Merge remote-tracking branch 'origin/develop' into shigusegubu

* origin/develop: (24 commits)
  MastoAPI followers/following endpoints
  Switch the CI to Elixir 1.8.1
  Linting.
  WebPush: Add activity id to the push messages.
  MastoAPI Accounts: Add fetching by nickname.
  Update Differences-in-MastodonAPI-Responses.md
  Remove chromium input hilight that clashes with our own
  Style again the login page to fit pleroma more
  MastoAPI StatusView: Add locality indicator.
  Broadcast deleted activity id on deletion to conform to MastoAPI streamig spec
  Change order of source code to align with platforms
  Update homepages and provide source code links for Roma apps in Clients.md
  Rename Mastalab -> Fedilab in Clients.md
  http: connection: unify adapter configuration and defaults
  http: connection: relax the timeouts a little
  http: rework connection timeouts to match hackney docs, enforce 1 second max TCP connection timeout
  http: actually pass the options list to the Connection factory
  http: connection: merge hackney option lists instead of concatenating them
  http: safely catch erlang exits and elixir errors from hackney (ref #672)
  Allow an admin to delete a user status
  ...

lib/pleroma/activity.ex

@@ -107,6 +107,18 @@ defmodule Pleroma.Activity do
 
   def get_in_reply_to_activity(_), do: nil
 
+  def delete_by_ap_id(id) when is_binary(id) do
+    by_object_ap_id(id)
+    |> Repo.delete_all(returning: true)
+    |> elem(1)
+    |> Enum.find(fn
+      %{data: %{"type" => "Create", "object" => %{"id" => ap_id}}} -> ap_id == id
+      _ -> nil
+    end)
+  end
+
+  def delete_by_ap_id(_), do: nil
+
   for {ap_type, type} <- @mastodon_notification_types do
     def mastodon_notification_type(%Activity{data: %{"type" => unquote(ap_type)}}),
       do: unquote(type)

lib/pleroma/http/connection.ex

@@ -8,8 +8,8 @@ defmodule Pleroma.HTTP.Connection do
   """
 
   @hackney_options [
-    timeout: 10000,
-    recv_timeout: 20000,
+    connect_timeout: 2_000,
+    recv_timeout: 20_000,
     follow_redirect: true,
     pool: :federation
   ]
@@ -31,6 +31,10 @@ defmodule Pleroma.HTTP.Connection do
   #
   defp hackney_options(opts) do
     options = Keyword.get(opts, :adapter, [])
-    @hackney_options ++ options
+    adapter_options = Pleroma.Config.get([:http, :adapter], [])
+
+    @hackney_options
+    |> Keyword.merge(adapter_options)
+    |> Keyword.merge(options)
   end
 end

lib/pleroma/http/http.ex

@@ -27,21 +27,29 @@ defmodule Pleroma.HTTP do
 
   """
   def request(method, url, body \\ "", headers \\ [], options \\ []) do
-    options =
-      process_request_options(options)
-      |> process_sni_options(url)
+    try do
+      options =
+        process_request_options(options)
+        |> process_sni_options(url)
 
-    params = Keyword.get(options, :params, [])
+      params = Keyword.get(options, :params, [])
 
-    %{}
-    |> Builder.method(method)
-    |> Builder.headers(headers)
-    |> Builder.opts(options)
-    |> Builder.url(url)
-    |> Builder.add_param(:body, :body, body)
-    |> Builder.add_param(:query, :query, params)
-    |> Enum.into([])
-    |> (&Tesla.request(Connection.new(), &1)).()
+      %{}
+      |> Builder.method(method)
+      |> Builder.headers(headers)
+      |> Builder.opts(options)
+      |> Builder.url(url)
+      |> Builder.add_param(:body, :body, body)
+      |> Builder.add_param(:query, :query, params)
+      |> Enum.into([])
+      |> (&Tesla.request(Connection.new(options), &1)).()
+    rescue
+      e ->
+        {:error, e}
+    catch
+      :exit, e ->
+        {:error, e}
+    end
   end
 
   defp process_sni_options(options, nil), do: options

lib/pleroma/object.ex

@@ -86,9 +86,9 @@ defmodule Pleroma.Object do
 
   def delete(%Object{data: %{"id" => id}} = object) do
     with {:ok, _obj} = swap_object_with_tombstone(object),
-         Repo.delete_all(Activity.by_object_ap_id(id)),
+         deleted_activity = Activity.delete_by_ap_id(id),
          {:ok, true} <- Cachex.del(:object_cache, "object:#{id}") do
-      {:ok, object}
+      {:ok, object, deleted_activity}
     end
   end
 

lib/pleroma/user.ex

@@ -532,6 +532,10 @@ defmodule Pleroma.User do
       _e ->
         with [_nick, _domain] <- String.split(nickname, "@"),
              {:ok, user} <- fetch_by_nickname(nickname) do
+          if Pleroma.Config.get([:fetch_initial_posts, :enabled]) do
+            {:ok, _} = Task.start(__MODULE__, :fetch_initial_posts, [user])
+          end
+
           user
         else
           _e -> nil
@@ -539,6 +543,17 @@ defmodule Pleroma.User do
     end
   end
 
+  @doc "Fetch some posts when the user has just been federated with"
+  def fetch_initial_posts(user) do
+    pages = Pleroma.Config.get!([:fetch_initial_posts, :pages])
+
+    Enum.each(
+      # Insert all the posts in reverse order, so they're in the right order on the timeline
+      Enum.reverse(Utils.fetch_ordered_collection(user.info.source_data["outbox"], pages)),
+      &Pleroma.Web.Federator.incoming_ap_doc/1
+    )
+  end
+
   def get_followers_query(%User{id: id, follower_address: follower_address}, nil) do
     from(
       u in User,
@@ -1121,24 +1136,36 @@ defmodule Pleroma.User do
 
   def html_filter_policy(_), do: @default_scrubbers
 
+  def fetch_by_ap_id(ap_id) do
+    ap_try = ActivityPub.make_user_from_ap_id(ap_id)
+
+    case ap_try do
+      {:ok, user} ->
+        user
+
+      _ ->
+        case OStatus.make_user(ap_id) do
+          {:ok, user} -> user
+          _ -> {:error, "Could not fetch by AP id"}
+        end
+    end
+  end
+
   def get_or_fetch_by_ap_id(ap_id) do
     user = get_by_ap_id(ap_id)
 
     if !is_nil(user) and !User.needs_update?(user) do
       user
     else
-      ap_try = ActivityPub.make_user_from_ap_id(ap_id)
+      user = fetch_by_ap_id(ap_id)
 
-      case ap_try do
-        {:ok, user} ->
-          user
-
-        _ ->
-          case OStatus.make_user(ap_id) do
-            {:ok, user} -> user
-            _ -> {:error, "Could not fetch by AP id"}
-          end
+      if Pleroma.Config.get([:fetch_initial_posts, :enabled]) do
+        with %User{} = user do
+          {:ok, _} = Task.start(__MODULE__, :fetch_initial_posts, [user])
+        end
       end
+
+      user
     end
   end
 

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -311,14 +311,14 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     user = User.get_cached_by_ap_id(actor)
     to = object.data["to"] || [] ++ object.data["cc"] || []
 
-    data = %{
-      "type" => "Delete",
-      "actor" => actor,
-      "object" => id,
-      "to" => to
-    }
-
-    with {:ok, _} <- Object.delete(object),
+    with {:ok, object, activity} <- Object.delete(object),
+         data <- %{
+           "type" => "Delete",
+           "actor" => actor,
+           "object" => id,
+           "to" => to,
+           "deleted_activity_id" => activity && activity.id
+         },
          {:ok, activity} <- insert(data, local),
          # Changing note count prior to enqueuing federation task in order to avoid race conditions on updating user.info
          {:ok, _actor} <- decrease_note_count_if_public(user, object),

lib/pleroma/web/activity_pub/transmogrifier.ex

@@ -736,6 +736,7 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
   def prepare_outgoing(%{"type" => _type} = data) do
     data =
       data
+      |> strip_internal_fields
       |> maybe_fix_object_url
       |> Map.merge(Utils.make_json_ld_header())
 
@@ -870,7 +871,8 @@ defmodule Pleroma.Web.ActivityPub.Transmogrifier do
       "announcements",
       "announcement_count",
       "emoji",
-      "context_id"
+      "context_id",
+      "deleted_activity_id"
     ])
   end
 

lib/pleroma/web/activity_pub/utils.ex

@@ -633,4 +633,43 @@ defmodule Pleroma.Web.ActivityPub.Utils do
     }
     |> Map.merge(additional)
   end
+
+  @doc """
+  Fetches the OrderedCollection/OrderedCollectionPage from `from`, limiting the amount of pages fetched after
+  the first one to `pages_left` pages.
+  If the amount of pages is higher than the collection has, it returns whatever was there.
+  """
+  def fetch_ordered_collection(from, pages_left, acc \\ []) do
+    with {:ok, response} <- Tesla.get(from),
+         {:ok, collection} <- Poison.decode(response.body) do
+      case collection["type"] do
+        "OrderedCollection" ->
+          # If we've encountered the OrderedCollection and not the page,
+          # just call the same function on the page address
+          fetch_ordered_collection(collection["first"], pages_left)
+
+        "OrderedCollectionPage" ->
+          if pages_left > 0 do
+            # There are still more pages
+            if Map.has_key?(collection, "next") do
+              # There are still more pages, go deeper saving what we have into the accumulator
+              fetch_ordered_collection(
+                collection["next"],
+                pages_left - 1,
+                acc ++ collection["orderedItems"]
+              )
+            else
+              # No more pages left, just return whatever we already have
+              acc ++ collection["orderedItems"]
+            end
+          else
+            # Got the amount of pages needed, add them all to the accumulator
+            acc ++ collection["orderedItems"]
+          end
+
+        _ ->
+          {:error, "Not an OrderedCollection or OrderedCollectionPage"}
+      end
+    end
+  end
 end

lib/pleroma/web/common_api/common_api.ex

@@ -30,7 +30,7 @@ defmodule Pleroma.Web.CommonAPI do
   def delete(activity_id, user) do
     with %Activity{data: %{"object" => %{"id" => object_id}}} <- Repo.get(Activity, activity_id),
          %Object{} = object <- Object.normalize(object_id),
-         true <- user.info.is_moderator || user.ap_id == object.data["actor"],
+         true <- User.superuser?(user) || user.ap_id == object.data["actor"],
          {:ok, _} <- unpin(activity_id, user),
          {:ok, delete} <- ActivityPub.delete(object) do
       {:ok, delete}

lib/pleroma/web/mastodon_api/mastodon_api.ex

@@ -1 +1,63 @@
+defmodule Pleroma.Web.MastodonAPI.MastodonAPI do
+  import Ecto.Query
+  import Ecto.Changeset
 
+  alias Pleroma.User
+  alias Pleroma.Repo
+
+  @default_limit 20
+
+  def get_followers(user, params \\ %{}) do
+    user
+    |> User.get_followers_query()
+    |> paginate(params)
+    |> Repo.all()
+  end
+
+  def get_friends(user, params \\ %{}) do
+    user
+    |> User.get_friends_query()
+    |> paginate(params)
+    |> Repo.all()
+  end
+
+  def paginate(query, params \\ %{}) do
+    options = cast_params(params)
+
+    query
+    |> restrict(:max_id, options)
+    |> restrict(:since_id, options)
+    |> restrict(:limit, options)
+    |> order_by([u], fragment("? desc nulls last", u.id))
+  end
+
+  def cast_params(params) do
+    param_types = %{
+      max_id: :string,
+      since_id: :string,
+      limit: :integer
+    }
+
+    changeset = cast({%{}, param_types}, params, Map.keys(param_types))
+    changeset.changes
+  end
+
+  defp restrict(query, :max_id, %{max_id: max_id}) do
+    query
+    |> where([q], q.id < ^max_id)
+  end
+
+  defp restrict(query, :since_id, %{since_id: since_id}) do
+    query
+    |> where([q], q.id > ^since_id)
+  end
+
+  defp restrict(query, :limit, options) do
+    limit = Map.get(options, :limit, @default_limit)
+
+    query
+    |> limit(^limit)
+  end
+
+  defp restrict(query, _, _), do: query
+end

lib/pleroma/web/mastodon_api/mastodon_api_controller.ex

@@ -22,6 +22,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
   alias Pleroma.Web.MastodonAPI.MastodonView
   alias Pleroma.Web.MastodonAPI.StatusView
   alias Pleroma.Web.MastodonAPI.ReportView
+  alias Pleroma.Web.MastodonAPI.MastodonAPI
   alias Pleroma.Web.ActivityPub.ActivityPub
   alias Pleroma.Web.ActivityPub.Utils
   alias Pleroma.Web.ActivityPub.Visibility
@@ -131,8 +132,8 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
     json(conn, account)
   end
 
-  def user(%{assigns: %{user: for_user}} = conn, %{"id" => id}) do
-    with %User{} = user <- Repo.get(User, id),
+  def user(%{assigns: %{user: for_user}} = conn, %{"id" => nickname_or_id}) do
+    with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id),
          true <- User.auth_active?(user) || user.id == for_user.id || User.superuser?(for_user) do
       account = AccountView.render("account.json", %{user: user, for: for_user})
       json(conn, account)
@@ -652,9 +653,9 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
     |> render("index.json", %{activities: activities, for: user, as: :activity})
   end
 
-  def followers(%{assigns: %{user: for_user}} = conn, %{"id" => id}) do
+  def followers(%{assigns: %{user: for_user}} = conn, %{"id" => id} = params) do
     with %User{} = user <- Repo.get(User, id),
-         {:ok, followers} <- User.get_followers(user) do
+         followers <- MastodonAPI.get_followers(user, params) do
       followers =
         cond do
           for_user && user.id == for_user.id -> followers
@@ -663,14 +664,15 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
         end
 
       conn
+      |> add_link_headers(:followers, followers, user)
       |> put_view(AccountView)
       |> render("accounts.json", %{users: followers, as: :user})
     end
   end
 
-  def following(%{assigns: %{user: for_user}} = conn, %{"id" => id}) do
+  def following(%{assigns: %{user: for_user}} = conn, %{"id" => id} = params) do
     with %User{} = user <- Repo.get(User, id),
-         {:ok, followers} <- User.get_friends(user) do
+         followers <- MastodonAPI.get_friends(user, params) do
       followers =
         cond do
           for_user && user.id == for_user.id -> followers
@@ -679,6 +681,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
         end
 
       conn
+      |> add_link_headers(:following, followers, user)
       |> put_view(AccountView)
       |> render("accounts.json", %{users: followers, as: :user})
     end
@@ -1452,7 +1455,6 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
                url,
                [],
                adapter: [
-                 timeout: timeout,
                  recv_timeout: timeout,
                  pool: :default
                ]

lib/pleroma/web/mastodon_api/views/status_view.ex

@@ -102,7 +102,10 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
         website: nil
       },
       language: nil,
-      emojis: []
+      emojis: [],
+      pleroma: %{
+        local: activity.local
+      }
     }
   end
 
@@ -181,7 +184,10 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
         website: nil
       },
       language: nil,
-      emojis: build_emojis(activity.data["object"]["emoji"])
+      emojis: build_emojis(activity.data["object"]["emoji"]),
+      pleroma: %{
+        local: activity.local
+      }
     }
   end
 

lib/pleroma/web/push/impl.ex

@@ -20,7 +20,10 @@ defmodule Pleroma.Web.Push.Impl do
 
   @doc "Performs sending notifications for user subscriptions"
   @spec perform_send(Notification.t()) :: list(any)
-  def perform_send(%{activity: %{data: %{"type" => activity_type}}, user_id: user_id} = notif)
+  def perform_send(
+        %{activity: %{data: %{"type" => activity_type}, id: activity_id}, user_id: user_id} =
+          notif
+      )
       when activity_type in @types do
     actor = User.get_cached_by_ap_id(notif.activity.data["actor"])
 
@@ -37,7 +40,10 @@ defmodule Pleroma.Web.Push.Impl do
         notification_id: notif.id,
         notification_type: type,
         icon: avatar_url,
-        preferred_locale: "en"
+        preferred_locale: "en",
+        pleroma: %{
+          activity_id: activity_id
+        }
       }
       |> Jason.encode!()
       |> push_message(build_sub(subscription), gcm_api_key, subscription)

lib/pleroma/web/rel_me.ex

@@ -5,7 +5,6 @@
 defmodule Pleroma.Web.RelMe do
   @hackney_options [
     pool: :media,
-    timeout: 2_000,
     recv_timeout: 2_000,
     max_body: 2_000_000
   ]

lib/pleroma/web/rich_media/parser.ex

@@ -11,7 +11,6 @@ defmodule Pleroma.Web.RichMedia.Parser do
 
   @hackney_options [
     pool: :media,
-    timeout: 2_000,
     recv_timeout: 2_000,
     max_body: 2_000_000
   ]

lib/pleroma/web/streamer.ex

@@ -211,15 +211,19 @@ defmodule Pleroma.Web.Streamer do
     end)
   end
 
-  def push_to_socket(topics, topic, %Activity{id: id, data: %{"type" => "Delete"}}) do
+  def push_to_socket(topics, topic, %Activity{
+        data: %{"type" => "Delete", "deleted_activity_id" => deleted_activity_id}
+      }) do
     Enum.each(topics[topic] || [], fn socket ->
       send(
         socket.transport_pid,
-        {:text, %{event: "delete", payload: to_string(id)} |> Jason.encode!()}
+        {:text, %{event: "delete", payload: to_string(deleted_activity_id)} |> Jason.encode!()}
       )
     end)
   end
 
+  def push_to_socket(_topics, _topic, %Activity{data: %{"type" => "Delete"}}), do: :noop
+
   def push_to_socket(topics, topic, item) do
     Enum.each(topics[topic] || [], fn socket ->
       # Get the current user so we have up-to-date blocks etc.

lib/pleroma/web/templates/layout/app.html.eex

@@ -8,75 +8,145 @@
     </title>
     <style>
       body {
-        background-color: #282c37;
+        background-color: #121a24;
         font-family: sans-serif;
-        color:white;
+        color: #b9b9ba;
         text-align: center;
       }
 
       .container {
-        margin: 50px auto;
-        max-width: 320px;
-        padding: 0;
-        padding: 40px 40px 40px 40px;
-        background-color: #313543;
+        max-width: 420px;
+        padding: 20px;
+        background-color: #182230;
         border-radius: 4px;
+        margin: auto;
+        margin-top: 10vh;
+        box-shadow: 0 1px 4px 0px rgba(0, 0, 0, 0.5);
       }
 
       h1 {
         margin: 0;
+        font-size: 24px;
       }
 
       h2 {
-        color: #9baec8;
+        color: #b9b9ba;
         font-weight: normal;
-        font-size: 20px;
-        margin-bottom: 40px;
+        font-size: 18px;
+        margin-bottom: 20px;
       }
 
       form {
         width: 100%;
       }
 
+      .input {
+        text-align: left;
+        color: #89898a;
+        display: flex;
+        flex-direction: column;
+      }
+
       input {
-        box-sizing: border-box;
-        width: 100%;
+        box-sizing: content-box;
         padding: 10px;
-        margin-top: 20px;
-        background-color: rgba(0,0,0,.1);
-        color: white;
+        margin-top: 5px;
+        margin-bottom: 10px;
+        background-color: #121a24;
+        color: #b9b9ba;
         border: 0;
-        border-bottom: 2px solid #9baec8;
+        transition-property: border-bottom;
+        transition-duration: 0.35s;
+        border-bottom: 2px solid #2a384a;
         font-size: 14px;
       }
 
-      input:focus {
-        border-bottom: 2px solid #4b8ed8;
+      .scopes-input {
+        display: flex;
+        margin-top: 1em;
+        text-align: left;
+        color: #89898a;
       }
 
-      input[type="checkbox"] {
-        width: auto;
+      .scopes-input label:first-child {
+        flex-basis: 40%;
+      }
+
+      .scopes {
+        display: flex;
+        flex-wrap: wrap;
+        text-align: left;
+        color: #b9b9ba;
+      }
+
+      .scope {
+        flex-basis: 100%;
+        display: flex;
+        height: 2em;
+        align-items: center;
+      }
+
+      [type="checkbox"] + label {
+        margin: 0.5em;
+      }
+
+      [type="checkbox"] {
+        display: none;
+      }
+
+      [type="checkbox"] + label:before {
+        display: inline-block;
+        color: white;
+        background-color: #121a24;
+        border: 4px solid #121a24;
+        box-sizing: border-box;
+        width: 1.2em;
+        height: 1.2em;
+        margin-right: 1.0em;
+        content: "";
+        transition-property: background-color;
+        transition-duration: 0.35s;
+        color: #121a24;
+        margin-bottom: -0.2em;
+        border-radius: 2px;
+      }
+
+      [type="checkbox"]:checked + label:before {
+        background-color: #d8a070;
+      }
+
+      input:focus {
+        outline: none;
+        border-bottom: 2px solid #d8a070;
       }
 
       button {
         box-sizing: border-box;
         width: 100%;
-        color: white;
-        background-color: #419bdd;
+        background-color: #1c2a3a;
+        color: #b9b9ba;
         border-radius: 4px;
         border: none;
         padding: 10px;
         margin-top: 30px;
         text-transform: uppercase;
-        font-weight: 500;
         font-size: 16px;
+        box-shadow: 0px 0px 2px 0px black,
+          0px 1px 0px 0px rgba(255, 255, 255, 0.2) inset,
+          0px -1px 0px 0px rgba(0, 0, 0, 0.2) inset;
+      }
+
+      button:hover {
+        cursor: pointer;
+        box-shadow: 0px 0px 0px 1px #d8a070,
+          0px 1px 0px 0px rgba(255, 255, 255, 0.2) inset,
+          0px -1px 0px 0px rgba(0, 0, 0, 0.2) inset;
       }
 
       .alert-danger {
         box-sizing: border-box;
         width: 100%;
-        color: #D8000C;
-        background-color: #FFD2D2;
+        background-color: #931014;
         border-radius: 4px;
         border: none;
         padding: 10px;
@@ -88,20 +158,32 @@
       .alert-info {
         box-sizing: border-box;
         width: 100%;
-        color: #00529B;
-        background-color: #BDE5F8;
         border-radius: 4px;
-        border: none;
+        border: 1px solid #7d796a;
         padding: 10px;
         margin-top: 20px;
         font-weight: 500;
         font-size: 16px;
       }
+
+      @media all and (max-width: 440px) {
+        .container {
+          margin-top: 0
+        }
+
+        .scopes-input {
+          flex-direction: column;
+        }
+
+        .scope {
+          flex-basis: 50%;
+        }
+      }
     </style>
   </head>
   <body>
     <div class="container">
-      <h1>Pleroma</h1>
+      <h1><%= Application.get_env(:pleroma, :instance)[:name] %></h1>
       <%= render @view_module, @view_template, assigns %>
     </div>
   </body>

lib/pleroma/web/templates/o_auth/o_auth/show.html.eex

@@ -6,23 +6,26 @@
 <% end %>
 <h2>OAuth Authorization</h2>
 <%= form_for @conn, o_auth_path(@conn, :authorize), [as: "authorization"], fn f -> %>
-<%= label f, :name, "Name or email" %>
-<%= text_input f, :name %>
-<br>
-<br>
-<%= label f, :password, "Password" %>
-<%= password_input f, :password %>
-<br>
-<br>
-
+<div class="input">
+  <%= label f, :name, "Name or email" %>
+  <%= text_input f, :name %>
+</div>
+<div class="input">
+  <%= label f, :password, "Password" %>
+  <%= password_input f, :password %>
+</div>
+<div class="scopes-input">
 <%= label f, :scope, "Permissions" %>
-<br>
-<%= for scope <- @available_scopes do %>
-  <%# Note: using hidden input with `unchecked_value` in order to distinguish user's empty selection from `scope` param being omitted %>
-  <%= checkbox f, :"scope_#{scope}", value: scope in @scopes && scope, checked_value: scope, unchecked_value: "", name: "authorization[scope][]" %>
-  <%= label f, :"scope_#{scope}", String.capitalize(scope) %>
-  <br>
-<% end %>
+  <div class="scopes">
+    <%= for scope <- @available_scopes do %>
+      <%# Note: using hidden input with `unchecked_value` in order to distinguish user's empty selection from `scope` param being omitted %>
+      <div class="scope">
+        <%= checkbox f, :"scope_#{scope}", value: scope in @scopes && scope, checked_value: scope, unchecked_value: "", name: "authorization[scope][]" %>
+        <%= label f, :"scope_#{scope}", String.capitalize(scope) %>
+      </div>
+    <% end %>
+  </div>
+</div>
 
 <%= hidden_input f, :client_id, value: @client_id %>
 <%= hidden_input f, :response_type, value: @response_type %>