Merge remote-tracking branch 'origin/develop' into instance_rules

Signed-off-by: marcin mikołajczak <git@mkljczk.pl>

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -74,22 +74,22 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
   defp check_remote_limit(_), do: true
 
   def increase_note_count_if_public(actor, object) do
-    if is_public?(object), do: User.increase_note_count(actor), else: {:ok, actor}
+    if public?(object), do: User.increase_note_count(actor), else: {:ok, actor}
   end
 
   def decrease_note_count_if_public(actor, object) do
-    if is_public?(object), do: User.decrease_note_count(actor), else: {:ok, actor}
+    if public?(object), do: User.decrease_note_count(actor), else: {:ok, actor}
   end
 
   def update_last_status_at_if_public(actor, object) do
-    if is_public?(object), do: User.update_last_status_at(actor), else: {:ok, actor}
+    if public?(object), do: User.update_last_status_at(actor), else: {:ok, actor}
   end
 
   defp increase_replies_count_if_reply(%{
          "object" => %{"inReplyTo" => reply_ap_id} = object,
          "type" => "Create"
        }) do
-    if is_public?(object) do
+    if public?(object) do
       Object.increase_replies_count(reply_ap_id)
     end
   end
@@ -100,7 +100,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
          "object" => %{"quoteUrl" => quote_ap_id} = object,
          "type" => "Create"
        }) do
-    if is_public?(object) do
+    if public?(object) do
       Object.increase_quotes_count(quote_ap_id)
     end
   end
@@ -319,6 +319,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
          {:ok, _actor} <- update_last_status_at_if_public(actor, activity),
          _ <- notify_and_stream(activity),
          :ok <- maybe_schedule_poll_notifications(activity),
+         :ok <- maybe_handle_group_posts(activity),
          :ok <- maybe_federate(activity) do
       {:ok, activity}
     else
@@ -498,7 +499,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
   end
 
   @spec fetch_latest_direct_activity_id_for_context(String.t(), keyword() | map()) ::
-          FlakeId.Ecto.CompatType.t() | nil
+          Ecto.UUID.t() | nil
   def fetch_latest_direct_activity_id_for_context(context, opts \\ %{}) do
     context
     |> fetch_activities_for_context_query(Map.merge(%{skip_preload: true}, opts))
@@ -1707,9 +1708,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
            Fetcher.fetch_and_contain_remote_object_from_id(first) do
       {:ok, false}
     else
-      {:error, {:ok, %{status: code}}} when code in [401, 403] -> {:ok, true}
-      {:error, _} = e -> e
-      e -> {:error, e}
+      {:error, _} -> {:ok, true}
     end
   end
 

lib/pleroma/web/activity_pub/builder.ex

@@ -9,6 +9,7 @@ defmodule Pleroma.Web.ActivityPub.Builder do
   This module encodes our addressing policies and general shape of our objects.
   """
 
+  alias Pleroma.Activity
   alias Pleroma.Emoji
   alias Pleroma.Object
   alias Pleroma.User
@@ -131,7 +132,7 @@ defmodule Pleroma.Web.ActivityPub.Builder do
   def emoji_react(actor, object, emoji) do
     with {:ok, data, meta} <- object_action(actor, object) do
       data =
-        if Emoji.is_unicode_emoji?(emoji) do
+        if Emoji.unicode?(emoji) do
           unicode_emoji_react(object, data, emoji)
         else
           custom_emoji_react(object, data, emoji)
@@ -347,7 +348,7 @@ defmodule Pleroma.Web.ActivityPub.Builder do
         actor.ap_id == Relay.ap_id() ->
           [actor.follower_address]
 
-        public? and Visibility.is_local_public?(object) ->
+        public? and Visibility.local_public?(object) ->
           [actor.follower_address, object.data["actor"], Utils.as_local_public()]
 
         public? ->
@@ -375,7 +376,7 @@ defmodule Pleroma.Web.ActivityPub.Builder do
 
     # Address the actor of the object, and our actor's follower collection if the post is public.
     to =
-      if Visibility.is_public?(object) do
+      if Visibility.public?(object) do
         [actor.follower_address, object.data["actor"]]
       else
         [object.data["actor"]]

lib/pleroma/web/activity_pub/mrf.ex

@@ -1,5 +1,5 @@
 # Pleroma: A lightweight social networking server
-# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# Copyright © 2017-2023 Pleroma Authors <https://pleroma.social/>
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Web.ActivityPub.MRF do
@@ -139,7 +139,16 @@ defmodule Pleroma.Web.ActivityPub.MRF do
 
   @spec subdomains_regex([String.t()]) :: [Regex.t()]
   def subdomains_regex(domains) when is_list(domains) do
-    for domain <- domains, do: ~r(^#{String.replace(domain, "*.", "(.*\\.)*")}$)i
+    for domain <- domains do
+      try do
+        target = String.replace(domain, "*.", "(.*\\.)*")
+        ~r<^#{target}$>i
+      rescue
+        e ->
+          Logger.error("MRF: Invalid subdomain Regex: #{domain}")
+          reraise e, __STACKTRACE__
+      end
+    end
   end
 
   @spec subdomain_match?([Regex.t()], String.t()) :: boolean()

lib/pleroma/web/activity_pub/mrf/anti_followbot_policy.ex

@@ -56,8 +56,6 @@ defmodule Pleroma.Web.ActivityPub.MRF.AntiFollowbotPolicy do
     nick_score + name_score + actor_type_score
   end
 
-  defp determine_if_followbot(_), do: 0.0
-
   defp bot_allowed?(%{"object" => target}, bot_actor) do
     %User{} = user = normalize_by_ap_id(target)
 

lib/pleroma/web/activity_pub/mrf/force_mention.ex

@@ -0,0 +1,59 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2024 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.ForceMention do
+  require Pleroma.Constants
+
+  alias Pleroma.Config
+  alias Pleroma.Object
+  alias Pleroma.User
+
+  @behaviour Pleroma.Web.ActivityPub.MRF.Policy
+
+  defp get_author(url) do
+    with %Object{data: %{"actor" => actor}} <- Object.normalize(url, fetch: false),
+         %User{ap_id: ap_id, nickname: nickname} <- User.get_cached_by_ap_id(actor) do
+      %{"type" => "Mention", "href" => ap_id, "name" => "@#{nickname}"}
+    else
+      _ -> nil
+    end
+  end
+
+  defp prepend_author(tags, _, false), do: tags
+
+  defp prepend_author(tags, nil, _), do: tags
+
+  defp prepend_author(tags, url, _) do
+    actor = get_author(url)
+
+    if not is_nil(actor) do
+      [actor | tags]
+    else
+      tags
+    end
+  end
+
+  @impl true
+  def filter(%{"type" => "Create", "object" => %{"tag" => tag} = object} = activity) do
+    tag =
+      tag
+      |> prepend_author(
+        object["inReplyTo"],
+        Config.get([:mrf_force_mention, :mention_parent, true])
+      )
+      |> prepend_author(
+        object["quoteUrl"],
+        Config.get([:mrf_force_mention, :mention_quoted, true])
+      )
+      |> Enum.uniq()
+
+    {:ok, put_in(activity["object"]["tag"], tag)}
+  end
+
+  @impl true
+  def filter(object), do: {:ok, object}
+
+  @impl true
+  def describe, do: {:ok, %{}}
+end

lib/pleroma/web/activity_pub/mrf/hashtag_policy.ex

@@ -9,7 +9,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.HashtagPolicy do
   alias Pleroma.Object
 
   @moduledoc """
-  Reject, TWKN-remove or Set-Sensitive messsages with specific hashtags (without the leading #)
+  Reject, TWKN-remove or Set-Sensitive messages with specific hashtags (without the leading #)
 
   Note: This MRF Policy is always enabled, if you want to disable it you have to set empty lists.
   """
@@ -84,7 +84,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.HashtagPolicy do
     if hashtags != [] do
       with {:ok, message} <- check_reject(message, hashtags),
            {:ok, message} <-
-             (if "type" == "Create" do
+             (if type == "Create" do
                 check_ftl_removal(message, hashtags)
               else
                 {:ok, message}

lib/pleroma/web/activity_pub/mrf/inline_quote_policy.ex

@@ -62,7 +62,6 @@ defmodule Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy do
       key: :mrf_inline_quote,
       related_policy: "Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy",
       label: "MRF Inline Quote Policy",
-      type: :group,
       description: "Force quote url to appear in post content.",
       children: [
         %{

lib/pleroma/web/activity_pub/mrf/keyword_policy.ex

@@ -10,15 +10,12 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do
   @moduledoc "Reject or Word-Replace messages with a keyword or regex"
 
   @behaviour Pleroma.Web.ActivityPub.MRF.Policy
-  defp string_matches?(string, _) when not is_binary(string) do
-    false
-  end
 
   defp string_matches?(string, pattern) when is_binary(pattern) do
     String.contains?(string, pattern)
   end
 
-  defp string_matches?(string, pattern) do
+  defp string_matches?(string, %Regex{} = pattern) do
     String.match?(string, pattern)
   end
 

lib/pleroma/web/activity_pub/mrf/no_empty_policy.ex

@@ -10,9 +10,9 @@ defmodule Pleroma.Web.ActivityPub.MRF.NoEmptyPolicy do
 
   @impl true
   def filter(%{"actor" => actor} = object) do
-    with true <- is_local?(actor),
-         true <- is_eligible_type?(object),
-         true <- is_note?(object),
+    with true <- local?(actor),
+         true <- eligible_type?(object),
+         true <- note?(object),
          false <- has_attachment?(object),
          true <- only_mentions?(object) do
       {:reject, "[NoEmptyPolicy]"}
@@ -24,7 +24,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.NoEmptyPolicy do
 
   def filter(object), do: {:ok, object}
 
-  defp is_local?(actor) do
+  defp local?(actor) do
     if actor |> String.starts_with?("#{Endpoint.url()}") do
       true
     else
@@ -59,11 +59,11 @@ defmodule Pleroma.Web.ActivityPub.MRF.NoEmptyPolicy do
 
   defp only_mentions?(_), do: false
 
-  defp is_note?(%{"object" => %{"type" => "Note"}}), do: true
-  defp is_note?(_), do: false
+  defp note?(%{"object" => %{"type" => "Note"}}), do: true
+  defp note?(_), do: false
 
-  defp is_eligible_type?(%{"type" => type}) when type in ["Create", "Update"], do: true
-  defp is_eligible_type?(_), do: false
+  defp eligible_type?(%{"type" => type}) when type in ["Create", "Update"], do: true
+  defp eligible_type?(_), do: false
 
   @impl true
   def describe, do: {:ok, %{}}

lib/pleroma/web/activity_pub/mrf/policy.ex

@@ -3,8 +3,8 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Web.ActivityPub.MRF.Policy do
-  @callback filter(Map.t()) :: {:ok | :reject, Map.t()}
-  @callback describe() :: {:ok | :error, Map.t()}
+  @callback filter(map()) :: {:ok | :reject, map()}
+  @callback describe() :: {:ok | :error, map()}
   @callback config_description() :: %{
               optional(:children) => [map()],
               key: atom(),

lib/pleroma/web/activity_pub/mrf/quote_to_link_tag_policy.ex

@@ -28,7 +28,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.QuoteToLinkTagPolicy do
     tags = object["tag"] || []
 
     if Enum.any?(tags, fn tag ->
-         CommonFixes.is_object_link_tag(tag) and tag["href"] == quote_url
+         CommonFixes.object_link_tag?(tag) and tag["href"] == quote_url
        end) do
       object
     else

lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex

@@ -34,7 +34,10 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do
           |> Path.basename()
           |> Path.extname()
 
-        file_path = Path.join(emoji_dir_path, shortcode <> (extension || ".png"))
+        extension = if extension == "", do: ".png", else: extension
+
+        shortcode = Path.basename(shortcode)
+        file_path = Path.join(emoji_dir_path, shortcode <> extension)
 
         case File.write(file_path, response.body) do
           :ok ->
@@ -76,6 +79,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do
       new_emojis =
         foreign_emojis
         |> Enum.reject(fn {shortcode, _url} -> shortcode in installed_emoji end)
+        |> Enum.reject(fn {shortcode, _url} -> String.contains?(shortcode, ["/", "\\"]) end)
         |> Enum.filter(fn {shortcode, _url} ->
           reject_emoji? =
             [:mrf_steal_emoji, :rejected_shortcodes]

lib/pleroma/web/activity_pub/object_validator.ex

@@ -173,6 +173,9 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
 
       {:object_validation, e} ->
         e
+
+      {:error, %Ecto.Changeset{} = e} ->
+        {:error, e}
     end
   end
 

lib/pleroma/web/activity_pub/object_validators/announce_validator.ex

@@ -82,7 +82,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.AnnounceValidator do
          object when is_binary(object) <- get_field(cng, :object),
          %User{} = actor <- User.get_cached_by_ap_id(actor),
          %Object{} = object <- Object.get_cached_by_ap_id(object),
-         false <- Visibility.is_public?(object) do
+         false <- Visibility.public?(object) do
       same_actor = object.data["actor"] == actor.ap_id
       recipients = get_field(cng, :to) ++ get_field(cng, :cc)
       local_public = Utils.as_local_public()

lib/pleroma/web/activity_pub/object_validators/chat_message_validator.ex

@@ -57,6 +57,11 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.ChatMessageValidator do
     |> Map.put("attachment", attachment)
   end
 
+  def fix_attachment(%{"attachment" => attachment} = data) when attachment == [] do
+    data
+    |> Map.drop(["attachment"])
+  end
+
   def fix_attachment(data), do: data
 
   def changeset(struct, data) do

lib/pleroma/web/activity_pub/object_validators/common_fixes.ex

@@ -4,6 +4,7 @@
 
 defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
   alias Pleroma.EctoType.ActivityPub.ObjectValidators
+  alias Pleroma.Maps
   alias Pleroma.Object
   alias Pleroma.Object.Containment
   alias Pleroma.User
@@ -24,6 +25,8 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
   end
 
   def fix_object_defaults(data) do
+    data = Maps.filter_empty_values(data)
+
     context =
       Utils.maybe_create_context(
         data["context"] || data["conversation"] || data["inReplyTo"] || data["id"]
@@ -99,7 +102,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
   end
 
   def fix_quote_url(%{"tag" => [_ | _] = tags} = data) do
-    tag = Enum.find(tags, &is_object_link_tag/1)
+    tag = Enum.find(tags, &object_link_tag?/1)
 
     if not is_nil(tag) do
       data
@@ -112,7 +115,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
   def fix_quote_url(data), do: data
 
   # https://codeberg.org/fediverse/fep/src/branch/main/fep/e232/fep-e232.md
-  def is_object_link_tag(%{
+  def object_link_tag?(%{
         "type" => "Link",
         "mediaType" => media_type,
         "href" => href
@@ -121,5 +124,5 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.CommonFixes do
     true
   end
 
-  def is_object_link_tag(_), do: false
+  def object_link_tag?(_), do: false
 end

lib/pleroma/web/activity_pub/object_validators/emoji_react_validator.ex

@@ -74,10 +74,10 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.EmojiReactValidator do
     new_emoji = Pleroma.Emoji.fully_qualify_emoji(emoji)
 
     cond do
-      Pleroma.Emoji.is_unicode_emoji?(emoji) ->
+      Pleroma.Emoji.unicode?(emoji) ->
         data
 
-      Pleroma.Emoji.is_unicode_emoji?(new_emoji) ->
+      Pleroma.Emoji.unicode?(new_emoji) ->
         data |> Map.put("content", new_emoji)
 
       true ->
@@ -90,7 +90,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.EmojiReactValidator do
   defp validate_emoji(cng) do
     content = get_field(cng, :content)
 
-    if Emoji.is_unicode_emoji?(content) || Emoji.is_custom_emoji?(content) do
+    if Emoji.unicode?(content) || Emoji.custom?(content) do
       cng
     else
       cng
@@ -101,7 +101,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.EmojiReactValidator do
   defp maybe_validate_tag_presence(cng) do
     content = get_field(cng, :content)
 
-    if Emoji.is_unicode_emoji?(content) do
+    if Emoji.unicode?(content) do
       cng
     else
       tag = get_field(cng, :tag)

lib/pleroma/web/activity_pub/object_validators/question_validator.ex

@@ -29,6 +29,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.QuestionValidator do
 
     field(:closed, ObjectValidators.DateTime)
     field(:voters, {:array, ObjectValidators.ObjectID}, default: [])
+    field(:nonAnonymous, :boolean)
     embeds_many(:anyOf, QuestionOptionsValidator)
     embeds_many(:oneOf, QuestionOptionsValidator)
   end

lib/pleroma/web/activity_pub/pipeline.ex

@@ -62,7 +62,7 @@ defmodule Pleroma.Web.ActivityPub.Pipeline do
     with {:ok, local} <- Keyword.fetch(meta, :local) do
       do_not_federate = meta[:do_not_federate] || !config().get([:instance, :federating])
 
-      if !do_not_federate and local and not Visibility.is_local_public?(activity) do
+      if !do_not_federate and local and not Visibility.local_public?(activity) do
         activity =
           if object = Keyword.get(meta, :object_data) do
             %{activity | data: Map.put(activity.data, "object", object)}

lib/pleroma/web/activity_pub/publisher.ex

@@ -13,23 +13,60 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
   alias Pleroma.User
   alias Pleroma.Web.ActivityPub.Relay
   alias Pleroma.Web.ActivityPub.Transmogrifier
+  alias Pleroma.Workers.PublisherWorker
 
   require Pleroma.Constants
 
   import Pleroma.Web.ActivityPub.Visibility
 
-  @behaviour Pleroma.Web.Federator.Publisher
-
   require Logger
 
   @moduledoc """
   ActivityPub outgoing federation module.
   """
 
+  @doc """
+  Enqueue publishing a single activity.
+  """
+  @spec enqueue_one(map(), Keyword.t()) :: {:ok, %Oban.Job{}}
+  def enqueue_one(%{} = params, worker_args \\ []) do
+    PublisherWorker.enqueue(
+      "publish_one",
+      %{"params" => params},
+      worker_args
+    )
+  end
+
+  @doc """
+  Gathers a set of remote users given an IR envelope.
+  """
+  def remote_users(%User{id: user_id}, %{data: %{"to" => to} = data}) do
+    cc = Map.get(data, "cc", [])
+
+    bcc =
+      data
+      |> Map.get("bcc", [])
+      |> Enum.reduce([], fn ap_id, bcc ->
+        case Pleroma.List.get_by_ap_id(ap_id) do
+          %Pleroma.List{user_id: ^user_id} = list ->
+            {:ok, following} = Pleroma.List.get_following(list)
+            bcc ++ Enum.map(following, & &1.ap_id)
+
+          _ ->
+            bcc
+        end
+      end)
+
+    [to, cc, bcc]
+    |> Enum.concat()
+    |> Enum.map(&User.get_cached_by_ap_id/1)
+    |> Enum.filter(fn user -> user && !user.local end)
+  end
+
   @doc """
   Determine if an activity can be represented by running it through Transmogrifier.
   """
-  def is_representable?(%Activity{} = activity) do
+  def representable?(%Activity{} = activity) do
     with {:ok, _data} <- Transmogrifier.prepare_outgoing(activity.data) do
       true
     else
@@ -80,9 +117,27 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
 
       result
     else
-      {_post_result, response} ->
+      {_post_result, %{status: code} = response} = e ->
         unless params[:unreachable_since], do: Instances.set_unreachable(inbox)
-        {:error, response}
+        Logger.metadata(activity: id, inbox: inbox, status: code)
+        Logger.error("Publisher failed to inbox #{inbox} with status #{code}")
+
+        case response do
+          %{status: 403} -> {:discard, :forbidden}
+          %{status: 404} -> {:discard, :not_found}
+          %{status: 410} -> {:discard, :not_found}
+          _ -> {:error, e}
+        end
+
+      {:error, :pool_full} ->
+        Logger.debug("Publisher snoozing worker job due to full connection pool")
+        {:snooze, 30}
+
+      e ->
+        unless params[:unreachable_since], do: Instances.set_unreachable(inbox)
+        Logger.metadata(activity: id, inbox: inbox)
+        Logger.error("Publisher failed to inbox #{inbox} #{inspect(e)}")
+        {:error, e}
     end
   end
 
@@ -103,19 +158,18 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
     end
   end
 
-  defp should_federate?(inbox, public) do
-    if public do
-      true
-    else
-      %{host: host} = URI.parse(inbox)
+  def should_federate?(nil, _), do: false
+  def should_federate?(_, true), do: true
 
-      quarantined_instances =
-        Config.get([:instance, :quarantined_instances], [])
-        |> Pleroma.Web.ActivityPub.MRF.instance_list_from_tuples()
-        |> Pleroma.Web.ActivityPub.MRF.subdomains_regex()
+  def should_federate?(inbox, _) do
+    %{host: host} = URI.parse(inbox)
 
-      !Pleroma.Web.ActivityPub.MRF.subdomain_match?(quarantined_instances, host)
-    end
+    quarantined_instances =
+      Config.get([:instance, :quarantined_instances], [])
+      |> Pleroma.Web.ActivityPub.MRF.instance_list_from_tuples()
+      |> Pleroma.Web.ActivityPub.MRF.subdomains_regex()
+
+    !Pleroma.Web.ActivityPub.MRF.subdomain_match?(quarantined_instances, host)
   end
 
   @spec recipients(User.t(), Activity.t()) :: [[User.t()]]
@@ -138,7 +192,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
           []
       end
 
-    mentioned = Pleroma.Web.Federator.Publisher.remote_users(actor, activity)
+    mentioned = remote_users(actor, activity)
     non_mentioned = (followers ++ fetchers) -- mentioned
 
     [mentioned, non_mentioned]
@@ -195,7 +249,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
 
   def publish(%User{} = actor, %{data: %{"bcc" => bcc}} = activity)
       when is_list(bcc) and bcc != [] do
-    public = is_public?(activity)
+    public = public?(activity)
     {:ok, data} = Transmogrifier.prepare_outgoing(activity.data)
 
     [priority_recipients, recipients] = recipients(actor, activity)
@@ -204,7 +258,10 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       [priority_recipients, recipients]
       |> Enum.map(fn recipients ->
         recipients
-        |> Enum.map(fn actor -> actor.inbox end)
+        |> Enum.map(fn %User{} = user ->
+          determine_inbox(activity, user)
+        end)
+        |> Enum.uniq()
         |> Enum.filter(fn inbox -> should_federate?(inbox, public) end)
         |> Instances.filter_reachable()
       end)
@@ -223,7 +280,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
             |> Map.put("cc", cc)
             |> Jason.encode!()
 
-          Pleroma.Web.Federator.Publisher.enqueue_one(__MODULE__, %{
+          __MODULE__.enqueue_one(%{
             inbox: inbox,
             json: json,
             actor_id: actor.id,
@@ -237,7 +294,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
 
   # Publishes an activity to all relevant peers.
   def publish(%User{} = actor, %Activity{} = activity) do
-    public = is_public?(activity)
+    public = public?(activity)
 
     if public && Config.get([:instance, :allow_relay]) do
       Logger.debug(fn -> "Relaying #{activity.data["id"]} out" end)
@@ -251,7 +308,10 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       recipients(actor, activity)
       |> Enum.map(fn recipients ->
         recipients
-        |> Enum.map(fn actor -> actor.inbox end)
+        |> Enum.map(fn %User{} = user ->
+          determine_inbox(activity, user)
+        end)
+        |> Enum.uniq()
         |> Enum.filter(fn inbox -> should_federate?(inbox, public) end)
       end)
 
@@ -262,8 +322,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
       inboxes
       |> Instances.filter_reachable()
       |> Enum.each(fn {inbox, unreachable_since} ->
-        Pleroma.Web.Federator.Publisher.enqueue_one(
-          __MODULE__,
+        __MODULE__.enqueue_one(
           %{
             inbox: inbox,
             json: json,

lib/pleroma/web/activity_pub/relay.ex

@@ -58,7 +58,7 @@ defmodule Pleroma.Web.ActivityPub.Relay do
   @spec publish(any()) :: {:ok, Activity.t()} | {:error, any()}
   def publish(%Activity{data: %{"type" => "Create"}} = activity) do
     with %User{} = user <- get_actor(),
-         true <- Visibility.is_public?(activity) do
+         true <- Visibility.public?(activity) do
       CommonAPI.repeat(activity.id, user)
     else
       error -> format_error(error)

lib/pleroma/web/activity_pub/side_effects.ex

@@ -233,6 +233,8 @@ defmodule Pleroma.Web.ActivityPub.SideEffects do
 
       Pleroma.Search.add_to_index(Map.put(activity, :object, object))
 
+      Utils.maybe_handle_group_posts(activity)
+
       meta =
         meta
         |> add_notifications(notifications)
@@ -256,7 +258,7 @@ defmodule Pleroma.Web.ActivityPub.SideEffects do
 
     Utils.add_announce_to_object(object, announced_object)
 
-    if !User.is_internal_user?(user) do
+    if !User.internal?(user) do
       Notification.create_notifications(object)
 
       ap_streamer().stream_out(object)
@@ -302,9 +304,9 @@ defmodule Pleroma.Web.ActivityPub.SideEffects do
     result =
       case deleted_object do
         %Object{} ->
-          with {:ok, deleted_object, _activity} <- Object.delete(deleted_object),
+          with {_, {:ok, deleted_object, _activity}} <- {:object, Object.delete(deleted_object)},
                {_, actor} when is_binary(actor) <- {:actor, deleted_object.data["actor"]},
-               %User{} = user <- User.get_cached_by_ap_id(actor) do
+               {_, %User{} = user} <- {:user, User.get_cached_by_ap_id(actor)} do
             User.remove_pinned_object_id(user, deleted_object.data["id"])
 
             {:ok, user} = ActivityPub.decrease_note_count_if_public(user, deleted_object)
@@ -326,6 +328,17 @@ defmodule Pleroma.Web.ActivityPub.SideEffects do
             {:actor, _} ->
               @logger.error("The object doesn't have an actor: #{inspect(deleted_object)}")
               :no_object_actor
+
+            {:user, _} ->
+              @logger.error(
+                "The object's actor could not be resolved to a user: #{inspect(deleted_object)}"
+              )
+
+              :no_object_user
+
+            {:object, _} ->
+              @logger.error("The object could not be deleted: #{inspect(deleted_object)}")
+              {:error, object}
           end
 
         %User{} ->
@@ -567,7 +580,7 @@ defmodule Pleroma.Web.ActivityPub.SideEffects do
 
   def handle_undoing(object), do: {:error, ["don't know how to handle", object]}
 
-  @spec delete_object(Object.t()) :: :ok | {:error, Ecto.Changeset.t()}
+  @spec delete_object(Activity.t()) :: :ok | {:error, Ecto.Changeset.t()}
   defp delete_object(object) do
     with {:ok, _} <- Repo.delete(object), do: :ok
   end

lib/pleroma/web/activity_pub/side_effects/handling.ex

@@ -4,5 +4,5 @@
 
 defmodule Pleroma.Web.ActivityPub.SideEffects.Handling do
   @callback handle(map(), keyword()) :: {:ok, map(), keyword()} | {:error, any()}
-  @callback handle_after_transaction(map()) :: map()
+  @callback handle_after_transaction(keyword()) :: keyword()
 end

lib/pleroma/web/activity_pub/transmogrifier.ex

@@ -23,7 +23,6 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
 
   import Ecto.Query
 
-  require Logger
   require Pleroma.Constants
 
   @doc """
@@ -155,8 +154,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
         |> Map.put("context", replied_object.data["context"] || object["conversation"])
         |> Map.drop(["conversation", "inReplyToAtomUri"])
       else
-        e ->
-          Logger.warning("Couldn't fetch #{inspect(in_reply_to_id)}, error: #{inspect(e)}")
+        _ ->
           object
       end
     else
@@ -181,8 +179,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
       {:quoting?, _} ->
         object
 
-      e ->
-        Logger.warning("Couldn't fetch #{inspect(quote_url)}, error: #{inspect(e)}")
+      _ ->
         object
     end
   end
@@ -782,7 +779,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
       |> Object.normalize(fetch: false)
 
     data =
-      if Visibility.is_private?(object) && object.data["actor"] == ap_id do
+      if Visibility.private?(object) && object.data["actor"] == ap_id do
         data |> Map.put("object", object |> Map.get(:data) |> prepare_object)
       else
         data |> maybe_fix_object_url
@@ -852,8 +849,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
            relative_object do
       Map.put(data, "object", external_url)
     else
-      {:fetch, e} ->
-        Logger.error("Couldn't fetch #{object} #{inspect(e)}")
+      {:fetch, _} ->
         data
 
       _ ->

lib/pleroma/web/activity_pub/utils.ex

@@ -167,7 +167,7 @@ defmodule Pleroma.Web.ActivityPub.Utils do
 
     with true <- Config.get!([:instance, :federating]),
          true <- type != "Block" || outgoing_blocks,
-         false <- Visibility.is_local_public?(activity) do
+         false <- Visibility.local_public?(activity) do
       Pleroma.Web.Federator.publish(activity)
     end
 
@@ -277,7 +277,7 @@ defmodule Pleroma.Web.ActivityPub.Utils do
     object_actor = User.get_cached_by_ap_id(object_actor_id)
 
     to =
-      if Visibility.is_public?(object) do
+      if Visibility.public?(object) do
         [actor.follower_address, object.data["actor"]]
       else
         [object.data["actor"]]
@@ -780,10 +780,9 @@ defmodule Pleroma.Web.ActivityPub.Utils do
         build_flag_object(object)
 
       nil ->
-        if %Object{} = object = Object.get_by_ap_id(id) do
-          build_flag_object(object)
-        else
-          %{"id" => id, "deleted" => true}
+        case Object.get_by_ap_id(id) do
+          %Object{} = object -> build_flag_object(object)
+          _ -> %{"id" => id, "deleted" => true}
         end
     end
   end
@@ -939,4 +938,27 @@ defmodule Pleroma.Web.ActivityPub.Utils do
     |> where([a, object: o], fragment("(?)->>'type' = 'Answer'", o.data))
     |> Repo.all()
   end
+
+  def maybe_handle_group_posts(activity) do
+    poster = User.get_cached_by_ap_id(activity.actor)
+
+    mentions =
+      activity.data["to"]
+      |> Enum.filter(&(&1 != activity.actor))
+
+    mentioned_local_groups =
+      User.get_all_by_ap_id(mentions)
+      |> Enum.filter(fn user ->
+        user.actor_type == "Group" and
+          user.local and
+          not User.blocks?(user, poster)
+      end)
+
+    mentioned_local_groups
+    |> Enum.each(fn group ->
+      Pleroma.Web.CommonAPI.repeat(activity.id, group)
+    end)
+
+    :ok
+  end
 end

lib/pleroma/web/activity_pub/visibility.ex

@@ -11,28 +11,28 @@ defmodule Pleroma.Web.ActivityPub.Visibility do
 
   require Pleroma.Constants
 
-  @spec is_public?(Object.t() | Activity.t() | map()) :: boolean()
-  def is_public?(%Object{data: %{"type" => "Tombstone"}}), do: false
-  def is_public?(%Object{data: data}), do: is_public?(data)
-  def is_public?(%Activity{data: %{"type" => "Move"}}), do: true
-  def is_public?(%Activity{data: data}), do: is_public?(data)
-  def is_public?(%{"directMessage" => true}), do: false
+  @spec public?(Object.t() | Activity.t() | map()) :: boolean()
+  def public?(%Object{data: %{"type" => "Tombstone"}}), do: false
+  def public?(%Object{data: data}), do: public?(data)
+  def public?(%Activity{data: %{"type" => "Move"}}), do: true
+  def public?(%Activity{data: data}), do: public?(data)
+  def public?(%{"directMessage" => true}), do: false
 
-  def is_public?(data) do
+  def public?(data) do
     Utils.label_in_message?(Pleroma.Constants.as_public(), data) or
       Utils.label_in_message?(Utils.as_local_public(), data)
   end
 
-  def is_local_public?(%Object{data: data}), do: is_local_public?(data)
-  def is_local_public?(%Activity{data: data}), do: is_local_public?(data)
+  def local_public?(%Object{data: data}), do: local_public?(data)
+  def local_public?(%Activity{data: data}), do: local_public?(data)
 
-  def is_local_public?(data) do
+  def local_public?(data) do
     Utils.label_in_message?(Utils.as_local_public(), data) and
       not Utils.label_in_message?(Pleroma.Constants.as_public(), data)
   end
 
-  def is_private?(activity) do
-    with false <- is_public?(activity),
+  def private?(activity) do
+    with false <- public?(activity),
          %User{follower_address: follower_address} <-
            User.get_cached_by_ap_id(activity.data["actor"]) do
       follower_address in activity.data["to"]
@@ -41,20 +41,20 @@ defmodule Pleroma.Web.ActivityPub.Visibility do
     end
   end
 
-  def is_announceable?(activity, user, public \\ true) do
-    is_public?(activity) ||
-      (!public && is_private?(activity) && activity.data["actor"] == user.ap_id)
+  def announceable?(activity, user, public \\ true) do
+    public?(activity) ||
+      (!public && private?(activity) && activity.data["actor"] == user.ap_id)
   end
 
-  def is_direct?(%Activity{data: %{"directMessage" => true}}), do: true
-  def is_direct?(%Object{data: %{"directMessage" => true}}), do: true
+  def direct?(%Activity{data: %{"directMessage" => true}}), do: true
+  def direct?(%Object{data: %{"directMessage" => true}}), do: true
 
-  def is_direct?(activity) do
-    !is_public?(activity) && !is_private?(activity)
+  def direct?(activity) do
+    !public?(activity) && !private?(activity)
   end
 
-  def is_list?(%{data: %{"listMessage" => _}}), do: true
-  def is_list?(_), do: false
+  def list?(%{data: %{"listMessage" => _}}), do: true
+  def list?(_), do: false
 
   @spec visible_for_user?(Object.t() | Activity.t() | nil, User.t() | nil) :: boolean()
   def visible_for_user?(%Object{data: %{"type" => "Tombstone"}}, _), do: false
@@ -77,7 +77,7 @@ defmodule Pleroma.Web.ActivityPub.Visibility do
       when module in [Activity, Object] do
     if restrict_unauthenticated_access?(message),
       do: false,
-      else: is_public?(message) and not is_local_public?(message)
+      else: public?(message) and not local_public?(message)
   end
 
   def visible_for_user?(%{__struct__: module} = message, user)
@@ -86,8 +86,8 @@ defmodule Pleroma.Web.ActivityPub.Visibility do
     y = [message.data["actor"]] ++ message.data["to"] ++ (message.data["cc"] || [])
 
     user_is_local = user.local
-    federatable = not is_local_public?(message)
-    (is_public?(message) || Enum.any?(x, &(&1 in y))) and (user_is_local || federatable)
+    federatable = not local_public?(message)
+    (public?(message) || Enum.any?(x, &(&1 in y))) and (user_is_local || federatable)
   end
 
   def entire_thread_visible_for_user?(%Activity{} = activity, %User{} = user) do

lib/pleroma/web/admin_api/controllers/config_controller.ex

@@ -9,7 +9,7 @@ defmodule Pleroma.Web.AdminAPI.ConfigController do
   alias Pleroma.ConfigDB
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action == :update)
 
   plug(
@@ -76,7 +76,7 @@ defmodule Pleroma.Web.AdminAPI.ConfigController do
     json(conn, translate_descriptions(descriptions))
   end
 
-  def show(conn, %{only_db: true}) do
+  def show(%{private: %{open_api_spex: %{params: %{only_db: true}}}} = conn, _) do
     with :ok <- configurable_from_database() do
       configs = Pleroma.Repo.all(ConfigDB)
 
@@ -128,7 +128,7 @@ defmodule Pleroma.Web.AdminAPI.ConfigController do
     end
   end
 
-  def update(%{body_params: %{configs: configs}} = conn, _) do
+  def update(%{private: %{open_api_spex: %{body_params: %{configs: configs}}}} = conn, _) do
     with :ok <- configurable_from_database() do
       results =
         configs

lib/pleroma/web/admin_api/controllers/instance_document_controller.ex

@@ -9,7 +9,7 @@ defmodule Pleroma.Web.AdminAPI.InstanceDocumentController do
   alias Pleroma.Web.Plugs.InstanceStatic
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   action_fallback(Pleroma.Web.AdminAPI.FallbackController)
 
@@ -18,7 +18,7 @@ defmodule Pleroma.Web.AdminAPI.InstanceDocumentController do
   plug(OAuthScopesPlug, %{scopes: ["admin:read"]} when action == :show)
   plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action in [:update, :delete])
 
-  def show(conn, %{name: document_name}) do
+  def show(%{private: %{open_api_spex: %{params: %{name: document_name}}}} = conn, _) do
     with {:ok, url} <- InstanceDocument.get(document_name),
          {:ok, content} <- File.read(InstanceStatic.file_path(url)) do
       conn
@@ -27,13 +27,18 @@ defmodule Pleroma.Web.AdminAPI.InstanceDocumentController do
     end
   end
 
-  def update(%{body_params: %{file: file}} = conn, %{name: document_name}) do
+  def update(
+        %{
+          private: %{open_api_spex: %{body_params: %{file: file}, params: %{name: document_name}}}
+        } = conn,
+        _
+      ) do
     with {:ok, url} <- InstanceDocument.put(document_name, file.path) do
       json(conn, %{"url" => url})
     end
   end
 
-  def delete(conn, %{name: document_name}) do
+  def delete(%{private: %{open_api_spex: %{params: %{name: document_name}}}} = conn, _) do
     with :ok <- InstanceDocument.delete(document_name) do
       json(conn, %{})
     end

lib/pleroma/web/admin_api/controllers/invite_controller.ex

@@ -13,7 +13,7 @@ defmodule Pleroma.Web.AdminAPI.InviteController do
 
   require Logger
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["admin:read:invites"]} when action == :index)
 
   plug(
@@ -33,14 +33,14 @@ defmodule Pleroma.Web.AdminAPI.InviteController do
   end
 
   @doc "Create an account registration invite token"
-  def create(%{body_params: params} = conn, _) do
+  def create(%{private: %{open_api_spex: %{body_params: params}}} = conn, _) do
     {:ok, invite} = UserInviteToken.create_invite(params)
 
     render(conn, "show.json", invite: invite)
   end
 
   @doc "Revokes invite by token"
-  def revoke(%{body_params: %{token: token}} = conn, _) do
+  def revoke(%{private: %{open_api_spex: %{body_params: %{token: token}}}} = conn, _) do
     with {:ok, invite} <- UserInviteToken.find_by_token(token),
          {:ok, updated_invite} = UserInviteToken.update_invite(invite, %{used: true}) do
       render(conn, "show.json", invite: updated_invite)
@@ -51,7 +51,13 @@ defmodule Pleroma.Web.AdminAPI.InviteController do
   end
 
   @doc "Sends registration invite via email"
-  def email(%{assigns: %{user: user}, body_params: %{email: email} = params} = conn, _) do
+  def email(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{email: email} = params}}
+        } = conn,
+        _
+      ) do
     with {_, false} <- {:registrations_open, Config.get([:instance, :registrations_open])},
          {_, true} <- {:invites_enabled, Config.get([:instance, :invites_enabled])},
          {:ok, invite_token} <- UserInviteToken.create_invite(),

lib/pleroma/web/admin_api/controllers/media_proxy_cache_controller.ex

@@ -11,7 +11,7 @@ defmodule Pleroma.Web.AdminAPI.MediaProxyCacheController do
 
   @cachex Pleroma.Config.get([:cachex, :provider], Cachex)
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -27,7 +27,7 @@ defmodule Pleroma.Web.AdminAPI.MediaProxyCacheController do
 
   defdelegate open_api_operation(action), to: Spec.MediaProxyCacheOperation
 
-  def index(%{assigns: %{user: _}} = conn, params) do
+  def index(%{assigns: %{user: _}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     entries = fetch_entries(params)
     urls = paginate_entries(entries, params.page, params.page_size)
 
@@ -59,12 +59,19 @@ defmodule Pleroma.Web.AdminAPI.MediaProxyCacheController do
     Enum.slice(entries, offset, page_size)
   end
 
-  def delete(%{assigns: %{user: _}, body_params: %{urls: urls}} = conn, _) do
+  def delete(
+        %{assigns: %{user: _}, private: %{open_api_spex: %{body_params: %{urls: urls}}}} = conn,
+        _
+      ) do
     MediaProxy.remove_from_banned_urls(urls)
     json(conn, %{})
   end
 
-  def purge(%{assigns: %{user: _}, body_params: %{urls: urls, ban: ban}} = conn, _) do
+  def purge(
+        %{assigns: %{user: _}, private: %{open_api_spex: %{body_params: %{urls: urls, ban: ban}}}} =
+          conn,
+        _
+      ) do
     MediaProxy.Invalidation.purge(urls)
 
     if ban do

lib/pleroma/web/admin_api/controllers/relay_controller.ex

@@ -11,7 +11,7 @@ defmodule Pleroma.Web.AdminAPI.RelayController do
 
   require Logger
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -31,7 +31,13 @@ defmodule Pleroma.Web.AdminAPI.RelayController do
     end
   end
 
-  def follow(%{assigns: %{user: admin}, body_params: %{relay_url: target}} = conn, _) do
+  def follow(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{relay_url: target}}}
+        } = conn,
+        _
+      ) do
     with {:ok, _message} <- Relay.follow(target) do
       ModerationLog.insert_log(%{action: "relay_follow", actor: admin, target: target})
 
@@ -44,7 +50,13 @@ defmodule Pleroma.Web.AdminAPI.RelayController do
     end
   end
 
-  def unfollow(%{assigns: %{user: admin}, body_params: %{relay_url: target} = params} = conn, _) do
+  def unfollow(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{relay_url: target} = params}}
+        } = conn,
+        _
+      ) do
     with {:ok, _message} <- Relay.unfollow(target, %{force: params[:force]}) do
       ModerationLog.insert_log(%{action: "relay_unfollow", actor: admin, target: target})
 

lib/pleroma/web/admin_api/controllers/report_controller.ex

@@ -18,7 +18,7 @@ defmodule Pleroma.Web.AdminAPI.ReportController do
 
   require Logger
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["admin:read:reports"]} when action in [:index, :show])
 
   plug(
@@ -31,13 +31,13 @@ defmodule Pleroma.Web.AdminAPI.ReportController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.ReportOperation
 
-  def index(conn, params) do
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     reports = Utils.get_reports(params, params.page, params.page_size)
 
     render(conn, "index.json", reports: reports)
   end
 
-  def show(conn, %{id: id}) do
+  def show(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %Activity{} = report <- Activity.get_report(id) do
       render(conn, "show.json", Report.extract_report_info(report))
     else
@@ -45,7 +45,13 @@ defmodule Pleroma.Web.AdminAPI.ReportController do
     end
   end
 
-  def update(%{assigns: %{user: admin}, body_params: %{reports: reports}} = conn, _) do
+  def update(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{reports: reports}}}
+        } = conn,
+        _
+      ) do
     result =
       Enum.map(reports, fn report ->
         case CommonAPI.update_report_state(report.id, report.state) do
@@ -73,9 +79,13 @@ defmodule Pleroma.Web.AdminAPI.ReportController do
     end
   end
 
-  def notes_create(%{assigns: %{user: user}, body_params: %{content: content}} = conn, %{
-        id: report_id
-      }) do
+  def notes_create(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{content: content}, params: %{id: report_id}}}
+        } = conn,
+        _
+      ) do
     with {:ok, _} <- ReportNote.create(user.id, report_id, content),
          report <- Activity.get_by_id_with_user_actor(report_id) do
       ModerationLog.insert_log(%{
@@ -92,10 +102,20 @@ defmodule Pleroma.Web.AdminAPI.ReportController do
     end
   end
 
-  def notes_delete(%{assigns: %{user: user}} = conn, %{
-        id: note_id,
-        report_id: report_id
-      }) do
+  def notes_delete(
+        %{
+          assigns: %{user: user},
+          private: %{
+            open_api_spex: %{
+              params: %{
+                id: note_id,
+                report_id: report_id
+              }
+            }
+          }
+        } = conn,
+        _
+      ) do
     with {:ok, note} <- ReportNote.destroy(note_id),
          report <- Activity.get_by_id_with_user_actor(report_id) do
       ModerationLog.insert_log(%{

lib/pleroma/web/admin_api/controllers/user_controller.ex

@@ -18,7 +18,7 @@ defmodule Pleroma.Web.AdminAPI.UserController do
 
   @users_page_size 50
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -51,13 +51,22 @@ defmodule Pleroma.Web.AdminAPI.UserController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.UserOperation
 
-  def delete(conn, %{nickname: nickname}) do
+  def delete(%{private: %{open_api_spex: %{params: %{nickname: nickname}}}} = conn, _) do
     conn
-    |> Map.put(:body_params, %{nicknames: [nickname]})
-    |> delete(%{})
+    |> do_deletes([nickname])
   end
 
-  def delete(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def delete(
+        %{
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
+    conn
+    |> do_deletes(nicknames)
+  end
+
+  defp do_deletes(%{assigns: %{user: admin}} = conn, nicknames) when is_list(nicknames) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
 
     Enum.each(users, fn user ->
@@ -77,9 +86,13 @@ defmodule Pleroma.Web.AdminAPI.UserController do
   def follow(
         %{
           assigns: %{user: admin},
-          body_params: %{
-            follower: follower_nick,
-            followed: followed_nick
+          private: %{
+            open_api_spex: %{
+              body_params: %{
+                follower: follower_nick,
+                followed: followed_nick
+              }
+            }
           }
         } = conn,
         _
@@ -102,9 +115,13 @@ defmodule Pleroma.Web.AdminAPI.UserController do
   def unfollow(
         %{
           assigns: %{user: admin},
-          body_params: %{
-            follower: follower_nick,
-            followed: followed_nick
+          private: %{
+            open_api_spex: %{
+              body_params: %{
+                follower: follower_nick,
+                followed: followed_nick
+              }
+            }
           }
         } = conn,
         _
@@ -124,7 +141,13 @@ defmodule Pleroma.Web.AdminAPI.UserController do
     json(conn, "ok")
   end
 
-  def create(%{assigns: %{user: admin}, body_params: %{users: users}} = conn, _) do
+  def create(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{users: users}}}
+        } = conn,
+        _
+      ) do
     changesets =
       users
       |> Enum.map(fn %{nickname: nickname, email: email, password: password} ->
@@ -178,7 +201,13 @@ defmodule Pleroma.Web.AdminAPI.UserController do
     end
   end
 
-  def show(%{assigns: %{user: admin}} = conn, %{nickname: nickname}) do
+  def show(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{params: %{nickname: nickname}}}
+        } = conn,
+        _
+      ) do
     with %User{} = user <- User.get_cached_by_nickname_or_id(nickname, for: admin) do
       render(conn, "show.json", %{user: user})
     else
@@ -186,7 +215,11 @@ defmodule Pleroma.Web.AdminAPI.UserController do
     end
   end
 
-  def toggle_activation(%{assigns: %{user: admin}} = conn, %{nickname: nickname}) do
+  def toggle_activation(
+        %{assigns: %{user: admin}, private: %{open_api_spex: %{params: %{nickname: nickname}}}} =
+          conn,
+        _
+      ) do
     user = User.get_cached_by_nickname(nickname)
 
     {:ok, updated_user} = User.set_activation(user, !user.is_active)
@@ -202,7 +235,13 @@ defmodule Pleroma.Web.AdminAPI.UserController do
     render(conn, "show.json", user: updated_user)
   end
 
-  def activate(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def activate(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.set_activation(users, true)
 
@@ -212,10 +251,16 @@ defmodule Pleroma.Web.AdminAPI.UserController do
       action: "activate"
     })
 
-    render(conn, "index.json", users: Keyword.values(updated_users))
+    render(conn, "index.json", users: updated_users)
   end
 
-  def deactivate(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def deactivate(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.set_activation(users, false)
 
@@ -225,10 +270,16 @@ defmodule Pleroma.Web.AdminAPI.UserController do
       action: "deactivate"
     })
 
-    render(conn, "index.json", users: Keyword.values(updated_users))
+    render(conn, "index.json", users: updated_users)
   end
 
-  def approve(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def approve(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.approve(users)
 
@@ -241,7 +292,13 @@ defmodule Pleroma.Web.AdminAPI.UserController do
     render(conn, "index.json", users: updated_users)
   end
 
-  def suggest(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def suggest(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.set_suggestion(users, true)
 
@@ -254,7 +311,13 @@ defmodule Pleroma.Web.AdminAPI.UserController do
     render(conn, "index.json", users: updated_users)
   end
 
-  def unsuggest(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def unsuggest(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.set_suggestion(users, false)
 
@@ -267,7 +330,7 @@ defmodule Pleroma.Web.AdminAPI.UserController do
     render(conn, "index.json", users: updated_users)
   end
 
-  def index(conn, params) do
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     {page, page_size} = page_params(params)
     filters = maybe_parse_filters(params[:filters])
 

lib/pleroma/web/api_spec.ex

@@ -43,7 +43,7 @@ defmodule Pleroma.Web.ApiSpec do
         - [Mastodon API documentation](https://docs.joinmastodon.org/client/intro/)
         - [Differences in Mastodon API responses from vanilla Mastodon](https://docs-develop.pleroma.social/backend/development/API/differences_in_mastoapi_responses/)
 
-        Please report such occurences on our [issue tracker](https://git.pleroma.social/pleroma/pleroma/-/issues). Feel free to submit API questions or proposals there too!
+        Please report such occurrences on our [issue tracker](https://git.pleroma.social/pleroma/pleroma/-/issues). Feel free to submit API questions or proposals there too!
         """,
         # Strip environment from the version
         version: Application.spec(:pleroma, :vsn) |> to_string() |> String.replace(~r/\+.*$/, ""),
@@ -94,15 +94,15 @@ defmodule Pleroma.Web.ApiSpec do
             "tags" => [
               "Chat administration",
               "Emoji pack administration",
-              "Frontend managment",
+              "Frontend management",
               "Instance configuration",
               "Instance documents",
               "Instance rule managment",
               "Invites",
               "MediaProxy cache",
-              "OAuth application managment",
+              "OAuth application management",
               "Relays",
-              "Report managment",
+              "Report management",
               "Status administration",
               "User administration",
               "Announcement management"

lib/pleroma/web/api_spec/cast_and_validate.ex

@@ -27,10 +27,12 @@ defmodule Pleroma.Web.ApiSpec.CastAndValidate do
 
   @impl Plug
 
-  def call(conn, %{operation_id: operation_id, render_error: render_error}) do
+  def call(conn, %{operation_id: operation_id, render_error: render_error} = opts) do
     {spec, operation_lookup} = PutApiSpec.get_spec_and_operation_lookup(conn)
     operation = operation_lookup[operation_id]
 
+    cast_opts = opts |> Map.take([:replace_params]) |> Map.to_list()
+
     content_type =
       case Conn.get_req_header(conn, "content-type") do
         [header_value | _] ->
@@ -44,7 +46,7 @@ defmodule Pleroma.Web.ApiSpec.CastAndValidate do
 
     conn = Conn.put_private(conn, :operation_id, operation_id)
 
-    case cast_and_validate(spec, operation, conn, content_type, strict?()) do
+    case cast_and_validate(spec, operation, conn, content_type, strict?(), cast_opts) do
       {:ok, conn} ->
         conn
 
@@ -94,11 +96,11 @@ defmodule Pleroma.Web.ApiSpec.CastAndValidate do
 
   def call(conn, opts), do: OpenApiSpex.Plug.CastAndValidate.call(conn, opts)
 
-  defp cast_and_validate(spec, operation, conn, content_type, true = _strict) do
-    OpenApiSpex.cast_and_validate(spec, operation, conn, content_type)
+  defp cast_and_validate(spec, operation, conn, content_type, true = _strict, cast_opts) do
+    OpenApiSpex.cast_and_validate(spec, operation, conn, content_type, cast_opts)
   end
 
-  defp cast_and_validate(spec, operation, conn, content_type, false = _strict) do
+  defp cast_and_validate(spec, operation, conn, content_type, false = _strict, cast_opts) do
     case OpenApiSpex.cast_and_validate(spec, operation, conn, content_type) do
       {:ok, conn} ->
         {:ok, conn}
@@ -123,7 +125,7 @@ defmodule Pleroma.Web.ApiSpec.CastAndValidate do
           end)
 
         conn = %Conn{conn | query_params: query_params}
-        OpenApiSpex.cast_and_validate(spec, operation, conn, content_type)
+        OpenApiSpex.cast_and_validate(spec, operation, conn, content_type, cast_opts)
     end
   end
 

lib/pleroma/web/api_spec/helpers.ex

@@ -62,7 +62,7 @@ defmodule Pleroma.Web.ApiSpec.Helpers do
     Operation.parameter(
       :with_relationships,
       :query,
-      BooleanLike,
+      BooleanLike.schema(),
       "Embed relationships into accounts. **If this parameter is not set account's `pleroma.relationship` is going to be `null`.**"
     )
   end

lib/pleroma/web/api_spec/operations/account_operation.ex

@@ -122,22 +122,27 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
       parameters:
         [
           %Reference{"$ref": "#/components/parameters/accountIdOrNickname"},
-          Operation.parameter(:pinned, :query, BooleanLike, "Include only pinned statuses"),
+          Operation.parameter(
+            :pinned,
+            :query,
+            BooleanLike.schema(),
+            "Include only pinned statuses"
+          ),
           Operation.parameter(:tagged, :query, :string, "With tag"),
           Operation.parameter(
             :only_media,
             :query,
-            BooleanLike,
+            BooleanLike.schema(),
             "Include only statuses with media attached"
           ),
           Operation.parameter(
             :with_muted,
             :query,
-            BooleanLike,
+            BooleanLike.schema(),
             "Include statuses from muted accounts."
           ),
-          Operation.parameter(:exclude_reblogs, :query, BooleanLike, "Exclude reblogs"),
-          Operation.parameter(:exclude_replies, :query, BooleanLike, "Exclude replies"),
+          Operation.parameter(:exclude_reblogs, :query, BooleanLike.schema(), "Exclude reblogs"),
+          Operation.parameter(:exclude_replies, :query, BooleanLike.schema(), "Exclude replies"),
           Operation.parameter(
             :exclude_visibilities,
             :query,
@@ -147,7 +152,7 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
           Operation.parameter(
             :with_muted,
             :query,
-            BooleanLike,
+            BooleanLike.schema(),
             "Include reactions from muted accounts."
           )
         ] ++ pagination_params(),
@@ -347,7 +352,7 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
       summary: "Endorse",
       operationId: "AccountController.endorse",
       security: [%{"oAuth" => ["follow", "write:accounts"]}],
-      description: "Addds the given account to endorsed accounts list.",
+      description: "Adds the given account to endorsed accounts list.",
       parameters: [%Reference{"$ref": "#/components/parameters/accountIdOrNickname"}],
       responses: %{
         200 => Operation.response("Relationship", "application/json", AccountRelationship),

lib/pleroma/web/api_spec/operations/admin/frontend_operation.ex

@@ -16,7 +16,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.FrontendOperation do
 
   def index_operation do
     %Operation{
-      tags: ["Frontend managment"],
+      tags: ["Frontend management"],
       summary: "Retrieve a list of available frontends",
       operationId: "AdminAPI.FrontendController.index",
       security: [%{"oAuth" => ["admin:read"]}],
@@ -29,7 +29,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.FrontendOperation do
 
   def install_operation do
     %Operation{
-      tags: ["Frontend managment"],
+      tags: ["Frontend management"],
       summary: "Install a frontend",
       operationId: "AdminAPI.FrontendController.install",
       security: [%{"oAuth" => ["admin:read"]}],

lib/pleroma/web/api_spec/operations/admin/o_auth_app_operation.ex

@@ -17,7 +17,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
   def index_operation do
     %Operation{
       summary: "Retrieve a list of OAuth applications",
-      tags: ["OAuth application managment"],
+      tags: ["OAuth application management"],
       operationId: "AdminAPI.OAuthAppController.index",
       security: [%{"oAuth" => ["admin:write"]}],
       parameters: [
@@ -69,7 +69,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
 
   def create_operation do
     %Operation{
-      tags: ["OAuth application managment"],
+      tags: ["OAuth application management"],
       summary: "Create an OAuth application",
       operationId: "AdminAPI.OAuthAppController.create",
       requestBody: request_body("Parameters", create_request()),
@@ -84,7 +84,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
 
   def update_operation do
     %Operation{
-      tags: ["OAuth application managment"],
+      tags: ["OAuth application management"],
       summary: "Update OAuth application",
       operationId: "AdminAPI.OAuthAppController.update",
       parameters: [id_param() | admin_api_params()],
@@ -102,7 +102,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
 
   def delete_operation do
     %Operation{
-      tags: ["OAuth application managment"],
+      tags: ["OAuth application management"],
       summary: "Delete OAuth application",
       operationId: "AdminAPI.OAuthAppController.delete",
       parameters: [id_param() | admin_api_params()],

lib/pleroma/web/api_spec/operations/admin/report_operation.ex

@@ -19,7 +19,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
 
   def index_operation do
     %Operation{
-      tags: ["Report managment"],
+      tags: ["Report management"],
       summary: "Retrieve a list of reports",
       operationId: "AdminAPI.ReportController.index",
       security: [%{"oAuth" => ["admin:read:reports"]}],
@@ -75,7 +75,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
 
   def show_operation do
     %Operation{
-      tags: ["Report managment"],
+      tags: ["Report management"],
       summary: "Retrieve a report",
       operationId: "AdminAPI.ReportController.show",
       parameters: [id_param() | admin_api_params()],
@@ -89,7 +89,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
 
   def update_operation do
     %Operation{
-      tags: ["Report managment"],
+      tags: ["Report management"],
       summary: "Change state of specified reports",
       operationId: "AdminAPI.ReportController.update",
       security: [%{"oAuth" => ["admin:write:reports"]}],
@@ -105,7 +105,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
 
   def notes_create_operation do
     %Operation{
-      tags: ["Report managment"],
+      tags: ["Report management"],
       summary: "Add a note to the report",
       operationId: "AdminAPI.ReportController.notes_create",
       parameters: [id_param() | admin_api_params()],
@@ -126,7 +126,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
 
   def notes_delete_operation do
     %Operation{
-      tags: ["Report managment"],
+      tags: ["Report management"],
       summary: "Delete note attached to the report",
       operationId: "AdminAPI.ReportController.notes_delete",
       parameters: [
@@ -147,7 +147,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
   end
 
   def id_param do
-    Operation.parameter(:id, :path, FlakeID, "Report ID",
+    Operation.parameter(:id, :path, FlakeID.schema(), "Report ID",
       example: "9umDrYheeY451cQnEe",
       required: true
     )

lib/pleroma/web/api_spec/operations/chat_operation.ex

@@ -137,7 +137,12 @@ defmodule Pleroma.Web.ApiSpec.ChatOperation do
         "Deprecated due to no support for pagination. Using [/api/v2/pleroma/chats](#operation/ChatController.index2) instead is recommended.",
       operationId: "ChatController.index",
       parameters: [
-        Operation.parameter(:with_muted, :query, BooleanLike, "Include chats from muted users")
+        Operation.parameter(
+          :with_muted,
+          :query,
+          BooleanLike.schema(),
+          "Include chats from muted users"
+        )
       ],
       responses: %{
         200 => Operation.response("The chats of the user", "application/json", chats_response())
@@ -156,7 +161,12 @@ defmodule Pleroma.Web.ApiSpec.ChatOperation do
       summary: "Retrieve list of chats",
       operationId: "ChatController.index2",
       parameters: [
-        Operation.parameter(:with_muted, :query, BooleanLike, "Include chats from muted users")
+        Operation.parameter(
+          :with_muted,
+          :query,
+          BooleanLike.schema(),
+          "Include chats from muted users"
+        )
         | pagination_params()
       ],
       responses: %{

lib/pleroma/web/api_spec/operations/directory_operation.ex

@@ -29,7 +29,7 @@ defmodule Pleroma.Web.ApiSpec.DirectoryOperation do
             "Order by recent activity or account creation",
             required: nil
           ),
-          Operation.parameter(:local, :query, BooleanLike, "Include local users only")
+          Operation.parameter(:local, :query, BooleanLike.schema(), "Include local users only")
         ] ++ pagination_params(),
       responses: %{
         200 =>

lib/pleroma/web/api_spec/operations/emoji_reaction_operation.ex

@@ -21,7 +21,7 @@ defmodule Pleroma.Web.ApiSpec.EmojiReactionOperation do
       summary:
         "Get an object of emoji to account mappings with accounts that reacted to the post",
       parameters: [
-        Operation.parameter(:id, :path, FlakeID, "Status ID", required: true),
+        Operation.parameter(:id, :path, FlakeID.schema(), "Status ID", required: true),
         Operation.parameter(:emoji, :path, :string, "Filter by a single unicode emoji",
           required: nil
         ),
@@ -45,7 +45,7 @@ defmodule Pleroma.Web.ApiSpec.EmojiReactionOperation do
       tags: ["Emoji reactions"],
       summary: "React to a post with a unicode emoji",
       parameters: [
-        Operation.parameter(:id, :path, FlakeID, "Status ID", required: true),
+        Operation.parameter(:id, :path, FlakeID.schema(), "Status ID", required: true),
         Operation.parameter(:emoji, :path, :string, "A single character unicode emoji",
           required: true
         )
@@ -64,7 +64,7 @@ defmodule Pleroma.Web.ApiSpec.EmojiReactionOperation do
       tags: ["Emoji reactions"],
       summary: "Remove a reaction to a post with a unicode emoji",
       parameters: [
-        Operation.parameter(:id, :path, FlakeID, "Status ID", required: true),
+        Operation.parameter(:id, :path, FlakeID.schema(), "Status ID", required: true),
         Operation.parameter(:emoji, :path, :string, "A single character unicode emoji",
           required: true
         )

lib/pleroma/web/api_spec/operations/instance_operation.ex

@@ -112,7 +112,7 @@ defmodule Pleroma.Web.ApiSpec.InstanceOperation do
         languages: %Schema{
           type: :array,
           items: %Schema{type: :string},
-          description: "Primary langauges of the website and its staff"
+          description: "Primary languages of the website and its staff"
         },
         registrations: %Schema{type: :boolean, description: "Whether registrations are enabled"},
         # Extra (not present in Mastodon):
@@ -264,7 +264,7 @@ defmodule Pleroma.Web.ApiSpec.InstanceOperation do
         languages: %Schema{
           type: :array,
           items: %Schema{type: :string},
-          description: "Primary langauges of the website and its staff"
+          description: "Primary languages of the website and its staff"
         },
         registrations: %Schema{
           type: :object,

lib/pleroma/web/api_spec/operations/notification_operation.ex

@@ -62,7 +62,7 @@ defmodule Pleroma.Web.ApiSpec.NotificationOperation do
           Operation.parameter(
             :with_muted,
             :query,
-            BooleanLike,
+            BooleanLike.schema(),
             "Include the notifications from muted users"
           )
         ] ++ pagination_params(),

lib/pleroma/web/api_spec/operations/pleroma_account_operation.ex

@@ -142,7 +142,7 @@ defmodule Pleroma.Web.ApiSpec.PleromaAccountOperation do
   end
 
   defp id_param do
-    Operation.parameter(:id, :path, FlakeID, "Account ID",
+    Operation.parameter(:id, :path, FlakeID.schema(), "Account ID",
       example: "9umDrYheeY451cQnEe",
       required: true
     )

lib/pleroma/web/api_spec/operations/pleroma_scrobble_operation.ex

@@ -23,7 +23,7 @@ defmodule Pleroma.Web.ApiSpec.PleromaScrobbleOperation do
       security: [%{"oAuth" => ["write"]}],
       operationId: "PleromaAPI.ScrobbleController.create",
       deprecated: true,
-      requestBody: request_body("Parameters", create_request(), requried: true),
+      requestBody: request_body("Parameters", create_request(), required: true),
       responses: %{
         200 => Operation.response("Scrobble", "application/json", scrobble())
       }

lib/pleroma/web/api_spec/operations/pleroma_status_operation.ex

@@ -37,7 +37,7 @@ defmodule Pleroma.Web.ApiSpec.PleromaStatusOperation do
   end
 
   def id_param do
-    Operation.parameter(:id, :path, FlakeID, "Status ID",
+    Operation.parameter(:id, :path, FlakeID.schema(), "Status ID",
       example: "9umDrYheeY451cQnEe",
       required: true
     )

lib/pleroma/web/api_spec/operations/poll_operation.ex

@@ -47,7 +47,7 @@ defmodule Pleroma.Web.ApiSpec.PollOperation do
   end
 
   defp id_param do
-    Operation.parameter(:id, :path, FlakeID, "Poll ID",
+    Operation.parameter(:id, :path, FlakeID.schema(), "Poll ID",
       example: "123",
       required: true
     )

lib/pleroma/web/api_spec/operations/scheduled_activity_operation.ex

@@ -88,7 +88,7 @@ defmodule Pleroma.Web.ApiSpec.ScheduledActivityOperation do
   end
 
   defp id_param do
-    Operation.parameter(:id, :path, FlakeID, "Poll ID",
+    Operation.parameter(:id, :path, FlakeID.schema(), "Poll ID",
       example: "123",
       required: true
     )

lib/pleroma/web/api_spec/operations/search_operation.ex

@@ -70,7 +70,7 @@ defmodule Pleroma.Web.ApiSpec.SearchOperation do
         Operation.parameter(
           :account_id,
           :query,
-          FlakeID,
+          FlakeID.schema(),
           "If provided, statuses returned will be authored only by this account"
         ),
         Operation.parameter(
@@ -116,7 +116,7 @@ defmodule Pleroma.Web.ApiSpec.SearchOperation do
         Operation.parameter(
           :account_id,
           :query,
-          FlakeID,
+          FlakeID.schema(),
           "If provided, statuses returned will be authored only by this account"
         ),
         Operation.parameter(

lib/pleroma/web/api_spec/operations/status_operation.ex

@@ -39,7 +39,7 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
         Operation.parameter(
           :with_muted,
           :query,
-          BooleanLike,
+          BooleanLike.schema(),
           "Include reactions from muted acccounts."
         )
       ],
@@ -82,7 +82,7 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
         Operation.parameter(
           :with_muted,
           :query,
-          BooleanLike,
+          BooleanLike.schema(),
           "Include reactions from muted acccounts."
         )
       ],
@@ -534,7 +534,7 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
           format: :"date-time",
           nullable: true,
           description:
-            "ISO 8601 Datetime at which to schedule a status. Providing this paramter will cause ScheduledStatus to be returned instead of Status. Must be at least 5 minutes in the future."
+            "ISO 8601 Datetime at which to schedule a status. Providing this parameter will cause ScheduledStatus to be returned instead of Status. Must be at least 5 minutes in the future."
         },
         language: %Schema{
           type: :string,
@@ -546,7 +546,7 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
           allOf: [BooleanLike],
           nullable: true,
           description:
-            "If set to `true` the post won't be actually posted, but the status entitiy would still be rendered back. This could be useful for previewing rich text/custom emoji, for example"
+            "If set to `true` the post won't be actually posted, but the status entity would still be rendered back. This could be useful for previewing rich text/custom emoji, for example"
         },
         content_type: %Schema{
           type: :string,
@@ -685,7 +685,7 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
   end
 
   def id_param do
-    Operation.parameter(:id, :path, FlakeID, "Status ID",
+    Operation.parameter(:id, :path, FlakeID.schema(), "Status ID",
       example: "9umDrYheeY451cQnEe",
       required: true
     )

lib/pleroma/web/api_spec/operations/timeline_operation.ex

@@ -176,7 +176,12 @@ defmodule Pleroma.Web.ApiSpec.TimelineOperation do
   end
 
   defp with_muted_param do
-    Operation.parameter(:with_muted, :query, BooleanLike, "Include activities by muted users")
+    Operation.parameter(
+      :with_muted,
+      :query,
+      BooleanLike.schema(),
+      "Include activities by muted users"
+    )
   end
 
   defp exclude_visibilities_param do

lib/pleroma/web/api_spec/operations/twitter_util_operation.ex

@@ -87,7 +87,7 @@ defmodule Pleroma.Web.ApiSpec.TwitterUtilOperation do
   defp change_password_request do
     %Schema{
       title: "ChangePasswordRequest",
-      description: "POST body for changing the account's passowrd",
+      description: "POST body for changing the account's password",
       type: :object,
       required: [:password, :new_password, :new_password_confirmation],
       properties: %{
@@ -136,23 +136,23 @@ defmodule Pleroma.Web.ApiSpec.TwitterUtilOperation do
     }
   end
 
-  def update_notificaton_settings_operation do
+  def update_notification_settings_operation do
     %Operation{
       tags: ["Settings"],
       summary: "Update Notification Settings",
       security: [%{"oAuth" => ["write:accounts"]}],
-      operationId: "UtilController.update_notificaton_settings",
+      operationId: "UtilController.update_notification_settings",
       parameters: [
         Operation.parameter(
           :block_from_strangers,
           :query,
-          BooleanLike,
+          BooleanLike.schema(),
           "blocks notifications from accounts you do not follow"
         ),
         Operation.parameter(
           :hide_notification_contents,
           :query,
-          BooleanLike,
+          BooleanLike.schema(),
           "removes the contents of a message from the push notification"
         )
       ],

lib/pleroma/web/api_spec/schemas/attachment.ex

@@ -11,7 +11,7 @@ defmodule Pleroma.Web.ApiSpec.Schemas.Attachment do
     title: "Attachment",
     description: "Represents a file or media attachment that can be added to a status.",
     type: :object,
-    requried: [:id, :url, :preview_url],
+    required: [:id, :url, :preview_url],
     properties: %{
       id: %Schema{type: :string, description: "The ID of the attachment in the database."},
       url: %Schema{

lib/pleroma/web/api_spec/schemas/poll.ex

@@ -56,6 +56,15 @@ defmodule Pleroma.Web.ApiSpec.Schemas.Poll do
           }
         },
         description: "Possible answers for the poll."
+      },
+      pleroma: %Schema{
+        type: :object,
+        properties: %{
+          non_anonymous: %Schema{
+            type: :boolean,
+            description: "Can voters be publicly identified?"
+          }
+        }
       }
     },
     example: %{
@@ -79,7 +88,10 @@ defmodule Pleroma.Web.ApiSpec.Schemas.Poll do
           votes_count: 4
         }
       ],
-      emojis: []
+      emojis: [],
+      pleroma: %{
+        non_anonymous: false
+      }
     }
   })
 end

lib/pleroma/web/auth/authenticator.ex

@@ -5,7 +5,7 @@
 defmodule Pleroma.Web.Auth.Authenticator do
   @callback get_user(Plug.Conn.t()) :: {:ok, user :: struct()} | {:error, any()}
   @callback create_from_registration(Plug.Conn.t(), registration :: struct()) ::
-              {:ok, User.t()} | {:error, any()}
+              {:ok, Pleroma.User.t()} | {:error, any()}
   @callback get_registration(Plug.Conn.t()) :: {:ok, registration :: struct()} | {:error, any()}
   @callback handle_error(Plug.Conn.t(), any()) :: any()
   @callback auth_template() :: String.t() | nil

lib/pleroma/web/common_api.ex

@@ -373,7 +373,7 @@ defmodule Pleroma.Web.CommonAPI do
       do: visibility in ~w(public unlisted)
 
   def public_announce?(object, _) do
-    Visibility.is_public?(object)
+    Visibility.public?(object)
   end
 
   def get_visibility(_, _, %Participation{}), do: {"direct", "direct"}
@@ -501,12 +501,12 @@ defmodule Pleroma.Web.CommonAPI do
   end
 
   defp activity_is_public(activity) do
-    with false <- Visibility.is_public?(activity) do
+    with false <- Visibility.public?(activity) do
       {:error, :visibility_error}
     end
   end
 
-  @spec unpin(String.t(), User.t()) :: {:ok, User.t()} | {:error, term()}
+  @spec unpin(String.t(), User.t()) :: {:ok, Activity.t()} | {:error, term()}
   def unpin(id, user) do
     with %Activity{} = activity <- create_activity_by_id(id),
          {:ok, unpin_data, _} <- Builder.unpin(user, activity.object),

lib/pleroma/web/common_api/activity_draft.ex

@@ -14,6 +14,8 @@ defmodule Pleroma.Web.CommonAPI.ActivityDraft do
   import Pleroma.Web.Gettext
   import Pleroma.Web.Utils.Guards, only: [not_empty_string: 1]
 
+  @type t :: %__MODULE__{}
+
   defstruct valid?: true,
             errors: [],
             user: nil,

lib/pleroma/web/common_api/utils.ex

@@ -109,7 +109,7 @@ defmodule Pleroma.Web.CommonAPI.Utils do
 
   def get_to_and_cc(%{visibility: "direct"} = draft) do
     # If the OP is a DM already, add the implicit actor.
-    if draft.in_reply_to && Visibility.is_direct?(draft.in_reply_to) do
+    if draft.in_reply_to && Visibility.direct?(draft.in_reply_to) do
       {Enum.uniq([draft.in_reply_to.data["actor"] | draft.mentions]), []}
     else
       {draft.mentions, []}

lib/pleroma/web/controller_helper.ex

@@ -20,7 +20,7 @@ defmodule Pleroma.Web.ControllerHelper do
     |> json(json)
   end
 
-  @spec fetch_integer_param(map(), String.t(), integer() | nil) :: integer() | nil
+  @spec fetch_integer_param(map(), String.t() | atom(), integer() | nil) :: integer() | nil
   def fetch_integer_param(params, name, default \\ nil) do
     params
     |> Map.get(name, default)
@@ -53,10 +53,15 @@ defmodule Pleroma.Web.ControllerHelper do
     end
   end
 
+  # TODO: Only fetch the params from open_api_spex when everything is converted
   @id_keys Pagination.page_keys() -- ["limit", "order"]
   defp build_pagination_fields(conn, min_id, max_id, extra_params) do
     params =
-      conn.params
+      if Map.has_key?(conn.private, :open_api_spex) do
+        get_in(conn, [Access.key(:private), Access.key(:open_api_spex), Access.key(:params)])
+      else
+        conn.params
+      end
       |> Map.drop(Map.keys(conn.path_params) |> Enum.map(&String.to_existing_atom/1))
       |> Map.merge(extra_params)
       |> Map.drop(@id_keys)
@@ -85,18 +90,15 @@ defmodule Pleroma.Web.ControllerHelper do
     end
   end
 
-  def assign_account_by_id(conn, _) do
-    case Pleroma.User.get_cached_by_id(conn.params.id) do
+  def assign_account_by_id(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
+    case Pleroma.User.get_cached_by_id(id) do
       %Pleroma.User{} = account -> assign(conn, :account, account)
       nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) |> halt()
     end
   end
 
   def try_render(conn, target, params) when is_binary(target) do
-    case render(conn, target, params) do
-      nil -> render_error(conn, :not_implemented, "Can't display this activity")
-      res -> res
-    end
+    render(conn, target, params)
   end
 
   def try_render(conn, _, _) do

lib/pleroma/web/embed_controller.ex

@@ -11,12 +11,10 @@ defmodule Pleroma.Web.EmbedController do
 
   alias Pleroma.Web.ActivityPub.Visibility
 
-  plug(:put_layout, :embed)
-
   def show(conn, %{"id" => id}) do
     with %Activity{local: true} = activity <-
            Activity.get_by_id_with_object(id),
-         true <- Visibility.is_public?(activity.object) do
+         true <- Visibility.public?(activity.object) do
       {:ok, author} = User.get_or_fetch(activity.object.data["actor"])
 
       conn

lib/pleroma/web/endpoint.ex

@@ -9,6 +9,16 @@ defmodule Pleroma.Web.Endpoint do
 
   alias Pleroma.Config
 
+  socket("/api/v1/streaming", Pleroma.Web.MastodonAPI.WebsocketHandler,
+    longpoll: false,
+    websocket: [
+      path: "/",
+      compress: false,
+      error_handler: {Pleroma.Web.MastodonAPI.WebsocketHandler, :handle_error, []},
+      fullsweep_after: 20
+    ]
+  )
+
   socket("/socket", Pleroma.Web.UserSocket,
     websocket: [
       path: "/websocket",
@@ -18,7 +28,8 @@ defmodule Pleroma.Web.Endpoint do
       ],
       timeout: 60_000,
       transport_log: false,
-      compress: false
+      compress: false,
+      fullsweep_after: 20
     ],
     longpoll: false
   )
@@ -32,7 +43,8 @@ defmodule Pleroma.Web.Endpoint do
   plug(Pleroma.Web.Plugs.HTTPSecurityPlug)
   plug(Pleroma.Web.Plugs.UploadedMedia)
 
-  @static_cache_control "public, no-cache"
+  @static_cache_control "public, max-age=1209600"
+  @static_cache_disabled "public, no-cache"
 
   # InstanceStatic needs to be before Plug.Static to be able to override shipped-static files
   # If you're adding new paths to `only:` you'll need to configure them in InstanceStatic as well
@@ -43,22 +55,32 @@ defmodule Pleroma.Web.Endpoint do
     from: :pleroma,
     only: ["emoji", "images"],
     gzip: true,
-    cache_control_for_etags: "public, max-age=1209600",
-    headers: %{
-      "cache-control" => "public, max-age=1209600"
-    }
-  )
-
-  plug(Pleroma.Web.Plugs.InstanceStatic,
-    at: "/",
-    gzip: true,
     cache_control_for_etags: @static_cache_control,
     headers: %{
       "cache-control" => @static_cache_control
     }
   )
 
-  # Careful! No `only` restriction here, as we don't know what frontends contain.
+  plug(Pleroma.Web.Plugs.InstanceStatic,
+    at: "/",
+    gzip: true,
+    cache_control_for_etags: @static_cache_disabled,
+    headers: %{
+      "cache-control" => @static_cache_disabled
+    }
+  )
+
+  plug(Pleroma.Web.Plugs.FrontendStatic,
+    at: "/",
+    frontend_type: :primary,
+    only: ["index.html"],
+    gzip: true,
+    cache_control_for_etags: @static_cache_disabled,
+    headers: %{
+      "cache-control" => @static_cache_disabled
+    }
+  )
+
   plug(Pleroma.Web.Plugs.FrontendStatic,
     at: "/",
     frontend_type: :primary,
@@ -75,9 +97,9 @@ defmodule Pleroma.Web.Endpoint do
     at: "/pleroma/admin",
     frontend_type: :admin,
     gzip: true,
-    cache_control_for_etags: @static_cache_control,
+    cache_control_for_etags: @static_cache_disabled,
     headers: %{
-      "cache-control" => @static_cache_control
+      "cache-control" => @static_cache_disabled
     }
   )
 
@@ -92,9 +114,9 @@ defmodule Pleroma.Web.Endpoint do
     only: Pleroma.Constants.static_only_files(),
     # credo:disable-for-previous-line Credo.Check.Readability.MaxLineLength
     gzip: true,
-    cache_control_for_etags: @static_cache_control,
+    cache_control_for_etags: @static_cache_disabled,
     headers: %{
-      "cache-control" => @static_cache_control
+      "cache-control" => @static_cache_disabled
     }
   )
 

lib/pleroma/web/federator.ex

@@ -6,9 +6,9 @@ defmodule Pleroma.Web.Federator do
   alias Pleroma.Activity
   alias Pleroma.Object.Containment
   alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Publisher
   alias Pleroma.Web.ActivityPub.Transmogrifier
   alias Pleroma.Web.ActivityPub.Utils
-  alias Pleroma.Web.Federator.Publisher
   alias Pleroma.Workers.PublisherWorker
   alias Pleroma.Workers.ReceiverWorker
 
@@ -68,10 +68,8 @@ defmodule Pleroma.Web.Federator do
 
   # Job Worker Callbacks
 
-  @spec perform(atom(), module(), any()) :: {:ok, any()} | {:error, any()}
-  def perform(:publish_one, module, params) do
-    apply(module, :publish_one, [params])
-  end
+  @spec perform(atom(), any()) :: {:ok, any()} | {:error, any()}
+  def perform(:publish_one, params), do: Publisher.publish_one(params)
 
   def perform(:publish, activity) do
     Logger.debug(fn -> "Running publish for #{activity.data["id"]}" end)

lib/pleroma/web/federator/publisher.ex

@@ -1,110 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Pleroma.Web.Federator.Publisher do
-  alias Pleroma.Activity
-  alias Pleroma.Config
-  alias Pleroma.User
-  alias Pleroma.Workers.PublisherWorker
-
-  require Logger
-
-  @moduledoc """
-  Defines the contract used by federation implementations to publish messages to
-  their peers.
-  """
-
-  @doc """
-  Determine whether an activity can be relayed using the federation module.
-  """
-  @callback is_representable?(Pleroma.Activity.t()) :: boolean()
-
-  @doc """
-  Relays an activity to a specified peer, determined by the parameters.  The
-  parameters used are controlled by the federation module.
-  """
-  @callback publish_one(Map.t()) :: {:ok, Map.t()} | {:error, any()}
-
-  @doc """
-  Enqueue publishing a single activity.
-  """
-  @spec enqueue_one(module(), Map.t(), Keyword.t()) :: {:ok, %Oban.Job{}}
-  def enqueue_one(module, %{} = params, worker_args \\ []) do
-    PublisherWorker.enqueue(
-      "publish_one",
-      %{"module" => to_string(module), "params" => params},
-      worker_args
-    )
-  end
-
-  @doc """
-  Relays an activity to all specified peers.
-  """
-  @callback publish(User.t(), Activity.t()) :: :ok | {:error, any()}
-
-  @spec publish(User.t(), Activity.t()) :: :ok
-  def publish(%User{} = user, %Activity{} = activity) do
-    Config.get([:instance, :federation_publisher_modules])
-    |> Enum.each(fn module ->
-      if module.is_representable?(activity) do
-        Logger.debug("Publishing #{activity.data["id"]} using #{inspect(module)}")
-        module.publish(user, activity)
-      end
-    end)
-
-    :ok
-  end
-
-  @doc """
-  Gathers links used by an outgoing federation module for WebFinger output.
-  """
-  @callback gather_webfinger_links(User.t()) :: list()
-
-  @spec gather_webfinger_links(User.t()) :: list()
-  def gather_webfinger_links(%User{} = user) do
-    Config.get([:instance, :federation_publisher_modules])
-    |> Enum.reduce([], fn module, links ->
-      links ++ module.gather_webfinger_links(user)
-    end)
-  end
-
-  @doc """
-  Gathers nodeinfo protocol names supported by the federation module.
-  """
-  @callback gather_nodeinfo_protocol_names() :: list()
-
-  @spec gather_nodeinfo_protocol_names() :: list()
-  def gather_nodeinfo_protocol_names do
-    Config.get([:instance, :federation_publisher_modules])
-    |> Enum.reduce([], fn module, links ->
-      links ++ module.gather_nodeinfo_protocol_names()
-    end)
-  end
-
-  @doc """
-  Gathers a set of remote users given an IR envelope.
-  """
-  def remote_users(%User{id: user_id}, %{data: %{"to" => to} = data}) do
-    cc = Map.get(data, "cc", [])
-
-    bcc =
-      data
-      |> Map.get("bcc", [])
-      |> Enum.reduce([], fn ap_id, bcc ->
-        case Pleroma.List.get_by_ap_id(ap_id) do
-          %Pleroma.List{user_id: ^user_id} = list ->
-            {:ok, following} = Pleroma.List.get_following(list)
-            bcc ++ Enum.map(following, & &1.ap_id)
-
-          _ ->
-            bcc
-        end
-      end)
-
-    [to, cc, bcc]
-    |> Enum.concat()
-    |> Enum.map(&User.get_cached_by_ap_id/1)
-    |> Enum.filter(fn user -> user && !user.local end)
-  end
-end

lib/pleroma/web/feed/feed_view.ex

@@ -132,7 +132,7 @@ defmodule Pleroma.Web.Feed.FeedView do
     |> safe_to_string()
   end
 
-  @spec to_rfc3339(String.t() | NativeDateTime.t()) :: String.t()
+  @spec to_rfc3339(String.t() | NaiveDateTime.t()) :: String.t()
   def to_rfc3339(date) when is_binary(date) do
     date
     |> Timex.parse!("{ISO:Extended}")
@@ -145,7 +145,7 @@ defmodule Pleroma.Web.Feed.FeedView do
     |> Timex.format!("{RFC3339}")
   end
 
-  @spec to_rfc2822(String.t() | DateTime.t() | NativeDateTime.t()) :: String.t()
+  @spec to_rfc2822(String.t() | DateTime.t() | NaiveDateTime.t()) :: String.t()
   def to_rfc2822(datestr) when is_binary(datestr) do
     datestr
     |> Timex.parse!("{ISO:Extended}")

lib/pleroma/web/gettext.ex

@@ -85,12 +85,12 @@ defmodule Pleroma.Web.Gettext do
     Process.get({Pleroma.Web.Gettext, :locales}, [])
   end
 
-  def is_locale_list(locales) do
+  def locale_list?(locales) do
     Enum.all?(locales, &is_binary/1)
   end
 
   def put_locales(locales) do
-    if is_locale_list(locales) do
+    if locale_list?(locales) do
       Process.put({Pleroma.Web.Gettext, :locales}, Enum.uniq(locales))
       Gettext.put_locale(Enum.at(locales, 0, Gettext.get_locale()))
       :ok

lib/pleroma/web/mastodon_api/controllers/account_controller.ex

@@ -30,7 +30,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   alias Pleroma.Web.TwitterAPI.TwitterAPI
   alias Pleroma.Web.Utils.Params
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(:skip_auth when action in [:create, :lookup])
 
@@ -92,7 +92,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
 
   plug(
     RateLimiter,
-    [name: :relation_id_action, params: [:id, :uri]] when action in @relationship_actions
+    [name: :relation_id_action, params: ["id", "uri"]] when action in @relationship_actions
   )
 
   plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
@@ -104,7 +104,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AccountOperation
 
   @doc "POST /api/v1/accounts"
-  def create(%{assigns: %{app: app}, body_params: params} = conn, _params) do
+  def create(
+        %{assigns: %{app: app}, private: %{open_api_spex: %{body_params: params}}} = conn,
+        _params
+      ) do
     with :ok <- validate_email_param(params),
          :ok <- TwitterAPI.validate_captcha(app, params),
          {:ok, user} <- TwitterAPI.register_user(params),
@@ -168,7 +171,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   end
 
   @doc "PATCH /api/v1/accounts/update_credentials"
-  def update_credentials(%{assigns: %{user: user}, body_params: params} = conn, _params) do
+  def update_credentials(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn,
+        _params
+      ) do
     params =
       params
       |> Enum.filter(fn {_, value} -> not is_nil(value) end)
@@ -235,7 +241,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
     # So we first build the normal local changeset, then apply it to the
     # user data, but don't persist it. With this, we generate the object
     # data for our update activity. We feed this and the changeset as meta
-    # inforation into the pipeline, where they will be properly updated and
+    # information into the pipeline, where they will be properly updated and
     # federated.
     with changeset <- User.update_changeset(user, user_params),
          {:ok, unpersisted_user} <- Ecto.Changeset.apply_action(changeset, :update),
@@ -289,7 +295,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   end
 
   @doc "GET /api/v1/accounts/relationships"
-  def relationships(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def relationships(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     targets = User.get_all_by_ids(List.wrap(id))
 
     render(conn, "relationships.json", user: user, targets: targets)
@@ -299,7 +308,13 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])
 
   @doc "GET /api/v1/accounts/:id"
-  def show(%{assigns: %{user: for_user}} = conn, %{id: nickname_or_id} = params) do
+  def show(
+        %{
+          assigns: %{user: for_user},
+          private: %{open_api_spex: %{params: %{id: nickname_or_id} = params}}
+        } = conn,
+        _params
+      ) do
     with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
          :visible <- User.visible_for(user, for_user) do
       render(conn, "show.json",
@@ -313,7 +328,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   end
 
   @doc "GET /api/v1/accounts/:id/statuses"
-  def statuses(%{assigns: %{user: reading_user}} = conn, params) do
+  def statuses(
+        %{assigns: %{user: reading_user}, private: %{open_api_spex: %{params: params}}} = conn,
+        _params
+      ) do
     with %User{} = user <- User.get_cached_by_nickname_or_id(params.id, for: reading_user),
          :visible <- User.visible_for(user, reading_user) do
       params =
@@ -348,7 +366,11 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   end
 
   @doc "GET /api/v1/accounts/:id/followers"
-  def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
+  def followers(
+        %{assigns: %{user: for_user, account: user}, private: %{open_api_spex: %{params: params}}} =
+          conn,
+        _params
+      ) do
     params =
       params
       |> Enum.map(fn {key, value} -> {to_string(key), value} end)
@@ -373,7 +395,11 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   end
 
   @doc "GET /api/v1/accounts/:id/following"
-  def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
+  def following(
+        %{assigns: %{user: for_user, account: user}, private: %{open_api_spex: %{params: params}}} =
+          conn,
+        _params
+      ) do
     params =
       params
       |> Enum.map(fn {key, value} -> {to_string(key), value} end)
@@ -411,7 +437,13 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
     {:error, "Can not follow yourself"}
   end
 
-  def follow(%{body_params: params, assigns: %{user: follower, account: followed}} = conn, _) do
+  def follow(
+        %{
+          assigns: %{user: follower, account: followed},
+          private: %{open_api_spex: %{body_params: params}}
+        } = conn,
+        _
+      ) do
     with {:ok, follower} <- MastodonAPI.follow(follower, followed, params) do
       render(conn, "relationship.json", user: follower, target: followed)
     else
@@ -431,7 +463,13 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   end
 
   @doc "POST /api/v1/accounts/:id/mute"
-  def mute(%{assigns: %{user: muter, account: muted}, body_params: params} = conn, _params) do
+  def mute(
+        %{
+          assigns: %{user: muter, account: muted},
+          private: %{open_api_spex: %{body_params: params}}
+        } = conn,
+        _params
+      ) do
     params =
       params
       |> Map.put_new(:duration, Map.get(params, :expires_in, 0))
@@ -472,7 +510,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
 
   @doc "POST /api/v1/accounts/:id/note"
   def note(
-        %{assigns: %{user: noter, account: target}, body_params: %{comment: comment}} = conn,
+        %{
+          assigns: %{user: noter, account: target},
+          private: %{open_api_spex: %{body_params: %{comment: comment}}}
+        } = conn,
         _params
       ) do
     with {:ok, _user_note} <- UserNote.create(noter, target, comment) do
@@ -513,7 +554,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   end
 
   @doc "POST /api/v1/follows"
-  def follow_by_uri(%{body_params: %{uri: uri}} = conn, _) do
+  def follow_by_uri(%{private: %{open_api_spex: %{body_params: %{uri: uri}}}} = conn, _) do
     case User.get_cached_by_nickname(uri) do
       %User{} = user ->
         conn
@@ -561,7 +602,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   end
 
   @doc "GET /api/v1/accounts/lookup"
-  def lookup(conn, %{acct: nickname} = _params) do
+  def lookup(%{private: %{open_api_spex: %{params: %{acct: nickname}}}} = conn, _params) do
     with %User{} = user <- User.get_by_nickname(nickname) do
       render(conn, "show.json",
         user: user,

lib/pleroma/web/mastodon_api/controllers/directory_controller.ex

@@ -15,7 +15,7 @@ defmodule Pleroma.Web.MastodonAPI.DirectoryController do
 
   plug(Pleroma.Web.ApiSpec.CastAndValidate)
 
-  plug(:skip_auth when action == "index")
+  plug(:skip_auth when action == :index)
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.DirectoryOperation
 

lib/pleroma/web/mastodon_api/controllers/domain_block_controller.ex

@@ -8,7 +8,7 @@ defmodule Pleroma.Web.MastodonAPI.DomainBlockController do
   alias Pleroma.User
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.DomainBlockOperation
 
   plug(
@@ -27,23 +27,31 @@ defmodule Pleroma.Web.MastodonAPI.DomainBlockController do
   end
 
   @doc "POST /api/v1/domain_blocks"
-  def create(%{assigns: %{user: blocker}, body_params: %{domain: domain}} = conn, _params) do
+  def create(
+        %{assigns: %{user: blocker}, private: %{open_api_spex: %{body_params: %{domain: domain}}}} =
+          conn,
+        _params
+      ) do
     User.block_domain(blocker, domain)
     json(conn, %{})
   end
 
-  def create(%{assigns: %{user: blocker}} = conn, %{domain: domain}) do
+  def create(%{assigns: %{user: blocker}} = conn, %{"domain" => domain}) do
     User.block_domain(blocker, domain)
     json(conn, %{})
   end
 
   @doc "DELETE /api/v1/domain_blocks"
-  def delete(%{assigns: %{user: blocker}, body_params: %{domain: domain}} = conn, _params) do
+  def delete(
+        %{assigns: %{user: blocker}, private: %{open_api_spex: %{body_params: %{domain: domain}}}} =
+          conn,
+        _params
+      ) do
     User.unblock_domain(blocker, domain)
     json(conn, %{})
   end
 
-  def delete(%{assigns: %{user: blocker}} = conn, %{domain: domain}) do
+  def delete(%{assigns: %{user: blocker}} = conn, %{"domain" => domain}) do
     User.unblock_domain(blocker, domain)
     json(conn, %{})
   end

lib/pleroma/web/mastodon_api/controllers/follow_request_controller.ex

@@ -9,7 +9,7 @@ defmodule Pleroma.Web.MastodonAPI.FollowRequestController do
   alias Pleroma.Web.CommonAPI
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(:assign_follower when action != :index)
 
   action_fallback(:errors)
@@ -44,7 +44,7 @@ defmodule Pleroma.Web.MastodonAPI.FollowRequestController do
     end
   end
 
-  defp assign_follower(%{params: %{id: id}} = conn, _) do
+  defp assign_follower(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     case User.get_cached_by_id(id) do
       %User{} = follower -> assign(conn, :follower, follower)
       nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) |> halt()

lib/pleroma/web/mastodon_api/controllers/list_controller.ex

@@ -11,7 +11,7 @@ defmodule Pleroma.Web.MastodonAPI.ListController do
 
   @oauth_read_actions [:index, :show, :list_accounts]
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(:list_by_id_and_user when action not in [:index, :create])
   plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action in @oauth_read_actions)
   plug(OAuthScopesPlug, %{scopes: ["write:lists"]} when action not in @oauth_read_actions)
@@ -21,25 +21,33 @@ defmodule Pleroma.Web.MastodonAPI.ListController do
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ListOperation
 
   # GET /api/v1/lists
-  def index(%{assigns: %{user: user}} = conn, opts) do
-    lists = Pleroma.List.for_user(user, opts)
+  def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
+    lists = Pleroma.List.for_user(user, params)
     render(conn, "index.json", lists: lists)
   end
 
   # POST /api/v1/lists
-  def create(%{assigns: %{user: user}, body_params: %{title: title}} = conn, _) do
+  def create(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{title: title}}}} =
+          conn,
+        _
+      ) do
     with {:ok, %Pleroma.List{} = list} <- Pleroma.List.create(title, user) do
       render(conn, "show.json", list: list)
     end
   end
 
-  # GET /api/v1/lists/:id
+  # GET /api/v1/lists/:idOB
   def show(%{assigns: %{list: list}} = conn, _) do
     render(conn, "show.json", list: list)
   end
 
   # PUT /api/v1/lists/:id
-  def update(%{assigns: %{list: list}, body_params: %{title: title}} = conn, _) do
+  def update(
+        %{assigns: %{list: list}, private: %{open_api_spex: %{body_params: %{title: title}}}} =
+          conn,
+        _
+      ) do
     with {:ok, list} <- Pleroma.List.rename(list, title) do
       render(conn, "show.json", list: list)
     end
@@ -62,7 +70,13 @@ defmodule Pleroma.Web.MastodonAPI.ListController do
   end
 
   # POST /api/v1/lists/:id/accounts
-  def add_to_list(%{assigns: %{list: list}, body_params: %{account_ids: account_ids}} = conn, _) do
+  def add_to_list(
+        %{
+          assigns: %{list: list},
+          private: %{open_api_spex: %{body_params: %{account_ids: account_ids}}}
+        } = conn,
+        _
+      ) do
     Enum.each(account_ids, fn account_id ->
       with %User{} = followed <- User.get_cached_by_id(account_id) do
         Pleroma.List.follow(list, followed)
@@ -74,9 +88,22 @@ defmodule Pleroma.Web.MastodonAPI.ListController do
 
   # DELETE /api/v1/lists/:id/accounts
   def remove_from_list(
-        %{assigns: %{list: list}, params: %{account_ids: account_ids}} = conn,
+        %{
+          private: %{open_api_spex: %{params: %{account_ids: account_ids}}}
+        } = conn,
         _
       ) do
+    do_remove_from_list(conn, account_ids)
+  end
+
+  def remove_from_list(
+        %{private: %{open_api_spex: %{body_params: %{account_ids: account_ids}}}} = conn,
+        _
+      ) do
+    do_remove_from_list(conn, account_ids)
+  end
+
+  defp do_remove_from_list(%{assigns: %{list: list}} = conn, account_ids) do
     Enum.each(account_ids, fn account_id ->
       with %User{} = followed <- User.get_cached_by_id(account_id) do
         Pleroma.List.unfollow(list, followed)
@@ -86,11 +113,10 @@ defmodule Pleroma.Web.MastodonAPI.ListController do
     json(conn, %{})
   end
 
-  def remove_from_list(%{body_params: params} = conn, _) do
-    remove_from_list(%{conn | params: params}, %{})
-  end
-
-  defp list_by_id_and_user(%{assigns: %{user: user}, params: %{id: id}} = conn, _) do
+  defp list_by_id_and_user(
+         %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+         _
+       ) do
     case Pleroma.List.get(id, user) do
       %Pleroma.List{} = list -> assign(conn, :list, list)
       nil -> conn |> render_error(:not_found, "List not found") |> halt()

lib/pleroma/web/mastodon_api/controllers/media_controller.ex

@@ -12,7 +12,7 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
 
   action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
   plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:create, :create2])
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(OAuthScopesPlug, %{scopes: ["read:media"]} when action == :show)
   plug(OAuthScopesPlug, %{scopes: ["write:media"]} when action != :show)
@@ -20,7 +20,11 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.MediaOperation
 
   @doc "POST /api/v1/media"
-  def create(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
+  def create(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file} = data}}} =
+          conn,
+        _
+      ) do
     with {:ok, object} <-
            ActivityPub.upload(
              file,
@@ -36,7 +40,11 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
   def create(_conn, _data), do: {:error, :bad_request}
 
   @doc "POST /api/v2/media"
-  def create2(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
+  def create2(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file} = data}}} =
+          conn,
+        _
+      ) do
     with {:ok, object} <-
            ActivityPub.upload(
              file,
@@ -54,7 +62,15 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
   def create2(_conn, _data), do: {:error, :bad_request}
 
   @doc "PUT /api/v1/media/:id"
-  def update(%{assigns: %{user: user}, body_params: %{description: description}} = conn, %{id: id}) do
+  def update(
+        %{
+          assigns: %{user: user},
+          private: %{
+            open_api_spex: %{body_params: %{description: description}, params: %{id: id}}
+          }
+        } = conn,
+        _
+      ) do
     with %Object{} = object <- Object.get_by_id(id),
          :ok <- Object.authorize_access(object, user),
          {:ok, %Object{data: data}} <- Object.update_data(object, %{"name" => description}) do
@@ -67,7 +83,7 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
   def update(conn, data), do: show(conn, data)
 
   @doc "GET /api/v1/media/:id"
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %Object{data: data, id: object_id} = object <- Object.get_by_id(id),
          :ok <- Object.authorize_access(object, user) do
       attachment_data = Map.put(data, "id", object_id)

lib/pleroma/web/mastodon_api/controllers/notification_controller.ex

@@ -13,7 +13,7 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
 
   @oauth_read_actions [:show, :index]
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -24,8 +24,20 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.NotificationOperation
 
+  @default_notification_types ~w{
+      mention
+      follow
+      follow_request
+      reblog
+      favourite
+      move
+      pleroma:emoji_reaction
+      poll
+      update
+    }
+
   # GET /api/v1/notifications
-  def index(conn, %{account_id: account_id} = params) do
+  def index(%{private: %{open_api_spex: %{params: %{account_id: account_id} = params}}} = conn, _) do
     case Pleroma.User.get_cached_by_id(account_id) do
       %{ap_id: account_ap_id} ->
         params =
@@ -33,7 +45,7 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
           |> Map.delete(:account_id)
           |> Map.put(:account_ap_id, account_ap_id)
 
-        index(conn, params)
+        do_get_notifications(conn, params)
 
       _ ->
         conn
@@ -42,18 +54,11 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
     end
   end
 
-  @default_notification_types ~w{
-    mention
-    follow
-    follow_request
-    reblog
-    favourite
-    move
-    pleroma:emoji_reaction
-    poll
-    update
-  }
-  def index(%{assigns: %{user: user}} = conn, params) do
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
+    do_get_notifications(conn, params)
+  end
+
+  defp do_get_notifications(%{assigns: %{user: user}} = conn, params) do
     params =
       Map.new(params, fn {k, v} -> {to_string(k), v} end)
       |> Map.put_new("types", Map.get(params, :include_types, @default_notification_types))
@@ -69,7 +74,7 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
   end
 
   # GET /api/v1/notifications/:id
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with {:ok, notification} <- Notification.get(user, id) do
       render(conn, "show.json", notification: notification, for: user)
     else
@@ -88,8 +93,20 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
 
   # POST /api/v1/notifications/:id/dismiss
 
-  def dismiss(%{assigns: %{user: user}} = conn, %{id: id} = _params) do
-    with {:ok, _notif} <- Notification.dismiss(user, id) do
+  def dismiss(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
+    do_dismiss(conn, id)
+  end
+
+  # POST /api/v1/notifications/dismiss (deprecated)
+  def dismiss_via_body(
+        %{private: %{open_api_spex: %{body_params: %{id: id}}}} = conn,
+        _
+      ) do
+    do_dismiss(conn, id)
+  end
+
+  defp do_dismiss(%{assigns: %{user: user}} = conn, notification_id) do
+    with {:ok, _notif} <- Notification.dismiss(user, notification_id) do
       json(conn, %{})
     else
       {:error, reason} ->
@@ -99,13 +116,11 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
     end
   end
 
-  # POST /api/v1/notifications/dismiss (deprecated)
-  def dismiss_via_body(%{body_params: params} = conn, _) do
-    dismiss(conn, params)
-  end
-
   # DELETE /api/v1/notifications/destroy_multiple
-  def destroy_multiple(%{assigns: %{user: user}} = conn, %{ids: ids} = _params) do
+  def destroy_multiple(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{ids: ids}}}} = conn,
+        _
+      ) do
     Notification.destroy_multiple(user, ids)
     json(conn, %{})
   end

lib/pleroma/web/mastodon_api/controllers/poll_controller.ex

@@ -15,7 +15,7 @@ defmodule Pleroma.Web.MastodonAPI.PollController do
 
   action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -29,7 +29,7 @@ defmodule Pleroma.Web.MastodonAPI.PollController do
   @cachex Pleroma.Config.get([:cachex, :provider], Cachex)
 
   @doc "GET /api/v1/polls/:id"
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %Object{} = object <- Object.get_by_id_and_maybe_refetch(id, interval: 60),
          %Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
          true <- Visibility.visible_for_user?(activity, user) do
@@ -41,7 +41,13 @@ defmodule Pleroma.Web.MastodonAPI.PollController do
   end
 
   @doc "POST /api/v1/polls/:id/votes"
-  def vote(%{assigns: %{user: user}, body_params: %{choices: choices}} = conn, %{id: id}) do
+  def vote(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{choices: choices}, params: %{id: id}}}
+        } = conn,
+        _
+      ) do
     with %Object{data: %{"type" => "Question"}} = object <- Object.get_by_id(id),
          %Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
          true <- Visibility.visible_for_user?(activity, user),

lib/pleroma/web/mastodon_api/controllers/scheduled_activity_controller.ex

@@ -13,7 +13,7 @@ defmodule Pleroma.Web.MastodonAPI.ScheduledActivityController do
 
   @oauth_read_actions [:show, :index]
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["read:statuses"]} when action in @oauth_read_actions)
   plug(OAuthScopesPlug, %{scopes: ["write:statuses"]} when action not in @oauth_read_actions)
   plug(:assign_scheduled_activity when action != :index)
@@ -23,7 +23,7 @@ defmodule Pleroma.Web.MastodonAPI.ScheduledActivityController do
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ScheduledActivityOperation
 
   @doc "GET /api/v1/scheduled_statuses"
-  def index(%{assigns: %{user: user}} = conn, params) do
+  def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     params = Map.new(params, fn {key, value} -> {to_string(key), value} end)
 
     with scheduled_activities <- MastodonAPI.get_scheduled_activities(user, params) do
@@ -39,7 +39,13 @@ defmodule Pleroma.Web.MastodonAPI.ScheduledActivityController do
   end
 
   @doc "PUT /api/v1/scheduled_statuses/:id"
-  def update(%{assigns: %{scheduled_activity: scheduled_activity}, body_params: params} = conn, _) do
+  def update(
+        %{
+          assigns: %{scheduled_activity: scheduled_activity},
+          private: %{open_api_spex: %{body_params: params}}
+        } = conn,
+        _
+      ) do
     with {:ok, scheduled_activity} <- ScheduledActivity.update(scheduled_activity, params) do
       render(conn, "show.json", scheduled_activity: scheduled_activity)
     end
@@ -52,7 +58,10 @@ defmodule Pleroma.Web.MastodonAPI.ScheduledActivityController do
     end
   end
 
-  defp assign_scheduled_activity(%{assigns: %{user: user}, params: %{id: id}} = conn, _) do
+  defp assign_scheduled_activity(
+         %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+         _
+       ) do
     case ScheduledActivity.get(user, id) do
       %ScheduledActivity{} = activity -> assign(conn, :scheduled_activity, activity)
       nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) |> halt()

lib/pleroma/web/mastodon_api/controllers/search_controller.ex

@@ -18,7 +18,7 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
 
   @search_limit 40
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   # Note: Mastodon doesn't allow unauthenticated access (requires read:accounts / read:search)
   plug(OAuthScopesPlug, %{scopes: ["read:search"], fallback: :proceed_unauthenticated})
@@ -29,7 +29,11 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.SearchOperation
 
-  def account_search(%{assigns: %{user: user}} = conn, %{q: query} = params) do
+  def account_search(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{q: query} = params}}} =
+          conn,
+        _
+      ) do
     accounts = User.search(query, search_options(params, user))
 
     conn
@@ -44,7 +48,12 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
   def search2(conn, params), do: do_search(:v2, conn, params)
   def search(conn, params), do: do_search(:v1, conn, params)
 
-  defp do_search(version, %{assigns: %{user: user}} = conn, %{q: query} = params) do
+  defp do_search(
+         version,
+         %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{q: query} = params}}} =
+           conn,
+         _
+       ) do
     query = String.trim(query)
     options = search_options(params, user)
     timeout = Keyword.get(Repo.config(), :timeout, 15_000)
@@ -147,7 +156,7 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
         tags
       end
 
-    Pleroma.Pagination.paginate(tags, options)
+    Pleroma.Pagination.paginate_list(tags, options)
   end
 
   defp add_joined_tag(tags) do

lib/pleroma/web/mastodon_api/controllers/status_controller.ex

@@ -25,7 +25,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   alias Pleroma.Web.Plugs.OAuthScopesPlug
   alias Pleroma.Web.Plugs.RateLimiter
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(:skip_public_check when action in [:index, :show])
 
@@ -110,7 +110,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
 
   `ids` query param is required
   """
-  def index(%{assigns: %{user: user}} = conn, %{ids: ids} = params) do
+  def index(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{ids: ids} = params}}} =
+          conn,
+        _
+      ) do
     limit = 100
 
     activities =
@@ -134,7 +138,9 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   def create(
         %{
           assigns: %{user: user},
-          body_params: %{status: _, scheduled_at: scheduled_at} = params
+          private: %{
+            open_api_spex: %{body_params: %{status: _, scheduled_at: scheduled_at} = params}
+          }
         } = conn,
         _
       )
@@ -156,7 +162,13 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
     else
       {:far_enough, _} ->
         params = Map.drop(params, [:scheduled_at])
-        create(%Plug.Conn{conn | body_params: params}, %{})
+
+        put_in(
+          conn,
+          [Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
+          params
+        )
+        |> do_create
 
       error ->
         error
@@ -164,7 +176,35 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   # Creates a regular status
-  def create(%{assigns: %{user: user}, body_params: %{status: _} = params} = conn, _) do
+  def create(
+        %{
+          private: %{open_api_spex: %{body_params: %{status: _}}}
+        } = conn,
+        _
+      ) do
+    do_create(conn)
+  end
+
+  def create(
+        %{
+          assigns: %{user: _user},
+          private: %{open_api_spex: %{body_params: %{media_ids: _} = params}}
+        } = conn,
+        _
+      ) do
+    params = Map.put(params, :status, "")
+
+    put_in(
+      conn,
+      [Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
+      params
+    )
+    |> do_create
+  end
+
+  defp do_create(
+         %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn
+       ) do
     params =
       Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
       |> put_application(conn)
@@ -189,13 +229,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
     end
   end
 
-  def create(%{assigns: %{user: _user}, body_params: %{media_ids: _} = params} = conn, _) do
-    params = Map.put(params, :status, "")
-    create(%Plug.Conn{conn | body_params: params}, %{})
-  end
-
   @doc "GET /api/v1/statuses/:id/history"
-  def show_history(%{assigns: assigns} = conn, %{id: id} = params) do
+  def show_history(
+        %{assigns: assigns, private: %{open_api_spex: %{params: %{id: id} = params}}} = conn,
+        _
+      ) do
     with user = assigns[:user],
          %Activity{} = activity <- Activity.get_by_id_with_object(id),
          true <- Visibility.visible_for_user?(activity, user) do
@@ -211,7 +249,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/statuses/:id/source"
-  def show_source(%{assigns: assigns} = conn, %{id: id} = _params) do
+  def show_source(%{assigns: assigns, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with user = assigns[:user],
          %Activity{} = activity <- Activity.get_by_id_with_object(id),
          true <- Visibility.visible_for_user?(activity, user) do
@@ -225,7 +263,13 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "PUT /api/v1/statuses/:id"
-  def update(%{assigns: %{user: user}, body_params: body_params} = conn, %{id: id} = params) do
+  def update(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: body_params, params: %{id: id} = params}}
+        } = conn,
+        _
+      ) do
     with {_, %Activity{}} = {_, activity} <- {:activity, Activity.get_by_id_with_object(id)},
          {_, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
          {_, true} <- {:is_create, activity.data["type"] == "Create"},
@@ -248,7 +292,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/statuses/:id"
-  def show(%{assigns: %{user: user}} = conn, %{id: id} = params) do
+  def show(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id} = params}}} =
+          conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          true <- Visibility.visible_for_user?(activity, user) do
       try_render(conn, "show.json",
@@ -263,7 +311,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "DELETE /api/v1/statuses/:id"
-  def delete(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def delete(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
       try_render(conn, "show.json",
@@ -278,7 +326,13 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/reblog"
-  def reblog(%{assigns: %{user: user}, body_params: params} = conn, %{id: ap_id_or_id}) do
+  def reblog(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: params, params: %{id: ap_id_or_id}}}
+        } = conn,
+        _
+      ) do
     with {:ok, announce} <- CommonAPI.repeat(ap_id_or_id, user, params),
          %Activity{} = announce <- Activity.normalize(announce.data) do
       try_render(conn, "show.json", %{activity: announce, for: user, as: :activity})
@@ -286,7 +340,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/unreblog"
-  def unreblog(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
+  def unreblog(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, _unannounce} <- CommonAPI.unrepeat(activity_id, user),
          %Activity{} = activity <- Activity.get_by_id(activity_id) do
       try_render(conn, "show.json", %{activity: activity, for: user, as: :activity})
@@ -294,7 +352,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/favourite"
-  def favourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
+  def favourite(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, _fav} <- CommonAPI.favorite(user, activity_id),
          %Activity{} = activity <- Activity.get_by_id(activity_id) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
@@ -302,7 +364,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/unfavourite"
-  def unfavourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
+  def unfavourite(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, _unfav} <- CommonAPI.unfavorite(activity_id, user),
          %Activity{} = activity <- Activity.get_by_id(activity_id) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
@@ -310,7 +376,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/pin"
-  def pin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
+  def pin(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
     else
@@ -329,14 +399,21 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/unpin"
-  def unpin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
+  def unpin(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
     end
   end
 
   @doc "POST /api/v1/statuses/:id/bookmark"
-  def bookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def bookmark(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          %User{} = user <- User.get_cached_by_nickname(user.nickname),
          true <- Visibility.visible_for_user?(activity, user),
@@ -346,7 +423,10 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/unbookmark"
-  def unbookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def unbookmark(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          %User{} = user <- User.get_cached_by_nickname(user.nickname),
          true <- Visibility.visible_for_user?(activity, user),
@@ -356,7 +436,13 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/mute"
-  def mute_conversation(%{assigns: %{user: user}, body_params: params} = conn, %{id: id}) do
+  def mute_conversation(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: params, params: %{id: id}}}
+        } = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id(id),
          {:ok, activity} <- CommonAPI.add_mute(user, activity, params) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
@@ -364,7 +450,13 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "POST /api/v1/statuses/:id/unmute"
-  def unmute_conversation(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def unmute_conversation(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{params: %{id: id}}}
+        } = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id(id),
          {:ok, activity} <- CommonAPI.remove_mute(user, activity) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
@@ -373,7 +465,10 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
 
   @doc "GET /api/v1/statuses/:id/card"
   @deprecated "https://github.com/tootsuite/mastodon/pull/11213"
-  def card(%{assigns: %{user: user}} = conn, %{id: status_id}) do
+  def card(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: status_id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id(status_id),
          true <- Visibility.visible_for_user?(activity, user) do
       data = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
@@ -384,7 +479,10 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/statuses/:id/favourited_by"
-  def favourited_by(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def favourited_by(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with true <- Pleroma.Config.get([:instance, :show_reactions]),
          %Activity{} = activity <- Activity.get_by_id_with_object(id),
          {:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
@@ -405,7 +503,10 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/statuses/:id/reblogged_by"
-  def reblogged_by(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def reblogged_by(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          {:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
          %Object{data: %{"announcements" => announces, "id" => ap_id}} <-
@@ -437,7 +538,10 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/statuses/:id/context"
-  def context(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def context(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id(id) do
       activities =
         ActivityPub.fetch_activities_for_context(activity.data["context"], %{
@@ -451,7 +555,10 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/favourites"
-  def favourites(%{assigns: %{user: %User{} = user}} = conn, params) do
+  def favourites(
+        %{assigns: %{user: %User{} = user}, private: %{open_api_spex: %{params: params}}} = conn,
+        _
+      ) do
     activities = ActivityPub.fetch_favourites(user, params)
 
     conn
@@ -464,7 +571,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   end
 
   @doc "GET /api/v1/bookmarks"
-  def bookmarks(%{assigns: %{user: user}} = conn, params) do
+  def bookmarks(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     user = User.get_cached_by_id(user.id)
 
     bookmarks =

lib/pleroma/web/mastodon_api/views/account_view.ex

@@ -194,6 +194,8 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
   end
 
   defp do_render("show.json", %{user: user} = opts) do
+    self = opts[:for] == user
+
     user = User.sanitize_html(user, User.html_filter_policy(opts[:for]))
     display_name = user.name || user.nickname
 
@@ -203,16 +205,16 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
     header_static = User.banner_url(user) |> MediaProxy.preview_url(static: true)
 
     following_count =
-      if !user.hide_follows_count or !user.hide_follows or opts[:for] == user,
+      if !user.hide_follows_count or !user.hide_follows or self,
         do: user.following_count,
         else: 0
 
     followers_count =
-      if !user.hide_followers_count or !user.hide_followers or opts[:for] == user,
+      if !user.hide_followers_count or !user.hide_followers or self,
         do: user.follower_count,
         else: 0
 
-    bot = user.actor_type == "Service"
+    bot = bot?(user)
 
     emojis =
       Enum.map(user.emoji, fn {shortcode, raw_url} ->
@@ -468,4 +470,12 @@ defmodule Pleroma.Web.MastodonAPI.AccountView do
 
   defp image_url(%{"url" => [%{"href" => href} | _]}), do: href
   defp image_url(_), do: nil
+
+  defp bot?(user) do
+    # Because older and/or Mastodon clients may not recognize a Group actor properly,
+    # and currently the group actor can only boost things, we should let these clients
+    # think groups are bots.
+    # See https://git.pleroma.social/pleroma/pleroma-meta/-/issues/14
+    user.actor_type == "Service" || user.actor_type == "Group"
+  end
 end

lib/pleroma/web/mastodon_api/views/instance_view.ex

@@ -28,6 +28,7 @@ defmodule Pleroma.Web.MastodonAPI.InstanceView do
         |> to_string,
       registrations: Keyword.get(instance, :registrations_open),
       approval_required: Keyword.get(instance, :account_approval_required),
+      contact_account: contact_account(Keyword.get(instance, :contact_username)),
       configuration: configuration(),
       # Extra (not present in Mastodon):
       max_toot_chars: Keyword.get(instance, :limit),
@@ -40,6 +41,7 @@ defmodule Pleroma.Web.MastodonAPI.InstanceView do
       background_image: Pleroma.Web.Endpoint.url() <> Keyword.get(instance, :background_image),
       shout_limit: Config.get([:shout, :limit]),
       description_limit: Keyword.get(instance, :description_limit),
+      chat_limit: Keyword.get(instance, :chat_limit),
       pleroma: pleroma_configuration(instance)
     })
   end
@@ -62,11 +64,12 @@ defmodule Pleroma.Web.MastodonAPI.InstanceView do
       registrations: %{
         enabled: Keyword.get(instance, :registrations_open),
         approval_required: Keyword.get(instance, :account_approval_required),
-        message: nil
+        message: nil,
+        url: nil
       },
       contact: %{
         email: Keyword.get(instance, :email),
-        account: nil
+        account: contact_account(Keyword.get(instance, :contact_username))
       },
       # Extra (not present in Mastodon):
       pleroma: pleroma_configuration2(instance)
@@ -139,7 +142,8 @@ defmodule Pleroma.Web.MastodonAPI.InstanceView do
       if Config.get([:instance, :profile_directory]) do
         "profile_directory"
       end,
-      "pleroma:get:main/ostatus"
+      "pleroma:get:main/ostatus",
+      "pleroma:group_actors"
     ]
     |> Enum.filter(& &1)
   end
@@ -180,15 +184,35 @@ defmodule Pleroma.Web.MastodonAPI.InstanceView do
     }
   end
 
+  defp contact_account(nil), do: nil
+
+  defp contact_account("@" <> username) do
+    contact_account(username)
+  end
+
+  defp contact_account(username) do
+    user = Pleroma.User.get_cached_by_nickname(username)
+
+    if user do
+      Pleroma.Web.MastodonAPI.AccountView.render("show.json", %{user: user, for: nil})
+    else
+      nil
+    end
+  end
+
   defp configuration do
     %{
+      accounts: %{
+        max_featured_tags: 0
+      },
       statuses: %{
         max_characters: Config.get([:instance, :limit]),
         max_media_attachments: Config.get([:instance, :max_media_attachments])
       },
       media_attachments: %{
         image_size_limit: Config.get([:instance, :upload_limit]),
-        video_size_limit: Config.get([:instance, :upload_limit])
+        video_size_limit: Config.get([:instance, :upload_limit]),
+        supported_mime_types: ["application/octet-stream"]
       },
       polls: %{
         max_options: Config.get([:instance, :poll_limits, :max_options]),
@@ -202,7 +226,13 @@ defmodule Pleroma.Web.MastodonAPI.InstanceView do
   defp configuration2 do
     configuration()
     |> Map.merge(%{
-      urls: %{streaming: Pleroma.Web.Endpoint.websocket_url()}
+      urls: %{
+        streaming: Pleroma.Web.Endpoint.websocket_url(),
+        status: Config.get([:instance, :status_page])
+      },
+      vapid: %{
+        public_key: Keyword.get(Pleroma.Web.Push.vapid_config(), :public_key)
+      }
     })
   end
 
@@ -235,6 +265,7 @@ defmodule Pleroma.Web.MastodonAPI.InstanceView do
           banner_upload_limit: Keyword.get(instance, :banner_upload_limit),
           background_image:
             Pleroma.Web.Endpoint.url() <> Keyword.get(instance, :background_image),
+          chat_limit: Keyword.get(instance, :chat_limit),
           description_limit: Keyword.get(instance, :description_limit),
           shout_limit: Config.get([:shout, :limit])
         })

lib/pleroma/web/mastodon_api/views/poll_view.ex

@@ -21,7 +21,10 @@ defmodule Pleroma.Web.MastodonAPI.PollView do
       votes_count: votes_count,
       voters_count: voters_count(object),
       options: options,
-      emojis: Pleroma.Web.MastodonAPI.StatusView.build_emojis(object.data["emoji"])
+      emojis: Pleroma.Web.MastodonAPI.StatusView.build_emojis(object.data["emoji"]),
+      pleroma: %{
+        non_anonymous: object.data["nonAnonymous"] || false
+      }
     }
 
     if params[:for] do

lib/pleroma/web/mastodon_api/views/status_view.ex

@@ -796,8 +796,6 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
     URI.merge(page_url_data, image_url_data) |> to_string
   end
 
-  defp build_image_url(_, _), do: nil
-
   defp get_source_text(%{"content" => content} = _source) do
     content
   end

lib/pleroma/web/mastodon_api/websocket_handler.ex

@@ -11,28 +11,21 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do
   alias Pleroma.Web.Streamer
   alias Pleroma.Web.StreamerView
 
-  @behaviour :cowboy_websocket
+  @behaviour Phoenix.Socket.Transport
 
   # Client ping period.
   @tick :timer.seconds(30)
-  # Cowboy timeout period.
-  @timeout :timer.seconds(60)
-  # Hibernate every X messages
-  @hibernate_every 100
 
-  def init(%{qs: qs} = req, state) do
-    with params <- Enum.into(:cow_qs.parse_qs(qs), %{}),
-         sec_websocket <- :cowboy_req.header("sec-websocket-protocol", req, nil),
-         access_token <- Map.get(params, "access_token"),
-         {:ok, user, oauth_token} <- authenticate_request(access_token, sec_websocket),
-         {:ok, topic} <- Streamer.get_topic(params["stream"], user, oauth_token, params) do
-      req =
-        if sec_websocket do
-          :cowboy_req.set_resp_header("sec-websocket-protocol", sec_websocket, req)
-        else
-          req
-        end
+  @impl Phoenix.Socket.Transport
+  def child_spec(_opts), do: :ignore
 
+  # This only prepares the connection and is not in the process yet
+  @impl Phoenix.Socket.Transport
+  def connect(%{params: params} = transport_info) do
+    with access_token <- Map.get(params, "access_token"),
+         {:ok, user, oauth_token} <- authenticate_request(access_token),
+         {:ok, topic} <-
+           Streamer.get_topic(params["stream"], user, oauth_token, params) do
       topics =
         if topic do
           [topic]
@@ -40,41 +33,40 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do
           []
         end
 
-      {:cowboy_websocket, req,
-       %{user: user, topics: topics, oauth_token: oauth_token, count: 0, timer: nil},
-       %{idle_timeout: @timeout}}
+      state = %{
+        user: user,
+        topics: topics,
+        oauth_token: oauth_token,
+        count: 0,
+        timer: nil
+      }
+
+      {:ok, state}
     else
       {:error, :bad_topic} ->
-        Logger.debug("#{__MODULE__} bad topic #{inspect(req)}")
-        req = :cowboy_req.reply(404, req)
-        {:ok, req, state}
+        Logger.debug("#{__MODULE__} bad topic #{inspect(transport_info)}")
+
+        {:error, :bad_topic}
 
       {:error, :unauthorized} ->
-        Logger.debug("#{__MODULE__} authentication error: #{inspect(req)}")
-        req = :cowboy_req.reply(401, req)
-        {:ok, req, state}
+        Logger.debug("#{__MODULE__} authentication error: #{inspect(transport_info)}")
+        {:error, :unauthorized}
     end
   end
 
-  def websocket_init(state) do
-    Logger.debug(
-      "#{__MODULE__} accepted websocket connection for user #{(state.user || %{id: "anonymous"}).id}, topics #{state.topics}"
-    )
-
+  # All subscriptions/links and messages cannot be created
+  # until the processed is launched with init/1
+  @impl Phoenix.Socket.Transport
+  def init(state) do
     Enum.each(state.topics, fn topic -> Streamer.add_socket(topic, state.oauth_token) end)
-    {:ok, %{state | timer: timer()}}
+
+    Process.send_after(self(), :ping, @tick)
+
+    {:ok, state}
   end
 
-  # Client's Pong frame.
-  def websocket_handle(:pong, state) do
-    if state.timer, do: Process.cancel_timer(state.timer)
-    {:ok, %{state | timer: timer()}}
-  end
-
-  # We only receive pings for now
-  def websocket_handle(:ping, state), do: {:ok, state}
-
-  def websocket_handle({:text, text}, state) do
+  @impl Phoenix.Socket.Transport
+  def handle_in({text, [opcode: :text]}, state) do
     with {:ok, %{} = event} <- Jason.decode(text) do
       handle_client_event(event, state)
     else
@@ -84,50 +76,47 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do
     end
   end
 
-  def websocket_handle(frame, state) do
+  def handle_in(frame, state) do
     Logger.error("#{__MODULE__} received frame: #{inspect(frame)}")
     {:ok, state}
   end
 
-  def websocket_info({:render_with_user, view, template, item, topic}, state) do
+  @impl Phoenix.Socket.Transport
+  def handle_info({:render_with_user, view, template, item, topic}, state) do
     user = %User{} = User.get_cached_by_ap_id(state.user.ap_id)
 
     unless Streamer.filtered_by_user?(user, item) do
-      websocket_info({:text, view.render(template, item, user, topic)}, %{state | user: user})
+      message = view.render(template, item, user, topic)
+      {:push, {:text, message}, %{state | user: user}}
     else
       {:ok, state}
     end
   end
 
-  def websocket_info({:text, message}, state) do
-    # If the websocket processed X messages, force an hibernate/GC.
-    # We don't hibernate at every message to balance CPU usage/latency with RAM usage.
-    if state.count > @hibernate_every do
-      {:reply, {:text, message}, %{state | count: 0}, :hibernate}
-    else
-      {:reply, {:text, message}, %{state | count: state.count + 1}}
-    end
+  def handle_info({:text, text}, state) do
+    {:push, {:text, text}, state}
   end
 
-  # Ping tick. We don't re-queue a timer there, it is instead queued when :pong is received.
-  # As we hibernate there, reset the count to 0.
-  # If the client misses :pong, Cowboy will automatically timeout the connection after
-  # `@idle_timeout`.
-  def websocket_info(:tick, state) do
-    {:reply, :ping, %{state | timer: nil, count: 0}, :hibernate}
+  def handle_info(:ping, state) do
+    Process.send_after(self(), :ping, @tick)
+
+    {:push, {:ping, ""}, state}
   end
 
-  def websocket_info(:close, state) do
-    {:stop, state}
+  def handle_info(:close, state) do
+    {:stop, {:closed, 'connection closed by server'}, state}
   end
 
-  # State can be `[]` only in case we terminate before switching to websocket,
-  # we already log errors for these cases in `init/1`, so just do nothing here
-  def terminate(_reason, _req, []), do: :ok
+  def handle_info(msg, state) do
+    Logger.debug("#{__MODULE__} received info: #{inspect(msg)}")
 
-  def terminate(reason, _req, state) do
+    {:ok, state}
+  end
+
+  @impl Phoenix.Socket.Transport
+  def terminate(reason, state) do
     Logger.debug(
-      "#{__MODULE__} terminating websocket connection for user #{(state.user || %{id: "anonymous"}).id}, topics #{state.topics || "?"}: #{inspect(reason)}"
+      "#{__MODULE__} terminating websocket connection for user #{(state.user || %{id: "anonymous"}).id}, topics #{state.topics || "?"}: #{inspect(reason)})"
     )
 
     Enum.each(state.topics, fn topic -> Streamer.remove_socket(topic) end)
@@ -135,16 +124,13 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do
   end
 
   # Public streams without authentication.
-  defp authenticate_request(nil, nil) do
+  defp authenticate_request(nil) do
     {:ok, nil, nil}
   end
 
   # Authenticated streams.
-  defp authenticate_request(access_token, sec_websocket) do
-    token = access_token || sec_websocket
-
-    with true <- is_bitstring(token),
-         oauth_token = %Token{user_id: user_id} <- Repo.get_by(Token, token: token),
+  defp authenticate_request(access_token) do
+    with oauth_token = %Token{user_id: user_id} <- Repo.get_by(Token, token: access_token),
          user = %User{} <- User.get_cached_by_id(user_id) do
       {:ok, user, oauth_token}
     else
@@ -152,36 +138,32 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do
     end
   end
 
-  defp timer do
-    Process.send_after(self(), :tick, @tick)
-  end
-
   defp handle_client_event(%{"type" => "subscribe", "stream" => _topic} = params, state) do
     with {_, {:ok, topic}} <-
            {:topic, Streamer.get_topic(params["stream"], state.user, state.oauth_token, params)},
          {_, false} <- {:subscribed, topic in state.topics} do
       Streamer.add_socket(topic, state.oauth_token)
 
-      {[
-         {:text,
-          StreamerView.render("pleroma_respond.json", %{type: "subscribe", result: "success"})}
-       ], %{state | topics: [topic | state.topics]}}
+      message =
+        StreamerView.render("pleroma_respond.json", %{type: "subscribe", result: "success"})
+
+      {:reply, :ok, {:text, message}, %{state | topics: [topic | state.topics]}}
     else
       {:subscribed, true} ->
-        {[
-           {:text,
-            StreamerView.render("pleroma_respond.json", %{type: "subscribe", result: "ignored"})}
-         ], state}
+        message =
+          StreamerView.render("pleroma_respond.json", %{type: "subscribe", result: "ignored"})
+
+        {:reply, :error, {:text, message}, state}
 
       {:topic, {:error, error}} ->
-        {[
-           {:text,
-            StreamerView.render("pleroma_respond.json", %{
-              type: "subscribe",
-              result: "error",
-              error: error
-            })}
-         ], state}
+        message =
+          StreamerView.render("pleroma_respond.json", %{
+            type: "subscribe",
+            result: "error",
+            error: error
+          })
+
+        {:reply, :error, {:text, message}, state}
     end
   end
 
@@ -191,26 +173,26 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do
          {_, true} <- {:subscribed, topic in state.topics} do
       Streamer.remove_socket(topic)
 
-      {[
-         {:text,
-          StreamerView.render("pleroma_respond.json", %{type: "unsubscribe", result: "success"})}
-       ], %{state | topics: List.delete(state.topics, topic)}}
+      message =
+        StreamerView.render("pleroma_respond.json", %{type: "unsubscribe", result: "success"})
+
+      {:reply, :ok, {:text, message}, %{state | topics: List.delete(state.topics, topic)}}
     else
       {:subscribed, false} ->
-        {[
-           {:text,
-            StreamerView.render("pleroma_respond.json", %{type: "unsubscribe", result: "ignored"})}
-         ], state}
+        message =
+          StreamerView.render("pleroma_respond.json", %{type: "unsubscribe", result: "ignored"})
+
+        {:reply, :error, {:text, message}, state}
 
       {:topic, {:error, error}} ->
-        {[
-           {:text,
-            StreamerView.render("pleroma_respond.json", %{
-              type: "unsubscribe",
-              result: "error",
-              error: error
-            })}
-         ], state}
+        message =
+          StreamerView.render("pleroma_respond.json", %{
+            type: "unsubscribe",
+            result: "error",
+            error: error
+          })
+
+        {:reply, :error, {:text, message}, state}
     end
   end
 
@@ -219,39 +201,47 @@ defmodule Pleroma.Web.MastodonAPI.WebsocketHandler do
          state
        ) do
     with {:auth, nil, nil} <- {:auth, state.user, state.oauth_token},
-         {:ok, user, oauth_token} <- authenticate_request(access_token, nil) do
-      {[
-         {:text,
-          StreamerView.render("pleroma_respond.json", %{
-            type: "pleroma:authenticate",
-            result: "success"
-          })}
-       ], %{state | user: user, oauth_token: oauth_token}}
+         {:ok, user, oauth_token} <- authenticate_request(access_token) do
+      message =
+        StreamerView.render("pleroma_respond.json", %{
+          type: "pleroma:authenticate",
+          result: "success"
+        })
+
+      {:reply, :ok, {:text, message}, %{state | user: user, oauth_token: oauth_token}}
     else
       {:auth, _, _} ->
-        {[
-           {:text,
-            StreamerView.render("pleroma_respond.json", %{
-              type: "pleroma:authenticate",
-              result: "error",
-              error: :already_authenticated
-            })}
-         ], state}
+        message =
+          StreamerView.render("pleroma_respond.json", %{
+            type: "pleroma:authenticate",
+            result: "error",
+            error: :already_authenticated
+          })
+
+        {:reply, :error, {:text, message}, state}
 
       _ ->
-        {[
-           {:text,
-            StreamerView.render("pleroma_respond.json", %{
-              type: "pleroma:authenticate",
-              result: "error",
-              error: :unauthorized
-            })}
-         ], state}
+        message =
+          StreamerView.render("pleroma_respond.json", %{
+            type: "pleroma:authenticate",
+            result: "error",
+            error: :unauthorized
+          })
+
+        {:reply, :error, {:text, message}, state}
     end
   end
 
   defp handle_client_event(params, state) do
     Logger.error("#{__MODULE__} received unknown event: #{inspect(params)}")
-    {[], state}
+    {:ok, state}
+  end
+
+  def handle_error(conn, :unauthorized) do
+    Plug.Conn.send_resp(conn, 401, "Unauthorized")
+  end
+
+  def handle_error(conn, _reason) do
+    Plug.Conn.send_resp(conn, 404, "Not Found")
   end
 end

lib/pleroma/web/media_proxy/media_proxy_controller.ex

@@ -56,7 +56,7 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyController do
     media_proxy_url = MediaProxy.url(url)
 
     with {:ok, %{status: status} = head_response} when status in 200..299 <-
-           Pleroma.HTTP.request("HEAD", media_proxy_url, [], [], pool: :media) do
+           Pleroma.HTTP.request(:head, media_proxy_url, "", [], pool: :media) do
       content_type = Tesla.get_header(head_response, "content-type")
       content_length = Tesla.get_header(head_response, "content-length")
       content_length = content_length && String.to_integer(content_length)

lib/pleroma/web/nodeinfo/nodeinfo.ex

@@ -6,7 +6,7 @@ defmodule Pleroma.Web.Nodeinfo.Nodeinfo do
   alias Pleroma.Config
   alias Pleroma.Stats
   alias Pleroma.User
-  alias Pleroma.Web.Federator.Publisher
+  alias Pleroma.Web.ActivityPub.Publisher
   alias Pleroma.Web.MastodonAPI.InstanceView
 
   # returns a nodeinfo 2.0 map, since 2.1 just adds a repository field

lib/pleroma/web/o_auth/authorization.ex

@@ -28,7 +28,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
   end
 
   @spec create_authorization(App.t(), User.t() | %{}, [String.t()] | nil) ::
-          {:ok, Authorization.t()} | {:error, Changeset.t()}
+          {:ok, Authorization.t()} | {:error, Ecto.Changeset.t()}
   def create_authorization(%App{} = app, %User{} = user, scopes \\ nil) do
     %{
       scopes: scopes || app.scopes,
@@ -39,7 +39,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
     |> Repo.insert()
   end
 
-  @spec create_changeset(map()) :: Changeset.t()
+  @spec create_changeset(map()) :: Ecto.Changeset.t()
   def create_changeset(attrs \\ %{}) do
     %Authorization{}
     |> cast(attrs, [:user_id, :app_id, :scopes, :valid_until])
@@ -58,7 +58,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
     put_change(changeset, :valid_until, NaiveDateTime.add(NaiveDateTime.utc_now(), lifespan))
   end
 
-  @spec use_changeset(Authtorizatiton.t(), map()) :: Changeset.t()
+  @spec use_changeset(Authorization.t(), map()) :: Ecto.Changeset.t()
   def use_changeset(%Authorization{} = auth, params) do
     auth
     |> cast(params, [:used])
@@ -66,7 +66,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
   end
 
   @spec use_token(Authorization.t()) ::
-          {:ok, Authorization.t()} | {:error, Changeset.t()} | {:error, String.t()}
+          {:ok, Authorization.t()} | {:error, Ecto.Changeset.t()} | {:error, String.t()}
   def use_token(%Authorization{used: false, valid_until: valid_until} = auth) do
     if NaiveDateTime.diff(NaiveDateTime.utc_now(), valid_until) < 0 do
       Repo.update(use_changeset(auth, %{used: true}))

lib/pleroma/web/o_auth/o_auth_controller.ex

@@ -310,7 +310,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
       after_token_exchange(conn, %{token: token})
     else
       _error ->
-        handle_token_exchange_error(conn, :invalid_credentails)
+        handle_token_exchange_error(conn, :invalid_credentials)
     end
   end
 
@@ -610,13 +610,8 @@ defmodule Pleroma.Web.OAuth.OAuthController do
     end
   end
 
-  @spec validate_scopes(App.t(), map() | list()) ::
+  @spec validate_scopes(App.t(), list()) ::
           {:ok, list()} | {:error, :missing_scopes | :unsupported_scopes}
-  defp validate_scopes(%App{} = app, params) when is_map(params) do
-    requested_scopes = Scopes.fetch_scopes(params, app.scopes)
-    validate_scopes(app, requested_scopes)
-  end
-
   defp validate_scopes(%App{} = app, requested_scopes) when is_list(requested_scopes) do
     Scopes.validate(requested_scopes, app.scopes)
   end

lib/pleroma/web/o_auth/token.ex

@@ -56,7 +56,8 @@ defmodule Pleroma.Web.OAuth.Token do
     |> Repo.find_resource()
   end
 
-  @spec exchange_token(App.t(), Authorization.t()) :: {:ok, Token.t()} | {:error, Changeset.t()}
+  @spec exchange_token(App.t(), Authorization.t()) ::
+          {:ok, Token.t()} | {:error, Ecto.Changeset.t()}
   def exchange_token(app, auth) do
     with {:ok, auth} <- Authorization.use_token(auth),
          true <- auth.app_id == app.id do
@@ -95,7 +96,7 @@ defmodule Pleroma.Web.OAuth.Token do
     |> validate_required([:valid_until])
   end
 
-  @spec create(App.t(), User.t(), map()) :: {:ok, Token} | {:error, Changeset.t()}
+  @spec create(App.t(), User.t(), map()) :: {:ok, Token} | {:error, Ecto.Changeset.t()}
   def create(%App{} = app, %User{} = user, attrs \\ %{}) do
     with {:ok, token} <- do_create(app, user, attrs) do
       if Pleroma.Config.get([:oauth2, :clean_expired_tokens]) do
@@ -137,9 +138,9 @@ defmodule Pleroma.Web.OAuth.Token do
     |> Repo.all()
   end
 
-  def is_expired?(%__MODULE__{valid_until: valid_until}) do
+  def expired?(%__MODULE__{valid_until: valid_until}) do
     NaiveDateTime.diff(NaiveDateTime.utc_now(), valid_until) > 0
   end
 
-  def is_expired?(_), do: false
+  def expired?(_), do: false
 end

lib/pleroma/web/o_auth/token/query.ex

@@ -9,10 +9,10 @@ defmodule Pleroma.Web.OAuth.Token.Query do
 
   import Ecto.Query, only: [from: 2]
 
-  @type query :: Ecto.Queryable.t() | Token.t()
-
   alias Pleroma.Web.OAuth.Token
 
+  @type query :: Ecto.Queryable.t() | Token.t()
+
   @spec get_by_refresh_token(query, String.t()) :: query
   def get_by_refresh_token(query \\ Token, refresh_token) do
     from(q in query, where: q.refresh_token == ^refresh_token)

lib/pleroma/web/o_status/o_status_controller.ex

@@ -37,7 +37,7 @@ defmodule Pleroma.Web.OStatus.OStatusController do
     with id <- Endpoint.url() <> conn.request_path,
          {_, %Activity{} = activity} <-
            {:activity, Activity.get_create_by_object_ap_id_with_object(id)},
-         {_, true} <- {:public?, Visibility.is_public?(activity)} do
+         {_, true} <- {:public?, Visibility.public?(activity)} do
       redirect(conn, to: "/notice/#{activity.id}")
     else
       reason when reason in [{:public?, false}, {:activity, nil}] ->
@@ -56,7 +56,7 @@ defmodule Pleroma.Web.OStatus.OStatusController do
   def activity(conn, _params) do
     with id <- Endpoint.url() <> conn.request_path,
          {_, %Activity{} = activity} <- {:activity, Activity.normalize(id)},
-         {_, true} <- {:public?, Visibility.is_public?(activity)} do
+         {_, true} <- {:public?, Visibility.public?(activity)} do
       redirect(conn, to: "/notice/#{activity.id}")
     else
       reason when reason in [{:public?, false}, {:activity, nil}] ->
@@ -69,7 +69,7 @@ defmodule Pleroma.Web.OStatus.OStatusController do
 
   def notice(%{assigns: %{format: format}} = conn, %{"id" => id}) do
     with {_, %Activity{} = activity} <- {:activity, Activity.get_by_id_with_object(id)},
-         {_, true} <- {:public?, Visibility.is_public?(activity)},
+         {_, true} <- {:public?, Visibility.public?(activity)},
          %User{} = user <- User.get_cached_by_ap_id(activity.data["actor"]) do
       cond do
         format in ["json", "activity+json"] ->
@@ -106,13 +106,12 @@ defmodule Pleroma.Web.OStatus.OStatusController do
   # Returns an HTML embedded <audio> or <video> player suitable for embed iframes.
   def notice_player(conn, %{"id" => id}) do
     with %Activity{data: %{"type" => "Create"}} = activity <- Activity.get_by_id_with_object(id),
-         true <- Visibility.is_public?(activity),
+         true <- Visibility.public?(activity),
          {_, true} <- {:visible?, Visibility.visible_for_user?(activity, _reading_user = nil)},
          %Object{} = object <- Object.normalize(activity, fetch: false),
          %{data: %{"attachment" => [%{"url" => [url | _]} | _]}} <- object,
          true <- String.starts_with?(url["mediaType"], ["audio", "video"]) do
       conn
-      |> put_layout(:metadata_player)
       |> put_resp_header("x-frame-options", "ALLOW")
       |> put_resp_header(
         "content-security-policy",

lib/pleroma/web/pleroma_api/controllers/chat_controller.ex

@@ -38,14 +38,24 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     %{scopes: ["read:chats"]} when action in [:messages, :index, :index2, :show]
   )
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ChatOperation
 
-  def delete_message(%{assigns: %{user: %{id: user_id} = user}} = conn, %{
-        message_id: message_id,
-        id: chat_id
-      }) do
+  def delete_message(
+        %{
+          assigns: %{user: %{id: user_id} = user},
+          private: %{
+            open_api_spex: %{
+              params: %{
+                message_id: message_id,
+                id: chat_id
+              }
+            }
+          }
+        } = conn,
+        _
+      ) do
     with %MessageReference{} = cm_ref <-
            MessageReference.get_by_id(message_id),
          ^chat_id <- to_string(cm_ref.chat_id),
@@ -72,11 +82,14 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
   defp remove_or_delete(cm_ref, _), do: MessageReference.delete(cm_ref)
 
   def post_chat_message(
-        %{body_params: params, assigns: %{user: user}} = conn,
-        %{id: id}
+        %{
+          private: %{open_api_spex: %{body_params: params, params: %{id: id}}},
+          assigns: %{user: user}
+        } = conn,
+        _
       ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id),
-         %User{} = recipient <- User.get_cached_by_ap_id(chat.recipient),
+         {_, %User{} = recipient} <- {:user, User.get_cached_by_ap_id(chat.recipient)},
          {:ok, activity} <-
            CommonAPI.post_chat_message(user, recipient, params[:content],
              media_id: params[:media_id],
@@ -97,12 +110,20 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
         conn
         |> put_status(:bad_request)
         |> json(%{error: message})
+
+      {:user, nil} ->
+        conn
+        |> put_status(:bad_request)
+        |> json(%{error: "Recipient does not exist"})
     end
   end
 
   def mark_message_as_read(
-        %{assigns: %{user: %{id: user_id}}} = conn,
-        %{id: chat_id, message_id: message_id}
+        %{
+          assigns: %{user: %{id: user_id}},
+          private: %{open_api_spex: %{params: %{id: chat_id, message_id: message_id}}}
+        } = conn,
+        _
       ) do
     with %MessageReference{} = cm_ref <- MessageReference.get_by_id(message_id),
          ^chat_id <- to_string(cm_ref.chat_id),
@@ -115,8 +136,16 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
   end
 
   def mark_as_read(
-        %{body_params: %{last_read_id: last_read_id}, assigns: %{user: user}} = conn,
-        %{id: id}
+        %{
+          assigns: %{user: user},
+          private: %{
+            open_api_spex: %{
+              body_params: %{last_read_id: last_read_id},
+              params: %{id: id}
+            }
+          }
+        } = conn,
+        _
       ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id),
          {_n, _} <- MessageReference.set_all_seen_for_chat(chat, last_read_id) do
@@ -124,7 +153,13 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     end
   end
 
-  def messages(%{assigns: %{user: user}} = conn, %{id: id} = params) do
+  def messages(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{params: %{id: id} = params}}
+        } = conn,
+        _
+      ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id) do
       chat_message_refs =
         chat
@@ -138,7 +173,7 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     end
   end
 
-  def index(%{assigns: %{user: user}} = conn, params) do
+  def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     chats =
       index_query(user, params)
       |> Repo.all()
@@ -146,7 +181,7 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     render(conn, "index.json", chats: chats)
   end
 
-  def index2(%{assigns: %{user: user}} = conn, params) do
+  def index2(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     chats =
       index_query(user, params)
       |> Pagination.fetch_paginated(params)
@@ -166,14 +201,14 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     |> where([c], c.recipient not in ^exclude_users)
   end
 
-  def create(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def create(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %User{ap_id: recipient} <- User.get_cached_by_id(id),
          {:ok, %Chat{} = chat} <- Chat.get_or_create(user.id, recipient) do
       render(conn, "show.json", chat: chat)
     end
   end
 
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id) do
       render(conn, "show.json", chat: chat)
     end

lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex

@@ -8,7 +8,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
   alias Pleroma.Emoji.Pack
   alias Pleroma.Web.ApiSpec
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -22,7 +22,10 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
 
   defdelegate open_api_operation(action), to: ApiSpec.PleromaEmojiFileOperation
 
-  def create(%{body_params: params} = conn, %{name: pack_name}) do
+  def create(
+        %{private: %{open_api_spex: %{body_params: params, params: %{name: pack_name}}}} = conn,
+        _
+      ) do
     filename = params[:filename] || get_filename(params[:file])
     shortcode = params[:shortcode] || Path.basename(filename, Path.extname(filename))
 
@@ -49,7 +52,17 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
     end
   end
 
-  def update(%{body_params: %{shortcode: shortcode} = params} = conn, %{name: pack_name}) do
+  def update(
+        %{
+          private: %{
+            open_api_spex: %{
+              body_params: %{shortcode: shortcode} = params,
+              params: %{name: pack_name}
+            }
+          }
+        } = conn,
+        _
+      ) do
     new_shortcode = params[:new_shortcode]
     new_filename = params[:new_filename]
     force = params[:force]
@@ -80,7 +93,10 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
     end
   end
 
-  def delete(conn, %{name: pack_name, shortcode: shortcode}) do
+  def delete(
+        %{private: %{open_api_spex: %{params: %{name: pack_name, shortcode: shortcode}}}} = conn,
+        _
+      ) do
     with {:ok, pack} <- Pack.load_pack(pack_name),
          {:ok, pack} <- Pack.delete_file(pack, shortcode) do
       json(conn, pack.files)

lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex

@@ -7,7 +7,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
 
   alias Pleroma.Emoji.Pack
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -26,7 +26,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaEmojiPackOperation
 
-  def remote(conn, params) do
+  def remote(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     with {:ok, packs} <-
            Pack.list_remote(url: params.url, page_size: params.page_size, page: params.page) do
       json(conn, packs)
@@ -38,7 +38,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def index(conn, params) do
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     emoji_path =
       [:instance, :static_dir]
       |> Pleroma.Config.get!()
@@ -61,7 +61,11 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def show(conn, %{name: name, page: page, page_size: page_size}) do
+  def show(
+        %{private: %{open_api_spex: %{params: %{name: name, page: page, page_size: page_size}}}} =
+          conn,
+        _
+      ) do
     name = String.trim(name)
 
     with {:ok, pack} <- Pack.show(name: name, page: page, page_size: page_size) do
@@ -90,7 +94,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def archive(conn, %{name: name}) do
+  def archive(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     with {:ok, archive} <- Pack.get_archive(name) do
       send_download(conn, {:binary, archive}, filename: "#{name}.zip")
     else
@@ -109,7 +113,10 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def download(%{body_params: %{url: url, name: name} = params} = conn, _) do
+  def download(
+        %{private: %{open_api_spex: %{body_params: %{url: url, name: name} = params}}} = conn,
+        _
+      ) do
     with {:ok, _pack} <- Pack.download(name, url, params[:as]) do
       json(conn, "ok")
     else
@@ -130,7 +137,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def create(conn, %{name: name}) do
+  def create(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     name = String.trim(name)
 
     with {:ok, _pack} <- Pack.create(name) do
@@ -159,7 +166,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def delete(conn, %{name: name}) do
+  def delete(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     name = String.trim(name)
 
     with {:ok, deleted} when deleted != [] <- Pack.delete(name) do
@@ -184,7 +191,11 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def update(%{body_params: %{metadata: metadata}} = conn, %{name: name}) do
+  def update(
+        %{private: %{open_api_spex: %{body_params: %{metadata: metadata}, params: %{name: name}}}} =
+          conn,
+        _
+      ) do
     with {:ok, pack} <- Pack.update_metadata(name, metadata) do
       json(conn, pack.pack)
     else

lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex

@@ -10,7 +10,7 @@ defmodule Pleroma.Web.PleromaAPI.MascotController do
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
   plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:update])
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["read:accounts"]} when action == :show)
   plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action != :show)
 
@@ -22,9 +22,13 @@ defmodule Pleroma.Web.PleromaAPI.MascotController do
   end
 
   @doc "PUT /api/v1/pleroma/mascot"
-  def update(%{assigns: %{user: user}, body_params: %{file: file}} = conn, _) do
+  def update(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file}}}} =
+          conn,
+        _
+      ) do
     with {:content_type, "image" <> _} <- {:content_type, file.content_type},
-         {:ok, object} <- ActivityPub.upload(file, actor: User.ap_id(user)) do
+         {_, {:ok, object}} <- {:upload, ActivityPub.upload(file, actor: User.ap_id(user))} do
       attachment = render_attachment(object)
       {:ok, _user} = User.mascot_update(user, attachment)
 
@@ -32,6 +36,9 @@ defmodule Pleroma.Web.PleromaAPI.MascotController do
     else
       {:content_type, _} ->
         render_error(conn, :unsupported_media_type, "mascots can only be images")
+
+      {:upload, {:error, _}} ->
+        render_error(conn, :error, "error uploading file")
     end
   end
 

lib/pleroma/web/pleroma_api/controllers/notification_controller.ex

@@ -7,7 +7,7 @@ defmodule Pleroma.Web.PleromaAPI.NotificationController do
 
   alias Pleroma.Notification
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -16,7 +16,13 @@ defmodule Pleroma.Web.PleromaAPI.NotificationController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaNotificationOperation
 
-  def mark_as_read(%{assigns: %{user: user}, body_params: %{id: notification_id}} = conn, _) do
+  def mark_as_read(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{id: notification_id}}}
+        } = conn,
+        _
+      ) do
     with {:ok, notification} <- Notification.read_one(user, notification_id) do
       render(conn, "show.json", notification: notification, for: user)
     else
@@ -27,7 +33,11 @@ defmodule Pleroma.Web.PleromaAPI.NotificationController do
     end
   end
 
-  def mark_as_read(%{assigns: %{user: user}, body_params: %{max_id: max_id}} = conn, _) do
+  def mark_as_read(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{max_id: max_id}}}} =
+          conn,
+        _
+      ) do
     notifications =
       user
       |> Notification.set_read_up_to(max_id)

lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex

@@ -15,14 +15,21 @@ defmodule Pleroma.Web.PleromaAPI.UserImportController do
   plug(OAuthScopesPlug, %{scopes: ["follow", "write:blocks"]} when action == :blocks)
   plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action == :mutes)
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   defdelegate open_api_operation(action), to: ApiSpec.UserImportOperation
 
-  def follow(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
-    follow(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+  def follow(
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_follow(conn, list)
   end
 
-  def follow(%{assigns: %{user: follower}, body_params: %{list: list}} = conn, _) do
+  def follow(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_follow(conn, list)
+
+  def do_follow(%{assigns: %{user: follower}} = conn, list) do
     identifiers =
       list
       |> String.split("\n")
@@ -35,20 +42,34 @@ defmodule Pleroma.Web.PleromaAPI.UserImportController do
     json(conn, "job started")
   end
 
-  def blocks(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
-    blocks(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+  def blocks(
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_block(conn, list)
   end
 
-  def blocks(%{assigns: %{user: blocker}, body_params: %{list: list}} = conn, _) do
+  def blocks(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_block(conn, list)
+
+  defp do_block(%{assigns: %{user: blocker}} = conn, list) do
     User.Import.blocks_import(blocker, prepare_user_identifiers(list))
     json(conn, "job started")
   end
 
-  def mutes(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
-    mutes(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+  def mutes(
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_mute(conn, list)
   end
 
-  def mutes(%{assigns: %{user: user}, body_params: %{list: list}} = conn, _) do
+  def mutes(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_mute(conn, list)
+
+  defp do_mute(%{assigns: %{user: user}} = conn, list) do
     User.Import.mutes_import(user, prepare_user_identifiers(list))
     json(conn, "job started")
   end

lib/pleroma/web/plugs/cache.ex

@@ -20,7 +20,7 @@ defmodule Pleroma.Web.Plugs.Cache do
 
   - `ttl`:  An expiration time (time-to-live). This value should be in milliseconds or `nil` to disable expiration. Defaults to `nil`.
   - `query_params`: Take URL query string into account (`true`), ignore it (`false`) or limit to specific params only (list). Defaults to `true`.
-  - `tracking_fun`: A function that is called on successfull responses, no matter if the request is cached or not. It should accept a conn as the first argument and the value assigned to `tracking_fun_data` as the second.
+  - `tracking_fun`: A function that is called on successful responses, no matter if the request is cached or not. It should accept a conn as the first argument and the value assigned to `tracking_fun_data` as the second.
 
   Additionally, you can overwrite the TTL inside a controller action by assigning `cache_ttl` to the connection struct:
 

lib/pleroma/web/plugs/o_auth_plug.ex

@@ -23,14 +23,14 @@ defmodule Pleroma.Web.Plugs.OAuthPlug do
   def call(conn, _) do
     with {:ok, token_str} <- fetch_token_str(conn) do
       with {:ok, user, user_token} <- fetch_user_and_token(token_str),
-           false <- Token.is_expired?(user_token) do
+           false <- Token.expired?(user_token) do
         conn
         |> assign(:token, user_token)
         |> assign(:user, user)
       else
         _ ->
           with {:ok, app, app_token} <- fetch_app_and_token(token_str),
-               false <- Token.is_expired?(app_token) do
+               false <- Token.expired?(app_token) do
             conn
             |> assign(:token, app_token)
             |> assign(:app, app)

lib/pleroma/web/plugs/rate_limiter/supervisor.ex

@@ -14,7 +14,7 @@ defmodule Pleroma.Web.Plugs.RateLimiter.Supervisor do
       Pleroma.Web.Plugs.RateLimiter.LimiterSupervisor
     ]
 
-    opts = [strategy: :one_for_one, name: Pleroma.Web.Streamer.Supervisor]
+    opts = [strategy: :one_for_one]
     Supervisor.init(children, opts)
   end
 end

lib/pleroma/web/plugs/remote_ip.ex

@@ -43,6 +43,6 @@ defmodule Pleroma.Web.Plugs.RemoteIp do
         InetCidr.v6?(InetCidr.parse_address!(proxy)) -> proxy <> "/128"
       end
 
-    InetCidr.parse(proxy, true)
+    InetCidr.parse_cidr!(proxy, true)
   end
 end