total rebaseHEADmaster

18 files changed, 296 insertions, 54 deletions

diff --git a/lib/pleroma/web/pleroma_api/controllers/account_controller.ex b/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
index 591391b..591391b 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/account_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/app_controller.ex b/lib/pleroma/web/pleroma_api/controllers/app_controller.ex
index 3e84f75..3e84f75 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/app_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/app_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/backup_controller.ex b/lib/pleroma/web/pleroma_api/controllers/backup_controller.ex
index b9daed2..b9daed2 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/backup_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/backup_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/bookmark_folder_controller.ex b/lib/pleroma/web/pleroma_api/controllers/bookmark_folder_controller.ex
new file mode 100644
index 0000000..6d6e2e9
--- /dev/null
+++ b/lib/pleroma/web/pleroma_api/controllers/bookmark_folder_controller.ex
@@ -0,0 +1,68 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2024 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.PleromaAPI.BookmarkFolderController do
+  use Pleroma.Web, :controller
+
+  alias Pleroma.BookmarkFolder
+  alias Pleroma.Web.Plugs.OAuthScopesPlug
+
+  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+
+  # Note: scope not present in Mastodon: read:bookmarks
+  plug(OAuthScopesPlug, %{scopes: ["read:bookmarks"]} when action == :index)
+
+  # Note: scope not present in Mastodon: write:bookmarks
+  plug(
+    OAuthScopesPlug,
+    %{scopes: ["write:bookmarks"]} when action in [:create, :update, :delete]
+  )
+
+  defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaBookmarkFolderOperation
+
+  action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
+
+  def index(%{assigns: %{user: user}} = conn, _params) do
+    with folders <- BookmarkFolder.for_user(user.id) do
+      conn
+      |> render("index.json", %{folders: folders, as: :folder})
+    end
+  end
+
+  def create(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn,
+        _
+      ) do
+    with {:ok, folder} <- BookmarkFolder.create(user.id, params[:name], params[:emoji]) do
+      render(conn, "show.json", folder: folder)
+    end
+  end
+
+  def update(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: params, params: %{id: id}}}
+        } = conn,
+        _
+      ) do
+    with true <- BookmarkFolder.belongs_to_user?(id, user.id),
+         {:ok, folder} <- BookmarkFolder.update(id, params[:name], params[:emoji]) do
+      render(conn, "show.json", folder: folder)
+    else
+      false -> {:error, :forbidden}
+    end
+  end
+
+  def delete(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
+    with true <- BookmarkFolder.belongs_to_user?(id, user.id),
+         {:ok, folder} <- BookmarkFolder.delete(id) do
+      render(conn, "show.json", folder: folder)
+    else
+      false -> {:error, :forbidden}
+    end
+  end
+end
diff --git a/lib/pleroma/web/pleroma_api/controllers/chat_controller.ex b/lib/pleroma/web/pleroma_api/controllers/chat_controller.ex
index 3d7b6a4..58780ac 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/chat_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/chat_controller.ex
@@ -38,14 +38,24 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     %{scopes: ["read:chats"]} when action in [:messages, :index, :index2, :show]
   )
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ChatOperation
 
-  def delete_message(%{assigns: %{user: %{id: user_id} = user}} = conn, %{
-        message_id: message_id,
-        id: chat_id
-      }) do
+  def delete_message(
+        %{
+          assigns: %{user: %{id: user_id} = user},
+          private: %{
+            open_api_spex: %{
+              params: %{
+                message_id: message_id,
+                id: chat_id
+              }
+            }
+          }
+        } = conn,
+        _
+      ) do
     with %MessageReference{} = cm_ref <-
            MessageReference.get_by_id(message_id),
          ^chat_id <- to_string(cm_ref.chat_id),
@@ -72,11 +82,14 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
   defp remove_or_delete(cm_ref, _), do: MessageReference.delete(cm_ref)
 
   def post_chat_message(
-        %{body_params: params, assigns: %{user: user}} = conn,
-        %{id: id}
+        %{
+          private: %{open_api_spex: %{body_params: params, params: %{id: id}}},
+          assigns: %{user: user}
+        } = conn,
+        _
       ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id),
-         %User{} = recipient <- User.get_cached_by_ap_id(chat.recipient),
+         {_, %User{} = recipient} <- {:user, User.get_cached_by_ap_id(chat.recipient)},
          {:ok, activity} <-
            CommonAPI.post_chat_message(user, recipient, params[:content],
              media_id: params[:media_id],
@@ -97,12 +110,20 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
         conn
         |> put_status(:bad_request)
         |> json(%{error: message})
+
+      {:user, nil} ->
+        conn
+        |> put_status(:bad_request)
+        |> json(%{error: "Recipient does not exist"})
     end
   end
 
   def mark_message_as_read(
-        %{assigns: %{user: %{id: user_id}}} = conn,
-        %{id: chat_id, message_id: message_id}
+        %{
+          assigns: %{user: %{id: user_id}},
+          private: %{open_api_spex: %{params: %{id: chat_id, message_id: message_id}}}
+        } = conn,
+        _
       ) do
     with %MessageReference{} = cm_ref <- MessageReference.get_by_id(message_id),
          ^chat_id <- to_string(cm_ref.chat_id),
@@ -115,8 +136,16 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
   end
 
   def mark_as_read(
-        %{body_params: %{last_read_id: last_read_id}, assigns: %{user: user}} = conn,
-        %{id: id}
+        %{
+          assigns: %{user: user},
+          private: %{
+            open_api_spex: %{
+              body_params: %{last_read_id: last_read_id},
+              params: %{id: id}
+            }
+          }
+        } = conn,
+        _
       ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id),
          {_n, _} <- MessageReference.set_all_seen_for_chat(chat, last_read_id) do
@@ -124,7 +153,13 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     end
   end
 
-  def messages(%{assigns: %{user: user}} = conn, %{id: id} = params) do
+  def messages(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{params: %{id: id} = params}}
+        } = conn,
+        _
+      ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id) do
       chat_message_refs =
         chat
@@ -138,7 +173,7 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     end
   end
 
-  def index(%{assigns: %{user: user}} = conn, params) do
+  def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     chats =
       index_query(user, params)
       |> Repo.all()
@@ -146,7 +181,7 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     render(conn, "index.json", chats: chats)
   end
 
-  def index2(%{assigns: %{user: user}} = conn, params) do
+  def index2(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     chats =
       index_query(user, params)
       |> Pagination.fetch_paginated(params)
@@ -166,14 +201,14 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     |> where([c], c.recipient not in ^exclude_users)
   end
 
-  def create(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def create(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %User{ap_id: recipient} <- User.get_cached_by_id(id),
          {:ok, %Chat{} = chat} <- Chat.get_or_create(user.id, recipient) do
       render(conn, "show.json", chat: chat)
     end
   end
 
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id) do
       render(conn, "show.json", chat: chat)
     end
diff --git a/lib/pleroma/web/pleroma_api/controllers/conversation_controller.ex b/lib/pleroma/web/pleroma_api/controllers/conversation_controller.ex
index 37990db..37990db 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/conversation_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/conversation_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex
index f854cf9..00fb304 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex
@@ -8,7 +8,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
   alias Pleroma.Emoji.Pack
   alias Pleroma.Web.ApiSpec
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -22,7 +22,10 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
 
   defdelegate open_api_operation(action), to: ApiSpec.PleromaEmojiFileOperation
 
-  def create(%{body_params: params} = conn, %{name: pack_name}) do
+  def create(
+        %{private: %{open_api_spex: %{body_params: params, params: %{name: pack_name}}}} = conn,
+        _
+      ) do
     filename = params[:filename] || get_filename(params[:file])
     shortcode = params[:shortcode] || Path.basename(filename, Path.extname(filename))
 
@@ -49,7 +52,17 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
     end
   end
 
-  def update(%{body_params: %{shortcode: shortcode} = params} = conn, %{name: pack_name}) do
+  def update(
+        %{
+          private: %{
+            open_api_spex: %{
+              body_params: %{shortcode: shortcode} = params,
+              params: %{name: pack_name}
+            }
+          }
+        } = conn,
+        _
+      ) do
     new_shortcode = params[:new_shortcode]
     new_filename = params[:new_filename]
     force = params[:force]
@@ -80,7 +93,10 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
     end
   end
 
-  def delete(conn, %{name: pack_name, shortcode: shortcode}) do
+  def delete(
+        %{private: %{open_api_spex: %{params: %{name: pack_name, shortcode: shortcode}}}} = conn,
+        _
+      ) do
     with {:ok, pack} <- Pack.load_pack(pack_name),
          {:ok, pack} <- Pack.delete_file(pack, shortcode) do
       json(conn, pack.files)
diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
index 420fea1..32360d2 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex
@@ -7,7 +7,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
 
   alias Pleroma.Emoji.Pack
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -26,7 +26,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaEmojiPackOperation
 
-  def remote(conn, params) do
+  def remote(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     with {:ok, packs} <-
            Pack.list_remote(url: params.url, page_size: params.page_size, page: params.page) do
       json(conn, packs)
@@ -38,7 +38,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def index(conn, params) do
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     emoji_path =
       [:instance, :static_dir]
       |> Pleroma.Config.get!()
@@ -61,7 +61,11 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def show(conn, %{name: name, page: page, page_size: page_size}) do
+  def show(
+        %{private: %{open_api_spex: %{params: %{name: name, page: page, page_size: page_size}}}} =
+          conn,
+        _
+      ) do
     name = String.trim(name)
 
     with {:ok, pack} <- Pack.show(name: name, page: page, page_size: page_size) do
@@ -90,7 +94,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def archive(conn, %{name: name}) do
+  def archive(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     with {:ok, archive} <- Pack.get_archive(name) do
       send_download(conn, {:binary, archive}, filename: "#{name}.zip")
     else
@@ -109,7 +113,10 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def download(%{body_params: %{url: url, name: name} = params} = conn, _) do
+  def download(
+        %{private: %{open_api_spex: %{body_params: %{url: url, name: name} = params}}} = conn,
+        _
+      ) do
     with {:ok, _pack} <- Pack.download(name, url, params[:as]) do
       json(conn, "ok")
     else
@@ -130,7 +137,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def create(conn, %{name: name}) do
+  def create(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     name = String.trim(name)
 
     with {:ok, _pack} <- Pack.create(name) do
@@ -159,7 +166,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def delete(conn, %{name: name}) do
+  def delete(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     name = String.trim(name)
 
     with {:ok, deleted} when deleted != [] <- Pack.delete(name) do
@@ -184,7 +191,11 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
     end
   end
 
-  def update(%{body_params: %{metadata: metadata}} = conn, %{name: name}) do
+  def update(
+        %{private: %{open_api_spex: %{body_params: %{metadata: metadata}, params: %{name: name}}}} =
+          conn,
+        _
+      ) do
     with {:ok, pack} <- Pack.update_metadata(name, metadata) do
       json(conn, pack.pack)
     else
diff --git a/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex b/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
index 78fd0b2..662cc15 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/emoji_reaction_controller.ex
@@ -28,8 +28,8 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
   def index(%{assigns: %{user: user}} = conn, %{id: activity_id} = params) do
     with true <- Pleroma.Config.get([:instance, :show_reactions]),
          %Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
-         %Object{data: %{"reactions" => reactions}} when is_list(reactions) <-
-           Object.normalize(activity, fetch: false) do
+         %Object{} = object <- Object.normalize(activity, fetch: false),
+         reactions <- Object.get_emoji_reactions(object) do
       reactions =
         reactions
         |> filter(params)
@@ -50,29 +50,32 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
           if not with_muted, do: User.cached_muted_users_ap_ids(user), else: []
       end
 
-    filter_emoji = fn emoji, users ->
+    filter_emoji = fn emoji, users, url ->
       case Enum.reject(users, &(&1 in exclude_ap_ids)) do
         [] -> nil
-        users -> {emoji, users}
+        users -> {emoji, users, url}
       end
     end
 
     reactions
     |> Stream.map(fn
-      [emoji, users] when is_list(users) -> filter_emoji.(emoji, users)
-      {emoji, users} when is_list(users) -> filter_emoji.(emoji, users)
-      _ -> nil
+      [emoji, users, url] when is_list(users) -> filter_emoji.(emoji, users, url)
     end)
     |> Stream.reject(&is_nil/1)
   end
 
   defp filter(reactions, %{emoji: emoji}) when is_binary(emoji) do
-    Enum.filter(reactions, fn [e, _] -> e == emoji end)
+    Enum.filter(reactions, fn [e, _, _] -> e == emoji end)
   end
 
   defp filter(reactions, _), do: reactions
 
   def create(%{assigns: %{user: user}} = conn, %{id: activity_id, emoji: emoji}) do
+    emoji =
+      emoji
+      |> Pleroma.Emoji.fully_qualify_emoji()
+      |> Pleroma.Emoji.maybe_quote()
+
     with {:ok, _activity} <- CommonAPI.react_with_emoji(activity_id, user, emoji) do
       activity = Activity.get_by_id(activity_id)
 
@@ -83,6 +86,11 @@ defmodule Pleroma.Web.PleromaAPI.EmojiReactionController do
   end
 
   def delete(%{assigns: %{user: user}} = conn, %{id: activity_id, emoji: emoji}) do
+    emoji =
+      emoji
+      |> Pleroma.Emoji.fully_qualify_emoji()
+      |> Pleroma.Emoji.maybe_quote()
+
     with {:ok, _activity} <- CommonAPI.unreact_with_emoji(activity_id, user, emoji) do
       activity = Activity.get_by_id(activity_id)
 
diff --git a/lib/pleroma/web/pleroma_api/controllers/instances_controller.ex b/lib/pleroma/web/pleroma_api/controllers/instances_controller.ex
index 6257e31..6257e31 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/instances_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/instances_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex b/lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex
index 66e9d84..3208cde 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex
@@ -10,7 +10,7 @@ defmodule Pleroma.Web.PleromaAPI.MascotController do
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
   plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:update])
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["read:accounts"]} when action == :show)
   plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action != :show)
 
@@ -22,9 +22,13 @@ defmodule Pleroma.Web.PleromaAPI.MascotController do
   end
 
   @doc "PUT /api/v1/pleroma/mascot"
-  def update(%{assigns: %{user: user}, body_params: %{file: file}} = conn, _) do
+  def update(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file}}}} =
+          conn,
+        _
+      ) do
     with {:content_type, "image" <> _} <- {:content_type, file.content_type},
-         {:ok, object} <- ActivityPub.upload(file, actor: User.ap_id(user)) do
+         {_, {:ok, object}} <- {:upload, ActivityPub.upload(file, actor: User.ap_id(user))} do
       attachment = render_attachment(object)
       {:ok, _user} = User.mascot_update(user, attachment)
 
@@ -32,6 +36,9 @@ defmodule Pleroma.Web.PleromaAPI.MascotController do
     else
       {:content_type, _} ->
         render_error(conn, :unsupported_media_type, "mascots can only be images")
+
+      {:upload, {:error, _}} ->
+        render_error(conn, :error, "error uploading file")
     end
   end
 
diff --git a/lib/pleroma/web/pleroma_api/controllers/notification_controller.ex b/lib/pleroma/web/pleroma_api/controllers/notification_controller.ex
index 87ea81c..f860eaf 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/notification_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/notification_controller.ex
@@ -7,7 +7,7 @@ defmodule Pleroma.Web.PleromaAPI.NotificationController do
 
   alias Pleroma.Notification
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -16,7 +16,13 @@ defmodule Pleroma.Web.PleromaAPI.NotificationController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaNotificationOperation
 
-  def mark_as_read(%{assigns: %{user: user}, body_params: %{id: notification_id}} = conn, _) do
+  def mark_as_read(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{id: notification_id}}}
+        } = conn,
+        _
+      ) do
     with {:ok, notification} <- Notification.read_one(user, notification_id) do
       render(conn, "show.json", notification: notification, for: user)
     else
@@ -27,7 +33,11 @@ defmodule Pleroma.Web.PleromaAPI.NotificationController do
     end
   end
 
-  def mark_as_read(%{assigns: %{user: user}, body_params: %{max_id: max_id}} = conn, _) do
+  def mark_as_read(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{max_id: max_id}}}} =
+          conn,
+        _
+      ) do
     notifications =
       user
       |> Notification.set_read_up_to(max_id)
diff --git a/lib/pleroma/web/pleroma_api/controllers/report_controller.ex b/lib/pleroma/web/pleroma_api/controllers/report_controller.ex
index 1f0a82c..1f0a82c 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/report_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/report_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/scrobble_controller.ex b/lib/pleroma/web/pleroma_api/controllers/scrobble_controller.ex
index bf6dc50..bf6dc50 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/scrobble_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/scrobble_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/settings_controller.ex b/lib/pleroma/web/pleroma_api/controllers/settings_controller.ex
index 1136575..1136575 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/settings_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/settings_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/status_controller.ex b/lib/pleroma/web/pleroma_api/controllers/status_controller.ex
new file mode 100644
index 0000000..482662f
--- /dev/null
+++ b/lib/pleroma/web/pleroma_api/controllers/status_controller.ex
@@ -0,0 +1,66 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.PleromaAPI.StatusController do
+  use Pleroma.Web, :controller
+
+  import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]
+
+  require Ecto.Query
+  require Pleroma.Constants
+
+  alias Pleroma.Activity
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.ActivityPub
+  alias Pleroma.Web.ActivityPub.Visibility
+  alias Pleroma.Web.MastodonAPI.StatusView
+  alias Pleroma.Web.Plugs.OAuthScopesPlug
+
+  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+
+  action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
+
+  plug(
+    OAuthScopesPlug,
+    %{scopes: ["read:statuses"], fallback: :proceed_unauthenticated} when action == :quotes
+  )
+
+  defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaStatusOperation
+
+  @doc "GET /api/v1/pleroma/statuses/:id/quotes"
+  def quotes(%{assigns: %{user: user}} = conn, %{id: id} = params) do
+    with %Activity{object: object} = activity <- Activity.get_by_id_with_object(id),
+         true <- Visibility.visible_for_user?(activity, user) do
+      params =
+        params
+        |> Map.put(:type, "Create")
+        |> Map.put(:blocking_user, user)
+        |> Map.put(:quote_url, object.data["id"])
+
+      recipients =
+        if user do
+          [Pleroma.Constants.as_public()] ++ [user.ap_id | User.following(user)]
+        else
+          [Pleroma.Constants.as_public()]
+        end
+
+      activities =
+        recipients
+        |> ActivityPub.fetch_activities(params)
+        |> Enum.reverse()
+
+      conn
+      |> add_link_headers(activities)
+      |> put_view(StatusView)
+      |> render("index.json",
+        activities: activities,
+        for: user,
+        as: :activity
+      )
+    else
+      nil -> {:error, :not_found}
+      false -> {:error, :not_found}
+    end
+  end
+end
diff --git a/lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex b/lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex
index e69847b..e69847b 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex
diff --git a/lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex b/lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex
index 90428a5..96466f1 100755..100644
--- a/lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex
+++ b/lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex
@@ -15,14 +15,21 @@ defmodule Pleroma.Web.PleromaAPI.UserImportController do
   plug(OAuthScopesPlug, %{scopes: ["follow", "write:blocks"]} when action == :blocks)
   plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action == :mutes)
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   defdelegate open_api_operation(action), to: ApiSpec.UserImportOperation
 
-  def follow(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
-    follow(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+  def follow(
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_follow(conn, list)
   end
 
-  def follow(%{assigns: %{user: follower}, body_params: %{list: list}} = conn, _) do
+  def follow(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_follow(conn, list)
+
+  def do_follow(%{assigns: %{user: follower}} = conn, list) do
     identifiers =
       list
       |> String.split("\n")
@@ -35,20 +42,34 @@ defmodule Pleroma.Web.PleromaAPI.UserImportController do
     json(conn, "job started")
   end
 
-  def blocks(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
-    blocks(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+  def blocks(
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_block(conn, list)
   end
 
-  def blocks(%{assigns: %{user: blocker}, body_params: %{list: list}} = conn, _) do
+  def blocks(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_block(conn, list)
+
+  defp do_block(%{assigns: %{user: blocker}} = conn, list) do
     User.Import.blocks_import(blocker, prepare_user_identifiers(list))
     json(conn, "job started")
   end
 
-  def mutes(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
-    mutes(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+  def mutes(
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_mute(conn, list)
   end
 
-  def mutes(%{assigns: %{user: user}, body_params: %{list: list}} = conn, _) do
+  def mutes(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_mute(conn, list)
+
+  defp do_mute(%{assigns: %{user: user}} = conn, list) do
     User.Import.mutes_import(user, prepare_user_identifiers(list))
     json(conn, "job started")
   end