxlkVIUSTQYfjM4EG533cwlZocw1mw72e5mm/owTa80BUZAr0OOuhoWARJV9btMb02ZyAF6SCSoGPTA37wHyfM1Dk88NHf7Z0Aov/Fl65dpRM+XyoxdkpkrhDfH9qAx4iuV2VEWddQDiXHA==\""},
-        {"(request-target)", "post /inbox"}
-      ]
-    }
-
-    assert HTTPSignatures.validate_conn(conn)
-  end
-
-  test "validate this too" do
-    conn = %{
-      params: %{"actor" => "https://niu.moe/users/rye"},
-      req_headers: [
-        {"x-forwarded-for", "149.202.73.191"},
-        {"host", "testing.pleroma.lol"},
-        {"x-cluster-client-ip", "149.202.73.191"},
-        {"connection", "upgrade"},
-        {"content-length", "2342"},
-        {"user-agent", "http.rb/3.0.0 (Mastodon/2.2.0; +https://niu.moe/)"},
-        {"date", "Sun, 18 Feb 2018 21:44:46 GMT"},
-        {"digest", "SHA-256=vS8uDOJlyAu78cF3k5EzrvaU9iilHCX3chP37gs5sS8="},
-        {"content-type", "application/activity+json"},
-        {"signature",
-         "keyId=\"https://niu.moe/users/rye#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) user-agent host date digest content-type\",signature=\"IN6fHD8pLiDEf35dOaRHzJKc1wBYh3/Yq0ItaNGxUSbJTd2xMjigZbcsVKzvgYYjglDDN+disGNeD+OBKwMqkXWaWe/lyMc9wHvCH5NMhpn/A7qGLY8yToSt4vh8ytSkZKO6B97yC+Nvy6Fz/yMbvKtFycIvSXCq417cMmY6f/aG+rtMUlTbKO5gXzC7SUgGJCtBPCh1xZzu5/w0pdqdjO46ePNeR6JyJSLLV4hfo3+p2n7SRraxM4ePVCUZqhwS9LPt3Zdhy3ut+IXCZgMVIZggQFM+zXLtcXY5HgFCsFQr5WQDu+YkhWciNWtKFnWfAsnsg5sC330lZ/0Z8Z91yA==\""},
-        {"(request-target)", "post /inbox"}
-      ]
-    }
-
-    assert HTTPSignatures.validate_conn(conn)
-  end
-
-  test "it generates a signature" do
-    user = insert(:user)
-    assert HTTPSignatures.sign(user, %{host: "mastodon.example.org"}) =~ "keyId=\""
-  end
-
-  test "this too" do
-    conn = %{
-      params: %{"actor" => "https://mst3k.interlinked.me/users/luciferMysticus"},
-      req_headers: [
-        {"host", "soc.canned-death.us"},
-        {"user-agent", "http.rb/3.0.0 (Mastodon/2.2.0; +https://mst3k.interlinked.me/)"},
-        {"date", "Sun, 11 Mar 2018 12:19:36 GMT"},
-        {"digest", "SHA-256=V7Hl6qDK2m8WzNsjzNYSBISi9VoIXLFlyjF/a5o1SOc="},
-        {"content-type", "application/activity+json"},
-        {"signature",
-         "keyId=\"https://mst3k.interlinked.me/users/luciferMysticus#main-key\",algorithm=\"rsa-sha256\",headers=\"(request-target) user-agent host date digest content-type\",signature=\"CTYdK5a6lYMxzmqjLOpvRRASoxo2Rqib2VrAvbR5HaTn80kiImj15pCpAyx8IZp53s0Fn/y8MjCTzp+absw8kxx0k2sQAXYs2iy6xhdDUe7iGzz+XLAEqLyZIZfecynaU2nb3Z2XnFDjhGjR1vj/JP7wiXpwp6o1dpDZj+KT2vxHtXuB9585V+sOHLwSB1cGDbAgTy0jx/2az2EGIKK2zkw1KJuAZm0DDMSZalp/30P8dl3qz7DV2EHdDNfaVtrs5BfbDOZ7t1hCcASllzAzgVGFl0BsrkzBfRMeUMRucr111ZG+c0BNOEtJYOHSyZsSSdNknElggCJekONYMYk5ZA==\""},
-        {"x-forwarded-for", "2607:5300:203:2899::31:1337"},
-        {"x-forwarded-host", "soc.canned-death.us"},
-        {"x-forwarded-server", "soc.canned-death.us"},
-        {"connection", "Keep-Alive"},
-        {"content-length", "2006"},
-        {"(request-target)", "post /inbox"}
-      ]
-    }
-
-    assert HTTPSignatures.validate_conn(conn)
-  end
-end
diff --git a/test/web/http_sigs/priv.key b/test/web/http_sigs/priv.key
deleted file mode 100644
index 425518a06..000000000
--- a/test/web/http_sigs/priv.key
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDCFENGw33yGihy92pDjZQhl0C36rPJj+CvfSC8+q28hxA161QF
-NUd13wuCTUcq0Qd2qsBe/2hFyc2DCJJg0h1L78+6Z4UMR7EOcpfdUE9Hf3m/hs+F
-UR45uBJeDK1HSFHD8bHKD6kv8FPGfJTotc+2xjJwoYi+1hqp1fIekaxsyQIDAQAB
-AoGBAJR8ZkCUvx5kzv+utdl7T5MnordT1TvoXXJGXK7ZZ+UuvMNUCdN2QPc4sBiA
-QWvLw1cSKt5DsKZ8UETpYPy8pPYnnDEz2dDYiaew9+xEpubyeW2oH4Zx71wqBtOK
-kqwrXa/pzdpiucRRjk6vE6YY7EBBs/g7uanVpGibOVAEsqH1AkEA7DkjVH28WDUg
-f1nqvfn2Kj6CT7nIcE3jGJsZZ7zlZmBmHFDONMLUrXR/Zm3pR5m0tCmBqa5RK95u
-412jt1dPIwJBANJT3v8pnkth48bQo/fKel6uEYyboRtA5/uHuHkZ6FQF7OUkGogc
-mSJluOdc5t6hI1VsLn0QZEjQZMEOWr+wKSMCQQCC4kXJEsHAve77oP6HtG/IiEn7
-kpyUXRNvFsDE0czpJJBvL/aRFUJxuRK91jhjC68sA7NsKMGg5OXb5I5Jj36xAkEA
-gIT7aFOYBFwGgQAQkWNKLvySgKbAZRTeLBacpHMuQdl1DfdntvAyqpAZ0lY0RKmW
-G6aFKaqQfOXKCyWoUiVknQJAXrlgySFci/2ueKlIE1QqIiLSZ8V8OlpFLRnb1pzI
-7U1yQXnTAEFYM560yJlzUpOb1V4cScGd365tiSMvxLOvTA==
------END RSA PRIVATE KEY-----
diff --git a/test/web/http_sigs/pub.key b/test/web/http_sigs/pub.key
deleted file mode 100644
index b3bbf6cb9..000000000
--- a/test/web/http_sigs/pub.key
+++ /dev/null
@@ -1,6 +0,0 @@
------BEGIN PUBLIC KEY-----
-MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCFENGw33yGihy92pDjZQhl0C3
-6rPJj+CvfSC8+q28hxA161QFNUd13wuCTUcq0Qd2qsBe/2hFyc2DCJJg0h1L78+6
-Z4UMR7EOcpfdUE9Hf3m/hs+FUR45uBJeDK1HSFHD8bHKD6kv8FPGfJTotc+2xjJw
-oYi+1hqp1fIekaxsyQIDAQAB
------END PUBLIC KEY-----
-- 
cgit v1.2.3


From 2ca8d20053ef2abda070b8aba0e6937cf2f07991 Mon Sep 17 00:00:00 2001
From: rinpatch <rinpatch@sdf.org>
Date: Tue, 14 May 2019 23:16:34 +0300
Subject: Fix rate-limiting tests

---
 config/test.exs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/config/test.exs b/config/test.exs
index f93bc5994..a0c90c371 100644
--- a/config/test.exs
+++ b/config/test.exs
@@ -59,6 +59,8 @@ config :pleroma, Pleroma.ScheduledActivity,
   total_user_limit: 3,
   enabled: false
 
+config :pleroma, :app_account_creation, max_requests: 5
+
 try do
   import_config "test.secret.exs"
 rescue
-- 
cgit v1.2.3


From 7b8dc99ef106314f1418ff1c314b47cf58a3c2d2 Mon Sep 17 00:00:00 2001
From: Aaron Tinio <aptinio@gmail.com>
Date: Tue, 14 May 2019 08:21:44 +0800
Subject: Implement Pleroma.Plugs.EnsurePublicOrAuthenticated

---
 .../plugs/ensure_public_or_authenticated_plug.ex   | 31 ++++++++++++
 .../ensure_public_or_authenticated_plug_test.exs   | 55 ++++++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 lib/pleroma/plugs/ensure_public_or_authenticated_plug.ex
 create mode 100644 test/plugs/ensure_public_or_authenticated_plug_test.exs

diff --git a/lib/pleroma/plugs/ensure_public_or_authenticated_plug.ex b/lib/pleroma/plugs/ensure_public_or_authenticated_plug.ex
new file mode 100644
index 000000000..317fd5445
--- /dev/null
+++ b/lib/pleroma/plugs/ensure_public_or_authenticated_plug.ex
@@ -0,0 +1,31 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug do
+  import Plug.Conn
+  alias Pleroma.Config
+  alias Pleroma.User
+
+  def init(options) do
+    options
+  end
+
+  def call(conn, _) do
+    public? = Config.get!([:instance, :public])
+
+    case {public?, conn} do
+      {true, _} ->
+        conn
+
+      {false, %{assigns: %{user: %User{}}}} ->
+        conn
+
+      {false, _} ->
+        conn
+        |> put_resp_content_type("application/json")
+        |> send_resp(403, Jason.encode!(%{error: "This resource requires authentication."}))
+        |> halt
+    end
+  end
+end
diff --git a/test/plugs/ensure_public_or_authenticated_plug_test.exs b/test/plugs/ensure_public_or_authenticated_plug_test.exs
new file mode 100644
index 000000000..ce5d77ff7
--- /dev/null
+++ b/test/plugs/ensure_public_or_authenticated_plug_test.exs
@@ -0,0 +1,55 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Plugs.EnsurePublicOrAuthenticatedPlugTest do
+  use Pleroma.Web.ConnCase, async: true
+
+  alias Pleroma.Config
+  alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
+  alias Pleroma.User
+
+  test "it halts if not public and no user is assigned", %{conn: conn} do
+    set_public_to(false)
+
+    conn =
+      conn
+      |> EnsurePublicOrAuthenticatedPlug.call(%{})
+
+    assert conn.status == 403
+    assert conn.halted == true
+  end
+
+  test "it continues if public", %{conn: conn} do
+    set_public_to(true)
+
+    ret_conn =
+      conn
+      |> EnsurePublicOrAuthenticatedPlug.call(%{})
+
+    assert ret_conn == conn
+  end
+
+  test "it continues if a user is assigned, even if not public", %{conn: conn} do
+    set_public_to(false)
+
+    conn =
+      conn
+      |> assign(:user, %User{})
+
+    ret_conn =
+      conn
+      |> EnsurePublicOrAuthenticatedPlug.call(%{})
+
+    assert ret_conn == conn
+  end
+
+  defp set_public_to(value) do
+    orig = Config.get!([:instance, :public])
+    Config.put([:instance, :public], value)
+
+    on_exit(fn ->
+      Config.put([:instance, :public], orig)
+    end)
+  end
+end
-- 
cgit v1.2.3


From 70c81b95d095a7148085201cfa3a07283ef296d9 Mon Sep 17 00:00:00 2001
From: Aaron Tinio <aptinio@gmail.com>
Date: Mon, 13 May 2019 23:07:11 +0800
Subject: Pipe requests to public endpoints through
 EnsurePublicOrAuthenticatedPlug

---
 lib/pleroma/web/router.ex                              | 16 +++++++++-------
 test/web/mastodon_api/mastodon_api_controller_test.exs | 13 +++++++++++++
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 80af0afe1..7fef82f82 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -84,11 +84,13 @@ defmodule Pleroma.Web.Router do
     plug(Pleroma.Plugs.EnsureUserKeyPlug)
   end
 
-  pipeline :oauth_read_or_unauthenticated do
+  pipeline :oauth_read_or_public do
     plug(Pleroma.Plugs.OAuthScopesPlug, %{
       scopes: ["read"],
       fallback: :proceed_unauthenticated
     })
+
+    plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)
   end
 
   pipeline :oauth_read do
@@ -404,7 +406,7 @@ defmodule Pleroma.Web.Router do
     get("/accounts/search", MastodonAPIController, :account_search)
 
     scope [] do
-      pipe_through(:oauth_read_or_unauthenticated)
+      pipe_through(:oauth_read_or_public)
 
       get("/timelines/public", MastodonAPIController, :public_timeline)
       get("/timelines/tag/:tag", MastodonAPIController, :hashtag_timeline)
@@ -425,7 +427,7 @@ defmodule Pleroma.Web.Router do
   end
 
   scope "/api/v2", Pleroma.Web.MastodonAPI do
-    pipe_through([:api, :oauth_read_or_unauthenticated])
+    pipe_through([:api, :oauth_read_or_public])
     get("/search", MastodonAPIController, :search2)
   end
 
@@ -455,7 +457,7 @@ defmodule Pleroma.Web.Router do
     )
 
     scope [] do
-      pipe_through(:oauth_read_or_unauthenticated)
+      pipe_through(:oauth_read_or_public)
 
       get("/statuses/user_timeline", TwitterAPI.Controller, :user_timeline)
       get("/qvitter/statuses/user_timeline", TwitterAPI.Controller, :user_timeline)
@@ -473,7 +475,7 @@ defmodule Pleroma.Web.Router do
   end
 
   scope "/api", Pleroma.Web do
-    pipe_through([:api, :oauth_read_or_unauthenticated])
+    pipe_through([:api, :oauth_read_or_public])
 
     get("/statuses/public_timeline", TwitterAPI.Controller, :public_timeline)
 
@@ -487,7 +489,7 @@ defmodule Pleroma.Web.Router do
   end
 
   scope "/api", Pleroma.Web, as: :twitter_api_search do
-    pipe_through([:api, :oauth_read_or_unauthenticated])
+    pipe_through([:api, :oauth_read_or_public])
     get("/pleroma/search_user", TwitterAPI.Controller, :search_user)
   end
 
@@ -671,7 +673,7 @@ defmodule Pleroma.Web.Router do
     delete("/auth/sign_out", MastodonAPIController, :logout)
 
     scope [] do
-      pipe_through(:oauth_read_or_unauthenticated)
+      pipe_through(:oauth_read_or_public)
       get("/web/*path", MastodonAPIController, :index)
     end
   end
diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 5c79ee633..40e7739e7 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -81,6 +81,19 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
     end)
   end
 
+  test "the public timeline when public is set to false", %{conn: conn} do
+    public = Pleroma.Config.get([:instance, :public])
+    Pleroma.Config.put([:instance, :public], false)
+
+    on_exit(fn ->
+      Pleroma.Config.put([:instance, :public], public)
+    end)
+
+    assert conn
+           |> get("/api/v1/timelines/public", %{"local" => "False"})
+           |> json_response(403) == %{"error" => "This resource requires authentication."}
+  end
+
   test "posting a status", %{conn: conn} do
     user = insert(:user)
 
-- 
cgit v1.2.3


From 6c9f45f4ddde48d2239ab68916e65d0ee5c2be76 Mon Sep 17 00:00:00 2001
From: Egor Kislitsyn <egor@kislitsyn.com>
Date: Wed, 15 May 2019 14:40:20 +0700
Subject: Remove unused queue from the config

---
 config/config.exs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/config/config.exs b/config/config.exs
index 32c7fecb8..3452eb1bb 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -424,8 +424,7 @@ config :pleroma_job_queue, :queues,
   mailer: 10,
   transmogrifier: 20,
   scheduled_activities: 10,
-  background: 5,
-  user: 10
+  background: 5
 
 config :pleroma, :fetch_initial_posts,
   enabled: false,
-- 
cgit v1.2.3


From ee22fff5ac4631edc6035e349c787d29a13adeaf Mon Sep 17 00:00:00 2001
From: Sachin Joshi <satchin.joshi@gmail.com>
Date: Tue, 14 May 2019 23:37:08 +0545
Subject: remove deprecated PleromaFE configuration

---
 CHANGELOG.md                                       |  3 +++
 config/config.exs                                  | 19 ---------------
 lib/pleroma/config/deprecation_warnings.ex         | 10 --------
 .../web/twitter_api/controllers/util_controller.ex | 28 +---------------------
 test/web/twitter_api/util_controller_test.exs      | 26 ++------------------
 5 files changed, 6 insertions(+), 80 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17e913648..e8b7323fd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -97,6 +97,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Mastodon API: Exposing default scope of the user to anyone
 - Mastodon API: Make `irreversible` field default to `false` [`POST /api/v1/filters`]
 
+## Removed
+- Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations` 
+
 ## [0.9.9999] - 2019-04-05
 ### Security
 - Mastodon API: Fix content warnings skipping HTML sanitization
diff --git a/config/config.exs b/config/config.exs
index 8d44c96de..35ddbad8a 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -253,25 +253,6 @@ config :pleroma, :markup,
     Pleroma.HTML.Scrubber.Default
   ]
 
-# Deprecated, will be gone in 1.0
-config :pleroma, :fe,
-  theme: "pleroma-dark",
-  logo: "/static/logo.png",
-  logo_mask: true,
-  logo_margin: "0.1em",
-  background: "/static/aurora_borealis.jpg",
-  redirect_root_no_login: "/main/all",
-  redirect_root_login: "/main/friends",
-  show_instance_panel: true,
-  scope_options_enabled: false,
-  formatting_options_enabled: false,
-  collapse_message_with_subject: false,
-  hide_post_stats: false,
-  hide_user_stats: false,
-  scope_copy: true,
-  subject_line_behavior: "email",
-  always_show_subject_input: true
-
 config :pleroma, :frontend_configurations,
   pleroma_fe: %{
     theme: "pleroma-dark",
diff --git a/lib/pleroma/config/deprecation_warnings.ex b/lib/pleroma/config/deprecation_warnings.ex
index 0345ac19c..240fb1c37 100644
--- a/lib/pleroma/config/deprecation_warnings.ex
+++ b/lib/pleroma/config/deprecation_warnings.ex
@@ -5,15 +5,6 @@
 defmodule Pleroma.Config.DeprecationWarnings do
   require Logger
 
-  def check_frontend_config_mechanism do
-    if Pleroma.Config.get(:fe) do
-      Logger.warn("""
-      !!!DEPRECATION WARNING!!!
-      You are using the old configuration mechanism for the frontend. Please check config.md.
-      """)
-    end
-  end
-
   def check_hellthread_threshold do
     if Pleroma.Config.get([:mrf_hellthread, :threshold]) do
       Logger.warn("""
@@ -24,7 +15,6 @@ defmodule Pleroma.Config.DeprecationWarnings do
   end
 
   def warn do
-    check_frontend_config_mechanism()
     check_hellthread_threshold()
   end
 end
diff --git a/lib/pleroma/web/twitter_api/controllers/util_controller.ex b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
index 89c55ef0e..489170d80 100644
--- a/lib/pleroma/web/twitter_api/controllers/util_controller.ex
+++ b/lib/pleroma/web/twitter_api/controllers/util_controller.ex
@@ -173,8 +173,6 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
 
   def config(conn, _params) do
     instance = Pleroma.Config.get(:instance)
-    instance_fe = Pleroma.Config.get(:fe)
-    instance_chat = Pleroma.Config.get(:chat)
 
     case get_format(conn) do
       "xml" ->
@@ -219,31 +217,7 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
             if(Pleroma.Config.get([:instance, :safe_dm_mentions]), do: "1", else: "0")
         }
 
-        pleroma_fe =
-          if instance_fe do
-            %{
-              theme: Keyword.get(instance_fe, :theme),
-              background: Keyword.get(instance_fe, :background),
-              logo: Keyword.get(instance_fe, :logo),
-              logoMask: Keyword.get(instance_fe, :logo_mask),
-              logoMargin: Keyword.get(instance_fe, :logo_margin),
-              redirectRootNoLogin: Keyword.get(instance_fe, :redirect_root_no_login),
-              redirectRootLogin: Keyword.get(instance_fe, :redirect_root_login),
-              chatDisabled: !Keyword.get(instance_chat, :enabled),
-              showInstanceSpecificPanel: Keyword.get(instance_fe, :show_instance_panel),
-              scopeOptionsEnabled: Keyword.get(instance_fe, :scope_options_enabled),
-              formattingOptionsEnabled: Keyword.get(instance_fe, :formatting_options_enabled),
-              collapseMessageWithSubject:
-                Keyword.get(instance_fe, :collapse_message_with_subject),
-              hidePostStats: Keyword.get(instance_fe, :hide_post_stats),
-              hideUserStats: Keyword.get(instance_fe, :hide_user_stats),
-              scopeCopy: Keyword.get(instance_fe, :scope_copy),
-              subjectLineBehavior: Keyword.get(instance_fe, :subject_line_behavior),
-              alwaysShowSubjectInput: Keyword.get(instance_fe, :always_show_subject_input)
-            }
-          else
-            Pleroma.Config.get([:frontend_configurations, :pleroma_fe])
-          end
+        pleroma_fe = Pleroma.Config.get([:frontend_configurations, :pleroma_fe])
 
         managed_config = Keyword.get(instance, :managed_config)
 
diff --git a/test/web/twitter_api/util_controller_test.exs b/test/web/twitter_api/util_controller_test.exs
index 14a8225f0..2cd82b3e7 100644
--- a/test/web/twitter_api/util_controller_test.exs
+++ b/test/web/twitter_api/util_controller_test.exs
@@ -141,7 +141,7 @@ defmodule Pleroma.Web.TwitterAPI.UtilControllerTest do
 
     test "it returns the managed config", %{conn: conn} do
       Pleroma.Config.put([:instance, :managed_config], false)
-      Pleroma.Config.put([:fe], theme: "rei-ayanami-towel")
+      Pleroma.Config.put([:frontend_configurations, :pleroma_fe], %{theme: "asuka-hospital"})
 
       response =
         conn
@@ -157,29 +157,7 @@ defmodule Pleroma.Web.TwitterAPI.UtilControllerTest do
         |> get("/api/statusnet/config.json")
         |> json_response(:ok)
 
-      assert response["site"]["pleromafe"]
-    end
-
-    test "if :pleroma, :fe is false, it returns the new style config settings", %{conn: conn} do
-      Pleroma.Config.put([:instance, :managed_config], true)
-      Pleroma.Config.put([:fe, :theme], "rei-ayanami-towel")
-      Pleroma.Config.put([:frontend_configurations, :pleroma_fe], %{theme: "asuka-hospital"})
-
-      response =
-        conn
-        |> get("/api/statusnet/config.json")
-        |> json_response(:ok)
-
-      assert response["site"]["pleromafe"]["theme"] == "rei-ayanami-towel"
-
-      Pleroma.Config.put([:fe], false)
-
-      response =
-        conn
-        |> get("/api/statusnet/config.json")
-        |> json_response(:ok)
-
-      assert response["site"]["pleromafe"]["theme"] == "asuka-hospital"
+      assert response["site"]["pleromafe"] == %{"theme" => "asuka-hospital"}
     end
   end
 
-- 
cgit v1.2.3


From f1e67bdc312ba16a37916024244d6cb9d4417c9e Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 15 May 2019 15:28:01 +0200
Subject: Search: Add optional rum indexing / searching.

---
 config/config.exs                                  |  2 +
 docs/config.md                                     | 15 ++++++++
 .../web/mastodon_api/mastodon_api_controller.ex    | 43 +++++++++++++++++-----
 mix.exs                                            |  5 ++-
 mix.lock                                           | 10 ++---
 ...20190510135645_add_fts_index_to_objects_two.exs | 33 -----------------
 ...20190510135645_add_fts_index_to_objects_two.exs | 36 ++++++++++++++++++
 7 files changed, 95 insertions(+), 49 deletions(-)
 delete mode 100644 priv/repo/migrations/20190510135645_add_fts_index_to_objects_two.exs
 create mode 100644 priv/repo/optional_migrations/rum_indexing/20190510135645_add_fts_index_to_objects_two.exs

diff --git a/config/config.exs b/config/config.exs
index 1e64b79a7..42e4cb4ce 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -476,6 +476,8 @@ config :pleroma, :oauth2,
   token_expires_in: 600,
   issue_new_refresh_token: true
 
+config :pleroma, :database, rum_enabled: false
+
 # Import environment specific config. This must remain at the bottom
 # of this file so it overrides the configuration defined above.
 import_config "#{Mix.env()}.exs"
diff --git a/docs/config.md b/docs/config.md
index 43ea24d80..99cee25cd 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -537,3 +537,18 @@ Configure OAuth 2 provider capabilities:
 * `shortcode_globs`: Location of custom emoji files. `*` can be used as a wildcard. Example `["/emoji/custom/**/*.png"]`
 * `groups`: Emojis are ordered in groups (tags). This is an array of key-value pairs where the key is the groupname and the value the location or array of locations. `*` can be used as a wildcard. Example `[Custom: ["/emoji/*.png", "/emoji/custom/*.png"]]`
 * `default_manifest`: Location of the JSON-manifest. This manifest contains information about the emoji-packs you can download. Currently only one manifest can be added (no arrays).
+
+## Database options
+
+### RUM indexing for full text search
+* `rum_enabled`: If RUM indexes should be used. Defaults to `false`.
+
+RUM indexes are an alternative indexing scheme that is not included in PostgreSQL by default. While they may eventually be mainlined, for now they have to be installed as a PostgreSQL extension from https://github.com/postgrespro/rum.
+
+Their advantage over the standard GIN indexes is that they allow efficient ordering of search results by timestamp, which makes search queries a lot faster on larger servers, by one or two orders of magnitude. They take up around 3 times as much space as GIN indexes.
+
+To enable them, both the `rum_enabled` flag has to be set and the following special migration has to be run:
+
+`mix ecto.migrate --migrations-path priv/repo/optional_migrations/rum_indexing/`
+
+This will probably take a long time.
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 32677df95..fc0100b1e 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -1000,6 +1000,30 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
     end
   end
 
+  def status_search_query_with_gin(q, query) do
+    from([a, o] in q,
+      where:
+        fragment(
+          "to_tsvector('english', ?->>'content') @@ plainto_tsquery('english', ?)",
+          o.data,
+          ^query
+        ),
+      order_by: [desc: :id]
+    )
+  end
+
+  def status_search_query_with_rum(q, query) do
+    from([a, o] in q,
+      where:
+        fragment(
+          "? @@ plainto_tsquery('english', ?)",
+          o.fts_content,
+          ^query
+        ),
+      order_by: [fragment("? <=> now()::date", o.inserted_at)]
+    )
+  end
+
   def status_search(user, query) do
     fetched =
       if Regex.match?(~r/https?:/, query) do
@@ -1013,20 +1037,19 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
       end || []
 
     q =
-      from(
-        [a, o] in Activity.with_preloaded_object(Activity),
+      from([a, o] in Activity.with_preloaded_object(Activity),
         where: fragment("?->>'type' = 'Create'", a.data),
         where: "https://www.w3.org/ns/activitystreams#Public" in a.recipients,
-        where:
-          fragment(
-            "? @@ plainto_tsquery('english', ?)",
-            o.fts_content,
-            ^query
-          ),
-        limit: 20,
-        order_by: [fragment("? <=> now()::date", o.inserted_at)]
+        limit: 20
       )
 
+    q =
+      if Pleroma.Config.get([:database, :rum_enabled]) do
+        status_search_query_with_rum(q, query)
+      else
+        status_search_query_with_gin(q, query)
+      end
+
     Repo.all(q) ++ fetched
   end
 
diff --git a/mix.exs b/mix.exs
index fae21f18d..f7955c6ca 100644
--- a/mix.exs
+++ b/mix.exs
@@ -65,7 +65,10 @@ defmodule Pleroma.Mixfile do
       {:plug_cowboy, "~> 2.0"},
       {:phoenix_pubsub, "~> 1.1"},
       {:phoenix_ecto, "~> 4.0"},
-      {:ecto_sql, "~>3.0.5"},
+      {:ecto_sql,
+       git: "https://github.com/elixir-ecto/ecto_sql",
+       ref: "e839a9a327b632d73533ac8105ba360bc831cf83",
+       override: true},
       {:postgrex, ">= 0.13.5"},
       {:gettext, "~> 0.15"},
       {:comeonin, "~> 4.1.1"},
diff --git a/mix.lock b/mix.lock
index 624c0fb35..d223803ab 100644
--- a/mix.lock
+++ b/mix.lock
@@ -16,12 +16,12 @@
   "cowlib": {:hex, :cowlib, "2.7.0", "3ef16e77562f9855a2605900cedb15c1462d76fb1be6a32fc3ae91973ee543d2", [:rebar3], [], "hexpm"},
   "credo": {:hex, :credo, "0.9.3", "76fa3e9e497ab282e0cf64b98a624aa11da702854c52c82db1bf24e54ab7c97a", [:mix], [{:bunt, "~> 0.2.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:poison, ">= 0.0.0", [hex: :poison, repo: "hexpm", optional: false]}], "hexpm"},
   "crypt": {:git, "https://github.com/msantos/crypt", "1f2b58927ab57e72910191a7ebaeff984382a1d3", [ref: "1f2b58927ab57e72910191a7ebaeff984382a1d3"]},
-  "db_connection": {:hex, :db_connection, "2.0.5", "ddb2ba6761a08b2bb9ca0e7d260e8f4dd39067426d835c24491a321b7f92a4da", [:mix], [{:connection, "~> 1.0.2", [hex: :connection, repo: "hexpm", optional: false]}], "hexpm"},
+  "db_connection": {:hex, :db_connection, "2.0.6", "bde2f85d047969c5b5800cb8f4b3ed6316c8cb11487afedac4aa5f93fd39abfa", [:mix], [{:connection, "~> 1.0.2", [hex: :connection, repo: "hexpm", optional: false]}], "hexpm"},
   "decimal": {:hex, :decimal, "1.7.0", "30d6b52c88541f9a66637359ddf85016df9eb266170d53105f02e4a67e00c5aa", [:mix], [], "hexpm"},
   "deep_merge": {:hex, :deep_merge, "1.0.0", "b4aa1a0d1acac393bdf38b2291af38cb1d4a52806cf7a4906f718e1feb5ee961", [:mix], [], "hexpm"},
   "earmark": {:hex, :earmark, "1.3.2", "b840562ea3d67795ffbb5bd88940b1bed0ed9fa32834915125ea7d02e35888a5", [:mix], [], "hexpm"},
-  "ecto": {:hex, :ecto, "3.0.7", "44dda84ac6b17bbbdeb8ac5dfef08b7da253b37a453c34ab1a98de7f7e5fec7f", [:mix], [{:decimal, "~> 1.6", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:poison, "~> 2.2 or ~> 3.0", [hex: :poison, repo: "hexpm", optional: true]}], "hexpm"},
-  "ecto_sql": {:hex, :ecto_sql, "3.0.5", "7e44172b4f7aca4469f38d7f6a3da394dbf43a1bcf0ca975e958cb957becd74e", [:mix], [{:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:ecto, "~> 3.0.6", [hex: :ecto, repo: "hexpm", optional: false]}, {:mariaex, "~> 0.9.1", [hex: :mariaex, repo: "hexpm", optional: true]}, {:postgrex, "~> 0.14.0", [hex: :postgrex, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.3.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm"},
+  "ecto": {:hex, :ecto, "3.1.4", "69d852da7a9f04ede725855a35ede48d158ca11a404fe94f8b2fb3b2162cd3c9", [:mix], [{:decimal, "~> 1.6", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm"},
+  "ecto_sql": {:git, "https://github.com/elixir-ecto/ecto_sql", "e839a9a327b632d73533ac8105ba360bc831cf83", [ref: "e839a9a327b632d73533ac8105ba360bc831cf83"]},
   "esshd": {:hex, :esshd, "0.1.0", "6f93a2062adb43637edad0ea7357db2702a4b80dd9683482fe00f5134e97f4c1", [:mix], [], "hexpm"},
   "eternal": {:hex, :eternal, "1.2.0", "e2a6b6ce3b8c248f7dc31451aefca57e3bdf0e48d73ae5043229380a67614c41", [:mix], [], "hexpm"},
   "ex_aws": {:hex, :ex_aws, "2.1.0", "b92651527d6c09c479f9013caa9c7331f19cba38a650590d82ebf2c6c16a1d8a", [:mix], [{:configparser_ex, "~> 2.0", [hex: :configparser_ex, repo: "hexpm", optional: true]}, {:hackney, "1.6.3 or 1.6.5 or 1.7.1 or 1.8.6 or ~> 1.9", [hex: :hackney, repo: "hexpm", optional: true]}, {:jsx, "~> 2.8", [hex: :jsx, repo: "hexpm", optional: true]}, {:poison, ">= 1.2.0", [hex: :poison, repo: "hexpm", optional: true]}, {:sweet_xml, "~> 0.6", [hex: :sweet_xml, repo: "hexpm", optional: true]}, {:xml_builder, "~> 0.1.0", [hex: :xml_builder, repo: "hexpm", optional: true]}], "hexpm"},
@@ -61,7 +61,7 @@
   "plug_crypto": {:hex, :plug_crypto, "1.0.0", "18e49317d3fa343f24620ed22795ec29d4a5e602d52d1513ccea0b07d8ea7d4d", [:mix], [], "hexpm"},
   "poison": {:hex, :poison, "3.1.0", "d9eb636610e096f86f25d9a46f35a9facac35609a7591b3be3326e99a0484665", [:mix], [], "hexpm"},
   "poolboy": {:hex, :poolboy, "1.5.2", "392b007a1693a64540cead79830443abf5762f5d30cf50bc95cb2c1aaafa006b", [:rebar3], [], "hexpm"},
-  "postgrex": {:hex, :postgrex, "0.14.1", "63247d4a5ad6b9de57a0bac5d807e1c32d41e39c04b8a4156a26c63bcd8a2e49", [:mix], [{:connection, "~> 1.0", [hex: :connection, repo: "hexpm", optional: false]}, {:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm"},
+  "postgrex": {:hex, :postgrex, "0.14.3", "5754dee2fdf6e9e508cbf49ab138df964278700b764177e8f3871e658b345a1e", [:mix], [{:connection, "~> 1.0", [hex: :connection, repo: "hexpm", optional: false]}, {:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm"},
   "prometheus": {:hex, :prometheus, "4.2.2", "a830e77b79dc6d28183f4db050a7cac926a6c58f1872f9ef94a35cd989aceef8", [:mix, :rebar3], [], "hexpm"},
   "prometheus_ecto": {:hex, :prometheus_ecto, "1.4.1", "6c768ea9654de871e5b32fab2eac348467b3021604ebebbcbd8bcbe806a65ed5", [:mix], [{:ecto, "~> 2.0 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: false]}, {:prometheus_ex, "~> 1.1 or ~> 2.0 or ~> 3.0", [hex: :prometheus_ex, repo: "hexpm", optional: false]}], "hexpm"},
   "prometheus_ex": {:hex, :prometheus_ex, "3.0.5", "fa58cfd983487fc5ead331e9a3e0aa622c67232b3ec71710ced122c4c453a02f", [:mix], [{:prometheus, "~> 4.0", [hex: :prometheus, repo: "hexpm", optional: false]}], "hexpm"},
@@ -74,7 +74,7 @@
   "ssl_verify_fun": {:hex, :ssl_verify_fun, "1.1.4", "f0eafff810d2041e93f915ef59899c923f4568f4585904d010387ed74988e77b", [:make, :mix, :rebar3], [], "hexpm"},
   "swoosh": {:hex, :swoosh, "0.20.0", "9a6c13822c9815993c03b6f8fccc370fcffb3c158d9754f67b1fdee6b3a5d928", [:mix], [{:cowboy, "~> 1.0.1 or ~> 1.1 or ~> 2.4", [hex: :cowboy, repo: "hexpm", optional: true]}, {:gen_smtp, "~> 0.12", [hex: :gen_smtp, repo: "hexpm", optional: true]}, {:hackney, "~> 1.9", [hex: :hackney, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mime, "~> 1.1", [hex: :mime, repo: "hexpm", optional: false]}, {:plug, "~> 1.4", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm"},
   "syslog": {:git, "https://github.com/Vagabond/erlang-syslog.git", "4a6c6f2c996483e86c1320e9553f91d337bcb6aa", [tag: "1.0.5"]},
-  "telemetry": {:hex, :telemetry, "0.3.0", "099a7f3ce31e4780f971b4630a3c22ec66d22208bc090fe33a2a3a6a67754a73", [:rebar3], [], "hexpm"},
+  "telemetry": {:hex, :telemetry, "0.4.0", "8339bee3fa8b91cb84d14c2935f8ecf399ccd87301ad6da6b71c09553834b2ab", [:rebar3], [], "hexpm"},
   "tesla": {:hex, :tesla, "1.2.1", "864783cc27f71dd8c8969163704752476cec0f3a51eb3b06393b3971dc9733ff", [:mix], [{:exjsx, ">= 3.0.0", [hex: :exjsx, repo: "hexpm", optional: true]}, {:fuse, "~> 2.4", [hex: :fuse, repo: "hexpm", optional: true]}, {:hackney, "~> 1.6", [hex: :hackney, repo: "hexpm", optional: true]}, {:ibrowse, "~> 4.4.0", [hex: :ibrowse, repo: "hexpm", optional: true]}, {:jason, ">= 1.0.0", [hex: :jason, repo: "hexpm", optional: true]}, {:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:poison, ">= 1.0.0", [hex: :poison, repo: "hexpm", optional: true]}], "hexpm"},
   "timex": {:hex, :timex, "3.5.0", "b0a23167da02d0fe4f1a4e104d1f929a00d348502b52432c05de875d0b9cffa5", [:mix], [{:combine, "~> 0.10", [hex: :combine, repo: "hexpm", optional: false]}, {:gettext, "~> 0.10", [hex: :gettext, repo: "hexpm", optional: false]}, {:tzdata, "~> 0.1.8 or ~> 0.5", [hex: :tzdata, repo: "hexpm", optional: false]}], "hexpm"},
   "trailing_format_plug": {:hex, :trailing_format_plug, "0.0.7", "64b877f912cf7273bed03379936df39894149e35137ac9509117e59866e10e45", [:mix], [{:plug, "> 0.12.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
diff --git a/priv/repo/migrations/20190510135645_add_fts_index_to_objects_two.exs b/priv/repo/migrations/20190510135645_add_fts_index_to_objects_two.exs
deleted file mode 100644
index 14b964847..000000000
--- a/priv/repo/migrations/20190510135645_add_fts_index_to_objects_two.exs
+++ /dev/null
@@ -1,33 +0,0 @@
-defmodule Pleroma.Repo.Migrations.AddFtsIndexToObjectsTwo do
-  use Ecto.Migration
-
-  def up do
-    drop_if_exists index(:objects, ["(to_tsvector('english', data->>'content'))"], using: :gin, name: :objects_fts)
-    alter table(:objects) do
-      add(:fts_content, :tsvector)
-    end
-
-    execute("CREATE FUNCTION objects_fts_update() RETURNS trigger AS $$
-    begin
-      new.fts_content := to_tsvector('english', new.data->>'content');
-      return new;
-    end
-    $$ LANGUAGE plpgsql")
-    execute("create index objects_fts on objects using RUM (fts_content rum_tsvector_addon_ops, inserted_at) with (attach = 'inserted_at', to = 'fts_content');")
-
-    execute("CREATE TRIGGER tsvectorupdate BEFORE INSERT OR UPDATE ON objects
-    FOR EACH ROW EXECUTE PROCEDURE objects_fts_update()")
-
-    execute("UPDATE objects SET updated_at = NOW()")
-  end
-
-  def down do
-    execute "drop index objects_fts"
-    execute "drop trigger tsvectorupdate on objects"
-    execute "drop function objects_fts_update()"
-    alter table(:objects) do
-      remove(:fts_content, :tsvector)
-    end
-    create index(:objects, ["(to_tsvector('english', data->>'content'))"], using: :gin, name: :objects_fts)
-  end
-end
diff --git a/priv/repo/optional_migrations/rum_indexing/20190510135645_add_fts_index_to_objects_two.exs b/priv/repo/optional_migrations/rum_indexing/20190510135645_add_fts_index_to_objects_two.exs
new file mode 100644
index 000000000..09e6cbfb1
--- /dev/null
+++ b/priv/repo/optional_migrations/rum_indexing/20190510135645_add_fts_index_to_objects_two.exs
@@ -0,0 +1,36 @@
+defmodule Pleroma.Repo.Migrations.AddFtsIndexToObjectsTwo do
+  use Ecto.Migration
+
+  def up do
+    execute("create extension if not exists rum")
+    drop_if_exists index(:objects, ["(to_tsvector('english', data->>'content'))"], using: :gin, name: :objects_fts)
+    alter table(:objects) do
+      add(:fts_content, :tsvector)
+    end
+
+    execute("CREATE FUNCTION objects_fts_update() RETURNS trigger AS $$
+    begin
+      new.fts_content := to_tsvector('english', new.data->>'content');
+      return new;
+    end
+    $$ LANGUAGE plpgsql")
+    execute("create index objects_fts on objects using RUM (fts_content rum_tsvector_addon_ops, inserted_at) with (attach = 'inserted_at', to = 'fts_content');")
+
+    execute("CREATE TRIGGER tsvectorupdate BEFORE INSERT OR UPDATE ON objects
+    FOR EACH ROW EXECUTE PROCEDURE objects_fts_update()")
+
+    execute("UPDATE objects SET updated_at = NOW()")
+    execute("vacuum analyze")
+  end
+
+  def down do
+    execute "drop index objects_fts"
+    execute "drop trigger tsvectorupdate on objects"
+    execute "drop function objects_fts_update()"
+    alter table(:objects) do
+      remove(:fts_content, :tsvector)
+    end
+    create index(:objects, ["(to_tsvector('english', data->>'content'))"], using: :gin, name: :objects_fts)
+    execute("vacuum analyze")
+  end
+end
-- 
cgit v1.2.3


From cbb3451023f557ece773bab20f79ac130f786d01 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 15 May 2019 16:30:08 +0200
Subject: CommonAPI: Refactor visibility, forbid public to private replies.

---
 lib/pleroma/web/activity_pub/visibility.ex         | 24 ++++++++++++++++++++
 lib/pleroma/web/common_api/common_api.ex           | 20 ++++++++++++-----
 lib/pleroma/web/mastodon_api/views/status_view.ex  | 26 ++--------------------
 lib/pleroma/web/twitter_api/views/activity_view.ex |  2 +-
 test/web/activity_pub/visibilty_test.exs           | 12 ++++++++++
 test/web/common_api/common_api_test.exs            | 22 ++++++++++++++++++
 6 files changed, 76 insertions(+), 30 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/visibility.ex b/lib/pleroma/web/activity_pub/visibility.ex
index 6dee61dd6..b38ee0442 100644
--- a/lib/pleroma/web/activity_pub/visibility.ex
+++ b/lib/pleroma/web/activity_pub/visibility.ex
@@ -58,4 +58,28 @@ defmodule Pleroma.Web.ActivityPub.Visibility do
         visible_for_user?(tail, user)
     end
   end
+
+  def get_visibility(object) do
+    public = "https://www.w3.org/ns/activitystreams#Public"
+    to = object.data["to"] || []
+    cc = object.data["cc"] || []
+
+    cond do
+      public in to ->
+        "public"
+
+      public in cc ->
+        "unlisted"
+
+      # this should use the sql for the object's activity
+      Enum.any?(to, &String.contains?(&1, "/followers")) ->
+        "private"
+
+      length(cc) > 0 ->
+        "private"
+
+      true ->
+        "direct"
+    end
+  end
 end
diff --git a/lib/pleroma/web/common_api/common_api.ex b/lib/pleroma/web/common_api/common_api.ex
index b53869c75..c31e56d4c 100644
--- a/lib/pleroma/web/common_api/common_api.ex
+++ b/lib/pleroma/web/common_api/common_api.ex
@@ -126,22 +126,30 @@ defmodule Pleroma.Web.CommonAPI do
         "public"
 
       in_reply_to ->
-        # XXX: these heuristics should be moved out of MastodonAPI.
-        with %Object{} = object <- Object.normalize(in_reply_to) do
-          Pleroma.Web.MastodonAPI.StatusView.get_visibility(object)
-        end
+        get_replied_to_visibility(in_reply_to)
     end
   end
 
   def get_visibility(_), do: "public"
 
+  def get_replied_to_visibility(nil), do: nil
+
+  def get_replied_to_visibility(activity) do
+    with %Object{} = object <- Object.normalize(activity) do
+      Pleroma.Web.ActivityPub.Visibility.get_visibility(object)
+    end
+  end
+
   def post(user, %{"status" => status} = data) do
-    visibility = get_visibility(data)
     limit = Pleroma.Config.get([:instance, :limit])
 
     with status <- String.trim(status),
          attachments <- attachments_from_ids(data),
+         visibility <- get_visibility(data),
          in_reply_to <- get_replied_to_activity(data["in_reply_to_status_id"]),
+         in_reply_to_visibility <- get_replied_to_visibility(in_reply_to),
+         {_, false} <-
+           {:private_to_public, in_reply_to_visibility == "direct" && visibility != "direct"},
          {content_html, mentions, tags} <-
            make_content_html(
              status,
@@ -185,6 +193,8 @@ defmodule Pleroma.Web.CommonAPI do
         )
 
       res
+    else
+      e -> {:error, e}
     end
   end
 
diff --git a/lib/pleroma/web/mastodon_api/views/status_view.ex b/lib/pleroma/web/mastodon_api/views/status_view.ex
index bd2372944..c93d915e5 100644
--- a/lib/pleroma/web/mastodon_api/views/status_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/status_view.ex
@@ -16,6 +16,8 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
   alias Pleroma.Web.MastodonAPI.StatusView
   alias Pleroma.Web.MediaProxy
 
+  import Pleroma.Web.ActivityPub.Visibility, only: [get_visibility: 1]
+
   # TODO: Add cached version.
   defp get_replied_to_activities(activities) do
     activities
@@ -340,30 +342,6 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
     end
   end
 
-  def get_visibility(object) do
-    public = "https://www.w3.org/ns/activitystreams#Public"
-    to = object.data["to"] || []
-    cc = object.data["cc"] || []
-
-    cond do
-      public in to ->
-        "public"
-
-      public in cc ->
-        "unlisted"
-
-      # this should use the sql for the object's activity
-      Enum.any?(to, &String.contains?(&1, "/followers")) ->
-        "private"
-
-      length(cc) > 0 ->
-        "private"
-
-      true ->
-        "direct"
-    end
-  end
-
   def render_content(%{data: %{"type" => "Video"}} = object) do
     with name when not is_nil(name) and name != "" <- object.data["name"] do
       "<p><a href=\"#{object.data["id"]}\">#{name}</a></p>#{object.data["content"]}"
diff --git a/lib/pleroma/web/twitter_api/views/activity_view.ex b/lib/pleroma/web/twitter_api/views/activity_view.ex
index d084ad734..44bcafe0e 100644
--- a/lib/pleroma/web/twitter_api/views/activity_view.ex
+++ b/lib/pleroma/web/twitter_api/views/activity_view.ex
@@ -310,7 +310,7 @@ defmodule Pleroma.Web.TwitterAPI.ActivityView do
       "tags" => tags,
       "activity_type" => "post",
       "possibly_sensitive" => possibly_sensitive,
-      "visibility" => StatusView.get_visibility(object),
+      "visibility" => Pleroma.Web.ActivityPub.Visibility.get_visibility(object),
       "summary" => summary,
       "summary_html" => summary |> Formatter.emojify(object.data["emoji"]),
       "card" => card,
diff --git a/test/web/activity_pub/visibilty_test.exs b/test/web/activity_pub/visibilty_test.exs
index 24b96c4aa..9c03c8be2 100644
--- a/test/web/activity_pub/visibilty_test.exs
+++ b/test/web/activity_pub/visibilty_test.exs
@@ -95,4 +95,16 @@ defmodule Pleroma.Web.ActivityPub.VisibilityTest do
     refute Visibility.visible_for_user?(private, unrelated)
     refute Visibility.visible_for_user?(direct, unrelated)
   end
+
+  test "get_visibility", %{
+    public: public,
+    private: private,
+    direct: direct,
+    unlisted: unlisted
+  } do
+    assert Visibility.get_visibility(public) == "public"
+    assert Visibility.get_visibility(private) == "private"
+    assert Visibility.get_visibility(direct) == "direct"
+    assert Visibility.get_visibility(unlisted) == "unlisted"
+  end
 end
diff --git a/test/web/common_api/common_api_test.exs b/test/web/common_api/common_api_test.exs
index a5b07c446..8d4f401ee 100644
--- a/test/web/common_api/common_api_test.exs
+++ b/test/web/common_api/common_api_test.exs
@@ -87,6 +87,28 @@ defmodule Pleroma.Web.CommonAPITest do
 
       assert object.data["content"] == "<p><b>2hu</b></p>alert('xss')"
     end
+
+    test "it does not allow replies to direct messages that are not direct messages themselves" do
+      user = insert(:user)
+
+      {:ok, activity} = CommonAPI.post(user, %{"status" => "suya..", "visibility" => "direct"})
+
+      assert {:ok, _} =
+               CommonAPI.post(user, %{
+                 "status" => "suya..",
+                 "visibility" => "direct",
+                 "in_reply_to_status_id" => activity.id
+               })
+
+      Enum.each(["public", "private", "unlisted"], fn visibility ->
+        assert {:error, {:private_to_public, _}} =
+                 CommonAPI.post(user, %{
+                   "status" => "suya..",
+                   "visibility" => visibility,
+                   "in_reply_to_status_id" => activity.id
+                 })
+      end)
+    end
   end
 
   describe "reactions" do
-- 
cgit v1.2.3


From 7a92e701b974aa5ee70d617be323292c953d08de Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 15 May 2019 16:35:33 +0200
Subject: CommonAPI: Visibility refactor.

---
 lib/pleroma/web/common_api/common_api.ex | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/lib/pleroma/web/common_api/common_api.ex b/lib/pleroma/web/common_api/common_api.ex
index c31e56d4c..29c4c1014 100644
--- a/lib/pleroma/web/common_api/common_api.ex
+++ b/lib/pleroma/web/common_api/common_api.ex
@@ -116,21 +116,16 @@ defmodule Pleroma.Web.CommonAPI do
     end
   end
 
-  def get_visibility(%{"visibility" => visibility})
+  def get_visibility(%{"visibility" => visibility}, in_reply_to)
       when visibility in ~w{public unlisted private direct},
-      do: visibility
+      do: {visibility, get_replied_to_visibility(in_reply_to)}
 
-  def get_visibility(%{"in_reply_to_status_id" => status_id}) when not is_nil(status_id) do
-    case get_replied_to_activity(status_id) do
-      nil ->
-        "public"
-
-      in_reply_to ->
-        get_replied_to_visibility(in_reply_to)
-    end
+  def get_visibility(_, in_reply_to) when not is_nil(in_reply_to) do
+    visibility = get_replied_to_visibility(in_reply_to)
+    {visibility, visibility}
   end
 
-  def get_visibility(_), do: "public"
+  def get_visibility(_, in_reply_to), do: {"public", get_replied_to_visibility(in_reply_to)}
 
   def get_replied_to_visibility(nil), do: nil
 
@@ -145,9 +140,8 @@ defmodule Pleroma.Web.CommonAPI do
 
     with status <- String.trim(status),
          attachments <- attachments_from_ids(data),
-         visibility <- get_visibility(data),
          in_reply_to <- get_replied_to_activity(data["in_reply_to_status_id"]),
-         in_reply_to_visibility <- get_replied_to_visibility(in_reply_to),
+         {visibility, in_reply_to_visibility} <- get_visibility(data, in_reply_to),
          {_, false} <-
            {:private_to_public, in_reply_to_visibility == "direct" && visibility != "direct"},
          {content_html, mentions, tags} <-
-- 
cgit v1.2.3


From 88cc423fa3c4baa698e99e1e62d251b6f81cc93d Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Wed, 15 May 2019 16:45:26 +0200
Subject: Dependencies: Update Ecto SQL.

---
 mix.exs  |  5 ++++-
 mix.lock | 10 +++++-----
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/mix.exs b/mix.exs
index b7b9d534d..2535fcf98 100644
--- a/mix.exs
+++ b/mix.exs
@@ -65,7 +65,10 @@ defmodule Pleroma.Mixfile do
       {:plug_cowboy, "~> 2.0"},
       {:phoenix_pubsub, "~> 1.1"},
       {:phoenix_ecto, "~> 4.0"},
-      {:ecto_sql, "~>3.0.5"},
+      {:ecto_sql,
+       git: "https://github.com/elixir-ecto/ecto_sql",
+       ref: "e839a9a327b632d73533ac8105ba360bc831cf83",
+       override: true},
       {:postgrex, ">= 0.13.5"},
       {:gettext, "~> 0.15"},
       {:comeonin, "~> 4.1.1"},
diff --git a/mix.lock b/mix.lock
index 0b24818c5..5ee5634d3 100644
--- a/mix.lock
+++ b/mix.lock
@@ -16,12 +16,12 @@
   "cowlib": {:hex, :cowlib, "2.7.0", "3ef16e77562f9855a2605900cedb15c1462d76fb1be6a32fc3ae91973ee543d2", [:rebar3], [], "hexpm"},
   "credo": {:hex, :credo, "0.9.3", "76fa3e9e497ab282e0cf64b98a624aa11da702854c52c82db1bf24e54ab7c97a", [:mix], [{:bunt, "~> 0.2.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:poison, ">= 0.0.0", [hex: :poison, repo: "hexpm", optional: false]}], "hexpm"},
   "crypt": {:git, "https://github.com/msantos/crypt", "1f2b58927ab57e72910191a7ebaeff984382a1d3", [ref: "1f2b58927ab57e72910191a7ebaeff984382a1d3"]},
-  "db_connection": {:hex, :db_connection, "2.0.5", "ddb2ba6761a08b2bb9ca0e7d260e8f4dd39067426d835c24491a321b7f92a4da", [:mix], [{:connection, "~> 1.0.2", [hex: :connection, repo: "hexpm", optional: false]}], "hexpm"},
+  "db_connection": {:hex, :db_connection, "2.0.6", "bde2f85d047969c5b5800cb8f4b3ed6316c8cb11487afedac4aa5f93fd39abfa", [:mix], [{:connection, "~> 1.0.2", [hex: :connection, repo: "hexpm", optional: false]}], "hexpm"},
   "decimal": {:hex, :decimal, "1.7.0", "30d6b52c88541f9a66637359ddf85016df9eb266170d53105f02e4a67e00c5aa", [:mix], [], "hexpm"},
   "deep_merge": {:hex, :deep_merge, "1.0.0", "b4aa1a0d1acac393bdf38b2291af38cb1d4a52806cf7a4906f718e1feb5ee961", [:mix], [], "hexpm"},
   "earmark": {:hex, :earmark, "1.3.2", "b840562ea3d67795ffbb5bd88940b1bed0ed9fa32834915125ea7d02e35888a5", [:mix], [], "hexpm"},
-  "ecto": {:hex, :ecto, "3.0.7", "44dda84ac6b17bbbdeb8ac5dfef08b7da253b37a453c34ab1a98de7f7e5fec7f", [:mix], [{:decimal, "~> 1.6", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:poison, "~> 2.2 or ~> 3.0", [hex: :poison, repo: "hexpm", optional: true]}], "hexpm"},
-  "ecto_sql": {:hex, :ecto_sql, "3.0.5", "7e44172b4f7aca4469f38d7f6a3da394dbf43a1bcf0ca975e958cb957becd74e", [:mix], [{:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:ecto, "~> 3.0.6", [hex: :ecto, repo: "hexpm", optional: false]}, {:mariaex, "~> 0.9.1", [hex: :mariaex, repo: "hexpm", optional: true]}, {:postgrex, "~> 0.14.0", [hex: :postgrex, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.3.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm"},
+  "ecto": {:hex, :ecto, "3.1.4", "69d852da7a9f04ede725855a35ede48d158ca11a404fe94f8b2fb3b2162cd3c9", [:mix], [{:decimal, "~> 1.6", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm"},
+  "ecto_sql": {:git, "https://github.com/elixir-ecto/ecto_sql", "e839a9a327b632d73533ac8105ba360bc831cf83", [ref: "e839a9a327b632d73533ac8105ba360bc831cf83"]},
   "esshd": {:hex, :esshd, "0.1.0", "6f93a2062adb43637edad0ea7357db2702a4b80dd9683482fe00f5134e97f4c1", [:mix], [], "hexpm"},
   "eternal": {:hex, :eternal, "1.2.0", "e2a6b6ce3b8c248f7dc31451aefca57e3bdf0e48d73ae5043229380a67614c41", [:mix], [], "hexpm"},
   "ex2ms": {:hex, :ex2ms, "1.5.0", "19e27f9212be9a96093fed8cdfbef0a2b56c21237196d26760f11dfcfae58e97", [:mix], [], "hexpm"},
@@ -64,7 +64,7 @@
   "plug_static_index_html": {:hex, :plug_static_index_html, "1.0.0", "840123d4d3975585133485ea86af73cb2600afd7f2a976f9f5fd8b3808e636a0", [:mix], [{:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
   "poison": {:hex, :poison, "3.1.0", "d9eb636610e096f86f25d9a46f35a9facac35609a7591b3be3326e99a0484665", [:mix], [], "hexpm"},
   "poolboy": {:hex, :poolboy, "1.5.2", "392b007a1693a64540cead79830443abf5762f5d30cf50bc95cb2c1aaafa006b", [:rebar3], [], "hexpm"},
-  "postgrex": {:hex, :postgrex, "0.14.1", "63247d4a5ad6b9de57a0bac5d807e1c32d41e39c04b8a4156a26c63bcd8a2e49", [:mix], [{:connection, "~> 1.0", [hex: :connection, repo: "hexpm", optional: false]}, {:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm"},
+  "postgrex": {:hex, :postgrex, "0.14.3", "5754dee2fdf6e9e508cbf49ab138df964278700b764177e8f3871e658b345a1e", [:mix], [{:connection, "~> 1.0", [hex: :connection, repo: "hexpm", optional: false]}, {:db_connection, "~> 2.0", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm"},
   "prometheus": {:hex, :prometheus, "4.2.2", "a830e77b79dc6d28183f4db050a7cac926a6c58f1872f9ef94a35cd989aceef8", [:mix, :rebar3], [], "hexpm"},
   "prometheus_ecto": {:hex, :prometheus_ecto, "1.4.1", "6c768ea9654de871e5b32fab2eac348467b3021604ebebbcbd8bcbe806a65ed5", [:mix], [{:ecto, "~> 2.0 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: false]}, {:prometheus_ex, "~> 1.1 or ~> 2.0 or ~> 3.0", [hex: :prometheus_ex, repo: "hexpm", optional: false]}], "hexpm"},
   "prometheus_ex": {:hex, :prometheus_ex, "3.0.5", "fa58cfd983487fc5ead331e9a3e0aa622c67232b3ec71710ced122c4c453a02f", [:mix], [{:prometheus, "~> 4.0", [hex: :prometheus, repo: "hexpm", optional: false]}], "hexpm"},
@@ -77,7 +77,7 @@
   "ssl_verify_fun": {:hex, :ssl_verify_fun, "1.1.4", "f0eafff810d2041e93f915ef59899c923f4568f4585904d010387ed74988e77b", [:make, :mix, :rebar3], [], "hexpm"},
   "swoosh": {:hex, :swoosh, "0.20.0", "9a6c13822c9815993c03b6f8fccc370fcffb3c158d9754f67b1fdee6b3a5d928", [:mix], [{:cowboy, "~> 1.0.1 or ~> 1.1 or ~> 2.4", [hex: :cowboy, repo: "hexpm", optional: true]}, {:gen_smtp, "~> 0.12", [hex: :gen_smtp, repo: "hexpm", optional: true]}, {:hackney, "~> 1.9", [hex: :hackney, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mime, "~> 1.1", [hex: :mime, repo: "hexpm", optional: false]}, {:plug, "~> 1.4", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm"},
   "syslog": {:git, "https://github.com/Vagabond/erlang-syslog.git", "4a6c6f2c996483e86c1320e9553f91d337bcb6aa", [tag: "1.0.5"]},
-  "telemetry": {:hex, :telemetry, "0.3.0", "099a7f3ce31e4780f971b4630a3c22ec66d22208bc090fe33a2a3a6a67754a73", [:rebar3], [], "hexpm"},
+  "telemetry": {:hex, :telemetry, "0.4.0", "8339bee3fa8b91cb84d14c2935f8ecf399ccd87301ad6da6b71c09553834b2ab", [:rebar3], [], "hexpm"},
   "tesla": {:hex, :tesla, "1.2.1", "864783cc27f71dd8c8969163704752476cec0f3a51eb3b06393b3971dc9733ff", [:mix], [{:exjsx, ">= 3.0.0", [hex: :exjsx, repo: "hexpm", optional: true]}, {:fuse, "~> 2.4", [hex: :fuse, repo: "hexpm", optional: true]}, {:hackney, "~> 1.6", [hex: :hackney, repo: "hexpm", optional: true]}, {:ibrowse, "~> 4.4.0", [hex: :ibrowse, repo: "hexpm", optional: true]}, {:jason, ">= 1.0.0", [hex: :jason, repo: "hexpm", optional: true]}, {:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:poison, ">= 1.0.0", [hex: :poison, repo: "hexpm", optional: true]}], "hexpm"},
   "timex": {:hex, :timex, "3.5.0", "b0a23167da02d0fe4f1a4e104d1f929a00d348502b52432c05de875d0b9cffa5", [:mix], [{:combine, "~> 0.10", [hex: :combine, repo: "hexpm", optional: false]}, {:gettext, "~> 0.10", [hex: :gettext, repo: "hexpm", optional: false]}, {:tzdata, "~> 0.1.8 or ~> 0.5", [hex: :tzdata, repo: "hexpm", optional: false]}], "hexpm"},
   "trailing_format_plug": {:hex, :trailing_format_plug, "0.0.7", "64b877f912cf7273bed03379936df39894149e35137ac9509117e59866e10e45", [:mix], [{:plug, "> 0.12.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
-- 
cgit v1.2.3


From f831acf91243bb9f4e6a9c1ca1bf77ea4762842e Mon Sep 17 00:00:00 2001
From: feld <feld@feld.me>
Date: Wed, 15 May 2019 15:19:20 +0000
Subject: Excoveralls for code coverage

---
 .gitlab-ci.yml | 1 +
 mix.exs        | 4 +++-
 mix.lock       | 1 +
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index dc99b81ee..f9745122a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -52,6 +52,7 @@ unit-testing:
     - mix ecto.create
     - mix ecto.migrate
     - mix test --trace --preload-modules
+    - mix coveralls
 
 lint:
   stage: test
diff --git a/mix.exs b/mix.exs
index b7b9d534d..7cc20b274 100644
--- a/mix.exs
+++ b/mix.exs
@@ -13,6 +13,7 @@ defmodule Pleroma.Mixfile do
       start_permanent: Mix.env() == :prod,
       aliases: aliases(),
       deps: deps(),
+      test_coverage: [tool: ExCoveralls],
 
       # Docs
       name: "Pleroma",
@@ -115,7 +116,8 @@ defmodule Pleroma.Mixfile do
       {:benchee, "~> 1.0"},
       {:esshd, "~> 0.1.0"},
       {:ex_rated, "~> 1.2"},
-      {:plug_static_index_html, "~> 1.0.0"}
+      {:plug_static_index_html, "~> 1.0.0"},
+      {:excoveralls, "~> 0.11.1", only: :test}
     ] ++ oauth_deps
   end
 
diff --git a/mix.lock b/mix.lock
index 0b24818c5..7d80eb0b8 100644
--- a/mix.lock
+++ b/mix.lock
@@ -31,6 +31,7 @@
   "ex_machina": {:hex, :ex_machina, "2.3.0", "92a5ad0a8b10ea6314b876a99c8c9e3f25f4dde71a2a835845b136b9adaf199a", [:mix], [{:ecto, "~> 2.2 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: true]}, {:ecto_sql, "~> 3.0", [hex: :ecto_sql, repo: "hexpm", optional: true]}], "hexpm"},
   "ex_rated": {:hex, :ex_rated, "1.3.2", "6aeb32abb46ea6076f417a9ce8cb1cf08abf35fb2d42375beaad4dd72b550bf1", [:mix], [{:ex2ms, "~> 1.5", [hex: :ex2ms, repo: "hexpm", optional: false]}], "hexpm"},
   "ex_syslogger": {:git, "https://github.com/slashmili/ex_syslogger.git", "f3963399047af17e038897c69e20d552e6899e1d", [tag: "1.4.0"]},
+  "excoveralls": {:hex, :excoveralls, "0.11.1", "dd677fbdd49114fdbdbf445540ec735808250d56b011077798316505064edb2c", [:mix], [{:hackney, "~> 1.0", [hex: :hackney, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm"},
   "floki": {:hex, :floki, "0.20.4", "be42ac911fece24b4c72f3b5846774b6e61b83fe685c2fc9d62093277fb3bc86", [:mix], [{:html_entities, "~> 0.4.0", [hex: :html_entities, repo: "hexpm", optional: false]}, {:mochiweb, "~> 2.15", [hex: :mochiweb, repo: "hexpm", optional: false]}], "hexpm"},
   "gen_smtp": {:hex, :gen_smtp, "0.13.0", "11f08504c4bdd831dc520b8f84a1dce5ce624474a797394e7aafd3c29f5dcd25", [:rebar3], [], "hexpm"},
   "gettext": {:hex, :gettext, "0.15.0", "40a2b8ce33a80ced7727e36768499fc9286881c43ebafccae6bab731e2b2b8ce", [:mix], [], "hexpm"},
-- 
cgit v1.2.3


From 4429c1b7dae9007299c46eab8bd60573b9ff1bdb Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Wed, 15 May 2019 15:29:42 +0000
Subject: tests: fixup

---
 test/plugs/http_signature_plug_test.exs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/test/plugs/http_signature_plug_test.exs b/test/plugs/http_signature_plug_test.exs
index 6a00dd4fd..efd811df7 100644
--- a/test/plugs/http_signature_plug_test.exs
+++ b/test/plugs/http_signature_plug_test.exs
@@ -4,7 +4,6 @@
 
 defmodule Pleroma.Web.Plugs.HTTPSignaturePlugTest do
   use Pleroma.Web.ConnCase
-  alias Pleroma.Web.HTTPSignatures
   alias Pleroma.Web.Plugs.HTTPSignaturePlug
 
   import Plug.Conn
-- 
cgit v1.2.3


From 958b4cfde916c9be71d7412fe1c90750ec578fdc Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Sun, 24 Mar 2019 23:45:57 +0000
Subject: migrations: add function to see if a thread can be satisfied

---
 ...190324222404_add_thread_visibility_function.exs | 76 ++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 priv/repo/migrations/20190324222404_add_thread_visibility_function.exs

diff --git a/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs b/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs
new file mode 100644
index 000000000..cea0322e7
--- /dev/null
+++ b/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs
@@ -0,0 +1,76 @@
+defmodule Pleroma.Repo.Migrations.AddThreadVisibilityFunction do
+  use Ecto.Migration
+  @disable_ddl_transaction true
+
+  def up do
+    statement = """
+    CREATE OR REPLACE FUNCTION thread_visibility(actor varchar, activity_id varchar) RETURNS boolean AS $$
+    DECLARE
+      public varchar := 'https://www.w3.org/ns/activitystreams#Public';
+      child objects%ROWTYPE;
+      activity activities%ROWTYPE;
+      actor_user users%ROWTYPE;
+      author users%ROWTYPE;
+      author_fa varchar;
+    BEGIN
+      --- Fetch our actor.
+      SELECT * INTO actor_user FROM users WHERE users.ap_id = actor;
+
+      --- Fetch our initial activity.
+      SELECT * INTO activity FROM activities WHERE activities.data->>'id' = activity_id;
+
+      LOOP
+        --- Ensure that we have an activity before continuing.
+        IF activity IS NULL THEN
+          RETURN true;
+        END IF;
+
+        --- Normalize the child object into child.
+        SELECT * INTO child FROM objects
+        INNER JOIN activities ON COALESCE(activities.data->'object'->>'id', activities.data->>'object') = objects.data->>'id'
+        WHERE COALESCE(activity.data->'object'->>'id', activity.data->>'object') = objects.data->>'id';
+
+        --- Fetch the author.
+        SELECT * INTO author FROM users WHERE users.ap_id = activity.actor;
+
+        --- Prepare author's AS2 followers collection.
+        SELECT COALESCE(author.follower_address, '') INTO author_fa;
+
+        --- Check visibility.
+        IF activity.actor = actor THEN
+          --- activity visible
+          NULL;
+        ELSIF ARRAY[public] && activity.recipients THEN
+          --- activity visible
+          NULL;
+        ELSIF ARRAY[author_fa] && activity.recipients AND ARRAY[author_fa] && actor_user.following THEN
+          --- activity visible
+          NULL;
+        ELSIF ARRAY[actor] && activity.recipients THEN
+          --- activity visible
+          NULL;
+        ELSE
+          --- activity not visible, break out of the loop
+          RETURN false;
+        END IF;
+
+        --- If there's a parent, load it and do this all over again.
+        IF (child.data->'inReplyTo' IS NOT NULL) AND (child.data->'inReplyTo' != 'null'::jsonb) THEN
+          SELECT * INTO activity FROM activities
+          INNER JOIN objects ON COALESCE(activities.data->'object'->>'id', activities.data->>'object') = objects.data->>'id'
+          WHERE child.data->>'inReplyTo' = objects.data->>'id';
+        ELSE
+          RETURN true;
+        END IF;
+      END LOOP;
+    END;
+    $$ LANGUAGE plpgsql IMMUTABLE;
+    """
+
+    execute(statement)
+  end
+
+  def down do
+    execute("drop function thread_visibility(actor varchar, activity_id varchar)")
+  end
+end
-- 
cgit v1.2.3


From 0387f5213805cdc4e0bf86f98797cefcd03ba61d Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 25 Mar 2019 00:06:02 +0000
Subject: activitypub: add restrict_thread_visibility()

---
 lib/pleroma/web/activity_pub/activity_pub.ex | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 233fee4fa..fec1bcd3e 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -569,6 +569,20 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
 
   defp restrict_visibility(query, _visibility), do: query
 
+  defp restrict_thread_visibility(query, %{"user" => %User{ap_id: ap_id}}) do
+    query =
+      from(
+        a in query,
+        where: fragment("thread_visibility(?, (?)->>'id') = true", ^ap_id, a.data)
+      )
+
+    Ecto.Adapters.SQL.to_sql(:all, Repo, query)
+
+    query
+  end
+
+  defp restrict_thread_visibility(query, _), do: query
+
   def fetch_user_activities(user, reading_user, params \\ %{}) do
     params =
       params
@@ -848,6 +862,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     |> restrict_muted(opts)
     |> restrict_media(opts)
     |> restrict_visibility(opts)
+    |> restrict_thread_visibility(opts)
     |> restrict_replies(opts)
     |> restrict_reblogs(opts)
     |> restrict_pinned(opts)
-- 
cgit v1.2.3


From de114ffbb0f92d24fd370adaaf43ff301ab04b4b Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 25 Mar 2019 00:10:20 +0000
Subject: activitypub: remove contain_timeline()

---
 lib/pleroma/web/activity_pub/activity_pub.ex            | 8 --------
 lib/pleroma/web/mastodon_api/mastodon_api_controller.ex | 1 -
 lib/pleroma/web/twitter_api/twitter_api_controller.ex   | 4 +---
 3 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index fec1bcd3e..e544d0c50 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -980,12 +980,4 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
   def contain_activity(%Activity{} = activity, %User{} = user) do
     contain_broken_threads(activity, user)
   end
-
-  # do post-processing on a timeline
-  def contain_timeline(timeline, user) do
-    timeline
-    |> Enum.filter(fn activity ->
-      contain_activity(activity, user)
-    end)
-  end
 end
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 87e597074..66056a846 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -303,7 +303,6 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
     activities =
       [user.ap_id | user.following]
       |> ActivityPub.fetch_activities(params)
-      |> ActivityPub.contain_timeline(user)
       |> Enum.reverse()
 
     conn
diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
index 3c5a70be9..31e86685a 100644
--- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex
+++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
@@ -101,9 +101,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
       |> Map.put("blocking_user", user)
       |> Map.put("user", user)
 
-    activities =
-      ActivityPub.fetch_activities([user.ap_id | user.following], params)
-      |> ActivityPub.contain_timeline(user)
+    activities = ActivityPub.fetch_activities([user.ap_id | user.following], params)
 
     conn
     |> put_view(ActivityView)
-- 
cgit v1.2.3


From 31db31c5879a2dedcc8dd4c671c4c9a79656355a Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 25 Mar 2019 00:38:28 +0000
Subject: activitypub: visibility: use SQL thread_visibility() function instead
 of manually walking the thread

---
 lib/pleroma/web/activity_pub/visibility.ex | 26 ++++++++------------------
 1 file changed, 8 insertions(+), 18 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/visibility.ex b/lib/pleroma/web/activity_pub/visibility.ex
index b38ee0442..46dd46575 100644
--- a/lib/pleroma/web/activity_pub/visibility.ex
+++ b/lib/pleroma/web/activity_pub/visibility.ex
@@ -1,6 +1,7 @@
 defmodule Pleroma.Web.ActivityPub.Visibility do
   alias Pleroma.Activity
   alias Pleroma.Object
+  alias Pleroma.Repo
   alias Pleroma.User
 
   def is_public?(%Object{data: %{"type" => "Tombstone"}}), do: false
@@ -38,25 +39,14 @@ defmodule Pleroma.Web.ActivityPub.Visibility do
     visible_for_user?(activity, nil) || Enum.any?(x, &(&1 in y))
   end
 
-  # guard
-  def entire_thread_visible_for_user?(nil, _user), do: false
+  def entire_thread_visible_for_user?(%Activity{} = activity, %User{} = user) do
+    {:ok, %{rows: [[result]]}} =
+      Ecto.Adapters.SQL.query(Repo, "SELECT thread_visibility($1, $2)", [
+        user.ap_id,
+        activity.data["id"]
+      ])
 
-  # XXX: Probably even more inefficient than the previous implementation intended to be a placeholder untill https://git.pleroma.social/pleroma/pleroma/merge_requests/971 is in develop
-  # credo:disable-for-previous-line Credo.Check.Readability.MaxLineLength
-
-  def entire_thread_visible_for_user?(
-        %Activity{} = tail,
-        # %Activity{data: %{"object" => %{"inReplyTo" => parent_id}}} = tail,
-        user
-      ) do
-    case Object.normalize(tail) do
-      %{data: %{"inReplyTo" => parent_id}} when is_binary(parent_id) ->
-        parent = Activity.get_in_reply_to_activity(tail)
-        visible_for_user?(tail, user) && entire_thread_visible_for_user?(parent, user)
-
-      _ ->
-        visible_for_user?(tail, user)
-    end
+    result
   end
 
   def get_visibility(object) do
-- 
cgit v1.2.3


From c7644313e72520a371e4bd417b1ff852365849b6 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 25 Mar 2019 01:23:15 +0000
Subject: test: update obsolete test

---
 test/web/activity_pub/activity_pub_test.exs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/web/activity_pub/activity_pub_test.exs b/test/web/activity_pub/activity_pub_test.exs
index 0f90aa1ac..b41f6ab81 100644
--- a/test/web/activity_pub/activity_pub_test.exs
+++ b/test/web/activity_pub/activity_pub_test.exs
@@ -968,7 +968,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
 
       assert length(activities) == 3
 
-      activities = ActivityPub.contain_timeline(activities, user1)
+      activities =
+        ActivityPub.fetch_activities([user1.ap_id | user1.following], %{"user" => user1})
 
       assert [public_activity, private_activity_1] == activities
       assert length(activities) == 2
-- 
cgit v1.2.3


From 75ce6adcffd2dbbc2ca2f83d7fe2d7fd659cd2f4 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Mon, 25 Mar 2019 02:56:13 +0000
Subject: migration: only care about Create activities

---
 .../migrations/20190324222404_add_thread_visibility_function.exs     | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs b/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs
index cea0322e7..11aa47e83 100644
--- a/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs
+++ b/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs
@@ -25,6 +25,11 @@ defmodule Pleroma.Repo.Migrations.AddThreadVisibilityFunction do
           RETURN true;
         END IF;
 
+        --- We only care about Create activities.
+        IF activity.data->>'type' != 'Create' THEN
+          RETURN true;
+        END IF;
+
         --- Normalize the child object into child.
         SELECT * INTO child FROM objects
         INNER JOIN activities ON COALESCE(activities.data->'object'->>'id', activities.data->>'object') = objects.data->>'id'
-- 
cgit v1.2.3


From 0aada88b5594b6714b8d65f8bee9c325d77d6e7b Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Wed, 8 May 2019 23:17:51 +0000
Subject: bbs: chase timeline containment patch

---
 lib/pleroma/bbs/handler.ex | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/pleroma/bbs/handler.ex b/lib/pleroma/bbs/handler.ex
index 106fe5d18..f34be961f 100644
--- a/lib/pleroma/bbs/handler.ex
+++ b/lib/pleroma/bbs/handler.ex
@@ -95,7 +95,6 @@ defmodule Pleroma.BBS.Handler do
     activities =
       [user.ap_id | user.following]
       |> ActivityPub.fetch_activities(params)
-      |> ActivityPub.contain_timeline(user)
 
     Enum.each(activities, fn activity ->
       puts_activity(activity)
-- 
cgit v1.2.3


From 12f45e2a8907c74c6b65d866bc3bab547b31edfa Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Wed, 15 May 2019 16:22:52 +0000
Subject: update migration

---
 ...190324222404_add_thread_visibility_function.exs | 81 ---------------------
 ...190515222404_add_thread_visibility_function.exs | 82 ++++++++++++++++++++++
 2 files changed, 82 insertions(+), 81 deletions(-)
 delete mode 100644 priv/repo/migrations/20190324222404_add_thread_visibility_function.exs
 create mode 100644 priv/repo/migrations/20190515222404_add_thread_visibility_function.exs

diff --git a/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs b/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs
deleted file mode 100644
index 11aa47e83..000000000
--- a/priv/repo/migrations/20190324222404_add_thread_visibility_function.exs
+++ /dev/null
@@ -1,81 +0,0 @@
-defmodule Pleroma.Repo.Migrations.AddThreadVisibilityFunction do
-  use Ecto.Migration
-  @disable_ddl_transaction true
-
-  def up do
-    statement = """
-    CREATE OR REPLACE FUNCTION thread_visibility(actor varchar, activity_id varchar) RETURNS boolean AS $$
-    DECLARE
-      public varchar := 'https://www.w3.org/ns/activitystreams#Public';
-      child objects%ROWTYPE;
-      activity activities%ROWTYPE;
-      actor_user users%ROWTYPE;
-      author users%ROWTYPE;
-      author_fa varchar;
-    BEGIN
-      --- Fetch our actor.
-      SELECT * INTO actor_user FROM users WHERE users.ap_id = actor;
-
-      --- Fetch our initial activity.
-      SELECT * INTO activity FROM activities WHERE activities.data->>'id' = activity_id;
-
-      LOOP
-        --- Ensure that we have an activity before continuing.
-        IF activity IS NULL THEN
-          RETURN true;
-        END IF;
-
-        --- We only care about Create activities.
-        IF activity.data->>'type' != 'Create' THEN
-          RETURN true;
-        END IF;
-
-        --- Normalize the child object into child.
-        SELECT * INTO child FROM objects
-        INNER JOIN activities ON COALESCE(activities.data->'object'->>'id', activities.data->>'object') = objects.data->>'id'
-        WHERE COALESCE(activity.data->'object'->>'id', activity.data->>'object') = objects.data->>'id';
-
-        --- Fetch the author.
-        SELECT * INTO author FROM users WHERE users.ap_id = activity.actor;
-
-        --- Prepare author's AS2 followers collection.
-        SELECT COALESCE(author.follower_address, '') INTO author_fa;
-
-        --- Check visibility.
-        IF activity.actor = actor THEN
-          --- activity visible
-          NULL;
-        ELSIF ARRAY[public] && activity.recipients THEN
-          --- activity visible
-          NULL;
-        ELSIF ARRAY[author_fa] && activity.recipients AND ARRAY[author_fa] && actor_user.following THEN
-          --- activity visible
-          NULL;
-        ELSIF ARRAY[actor] && activity.recipients THEN
-          --- activity visible
-          NULL;
-        ELSE
-          --- activity not visible, break out of the loop
-          RETURN false;
-        END IF;
-
-        --- If there's a parent, load it and do this all over again.
-        IF (child.data->'inReplyTo' IS NOT NULL) AND (child.data->'inReplyTo' != 'null'::jsonb) THEN
-          SELECT * INTO activity FROM activities
-          INNER JOIN objects ON COALESCE(activities.data->'object'->>'id', activities.data->>'object') = objects.data->>'id'
-          WHERE child.data->>'inReplyTo' = objects.data->>'id';
-        ELSE
-          RETURN true;
-        END IF;
-      END LOOP;
-    END;
-    $$ LANGUAGE plpgsql IMMUTABLE;
-    """
-
-    execute(statement)
-  end
-
-  def down do
-    execute("drop function thread_visibility(actor varchar, activity_id varchar)")
-  end
-end
diff --git a/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs b/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs
new file mode 100644
index 000000000..a3f717b89
--- /dev/null
+++ b/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs
@@ -0,0 +1,82 @@
+defmodule Pleroma.Repo.Migrations.AddThreadVisibilityFunction do
+  use Ecto.Migration
+  @disable_ddl_transaction true
+
+  def up do
+    statement = """
+    CREATE OR REPLACE FUNCTION thread_visibility(actor varchar, activity_id varchar) RETURNS boolean AS $$
+    DECLARE
+      public varchar := 'https://www.w3.org/ns/activitystreams#Public';
+      child objects%ROWTYPE;
+      activity activities%ROWTYPE;
+      actor_user users%ROWTYPE;
+      author users%ROWTYPE;
+      author_fa varchar;
+    BEGIN
+      --- Fetch our actor.
+      SELECT * INTO actor_user FROM users WHERE users.ap_id = actor;
+
+      --- Fetch our initial activity.
+      SELECT * INTO activity FROM activities WHERE activities.data->>'id' = activity_id;
+
+      LOOP
+        --- Ensure that we have an activity before continuing.
+        --- If we don't, the thread is not satisfiable.
+        IF activity IS NULL THEN
+          RETURN false;
+        END IF;
+
+        --- We only care about Create activities.
+        IF activity.data->>'type' != 'Create' THEN
+          RETURN true;
+        END IF;
+
+        --- Normalize the child object into child.
+        SELECT * INTO child FROM objects
+        INNER JOIN activities ON COALESCE(activities.data->'object'->>'id', activities.data->>'object') = objects.data->>'id'
+        WHERE COALESCE(activity.data->'object'->>'id', activity.data->>'object') = objects.data->>'id';
+
+        --- Fetch the author.
+        SELECT * INTO author FROM users WHERE users.ap_id = activity.actor;
+
+        --- Prepare author's AS2 followers collection.
+        SELECT COALESCE(author.follower_address, '') INTO author_fa;
+
+        --- Check visibility.
+        IF activity.actor = actor THEN
+          --- activity visible
+          NULL;
+        ELSIF ARRAY[public] && activity.recipients THEN
+          --- activity visible
+          NULL;
+        ELSIF ARRAY[author_fa] && activity.recipients AND ARRAY[author_fa] && actor_user.following THEN
+          --- activity visible
+          NULL;
+        ELSIF ARRAY[actor] && activity.recipients THEN
+          --- activity visible
+          NULL;
+        ELSE
+          --- activity not visible, break out of the loop
+          RETURN false;
+        END IF;
+
+        --- If there's a parent, load it and do this all over again.
+        IF (child.data->'inReplyTo' IS NOT NULL) AND (child.data->'inReplyTo' != 'null'::jsonb) THEN
+          SELECT * INTO activity FROM activities
+          INNER JOIN objects ON COALESCE(activities.data->'object'->>'id', activities.data->>'object') = objects.data->>'id'
+          WHERE child.data->>'inReplyTo' = objects.data->>'id';
+        ELSE
+          RETURN true;
+        END IF;
+      END LOOP;
+    END;
+    $$ LANGUAGE plpgsql IMMUTABLE;
+    """
+
+    execute(statement)
+  end
+
+  def down do
+    execute("drop function thread_visibility(actor varchar, activity_id varchar)")
+  end
+end
-- 
cgit v1.2.3


From f09c3afdf51eea17103d1445b31b7a269c474538 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Wed, 15 May 2019 16:23:01 +0000
Subject: chase test failures

---
 lib/pleroma/filter.ex                       | 3 ++-
 test/user_test.exs                          | 2 --
 test/web/activity_pub/activity_pub_test.exs | 9 ++++++---
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/lib/pleroma/filter.ex b/lib/pleroma/filter.ex
index 79efc29f0..90457dadf 100644
--- a/lib/pleroma/filter.ex
+++ b/lib/pleroma/filter.ex
@@ -38,7 +38,8 @@ defmodule Pleroma.Filter do
     query =
       from(
         f in Pleroma.Filter,
-        where: f.user_id == ^user_id
+        where: f.user_id == ^user_id,
+        order_by: [desc: :id]
       )
 
     Repo.all(query)
diff --git a/test/user_test.exs b/test/user_test.exs
index 0b65e89e9..bb47b4958 100644
--- a/test/user_test.exs
+++ b/test/user_test.exs
@@ -873,7 +873,6 @@ defmodule Pleroma.UserTest do
 
       assert [activity] ==
                ActivityPub.fetch_activities([user2.ap_id | user2.following], %{"user" => user2})
-               |> ActivityPub.contain_timeline(user2)
 
       {:ok, _user} = User.deactivate(user)
 
@@ -882,7 +881,6 @@ defmodule Pleroma.UserTest do
 
       assert [] ==
                ActivityPub.fetch_activities([user2.ap_id | user2.following], %{"user" => user2})
-               |> ActivityPub.contain_timeline(user2)
     end
   end
 
diff --git a/test/web/activity_pub/activity_pub_test.exs b/test/web/activity_pub/activity_pub_test.exs
index b41f6ab81..34e23b852 100644
--- a/test/web/activity_pub/activity_pub_test.exs
+++ b/test/web/activity_pub/activity_pub_test.exs
@@ -960,18 +960,21 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
           "in_reply_to_status_id" => private_activity_2.id
         })
 
-      activities = ActivityPub.fetch_activities([user1.ap_id | user1.following])
+      activities =
+        ActivityPub.fetch_activities([user1.ap_id | user1.following])
+        |> Enum.map(fn a -> a.id end)
 
       private_activity_1 = Activity.get_by_ap_id_with_object(private_activity_1.data["id"])
 
-      assert [public_activity, private_activity_1, private_activity_3] == activities
+      assert [public_activity.id, private_activity_1.id, private_activity_3.id] == activities
 
       assert length(activities) == 3
 
       activities =
         ActivityPub.fetch_activities([user1.ap_id | user1.following], %{"user" => user1})
+        |> Enum.map(fn a -> a.id end)
 
-      assert [public_activity, private_activity_1] == activities
+      assert [public_activity.id, private_activity_1.id] == activities
       assert length(activities) == 2
     end
   end
-- 
cgit v1.2.3


From 71fa7eeb6fdc7cf2087a32fb515ad11b7bf90c01 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Wed, 15 May 2019 16:54:14 +0000
Subject: thread visibility function: significantly improve efficiency

---
 ...190515222404_add_thread_visibility_function.exs | 27 ++++++++--------------
 1 file changed, 9 insertions(+), 18 deletions(-)

diff --git a/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs b/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs
index a3f717b89..a4daf680b 100644
--- a/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs
+++ b/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs
@@ -10,8 +10,8 @@ defmodule Pleroma.Repo.Migrations.AddThreadVisibilityFunction do
       child objects%ROWTYPE;
       activity activities%ROWTYPE;
       actor_user users%ROWTYPE;
-      author users%ROWTYPE;
       author_fa varchar;
+      valid_recipients varchar[];
     BEGIN
       --- Fetch our actor.
       SELECT * INTO actor_user FROM users WHERE users.ap_id = actor;
@@ -36,26 +36,17 @@ defmodule Pleroma.Repo.Migrations.AddThreadVisibilityFunction do
         INNER JOIN activities ON COALESCE(activities.data->'object'->>'id', activities.data->>'object') = objects.data->>'id'
         WHERE COALESCE(activity.data->'object'->>'id', activity.data->>'object') = objects.data->>'id';
 
-        --- Fetch the author.
-        SELECT * INTO author FROM users WHERE users.ap_id = activity.actor;
+        --- Fetch the author's AS2 following collection.
+        SELECT COALESCE(author.follower_address, '') INTO author_fa FROM users WHERE users.ap_id = activity.actor;
 
-        --- Prepare author's AS2 followers collection.
-        SELECT COALESCE(author.follower_address, '') INTO author_fa;
+        --- Prepare valid recipients array.
+        valid_recipients := ARRAY[actor, public];
+        IF ARRAY[author_fa] && actor_user.following THEN
+          valid_recipients := valid_recipients || author_fa;
+        END IF;
 
         --- Check visibility.
-        IF activity.actor = actor THEN
-          --- activity visible
-          NULL;
-        ELSIF ARRAY[public] && activity.recipients THEN
-          --- activity visible
-          NULL;
-        ELSIF ARRAY[author_fa] && activity.recipients AND ARRAY[author_fa] && actor_user.following THEN
-          --- activity visible
-          NULL;
-        ELSIF ARRAY[actor] && activity.recipients THEN
-          --- activity visible
-          NULL;
-        ELSE
+        IF NOT valid_recipients && activity.recipients THEN
           --- activity not visible, break out of the loop
           RETURN false;
         END IF;
-- 
cgit v1.2.3


From a591ab6112abdf162f4d6fdfbbcdd85bbaf75058 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Wed, 15 May 2019 16:56:46 +0000
Subject: activity pub: remove Ecto SQL query dumps

---
 lib/pleroma/web/activity_pub/activity_pub.ex | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index e544d0c50..7cd5b889b 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -540,8 +540,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
             )
         )
 
-      Ecto.Adapters.SQL.to_sql(:all, Repo, query)
-
       query
     else
       Logger.error("Could not restrict visibility to #{visibility}")
@@ -557,8 +555,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
           fragment("activity_visibility(?, ?, ?) = ?", a.actor, a.recipients, a.data, ^visibility)
       )
 
-    Ecto.Adapters.SQL.to_sql(:all, Repo, query)
-
     query
   end
 
@@ -576,8 +572,6 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
         where: fragment("thread_visibility(?, (?)->>'id') = true", ^ap_id, a.data)
       )
 
-    Ecto.Adapters.SQL.to_sql(:all, Repo, query)
-
     query
   end
 
-- 
cgit v1.2.3


From f3971cbde3d69faec973717e1421f4a643ef947e Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Wed, 15 May 2019 17:02:40 +0000
Subject: thread visibility function: fix use of no longer used author variable

---
 priv/repo/migrations/20190515222404_add_thread_visibility_function.exs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs b/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs
index a4daf680b..dc9abc998 100644
--- a/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs
+++ b/priv/repo/migrations/20190515222404_add_thread_visibility_function.exs
@@ -37,7 +37,7 @@ defmodule Pleroma.Repo.Migrations.AddThreadVisibilityFunction do
         WHERE COALESCE(activity.data->'object'->>'id', activity.data->>'object') = objects.data->>'id';
 
         --- Fetch the author's AS2 following collection.
-        SELECT COALESCE(author.follower_address, '') INTO author_fa FROM users WHERE users.ap_id = activity.actor;
+        SELECT COALESCE(users.follower_address, '') INTO author_fa FROM users WHERE users.ap_id = activity.actor;
 
         --- Prepare valid recipients array.
         valid_recipients := ARRAY[actor, public];
-- 
cgit v1.2.3


From 64495b96e9159b88ef0b4a6486e60b54722664fb Mon Sep 17 00:00:00 2001
From: Aaron Tinio <aptinio@gmail.com>
Date: Wed, 15 May 2019 06:13:47 +0800
Subject: Add test for blocked domains

---
 test/web/activity_pub/activity_pub_test.exs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/test/web/activity_pub/activity_pub_test.exs b/test/web/activity_pub/activity_pub_test.exs
index 0f90aa1ac..442120ffd 100644
--- a/test/web/activity_pub/activity_pub_test.exs
+++ b/test/web/activity_pub/activity_pub_test.exs
@@ -462,6 +462,20 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
     refute Enum.member?(activities, activity_three.id)
   end
 
+  test "doesn't return activities from blocked domains" do
+    domain = "dogwhistle.zone"
+    domain_user = insert(:user, %{ap_id: "https://#{domain}/@pundit"})
+    note = insert(:note, %{data: %{"actor" => domain_user.ap_id}})
+    activity = insert(:note_activity, %{note: note})
+    user = insert(:user)
+    {:ok, user} = User.block_domain(user, domain)
+
+    activities =
+      ActivityPub.fetch_activities([], %{"blocking_user" => user, "skip_preload" => true})
+
+    refute activity in activities
+  end
+
   test "doesn't return muted activities" do
     activity_one = insert(:note_activity)
     activity_two = insert(:note_activity)
-- 
cgit v1.2.3


From 2b6119dfbf47f118dfb102fc09f6450e59ccf15e Mon Sep 17 00:00:00 2001
From: Aaron Tinio <aptinio@gmail.com>
Date: Wed, 15 May 2019 07:59:24 +0800
Subject: Restrict reblogs of activities from blocked domains

---
 lib/pleroma/web/activity_pub/activity_pub.ex | 11 ++++++++++-
 test/web/activity_pub/activity_pub_test.exs  |  9 +++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 233fee4fa..6087a1cdc 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -752,6 +752,14 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
 
     from(
       activity in query,
+      inner_join: o in Object,
+      on:
+        fragment(
+          "(?->>'id') = COALESCE(?->'object'->>'id', ?->>'object')",
+          o.data,
+          activity.data,
+          activity.data
+        ),
       where: fragment("not (? = ANY(?))", activity.actor, ^blocks),
       where: fragment("not (? && ?)", activity.recipients, ^blocks),
       where:
@@ -761,7 +769,8 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
           activity.data,
           ^blocks
         ),
-      where: fragment("not (split_part(?, '/', 3) = ANY(?))", activity.actor, ^domain_blocks)
+      where: fragment("not (split_part(?, '/', 3) = ANY(?))", activity.actor, ^domain_blocks),
+      where: fragment("not (split_part(?->>'actor', '/', 3) = ANY(?))", o.data, ^domain_blocks)
     )
   end
 
diff --git a/test/web/activity_pub/activity_pub_test.exs b/test/web/activity_pub/activity_pub_test.exs
index 442120ffd..dfee93f67 100644
--- a/test/web/activity_pub/activity_pub_test.exs
+++ b/test/web/activity_pub/activity_pub_test.exs
@@ -474,6 +474,15 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubTest do
       ActivityPub.fetch_activities([], %{"blocking_user" => user, "skip_preload" => true})
 
     refute activity in activities
+
+    followed_user = insert(:user)
+    ActivityPub.follow(user, followed_user)
+    {:ok, repeat_activity, _} = CommonAPI.repeat(activity.id, followed_user)
+
+    activities =
+      ActivityPub.fetch_activities([], %{"blocking_user" => user, "skip_preload" => true})
+
+    refute repeat_activity in activities
   end
 
   test "doesn't return muted activities" do
-- 
cgit v1.2.3


From 793f1834d2bc37ba3d4ba11fb669078950994adb Mon Sep 17 00:00:00 2001
From: Aaron Tinio <aptinio@gmail.com>
Date: Thu, 16 May 2019 06:25:14 +0800
Subject: Use named binding to conditionally join object

---
 lib/pleroma/activity.ex                      | 19 +++++++++++--------
 lib/pleroma/web/activity_pub/activity_pub.ex | 13 ++++---------
 2 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/lib/pleroma/activity.ex b/lib/pleroma/activity.ex
index 4a0919478..3fd4003f8 100644
--- a/lib/pleroma/activity.ex
+++ b/lib/pleroma/activity.ex
@@ -60,21 +60,24 @@ defmodule Pleroma.Activity do
     timestamps()
   end
 
-  def with_preloaded_object(query) do
-    query
-    |> join(
-      :inner,
-      [activity],
-      o in Object,
+  def with_joined_object(query) do
+    join(query, :inner, [activity], o in Object,
       on:
         fragment(
           "(?->>'id') = COALESCE(?->'object'->>'id', ?->>'object')",
           o.data,
           activity.data,
           activity.data
-        )
+        ),
+      as: :object
     )
-    |> preload([activity, object], object: object)
+  end
+
+  def with_preloaded_object(query) do
+    query
+    |> has_named_binding?(:object)
+    |> if(do: query, else: with_joined_object(query))
+    |> preload([activity, object: object], object: object)
   end
 
   def with_preloaded_bookmark(query, %User{} = user) do
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 6087a1cdc..2fd073d3a 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -750,16 +750,11 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     blocks = info.blocks || []
     domain_blocks = info.domain_blocks || []
 
+    query =
+      if has_named_binding?(query, :object), do: query, else: Activity.with_joined_object(query)
+
     from(
-      activity in query,
-      inner_join: o in Object,
-      on:
-        fragment(
-          "(?->>'id') = COALESCE(?->'object'->>'id', ?->>'object')",
-          o.data,
-          activity.data,
-          activity.data
-        ),
+      [activity, object: o] in query,
       where: fragment("not (? = ANY(?))", activity.actor, ^blocks),
       where: fragment("not (? && ?)", activity.recipients, ^blocks),
       where:
-- 
cgit v1.2.3


From 0ae15c23061413cb2b67d2be462742dccae01fb4 Mon Sep 17 00:00:00 2001
From: PolymerWitch <briarrose@mailbox.org>
Date: Wed, 15 May 2019 15:36:20 -0700
Subject: Added package to dependency list

Added the erlang-ssh package to the dependency list and the installation
command instructions. The project wouldn't build otherwise.
---
 docs/installation/debian_based_en.md | 3 ++-
 docs/installation/debian_based_jp.md | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/installation/debian_based_en.md b/docs/installation/debian_based_en.md
index 9613a329b..9c0ef92d4 100644
--- a/docs/installation/debian_based_en.md
+++ b/docs/installation/debian_based_en.md
@@ -12,6 +12,7 @@ This guide will assume you are on Debian Stretch. This guide should also work wi
 * `erlang-tools`
 * `erlang-parsetools`
 * `erlang-eldap`, if you want to enable ldap authenticator
+* `erlang-ssh`
 * `erlang-xmerl`
 * `git`
 * `build-essential`
@@ -49,7 +50,7 @@ sudo dpkg -i /tmp/erlang-solutions_1.0_all.deb
 
 ```shell
 sudo apt update
-sudo apt install elixir erlang-dev erlang-parsetools erlang-xmerl erlang-tools
+sudo apt install elixir erlang-dev erlang-parsetools erlang-xmerl erlang-tools erlang-ssh
 ```
 
 ### Install PleromaBE
diff --git a/docs/installation/debian_based_jp.md b/docs/installation/debian_based_jp.md
index ac5dcaaee..41cce6792 100644
--- a/docs/installation/debian_based_jp.md
+++ b/docs/installation/debian_based_jp.md
@@ -14,6 +14,7 @@
 - erlang-dev
 - erlang-tools
 - erlang-parsetools
+- erlang-ssh
 - erlang-xmerl (Jessieではバックポートからインストールすること！)
 - git
 - build-essential
@@ -44,7 +45,7 @@ wget -P /tmp/ https://packages.erlang-solutions.com/erlang-solutions_1.0_all.deb
 
 * ElixirとErlangをインストールします、
 ```
-apt update && apt install elixir erlang-dev erlang-parsetools erlang-xmerl erlang-tools
+apt update && apt install elixir erlang-dev erlang-parsetools erlang-xmerl erlang-tools erlang-ssh
 ```
 
 ### Pleroma BE (バックエンド) をインストールします
-- 
cgit v1.2.3


From 1d2923e5d0893b39f41ded77d24652029f6f12ec Mon Sep 17 00:00:00 2001
From: Angelina Filippova <linakirsanova@gmail.com>
Date: Thu, 16 May 2019 01:36:26 +0300
Subject: Update tag/untag docs

---
 docs/api/admin_api.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/api/admin_api.md b/docs/api/admin_api.md
index 75fa2ee83..8f79d7f24 100644
--- a/docs/api/admin_api.md
+++ b/docs/api/admin_api.md
@@ -106,14 +106,14 @@ Authentication is required and the user must be an admin.
 
 - Method: `PUT`
 - Params:
-  - `nickname`
+  - `nicknames`
   - `tags`
 
 ### Untag a list of users
 
 - Method: `DELETE`
 - Params:
-  - `nickname`
+  - `nicknames`
   - `tags`
 
 ## `/api/pleroma/admin/users/:nickname/permission_group`
-- 
cgit v1.2.3


From 0641e685c166859fe2d5994bfcd069e0a8e62acf Mon Sep 17 00:00:00 2001
From: Angelina Filippova <linakirsanova@gmail.com>
Date: Thu, 16 May 2019 01:46:43 +0300
Subject: Note that nicknames is an array

---
 docs/api/admin_api.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/api/admin_api.md b/docs/api/admin_api.md
index 8f79d7f24..94fce9c6f 100644
--- a/docs/api/admin_api.md
+++ b/docs/api/admin_api.md
@@ -106,14 +106,14 @@ Authentication is required and the user must be an admin.
 
 - Method: `PUT`
 - Params:
-  - `nicknames`
+  - `nicknames` (array)
   - `tags`
 
 ### Untag a list of users
 
 - Method: `DELETE`
 - Params:
-  - `nicknames`
+  - `nicknames` (array)
   - `tags`
 
 ## `/api/pleroma/admin/users/:nickname/permission_group`
-- 
cgit v1.2.3


From 107c83ab2b186c951dc27140908d414a202119d8 Mon Sep 17 00:00:00 2001
From: Angelina Filippova <linakirsanova@gmail.com>
Date: Thu, 16 May 2019 01:48:53 +0300
Subject: Note that nicknames is an array

---
 docs/api/admin_api.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/api/admin_api.md b/docs/api/admin_api.md
index 94fce9c6f..59578f8d1 100644
--- a/docs/api/admin_api.md
+++ b/docs/api/admin_api.md
@@ -107,14 +107,14 @@ Authentication is required and the user must be an admin.
 - Method: `PUT`
 - Params:
   - `nicknames` (array)
-  - `tags`
+  - `tags` (array)
 
 ### Untag a list of users
 
 - Method: `DELETE`
 - Params:
   - `nicknames` (array)
-  - `tags`
+  - `tags` (array)
 
 ## `/api/pleroma/admin/users/:nickname/permission_group`
 
-- 
cgit v1.2.3


From c31026423c8c73ab33dc0d38b9d187a0d2b68309 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Thu, 16 May 2019 04:41:27 +0000
Subject: publisher: use the correct queue name for outgoing federation

---
 lib/pleroma/web/federator/publisher.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/federator/publisher.ex b/lib/pleroma/web/federator/publisher.ex
index 916bcdcba..fb4e8548d 100644
--- a/lib/pleroma/web/federator/publisher.ex
+++ b/lib/pleroma/web/federator/publisher.ex
@@ -31,7 +31,7 @@ defmodule Pleroma.Web.Federator.Publisher do
   """
   @spec enqueue_one(module(), Map.t()) :: :ok
   def enqueue_one(module, %{} = params),
-    do: PleromaJobQueue.enqueue(:federation_outgoing, __MODULE__, [:publish_one, module, params])
+    do: PleromaJobQueue.enqueue(:federator_outgoing, __MODULE__, [:publish_one, module, params])
 
   @spec perform(atom(), module(), any()) :: {:ok, any()} | {:error, any()}
   def perform(:publish_one, module, params) do
-- 
cgit v1.2.3


From aa11fa4864bf6ebdd4acfdba837675abbdcffc83 Mon Sep 17 00:00:00 2001
From: Alex S <alex.strizhakov@gmail.com>
Date: Thu, 16 May 2019 12:49:40 +0700
Subject: add report uri and report to

---
 CHANGELOG.md                            |   3 +-
 config/test.exs                         |   2 +
 docs/config.md                          |   3 +-
 lib/pleroma/plugs/http_security_plug.ex |  31 ++++++--
 test/plugs/http_security_plug_test.exs  | 133 ++++++++++++++++++--------------
 5 files changed, 107 insertions(+), 65 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b0e849285..ea1f29304 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Configuration: `fetch_initial_posts` option
 - Configuration: `notify_email` option
 - Configuration: Media proxy `whitelist` option
+- Configuration: `report_uri` option
 - Pleroma API: User subscriptions
 - Pleroma API: Healthcheck endpoint
 - Admin API: Endpoints for listing/revoking invite tokens
@@ -98,7 +99,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Mastodon API: Make `irreversible` field default to `false` [`POST /api/v1/filters`]
 
 ## Removed
-- Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations` 
+- Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations`
 
 ## [0.9.9999] - 2019-04-05
 ### Security
diff --git a/config/test.exs b/config/test.exs
index a0c90c371..40db66170 100644
--- a/config/test.exs
+++ b/config/test.exs
@@ -61,6 +61,8 @@ config :pleroma, Pleroma.ScheduledActivity,
 
 config :pleroma, :app_account_creation, max_requests: 5
 
+config :pleroma, :http_security, report_uri: "https://endpoint.com"
+
 try do
   import_config "test.secret.exs"
 rescue
diff --git a/docs/config.md b/docs/config.md
index 470f71b7c..c2af5c012 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -286,7 +286,8 @@ This will make Pleroma listen on `127.0.0.1` port `8080` and generate urls start
 * ``sts``: Whether to additionally send a `Strict-Transport-Security` header
 * ``sts_max_age``: The maximum age for the `Strict-Transport-Security` header if sent
 * ``ct_max_age``: The maximum age for the `Expect-CT` header if sent
-* ``referrer_policy``: The referrer policy to use, either `"same-origin"` or `"no-referrer"`.
+* ``referrer_policy``: The referrer policy to use, either `"same-origin"` or `"no-referrer"`
+* ``report_uri``: Adds the specified url to `report-uri` and `report-to` group in CSP header.
 
 ## :mrf_user_allowlist
 
diff --git a/lib/pleroma/plugs/http_security_plug.ex b/lib/pleroma/plugs/http_security_plug.ex
index a476f1d49..485ddfbc7 100644
--- a/lib/pleroma/plugs/http_security_plug.ex
+++ b/lib/pleroma/plugs/http_security_plug.ex
@@ -20,8 +20,9 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
 
   defp headers do
     referrer_policy = Config.get([:http_security, :referrer_policy])
+    report_uri = Config.get([:http_security, :report_uri])
 
-    [
+    headers = [
       {"x-xss-protection", "1; mode=block"},
       {"x-permitted-cross-domain-policies", "none"},
       {"x-frame-options", "DENY"},
@@ -30,12 +31,27 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
       {"x-download-options", "noopen"},
       {"content-security-policy", csp_string() <> ";"}
     ]
+
+    if report_uri do
+      report_group = %{
+        "group" => "csp-endpoint",
+        "max-age" => 10_886_400,
+        "endpoints" => [
+          %{"url" => report_uri}
+        ]
+      }
+
+      headers ++ [{"reply-to", Jason.encode!(report_group)}]
+    else
+      headers
+    end
   end
 
   defp csp_string do
     scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme]
     static_url = Pleroma.Web.Endpoint.static_url()
     websocket_url = Pleroma.Web.Endpoint.websocket_url()
+    report_uri = Config.get([:http_security, :report_uri])
 
     connect_src = "connect-src 'self' #{static_url} #{websocket_url}"
 
@@ -53,7 +69,7 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
         "script-src 'self'"
       end
 
-    [
+    main_part = [
       "default-src 'none'",
       "base-uri 'self'",
       "frame-ancestors 'none'",
@@ -63,11 +79,14 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do
       "font-src 'self'",
       "manifest-src 'self'",
       connect_src,
-      script_src,
-      if scheme == "https" do
-        "upgrade-insecure-requests"
-      end
+      script_src
     ]
+
+    report = if report_uri, do: ["report-uri #{report_uri}; report-to csp-endpoint"], else: []
+
+    insecure = if scheme == "https", do: ["upgrade-insecure-requests"], else: []
+
+    (main_part ++ report ++ insecure)
     |> Enum.join("; ")
   end
 
diff --git a/test/plugs/http_security_plug_test.exs b/test/plugs/http_security_plug_test.exs
index 0cbb7e4b1..7dfd50c1f 100644
--- a/test/plugs/http_security_plug_test.exs
+++ b/test/plugs/http_security_plug_test.exs
@@ -7,77 +7,96 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlugTest do
   alias Pleroma.Config
   alias Plug.Conn
 
-  test "it sends CSP headers when enabled", %{conn: conn} do
-    Config.put([:http_security, :enabled], true)
-
-    conn =
-      conn
-      |> get("/api/v1/instance")
-
-    refute Conn.get_resp_header(conn, "x-xss-protection") == []
-    refute Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
-    refute Conn.get_resp_header(conn, "x-frame-options") == []
-    refute Conn.get_resp_header(conn, "x-content-type-options") == []
-    refute Conn.get_resp_header(conn, "x-download-options") == []
-    refute Conn.get_resp_header(conn, "referrer-policy") == []
-    refute Conn.get_resp_header(conn, "content-security-policy") == []
-  end
+  describe "http security enabled" do
+    setup do
+      enabled = Config.get([:http_securiy, :enabled])
 
-  test "it does not send CSP headers when disabled", %{conn: conn} do
-    Config.put([:http_security, :enabled], false)
+      Config.put([:http_security, :enabled], true)
 
-    conn =
-      conn
-      |> get("/api/v1/instance")
+      on_exit(fn ->
+        Config.put([:http_security, :enabled], enabled)
+      end)
 
-    assert Conn.get_resp_header(conn, "x-xss-protection") == []
-    assert Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
-    assert Conn.get_resp_header(conn, "x-frame-options") == []
-    assert Conn.get_resp_header(conn, "x-content-type-options") == []
-    assert Conn.get_resp_header(conn, "x-download-options") == []
-    assert Conn.get_resp_header(conn, "referrer-policy") == []
-    assert Conn.get_resp_header(conn, "content-security-policy") == []
-  end
+      :ok
+    end
 
-  test "it sends STS headers when enabled", %{conn: conn} do
-    Config.put([:http_security, :enabled], true)
-    Config.put([:http_security, :sts], true)
+    test "it sends CSP headers when enabled", %{conn: conn} do
+      conn = get(conn, "/api/v1/instance")
 
-    conn =
-      conn
-      |> get("/api/v1/instance")
+      refute Conn.get_resp_header(conn, "x-xss-protection") == []
+      refute Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
+      refute Conn.get_resp_header(conn, "x-frame-options") == []
+      refute Conn.get_resp_header(conn, "x-content-type-options") == []
+      refute Conn.get_resp_header(conn, "x-download-options") == []
+      refute Conn.get_resp_header(conn, "referrer-policy") == []
+      refute Conn.get_resp_header(conn, "content-security-policy") == []
+    end
 
-    refute Conn.get_resp_header(conn, "strict-transport-security") == []
-    refute Conn.get_resp_header(conn, "expect-ct") == []
-  end
+    test "it sends STS headers when enabled", %{conn: conn} do
+      Config.put([:http_security, :sts], true)
 
-  test "it does not send STS headers when disabled", %{conn: conn} do
-    Config.put([:http_security, :enabled], true)
-    Config.put([:http_security, :sts], false)
+      conn = get(conn, "/api/v1/instance")
 
-    conn =
-      conn
-      |> get("/api/v1/instance")
+      refute Conn.get_resp_header(conn, "strict-transport-security") == []
+      refute Conn.get_resp_header(conn, "expect-ct") == []
+    end
 
-    assert Conn.get_resp_header(conn, "strict-transport-security") == []
-    assert Conn.get_resp_header(conn, "expect-ct") == []
-  end
+    test "it does not send STS headers when disabled", %{conn: conn} do
+      Config.put([:http_security, :sts], false)
+
+      conn = get(conn, "/api/v1/instance")
+
+      assert Conn.get_resp_header(conn, "strict-transport-security") == []
+      assert Conn.get_resp_header(conn, "expect-ct") == []
+    end
+
+    test "referrer-policy header reflects configured value", %{conn: conn} do
+      conn = get(conn, "/api/v1/instance")
+
+      assert Conn.get_resp_header(conn, "referrer-policy") == ["same-origin"]
 
-  test "referrer-policy header reflects configured value", %{conn: conn} do
-    Config.put([:http_security, :enabled], true)
+      Config.put([:http_security, :referrer_policy], "no-referrer")
 
-    conn =
-      conn
-      |> get("/api/v1/instance")
+      conn =
+        build_conn()
+        |> get("/api/v1/instance")
 
-    assert Conn.get_resp_header(conn, "referrer-policy") == ["same-origin"]
+      assert Conn.get_resp_header(conn, "referrer-policy") == ["no-referrer"]
+    end
 
-    Config.put([:http_security, :referrer_policy], "no-referrer")
+    test "it sends `report-to` & `report-uri` CSP response headers" do
+      conn =
+        build_conn()
+        |> get("/api/v1/instance")
 
-    conn =
-      build_conn()
-      |> get("/api/v1/instance")
+      [csp] = Conn.get_resp_header(conn, "content-security-policy")
 
-    assert Conn.get_resp_header(conn, "referrer-policy") == ["no-referrer"]
+      assert csp =~ ~r|report-uri https://endpoint.com; report-to csp-endpoint;|
+
+      [reply_to] = Conn.get_resp_header(conn, "reply-to")
+
+      assert reply_to ==
+               "{\"endpoints\":[{\"url\":\"https://endpoint.com\"}],\"group\":\"csp-endpoint\",\"max-age\":10886400}"
+    end
+  end
+
+  test "it does not send CSP headers when disabled", %{conn: conn} do
+    enabled = Config.get([:http_securiy, :enabled])
+
+    Config.put([:http_security, :enabled], false)
+
+    on_exit(fn ->
+      Config.put([:http_security, :enabled], enabled)
+    end)
+
+    conn = get(conn, "/api/v1/instance")
+
+    assert Conn.get_resp_header(conn, "x-xss-protection") == []
+    assert Conn.get_resp_header(conn, "x-permitted-cross-domain-policies") == []
+    assert Conn.get_resp_header(conn, "x-frame-options") == []
+    assert Conn.get_resp_header(conn, "x-content-type-options") == []
+    assert Conn.get_resp_header(conn, "x-download-options") == []
+    assert Conn.get_resp_header(conn, "referrer-policy") == []
+    assert Conn.get_resp_header(conn, "content-security-policy") == []
   end
 end
-- 
cgit v1.2.3


From 8355d0607e986f5a2cc5addfb2bcb35f799f10cb Mon Sep 17 00:00:00 2001
From: Alex S <alex.strizhakov@gmail.com>
Date: Thu, 16 May 2019 17:03:12 +0700
Subject: trailing spaces

---
 docs/introduction.md | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/docs/introduction.md b/docs/introduction.md
index 4af0747fe..045dc7c05 100644
--- a/docs/introduction.md
+++ b/docs/introduction.md
@@ -1,30 +1,30 @@
 # Introduction to Pleroma
 ## What is Pleroma?
-Pleroma is a federated social networking platform, compatible with GNU social, Mastodon and other OStatus and ActivityPub implementations. It is free software licensed under the AGPLv3.  
-It actually consists of two components: a backend, named simply Pleroma, and a user-facing frontend, named Pleroma-FE. It also includes the Mastodon frontend, if that's your thing.  
-It's part of what we call the fediverse, a federated network of instances which speak common protocols and can communicate with each other.  
+Pleroma is a federated social networking platform, compatible with GNU social, Mastodon and other OStatus and ActivityPub implementations. It is free software licensed under the AGPLv3.
+It actually consists of two components: a backend, named simply Pleroma, and a user-facing frontend, named Pleroma-FE. It also includes the Mastodon frontend, if that's your thing.
+It's part of what we call the fediverse, a federated network of instances which speak common protocols and can communicate with each other.
 One account on a instance is enough to talk to the entire fediverse!
-  
+
 ## How can I use it?
 
-Pleroma instances are already widely deployed, a list can be found here:  
+Pleroma instances are already widely deployed, a list can be found here:
 http://distsn.org/pleroma-instances.html
 
-If you don't feel like joining an existing instance, but instead prefer to deploy your own instance, that's easy too!  
-Installation instructions can be found here:  
+If you don't feel like joining an existing instance, but instead prefer to deploy your own instance, that's easy too!
+Installation instructions can be found here:
 [main Pleroma wiki](/)
-  
+
 ## I got an account, now what?
-Great! Now you can explore the fediverse!  
-- Open the login page for your Pleroma instance (for ex. https://pleroma.soykaf.com) and login with your username and password.  
-(If you don't have one yet, click on Register) :slightly_smiling_face:  
+Great! Now you can explore the fediverse!
+- Open the login page for your Pleroma instance (for ex. https://pleroma.soykaf.com) and login with your username and password.
+(If you don't have one yet, click on Register) :slightly_smiling_face:
 
 At this point you will have two columns in front of you.
 
 ### Left column
-- first block: here you can see your avatar, your nickname a bio, and statistics (Statuses, Following, Followers).  
-Under that you have a text form which allows you to post new statuses. The icon on the left is for uploading media files and attach them to your post. The number under the text form is a character counter, every instance can have a different character limit (the default is 5000).  
-If you want to mention someone, type @ + name of the person. A drop-down menu will help you in finding the right person. :slight_smile:   
+- first block: here you can see your avatar, your nickname a bio, and statistics (Statuses, Following, Followers).
+Under that you have a text form which allows you to post new statuses. The icon on the left is for uploading media files and attach them to your post. The number under the text form is a character counter, every instance can have a different character limit (the default is 5000).
+If you want to mention someone, type @ + name of the person. A drop-down menu will help you in finding the right person. :slight_smile:
 To post your status, simply press Submit.
 
 - second block: Here you can switch between the different timelines:
@@ -38,7 +38,7 @@ To post your status, simply press Submit.
 - fourth block: This is the Notifications block, here you will get notified whenever somebody mentions you, follows you, repeats or favorites one of your statuses.
 
 ### Right column
-This is where the interesting stuff happens! :slight_smile:   
+This is where the interesting stuff happens! :slight_smile:
 Depending on the timeline you will see different statuses, but each status has a standard structure:
 - Icon + name + link to profile. An optional left-arrow if it's a reply to another status (hovering will reveal the replied-to status).
 - A + button on the right allows you to Expand/Collapse an entire discussion thread. It also updates in realtime!
@@ -47,9 +47,9 @@ Depending on the timeline you will see different statuses, but each status has a
 - Four buttons (left to right): Reply, Repeat, Favorite, Delete.
 
 ## Mastodon interface
-If the Pleroma interface isn't your thing, or you're just trying something new but you want to keep using the familiar Mastodon interface, we got that too! :smile:  
-Just add a "/web" after your instance url (for ex. https://pleroma.soycaf.com/web) and you'll end on the Mastodon web interface, but with a Pleroma backend! MAGIC! :fireworks:  
-For more information on the Mastodon interface, please look here:  
+If the Pleroma interface isn't your thing, or you're just trying something new but you want to keep using the familiar Mastodon interface, we got that too! :smile:
+Just add a "/web" after your instance url (for ex. https://pleroma.soycaf.com/web) and you'll end on the Mastodon web interface, but with a Pleroma backend! MAGIC! :fireworks:
+For more information on the Mastodon interface, please look here:
 https://github.com/tootsuite/documentation/blob/master/Using-Mastodon/User-guide.md
 
 Remember, what you see is only the frontend part of Mastodon, the backend is still Pleroma.
-- 
cgit v1.2.3


From 4711d8151c8cb7ce2024f378e17b3a113a3aac1c Mon Sep 17 00:00:00 2001
From: Alex S <alex.strizhakov@gmail.com>
Date: Thu, 16 May 2019 17:35:07 +0700
Subject: try this

---
 test/web/common_api/common_api_test.exs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/web/common_api/common_api_test.exs b/test/web/common_api/common_api_test.exs
index 8d4f401ee..b0c441a37 100644
--- a/test/web/common_api/common_api_test.exs
+++ b/test/web/common_api/common_api_test.exs
@@ -279,14 +279,14 @@ defmodule Pleroma.Web.CommonAPITest do
     test "add a reblog mute", %{muter: muter, muted: muted} do
       {:ok, muter} = CommonAPI.hide_reblogs(muter, muted)
 
-      assert Pleroma.User.showing_reblogs?(muter, muted) == false
+      assert User.showing_reblogs?(muter, muted) == false
     end
 
     test "remove a reblog mute", %{muter: muter, muted: muted} do
       {:ok, muter} = CommonAPI.hide_reblogs(muter, muted)
       {:ok, muter} = CommonAPI.show_reblogs(muter, muted)
 
-      assert Pleroma.User.showing_reblogs?(muter, muted) == true
+      assert User.showing_reblogs?(muter, muted) == true
     end
   end
 end
-- 
cgit v1.2.3


From 73ae58fdfaf0b9dc9630929b0b84ae3b6083684a Mon Sep 17 00:00:00 2001
From: Alexander Strizhakov <alex.strizhakov@gmail.com>
Date: Thu, 16 May 2019 13:23:41 +0000
Subject: Feature/896 toggling confirmation

---
 CHANGELOG.md                  |  3 ++-
 lib/mix/tasks/pleroma/user.ex | 19 +++++++++++++++++++
 lib/pleroma/user.ex           | 13 +++++++++++++
 lib/pleroma/user/info.ex      |  2 +-
 test/tasks/user_test.exs      | 27 +++++++++++++++++++++++++++
 test/user_test.exs            | 18 ++++++++++++++++++
 6 files changed, 80 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b0e849285..b3d8e1e0c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - [Prometheus](https://prometheus.io/) metrics
 - Support for Mastodon's remote interaction
 - Mix Tasks: `mix pleroma.database remove_embedded_objects`
+- Mix Tasks: `mix pleroma.user toggle_confirmed`
 - Federation: Support for reports
 - Configuration: `safe_dm_mentions` option
 - Configuration: `link_name` option
@@ -98,7 +99,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Mastodon API: Make `irreversible` field default to `false` [`POST /api/v1/filters`]
 
 ## Removed
-- Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations` 
+- Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations`
 
 ## [0.9.9999] - 2019-04-05
 ### Security
diff --git a/lib/mix/tasks/pleroma/user.ex b/lib/mix/tasks/pleroma/user.ex
index d130ff8c9..25fc40ea7 100644
--- a/lib/mix/tasks/pleroma/user.ex
+++ b/lib/mix/tasks/pleroma/user.ex
@@ -77,6 +77,10 @@ defmodule Mix.Tasks.Pleroma.User do
   ## Delete tags from a user.
 
       mix pleroma.user untag NICKNAME TAGS
+
+  ## Toggle confirmation of the user's account.
+
+      mix pleroma.user toggle_confirmed NICKNAME
   """
   def run(["new", nickname, email | rest]) do
     {options, [], []} =
@@ -388,6 +392,21 @@ defmodule Mix.Tasks.Pleroma.User do
     end
   end
 
+  def run(["toggle_confirmed", nickname]) do
+    Common.start_pleroma()
+
+    with %User{} = user <- User.get_cached_by_nickname(nickname) do
+      {:ok, user} = User.toggle_confirmation(user)
+
+      message = if user.info.confirmation_pending, do: "needs", else: "doesn't need"
+
+      Mix.shell().info("#{nickname} #{message} confirmation.")
+    else
+      _ ->
+        Mix.shell().error("No local user #{nickname}")
+    end
+  end
+
   defp set_moderator(user, value) do
     info_cng = User.Info.admin_api_update(user.info, %{is_moderator: value})
 
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index c6a562a61..1aa966dfc 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1378,4 +1378,17 @@ defmodule Pleroma.User do
   def showing_reblogs?(%User{} = user, %User{} = target) do
     target.ap_id not in user.info.muted_reblogs
   end
+
+  @spec toggle_confirmation(User.t()) :: {:ok, User.t()} | {:error, Changeset.t()}
+  def toggle_confirmation(%User{} = user) do
+    need_confirmation? = !user.info.confirmation_pending
+
+    info_changeset =
+      User.Info.confirmation_changeset(user.info, need_confirmation: need_confirmation?)
+
+    user
+    |> change()
+    |> put_embed(:info, info_changeset)
+    |> update_and_set_cache()
+  end
 end
diff --git a/lib/pleroma/user/info.ex b/lib/pleroma/user/info.ex
index 5a50ee639..5f0cefc00 100644
--- a/lib/pleroma/user/info.ex
+++ b/lib/pleroma/user/info.ex
@@ -212,7 +212,7 @@ defmodule Pleroma.User.Info do
     ])
   end
 
-  @spec confirmation_changeset(Info.t(), keyword()) :: Ecto.Changerset.t()
+  @spec confirmation_changeset(Info.t(), keyword()) :: Changeset.t()
   def confirmation_changeset(info, opts) do
     need_confirmation? = Keyword.get(opts, :need_confirmation)
 
diff --git a/test/tasks/user_test.exs b/test/tasks/user_test.exs
index eaf4ecf84..1f97740be 100644
--- a/test/tasks/user_test.exs
+++ b/test/tasks/user_test.exs
@@ -338,4 +338,31 @@ defmodule Mix.Tasks.Pleroma.UserTest do
       assert message == "User #{nickname} statuses deleted."
     end
   end
+
+  describe "running toggle_confirmed" do
+    test "user is confirmed" do
+      %{id: id, nickname: nickname} = insert(:user, info: %{confirmation_pending: false})
+
+      assert :ok = Mix.Tasks.Pleroma.User.run(["toggle_confirmed", nickname])
+      assert_received {:mix_shell, :info, [message]}
+      assert message == "#{nickname} needs confirmation."
+
+      user = Repo.get(User, id)
+      assert user.info.confirmation_pending
+      assert user.info.confirmation_token
+    end
+
+    test "user is not confirmed" do
+      %{id: id, nickname: nickname} =
+        insert(:user, info: %{confirmation_pending: true, confirmation_token: "some token"})
+
+      assert :ok = Mix.Tasks.Pleroma.User.run(["toggle_confirmed", nickname])
+      assert_received {:mix_shell, :info, [message]}
+      assert message == "#{nickname} doesn't need confirmation."
+
+      user = Repo.get(User, id)
+      refute user.info.confirmation_pending
+      refute user.info.confirmation_token
+    end
+  end
 end
diff --git a/test/user_test.exs b/test/user_test.exs
index 0b65e89e9..f256396c0 100644
--- a/test/user_test.exs
+++ b/test/user_test.exs
@@ -1204,4 +1204,22 @@ defmodule Pleroma.UserTest do
 
     assert Map.get(user_show, "followers_count") == 2
   end
+
+  describe "toggle_confirmation/1" do
+    test "if user is confirmed" do
+      user = insert(:user, info: %{confirmation_pending: false})
+      {:ok, user} = User.toggle_confirmation(user)
+
+      assert user.info.confirmation_pending
+      assert user.info.confirmation_token
+    end
+
+    test "if user is unconfirmed" do
+      user = insert(:user, info: %{confirmation_pending: true, confirmation_token: "some token"})
+      {:ok, user} = User.toggle_confirmation(user)
+
+      refute user.info.confirmation_pending
+      refute user.info.confirmation_token
+    end
+  end
 end
-- 
cgit v1.2.3


From efa61c161085fd24f7e85ccf7f32ef823e335d7b Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Thu, 16 May 2019 13:14:48 -0500
Subject: Move to pleroma.database mix task

---
 lib/mix/tasks/pleroma/conversations.ex | 23 -----------------------
 lib/mix/tasks/pleroma/database.ex      | 11 +++++++++++
 2 files changed, 11 insertions(+), 23 deletions(-)
 delete mode 100644 lib/mix/tasks/pleroma/conversations.ex

diff --git a/lib/mix/tasks/pleroma/conversations.ex b/lib/mix/tasks/pleroma/conversations.ex
deleted file mode 100644
index b52b9921a..000000000
--- a/lib/mix/tasks/pleroma/conversations.ex
+++ /dev/null
@@ -1,23 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Mix.Tasks.Pleroma.Conversations do
-  use Mix.Task
-  alias Mix.Tasks.Pleroma.Common
-  alias Pleroma.Conversation
-
-  @shortdoc "Manages Pleroma conversations."
-  @moduledoc """
-  Manages Pleroma conversations.
-
-  ## Create a conversation for all existing DMs. Can be safely re-run.
-
-      mix pleroma.conversations bump_all
-
-  """
-  def run(["bump_all"]) do
-    Common.start_pleroma()
-    Conversation.bump_for_all_activities()
-  end
-end
diff --git a/lib/mix/tasks/pleroma/database.ex b/lib/mix/tasks/pleroma/database.ex
index ab9a3a7ff..42753a1a4 100644
--- a/lib/mix/tasks/pleroma/database.ex
+++ b/lib/mix/tasks/pleroma/database.ex
@@ -4,6 +4,7 @@
 
 defmodule Mix.Tasks.Pleroma.Database do
   alias Mix.Tasks.Pleroma.Common
+  alias Pleroma.Conversation
   require Logger
   use Mix.Task
 
@@ -19,6 +20,11 @@ defmodule Mix.Tasks.Pleroma.Database do
 
     Options:
     - `--vacuum` - run `VACUUM FULL` after the embedded objects are replaced with their references
+
+  ## Create a conversation for all existing DMs. Can be safely re-run.
+
+      mix pleroma.database bump_all_conversations
+
   """
   def run(["remove_embedded_objects" | args]) do
     {options, [], []} =
@@ -48,4 +54,9 @@ defmodule Mix.Tasks.Pleroma.Database do
       )
     end
   end
+
+  def run(["bump_all_conversations"]) do
+    Common.start_pleroma()
+    Conversation.bump_for_all_activities()
+  end
 end
-- 
cgit v1.2.3


From cd127d2fa43e6b1ecd7fadfc1d6293b2a432be18 Mon Sep 17 00:00:00 2001
From: Mark Felder <feld@FreeBSD.org>
Date: Thu, 16 May 2019 13:17:09 -0500
Subject: Update CHANGELOG

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b3d8e1e0c..fe6ab002c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - A [job queue](https://git.pleroma.social/pleroma/pleroma_job_queue) for federation, emails, web push, etc.
 - [Prometheus](https://prometheus.io/) metrics
 - Support for Mastodon's remote interaction
+- Mix Tasks: `mix pleroma.database bump_all_conversations`
 - Mix Tasks: `mix pleroma.database remove_embedded_objects`
 - Mix Tasks: `mix pleroma.user toggle_confirmed`
 - Federation: Support for reports
-- 
cgit v1.2.3


From e2b3a27204ca511a2e455a1151fdea36fdc0e53d Mon Sep 17 00:00:00 2001
From: Sergey Suprunenko <suprunenko.s@gmail.com>
Date: Thu, 16 May 2019 19:09:18 +0000
Subject: Add Reports to Admin API

---
 CHANGELOG.md                                       |   2 +
 docs/api/admin_api.md                              | 289 +++++++++++++++++-
 lib/pleroma/activity.ex                            |   2 +-
 lib/pleroma/emails/admin_email.ex                  |   2 +-
 lib/pleroma/web/activity_pub/activity_pub.ex       |   7 +
 lib/pleroma/web/activity_pub/utils.ex              |  78 ++++-
 lib/pleroma/web/admin_api/admin_api_controller.ex  |  81 +++++
 lib/pleroma/web/admin_api/views/report_view.ex     |  41 +++
 lib/pleroma/web/common_api/common_api.ex           |  57 ++++
 lib/pleroma/web/common_api/utils.ex                |  10 +-
 lib/pleroma/web/router.ex                          |   8 +
 ...20190511191044_set_default_state_to_reports.exs |  19 ++
 test/support/factory.ex                            |   5 +-
 test/web/admin_api/admin_api_controller_test.exs   | 327 +++++++++++++++++++++
 test/web/common_api/common_api_test.exs            |  33 ++-
 .../mastodon_api/mastodon_api_controller_test.exs  |   4 +-
 16 files changed, 945 insertions(+), 20 deletions(-)
 create mode 100644 lib/pleroma/web/admin_api/views/report_view.ex
 create mode 100644 priv/repo/migrations/20190511191044_set_default_state_to_reports.exs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fe6ab002c..dc09d4f6b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Admin API: Endpoints for listing/revoking invite tokens
 - Admin API: Endpoints for making users follow/unfollow each other
 - Admin API: added filters (role, tags, email, name) for users endpoint
+- Admin API: Endpoints for managing reports
+- Admin API: Endpoints for deleting and changing the scope of individual reported statuses
 - AdminFE: initial release with basic user management accessible at /pleroma/admin/
 - Mastodon API: [Scheduled statuses](https://docs.joinmastodon.org/api/rest/scheduled-statuses/)
 - Mastodon API: `/api/v1/notifications/destroy_multiple` (glitch-soc extension)
diff --git a/docs/api/admin_api.md b/docs/api/admin_api.md
index 59578f8d1..b45c5e285 100644
--- a/docs/api/admin_api.md
+++ b/docs/api/admin_api.md
@@ -24,7 +24,7 @@ Authentication is required and the user must be an admin.
 - Example: `https://mypleroma.org/api/pleroma/admin/users?query=john&filters=local,active&page=1&page_size=10&tags[]=some_tag&tags[]=another_tag&name=display_name&email=email@example.com`
 - Response:
 
-```JSON
+```json
 {
   "page_size": integer,
   "count": integer,
@@ -92,7 +92,7 @@ Authentication is required and the user must be an admin.
   - `nickname`
 - Response: User’s object
 
-```JSON
+```json
 {
   "deactivated": bool,
   "id": integer,
@@ -124,7 +124,7 @@ Authentication is required and the user must be an admin.
 - Params: none
 - Response:
 
-```JSON
+```json
 {
   "is_moderator": bool,
   "is_admin": bool
@@ -141,7 +141,7 @@ Note: Available `:permission_group` is currently moderator and admin. 404 is ret
 - Params: none
 - Response:
 
-```JSON
+```json
 {
   "is_moderator": bool,
   "is_admin": bool
@@ -223,7 +223,7 @@ Note: Available `:permission_group` is currently moderator and admin. 404 is ret
 - Params: none
 - Response:
 
-```JSON
+```json
 {
 
   "invites": [
@@ -250,7 +250,7 @@ Note: Available `:permission_group` is currently moderator and admin. 404 is ret
   - `token`
 - Response:
 
-```JSON
+```json
 {
   "id": integer,
   "token": string,
@@ -280,3 +280,280 @@ Note: Available `:permission_group` is currently moderator and admin. 404 is ret
 - Methods: `GET`
 - Params: none
 - Response: password reset token (base64 string)
+
+## `/api/pleroma/admin/reports`
+### Get a list of reports
+- Method `GET`
+- Params:
+  - `state`: optional, the state of reports. Valid values are `open`, `closed` and `resolved`
+  - `limit`: optional, the number of records to retrieve
+  - `since_id`: optional, returns results that are more recent than the specified id
+  - `max_id`: optional, returns results that are older than the specified id
+- Response: 
+  - On failure: 403 Forbidden error `{"error": "error_msg"}` when requested by anonymous or non-admin
+  - On success: JSON, returns a list of reports, where:
+    - `account`: the user who has been reported
+    - `actor`: the user who has sent the report
+    - `statuses`: list of statuses that have been included to the report
+
+```json
+{
+  "reports": [
+    {
+      "account": {
+        "acct": "user",
+        "avatar": "https://pleroma.example.org/images/avi.png",
+        "avatar_static": "https://pleroma.example.org/images/avi.png",
+        "bot": false,
+        "created_at": "2019-04-23T17:32:04.000Z",
+        "display_name": "User",
+        "emojis": [],
+        "fields": [],
+        "followers_count": 1,
+        "following_count": 1,
+        "header": "https://pleroma.example.org/images/banner.png",
+        "header_static": "https://pleroma.example.org/images/banner.png",
+        "id": "9i6dAJqSGSKMzLG2Lo",
+        "locked": false,
+        "note": "",
+        "pleroma": {
+          "confirmation_pending": false,
+          "hide_favorites": true,
+          "hide_followers": false,
+          "hide_follows": false,
+          "is_admin": false,
+          "is_moderator": false,
+          "relationship": {},
+          "tags": []
+        },
+        "source": {
+          "note": "",
+          "pleroma": {},
+          "sensitive": false
+        },
+        "statuses_count": 3,
+        "url": "https://pleroma.example.org/users/user",
+        "username": "user"
+      },
+      "actor": {
+        "acct": "lain",
+        "avatar": "https://pleroma.example.org/images/avi.png",
+        "avatar_static": "https://pleroma.example.org/images/avi.png",
+        "bot": false,
+        "created_at": "2019-03-28T17:36:03.000Z",
+        "display_name": "Roger Braun",
+        "emojis": [],
+        "fields": [],
+        "followers_count": 1,
+        "following_count": 1,
+        "header": "https://pleroma.example.org/images/banner.png",
+        "header_static": "https://pleroma.example.org/images/banner.png",
+        "id": "9hEkA5JsvAdlSrocam",
+        "locked": false,
+        "note": "",
+        "pleroma": {
+          "confirmation_pending": false,
+          "hide_favorites": false,
+          "hide_followers": false,
+          "hide_follows": false,
+          "is_admin": false,
+          "is_moderator": false,
+          "relationship": {},
+          "tags": []
+        },
+        "source": {
+          "note": "",
+          "pleroma": {},
+          "sensitive": false
+        },
+        "statuses_count": 1,
+        "url": "https://pleroma.example.org/users/lain",
+        "username": "lain"
+      },
+      "content": "Please delete it",
+      "created_at": "2019-04-29T19:48:15.000Z",
+      "id": "9iJGOv1j8hxuw19bcm",
+      "state": "open",
+      "statuses": [
+        {
+          "account": { ... },
+          "application": {
+            "name": "Web",
+            "website": null
+          },
+          "bookmarked": false,
+          "card": null,
+          "content": "<span class=\"h-card\"><a data-user=\"9hEkA5JsvAdlSrocam\" class=\"u-url mention\" href=\"https://pleroma.example.org/users/lain\">@<span>lain</span></a></span> click on my link <a href=\"https://www.google.com/\">https://www.google.com/</a>",
+          "created_at": "2019-04-23T19:15:47.000Z",
+          "emojis": [],
+          "favourited": false,
+          "favourites_count": 0,
+          "id": "9i6mQ9uVrrOmOime8m",
+          "in_reply_to_account_id": null,
+          "in_reply_to_id": null,
+          "language": null,
+          "media_attachments": [],
+          "mentions": [
+            {
+              "acct": "lain",
+              "id": "9hEkA5JsvAdlSrocam",
+              "url": "https://pleroma.example.org/users/lain",
+              "username": "lain"
+            },
+            {
+              "acct": "user",
+              "id": "9i6dAJqSGSKMzLG2Lo",
+              "url": "https://pleroma.example.org/users/user",
+              "username": "user"
+            }
+          ],
+          "muted": false,
+          "pinned": false,
+          "pleroma": {
+            "content": {
+              "text/plain": "@lain click on my link https://www.google.com/"
+            },
+            "conversation_id": 28,
+            "in_reply_to_account_acct": null,
+            "local": true,
+            "spoiler_text": {
+              "text/plain": ""
+            }
+          },
+          "reblog": null,
+          "reblogged": false,
+          "reblogs_count": 0,
+          "replies_count": 0,
+          "sensitive": false,
+          "spoiler_text": "",
+          "tags": [],
+          "uri": "https://pleroma.example.org/objects/8717b90f-8e09-4b58-97b0-e3305472b396",
+          "url": "https://pleroma.example.org/notice/9i6mQ9uVrrOmOime8m",
+          "visibility": "direct"
+        }
+      ]
+    }
+  ]
+}
+```
+
+## `/api/pleroma/admin/reports/:id`
+### Get an individual report
+- Method `GET`
+- Params:
+  - `id`
+- Response:
+  - On failure: 
+    - 403 Forbidden `{"error": "error_msg"}`
+    - 404 Not Found `"Not found"`
+  - On success: JSON, Report object (see above)
+
+## `/api/pleroma/admin/reports/:id`
+### Change the state of the report
+- Method `PUT`
+- Params:
+  - `id`
+  - `state`: required, the new state. Valid values are `open`, `closed` and `resolved`
+- Response: 
+  - On failure: 
+    - 400 Bad Request `"Unsupported state"`
+    - 403 Forbidden `{"error": "error_msg"}`
+    - 404 Not Found `"Not found"`
+  - On success: JSON, Report object (see above)
+
+## `/api/pleroma/admin/reports/:id/respond`
+### Respond to a report
+- Method `POST`
+- Params:
+  - `id`
+  - `status`: required, the message
+- Response: 
+  - On failure: 
+    - 400 Bad Request `"Invalid parameters"` when `status` is missing 
+    - 403 Forbidden `{"error": "error_msg"}` 
+    - 404 Not Found `"Not found"`
+  - On success: JSON, created Mastodon Status entity
+
+```json
+{
+  "account": { ... },
+  "application": {
+    "name": "Web",
+    "website": null
+  },
+  "bookmarked": false,
+  "card": null,
+  "content": "Your claim is going to be closed",
+  "created_at": "2019-05-11T17:13:03.000Z",
+  "emojis": [],
+  "favourited": false,
+  "favourites_count": 0,
+  "id": "9ihuiSL1405I65TmEq",
+  "in_reply_to_account_id": null,
+  "in_reply_to_id": null,
+  "language": null,
+  "media_attachments": [],
+  "mentions": [
+    {
+      "acct": "user",
+      "id": "9i6dAJqSGSKMzLG2Lo",
+      "url": "https://pleroma.example.org/users/user",
+      "username": "user"
+    },
+    {
+      "acct": "admin",
+      "id": "9hEkA5JsvAdlSrocam",
+      "url": "https://pleroma.example.org/users/admin",
+      "username": "admin"
+    }
+  ],
+  "muted": false,
+  "pinned": false,
+  "pleroma": {
+    "content": {
+      "text/plain": "Your claim is going to be closed"
+    },
+    "conversation_id": 35,
+    "in_reply_to_account_acct": null,
+    "local": true,
+    "spoiler_text": {
+      "text/plain": ""
+    }
+  },
+  "reblog": null,
+  "reblogged": false,
+  "reblogs_count": 0,
+  "replies_count": 0,
+  "sensitive": false,
+  "spoiler_text": "",
+  "tags": [],
+  "uri": "https://pleroma.example.org/objects/cab0836d-9814-46cd-a0ea-529da9db5fcb",
+  "url": "https://pleroma.example.org/notice/9ihuiSL1405I65TmEq",
+  "visibility": "direct"
+}
+```
+
+## `/api/pleroma/admin/statuses/:id`
+### Change the scope of an individual reported status
+- Method `PUT`
+- Params:
+  - `id`
+  - `sensitive`: optional, valid values are `true` or `false`
+  - `visibility`: optional, valid values are `public`, `private` and `unlisted`
+- Response: 
+  - On failure: 
+    - 400 Bad Request `"Unsupported visibility"`
+    - 403 Forbidden `{"error": "error_msg"}` 
+    - 404 Not Found `"Not found"`
+  - On success: JSON, Mastodon Status entity
+
+## `/api/pleroma/admin/statuses/:id`
+### Delete an individual reported status
+- Method `DELETE`
+- Params:
+  - `id`
+- Response: 
+  - On failure: 
+    - 403 Forbidden `{"error": "error_msg"}` 
+    - 404 Not Found `"Not found"`
+  - On success: 200 OK `{}`
diff --git a/lib/pleroma/activity.ex b/lib/pleroma/activity.ex
index 3fd4003f8..4e54b15ba 100644
--- a/lib/pleroma/activity.ex
+++ b/lib/pleroma/activity.ex
@@ -111,7 +111,7 @@ defmodule Pleroma.Activity do
 
   def change(struct, params \\ %{}) do
     struct
-    |> cast(params, [:data])
+    |> cast(params, [:data, :recipients])
     |> validate_required([:data])
     |> unique_constraint(:ap_id, name: :activities_unique_apid_index)
   end
diff --git a/lib/pleroma/emails/admin_email.ex b/lib/pleroma/emails/admin_email.ex
index df0f72f96..d0e254362 100644
--- a/lib/pleroma/emails/admin_email.ex
+++ b/lib/pleroma/emails/admin_email.ex
@@ -29,7 +29,7 @@ defmodule Pleroma.Emails.AdminEmail do
       end
 
     statuses_html =
-      if length(statuses) > 0 do
+      if is_list(statuses) && length(statuses) > 0 do
         statuses_list_html =
           statuses
           |> Enum.map(fn
diff --git a/lib/pleroma/web/activity_pub/activity_pub.ex b/lib/pleroma/web/activity_pub/activity_pub.ex
index 6a186efbf..5c3156978 100644
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@@ -703,6 +703,12 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
 
   defp restrict_type(query, _), do: query
 
+  defp restrict_state(query, %{"state" => state}) do
+    from(activity in query, where: fragment("?->>'state' = ?", activity.data, ^state))
+  end
+
+  defp restrict_state(query, _), do: query
+
   defp restrict_favorited_by(query, %{"favorited_by" => ap_id}) do
     from(
       activity in query,
@@ -855,6 +861,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     |> restrict_local(opts)
     |> restrict_actor(opts)
     |> restrict_type(opts)
+    |> restrict_state(opts)
     |> restrict_favorited_by(opts)
     |> restrict_blocked(opts)
     |> restrict_muted(opts)
diff --git a/lib/pleroma/web/activity_pub/utils.ex b/lib/pleroma/web/activity_pub/utils.ex
index 236d1b4ac..ca8a0844b 100644
--- a/lib/pleroma/web/activity_pub/utils.ex
+++ b/lib/pleroma/web/activity_pub/utils.ex
@@ -20,6 +20,8 @@ defmodule Pleroma.Web.ActivityPub.Utils do
   require Logger
 
   @supported_object_types ["Article", "Note", "Video", "Page"]
+  @supported_report_states ~w(open closed resolved)
+  @valid_visibilities ~w(public unlisted private direct)
 
   # Some implementations send the actor URI as the actor field, others send the entire actor object,
   # so figure out what the actor's URI is based on what we have.
@@ -670,7 +672,8 @@ defmodule Pleroma.Web.ActivityPub.Utils do
       "actor" => params.actor.ap_id,
       "content" => params.content,
       "object" => object,
-      "context" => params.context
+      "context" => params.context,
+      "state" => "open"
     }
     |> Map.merge(additional)
   end
@@ -713,4 +716,77 @@ defmodule Pleroma.Web.ActivityPub.Utils do
       end
     end
   end
+
+  #### Report-related helpers
+
+  def update_report_state(%Activity{} = activity, state) when state in @supported_report_states do
+    with new_data <- Map.put(activity.data, "state", state),
+         changeset <- Changeset.change(activity, data: new_data),
+         {:ok, activity} <- Repo.update(changeset) do
+      {:ok, activity}
+    end
+  end
+
+  def update_report_state(_, _), do: {:error, "Unsupported state"}
+
+  def update_activity_visibility(activity, visibility) when visibility in @valid_visibilities do
+    [to, cc, recipients] =
+      activity
+      |> get_updated_targets(visibility)
+      |> Enum.map(&Enum.uniq/1)
+
+    object_data =
+      activity.object.data
+      |> Map.put("to", to)
+      |> Map.put("cc", cc)
+
+    {:ok, object} =
+      activity.object
+      |> Object.change(%{data: object_data})
+      |> Object.update_and_set_cache()
+
+    activity_data =
+      activity.data
+      |> Map.put("to", to)
+      |> Map.put("cc", cc)
+
+    activity
+    |> Map.put(:object, object)
+    |> Activity.change(%{data: activity_data, recipients: recipients})
+    |> Repo.update()
+  end
+
+  def update_activity_visibility(_, _), do: {:error, "Unsupported visibility"}
+
+  defp get_updated_targets(
+         %Activity{data: %{"to" => to} = data, recipients: recipients},
+         visibility
+       ) do
+    cc = Map.get(data, "cc", [])
+    follower_address = User.get_cached_by_ap_id(data["actor"]).follower_address
+    public = "https://www.w3.org/ns/activitystreams#Public"
+
+    case visibility do
+      "public" ->
+        to = [public | List.delete(to, follower_address)]
+        cc = [follower_address | List.delete(cc, public)]
+        recipients = [public | recipients]
+        [to, cc, recipients]
+
+      "private" ->
+        to = [follower_address | List.delete(to, public)]
+        cc = List.delete(cc, public)
+        recipients = List.delete(recipients, public)
+        [to, cc, recipients]
+
+      "unlisted" ->
+        to = [follower_address | List.delete(to, public)]
+        cc = [public | List.delete(cc, follower_address)]
+        recipients = recipients ++ [follower_address, public]
+        [to, cc, recipients]
+
+      _ ->
+        [to, cc, recipients]
+    end
+  end
 end
diff --git a/lib/pleroma/web/admin_api/admin_api_controller.ex b/lib/pleroma/web/admin_api/admin_api_controller.ex
index e00b33aba..de2a13c01 100644
--- a/lib/pleroma/web/admin_api/admin_api_controller.ex
+++ b/lib/pleroma/web/admin_api/admin_api_controller.ex
@@ -4,11 +4,16 @@
 
 defmodule Pleroma.Web.AdminAPI.AdminAPIController do
   use Pleroma.Web, :controller
+  alias Pleroma.Activity
   alias Pleroma.User
   alias Pleroma.UserInviteToken
+  alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.ActivityPub.Relay
   alias Pleroma.Web.AdminAPI.AccountView
+  alias Pleroma.Web.AdminAPI.ReportView
   alias Pleroma.Web.AdminAPI.Search
+  alias Pleroma.Web.CommonAPI
+  alias Pleroma.Web.MastodonAPI.StatusView
 
   import Pleroma.Web.ControllerHelper, only: [json_response: 3]
 
@@ -287,12 +292,88 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
     |> json(token.token)
   end
 
+  def list_reports(conn, params) do
+    params =
+      params
+      |> Map.put("type", "Flag")
+      |> Map.put("skip_preload", true)
+
+    reports =
+      []
+      |> ActivityPub.fetch_activities(params)
+      |> Enum.reverse()
+
+    conn
+    |> put_view(ReportView)
+    |> render("index.json", %{reports: reports})
+  end
+
+  def report_show(conn, %{"id" => id}) do
+    with %Activity{} = report <- Activity.get_by_id(id) do
+      conn
+      |> put_view(ReportView)
+      |> render("show.json", %{report: report})
+    else
+      _ -> {:error, :not_found}
+    end
+  end
+
+  def report_update_state(conn, %{"id" => id, "state" => state}) do
+    with {:ok, report} <- CommonAPI.update_report_state(id, state) do
+      conn
+      |> put_view(ReportView)
+      |> render("show.json", %{report: report})
+    end
+  end
+
+  def report_respond(%{assigns: %{user: user}} = conn, %{"id" => id} = params) do
+    with false <- is_nil(params["status"]),
+         %Activity{} <- Activity.get_by_id(id) do
+      params =
+        params
+        |> Map.put("in_reply_to_status_id", id)
+        |> Map.put("visibility", "direct")
+
+      {:ok, activity} = CommonAPI.post(user, params)
+
+      conn
+      |> put_view(StatusView)
+      |> render("status.json", %{activity: activity})
+    else
+      true ->
+        {:param_cast, nil}
+
+      nil ->
+        {:error, :not_found}
+    end
+  end
+
+  def status_update(conn, %{"id" => id} = params) do
+    with {:ok, activity} <- CommonAPI.update_activity_scope(id, params) do
+      conn
+      |> put_view(StatusView)
+      |> render("status.json", %{activity: activity})
+    end
+  end
+
+  def status_delete(%{assigns: %{user: user}} = conn, %{"id" => id}) do
+    with {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
+      json(conn, %{})
+    end
+  end
+
   def errors(conn, {:error, :not_found}) do
     conn
     |> put_status(404)
     |> json("Not found")
   end
 
+  def errors(conn, {:error, reason}) do
+    conn
+    |> put_status(400)
+    |> json(reason)
+  end
+
   def errors(conn, {:param_cast, _}) do
     conn
     |> put_status(400)
diff --git a/lib/pleroma/web/admin_api/views/report_view.ex b/lib/pleroma/web/admin_api/views/report_view.ex
new file mode 100644
index 000000000..47a73dc7e
--- /dev/null
+++ b/lib/pleroma/web/admin_api/views/report_view.ex
@@ -0,0 +1,41 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.AdminAPI.ReportView do
+  use Pleroma.Web, :view
+  alias Pleroma.Activity
+  alias Pleroma.User
+  alias Pleroma.Web.CommonAPI.Utils
+  alias Pleroma.Web.MastodonAPI.AccountView
+  alias Pleroma.Web.MastodonAPI.StatusView
+
+  def render("index.json", %{reports: reports}) do
+    %{
+      reports: render_many(reports, __MODULE__, "show.json", as: :report)
+    }
+  end
+
+  def render("show.json", %{report: report}) do
+    user = User.get_cached_by_ap_id(report.data["actor"])
+    created_at = Utils.to_masto_date(report.data["published"])
+
+    [account_ap_id | status_ap_ids] = report.data["object"]
+    account = User.get_cached_by_ap_id(account_ap_id)
+
+    statuses =
+      Enum.map(status_ap_ids, fn ap_id ->
+        Activity.get_by_ap_id_with_object(ap_id)
+      end)
+
+    %{
+      id: report.id,
+      account: AccountView.render("account.json", %{user: account}),
+      actor: AccountView.render("account.json", %{user: user}),
+      content: report.data["content"],
+      created_at: created_at,
+      statuses: StatusView.render("index.json", %{activities: statuses, as: :activity}),
+      state: report.data["state"]
+    }
+  end
+end
diff --git a/lib/pleroma/web/common_api/common_api.ex b/lib/pleroma/web/common_api/common_api.ex
index 29c4c1014..208c12c7b 100644
--- a/lib/pleroma/web/common_api/common_api.ex
+++ b/lib/pleroma/web/common_api/common_api.ex
@@ -71,6 +71,9 @@ defmodule Pleroma.Web.CommonAPI do
          {:ok, _} <- unpin(activity_id, user),
          {:ok, delete} <- ActivityPub.delete(object) do
       {:ok, delete}
+    else
+      _ ->
+        {:error, "Could not delete"}
     end
   end
 
@@ -315,6 +318,60 @@ defmodule Pleroma.Web.CommonAPI do
     end
   end
 
+  def update_report_state(activity_id, state) do
+    with %Activity{} = activity <- Activity.get_by_id(activity_id),
+         {:ok, activity} <- Utils.update_report_state(activity, state) do
+      {:ok, activity}
+    else
+      nil ->
+        {:error, :not_found}
+
+      {:error, reason} ->
+        {:error, reason}
+
+      _ ->
+        {:error, "Could not update state"}
+    end
+  end
+
+  def update_activity_scope(activity_id, opts \\ %{}) do
+    with %Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
+         {:ok, activity} <- toggle_sensitive(activity, opts),
+         {:ok, activity} <- set_visibility(activity, opts) do
+      {:ok, activity}
+    else
+      nil ->
+        {:error, :not_found}
+
+      {:error, reason} ->
+        {:error, reason}
+    end
+  end
+
+  defp toggle_sensitive(activity, %{"sensitive" => sensitive}) when sensitive in ~w(true false) do
+    toggle_sensitive(activity, %{"sensitive" => String.to_existing_atom(sensitive)})
+  end
+
+  defp toggle_sensitive(%Activity{object: object} = activity, %{"sensitive" => sensitive})
+       when is_boolean(sensitive) do
+    new_data = Map.put(object.data, "sensitive", sensitive)
+
+    {:ok, object} =
+      object
+      |> Object.change(%{data: new_data})
+      |> Object.update_and_set_cache()
+
+    {:ok, Map.put(activity, :object, object)}
+  end
+
+  defp toggle_sensitive(activity, _), do: {:ok, activity}
+
+  defp set_visibility(activity, %{"visibility" => visibility}) do
+    Utils.update_activity_visibility(activity, visibility)
+  end
+
+  defp set_visibility(activity, _), do: {:ok, activity}
+
   def hide_reblogs(user, muted) do
     ap_id = muted.ap_id
 
diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index 1dfe50b40..bee2fd159 100644
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -237,13 +237,11 @@ defmodule Pleroma.Web.CommonAPI.Utils do
       "tag" => tags |> Enum.map(fn {_, tag} -> tag end) |> Enum.uniq()
     }
 
-    if in_reply_to do
-      in_reply_to_object = Object.normalize(in_reply_to)
-
-      object
-      |> Map.put("inReplyTo", in_reply_to_object.data["id"])
+    with false <- is_nil(in_reply_to),
+         %Object{} = in_reply_to_object <- Object.normalize(in_reply_to) do
+      Map.put(object, "inReplyTo", in_reply_to_object.data["id"])
     else
-      object
+      _ -> object
     end
   end
 
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 7fef82f82..6a4e4a1d4 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -194,6 +194,14 @@ defmodule Pleroma.Web.Router do
 
     get("/users", AdminAPIController, :list_users)
     get("/users/:nickname", AdminAPIController, :user_show)
+
+    get("/reports", AdminAPIController, :list_reports)
+    get("/reports/:id", AdminAPIController, :report_show)
+    put("/reports/:id", AdminAPIController, :report_update_state)
+    post("/reports/:id/respond", AdminAPIController, :report_respond)
+
+    put("/statuses/:id", AdminAPIController, :status_update)
+    delete("/statuses/:id", AdminAPIController, :status_delete)
   end
 
   scope "/", Pleroma.Web.TwitterAPI do
diff --git a/priv/repo/migrations/20190511191044_set_default_state_to_reports.exs b/priv/repo/migrations/20190511191044_set_default_state_to_reports.exs
new file mode 100644
index 000000000..0d3d253b6
--- /dev/null
+++ b/priv/repo/migrations/20190511191044_set_default_state_to_reports.exs
@@ -0,0 +1,19 @@
+defmodule Pleroma.Repo.Migrations.SetDefaultStateToReports do
+  use Ecto.Migration
+
+  def up do
+    execute """
+      UPDATE activities AS a
+      SET data = jsonb_set(data, '{state}', '"open"', true)
+      WHERE data->>'type' = 'Flag'
+    """
+  end
+
+  def down do
+    execute """
+      UPDATE activities AS a
+      SET data = data #- '{state}'
+      WHERE data->>'type' = 'Flag'
+    """
+  end
+end
diff --git a/test/support/factory.ex b/test/support/factory.ex
index 2a2954ad6..90c7d80f2 100644
--- a/test/support/factory.ex
+++ b/test/support/factory.ex
@@ -43,7 +43,7 @@ defmodule Pleroma.Factory do
   def note_factory(attrs \\ %{}) do
     text = sequence(:text, &"This is :moominmamma: note #{&1}")
 
-    user = insert(:user)
+    user = attrs[:user] || insert(:user)
 
     data = %{
       "type" => "Note",
@@ -113,7 +113,8 @@ defmodule Pleroma.Factory do
   end
 
   def note_activity_factory(attrs \\ %{}) do
-    note = attrs[:note] || insert(:note)
+    user = attrs[:user] || insert(:user)
+    note = attrs[:note] || insert(:note, user: user)
 
     data = %{
       "id" => Pleroma.Web.ActivityPub.Utils.generate_activity_id(),
diff --git a/test/web/admin_api/admin_api_controller_test.exs b/test/web/admin_api/admin_api_controller_test.exs
index 6c1897b5a..ca12c7215 100644
--- a/test/web/admin_api/admin_api_controller_test.exs
+++ b/test/web/admin_api/admin_api_controller_test.exs
@@ -5,8 +5,10 @@
 defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
   use Pleroma.Web.ConnCase
 
+  alias Pleroma.Activity
   alias Pleroma.User
   alias Pleroma.UserInviteToken
+  alias Pleroma.Web.CommonAPI
   import Pleroma.Factory
 
   describe "/api/pleroma/admin/users" do
@@ -949,4 +951,329 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
              }
     end
   end
+
+  describe "GET /api/pleroma/admin/reports/:id" do
+    setup %{conn: conn} do
+      admin = insert(:user, info: %{is_admin: true})
+
+      %{conn: assign(conn, :user, admin)}
+    end
+
+    test "returns report by its id", %{conn: conn} do
+      [reporter, target_user] = insert_pair(:user)
+      activity = insert(:note_activity, user: target_user)
+
+      {:ok, %{id: report_id}} =
+        CommonAPI.report(reporter, %{
+          "account_id" => target_user.id,
+          "comment" => "I feel offended",
+          "status_ids" => [activity.id]
+        })
+
+      response =
+        conn
+        |> get("/api/pleroma/admin/reports/#{report_id}")
+        |> json_response(:ok)
+
+      assert response["id"] == report_id
+    end
+
+    test "returns 404 when report id is invalid", %{conn: conn} do
+      conn = get(conn, "/api/pleroma/admin/reports/test")
+
+      assert json_response(conn, :not_found) == "Not found"
+    end
+  end
+
+  describe "PUT /api/pleroma/admin/reports/:id" do
+    setup %{conn: conn} do
+      admin = insert(:user, info: %{is_admin: true})
+      [reporter, target_user] = insert_pair(:user)
+      activity = insert(:note_activity, user: target_user)
+
+      {:ok, %{id: report_id}} =
+        CommonAPI.report(reporter, %{
+          "account_id" => target_user.id,
+          "comment" => "I feel offended",
+          "status_ids" => [activity.id]
+        })
+
+      %{conn: assign(conn, :user, admin), id: report_id}
+    end
+
+    test "mark report as resolved", %{conn: conn, id: id} do
+      response =
+        conn
+        |> put("/api/pleroma/admin/reports/#{id}", %{"state" => "resolved"})
+        |> json_response(:ok)
+
+      assert response["state"] == "resolved"
+    end
+
+    test "closes report", %{conn: conn, id: id} do
+      response =
+        conn
+        |> put("/api/pleroma/admin/reports/#{id}", %{"state" => "closed"})
+        |> json_response(:ok)
+
+      assert response["state"] == "closed"
+    end
+
+    test "returns 400 when state is unknown", %{conn: conn, id: id} do
+      conn =
+        conn
+        |> put("/api/pleroma/admin/reports/#{id}", %{"state" => "test"})
+
+      assert json_response(conn, :bad_request) == "Unsupported state"
+    end
+
+    test "returns 404 when report is not exist", %{conn: conn} do
+      conn =
+        conn
+        |> put("/api/pleroma/admin/reports/test", %{"state" => "closed"})
+
+      assert json_response(conn, :not_found) == "Not found"
+    end
+  end
+
+  describe "GET /api/pleroma/admin/reports" do
+    setup %{conn: conn} do
+      admin = insert(:user, info: %{is_admin: true})
+
+      %{conn: assign(conn, :user, admin)}
+    end
+
+    test "returns empty response when no reports created", %{conn: conn} do
+      response =
+        conn
+        |> get("/api/pleroma/admin/reports")
+        |> json_response(:ok)
+
+      assert Enum.empty?(response["reports"])
+    end
+
+    test "returns reports", %{conn: conn} do
+      [reporter, target_user] = insert_pair(:user)
+      activity = insert(:note_activity, user: target_user)
+
+      {:ok, %{id: report_id}} =
+        CommonAPI.report(reporter, %{
+          "account_id" => target_user.id,
+          "comment" => "I feel offended",
+          "status_ids" => [activity.id]
+        })
+
+      response =
+        conn
+        |> get("/api/pleroma/admin/reports")
+        |> json_response(:ok)
+
+      [report] = response["reports"]
+
+      assert length(response["reports"]) == 1
+      assert report["id"] == report_id
+    end
+
+    test "returns reports with specified state", %{conn: conn} do
+      [reporter, target_user] = insert_pair(:user)
+      activity = insert(:note_activity, user: target_user)
+
+      {:ok, %{id: first_report_id}} =
+        CommonAPI.report(reporter, %{
+          "account_id" => target_user.id,
+          "comment" => "I feel offended",
+          "status_ids" => [activity.id]
+        })
+
+      {:ok, %{id: second_report_id}} =
+        CommonAPI.report(reporter, %{
+          "account_id" => target_user.id,
+          "comment" => "I don't like this user"
+        })
+
+      CommonAPI.update_report_state(second_report_id, "closed")
+
+      response =
+        conn
+        |> get("/api/pleroma/admin/reports", %{
+          "state" => "open"
+        })
+        |> json_response(:ok)
+
+      [open_report] = response["reports"]
+
+      assert length(response["reports"]) == 1
+      assert open_report["id"] == first_report_id
+
+      response =
+        conn
+        |> get("/api/pleroma/admin/reports", %{
+          "state" => "closed"
+        })
+        |> json_response(:ok)
+
+      [closed_report] = response["reports"]
+
+      assert length(response["reports"]) == 1
+      assert closed_report["id"] == second_report_id
+
+      response =
+        conn
+        |> get("/api/pleroma/admin/reports", %{
+          "state" => "resolved"
+        })
+        |> json_response(:ok)
+
+      assert Enum.empty?(response["reports"])
+    end
+
+    test "returns 403 when requested by a non-admin" do
+      user = insert(:user)
+
+      conn =
+        build_conn()
+        |> assign(:user, user)
+        |> get("/api/pleroma/admin/reports")
+
+      assert json_response(conn, :forbidden) == %{"error" => "User is not admin."}
+    end
+
+    test "returns 403 when requested by anonymous" do
+      conn =
+        build_conn()
+        |> get("/api/pleroma/admin/reports")
+
+      assert json_response(conn, :forbidden) == %{"error" => "Invalid credentials."}
+    end
+  end
+
+  describe "POST /api/pleroma/admin/reports/:id/respond" do
+    setup %{conn: conn} do
+      admin = insert(:user, info: %{is_admin: true})
+
+      %{conn: assign(conn, :user, admin)}
+    end
+
+    test "returns created dm", %{conn: conn} do
+      [reporter, target_user] = insert_pair(:user)
+      activity = insert(:note_activity, user: target_user)
+
+      {:ok, %{id: report_id}} =
+        CommonAPI.report(reporter, %{
+          "account_id" => target_user.id,
+          "comment" => "I feel offended",
+          "status_ids" => [activity.id]
+        })
+
+      response =
+        conn
+        |> post("/api/pleroma/admin/reports/#{report_id}/respond", %{
+          "status" => "I will check it out"
+        })
+        |> json_response(:ok)
+
+      recipients = Enum.map(response["mentions"], & &1["username"])
+
+      assert conn.assigns[:user].nickname in recipients
+      assert reporter.nickname in recipients
+      assert response["content"] == "I will check it out"
+      assert response["visibility"] == "direct"
+    end
+
+    test "returns 400 when status is missing", %{conn: conn} do
+      conn = post(conn, "/api/pleroma/admin/reports/test/respond")
+
+      assert json_response(conn, :bad_request) == "Invalid parameters"
+    end
+
+    test "returns 404 when report id is invalid", %{conn: conn} do
+      conn =
+        post(conn, "/api/pleroma/admin/reports/test/respond", %{
+          "status" => "foo"
+        })
+
+      assert json_response(conn, :not_found) == "Not found"
+    end
+  end
+
+  describe "PUT /api/pleroma/admin/statuses/:id" do
+    setup %{conn: conn} do
+      admin = insert(:user, info: %{is_admin: true})
+      activity = insert(:note_activity)
+
+      %{conn: assign(conn, :user, admin), id: activity.id}
+    end
+
+    test "toggle sensitive flag", %{conn: conn, id: id} do
+      response =
+        conn
+        |> put("/api/pleroma/admin/statuses/#{id}", %{"sensitive" => "true"})
+        |> json_response(:ok)
+
+      assert response["sensitive"]
+
+      response =
+        conn
+        |> put("/api/pleroma/admin/statuses/#{id}", %{"sensitive" => "false"})
+        |> json_response(:ok)
+
+      refute response["sensitive"]
+    end
+
+    test "change visibility flag", %{conn: conn, id: id} do
+      response =
+        conn
+        |> put("/api/pleroma/admin/statuses/#{id}", %{"visibility" => "public"})
+        |> json_response(:ok)
+
+      assert response["visibility"] == "public"
+
+      response =
+        conn
+        |> put("/api/pleroma/admin/statuses/#{id}", %{"visibility" => "private"})
+        |> json_response(:ok)
+
+      assert response["visibility"] == "private"
+
+      response =
+        conn
+        |> put("/api/pleroma/admin/statuses/#{id}", %{"visibility" => "unlisted"})
+        |> json_response(:ok)
+
+      assert response["visibility"] == "unlisted"
+    end
+
+    test "returns 400 when visibility is unknown", %{conn: conn, id: id} do
+      conn =
+        conn
+        |> put("/api/pleroma/admin/statuses/#{id}", %{"visibility" => "test"})
+
+      assert json_response(conn, :bad_request) == "Unsupported visibility"
+    end
+  end
+
+  describe "DELETE /api/pleroma/admin/statuses/:id" do
+    setup %{conn: conn} do
+      admin = insert(:user, info: %{is_admin: true})
+      activity = insert(:note_activity)
+
+      %{conn: assign(conn, :user, admin), id: activity.id}
+    end
+
+    test "deletes status", %{conn: conn, id: id} do
+      conn
+      |> delete("/api/pleroma/admin/statuses/#{id}")
+      |> json_response(:ok)
+
+      refute Activity.get_by_id(id)
+    end
+
+    test "returns error when status is not exist", %{conn: conn} do
+      conn =
+        conn
+        |> delete("/api/pleroma/admin/statuses/test")
+
+      assert json_response(conn, :bad_request) == "Could not delete"
+    end
+  end
 end
diff --git a/test/web/common_api/common_api_test.exs b/test/web/common_api/common_api_test.exs
index 8d4f401ee..38b5aa65f 100644
--- a/test/web/common_api/common_api_test.exs
+++ b/test/web/common_api/common_api_test.exs
@@ -261,10 +261,41 @@ defmodule Pleroma.Web.CommonAPITest do
                data: %{
                  "type" => "Flag",
                  "content" => ^comment,
-                 "object" => [^target_ap_id, ^activity_ap_id]
+                 "object" => [^target_ap_id, ^activity_ap_id],
+                 "state" => "open"
                }
              } = flag_activity
     end
+
+    test "updates report state" do
+      [reporter, target_user] = insert_pair(:user)
+      activity = insert(:note_activity, user: target_user)
+
+      {:ok, %Activity{id: report_id}} =
+        CommonAPI.report(reporter, %{
+          "account_id" => target_user.id,
+          "comment" => "I feel offended",
+          "status_ids" => [activity.id]
+        })
+
+      {:ok, report} = CommonAPI.update_report_state(report_id, "resolved")
+
+      assert report.data["state"] == "resolved"
+    end
+
+    test "does not update report state when state is unsupported" do
+      [reporter, target_user] = insert_pair(:user)
+      activity = insert(:note_activity, user: target_user)
+
+      {:ok, %Activity{id: report_id}} =
+        CommonAPI.report(reporter, %{
+          "account_id" => target_user.id,
+          "comment" => "I feel offended",
+          "status_ids" => [activity.id]
+        })
+
+      assert CommonAPI.update_report_state(report_id, "test") == {:error, "Unsupported state"}
+    end
   end
 
   describe "reblog muting" do
diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 40e7739e7..90d67a55f 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -2129,7 +2129,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
         |> get("/api/v1/pleroma/accounts/#{user.id}/favourites")
         |> json_response(:ok)
 
-      assert length(anonymous_response) == 0
+      assert Enum.empty?(anonymous_response)
     end
 
     test "does not return others' favorited DM when user is not one of recipients", %{
@@ -2153,7 +2153,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
         |> get("/api/v1/pleroma/accounts/#{user.id}/favourites")
         |> json_response(:ok)
 
-      assert length(response) == 0
+      assert Enum.empty?(response)
     end
 
     test "paginates favorites using since_id and max_id", %{
-- 
cgit v1.2.3


From 2c303afc8b25ca92eaa229df3e9e4737856e890c Mon Sep 17 00:00:00 2001
From: Sergey Suprunenko <suprunenko.s@gmail.com>
Date: Thu, 16 May 2019 20:04:08 +0000
Subject: Remove duplicated entries in users' following lists

---
 CHANGELOG.md                      |  1 +
 lib/mix/tasks/pleroma/database.ex | 17 ++++++++++++--
 lib/pleroma/user.ex               | 14 ++++++++++-
 test/tasks/database_test.exs      | 49 +++++++++++++++++++++++++++++++++++++++
 test/tasks/user_test.exs          |  1 +
 test/user_test.exs                | 31 +++++++++++++++++++++++++
 6 files changed, 110 insertions(+), 3 deletions(-)
 create mode 100644 test/tasks/database_test.exs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dc09d4f6b..4d314817b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Support for Mastodon's remote interaction
 - Mix Tasks: `mix pleroma.database bump_all_conversations`
 - Mix Tasks: `mix pleroma.database remove_embedded_objects`
+- Mix Tasks: `mix pleroma.database update_users_following_followers_counts`
 - Mix Tasks: `mix pleroma.user toggle_confirmed`
 - Federation: Support for reports
 - Configuration: `safe_dm_mentions` option
diff --git a/lib/mix/tasks/pleroma/database.ex b/lib/mix/tasks/pleroma/database.ex
index 42753a1a4..f650b447d 100644
--- a/lib/mix/tasks/pleroma/database.ex
+++ b/lib/mix/tasks/pleroma/database.ex
@@ -5,6 +5,8 @@
 defmodule Mix.Tasks.Pleroma.Database do
   alias Mix.Tasks.Pleroma.Common
   alias Pleroma.Conversation
+  alias Pleroma.Repo
+  alias Pleroma.User
   require Logger
   use Mix.Task
 
@@ -25,6 +27,9 @@ defmodule Mix.Tasks.Pleroma.Database do
 
       mix pleroma.database bump_all_conversations
 
+  ## Remove duplicated items from following and update followers count for all users
+
+      mix pleroma.database update_users_following_followers_counts
   """
   def run(["remove_embedded_objects" | args]) do
     {options, [], []} =
@@ -38,7 +43,7 @@ defmodule Mix.Tasks.Pleroma.Database do
     Common.start_pleroma()
     Logger.info("Removing embedded objects")
 
-    Pleroma.Repo.query!(
+    Repo.query!(
       "update activities set data = jsonb_set(data, '{object}'::text[], data->'object'->'id') where data->'object'->>'id' is not null;",
       [],
       timeout: :infinity
@@ -47,7 +52,7 @@ defmodule Mix.Tasks.Pleroma.Database do
     if Keyword.get(options, :vacuum) do
       Logger.info("Runnning VACUUM FULL")
 
-      Pleroma.Repo.query!(
+      Repo.query!(
         "vacuum full;",
         [],
         timeout: :infinity
@@ -59,4 +64,12 @@ defmodule Mix.Tasks.Pleroma.Database do
     Common.start_pleroma()
     Conversation.bump_for_all_activities()
   end
+
+  def run(["update_users_following_followers_counts"]) do
+    Common.start_pleroma()
+
+    users = Repo.all(User)
+    Enum.each(users, &User.remove_duplicated_following/1)
+    Enum.each(users, &User.update_follower_count/1)
+  end
 end
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 1aa966dfc..9ffb61300 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -166,7 +166,7 @@ defmodule Pleroma.User do
 
   def update_changeset(struct, params \\ %{}) do
     struct
-    |> cast(params, [:bio, :name, :avatar])
+    |> cast(params, [:bio, :name, :avatar, :following])
     |> unique_constraint(:nickname)
     |> validate_format(:nickname, local_nickname_regex())
     |> validate_length(:bio, max: 5000)
@@ -709,6 +709,18 @@ defmodule Pleroma.User do
     end
   end
 
+  def remove_duplicated_following(%User{following: following} = user) do
+    uniq_following = Enum.uniq(following)
+
+    if length(following) == length(uniq_following) do
+      {:ok, user}
+    else
+      user
+      |> update_changeset(%{following: uniq_following})
+      |> update_and_set_cache()
+    end
+  end
+
   @spec get_users_from_set([String.t()], boolean()) :: [User.t()]
   def get_users_from_set(ap_ids, local_only \\ true) do
     criteria = %{ap_id: ap_ids, deactivated: false}
diff --git a/test/tasks/database_test.exs b/test/tasks/database_test.exs
new file mode 100644
index 000000000..579130b05
--- /dev/null
+++ b/test/tasks/database_test.exs
@@ -0,0 +1,49 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Mix.Tasks.Pleroma.DatabaseTest do
+  alias Pleroma.Repo
+  alias Pleroma.User
+  use Pleroma.DataCase
+
+  import Pleroma.Factory
+
+  setup_all do
+    Mix.shell(Mix.Shell.Process)
+
+    on_exit(fn ->
+      Mix.shell(Mix.Shell.IO)
+    end)
+
+    :ok
+  end
+
+  describe "running update_users_following_followers_counts" do
+    test "following and followers count are updated" do
+      [user, user2] = insert_pair(:user)
+      {:ok, %User{following: following, info: info} = user} = User.follow(user, user2)
+
+      assert length(following) == 2
+      assert info.follower_count == 0
+
+      info_cng = Ecto.Changeset.change(info, %{follower_count: 3})
+
+      {:ok, user} =
+        user
+        |> Ecto.Changeset.change(%{following: following ++ following})
+        |> Ecto.Changeset.put_embed(:info, info_cng)
+        |> Repo.update()
+
+      assert length(user.following) == 4
+      assert user.info.follower_count == 3
+
+      assert :ok == Mix.Tasks.Pleroma.Database.run(["update_users_following_followers_counts"])
+
+      user = User.get_by_id(user.id)
+
+      assert length(user.following) == 2
+      assert user.info.follower_count == 0
+    end
+  end
+end
diff --git a/test/tasks/user_test.exs b/test/tasks/user_test.exs
index 1f97740be..260ce0d95 100644
--- a/test/tasks/user_test.exs
+++ b/test/tasks/user_test.exs
@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Mix.Tasks.Pleroma.UserTest do
+  alias Pleroma.Repo
   alias Pleroma.User
   use Pleroma.DataCase
 
diff --git a/test/user_test.exs b/test/user_test.exs
index 16a014f2f..721b65693 100644
--- a/test/user_test.exs
+++ b/test/user_test.exs
@@ -626,6 +626,37 @@ defmodule Pleroma.UserTest do
     end
   end
 
+  describe "remove duplicates from following list" do
+    test "it removes duplicates" do
+      user = insert(:user)
+      follower = insert(:user)
+
+      {:ok, %User{following: following} = follower} = User.follow(follower, user)
+      assert length(following) == 2
+
+      {:ok, follower} =
+        follower
+        |> User.update_changeset(%{following: following ++ following})
+        |> Repo.update()
+
+      assert length(follower.following) == 4
+
+      {:ok, follower} = User.remove_duplicated_following(follower)
+      assert length(follower.following) == 2
+    end
+
+    test "it does nothing when following is uniq" do
+      user = insert(:user)
+      follower = insert(:user)
+
+      {:ok, follower} = User.follow(follower, user)
+      assert length(follower.following) == 2
+
+      {:ok, follower} = User.remove_duplicated_following(follower)
+      assert length(follower.following) == 2
+    end
+  end
+
   describe "follow_import" do
     test "it imports user followings from list" do
       [user1, user2, user3] = insert_list(3, :user)
-- 
cgit v1.2.3


From 70235ce840a4ed834080ab6afc3000185590c6cb Mon Sep 17 00:00:00 2001
From: Aaron Tinio <aptinio@gmail.com>
Date: Fri, 17 May 2019 09:02:04 +0800
Subject: Fix typo: s/"tags"/"tag"/g

---
 lib/pleroma/web/activity_pub/mrf/simple_policy.ex | 2 +-
 lib/pleroma/web/activity_pub/mrf/tag_policy.ex    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/mrf/simple_policy.ex b/lib/pleroma/web/activity_pub/mrf/simple_policy.ex
index 2f105700b..50426e920 100644
--- a/lib/pleroma/web/activity_pub/mrf/simple_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/simple_policy.ex
@@ -55,7 +55,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do
     object =
       if Enum.member?(Pleroma.Config.get([:mrf_simple, :media_nsfw]), actor_host) do
         tags = (child_object["tag"] || []) ++ ["nsfw"]
-        child_object = Map.put(child_object, "tags", tags)
+        child_object = Map.put(child_object, "tag", tags)
         child_object = Map.put(child_object, "sensitive", true)
         Map.put(object, "object", child_object)
       else
diff --git a/lib/pleroma/web/activity_pub/mrf/tag_policy.ex b/lib/pleroma/web/activity_pub/mrf/tag_policy.ex
index b52be30e7..6683b8d8e 100644
--- a/lib/pleroma/web/activity_pub/mrf/tag_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/tag_policy.ex
@@ -31,7 +31,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
 
     object =
       object
-      |> Map.put("tags", tags)
+      |> Map.put("tag", tags)
       |> Map.put("sensitive", true)
 
     message = Map.put(message, "object", object)
-- 
cgit v1.2.3


From 443cd68a4c37cc8e3a3260feff25791bd5ebabf4 Mon Sep 17 00:00:00 2001
From: Aaron Tinio <aptinio@gmail.com>
Date: Fri, 17 May 2019 08:11:17 +0800
Subject: Add tests for MRF.SimplePolicy

---
 test/web/activity_pub/mrf/simple_policy_test.exs | 192 +++++++++++++++++++++++
 1 file changed, 192 insertions(+)
 create mode 100644 test/web/activity_pub/mrf/simple_policy_test.exs

diff --git a/test/web/activity_pub/mrf/simple_policy_test.exs b/test/web/activity_pub/mrf/simple_policy_test.exs
new file mode 100644
index 000000000..1e0511975
--- /dev/null
+++ b/test/web/activity_pub/mrf/simple_policy_test.exs
@@ -0,0 +1,192 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicyTest do
+  use Pleroma.DataCase
+  import Pleroma.Factory
+  alias Pleroma.Config
+  alias Pleroma.Web.ActivityPub.MRF.SimplePolicy
+
+  setup do
+    orig = Config.get!(:mrf_simple)
+
+    Config.put(:mrf_simple,
+      media_removal: [],
+      media_nsfw: [],
+      federated_timeline_removal: [],
+      reject: [],
+      accept: []
+    )
+
+    on_exit(fn ->
+      Config.put(:mrf_simple, orig)
+    end)
+  end
+
+  describe "when :media_removal" do
+    test "is empty" do
+      Config.put([:mrf_simple, :media_removal], [])
+      media_message = build_media_message()
+      local_message = build_local_message()
+
+      assert SimplePolicy.filter(media_message) == {:ok, media_message}
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+    end
+
+    test "has a matching host" do
+      Config.put([:mrf_simple, :media_removal], ["remote.instance"])
+      media_message = build_media_message()
+      local_message = build_local_message()
+
+      assert SimplePolicy.filter(media_message) ==
+               {:ok,
+                media_message
+                |> Map.put("object", Map.delete(media_message["object"], "attachment"))}
+
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+    end
+  end
+
+  describe "when :media_nsfw" do
+    test "is empty" do
+      Config.put([:mrf_simple, :media_nsfw], [])
+      media_message = build_media_message()
+      local_message = build_local_message()
+
+      assert SimplePolicy.filter(media_message) == {:ok, media_message}
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+    end
+
+    test "has a matching host" do
+      Config.put([:mrf_simple, :media_nsfw], ["remote.instance"])
+      media_message = build_media_message()
+      local_message = build_local_message()
+
+      assert SimplePolicy.filter(media_message) ==
+               {:ok,
+                media_message
+                |> put_in(["object", "tag"], ["foo", "nsfw"])
+                |> put_in(["object", "sensitive"], true)}
+
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+    end
+  end
+
+  defp build_media_message do
+    %{
+      "actor" => "https://remote.instance/users/bob",
+      "type" => "Create",
+      "object" => %{
+        "attachment" => [%{}],
+        "tag" => ["foo"],
+        "sensitive" => false
+      }
+    }
+  end
+
+  describe "when :federated_timeline_removal" do
+    test "is empty" do
+      Config.put([:mrf_simple, :federated_timeline_removal], [])
+      {_, ftl_message} = build_ftl_actor_and_message()
+      local_message = build_local_message()
+
+      assert SimplePolicy.filter(ftl_message) == {:ok, ftl_message}
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+    end
+
+    test "has a matching host" do
+      {actor, ftl_message} = build_ftl_actor_and_message()
+
+      ftl_message_actor_host =
+        ftl_message
+        |> Map.fetch!("actor")
+        |> URI.parse()
+        |> Map.fetch!(:host)
+
+      Config.put([:mrf_simple, :federated_timeline_removal], [ftl_message_actor_host])
+      local_message = build_local_message()
+
+      assert {:ok, ftl_message} = SimplePolicy.filter(ftl_message)
+      assert actor.follower_address in ftl_message["to"]
+      refute actor.follower_address in ftl_message["cc"]
+      refute "https://www.w3.org/ns/activitystreams#Public" in ftl_message["to"]
+      assert "https://www.w3.org/ns/activitystreams#Public" in ftl_message["cc"]
+
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+    end
+  end
+
+  defp build_ftl_actor_and_message do
+    actor = insert(:user)
+
+    {actor,
+     %{
+       "actor" => actor.ap_id,
+       "to" => ["https://www.w3.org/ns/activitystreams#Public", "http://foo.bar/baz"],
+       "cc" => [actor.follower_address, "http://foo.bar/qux"]
+     }}
+  end
+
+  describe "when :reject" do
+    test "is empty" do
+      Config.put([:mrf_simple, :reject], [])
+
+      remote_message = build_remote_message()
+
+      assert SimplePolicy.filter(remote_message) == {:ok, remote_message}
+    end
+
+    test "has a matching host" do
+      Config.put([:mrf_simple, :reject], ["remote.instance"])
+
+      remote_message = build_remote_message()
+
+      assert SimplePolicy.filter(remote_message) == {:reject, nil}
+    end
+  end
+
+  describe "when :accept" do
+    test "is empty" do
+      Config.put([:mrf_simple, :accept], [])
+
+      local_message = build_local_message()
+      remote_message = build_remote_message()
+
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+      assert SimplePolicy.filter(remote_message) == {:ok, remote_message}
+    end
+
+    test "is not empty but it doesn't have a matching host" do
+      Config.put([:mrf_simple, :accept], ["non.matching.remote"])
+
+      local_message = build_local_message()
+      remote_message = build_remote_message()
+
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+      assert SimplePolicy.filter(remote_message) == {:reject, nil}
+    end
+
+    test "has a matching host" do
+      Config.put([:mrf_simple, :accept], ["remote.instance"])
+
+      local_message = build_local_message()
+      remote_message = build_remote_message()
+
+      assert SimplePolicy.filter(local_message) == {:ok, local_message}
+      assert SimplePolicy.filter(remote_message) == {:ok, remote_message}
+    end
+  end
+
+  defp build_local_message do
+    %{
+      "actor" => "#{Pleroma.Web.base_url()}/users/alice",
+      "to" => [],
+      "cc" => []
+    }
+  end
+
+  defp build_remote_message do
+    %{"actor" => "https://remote.instance/users/bob"}
+  end
+end
-- 
cgit v1.2.3


From 68c75a08e8593d41f496a362ab1be43d054c09d5 Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Fri, 17 May 2019 07:34:52 +0200
Subject: MastoAPI account_view.ex: requested is false when following is true

Closes: https://git.pleroma.social/pleroma/pleroma/issues/903
---
 lib/pleroma/web/mastodon_api/views/account_view.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/mastodon_api/views/account_view.ex b/lib/pleroma/web/mastodon_api/views/account_view.ex
index 779b9a382..606a0f2ed 100644
--- a/lib/pleroma/web/mastodon_api/views/account_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/account_view.ex
@@ -40,7 +40,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
     follow_activity = Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(user, target)
 
     requested =
-      if follow_activity do
+      if follow_activity and !User.following?(target, user) do
         follow_activity.data["state"] == "pending"
       else
         false
-- 
cgit v1.2.3


From 7ed682213faf88edc67b4c2a24b277ab1d992813 Mon Sep 17 00:00:00 2001
From: Alexander Strizhakov <alex.strizhakov@gmail.com>
Date: Fri, 17 May 2019 07:25:20 +0000
Subject: Fix/902 random compile failing

---
 lib/pleroma/user.ex                                     |  6 +++---
 lib/pleroma/web/activity_pub/transmogrifier.ex          |  1 -
 lib/pleroma/web/common_api/common_api.ex                |  6 +++---
 lib/pleroma/web/federator/publisher.ex                  |  8 ++++----
 lib/pleroma/web/mastodon_api/mastodon_api_controller.ex |  2 +-
 lib/pleroma/web/oauth/authorization.ex                  |  2 +-
 lib/pleroma/web/oauth/token.ex                          |  2 +-
 lib/pleroma/web/web_finger/web_finger.ex                |  2 +-
 test/formatter_test.exs                                 |  2 +-
 test/plugs/legacy_authentication_plug_test.exs          |  2 +-
 test/repo_test.exs                                      |  7 ++++---
 test/support/factory.ex                                 |  9 +++++----
 test/user_test.exs                                      | 10 +++++-----
 test/web/mastodon_api/mastodon_api_controller_test.exs  |  8 ++++----
 test/web/ostatus/ostatus_test.exs                       |  4 ++--
 15 files changed, 36 insertions(+), 35 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 9ffb61300..9607c1f03 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -55,7 +55,7 @@ defmodule Pleroma.User do
     field(:last_refreshed_at, :naive_datetime_usec)
     has_many(:notifications, Notification)
     has_many(:registrations, Registration)
-    embeds_one(:info, Pleroma.User.Info)
+    embeds_one(:info, User.Info)
 
     timestamps()
   end
@@ -233,7 +233,7 @@ defmodule Pleroma.User do
       |> validate_confirmation(:password)
       |> unique_constraint(:email)
       |> unique_constraint(:nickname)
-      |> validate_exclusion(:nickname, Pleroma.Config.get([Pleroma.User, :restricted_nicknames]))
+      |> validate_exclusion(:nickname, Pleroma.Config.get([User, :restricted_nicknames]))
       |> validate_format(:nickname, local_nickname_regex())
       |> validate_format(:email, @email_regex)
       |> validate_length(:bio, max: 1000)
@@ -278,7 +278,7 @@ defmodule Pleroma.User do
     with {:ok, user} <- Repo.insert(changeset),
          {:ok, user} <- autofollow_users(user),
          {:ok, user} <- set_cache(user),
-         {:ok, _} <- Pleroma.User.WelcomeMessage.post_welcome_message_to_user(user),
+         {:ok, _} <- User.WelcomeMessage.post_welcome_message_to_user(user),
          {:ok, _} <- try_send_confirmation_email(user) do
       {:ok, user}
     end
diff --git a/lib/pleroma/web/activity_pub/transmogrifier.ex b/lib/pleroma/web/activity_pub/transmogrifier.ex
index 508f3532f..5edd8ccc7 100644
--- a/lib/pleroma/web/activity_pub/transmogrifier.ex
+++ b/lib/pleroma/web/activity_pub/transmogrifier.ex
@@ -11,7 +11,6 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
   alias Pleroma.Object.Containment
   alias Pleroma.Repo
   alias Pleroma.User
-  alias Pleroma.User
   alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.ActivityPub.Utils
   alias Pleroma.Web.ActivityPub.Visibility
diff --git a/lib/pleroma/web/common_api/common_api.ex b/lib/pleroma/web/common_api/common_api.ex
index 208c12c7b..a599ffee5 100644
--- a/lib/pleroma/web/common_api/common_api.ex
+++ b/lib/pleroma/web/common_api/common_api.ex
@@ -200,7 +200,7 @@ defmodule Pleroma.Web.CommonAPI do
     user =
       with emoji <- emoji_from_profile(user),
            source_data <- (user.info.source_data || %{}) |> Map.put("tag", emoji),
-           info_cng <- Pleroma.User.Info.set_source_data(user.info, source_data),
+           info_cng <- User.Info.set_source_data(user.info, source_data),
            change <- Ecto.Changeset.change(user) |> Ecto.Changeset.put_embed(:info, info_cng),
            {:ok, user} <- User.update_and_set_cache(change) do
         user
@@ -233,7 +233,7 @@ defmodule Pleroma.Web.CommonAPI do
          } = activity <- get_by_id_or_ap_id(id_or_ap_id),
          true <- Enum.member?(object_to, "https://www.w3.org/ns/activitystreams#Public"),
          %{valid?: true} = info_changeset <-
-           Pleroma.User.Info.add_pinnned_activity(user.info, activity),
+           User.Info.add_pinnned_activity(user.info, activity),
          changeset <-
            Ecto.Changeset.change(user) |> Ecto.Changeset.put_embed(:info, info_changeset),
          {:ok, _user} <- User.update_and_set_cache(changeset) do
@@ -250,7 +250,7 @@ defmodule Pleroma.Web.CommonAPI do
   def unpin(id_or_ap_id, user) do
     with %Activity{} = activity <- get_by_id_or_ap_id(id_or_ap_id),
          %{valid?: true} = info_changeset <-
-           Pleroma.User.Info.remove_pinnned_activity(user.info, activity),
+           User.Info.remove_pinnned_activity(user.info, activity),
          changeset <-
            Ecto.Changeset.change(user) |> Ecto.Changeset.put_embed(:info, info_changeset),
          {:ok, _user} <- User.update_and_set_cache(changeset) do
diff --git a/lib/pleroma/web/federator/publisher.ex b/lib/pleroma/web/federator/publisher.ex
index fb4e8548d..70f870244 100644
--- a/lib/pleroma/web/federator/publisher.ex
+++ b/lib/pleroma/web/federator/publisher.ex
@@ -52,9 +52,9 @@ defmodule Pleroma.Web.Federator.Publisher do
   @doc """
   Relays an activity to all specified peers.
   """
-  @callback publish(Pleroma.User.t(), Pleroma.Activity.t()) :: :ok | {:error, any()}
+  @callback publish(User.t(), Activity.t()) :: :ok | {:error, any()}
 
-  @spec publish(Pleroma.User.t(), Pleroma.Activity.t()) :: :ok
+  @spec publish(User.t(), Activity.t()) :: :ok
   def publish(%User{} = user, %Activity{} = activity) do
     Config.get([:instance, :federation_publisher_modules])
     |> Enum.each(fn module ->
@@ -70,9 +70,9 @@ defmodule Pleroma.Web.Federator.Publisher do
   @doc """
   Gathers links used by an outgoing federation module for WebFinger output.
   """
-  @callback gather_webfinger_links(Pleroma.User.t()) :: list()
+  @callback gather_webfinger_links(User.t()) :: list()
 
-  @spec gather_webfinger_links(Pleroma.User.t()) :: list()
+  @spec gather_webfinger_links(User.t()) :: list()
   def gather_webfinger_links(%User{} = user) do
     Config.get([:instance, :federation_publisher_modules])
     |> Enum.reduce([], fn module, links ->
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index 66056a846..1b776fbca 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -1222,7 +1222,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
     accounts
     |> Enum.each(fn account_id ->
       with %Pleroma.List{} = list <- Pleroma.List.get(id, user),
-           %User{} = followed <- Pleroma.User.get_cached_by_id(account_id) do
+           %User{} = followed <- User.get_cached_by_id(account_id) do
         Pleroma.List.unfollow(list, followed)
       end
     end)
diff --git a/lib/pleroma/web/oauth/authorization.ex b/lib/pleroma/web/oauth/authorization.ex
index b47688de1..18973413e 100644
--- a/lib/pleroma/web/oauth/authorization.ex
+++ b/lib/pleroma/web/oauth/authorization.ex
@@ -20,7 +20,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
     field(:scopes, {:array, :string}, default: [])
     field(:valid_until, :naive_datetime_usec)
     field(:used, :boolean, default: false)
-    belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId)
+    belongs_to(:user, User, type: Pleroma.FlakeId)
     belongs_to(:app, App)
 
     timestamps()
diff --git a/lib/pleroma/web/oauth/token.ex b/lib/pleroma/web/oauth/token.ex
index ef047d565..66c95c2e9 100644
--- a/lib/pleroma/web/oauth/token.ex
+++ b/lib/pleroma/web/oauth/token.ex
@@ -22,7 +22,7 @@ defmodule Pleroma.Web.OAuth.Token do
     field(:refresh_token, :string)
     field(:scopes, {:array, :string}, default: [])
     field(:valid_until, :naive_datetime_usec)
-    belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId)
+    belongs_to(:user, User, type: Pleroma.FlakeId)
     belongs_to(:app, App)
 
     timestamps()
diff --git a/lib/pleroma/web/web_finger/web_finger.ex b/lib/pleroma/web/web_finger/web_finger.ex
index 3a3b98a10..1239b962a 100644
--- a/lib/pleroma/web/web_finger/web_finger.ex
+++ b/lib/pleroma/web/web_finger/web_finger.ex
@@ -99,7 +99,7 @@ defmodule Pleroma.Web.WebFinger do
 
       info_cng =
         info
-        |> Pleroma.User.Info.set_keys(pem)
+        |> User.Info.set_keys(pem)
 
       cng =
         Ecto.Changeset.change(user)
diff --git a/test/formatter_test.exs b/test/formatter_test.exs
index 06f4f6e50..5e7011160 100644
--- a/test/formatter_test.exs
+++ b/test/formatter_test.exs
@@ -125,7 +125,7 @@ defmodule Pleroma.FormatterTest do
       archaeme =
         insert(:user, %{
           nickname: "archa_eme_",
-          info: %Pleroma.User.Info{source_data: %{"url" => "https://archeme/@archa_eme_"}}
+          info: %User.Info{source_data: %{"url" => "https://archeme/@archa_eme_"}}
         })
 
       archaeme_remote = insert(:user, %{nickname: "archaeme@archae.me"})
diff --git a/test/plugs/legacy_authentication_plug_test.exs b/test/plugs/legacy_authentication_plug_test.exs
index 8b0b06772..02f530058 100644
--- a/test/plugs/legacy_authentication_plug_test.exs
+++ b/test/plugs/legacy_authentication_plug_test.exs
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Plugs.LegacyAuthenticationPlugTest do
-  use Pleroma.Web.ConnCase, async: true
+  use Pleroma.Web.ConnCase
 
   alias Pleroma.Plugs.LegacyAuthenticationPlug
   alias Pleroma.User
diff --git a/test/repo_test.exs b/test/repo_test.exs
index 5382289c7..85085a1fa 100644
--- a/test/repo_test.exs
+++ b/test/repo_test.exs
@@ -1,23 +1,24 @@
 defmodule Pleroma.RepoTest do
   use Pleroma.DataCase
   import Pleroma.Factory
+  alias Pleroma.User
 
   describe "find_resource/1" do
     test "returns user" do
       user = insert(:user)
-      query = from(t in Pleroma.User, where: t.id == ^user.id)
+      query = from(t in User, where: t.id == ^user.id)
       assert Repo.find_resource(query) == {:ok, user}
     end
 
     test "returns not_found" do
-      query = from(t in Pleroma.User, where: t.id == ^"9gBuXNpD2NyDmmxxdw")
+      query = from(t in User, where: t.id == ^"9gBuXNpD2NyDmmxxdw")
       assert Repo.find_resource(query) == {:error, :not_found}
     end
   end
 
   describe "get_assoc/2" do
     test "get assoc from preloaded data" do
-      user = %Pleroma.User{name: "Agent Smith"}
+      user = %User{name: "Agent Smith"}
       token = %Pleroma.Web.OAuth.Token{insert(:oauth_token) | user: user}
       assert Repo.get_assoc(token, :user) == {:ok, user}
     end
diff --git a/test/support/factory.ex b/test/support/factory.ex
index 90c7d80f2..be6247ca4 100644
--- a/test/support/factory.ex
+++ b/test/support/factory.ex
@@ -4,6 +4,7 @@
 
 defmodule Pleroma.Factory do
   use ExMachina.Ecto, repo: Pleroma.Repo
+  alias Pleroma.User
 
   def participation_factory do
     conversation = insert(:conversation)
@@ -23,7 +24,7 @@ defmodule Pleroma.Factory do
   end
 
   def user_factory do
-    user = %Pleroma.User{
+    user = %User{
       name: sequence(:name, &"Test テスト User #{&1}"),
       email: sequence(:email, &"user#{&1}@example.com"),
       nickname: sequence(:nickname, &"nick#{&1}"),
@@ -34,9 +35,9 @@ defmodule Pleroma.Factory do
 
     %{
       user
-      | ap_id: Pleroma.User.ap_id(user),
-        follower_address: Pleroma.User.ap_followers(user),
-        following: [Pleroma.User.ap_id(user)]
+      | ap_id: User.ap_id(user),
+        follower_address: User.ap_followers(user),
+        following: [User.ap_id(user)]
     }
   end
 
diff --git a/test/user_test.exs b/test/user_test.exs
index 721b65693..10e463ff8 100644
--- a/test/user_test.exs
+++ b/test/user_test.exs
@@ -277,7 +277,7 @@ defmodule Pleroma.UserTest do
     end
 
     test "it restricts certain nicknames" do
-      [restricted_name | _] = Pleroma.Config.get([Pleroma.User, :restricted_nicknames])
+      [restricted_name | _] = Pleroma.Config.get([User, :restricted_nicknames])
 
       assert is_bitstring(restricted_name)
 
@@ -1223,11 +1223,11 @@ defmodule Pleroma.UserTest do
     follower2 = insert(:user)
     follower3 = insert(:user)
 
-    {:ok, follower} = Pleroma.User.follow(follower, user)
-    {:ok, _follower2} = Pleroma.User.follow(follower2, user)
-    {:ok, _follower3} = Pleroma.User.follow(follower3, user)
+    {:ok, follower} = User.follow(follower, user)
+    {:ok, _follower2} = User.follow(follower2, user)
+    {:ok, _follower3} = User.follow(follower3, user)
 
-    {:ok, _} = Pleroma.User.block(user, follower)
+    {:ok, _} = User.block(user, follower)
 
     user_show = Pleroma.Web.TwitterAPI.UserView.render("show.json", %{user: user})
 
diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs
index 90d67a55f..cbff141c8 100644
--- a/test/web/mastodon_api/mastodon_api_controller_test.exs
+++ b/test/web/mastodon_api/mastodon_api_controller_test.exs
@@ -446,7 +446,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
   end
 
   test "verify_credentials default scope unlisted", %{conn: conn} do
-    user = insert(:user, %{info: %Pleroma.User.Info{default_scope: "unlisted"}})
+    user = insert(:user, %{info: %User.Info{default_scope: "unlisted"}})
 
     conn =
       conn
@@ -1322,7 +1322,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
 
   describe "locked accounts" do
     test "/api/v1/follow_requests works" do
-      user = insert(:user, %{info: %Pleroma.User.Info{locked: true}})
+      user = insert(:user, %{info: %User.Info{locked: true}})
       other_user = insert(:user)
 
       {:ok, _activity} = ActivityPub.follow(other_user, user)
@@ -1367,7 +1367,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
     end
 
     test "verify_credentials", %{conn: conn} do
-      user = insert(:user, %{info: %Pleroma.User.Info{default_scope: "private"}})
+      user = insert(:user, %{info: %User.Info{default_scope: "private"}})
 
       conn =
         conn
@@ -1379,7 +1379,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
     end
 
     test "/api/v1/follow_requests/:id/reject works" do
-      user = insert(:user, %{info: %Pleroma.User.Info{locked: true}})
+      user = insert(:user, %{info: %User.Info{locked: true}})
       other_user = insert(:user)
 
       {:ok, _activity} = ActivityPub.follow(other_user, user)
diff --git a/test/web/ostatus/ostatus_test.exs b/test/web/ostatus/ostatus_test.exs
index 2916caf8d..3516a13fa 100644
--- a/test/web/ostatus/ostatus_test.exs
+++ b/test/web/ostatus/ostatus_test.exs
@@ -355,7 +355,7 @@ defmodule Pleroma.Web.OStatusTest do
 
       {:ok, user} = OStatus.find_or_make_user(uri)
 
-      user = Pleroma.User.get_cached_by_id(user.id)
+      user = User.get_cached_by_id(user.id)
       assert user.name == "Constance Variable"
       assert user.nickname == "lambadalambda@social.heldscal.la"
       assert user.local == false
@@ -374,7 +374,7 @@ defmodule Pleroma.Web.OStatusTest do
       {:ok, user} = OStatus.find_or_make_user(uri)
 
       assert user.info ==
-               %Pleroma.User.Info{
+               %User.Info{
                  id: user.info.id,
                  ap_enabled: false,
                  background: %{},
-- 
cgit v1.2.3


From 718b59a2631af6245570a073e3c5b2464b810a27 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Fri, 17 May 2019 11:19:30 +0200
Subject: Dependencies: Update ecto sql once more.

---
 mix.exs  | 2 +-
 mix.lock | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mix.exs b/mix.exs
index 2535fcf98..2888b69e2 100644
--- a/mix.exs
+++ b/mix.exs
@@ -67,7 +67,7 @@ defmodule Pleroma.Mixfile do
       {:phoenix_ecto, "~> 4.0"},
       {:ecto_sql,
        git: "https://github.com/elixir-ecto/ecto_sql",
-       ref: "e839a9a327b632d73533ac8105ba360bc831cf83",
+       ref: "14cb065a74c488d737d973f7a91bc036c6245f78",
        override: true},
       {:postgrex, ">= 0.13.5"},
       {:gettext, "~> 0.15"},
diff --git a/mix.lock b/mix.lock
index 5ee5634d3..714a8a2b1 100644
--- a/mix.lock
+++ b/mix.lock
@@ -21,7 +21,7 @@
   "deep_merge": {:hex, :deep_merge, "1.0.0", "b4aa1a0d1acac393bdf38b2291af38cb1d4a52806cf7a4906f718e1feb5ee961", [:mix], [], "hexpm"},
   "earmark": {:hex, :earmark, "1.3.2", "b840562ea3d67795ffbb5bd88940b1bed0ed9fa32834915125ea7d02e35888a5", [:mix], [], "hexpm"},
   "ecto": {:hex, :ecto, "3.1.4", "69d852da7a9f04ede725855a35ede48d158ca11a404fe94f8b2fb3b2162cd3c9", [:mix], [{:decimal, "~> 1.6", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm"},
-  "ecto_sql": {:git, "https://github.com/elixir-ecto/ecto_sql", "e839a9a327b632d73533ac8105ba360bc831cf83", [ref: "e839a9a327b632d73533ac8105ba360bc831cf83"]},
+  "ecto_sql": {:git, "https://github.com/elixir-ecto/ecto_sql", "14cb065a74c488d737d973f7a91bc036c6245f78", [ref: "14cb065a74c488d737d973f7a91bc036c6245f78"]},
   "esshd": {:hex, :esshd, "0.1.0", "6f93a2062adb43637edad0ea7357db2702a4b80dd9683482fe00f5134e97f4c1", [:mix], [], "hexpm"},
   "eternal": {:hex, :eternal, "1.2.0", "e2a6b6ce3b8c248f7dc31451aefca57e3bdf0e48d73ae5043229380a67614c41", [:mix], [], "hexpm"},
   "ex2ms": {:hex, :ex2ms, "1.5.0", "19e27f9212be9a96093fed8cdfbef0a2b56c21237196d26760f11dfcfae58e97", [:mix], [], "hexpm"},
-- 
cgit v1.2.3


From e39c190f046bb345e80a2195278bb59ac81b8002 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Fri, 17 May 2019 11:30:35 +0200
Subject: Configuration: disable migration lock.

---
 config/config.exs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/config.exs b/config/config.exs
index 3d11c3a87..92d3e0dcd 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -48,7 +48,8 @@ config :pleroma, ecto_repos: [Pleroma.Repo]
 
 config :pleroma, Pleroma.Repo,
   types: Pleroma.PostgresTypes,
-  telemetry_event: [Pleroma.Repo.Instrumenter]
+  telemetry_event: [Pleroma.Repo.Instrumenter],
+  migration_lock: nil
 
 config :pleroma, Pleroma.Captcha,
   enabled: false,
-- 
cgit v1.2.3


From 249b31ffe53115ad187235890c405138ba190e14 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Fri, 17 May 2019 11:49:13 +0200
Subject: Fix specs.

---
 lib/pleroma/user.ex               | 1 -
 test/web/ostatus/ostatus_test.exs | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index 9607c1f03..28da310ee 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -1144,7 +1144,6 @@ defmodule Pleroma.User do
     stream =
       ap_id
       |> Activity.query_by_actor()
-      |> Activity.with_preloaded_object()
       |> Repo.stream()
 
     Repo.transaction(fn -> Enum.each(stream, &delete_activity(&1)) end, timeout: :infinity)
diff --git a/test/web/ostatus/ostatus_test.exs b/test/web/ostatus/ostatus_test.exs
index 3516a13fa..f6be16862 100644
--- a/test/web/ostatus/ostatus_test.exs
+++ b/test/web/ostatus/ostatus_test.exs
@@ -407,7 +407,7 @@ defmodule Pleroma.Web.OStatusTest do
       {:ok, user} = OStatus.find_or_make_user(uri)
       old_name = user.name
       old_bio = user.bio
-      change = Ecto.Changeset.change(user, %{avatar: nil, bio: nil, old_name: nil})
+      change = Ecto.Changeset.change(user, %{avatar: nil, bio: nil, name: nil})
 
       {:ok, user} = Repo.update(change)
       refute user.avatar
-- 
cgit v1.2.3


From 5743124c7727af3fbcd8243f1f8e71de91c9b470 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Fri, 17 May 2019 11:51:50 +0200
Subject: Dependencies: Update tzdata.

This fixes the bug that tz data could not be loaded. Closes #910.
---
 mix.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mix.lock b/mix.lock
index cd2d2370a..1dc19532d 100644
--- a/mix.lock
+++ b/mix.lock
@@ -83,7 +83,7 @@
   "tesla": {:hex, :tesla, "1.2.1", "864783cc27f71dd8c8969163704752476cec0f3a51eb3b06393b3971dc9733ff", [:mix], [{:exjsx, ">= 3.0.0", [hex: :exjsx, repo: "hexpm", optional: true]}, {:fuse, "~> 2.4", [hex: :fuse, repo: "hexpm", optional: true]}, {:hackney, "~> 1.6", [hex: :hackney, repo: "hexpm", optional: true]}, {:ibrowse, "~> 4.4.0", [hex: :ibrowse, repo: "hexpm", optional: true]}, {:jason, ">= 1.0.0", [hex: :jason, repo: "hexpm", optional: true]}, {:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:poison, ">= 1.0.0", [hex: :poison, repo: "hexpm", optional: true]}], "hexpm"},
   "timex": {:hex, :timex, "3.5.0", "b0a23167da02d0fe4f1a4e104d1f929a00d348502b52432c05de875d0b9cffa5", [:mix], [{:combine, "~> 0.10", [hex: :combine, repo: "hexpm", optional: false]}, {:gettext, "~> 0.10", [hex: :gettext, repo: "hexpm", optional: false]}, {:tzdata, "~> 0.1.8 or ~> 0.5", [hex: :tzdata, repo: "hexpm", optional: false]}], "hexpm"},
   "trailing_format_plug": {:hex, :trailing_format_plug, "0.0.7", "64b877f912cf7273bed03379936df39894149e35137ac9509117e59866e10e45", [:mix], [{:plug, "> 0.12.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
-  "tzdata": {:hex, :tzdata, "0.5.17", "50793e3d85af49736701da1a040c415c97dc1caf6464112fd9bd18f425d3053b", [:mix], [{:hackney, "~> 1.0", [hex: :hackney, repo: "hexpm", optional: false]}], "hexpm"},
+  "tzdata": {:hex, :tzdata, "0.5.20", "304b9e98a02840fb32a43ec111ffbe517863c8566eb04a061f1c4dbb90b4d84c", [:mix], [{:hackney, "~> 1.0", [hex: :hackney, repo: "hexpm", optional: false]}], "hexpm"},
   "ueberauth": {:hex, :ueberauth, "0.6.1", "9e90d3337dddf38b1ca2753aca9b1e53d8a52b890191cdc55240247c89230412", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
   "unicode_util_compat": {:hex, :unicode_util_compat, "0.4.1", "d869e4c68901dd9531385bb0c8c40444ebf624e60b6962d95952775cac5e90cd", [:rebar3], [], "hexpm"},
   "unsafe": {:hex, :unsafe, "1.0.0", "7c21742cd05380c7875546b023481d3a26f52df8e5dfedcb9f958f322baae305", [:mix], [], "hexpm"},
-- 
cgit v1.2.3


From 46684db84d0583cb5d88f8fcbd6b970ef95c84de Mon Sep 17 00:00:00 2001
From: lambda <lain@soykaf.club>
Date: Fri, 17 May 2019 09:53:44 +0000
Subject: Update account_view.ex

---
 lib/pleroma/web/mastodon_api/views/account_view.ex | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/pleroma/web/mastodon_api/views/account_view.ex b/lib/pleroma/web/mastodon_api/views/account_view.ex
index 606a0f2ed..134c07b7e 100644
--- a/lib/pleroma/web/mastodon_api/views/account_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/account_view.ex
@@ -40,7 +40,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
     follow_activity = Pleroma.Web.ActivityPub.Utils.fetch_latest_follow(user, target)
 
     requested =
-      if follow_activity and !User.following?(target, user) do
+      if follow_activity && !User.following?(target, user) do
         follow_activity.data["state"] == "pending"
       else
         false
-- 
cgit v1.2.3


From a3fc7294da43a7e2d17626200e8d3bf5c05808d3 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Fri, 17 May 2019 12:47:38 +0200
Subject: CI: Add rum variant testing.

---
 .gitlab-ci.yml | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f9745122a..3ea275127 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -15,6 +15,7 @@ cache:
 stages:
   - build
   - test
+  - test-rum
   - deploy
 
 before_script:
@@ -45,7 +46,7 @@ docs-build:
 unit-testing:
   stage: test
   services:
-  - name: postgres:9.6.2
+  - name: lainsoykaf/postgres-with-rum
     command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
   script:
     - mix deps.get
@@ -54,6 +55,20 @@ unit-testing:
     - mix test --trace --preload-modules
     - mix coveralls
 
+unit-testing-rum:
+  stage: test-rum
+  services:
+  - name: lainsoykaf/postgres-with-rum
+    command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+  script:
+    - "echo 'config :pleroma, :database, rum_enabled: true' >> config/test.exs"
+    - mix deps.get
+    - mix ecto.create
+    - mix ecto.migrate
+    - "mix ecto.migrate --migrations-path priv/repo/optional_migrations/rum_indexing/"
+    - mix test --trace --preload-modules
+    - mix coveralls
+
 lint:
   stage: test
   script:
@@ -65,7 +80,6 @@ analysis:
     - mix deps.get
     - mix credo --strict --only=warnings,todo,fixme,consistency,readability
 
-
 docs-deploy:
   stage: deploy
   image: alpine:3.9
-- 
cgit v1.2.3


From 022e6e4b44229be70f0ec6720a66610a0e2a403a Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Fri, 17 May 2019 14:59:01 +0200
Subject: RUM: Remove vacuum analyze from migration

Can't be run in a trnasaction.
---
 .../rum_indexing/20190510135645_add_fts_index_to_objects_two.exs        | 2 --
 1 file changed, 2 deletions(-)

diff --git a/priv/repo/optional_migrations/rum_indexing/20190510135645_add_fts_index_to_objects_two.exs b/priv/repo/optional_migrations/rum_indexing/20190510135645_add_fts_index_to_objects_two.exs
index 09e6cbfb1..b6a24441a 100644
--- a/priv/repo/optional_migrations/rum_indexing/20190510135645_add_fts_index_to_objects_two.exs
+++ b/priv/repo/optional_migrations/rum_indexing/20190510135645_add_fts_index_to_objects_two.exs
@@ -20,7 +20,6 @@ defmodule Pleroma.Repo.Migrations.AddFtsIndexToObjectsTwo do
     FOR EACH ROW EXECUTE PROCEDURE objects_fts_update()")
 
     execute("UPDATE objects SET updated_at = NOW()")
-    execute("vacuum analyze")
   end
 
   def down do
@@ -31,6 +30,5 @@ defmodule Pleroma.Repo.Migrations.AddFtsIndexToObjectsTwo do
       remove(:fts_content, :tsvector)
     end
     create index(:objects, ["(to_tsvector('english', data->>'content'))"], using: :gin, name: :objects_fts)
-    execute("vacuum analyze")
   end
 end
-- 
cgit v1.2.3


From 8784a7d1b40394cb1b4d5ce2d04b8cd057a57ceb Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Fri, 17 May 2019 15:06:51 +0200
Subject: RUM: Set rum status by the environment.

---
 config/test.exs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/config/test.exs b/config/test.exs
index 40db66170..e1785d10f 100644
--- a/config/test.exs
+++ b/config/test.exs
@@ -63,6 +63,10 @@ config :pleroma, :app_account_creation, max_requests: 5
 
 config :pleroma, :http_security, report_uri: "https://endpoint.com"
 
+rum_enabled = System.get_env("RUM_ENABLED") == "true"
+config :pleroma, :database, rum_enabled: rum_enabled
+IO.puts("RUM enabled: #{rum_enabled}")
+
 try do
   import_config "test.secret.exs"
 rescue
-- 
cgit v1.2.3


From ef63cf70883f4c7e3814ebac907f000da835ea10 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Fri, 17 May 2019 15:21:29 +0200
Subject: CI: Use the correct image with the correct hostname.

---
 .gitlab-ci.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3ea275127..8b5131dc3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -15,7 +15,6 @@ cache:
 stages:
   - build
   - test
-  - test-rum
   - deploy
 
 before_script:
@@ -47,6 +46,7 @@ unit-testing:
   stage: test
   services:
   - name: lainsoykaf/postgres-with-rum
+    alias: postgres
     command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
   script:
     - mix deps.get
@@ -56,18 +56,19 @@ unit-testing:
     - mix coveralls
 
 unit-testing-rum:
-  stage: test-rum
+  stage: test
   services:
   - name: lainsoykaf/postgres-with-rum
+    alias: postgres
     command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
+  variables:
+    RUM_ENABLED: "true"
   script:
-    - "echo 'config :pleroma, :database, rum_enabled: true' >> config/test.exs"
     - mix deps.get
     - mix ecto.create
     - mix ecto.migrate
     - "mix ecto.migrate --migrations-path priv/repo/optional_migrations/rum_indexing/"
     - mix test --trace --preload-modules
-    - mix coveralls
 
 lint:
   stage: test
-- 
cgit v1.2.3


From 78588dbd80580fbef53819dd87ee8fcc26cb09e9 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 17 May 2019 18:49:10 +0000
Subject: mrf: simple policy: mark all posts instead of posts with media as
 sensitive if they match media_nsfw

---
 lib/pleroma/web/activity_pub/mrf/simple_policy.ex | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lib/pleroma/web/activity_pub/mrf/simple_policy.ex b/lib/pleroma/web/activity_pub/mrf/simple_policy.ex
index 50426e920..9627c3400 100644
--- a/lib/pleroma/web/activity_pub/mrf/simple_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/simple_policy.ex
@@ -48,10 +48,9 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do
          %{host: actor_host} = _actor_info,
          %{
            "type" => "Create",
-           "object" => %{"attachment" => child_attachment} = child_object
+           "object" => child_object
          } = object
-       )
-       when length(child_attachment) > 0 do
+       ) do
     object =
       if Enum.member?(Pleroma.Config.get([:mrf_simple, :media_nsfw]), actor_host) do
         tags = (child_object["tag"] || []) ++ ["nsfw"]
-- 
cgit v1.2.3


From 0da1233e8e093ff7c69994f9e81d58611be60507 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 17 May 2019 18:49:43 +0000
Subject: rich media: suppress link previews if post is marked as sensitive

---
 lib/pleroma/web/rich_media/helpers.ex |  1 +
 test/web/rich_media/helpers_test.exs  | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/lib/pleroma/web/rich_media/helpers.ex b/lib/pleroma/web/rich_media/helpers.ex
index 0162a5be9..9bc8f2559 100644
--- a/lib/pleroma/web/rich_media/helpers.ex
+++ b/lib/pleroma/web/rich_media/helpers.ex
@@ -24,6 +24,7 @@ defmodule Pleroma.Web.RichMedia.Helpers do
   def fetch_data_for_activity(%Activity{data: %{"type" => "Create"}} = activity) do
     with true <- Pleroma.Config.get([:rich_media, :enabled]),
          %Object{} = object <- Object.normalize(activity),
+         false <- object.data["sensitive"] || false,
          {:ok, page_url} <- HTML.extract_first_external_url(object, object.data["content"]),
          :ok <- validate_page_url(page_url),
          {:ok, rich_media} <- Parser.parse(page_url) do
diff --git a/test/web/rich_media/helpers_test.exs b/test/web/rich_media/helpers_test.exs
index 60d93768f..6e23392ca 100644
--- a/test/web/rich_media/helpers_test.exs
+++ b/test/web/rich_media/helpers_test.exs
@@ -1,6 +1,7 @@
 defmodule Pleroma.Web.RichMedia.HelpersTest do
   use Pleroma.DataCase
 
+  alias Pleroma.Object
   alias Pleroma.Web.CommonAPI
 
   import Pleroma.Factory
@@ -59,4 +60,24 @@ defmodule Pleroma.Web.RichMedia.HelpersTest do
 
     Pleroma.Config.put([:rich_media, :enabled], false)
   end
+
+  test "refuses to crawl URLs from posts marked sensitive" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        "status" => "http://example.com/ogp",
+        "spoiler_text" => "."
+      })
+
+    %Object{} = object = Object.normalize(activity)
+
+    assert object.data["sensitive"]
+
+    Pleroma.Config.put([:rich_media, :enabled], true)
+
+    assert %{} = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
+
+    Pleroma.Config.put([:rich_media, :enabled], false)
+  end
 end
-- 
cgit v1.2.3


From d3b8cd342ff6d1fe87bcfe6305424faf49666252 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 17 May 2019 19:03:19 +0000
Subject: http: request builder: send user-agent when making requests

---
 lib/pleroma/http/request_builder.ex | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/pleroma/http/request_builder.ex b/lib/pleroma/http/request_builder.ex
index 5f2cff2c0..522728da1 100644
--- a/lib/pleroma/http/request_builder.ex
+++ b/lib/pleroma/http/request_builder.ex
@@ -45,8 +45,9 @@ defmodule Pleroma.HTTP.RequestBuilder do
   Add headers to the request
   """
   @spec headers(map(), list(tuple)) :: map()
-  def headers(request, h) do
-    Map.put_new(request, :headers, h)
+  def headers(request, header_list) do
+    header_list = header_list ++ [{"User-Agent", Pleroma.Application.user_agent()}]
+    Map.put_new(request, :headers, header_list)
   end
 
   @doc """
-- 
cgit v1.2.3


From 290f5b2cfe91dd2acba56f79ef137f15c68a0db0 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 17 May 2019 20:28:58 +0000
Subject: config: make sending the user agent configurable, disable sending the
 user agent in tests

---
 config/config.exs                   | 1 +
 config/test.exs                     | 2 ++
 lib/pleroma/http/request_builder.ex | 8 +++++++-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/config/config.exs b/config/config.exs
index e82f08e07..9a10b0ff7 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -192,6 +192,7 @@ config :tesla, adapter: Tesla.Adapter.Hackney
 # Configures http settings, upstream proxy etc.
 config :pleroma, :http,
   proxy_url: nil,
+  send_user_agent: true,
   adapter: [
     ssl_options: [
       # We don't support TLS v1.3 yet
diff --git a/config/test.exs b/config/test.exs
index e1785d10f..6100989c4 100644
--- a/config/test.exs
+++ b/config/test.exs
@@ -63,6 +63,8 @@ config :pleroma, :app_account_creation, max_requests: 5
 
 config :pleroma, :http_security, report_uri: "https://endpoint.com"
 
+config :pleroma, :http, send_user_agent: false
+
 rum_enabled = System.get_env("RUM_ENABLED") == "true"
 config :pleroma, :database, rum_enabled: rum_enabled
 IO.puts("RUM enabled: #{rum_enabled}")
diff --git a/lib/pleroma/http/request_builder.ex b/lib/pleroma/http/request_builder.ex
index 522728da1..e23457999 100644
--- a/lib/pleroma/http/request_builder.ex
+++ b/lib/pleroma/http/request_builder.ex
@@ -46,7 +46,13 @@ defmodule Pleroma.HTTP.RequestBuilder do
   """
   @spec headers(map(), list(tuple)) :: map()
   def headers(request, header_list) do
-    header_list = header_list ++ [{"User-Agent", Pleroma.Application.user_agent()}]
+    header_list =
+      if Pleroma.Config.get([:http, :send_user_agent]) do
+        header_list ++ [{"User-Agent", Pleroma.Application.user_agent()}]
+      else
+        header_list
+      end
+
     Map.put_new(request, :headers, header_list)
   end
 
-- 
cgit v1.2.3


From c234ce546a769747f436c19fee99bed2a7a58f3b Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 17 May 2019 20:31:39 +0000
Subject: add CHANGELOG entry

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 12c439135..5de9ae292 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -102,6 +102,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Mastodon API: Correct `reblogged`, `favourited`, and `bookmarked` values in the reblog status JSON
 - Mastodon API: Exposing default scope of the user to anyone
 - Mastodon API: Make `irreversible` field default to `false` [`POST /api/v1/filters`]
+- User-Agent is now sent correctly for all HTTP requests.
 
 ## Removed
 - Configuration: `config :pleroma, :fe` in favor of the more flexible `config :pleroma, :frontend_configurations`
-- 
cgit v1.2.3


From dc081595385084fe6b382e4b38c17cb51cf0a611 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 17 May 2019 20:42:51 +0000
Subject: also suppress link previews from posts marked #nsfw

---
 lib/pleroma/web/common_api/common_api.ex |  4 +++-
 lib/pleroma/web/common_api/utils.ex      |  4 +++-
 test/web/rich_media/helpers_test.exs     | 21 ++++++++++++++++++++-
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/lib/pleroma/web/common_api/common_api.ex b/lib/pleroma/web/common_api/common_api.ex
index a599ffee5..5a312d673 100644
--- a/lib/pleroma/web/common_api/common_api.ex
+++ b/lib/pleroma/web/common_api/common_api.ex
@@ -157,6 +157,7 @@ defmodule Pleroma.Web.CommonAPI do
          {to, cc} <- to_for_user_and_mentions(user, mentions, in_reply_to, visibility),
          context <- make_context(in_reply_to),
          cw <- data["spoiler_text"] || "",
+         sensitive <- data["sensitive"] || Enum.member?(tags, {"#nsfw", "nsfw"}),
          full_payload <- String.trim(status <> cw),
          length when length in 1..limit <- String.length(full_payload),
          object <-
@@ -169,7 +170,8 @@ defmodule Pleroma.Web.CommonAPI do
              in_reply_to,
              tags,
              cw,
-             cc
+             cc,
+             sensitive
            ),
          object <-
            Map.put(
diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index bee2fd159..8d6160976 100644
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -223,7 +223,8 @@ defmodule Pleroma.Web.CommonAPI.Utils do
         in_reply_to,
         tags,
         cw \\ nil,
-        cc \\ []
+        cc \\ [],
+        sensitive \\ false
       ) do
     object = %{
       "type" => "Note",
@@ -231,6 +232,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
       "cc" => cc,
       "content" => content_html,
       "summary" => cw,
+      "sensitive" => sensitive,
       "context" => context,
       "attachment" => attachments,
       "actor" => actor,
diff --git a/test/web/rich_media/helpers_test.exs b/test/web/rich_media/helpers_test.exs
index 6e23392ca..53b0596f5 100644
--- a/test/web/rich_media/helpers_test.exs
+++ b/test/web/rich_media/helpers_test.exs
@@ -67,7 +67,26 @@ defmodule Pleroma.Web.RichMedia.HelpersTest do
     {:ok, activity} =
       CommonAPI.post(user, %{
         "status" => "http://example.com/ogp",
-        "spoiler_text" => "."
+        "sensitive" => true
+      })
+
+    %Object{} = object = Object.normalize(activity)
+
+    assert object.data["sensitive"]
+
+    Pleroma.Config.put([:rich_media, :enabled], true)
+
+    assert %{} = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
+
+    Pleroma.Config.put([:rich_media, :enabled], false)
+  end
+
+  test "refuses to crawl URLs from posts tagged NSFW" do
+    user = insert(:user)
+
+    {:ok, activity} =
+      CommonAPI.post(user, %{
+        "status" => "http://example.com/ogp #nsfw"
       })
 
     %Object{} = object = Object.normalize(activity)
-- 
cgit v1.2.3


From c4a55e167afcfd25cf4c1efb46886f2defe72c22 Mon Sep 17 00:00:00 2001
From: William Pitcock <nenolod@dereferenced.org>
Date: Fri, 17 May 2019 20:43:31 +0000
Subject: add Changelog entry

---
 CHANGELOG.md                        | 1 +
 lib/pleroma/web/common_api/utils.ex | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 12c439135..a73bf47d2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -71,6 +71,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Deps: Updated Ecto to 3.0.7
 - Don't ship finmoji by default, they can be installed as an emoji pack
 - Hide deactivated users and their statuses
+- Posts which are marked sensitive or tagged nsfw no longer have link previews.
 
 ### Fixed
 - Added an FTS index on objects. Running `vacuum analyze` and setting a larger `work_mem` is recommended.
diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex
index 8d6160976..d93c0d46e 100644
--- a/lib/pleroma/web/common_api/utils.ex
+++ b/lib/pleroma/web/common_api/utils.ex
@@ -232,7 +232,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
       "cc" => cc,
       "content" => content_html,
       "summary" => cw,
-      "sensitive" => sensitive,
+      "sensitive" => !Enum.member?(["false", "False", "0", false], sensitive),
       "context" => context,
       "attachment" => attachments,
       "actor" => actor,
-- 
cgit v1.2.3