2.76
mastoapi.c
1/* snac - A simple, minimalistic ActivityPub instance */
2/* copyright (c) 2022 - 2025 grunfink et al. / MIT license */
3
4#ifndef NO_MASTODON_API
5
6#include "xs.h"
7#include "xs_hex.h"
8#include "xs_openssl.h"
9#include "xs_json.h"
10#include "xs_io.h"
11#include "xs_time.h"
12#include "xs_glob.h"
13#include "xs_set.h"
14#include "xs_random.h"
15#include "xs_url.h"
16#include "xs_mime.h"
17#include "xs_match.h"
18
19#include "snac.h"
20
21#include <sys/time.h>
22
23static xs_str *random_str(void)
24/* just what is says in the tin */
25{
26 unsigned int data[4] = {0};
27
28 xs_rnd_buf(data, sizeof(data));
29 return xs_hex_enc((char *)data, sizeof(data));
30}
31
32
33int app_add(const char *id, const xs_dict *app)
34/* stores an app */
35{
36 if (!xs_is_hex(id))
37 return HTTP_STATUS_INTERNAL_SERVER_ERROR;
38
39 int status = HTTP_STATUS_CREATED;
40 xs *fn = xs_fmt("%s/app/", srv_basedir);
41 FILE *f;
42
43 mkdirx(fn);
44 fn = xs_str_cat(fn, id);
45 fn = xs_str_cat(fn, ".json");
46
47 if ((f = fopen(fn, "w")) != NULL) {
48 xs_json_dump(app, 4, f);
49 fclose(f);
50 }
51 else
52 status = HTTP_STATUS_INTERNAL_SERVER_ERROR;
53
54 return status;
55}
56
57
58xs_str *_app_fn(const char *id)
59{
60 return xs_fmt("%s/app/%s.json", srv_basedir, id);
61}
62
63
64xs_dict *app_get(const char *id)
65/* gets an app */
66{
67 if (!xs_is_hex(id))
68 return NULL;
69
70 xs *fn = _app_fn(id);
71 xs_dict *app = NULL;
72 FILE *f;
73
74 if ((f = fopen(fn, "r")) != NULL) {
75 app = xs_json_load(f);
76 fclose(f);
77
78 }
79
80 return app;
81}
82
83
84int app_del(const char *id)
85/* deletes an app */
86{
87 if (!xs_is_hex(id))
88 return -1;
89
90 xs *fn = _app_fn(id);
91
92 return unlink(fn);
93}
94
95
96int token_add(const char *id, const xs_dict *token)
97/* stores a token */
98{
99 if (!xs_is_hex(id))
100 return HTTP_STATUS_INTERNAL_SERVER_ERROR;
101
102 int status = HTTP_STATUS_CREATED;
103 xs *fn = xs_fmt("%s/token/", srv_basedir);
104 FILE *f;
105
106 mkdirx(fn);
107 fn = xs_str_cat(fn, id);
108 fn = xs_str_cat(fn, ".json");
109
110 if ((f = fopen(fn, "w")) != NULL) {
111 xs_json_dump(token, 4, f);
112 fclose(f);
113 }
114 else
115 status = HTTP_STATUS_INTERNAL_SERVER_ERROR;
116
117 return status;
118}
119
120
121xs_dict *token_get(const char *id)
122/* gets a token */
123{
124 if (!xs_is_hex(id))
125 return NULL;
126
127 xs *fn = xs_fmt("%s/token/%s.json", srv_basedir, id);
128 xs_dict *token = NULL;
129 FILE *f;
130
131 if ((f = fopen(fn, "r")) != NULL) {
132 token = xs_json_load(f);
133 fclose(f);
134
135 /* 'touch' the file */
136 utimes(fn, NULL);
137
138 /* also 'touch' the app */
139 const char *app_id = xs_dict_get(token, "client_id");
140
141 if (app_id) {
142 xs *afn = xs_fmt("%s/app/%s.json", srv_basedir, app_id);
143 utimes(afn, NULL);
144 }
145 }
146
147 return token;
148}
149
150
151int token_del(const char *id)
152/* deletes a token */
153{
154 if (!xs_is_hex(id))
155 return -1;
156
157 xs *fn = xs_fmt("%s/token/%s.json", srv_basedir, id);
158
159 return unlink(fn);
160}
161
162
163const char *login_page = ""
164"<!DOCTYPE html>\n"
165"<html>\n"
166"<head>\n"
167"<title>%s OAuth - Snac2</title>\n"
168"<meta content=\"width=device-width, initial-scale=1, minimum-scale=1, user-scalable=no\" name=\"viewport\">"
169"<style>:root {color-scheme: light dark}</style>\n"
170"</head>\n"
171"<body><h1>%s OAuth identify</h1>\n"
172"<div style=\"background-color: red; color: white\">%s</div>\n"
173"<form method=\"post\" action=\"%s:/" "/%s/%s\">\n"
174"<p>Login: <input type=\"text\" name=\"login\" autocapitalize=\"off\"></p>\n"
175"<p>Password: <input type=\"password\" name=\"passwd\"></p>\n"
176"<input type=\"hidden\" name=\"redir\" value=\"%s\">\n"
177"<input type=\"hidden\" name=\"cid\" value=\"%s\">\n"
178"<input type=\"hidden\" name=\"state\" value=\"%s\">\n"
179"<input type=\"submit\" value=\"OK\">\n"
180"</form><p>%s</p></body></html>\n"
181"";
182
183int oauth_get_handler(const xs_dict *req, const char *q_path,
184 char **body, int *b_size, char **ctype)
185{
186 (void)b_size;
187
188 if (!xs_startswith(q_path, "/oauth/"))
189 return 0;
190
191 int status = HTTP_STATUS_NOT_FOUND;
192 const xs_dict *msg = xs_dict_get(req, "q_vars");
193 xs *cmd = xs_replace_n(q_path, "/oauth", "", 1);
194
195 srv_debug(1, xs_fmt("oauth_get_handler %s", q_path));
196
197 if (strcmp(cmd, "/authorize") == 0) { /** **/
198 const char *cid = xs_dict_get(msg, "client_id");
199 const char *ruri = xs_dict_get(msg, "redirect_uri");
200 const char *rtype = xs_dict_get(msg, "response_type");
201 const char *state = xs_dict_get(msg, "state");
202
203 status = HTTP_STATUS_BAD_REQUEST;
204
205 if (cid && ruri && rtype && strcmp(rtype, "code") == 0) {
206 xs *app = app_get(cid);
207
208 if (app != NULL) {
209 const char *host = xs_dict_get(srv_config, "host");
210 const char *proto = xs_dict_get_def(srv_config, "protocol", "https");
211
212 if (xs_is_null(state))
213 state = "";
214
215 *body = xs_fmt(login_page, host, host, "", proto, host, "oauth/x-snac-login",
216 ruri, cid, state, USER_AGENT);
217 *ctype = "text/html";
218 status = HTTP_STATUS_OK;
219
220 srv_debug(1, xs_fmt("oauth authorize: generating login page"));
221 }
222 else
223 srv_debug(1, xs_fmt("oauth authorize: bad client_id %s", cid));
224 }
225 else
226 srv_debug(1, xs_fmt("oauth authorize: invalid or unset arguments"));
227 }
228 else
229 if (strcmp(cmd, "/x-snac-get-token") == 0) { /** **/
230 const char *host = xs_dict_get(srv_config, "host");
231 const char *proto = xs_dict_get_def(srv_config, "protocol", "https");
232
233 *body = xs_fmt(login_page, host, host, "", proto, host, "oauth/x-snac-get-token",
234 "", "", "", USER_AGENT);
235 *ctype = "text/html";
236 status = HTTP_STATUS_OK;
237
238 }
239
240 return status;
241}
242
243
244int oauth_post_handler(const xs_dict *req, const char *q_path,
245 const char *payload, int p_size,
246 char **body, int *b_size, char **ctype)
247{
248 (void)p_size;
249 (void)b_size;
250
251 if (!xs_startswith(q_path, "/oauth/"))
252 return 0;
253
254 int status = HTTP_STATUS_NOT_FOUND;
255
256 const char *i_ctype = xs_dict_get(req, "content-type");
257 xs *args = NULL;
258
259 if (i_ctype && xs_startswith(i_ctype, "application/json")) {
260 if (!xs_is_null(payload))
261 args = xs_json_loads(payload);
262 }
263 else
264 if (i_ctype && xs_startswith(i_ctype, "application/x-www-form-urlencoded") && payload) {
265 args = xs_url_vars(payload);
266 }
267 else
268 args = xs_dup(xs_dict_get(req, "p_vars"));
269
270 if (args == NULL)
271 return HTTP_STATUS_BAD_REQUEST;
272
273 xs *cmd = xs_replace_n(q_path, "/oauth", "", 1);
274
275 srv_debug(1, xs_fmt("oauth_post_handler %s", q_path));
276
277 if (strcmp(cmd, "/x-snac-login") == 0) { /** **/
278 const char *login = xs_dict_get(args, "login");
279 const char *passwd = xs_dict_get(args, "passwd");
280 const char *redir = xs_dict_get(args, "redir");
281 const char *cid = xs_dict_get(args, "cid");
282 const char *state = xs_dict_get(args, "state");
283 const char *host = xs_dict_get(srv_config, "host");
284 const char *proto = xs_dict_get_def(srv_config, "protocol", "https");
285
286 /* by default, generate another login form with an error */
287 *body = xs_fmt(login_page, host, host, "LOGIN INCORRECT", proto, host, "oauth/x-snac-login",
288 redir, cid, state, USER_AGENT);
289 *ctype = "text/html";
290 status = HTTP_STATUS_OK;
291
292 if (login && passwd && redir && cid) {
293 snac snac;
294
295 if (user_open(&snac, login)) {
296 const char *addr = xs_or(xs_dict_get(req, "remote-addr"),
297 xs_dict_get(req, "x-forwarded-for"));
298
299 if (badlogin_check(login, addr)) {
300 /* check the login + password */
301 if (check_password(login, passwd, xs_dict_get(snac.config, "passwd"))) {
302 /* success! redirect to the desired uri */
303 xs *code = random_str();
304
305 xs_free(*body);
306
307 if (strcmp(redir, "urn:ietf:wg:oauth:2.0:oob") == 0) {
308 *body = xs_dup(code);
309 }
310 else {
311 if (xs_str_in(redir, "?") != -1)
312 *body = xs_fmt("%s&code=%s", redir, code);
313 else
314 *body = xs_fmt("%s?code=%s", redir, code);
315
316 status = HTTP_STATUS_SEE_OTHER;
317 }
318
319 /* if there is a state, add it */
320 if (!xs_is_null(state) && *state) {
321 *body = xs_str_cat(*body, "&state=");
322 *body = xs_str_cat(*body, state);
323 }
324
325 srv_log(xs_fmt("oauth x-snac-login: '%s' success, redirect to %s",
326 login, *body));
327
328 /* assign the login to the app */
329 xs *app = app_get(cid);
330
331 if (app != NULL) {
332 app = xs_dict_set(app, "uid", login);
333 app = xs_dict_set(app, "code", code);
334 app_add(cid, app);
335 }
336 else
337 srv_log(xs_fmt("oauth x-snac-login: error getting app %s", cid));
338 }
339 else {
340 srv_debug(1, xs_fmt("oauth x-snac-login: login '%s' incorrect", login));
341 badlogin_inc(login, addr);
342 }
343 }
344
345 user_free(&snac);
346 }
347 else
348 srv_debug(1, xs_fmt("oauth x-snac-login: bad user '%s'", login));
349 }
350 else
351 srv_debug(1, xs_fmt("oauth x-snac-login: invalid or unset arguments"));
352 }
353 else
354 if (strcmp(cmd, "/token") == 0) { /** **/
355 xs *wrk = NULL;
356 const char *gtype = xs_dict_get(args, "grant_type");
357 const char *code = xs_dict_get(args, "code");
358 const char *cid = xs_dict_get(args, "client_id");
359 const char *csec = xs_dict_get(args, "client_secret");
360 const char *ruri = xs_dict_get(args, "redirect_uri");
361 const char *scope = xs_dict_get(args, "scope");
362
363 /* no client_secret? check if it's inside an authorization header
364 (AndStatus does it this way) */
365 if (xs_is_null(csec)) {
366 const char *auhdr = xs_dict_get(req, "authorization");
367
368 if (!xs_is_null(auhdr) && xs_startswith(auhdr, "Basic ")) {
369 xs *s1 = xs_replace_n(auhdr, "Basic ", "", 1);
370 int size;
371 xs *s2 = xs_base64_dec(s1, &size);
372
373 if (!xs_is_null(s2)) {
374 xs *l1 = xs_split(s2, ":");
375
376 if (xs_list_len(l1) == 2) {
377 wrk = xs_dup(xs_list_get(l1, 1));
378 csec = wrk;
379 }
380 }
381 }
382 }
383
384 /* no code?
385 I'm not sure of the impacts of this right now, but Subway Tooter does not
386 provide a code so one must be generated */
387 if (xs_is_null(code)){
388 code = random_str();
389 }
390 if (gtype && code && cid && csec && ruri) {
391 xs *app = app_get(cid);
392
393 if (app == NULL) {
394 status = HTTP_STATUS_UNAUTHORIZED;
395 srv_log(xs_fmt("oauth token: invalid app %s", cid));
396 }
397 else
398 if (strcmp(csec, xs_dict_get(app, "client_secret")) != 0) {
399 status = HTTP_STATUS_UNAUTHORIZED;
400 srv_log(xs_fmt("oauth token: invalid client_secret for app %s", cid));
401 }
402 else {
403 xs *rsp = xs_dict_new();
404 xs *cat = xs_number_new(time(NULL));
405 xs *tokid = random_str();
406
407 rsp = xs_dict_append(rsp, "access_token", tokid);
408 rsp = xs_dict_append(rsp, "token_type", "Bearer");
409 rsp = xs_dict_append(rsp, "created_at", cat);
410
411 if (!xs_is_null(scope))
412 rsp = xs_dict_append(rsp, "scope", scope);
413
414 *body = xs_json_dumps(rsp, 4);
415 *ctype = "application/json";
416 status = HTTP_STATUS_OK;
417
418 const char *uid = xs_dict_get(app, "uid");
419
420 srv_debug(1, xs_fmt("oauth token: "
421 "successful login for %s, new token %s", uid, tokid));
422
423 xs *token = xs_dict_new();
424 token = xs_dict_append(token, "token", tokid);
425 token = xs_dict_append(token, "client_id", cid);
426 token = xs_dict_append(token, "client_secret", csec);
427 token = xs_dict_append(token, "uid", uid);
428 token = xs_dict_append(token, "code", code);
429
430 token_add(tokid, token);
431 }
432 }
433 else {
434 srv_debug(1, xs_fmt("oauth token: invalid or unset arguments"));
435 status = HTTP_STATUS_BAD_REQUEST;
436 }
437 }
438 else
439 if (strcmp(cmd, "/revoke") == 0) { /** **/
440 const char *cid = xs_dict_get(args, "client_id");
441 const char *csec = xs_dict_get(args, "client_secret");
442 const char *tokid = xs_dict_get(args, "token");
443
444 if (cid && csec && tokid) {
445 xs *token = token_get(tokid);
446
447 *body = xs_str_new("{}");
448 *ctype = "application/json";
449
450 if (token == NULL || strcmp(csec, xs_dict_get(token, "client_secret")) != 0) {
451 srv_debug(1, xs_fmt("oauth revoke: bad secret for token %s", tokid));
452 status = HTTP_STATUS_FORBIDDEN;
453 }
454 else {
455 token_del(tokid);
456 srv_debug(1, xs_fmt("oauth revoke: revoked token %s", tokid));
457 status = HTTP_STATUS_OK;
458
459 /* also delete the app, as it serves no purpose from now on */
460 app_del(cid);
461 }
462 }
463 else {
464 srv_debug(1, xs_fmt("oauth revoke: invalid or unset arguments"));
465 status = HTTP_STATUS_FORBIDDEN;
466 }
467 }
468 if (strcmp(cmd, "/x-snac-get-token") == 0) { /** **/
469 const char *login = xs_dict_get(args, "login");
470 const char *passwd = xs_dict_get(args, "passwd");
471 const char *host = xs_dict_get(srv_config, "host");
472 const char *proto = xs_dict_get_def(srv_config, "protocol", "https");
473
474 /* by default, generate another login form with an error */
475 *body = xs_fmt(login_page, host, host, "LOGIN INCORRECT", proto, host, "oauth/x-snac-get-token",
476 "", "", "", USER_AGENT);
477 *ctype = "text/html";
478 status = HTTP_STATUS_OK;
479
480 if (login && passwd) {
481 snac user;
482
483 if (user_open(&user, login)) {
484 const char *addr = xs_or(xs_dict_get(req, "remote-addr"),
485 xs_dict_get(req, "x-forwarded-for"));
486
487 if (badlogin_check(login, addr)) {
488 /* check the login + password */
489 if (check_password(login, passwd, xs_dict_get(user.config, "passwd"))) {
490 /* success! create a new token */
491 xs *tokid = random_str();
492
493 srv_debug(1, xs_fmt("x-snac-new-token: "
494 "successful login for %s, new token %s", login, tokid));
495
496 xs *token = xs_dict_new();
497 token = xs_dict_append(token, "token", tokid);
498 token = xs_dict_append(token, "client_id", "snac-client");
499 token = xs_dict_append(token, "client_secret", "");
500 token = xs_dict_append(token, "uid", login);
501 token = xs_dict_append(token, "code", "");
502
503 token_add(tokid, token);
504
505 *ctype = "text/plain";
506 xs_free(*body);
507 *body = xs_dup(tokid);
508 }
509 else
510 badlogin_inc(login, addr);
511
512 user_free(&user);
513 }
514 }
515 }
516 }
517
518 return status;
519}
520
521
522xs_str *mastoapi_id(const xs_dict *msg)
523/* returns a somewhat Mastodon-compatible status id */
524{
525 const char *id = xs_dict_get(msg, "id");
526 xs *md5 = xs_md5_hex(id, strlen(id));
527
528 return xs_fmt("%10.0f%s", object_ctime_by_md5(md5), md5);
529}
530
531#define MID_TO_MD5(id) (id + 10)
532
533
534xs_dict *mastoapi_account(snac *logged, const xs_dict *actor)
535/* converts an ActivityPub actor to a Mastodon account */
536{
537 const char *id = xs_dict_get(actor, "id");
538 const char *pub = xs_dict_get(actor, "published");
539 const char *proxy = NULL;
540
541 if (xs_type(id) != XSTYPE_STRING)
542 return NULL;
543
544 if (logged && xs_is_true(xs_dict_get(srv_config, "proxy_media")))
545 proxy = logged->actor;
546
547 const char *prefu = xs_dict_get(actor, "preferredUsername");
548
549 const char *display_name = xs_dict_get(actor, "name");
550 if (xs_is_null(display_name) || *display_name == '\0')
551 display_name = prefu;
552
553 xs_dict *acct = xs_dict_new();
554 xs *acct_md5 = xs_md5_hex(id, strlen(id));
555 acct = xs_dict_append(acct, "id", acct_md5);
556 acct = xs_dict_append(acct, "username", prefu);
557 acct = xs_dict_append(acct, "display_name", display_name);
558 acct = xs_dict_append(acct, "discoverable", xs_stock(XSTYPE_TRUE));
559 acct = xs_dict_append(acct, "group", xs_stock(XSTYPE_FALSE));
560 acct = xs_dict_append(acct, "hide_collections", xs_stock(XSTYPE_FALSE));
561 acct = xs_dict_append(acct, "indexable", xs_stock(XSTYPE_TRUE));
562 acct = xs_dict_append(acct, "noindex", xs_stock(XSTYPE_FALSE));
563 acct = xs_dict_append(acct, "roles", xs_stock(XSTYPE_LIST));
564
565 {
566 /* create the acct field as user@host */
567 xs *l = xs_split(id, "/");
568 xs *fquid = xs_fmt("%s@%s", prefu, xs_list_get(l, 2));
569 acct = xs_dict_append(acct, "acct", fquid);
570 }
571
572 if (pub)
573 acct = xs_dict_append(acct, "created_at", pub);
574 else {
575 /* unset created_at crashes Tusky, so lie like a mf */
576 xs *date = xs_str_utctime(0, ISO_DATE_SPEC);
577 acct = xs_dict_append(acct, "created_at", date);
578 }
579
580 xs *last_status_at = xs_str_utctime(0, "%Y-%m-%d");
581 acct = xs_dict_append(acct, "last_status_at", last_status_at);
582
583 const char *note = xs_dict_get(actor, "summary");
584 if (xs_is_null(note))
585 note = "";
586
587 if (strcmp(xs_dict_get(actor, "type"), "Service") == 0)
588 acct = xs_dict_append(acct, "bot", xs_stock(XSTYPE_TRUE));
589 else
590 acct = xs_dict_append(acct, "bot", xs_stock(XSTYPE_FALSE));
591
592 acct = xs_dict_append(acct, "note", note);
593
594 acct = xs_dict_append(acct, "url", id);
595 acct = xs_dict_append(acct, "uri", id);
596
597 xs *avatar = NULL;
598 const xs_dict *av = xs_dict_get(actor, "icon");
599
600 if (xs_type(av) == XSTYPE_DICT) {
601 const char *url = xs_dict_get(av, "url");
602
603 if (url != NULL)
604 avatar = make_url(url, proxy, 1);
605 }
606
607 if (avatar == NULL)
608 avatar = xs_fmt("%s/susie.png", srv_baseurl);
609
610 acct = xs_dict_append(acct, "avatar", avatar);
611 acct = xs_dict_append(acct, "avatar_static", avatar);
612
613 xs *header = NULL;
614 const xs_dict *hd = xs_dict_get(actor, "image");
615
616 if (xs_type(hd) == XSTYPE_DICT)
617 header = make_url(xs_dict_get(hd, "url"), proxy, 1);
618
619 if (xs_is_null(header))
620 header = xs_str_new(NULL);
621
622 acct = xs_dict_append(acct, "header", header);
623 acct = xs_dict_append(acct, "header_static", header);
624
625 /* emojis */
626 const xs_list *p;
627 if (!xs_is_null(p = xs_dict_get(actor, "tag"))) {
628 xs *eml = xs_list_new();
629 const xs_dict *v;
630 int c = 0;
631
632 while (xs_list_next(p, &v, &c)) {
633 const char *type = xs_dict_get(v, "type");
634
635 if (!xs_is_null(type) && strcmp(type, "Emoji") == 0) {
636 const char *name = xs_dict_get(v, "name");
637 const xs_dict *icon = xs_dict_get(v, "icon");
638
639 if (!xs_is_null(name) && !xs_is_null(icon)) {
640 const char *o_url = xs_dict_get(icon, "url");
641
642 if (!xs_is_null(o_url)) {
643 xs *url = make_url(o_url, proxy, 1);
644 xs *nm = xs_strip_chars_i(xs_dup(name), ":");
645 xs *d1 = xs_dict_new();
646
647 d1 = xs_dict_append(d1, "shortcode", nm);
648 d1 = xs_dict_append(d1, "url", url);
649 d1 = xs_dict_append(d1, "static_url", url);
650 d1 = xs_dict_append(d1, "visible_in_picker", xs_stock(XSTYPE_TRUE));
651
652 eml = xs_list_append(eml, d1);
653 }
654 }
655 }
656 }
657
658 acct = xs_dict_append(acct, "emojis", eml);
659 }
660
661 acct = xs_dict_append(acct, "locked", xs_stock(XSTYPE_FALSE));
662 acct = xs_dict_append(acct, "followers_count", xs_stock(0));
663 acct = xs_dict_append(acct, "following_count", xs_stock(0));
664 acct = xs_dict_append(acct, "statuses_count", xs_stock(0));
665
666 xs *fields = xs_list_new();
667 p = xs_dict_get(actor, "attachment");
668 const xs_dict *v;
669
670 /* dict of validated links */
671 xs_dict *val_links = NULL;
672 const xs_dict *metadata = xs_stock(XSTYPE_DICT);
673 snac user = {0};
674
675 if (xs_startswith(id, srv_baseurl)) {
676 /* if it's a local user, open it and pick its validated links */
677 if (user_open(&user, prefu)) {
678 val_links = user.links;
679 metadata = xs_dict_get_def(user.config, "metadata", xs_stock(XSTYPE_DICT));
680
681 /* does this user want to publish their contact metrics? */
682 if (xs_is_true(xs_dict_get(user.config, "show_contact_metrics"))) {
683 xs *fwing = following_list(&user);
684 xs *fwers = follower_list(&user);
685 xs *ni = xs_number_new(xs_list_len(fwing));
686 xs *ne = xs_number_new(xs_list_len(fwers));
687
688 acct = xs_dict_append(acct, "followers_count", ne);
689 acct = xs_dict_append(acct, "following_count", ni);
690 }
691 }
692 }
693
694 if (xs_is_null(val_links))
695 val_links = xs_stock(XSTYPE_DICT);
696
697 int c = 0;
698 while (xs_list_next(p, &v, &c)) {
699 const char *type = xs_dict_get(v, "type");
700 const char *name = xs_dict_get(v, "name");
701 const char *value = xs_dict_get(v, "value");
702
703 if (!xs_is_null(type) && !xs_is_null(name) &&
704 !xs_is_null(value) && strcmp(type, "PropertyValue") == 0) {
705 xs *val_date = NULL;
706
707 const char *url = xs_dict_get(metadata, name);
708
709 if (!xs_is_null(url) && xs_startswith(url, "https:/" "/")) {
710 const xs_number *verified_time = xs_dict_get(val_links, url);
711 if (xs_type(verified_time) == XSTYPE_NUMBER) {
712 time_t t = xs_number_get(verified_time);
713
714 if (t > 0)
715 val_date = xs_str_utctime(t, ISO_DATE_SPEC);
716 }
717 }
718
719 xs *d = xs_dict_new();
720
721 d = xs_dict_append(d, "name", name);
722 d = xs_dict_append(d, "value", value);
723 d = xs_dict_append(d, "verified_at",
724 xs_type(val_date) == XSTYPE_STRING && *val_date ?
725 val_date : xs_stock(XSTYPE_NULL));
726
727 fields = xs_list_append(fields, d);
728 }
729 }
730
731 user_free(&user);
732
733 acct = xs_dict_append(acct, "fields", fields);
734
735 return acct;
736}
737
738
739xs_str *mastoapi_date(const char *date)
740/* converts an ISO 8601 date to whatever format Mastodon uses */
741{
742 xs_str *s = xs_crop_i(xs_dup(date), 0, 19);
743 s = xs_str_cat(s, ".000Z");
744
745 return s;
746}
747
748
749xs_dict *mastoapi_poll(snac *snac, const xs_dict *msg)
750/* creates a mastoapi Poll object */
751{
752 xs_dict *poll = xs_dict_new();
753 xs *mid = mastoapi_id(msg);
754 const xs_list *opts = NULL;
755 const xs_val *v;
756 int num_votes = 0;
757 xs *options = xs_list_new();
758
759 poll = xs_dict_append(poll, "id", mid);
760 const char *date = xs_dict_get(msg, "endTime");
761 if (date == NULL)
762 date = xs_dict_get(msg, "closed");
763 if (date == NULL)
764 return NULL;
765
766 xs *fd = mastoapi_date(date);
767 poll = xs_dict_append(poll, "expires_at", fd);
768
769 date = xs_dict_get(msg, "closed");
770 time_t t = 0;
771
772 if (date != NULL)
773 t = xs_parse_iso_date(date, 0);
774
775 poll = xs_dict_append(poll, "expired",
776 t < time(NULL) ? xs_stock(XSTYPE_FALSE) : xs_stock(XSTYPE_TRUE));
777
778 if ((opts = xs_dict_get(msg, "oneOf")) != NULL)
779 poll = xs_dict_append(poll, "multiple", xs_stock(XSTYPE_FALSE));
780 else {
781 opts = xs_dict_get(msg, "anyOf");
782 poll = xs_dict_append(poll, "multiple", xs_stock(XSTYPE_TRUE));
783 }
784
785 int c = 0;
786 while (xs_list_next(opts, &v, &c)) {
787 const char *title = xs_dict_get(v, "name");
788 const char *replies = xs_dict_get(v, "replies");
789
790 if (title && replies) {
791 const char *votes_count = xs_dict_get(replies, "totalItems");
792
793 if (xs_type(votes_count) == XSTYPE_NUMBER) {
794 xs *d = xs_dict_new();
795 d = xs_dict_append(d, "title", title);
796 d = xs_dict_append(d, "votes_count", votes_count);
797
798 options = xs_list_append(options, d);
799 num_votes += xs_number_get(votes_count);
800 }
801 }
802 }
803
804 poll = xs_dict_append(poll, "options", options);
805 xs *vc = xs_number_new(num_votes);
806 poll = xs_dict_append(poll, "votes_count", vc);
807
808 poll = xs_dict_append(poll, "emojis", xs_stock(XSTYPE_LIST));
809
810 poll = xs_dict_append(poll, "voted",
811 (snac && was_question_voted(snac, xs_dict_get(msg, "id"))) ?
812 xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
813
814 return poll;
815}
816
817
818xs_dict *mastoapi_status(snac *snac, const xs_dict *msg)
819/* converts an ActivityPub note to a Mastodon status */
820{
821 xs *actor = NULL;
822 actor_get_refresh(snac, get_atto(msg), &actor);
823 const char *proxy = NULL;
824
825 /* if the author is not here, discard */
826 if (actor == NULL)
827 return NULL;
828
829 if (snac && xs_is_true(xs_dict_get(srv_config, "proxy_media")))
830 proxy = snac->actor;
831
832 const char *type = xs_dict_get(msg, "type");
833 const char *id = xs_dict_get(msg, "id");
834
835 /* fail if it's not a valid actor */
836 if (xs_is_null(type) || xs_is_null(id))
837 return NULL;
838
839 xs *acct = mastoapi_account(snac, actor);
840 if (acct == NULL)
841 return NULL;
842
843 xs *idx = NULL;
844 xs *ixc = NULL;
845 const char *tmp;
846 xs *mid = mastoapi_id(msg);
847
848 xs_dict *st = xs_dict_new();
849
850 st = xs_dict_append(st, "id", mid);
851 st = xs_dict_append(st, "uri", id);
852 st = xs_dict_append(st, "url", id);
853 st = xs_dict_append(st, "account", acct);
854
855 const char *published = xs_dict_get(msg, "published");
856 xs *fd = NULL;
857
858 if (published)
859 fd = mastoapi_date(published);
860 else {
861 xs *p = xs_str_iso_date(0);
862 fd = mastoapi_date(p);
863 }
864
865 st = xs_dict_append(st, "created_at", fd);
866
867 {
868 const char *content = xs_dict_get(msg, "content");
869 const char *name = xs_dict_get(msg, "name");
870 xs *s1 = NULL;
871
872 if (name && content)
873 s1 = xs_fmt("%s<br><br>%s", name, content);
874 else
875 if (name)
876 s1 = xs_dup(name);
877 else
878 if (content)
879 s1 = xs_dup(content);
880 else
881 s1 = xs_str_new(NULL);
882
883 st = xs_dict_append(st, "content", s1);
884 }
885
886 st = xs_dict_append(st, "visibility",
887 is_msg_public(msg) ? "public" : "private");
888
889 tmp = xs_dict_get(msg, "sensitive");
890 if (xs_is_null(tmp))
891 tmp = xs_stock(XSTYPE_FALSE);
892
893 st = xs_dict_append(st, "sensitive", tmp);
894
895 tmp = xs_dict_get(msg, "summary");
896 if (xs_is_null(tmp))
897 tmp = "";
898
899 st = xs_dict_append(st, "spoiler_text", tmp);
900
901 /* create the list of attachments */
902 xs *attach = get_attachments(msg);
903
904 {
905 xs_list *p = attach;
906 const xs_dict *v;
907
908 xs *matt = xs_list_new();
909
910 while (xs_list_iter(&p, &v)) {
911 const char *type = xs_dict_get(v, "type");
912 const char *o_href = xs_dict_get(v, "href");
913 const char *name = xs_dict_get(v, "name");
914
915 if (xs_match(type, "image/*|video/*|audio/*|Image|Video")) { /* */
916 xs *matteid = xs_fmt("%s_%d", id, xs_list_len(matt));
917 xs *href = make_url(o_href, proxy, 1);
918
919 xs *d = xs_dict_new();
920
921 d = xs_dict_append(d, "id", matteid);
922 d = xs_dict_append(d, "url", href);
923 d = xs_dict_append(d, "preview_url", href);
924 d = xs_dict_append(d, "remote_url", href);
925 d = xs_dict_append(d, "description", name);
926
927 d = xs_dict_append(d, "type", (*type == 'v' || *type == 'V') ? "video" :
928 (*type == 'a' || *type == 'A') ? "audio" : "image");
929
930 matt = xs_list_append(matt, d);
931 }
932 }
933
934 st = xs_dict_append(st, "media_attachments", matt);
935 }
936
937 {
938 xs *ml = xs_list_new();
939 xs *htl = xs_list_new();
940 xs *eml = xs_list_new();
941 const xs_list *tag = xs_dict_get(msg, "tag");
942 int n = 0;
943
944 xs *tag_list = NULL;
945
946 if (xs_type(tag) == XSTYPE_DICT) {
947 tag_list = xs_list_new();
948 tag_list = xs_list_append(tag_list, tag);
949 }
950 else
951 if (xs_type(tag) == XSTYPE_LIST)
952 tag_list = xs_dup(tag);
953 else
954 tag_list = xs_list_new();
955
956 tag = tag_list;
957 const xs_dict *v;
958
959 int c = 0;
960 while (xs_list_next(tag, &v, &c)) {
961 const char *type = xs_dict_get(v, "type");
962
963 if (xs_is_null(type))
964 continue;
965
966 xs *d1 = xs_dict_new();
967
968 if (strcmp(type, "Mention") == 0) {
969 const char *name = xs_dict_get(v, "name");
970 const char *href = xs_dict_get(v, "href");
971
972 if (!xs_is_null(name) && !xs_is_null(href) &&
973 (snac == NULL || strcmp(href, snac->actor) != 0)) {
974 xs *nm = xs_strip_chars_i(xs_dup(name), "@");
975
976 xs *id = xs_fmt("%d", n++);
977 d1 = xs_dict_append(d1, "id", id);
978 d1 = xs_dict_append(d1, "username", nm);
979 d1 = xs_dict_append(d1, "acct", nm);
980 d1 = xs_dict_append(d1, "url", href);
981
982 ml = xs_list_append(ml, d1);
983 }
984 }
985 else
986 if (strcmp(type, "Hashtag") == 0) {
987 const char *name = xs_dict_get(v, "name");
988 const char *href = xs_dict_get(v, "href");
989
990 if (!xs_is_null(name) && !xs_is_null(href)) {
991 xs *nm = xs_strip_chars_i(xs_dup(name), "#");
992
993 d1 = xs_dict_append(d1, "name", nm);
994 d1 = xs_dict_append(d1, "url", href);
995
996 htl = xs_list_append(htl, d1);
997 }
998 }
999 else
1000 if (strcmp(type, "Emoji") == 0) {
1001 const char *name = xs_dict_get(v, "name");
1002 const xs_dict *icon = xs_dict_get(v, "icon");
1003
1004 if (!xs_is_null(name) && !xs_is_null(icon)) {
1005 const char *o_url = xs_dict_get(icon, "url");
1006
1007 if (!xs_is_null(o_url)) {
1008 xs *url = make_url(o_url, snac ? snac->actor : NULL, 1);
1009 xs *nm = xs_strip_chars_i(xs_dup(name), ":");
1010
1011 d1 = xs_dict_append(d1, "shortcode", nm);
1012 d1 = xs_dict_append(d1, "url", url);
1013 d1 = xs_dict_append(d1, "static_url", url);
1014 d1 = xs_dict_append(d1, "visible_in_picker", xs_stock(XSTYPE_TRUE));
1015 d1 = xs_dict_append(d1, "category", "Emojis");
1016
1017 eml = xs_list_append(eml, d1);
1018 }
1019 }
1020 }
1021 }
1022
1023 st = xs_dict_append(st, "mentions", ml);
1024 st = xs_dict_append(st, "tags", htl);
1025 st = xs_dict_append(st, "emojis", eml);
1026 }
1027
1028 xs_free(idx);
1029 xs_free(ixc);
1030 idx = object_likes(id);
1031 ixc = xs_number_new(xs_list_len(idx));
1032
1033 st = xs_dict_append(st, "favourites_count", ixc);
1034 st = xs_dict_append(st, "favourited",
1035 (snac && xs_list_in(idx, snac->md5) != -1) ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
1036
1037 xs_free(idx);
1038 xs_free(ixc);
1039 idx = object_announces(id);
1040 ixc = xs_number_new(xs_list_len(idx));
1041
1042 st = xs_dict_append(st, "reblogs_count", ixc);
1043 st = xs_dict_append(st, "reblogged",
1044 (snac && xs_list_in(idx, snac->md5) != -1) ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
1045
1046 /* get the last person who boosted this */
1047 xs *boosted_by_md5 = NULL;
1048 if (xs_list_len(idx))
1049 boosted_by_md5 = xs_dup(xs_list_get(idx, -1));
1050
1051 xs_free(idx);
1052 xs_free(ixc);
1053 idx = object_children(id);
1054 ixc = xs_number_new(xs_list_len(idx));
1055
1056 st = xs_dict_append(st, "replies_count", ixc);
1057
1058 /* default in_reply_to values */
1059 st = xs_dict_append(st, "in_reply_to_id", xs_stock(XSTYPE_NULL));
1060 st = xs_dict_append(st, "in_reply_to_account_id", xs_stock(XSTYPE_NULL));
1061
1062 tmp = get_in_reply_to(msg);
1063 if (!xs_is_null(tmp)) {
1064 xs *irto = NULL;
1065
1066 if (valid_status(object_get(tmp, &irto))) {
1067 xs *irt_mid = mastoapi_id(irto);
1068 st = xs_dict_set(st, "in_reply_to_id", irt_mid);
1069
1070 const char *at = NULL;
1071 if (!xs_is_null(at = get_atto(irto))) {
1072 xs *at_md5 = xs_md5_hex(at, strlen(at));
1073 st = xs_dict_set(st, "in_reply_to_account_id", at_md5);
1074 }
1075 }
1076 }
1077
1078 st = xs_dict_append(st, "reblog", xs_stock(XSTYPE_NULL));
1079 st = xs_dict_append(st, "card", xs_stock(XSTYPE_NULL));
1080 st = xs_dict_append(st, "language", "en");
1081
1082 st = xs_dict_append(st, "filtered", xs_stock(XSTYPE_LIST));
1083 st = xs_dict_append(st, "muted", xs_stock(XSTYPE_FALSE));
1084
1085 tmp = xs_dict_get(msg, "sourceContent");
1086 if (xs_is_null(tmp))
1087 tmp = "";
1088
1089 st = xs_dict_append(st, "text", tmp);
1090
1091 tmp = xs_dict_get(msg, "updated");
1092 xs *fd2 = NULL;
1093 if (xs_is_null(tmp))
1094 tmp = xs_stock(XSTYPE_NULL);
1095 else {
1096 fd2 = mastoapi_date(tmp);
1097 tmp = fd2;
1098 }
1099
1100 st = xs_dict_append(st, "edited_at", tmp);
1101
1102 if (strcmp(type, "Question") == 0) {
1103 xs *poll = mastoapi_poll(snac, msg);
1104 st = xs_dict_append(st, "poll", poll);
1105 }
1106 else
1107 st = xs_dict_append(st, "poll", xs_stock(XSTYPE_NULL));
1108
1109 st = xs_dict_append(st, "bookmarked",
1110 (snac && is_bookmarked(snac, id)) ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
1111
1112 st = xs_dict_append(st, "pinned",
1113 (snac && is_pinned(snac, id)) ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
1114
1115 /* is it a boost? */
1116 if (!xs_is_null(boosted_by_md5)) {
1117 /* create a new dummy status, using st as the 'reblog' field */
1118 xs_dict *bst = xs_dup(st);
1119 xs *b_actor = NULL;
1120
1121 if (valid_status(object_get_by_md5(boosted_by_md5, &b_actor))) {
1122 xs *b_acct = mastoapi_account(snac, b_actor);
1123 xs *fake_uri = NULL;
1124
1125 if (snac)
1126 fake_uri = xs_fmt("%s/d/%s/Announce", snac->actor, mid);
1127 else
1128 fake_uri = xs_fmt("%s#%s", srv_baseurl, mid);
1129
1130 bst = xs_dict_set(bst, "uri", fake_uri);
1131 bst = xs_dict_set(bst, "url", fake_uri);
1132 bst = xs_dict_set(bst, "account", b_acct);
1133 bst = xs_dict_set(bst, "content", "");
1134 bst = xs_dict_set(bst, "reblog", st);
1135
1136 xs_free(st);
1137 st = bst;
1138 }
1139 }
1140
1141 return st;
1142}
1143
1144
1145xs_dict *mastoapi_relationship(snac *snac, const char *md5)
1146{
1147 xs_dict *rel = NULL;
1148 xs *actor_o = NULL;
1149
1150 if (valid_status(object_get_by_md5(md5, &actor_o))) {
1151 rel = xs_dict_new();
1152
1153 const char *actor = xs_dict_get(actor_o, "id");
1154
1155 rel = xs_dict_append(rel, "id", md5);
1156 rel = xs_dict_append(rel, "following",
1157 following_check(snac, actor) ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
1158
1159 rel = xs_dict_append(rel, "showing_reblogs", xs_stock(XSTYPE_TRUE));
1160 rel = xs_dict_append(rel, "notifying", xs_stock(XSTYPE_FALSE));
1161 rel = xs_dict_append(rel, "followed_by",
1162 follower_check(snac, actor) ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
1163
1164 rel = xs_dict_append(rel, "blocking",
1165 is_muted(snac, actor) ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
1166
1167 rel = xs_dict_append(rel, "muting", xs_stock(XSTYPE_FALSE));
1168 rel = xs_dict_append(rel, "muting_notifications", xs_stock(XSTYPE_FALSE));
1169 rel = xs_dict_append(rel, "requested", xs_stock(XSTYPE_FALSE));
1170 rel = xs_dict_append(rel, "domain_blocking", xs_stock(XSTYPE_FALSE));
1171 rel = xs_dict_append(rel, "endorsed", xs_stock(XSTYPE_FALSE));
1172 rel = xs_dict_append(rel, "note", "");
1173 }
1174
1175 return rel;
1176}
1177
1178
1179int process_auth_token(snac *snac, const xs_dict *req)
1180/* processes an authorization token, if there is one */
1181{
1182 int logged_in = 0;
1183 const char *v;
1184
1185 /* if there is an authorization field, try to validate it */
1186 if (!xs_is_null(v = xs_dict_get(req, "authorization")) && xs_startswith(v, "Bearer ")) {
1187 xs *tokid = xs_replace_n(v, "Bearer ", "", 1);
1188 xs *token = token_get(tokid);
1189
1190 if (token != NULL) {
1191 const char *uid = xs_dict_get(token, "uid");
1192
1193 if (!xs_is_null(uid) && user_open(snac, uid)) {
1194 logged_in = 1;
1195
1196 /* this counts as a 'login' */
1197 lastlog_write(snac, "mastoapi");
1198
1199 srv_debug(2, xs_fmt("mastoapi auth: valid token for user '%s'", uid));
1200 }
1201 else
1202 srv_log(xs_fmt("mastoapi auth: corrupted token '%s'", tokid));
1203 }
1204 else
1205 srv_log(xs_fmt("mastoapi auth: invalid token '%s'", tokid));
1206 }
1207
1208 return logged_in;
1209}
1210
1211
1212void credentials_get(char **body, char **ctype, int *status, snac snac)
1213{
1214 xs *acct = xs_dict_new();
1215
1216 const xs_val *bot = xs_dict_get(snac.config, "bot");
1217
1218 acct = xs_dict_append(acct, "id", snac.md5);
1219 acct = xs_dict_append(acct, "username", xs_dict_get(snac.config, "uid"));
1220 acct = xs_dict_append(acct, "acct", xs_dict_get(snac.config, "uid"));
1221 acct = xs_dict_append(acct, "display_name", xs_dict_get(snac.config, "name"));
1222 acct = xs_dict_append(acct, "created_at", xs_dict_get(snac.config, "published"));
1223 acct = xs_dict_append(acct, "last_status_at", xs_dict_get(snac.config, "published"));
1224 acct = xs_dict_append(acct, "note", xs_dict_get(snac.config, "bio"));
1225 acct = xs_dict_append(acct, "url", snac.actor);
1226
1227 acct = xs_dict_append(acct, "locked",
1228 xs_stock(xs_is_true(xs_dict_get(snac.config, "approve_followers")) ? XSTYPE_TRUE : XSTYPE_FALSE));
1229
1230 acct = xs_dict_append(acct, "bot", xs_stock(xs_is_true(bot) ? XSTYPE_TRUE : XSTYPE_FALSE));
1231 acct = xs_dict_append(acct, "emojis", xs_stock(XSTYPE_LIST));
1232
1233 xs *src = xs_json_loads("{\"privacy\":\"public\", \"language\":\"en\","
1234 "\"follow_requests_count\": 0,"
1235 "\"sensitive\":false,\"fields\":[],\"note\":\"\"}");
1236 /* some apps take the note from the source object */
1237 src = xs_dict_set(src, "note", xs_dict_get(snac.config, "bio"));
1238 src = xs_dict_set(src, "privacy", xs_type(xs_dict_get(snac.config, "private")) == XSTYPE_TRUE ? "private" : "public");
1239
1240 const xs_str *cw = xs_dict_get(snac.config, "cw");
1241 src = xs_dict_set(src, "sensitive",
1242 strcmp(cw, "open") == 0 ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
1243
1244 src = xs_dict_set(src, "bot", xs_stock(xs_is_true(bot) ? XSTYPE_TRUE : XSTYPE_FALSE));
1245
1246 xs *avatar = NULL;
1247 const char *av = xs_dict_get(snac.config, "avatar");
1248
1249 if (xs_is_null(av) || *av == '\0')
1250 avatar = xs_fmt("%s/susie.png", srv_baseurl);
1251 else
1252 avatar = xs_dup(av);
1253
1254 acct = xs_dict_append(acct, "avatar", avatar);
1255 acct = xs_dict_append(acct, "avatar_static", avatar);
1256
1257 xs *header = NULL;
1258 const char *hd = xs_dict_get(snac.config, "header");
1259
1260 if (!xs_is_null(hd))
1261 header = xs_dup(hd);
1262 else
1263 header = xs_str_new(NULL);
1264
1265 acct = xs_dict_append(acct, "header", header);
1266 acct = xs_dict_append(acct, "header_static", header);
1267
1268 const xs_dict *metadata = xs_dict_get(snac.config, "metadata");
1269 if (xs_type(metadata) == XSTYPE_DICT) {
1270 xs *fields = xs_list_new();
1271 const xs_str *k;
1272 const xs_str *v;
1273
1274 xs_dict *val_links = snac.links;
1275 if (xs_is_null(val_links))
1276 val_links = xs_stock(XSTYPE_DICT);
1277
1278 int c = 0;
1279 while (xs_dict_next(metadata, &k, &v, &c)) {
1280 xs *val_date = NULL;
1281
1282 const xs_number *verified_time = xs_dict_get(val_links, v);
1283 if (xs_type(verified_time) == XSTYPE_NUMBER) {
1284 time_t t = xs_number_get(verified_time);
1285
1286 if (t > 0)
1287 val_date = xs_str_utctime(t, ISO_DATE_SPEC);
1288 }
1289
1290 xs *d = xs_dict_new();
1291
1292 d = xs_dict_append(d, "name", k);
1293 d = xs_dict_append(d, "value", v);
1294 d = xs_dict_append(d, "verified_at",
1295 xs_type(val_date) == XSTYPE_STRING && *val_date ? val_date : xs_stock(XSTYPE_NULL));
1296
1297 fields = xs_list_append(fields, d);
1298 }
1299
1300 acct = xs_dict_set(acct, "fields", fields);
1301 /* some apps take the fields from the source object */
1302 src = xs_dict_set(src, "fields", fields);
1303 }
1304
1305 acct = xs_dict_append(acct, "source", src);
1306 acct = xs_dict_append(acct, "followers_count", xs_stock(0));
1307 acct = xs_dict_append(acct, "following_count", xs_stock(0));
1308 acct = xs_dict_append(acct, "statuses_count", xs_stock(0));
1309
1310 /* does this user want to publish their contact metrics? */
1311 if (xs_is_true(xs_dict_get(snac.config, "show_contact_metrics"))) {
1312 xs *fwing = following_list(&snac);
1313 xs *fwers = follower_list(&snac);
1314 xs *ni = xs_number_new(xs_list_len(fwing));
1315 xs *ne = xs_number_new(xs_list_len(fwers));
1316
1317 acct = xs_dict_append(acct, "followers_count", ne);
1318 acct = xs_dict_append(acct, "following_count", ni);
1319 }
1320
1321 *body = xs_json_dumps(acct, 4);
1322 *ctype = "application/json";
1323 *status = HTTP_STATUS_OK;
1324}
1325
1326
1327xs_list *mastoapi_timeline(snac *user, const xs_dict *args, const char *index_fn)
1328{
1329 xs_list *out = xs_list_new();
1330 FILE *f;
1331 char md5[MD5_HEX_SIZE];
1332
1333 if (dbglevel) {
1334 xs *js = xs_json_dumps(args, 0);
1335 srv_debug(1, xs_fmt("mastoapi_timeline args %s", js));
1336 }
1337
1338 if ((f = fopen(index_fn, "r")) == NULL)
1339 return out;
1340
1341 const char *max_id = xs_dict_get(args, "max_id");
1342 const char *since_id = xs_dict_get(args, "since_id");
1343 const char *min_id = xs_dict_get(args, "min_id"); /* unsupported old-to-new navigation */
1344 const char *limit_s = xs_dict_get(args, "limit");
1345 int (*iterator)(FILE *, char *);
1346 int initial_status = 0;
1347 int ascending = 0;
1348 int limit = 0;
1349 int cnt = 0;
1350
1351 if (!xs_is_null(limit_s))
1352 limit = atoi(limit_s);
1353
1354 if (limit == 0)
1355 limit = 20;
1356
1357 if (min_id) {
1358 iterator = &index_asc_next;
1359 initial_status = index_asc_first(f, md5, MID_TO_MD5(min_id));
1360 ascending = 1;
1361 }
1362 else {
1363 iterator = &index_desc_next;
1364 initial_status = index_desc_first(f, md5, 0);
1365 }
1366
1367 if (initial_status) {
1368 do {
1369 xs *msg = NULL;
1370
1371 /* only return entries older that max_id */
1372 if (max_id) {
1373 if (strcmp(md5, MID_TO_MD5(max_id)) == 0) {
1374 max_id = NULL;
1375 if (ascending)
1376 break;
1377 }
1378 if (!ascending)
1379 continue;
1380 }
1381
1382 /* only returns entries newer than since_id */
1383 if (since_id) {
1384 if (strcmp(md5, MID_TO_MD5(since_id)) == 0) {
1385 if (!ascending)
1386 break;
1387 since_id = NULL;
1388 }
1389 if (ascending)
1390 continue;
1391 }
1392
1393 /* get the entry */
1394 if (user) {
1395 if (!valid_status(timeline_get_by_md5(user, md5, &msg)))
1396 continue;
1397 }
1398 else {
1399 if (!valid_status(object_get_by_md5(md5, &msg)))
1400 continue;
1401 }
1402
1403 /* discard non-Notes */
1404 const char *id = xs_dict_get(msg, "id");
1405 const char *type = xs_dict_get(msg, "type");
1406 if (!xs_match(type, POSTLIKE_OBJECT_TYPE))
1407 continue;
1408
1409 if (id && is_instance_blocked(id))
1410 continue;
1411
1412 const char *from = NULL;
1413 if (strcmp(type, "Page") == 0)
1414 from = xs_dict_get(msg, "audience");
1415
1416 if (from == NULL)
1417 from = get_atto(msg);
1418
1419 if (from == NULL)
1420 continue;
1421
1422 if (user) {
1423 /* is this message from a person we don't follow? */
1424 if (strcmp(from, user->actor) && !following_check(user, from)) {
1425 /* discard if it was not boosted */
1426 xs *idx = object_announces(id);
1427
1428 if (xs_list_len(idx) == 0)
1429 continue;
1430 }
1431
1432 /* discard notes from muted morons */
1433 if (is_muted(user, from))
1434 continue;
1435
1436 /* discard hidden notes */
1437 if (is_hidden(user, id))
1438 continue;
1439 }
1440 else {
1441 /* skip non-public messages */
1442 if (!is_msg_public(msg))
1443 continue;
1444
1445 /* discard messages from private users */
1446 if (is_msg_from_private_user(msg))
1447 continue;
1448 }
1449
1450 /* if it has a name and it's not an object that may have one,
1451 it's a poll vote, so discard it */
1452 if (!xs_is_null(xs_dict_get(msg, "name")) && !xs_match(type, "Page|Video|Audio|Event"))
1453 continue;
1454
1455 /* convert the Note into a Mastodon status */
1456 xs *st = mastoapi_status(user, msg);
1457
1458 if (st != NULL) {
1459 if (ascending)
1460 out = xs_list_insert(out, 0, st);
1461 else
1462 out = xs_list_append(out, st);
1463 cnt++;
1464 }
1465
1466 } while ((cnt < limit) && (*iterator)(f, md5));
1467 }
1468
1469 int more = index_desc_next(f, md5);
1470
1471 fclose(f);
1472
1473 srv_debug(1, xs_fmt("mastoapi_timeline ret %d%s", cnt, more ? " (+)" : ""));
1474
1475 return out;
1476}
1477
1478
1479xs_str *timeline_link_header(const char *endpoint, xs_list *timeline)
1480/* returns a Link header with paging information */
1481{
1482 xs_str *s = NULL;
1483
1484 if (xs_list_len(timeline) == 0)
1485 return NULL;
1486
1487 const xs_dict *first_st = xs_list_get(timeline, 0);
1488 const xs_dict *last_st = xs_list_get(timeline, -1);
1489 const char *first_id = xs_dict_get(first_st, "id");
1490 const char *last_id = xs_dict_get(last_st, "id");
1491 const char *host = xs_dict_get(srv_config, "host");
1492 const char *protocol = xs_dict_get_def(srv_config, "protocol", "https");
1493
1494 s = xs_fmt(
1495 "<%s:/" "/%s%s?max_id=%s>; rel=\"next\", "
1496 "<%s:/" "/%s%s?since_id=%s>; rel=\"prev\"",
1497 protocol, host, endpoint, last_id,
1498 protocol, host, endpoint, first_id);
1499
1500 srv_debug(1, xs_fmt("timeline_link_header %s", s));
1501
1502 return s;
1503}
1504
1505
1506xs_list *mastoapi_account_lists(snac *user, const char *uid)
1507/* returns the list of list an user is in */
1508{
1509 xs_list *out = xs_list_new();
1510 xs *actor_md5 = NULL;
1511 xs *lol = list_maint(user, NULL, 0);
1512
1513 if (uid) {
1514 if (!xs_is_hex(uid))
1515 actor_md5 = xs_md5_hex(uid, strlen(uid));
1516 else
1517 actor_md5 = xs_dup(uid);
1518 }
1519
1520 const xs_list *li;
1521 xs_list_foreach(lol, li) {
1522 const char *list_id = xs_list_get(li, 0);
1523 const char *list_title = xs_list_get(li, 1);
1524 if (uid) {
1525 xs *users = list_content(user, list_id, NULL, 0);
1526 if (xs_list_in(users, actor_md5) == -1)
1527 continue;
1528 }
1529
1530 xs *d = xs_dict_new();
1531
1532 d = xs_dict_append(d, "id", list_id);
1533 d = xs_dict_append(d, "title", list_title);
1534 d = xs_dict_append(d, "replies_policy", "list");
1535 d = xs_dict_append(d, "exclusive", xs_stock(XSTYPE_FALSE));
1536
1537 out = xs_list_append(out, d);
1538 }
1539
1540 return out;
1541}
1542
1543
1544int mastoapi_get_handler(const xs_dict *req, const char *q_path,
1545 char **body, int *b_size, char **ctype, xs_str **link)
1546{
1547 (void)b_size;
1548
1549 if (!xs_startswith(q_path, "/api/v1/") && !xs_startswith(q_path, "/api/v2/"))
1550 return 0;
1551
1552 int status = HTTP_STATUS_NOT_FOUND;
1553 const xs_dict *args = xs_dict_get(req, "q_vars");
1554 xs *cmd = xs_replace_n(q_path, "/api", "", 1);
1555
1556 snac snac1 = {0};
1557 int logged_in = process_auth_token(&snac1, req);
1558
1559 if (strcmp(cmd, "/v1/accounts/verify_credentials") == 0) { /** **/
1560 if (logged_in) {
1561 credentials_get(body, ctype, &status, snac1);
1562 }
1563 else {
1564 status = HTTP_STATUS_UNPROCESSABLE_CONTENT; // (no login)
1565 }
1566 }
1567 else
1568 if (strcmp(cmd, "/v1/accounts/relationships") == 0) { /** **/
1569 /* find if an account is followed, blocked, etc. */
1570 /* the account to get relationships about is in args "id[]" */
1571
1572 if (logged_in) {
1573 xs *res = xs_list_new();
1574 const char *md5 = xs_dict_get(args, "id[]");
1575
1576 if (xs_is_null(md5))
1577 md5 = xs_dict_get(args, "id");
1578
1579 if (!xs_is_null(md5)) {
1580 if (xs_type(md5) == XSTYPE_LIST)
1581 md5 = xs_list_get(md5, 0);
1582
1583 xs *rel = mastoapi_relationship(&snac1, md5);
1584
1585 if (rel != NULL)
1586 res = xs_list_append(res, rel);
1587 }
1588
1589 *body = xs_json_dumps(res, 4);
1590 *ctype = "application/json";
1591 status = HTTP_STATUS_OK;
1592 }
1593 else
1594 status = HTTP_STATUS_UNPROCESSABLE_CONTENT;
1595 }
1596 else
1597 if (strcmp(cmd, "/v1/accounts/lookup") == 0) { /** **/
1598 /* lookup an account */
1599 const char *acct = xs_dict_get(args, "acct");
1600
1601 if (!xs_is_null(acct)) {
1602 xs *s = xs_strip_chars_i(xs_dup(acct), "@");
1603 xs *l = xs_split_n(s, "@", 1);
1604 const char *uid = xs_list_get(l, 0);
1605 const char *host = xs_list_get(l, 1);
1606
1607 if (uid && (!host || strcmp(host, xs_dict_get(srv_config, "host")) == 0)) {
1608 snac user;
1609
1610 if (user_open(&user, uid)) {
1611 xs *actor = msg_actor(&user);
1612 xs *macct = mastoapi_account(NULL, actor);
1613
1614 *body = xs_json_dumps(macct, 4);
1615 *ctype = "application/json";
1616 status = HTTP_STATUS_OK;
1617
1618 user_free(&user);
1619 }
1620 }
1621 }
1622 }
1623 else
1624 if (xs_startswith(cmd, "/v1/accounts/")) { /** **/
1625 /* account-related information */
1626 xs *l = xs_split(cmd, "/");
1627 const char *uid = xs_list_get(l, 3);
1628 const char *opt = xs_list_get(l, 4);
1629
1630 if (uid != NULL) {
1631 snac snac2;
1632 xs *out = NULL;
1633 xs *actor = NULL;
1634
1635 if (logged_in && strcmp(uid, "search") == 0) { /** **/
1636 /* search for accounts starting with q */
1637 const char *aq = xs_dict_get(args, "q");
1638
1639 if (!xs_is_null(aq)) {
1640 xs *q = xs_tolower_i(xs_dup(aq));
1641 out = xs_list_new();
1642 xs *wing = following_list(&snac1);
1643 xs *wers = follower_list(&snac1);
1644 xs *ulst = user_list();
1645 xs_list *p;
1646 const xs_str *v;
1647 xs_set seen;
1648
1649 xs_set_init(&seen);
1650
1651 /* user relations */
1652 xs_list *lsts[] = { wing, wers, NULL };
1653 int n;
1654 for (n = 0; (p = lsts[n]) != NULL; n++) {
1655
1656 while (xs_list_iter(&p, &v)) {
1657 /* already seen? skip */
1658 if (xs_set_add(&seen, v) == 0)
1659 continue;
1660
1661 xs *actor = NULL;
1662
1663 if (valid_status(object_get(v, &actor))) {
1664 const char *uname = xs_dict_get(actor, "preferredUsername");
1665
1666 if (!xs_is_null(uname)) {
1667 xs *luname = xs_tolower_i(xs_dup(uname));
1668
1669 if (xs_startswith(luname, q)) {
1670 xs *acct = mastoapi_account(&snac1, actor);
1671
1672 out = xs_list_append(out, acct);
1673 }
1674 }
1675 }
1676 }
1677 }
1678
1679 /* local users */
1680 p = ulst;
1681 while (xs_list_iter(&p, &v)) {
1682 snac user;
1683
1684 /* skip this same user */
1685 if (strcmp(v, xs_dict_get(snac1.config, "uid")) == 0)
1686 continue;
1687
1688 /* skip if the uid does not start with the query */
1689 xs *v2 = xs_tolower_i(xs_dup(v));
1690 if (!xs_startswith(v2, q))
1691 continue;
1692
1693 if (user_open(&user, v)) {
1694 /* if it's not already seen, add it */
1695 if (xs_set_add(&seen, user.actor) == 1) {
1696 xs *actor = msg_actor(&user);
1697 xs *acct = mastoapi_account(&snac1, actor);
1698
1699 out = xs_list_append(out, acct);
1700 }
1701
1702 user_free(&user);
1703 }
1704 }
1705
1706 xs_set_free(&seen);
1707 }
1708 }
1709 else
1710 /* is it a local user? */
1711 if (user_open(&snac2, uid) || user_open_by_md5(&snac2, uid)) {
1712 if (opt == NULL) {
1713 /* account information */
1714 actor = msg_actor(&snac2);
1715 out = mastoapi_account(NULL, actor);
1716 }
1717 else
1718 if (strcmp(opt, "statuses") == 0) { /** **/
1719 /* the public list of posts of a user */
1720 xs *timeline = timeline_simple_list(&snac2, "public", 0, 256, NULL);
1721 xs_list *p = timeline;
1722 const xs_str *v;
1723
1724 out = xs_list_new();
1725
1726 while (xs_list_iter(&p, &v)) {
1727 xs *msg = NULL;
1728
1729 if (valid_status(timeline_get_by_md5(&snac2, v, &msg))) {
1730 /* add only posts by the author */
1731 if (strcmp(xs_dict_get(msg, "type"), "Note") == 0 &&
1732 xs_startswith(xs_dict_get(msg, "id"), snac2.actor)) {
1733 xs *st = mastoapi_status(&snac2, msg);
1734
1735 if (st)
1736 out = xs_list_append(out, st);
1737 }
1738 }
1739 }
1740 }
1741 else
1742 if (strcmp(opt, "featured_tags") == 0) {
1743 /* snac doesn't have features tags, yet? */
1744 /* implement empty response so apps like Tokodon don't show an error */
1745 out = xs_list_new();
1746 }
1747 else
1748 if (strcmp(opt, "following") == 0) {
1749 xs *wing = following_list(&snac1);
1750 out = xs_list_new();
1751 int c = 0;
1752 const char *v;
1753
1754 while (xs_list_next(wing, &v, &c)) {
1755 xs *actor = NULL;
1756
1757 if (valid_status(object_get(v, &actor))) {
1758 xs *acct = mastoapi_account(NULL, actor);
1759 out = xs_list_append(out, acct);
1760 }
1761 }
1762 }
1763 else
1764 if (strcmp(opt, "followers") == 0) {
1765 out = xs_list_new();
1766 }
1767 else
1768 if (strcmp(opt, "lists") == 0) {
1769 out = mastoapi_account_lists(&snac1, uid);
1770 }
1771
1772 user_free(&snac2);
1773 }
1774 else {
1775 /* try the uid as the md5 of a possibly loaded actor */
1776 if (logged_in && valid_status(object_get_by_md5(uid, &actor))) {
1777 if (opt == NULL) {
1778 /* account information */
1779 out = mastoapi_account(&snac1, actor);
1780 }
1781 else
1782 if (strcmp(opt, "statuses") == 0) {
1783 /* we don't serve statuses of others; return the empty list */
1784 out = xs_list_new();
1785 }
1786 else
1787 if (strcmp(opt, "featured_tags") == 0) {
1788 /* snac doesn't have features tags, yet? */
1789 /* implement empty response so apps like Tokodon don't show an error */
1790 out = xs_list_new();
1791 }
1792 else
1793 if (strcmp(opt, "lists") == 0) {
1794 out = mastoapi_account_lists(&snac1, uid);
1795 }
1796 }
1797 }
1798
1799 if (out != NULL) {
1800 *body = xs_json_dumps(out, 4);
1801 *ctype = "application/json";
1802 status = HTTP_STATUS_OK;
1803 }
1804 }
1805 }
1806 else
1807 if (strcmp(cmd, "/v1/timelines/home") == 0) { /** **/
1808 /* the private timeline */
1809 if (logged_in) {
1810 xs *ifn = user_index_fn(&snac1, "private");
1811 xs *out = mastoapi_timeline(&snac1, args, ifn);
1812
1813 *link = timeline_link_header("/api/v1/timelines/home", out);
1814
1815 *body = xs_json_dumps(out, 4);
1816 *ctype = "application/json";
1817 status = HTTP_STATUS_OK;
1818
1819 srv_debug(2, xs_fmt("mastoapi timeline: returned %d entries", xs_list_len(out)));
1820 }
1821 else {
1822 status = HTTP_STATUS_UNAUTHORIZED;
1823 }
1824 }
1825 else
1826 if (strcmp(cmd, "/v1/timelines/public") == 0) { /** **/
1827 /* the instance public timeline (public timelines for all users) */
1828 xs *ifn = instance_index_fn();
1829 xs *out = mastoapi_timeline(NULL, args, ifn);
1830
1831 *body = xs_json_dumps(out, 4);
1832 *ctype = "application/json";
1833 status = HTTP_STATUS_OK;
1834 }
1835 else
1836 if (xs_startswith(cmd, "/v1/timelines/tag/")) { /** **/
1837 /* get the tag */
1838 xs *l = xs_split(cmd, "/");
1839 const char *tag = xs_list_get(l, -1);
1840
1841 xs *ifn = tag_fn(tag);
1842 xs *out = mastoapi_timeline(NULL, args, ifn);
1843
1844 *body = xs_json_dumps(out, 4);
1845 *ctype = "application/json";
1846 status = HTTP_STATUS_OK;
1847 }
1848 else
1849 if (xs_startswith(cmd, "/v1/timelines/list/")) { /** **/
1850 /* get the list id */
1851 if (logged_in) {
1852 xs *l = xs_split(cmd, "/");
1853 const char *list = xs_list_get(l, -1);
1854
1855 xs *ifn = list_timeline_fn(&snac1, list);
1856 xs *out = mastoapi_timeline(NULL, args, ifn);
1857
1858 *body = xs_json_dumps(out, 4);
1859 *ctype = "application/json";
1860 status = HTTP_STATUS_OK;
1861 }
1862 else
1863 status = HTTP_STATUS_MISDIRECTED_REQUEST;
1864 }
1865 else
1866 if (strcmp(cmd, "/v1/conversations") == 0) { /** **/
1867 /* TBD */
1868 *body = xs_dup("[]");
1869 *ctype = "application/json";
1870 status = HTTP_STATUS_OK;
1871 }
1872 else
1873 if (strcmp(cmd, "/v1/notifications") == 0) { /** **/
1874 if (logged_in) {
1875 xs *l = notify_list(&snac1, 0, 64);
1876 xs *out = xs_list_new();
1877 const xs_dict *v;
1878 const xs_list *excl = xs_dict_get(args, "exclude_types[]");
1879 const char *min_id = xs_dict_get(args, "min_id");
1880 const char *max_id = xs_dict_get(args, "max_id");
1881 const char *limit = xs_dict_get(args, "limit");
1882 int limit_count = 0;
1883 if (!xs_is_null(limit)) {
1884 limit_count = atoi(limit);
1885 }
1886
1887 if (dbglevel) {
1888 xs *js = xs_json_dumps(args, 0);
1889 srv_debug(1, xs_fmt("mastoapi_notifications args %s", js));
1890 }
1891
1892 xs_list_foreach(l, v) {
1893 xs *noti = notify_get(&snac1, v);
1894
1895 if (noti == NULL)
1896 continue;
1897
1898 const char *type = xs_dict_get(noti, "type");
1899 const char *utype = xs_dict_get(noti, "utype");
1900 const char *objid = xs_dict_get(noti, "objid");
1901 const char *id = xs_dict_get(noti, "id");
1902 xs *fid = xs_replace(id, ".", "");
1903 xs *actor = NULL;
1904 xs *entry = NULL;
1905
1906 if (!valid_status(actor_get(xs_dict_get(noti, "actor"), &actor)))
1907 continue;
1908
1909 if (objid != NULL && !valid_status(object_get(objid, &entry)))
1910 continue;
1911
1912 if (is_hidden(&snac1, objid))
1913 continue;
1914
1915 if (max_id) {
1916 if (strcmp(fid, max_id) == 0)
1917 max_id = NULL;
1918
1919 continue;
1920 }
1921
1922 if (min_id) {
1923 if (strcmp(fid, min_id) <= 0) {
1924 continue;
1925 }
1926 }
1927
1928 /* convert the type */
1929 if (strcmp(type, "Like") == 0 || strcmp(type, "EmojiReact") == 0)
1930 type = "favourite";
1931 else
1932 if (strcmp(type, "Announce") == 0)
1933 type = "reblog";
1934 else
1935 if (strcmp(type, "Follow") == 0)
1936 type = "follow";
1937 else
1938 if (strcmp(type, "Create") == 0)
1939 type = "mention";
1940 else
1941 if (strcmp(type, "Update") == 0 && strcmp(utype, "Question") == 0)
1942 type = "poll";
1943 else
1944 continue;
1945
1946 /* excluded type? */
1947 if (!xs_is_null(excl) && xs_list_in(excl, type) != -1)
1948 continue;
1949
1950 xs *mn = xs_dict_new();
1951
1952 mn = xs_dict_append(mn, "type", type);
1953
1954 mn = xs_dict_append(mn, "id", fid);
1955
1956 mn = xs_dict_append(mn, "created_at", xs_dict_get(noti, "date"));
1957
1958 xs *acct = mastoapi_account(&snac1, actor);
1959
1960 if (acct == NULL)
1961 continue;
1962
1963 mn = xs_dict_append(mn, "account", acct);
1964
1965 if (strcmp(type, "follow") != 0 && !xs_is_null(objid)) {
1966 xs *st = mastoapi_status(&snac1, entry);
1967
1968 if (st)
1969 mn = xs_dict_append(mn, "status", st);
1970 }
1971
1972 out = xs_list_append(out, mn);
1973 if (!xs_is_null(limit)) {
1974 if (--limit_count <= 0)
1975 break;
1976 }
1977 }
1978
1979 srv_debug(1, xs_fmt("mastoapi_notifications count %d", xs_list_len(out)));
1980
1981 *body = xs_json_dumps(out, 4);
1982 *ctype = "application/json";
1983 status = HTTP_STATUS_OK;
1984 }
1985 else
1986 status = HTTP_STATUS_UNAUTHORIZED;
1987 }
1988 else
1989 if (strcmp(cmd, "/v1/filters") == 0) { /** **/
1990 /* snac will never have filters */
1991 *body = xs_dup("[]");
1992 *ctype = "application/json";
1993 status = HTTP_STATUS_OK;
1994 }
1995 else
1996 if (strcmp(cmd, "/v2/filters") == 0) { /** **/
1997 /* snac will never have filters
1998 * but still, without a v2 endpoint a short delay is introduced
1999 * in some apps */
2000 *body = xs_dup("[]");
2001 *ctype = "application/json";
2002 status = HTTP_STATUS_OK;
2003 }
2004 else
2005 if (strcmp(cmd, "/v1/favourites") == 0) { /** **/
2006 /* snac will never support a list of favourites */
2007 *body = xs_dup("[]");
2008 *ctype = "application/json";
2009 status = HTTP_STATUS_OK;
2010 }
2011 else
2012 if (strcmp(cmd, "/v1/bookmarks") == 0) { /** **/
2013 if (logged_in) {
2014 xs *ifn = bookmark_index_fn(&snac1);
2015 xs *out = mastoapi_timeline(&snac1, args, ifn);
2016
2017 *body = xs_json_dumps(out, 4);
2018 *ctype = "application/json";
2019 status = HTTP_STATUS_OK;
2020 }
2021 else
2022 status = HTTP_STATUS_UNAUTHORIZED;
2023 }
2024 else
2025 if (strcmp(cmd, "/v1/lists") == 0) { /** list of lists **/
2026 if (logged_in) {
2027 xs *l = mastoapi_account_lists(&snac1, NULL);
2028
2029 *body = xs_json_dumps(l, 4);
2030 *ctype = "application/json";
2031 status = HTTP_STATUS_OK;
2032 }
2033 else
2034 status = HTTP_STATUS_UNAUTHORIZED;
2035 }
2036 else
2037 if (xs_startswith(cmd, "/v1/lists/")) { /** list information **/
2038 if (logged_in) {
2039 xs *l = xs_split(cmd, "/");
2040 const char *p = xs_list_get(l, -1);
2041
2042 if (p) {
2043 if (strcmp(p, "accounts") == 0) {
2044 p = xs_list_get(l, -2);
2045
2046 if (p && xs_is_hex(p)) {
2047 xs *actors = list_content(&snac1, p, NULL, 0);
2048 xs *out = xs_list_new();
2049 int c = 0;
2050 const char *v;
2051
2052 while (xs_list_next(actors, &v, &c)) {
2053 xs *actor = NULL;
2054
2055 if (valid_status(object_get_by_md5(v, &actor))) {
2056 xs *acct = mastoapi_account(&snac1, actor);
2057 out = xs_list_append(out, acct);
2058 }
2059 }
2060
2061 *body = xs_json_dumps(out, 4);
2062 *ctype = "application/json";
2063 status = HTTP_STATUS_OK;
2064 }
2065 }
2066 else
2067 if (xs_is_hex(p)) {
2068 xs *out = xs_list_new();
2069 xs *lol = list_maint(&snac1, NULL, 0);
2070 int c = 0;
2071 const xs_list *v;
2072
2073 while (xs_list_next(lol, &v, &c)) {
2074 const char *id = xs_list_get(v, 0);
2075
2076 if (id && strcmp(id, p) == 0) {
2077 xs *d = xs_dict_new();
2078
2079 d = xs_dict_append(d, "id", p);
2080 d = xs_dict_append(d, "title", xs_list_get(v, 1));
2081 d = xs_dict_append(d, "replies_policy", "list");
2082 d = xs_dict_append(d, "exclusive", xs_stock(XSTYPE_FALSE));
2083
2084 out = xs_dup(d);
2085 break;
2086 }
2087 }
2088
2089 *body = xs_json_dumps(out, 4);
2090 *ctype = "application/json";
2091 status = HTTP_STATUS_OK;
2092 }
2093 }
2094 }
2095 else
2096 status = HTTP_STATUS_UNAUTHORIZED;
2097 }
2098 else
2099 if (strcmp(cmd, "/v1/scheduled_statuses") == 0) { /** **/
2100 /* snac does not schedule notes */
2101 *body = xs_dup("[]");
2102 *ctype = "application/json";
2103 status = HTTP_STATUS_OK;
2104 }
2105 else
2106 if (strcmp(cmd, "/v1/follow_requests") == 0) { /** **/
2107 /* snac does not support optional follow confirmations */
2108 *body = xs_dup("[]");
2109 *ctype = "application/json";
2110 status = HTTP_STATUS_OK;
2111 }
2112 else
2113 if (strcmp(cmd, "/v1/announcements") == 0) { /** **/
2114 if (logged_in) {
2115 xs *resp = xs_list_new();
2116 double la = 0.0;
2117 xs *user_la = xs_dup(xs_dict_get(snac1.config, "last_announcement"));
2118 if (user_la != NULL)
2119 la = xs_number_get(user_la);
2120 xs *val_date = xs_str_utctime(la, ISO_DATE_SPEC);
2121
2122 /* contrary to html, we always send the announcement and set the read flag instead */
2123
2124 const t_announcement *annce = announcement(la);
2125 if (annce != NULL && annce->text != NULL) {
2126 xs *an = xs_dict_new();
2127 xs *id = xs_fmt("%d", annce->timestamp);
2128 xs *ct = xs_fmt("<p>%s</p>", annce->text);
2129
2130 an = xs_dict_set(an, "id", id);
2131 an = xs_dict_set(an, "content", ct);
2132 an = xs_dict_set(an, "starts_at", xs_stock(XSTYPE_NULL));
2133 an = xs_dict_set(an, "ends_at", xs_stock(XSTYPE_NULL));
2134 an = xs_dict_set(an, "all_day", xs_stock(XSTYPE_TRUE));
2135 an = xs_dict_set(an, "published_at", val_date);
2136 an = xs_dict_set(an, "updated_at", val_date);
2137 an = xs_dict_set(an, "read", (annce->timestamp >= la)
2138 ? xs_stock(XSTYPE_FALSE) : xs_stock(XSTYPE_TRUE));
2139 an = xs_dict_set(an, "mentions", xs_stock(XSTYPE_LIST));
2140 an = xs_dict_set(an, "statuses", xs_stock(XSTYPE_LIST));
2141 an = xs_dict_set(an, "tags", xs_stock(XSTYPE_LIST));
2142 an = xs_dict_set(an, "emojis", xs_stock(XSTYPE_LIST));
2143 an = xs_dict_set(an, "reactions", xs_stock(XSTYPE_LIST));
2144 resp = xs_list_append(resp, an);
2145 }
2146
2147 *body = xs_json_dumps(resp, 4);
2148 *ctype = "application/json";
2149 status = HTTP_STATUS_OK;
2150 }
2151 }
2152 else
2153 if (strcmp(cmd, "/v1/custom_emojis") == 0) { /** **/
2154 xs *emo = emojis();
2155 xs *list = xs_list_new();
2156 int c = 0;
2157 const xs_str *k;
2158 const xs_val *v;
2159 while(xs_dict_next(emo, &k, &v, &c)) {
2160 xs *current = xs_dict_new();
2161 if (xs_startswith(v, "https://") && xs_startswith((xs_mime_by_ext(v)), "image/")) {
2162 /* remove first and last colon */
2163 xs *shortcode = xs_replace(k, ":", "");
2164 current = xs_dict_append(current, "shortcode", shortcode);
2165 current = xs_dict_append(current, "url", v);
2166 current = xs_dict_append(current, "static_url", v);
2167 current = xs_dict_append(current, "visible_in_picker", xs_stock(XSTYPE_TRUE));
2168 list = xs_list_append(list, current);
2169 }
2170 }
2171 *body = xs_json_dumps(list, 0);
2172 *ctype = "application/json";
2173 status = HTTP_STATUS_OK;
2174 }
2175 else
2176 if (strcmp(cmd, "/v1/instance") == 0) { /** **/
2177 /* returns an instance object */
2178 xs *ins = xs_dict_new();
2179 const char *host = xs_dict_get(srv_config, "host");
2180 const char *title = xs_dict_get(srv_config, "title");
2181 const char *sdesc = xs_dict_get(srv_config, "short_description");
2182
2183 ins = xs_dict_append(ins, "uri", host);
2184 ins = xs_dict_append(ins, "domain", host);
2185 ins = xs_dict_append(ins, "title", title && *title ? title : host);
2186 ins = xs_dict_append(ins, "version", "4.0.0 (not true; really " USER_AGENT ")");
2187 ins = xs_dict_append(ins, "source_url", WHAT_IS_SNAC_URL);
2188 ins = xs_dict_append(ins, "description", host);
2189
2190 ins = xs_dict_append(ins, "short_description", sdesc && *sdesc ? sdesc : host);
2191
2192 xs *susie = xs_fmt("%s/susie.png", srv_baseurl);
2193 ins = xs_dict_append(ins, "thumbnail", susie);
2194
2195 const char *v = xs_dict_get(srv_config, "admin_email");
2196 if (xs_is_null(v) || *v == '\0')
2197 v = "admin@localhost";
2198
2199 ins = xs_dict_append(ins, "email", v);
2200
2201 ins = xs_dict_append(ins, "rules", xs_stock(XSTYPE_LIST));
2202
2203 xs *l1 = xs_list_append(xs_list_new(), "en");
2204 ins = xs_dict_append(ins, "languages", l1);
2205
2206 xs *wss = xs_fmt("wss:/" "/%s", xs_dict_get(srv_config, "host"));
2207 xs *urls = xs_dict_new();
2208 urls = xs_dict_append(urls, "streaming_api", wss);
2209
2210 ins = xs_dict_append(ins, "urls", urls);
2211
2212 xs *d2 = xs_dict_append(xs_dict_new(), "user_count", xs_stock(0));
2213 d2 = xs_dict_append(d2, "status_count", xs_stock(0));
2214 d2 = xs_dict_append(d2, "domain_count", xs_stock(0));
2215 ins = xs_dict_append(ins, "stats", d2);
2216
2217 ins = xs_dict_append(ins, "registrations", xs_stock(XSTYPE_FALSE));
2218 ins = xs_dict_append(ins, "approval_required", xs_stock(XSTYPE_FALSE));
2219 ins = xs_dict_append(ins, "invites_enabled", xs_stock(XSTYPE_FALSE));
2220
2221 xs *cfg = xs_dict_new();
2222
2223 {
2224 xs *d11 = xs_json_loads("{\"characters_reserved_per_url\":32,"
2225 "\"max_characters\":100000,\"max_media_attachments\":4}");
2226
2227 const xs_number *max_attachments = xs_dict_get(srv_config, "max_attachments");
2228 if (xs_type(max_attachments) == XSTYPE_NUMBER)
2229 d11 = xs_dict_set(d11, "max_media_attachments", max_attachments);
2230
2231 cfg = xs_dict_append(cfg, "statuses", d11);
2232
2233 xs *d12 = xs_json_loads("{\"max_featured_tags\":0}");
2234 cfg = xs_dict_append(cfg, "accounts", d12);
2235
2236 xs *d13 = xs_json_loads("{\"image_matrix_limit\":33177600,"
2237 "\"image_size_limit\":16777216,"
2238 "\"video_frame_rate_limit\":120,"
2239 "\"video_matrix_limit\":8294400,"
2240 "\"video_size_limit\":103809024}"
2241 );
2242
2243 {
2244 /* get the supported mime types from the internal list */
2245 const char **p = xs_mime_types;
2246 xs_set mtypes;
2247 xs_set_init(&mtypes);
2248
2249 while (*p) {
2250 const char *type = p[1];
2251
2252 if (xs_startswith(type, "image/") ||
2253 xs_startswith(type, "video/") ||
2254 xs_startswith(type, "audio/"))
2255 xs_set_add(&mtypes, type);
2256
2257 p += 2;
2258 }
2259
2260 xs *l = xs_set_result(&mtypes);
2261 d13 = xs_dict_append(d13, "supported_mime_types", l);
2262 }
2263
2264 cfg = xs_dict_append(cfg, "media_attachments", d13);
2265
2266 xs *d14 = xs_json_loads("{\"max_characters_per_option\":50,"
2267 "\"max_expiration\":2629746,"
2268 "\"max_options\":8,\"min_expiration\":300}");
2269 cfg = xs_dict_append(cfg, "polls", d14);
2270 }
2271
2272 ins = xs_dict_append(ins, "configuration", cfg);
2273
2274 const char *admin_account = xs_dict_get(srv_config, "admin_account");
2275
2276 if (!xs_is_null(admin_account) && *admin_account) {
2277 snac admin;
2278
2279 if (user_open(&admin, admin_account)) {
2280 xs *actor = msg_actor(&admin);
2281 xs *acct = mastoapi_account(NULL, actor);
2282
2283 ins = xs_dict_append(ins, "contact_account", acct);
2284
2285 user_free(&admin);
2286 }
2287 }
2288
2289 *body = xs_json_dumps(ins, 4);
2290 *ctype = "application/json";
2291 status = HTTP_STATUS_OK;
2292 }
2293 else
2294 if (strcmp(cmd, "/v1/instance/peers") == 0) { /** **/
2295 /* get the collected inbox list as the instances "this domain is aware of" */
2296 xs *list = inbox_list();
2297 xs *peers = xs_list_new();
2298 const char *inbox;
2299
2300 xs_list_foreach(list, inbox) {
2301 xs *l = xs_split(inbox, "/");
2302 const char *domain = xs_list_get(l, 2);
2303
2304 if (xs_is_string(domain))
2305 peers = xs_list_append(peers, domain);
2306 }
2307
2308 *body = xs_json_dumps(peers, 4);
2309 *ctype = "application/json";
2310 status = HTTP_STATUS_OK;
2311 }
2312 else
2313 if (xs_startswith(cmd, "/v1/statuses/")) { /** **/
2314 /* information about a status */
2315 if (logged_in) {
2316 xs *l = xs_split(cmd, "/");
2317 const char *id = xs_list_get(l, 3);
2318 const char *op = xs_list_get(l, 4);
2319
2320 if (!xs_is_null(id)) {
2321 xs *msg = NULL;
2322 xs *out = NULL;
2323
2324 /* skip the 'fake' part of the id */
2325 id = MID_TO_MD5(id);
2326
2327 if (valid_status(object_get_by_md5(id, &msg))) {
2328 if (op == NULL) {
2329 if (!is_muted(&snac1, get_atto(msg))) {
2330 /* return the status itself */
2331 out = mastoapi_status(&snac1, msg);
2332 }
2333 }
2334 else
2335 if (strcmp(op, "context") == 0) { /** **/
2336 /* return ancestors and children */
2337 xs *anc = xs_list_new();
2338 xs *des = xs_list_new();
2339 xs_list *p;
2340 const xs_str *v;
2341 char pid[MD5_HEX_SIZE];
2342
2343 /* build the [grand]parent list, moving up */
2344 strncpy(pid, id, sizeof(pid));
2345
2346 while (object_parent(pid, pid)) {
2347 xs *m2 = NULL;
2348
2349 if (valid_status(timeline_get_by_md5(&snac1, pid, &m2))) {
2350 xs *st = mastoapi_status(&snac1, m2);
2351
2352 if (st)
2353 anc = xs_list_insert(anc, 0, st);
2354 }
2355 else
2356 break;
2357 }
2358
2359 /* build the children list */
2360 xs *children = object_children(xs_dict_get(msg, "id"));
2361 p = children;
2362
2363 while (xs_list_iter(&p, &v)) {
2364 xs *m2 = NULL;
2365
2366 if (valid_status(timeline_get_by_md5(&snac1, v, &m2))) {
2367 if (xs_is_null(xs_dict_get(m2, "name"))) {
2368 xs *st = mastoapi_status(&snac1, m2);
2369
2370 if (st)
2371 des = xs_list_append(des, st);
2372 }
2373 }
2374 }
2375
2376 out = xs_dict_new();
2377 out = xs_dict_append(out, "ancestors", anc);
2378 out = xs_dict_append(out, "descendants", des);
2379 }
2380 else
2381 if (strcmp(op, "reblogged_by") == 0 || /** **/
2382 strcmp(op, "favourited_by") == 0) { /** **/
2383 /* return the list of people who liked or boosted this */
2384 out = xs_list_new();
2385
2386 xs *l = NULL;
2387
2388 if (op[0] == 'r')
2389 l = object_announces(xs_dict_get(msg, "id"));
2390 else
2391 l = object_likes(xs_dict_get(msg, "id"));
2392
2393 xs_list *p = l;
2394 const xs_str *v;
2395
2396 while (xs_list_iter(&p, &v)) {
2397 xs *actor2 = NULL;
2398
2399 if (valid_status(object_get_by_md5(v, &actor2))) {
2400 xs *acct2 = mastoapi_account(&snac1, actor2);
2401
2402 out = xs_list_append(out, acct2);
2403 }
2404 }
2405 }
2406 else
2407 if (strcmp(op, "source") == 0) { /** **/
2408 out = xs_dict_new();
2409
2410 /* get the mastoapi status id */
2411 out = xs_dict_append(out, "id", xs_list_get(l, 3));
2412
2413 out = xs_dict_append(out, "text", xs_dict_get(msg, "sourceContent"));
2414 out = xs_dict_append(out, "spoiler_text", xs_dict_get(msg, "summary"));
2415 }
2416 }
2417 else
2418 srv_debug(1, xs_fmt("mastoapi status: bad id %s", id));
2419
2420 if (out != NULL) {
2421 *body = xs_json_dumps(out, 4);
2422 *ctype = "application/json";
2423 status = HTTP_STATUS_OK;
2424 }
2425 }
2426 }
2427 else
2428 status = HTTP_STATUS_UNAUTHORIZED;
2429 }
2430 else
2431 if (strcmp(cmd, "/v1/preferences") == 0) { /** **/
2432 *body = xs_dup("{}");
2433 *ctype = "application/json";
2434 status = HTTP_STATUS_OK;
2435 }
2436 else
2437 if (strcmp(cmd, "/v1/markers") == 0) { /** **/
2438 if (logged_in) {
2439 const xs_list *timeline = xs_dict_get(args, "timeline[]");
2440 xs_str *json = NULL;
2441 if (!xs_is_null(timeline))
2442 json = xs_json_dumps(markers_get(&snac1, timeline), 4);
2443
2444 if (!xs_is_null(json))
2445 *body = json;
2446 else
2447 *body = xs_dup("{}");
2448
2449 *ctype = "application/json";
2450 status = HTTP_STATUS_OK;
2451 }
2452 else
2453 status = HTTP_STATUS_UNAUTHORIZED;
2454 }
2455 else
2456 if (strcmp(cmd, "/v1/followed_tags") == 0) { /** **/
2457 *body = xs_dup("[]");
2458 *ctype = "application/json";
2459 status = HTTP_STATUS_OK;
2460 }
2461 else
2462 if (strcmp(cmd, "/v1/trends/tags") == 0) { /** **/
2463 *body = xs_dup("[]");
2464 *ctype = "application/json";
2465 status = HTTP_STATUS_OK;
2466 }
2467 else
2468 if (strcmp(cmd, "/v1/trends/statuses") == 0) { /** **/
2469 *body = xs_dup("[]");
2470 *ctype = "application/json";
2471 status = HTTP_STATUS_OK;
2472 }
2473 else
2474 if (strcmp(cmd, "/v2/search") == 0) { /** **/
2475 if (logged_in) {
2476 const char *q = xs_dict_get(args, "q");
2477 const char *type = xs_dict_get(args, "type");
2478 const char *offset = xs_dict_get(args, "offset");
2479
2480 xs *acl = xs_list_new();
2481 xs *stl = xs_list_new();
2482 xs *htl = xs_list_new();
2483 xs *res = xs_dict_new();
2484
2485 if (xs_is_null(offset) || strcmp(offset, "0") == 0) {
2486 /* reply something only for offset 0; otherwise,
2487 apps like Tusky keep asking again and again */
2488 if (xs_startswith(q, "https://")) {
2489 xs *md5 = xs_md5_hex(q, strlen(q));
2490
2491 if (!timeline_here(&snac1, md5)) {
2492 xs *object = NULL;
2493 int status;
2494
2495 status = activitypub_request(&snac1, q, &object);
2496 snac_debug(&snac1, 1, xs_fmt("Request searched URL %s %d", q, status));
2497
2498 if (valid_status(status)) {
2499 /* got it; also request the actor */
2500 const char *attr_to = get_atto(object);
2501 xs *actor_obj = NULL;
2502
2503 if (!xs_is_null(attr_to)) {
2504 status = actor_request(&snac1, attr_to, &actor_obj);
2505
2506 snac_debug(&snac1, 1, xs_fmt("Request author %s of %s %d", attr_to, q, status));
2507
2508 if (valid_status(status)) {
2509 /* add the actor */
2510 actor_add(attr_to, actor_obj);
2511
2512 /* add the post to the timeline */
2513 timeline_add(&snac1, q, object);
2514 }
2515 }
2516 }
2517 }
2518 }
2519
2520 if (!xs_is_null(q)) {
2521 if (xs_is_null(type) || strcmp(type, "accounts") == 0) {
2522 /* do a webfinger query */
2523 char *actor = NULL;
2524 char *user = NULL;
2525
2526 if (valid_status(webfinger_request(q, &actor, &user)) && actor) {
2527 xs *actor_o = NULL;
2528
2529 if (valid_status(actor_request(&snac1, actor, &actor_o))) {
2530 xs *acct = mastoapi_account(NULL, actor_o);
2531
2532 acl = xs_list_append(acl, acct);
2533
2534 if (!object_here(actor))
2535 object_add(actor, actor_o);
2536 }
2537 }
2538 }
2539
2540 if (xs_is_null(type) || strcmp(type, "hashtags") == 0) {
2541 /* search this tag */
2542 xs *tl = tag_search((char *)q, 0, 1);
2543
2544 if (xs_list_len(tl)) {
2545 xs *d = xs_dict_new();
2546
2547 d = xs_dict_append(d, "name", q);
2548 xs *url = xs_fmt("%s?t=%s", srv_baseurl, q);
2549 d = xs_dict_append(d, "url", url);
2550 d = xs_dict_append(d, "history", xs_stock(XSTYPE_LIST));
2551
2552 htl = xs_list_append(htl, d);
2553 }
2554 }
2555
2556 if (xs_is_null(type) || strcmp(type, "statuses") == 0) {
2557 int to = 0;
2558 int cnt = 40;
2559 xs *tl = content_search(&snac1, q, 1, 0, cnt, 0, &to);
2560 int c = 0;
2561 const char *v;
2562
2563 while (xs_list_next(tl, &v, &c) && --cnt) {
2564 xs *post = NULL;
2565
2566 if (!valid_status(timeline_get_by_md5(&snac1, v, &post)))
2567 continue;
2568
2569 xs *s = mastoapi_status(&snac1, post);
2570
2571 if (!xs_is_null(s))
2572 stl = xs_list_append(stl, s);
2573 }
2574 }
2575 }
2576 }
2577
2578 res = xs_dict_append(res, "accounts", acl);
2579 res = xs_dict_append(res, "statuses", stl);
2580 res = xs_dict_append(res, "hashtags", htl);
2581
2582 *body = xs_json_dumps(res, 4);
2583 *ctype = "application/json";
2584 status = HTTP_STATUS_OK;
2585 }
2586 else
2587 status = HTTP_STATUS_UNAUTHORIZED;
2588 }
2589
2590 /* user cleanup */
2591 if (logged_in)
2592 user_free(&snac1);
2593
2594 srv_debug(1, xs_fmt("mastoapi_get_handler %s %d", q_path, status));
2595
2596 return status;
2597}
2598
2599
2600int mastoapi_post_handler(const xs_dict *req, const char *q_path,
2601 const char *payload, int p_size,
2602 char **body, int *b_size, char **ctype)
2603{
2604 (void)p_size;
2605 (void)b_size;
2606
2607 if (!xs_startswith(q_path, "/api/v1/") && !xs_startswith(q_path, "/api/v2/"))
2608 return 0;
2609
2610 int status = HTTP_STATUS_NOT_FOUND;
2611 xs *args = NULL;
2612 const char *i_ctype = xs_dict_get(req, "content-type");
2613
2614 if (i_ctype && xs_startswith(i_ctype, "application/json")) {
2615 if (!xs_is_null(payload))
2616 args = xs_json_loads(payload);
2617 }
2618 else if (i_ctype && xs_startswith(i_ctype, "application/x-www-form-urlencoded"))
2619 {
2620 // Some apps send form data instead of json so we should cater for those
2621 if (!xs_is_null(payload)) {
2622 args = xs_url_vars(payload);
2623 }
2624 }
2625 else
2626 args = xs_dup(xs_dict_get(req, "p_vars"));
2627
2628 if (args == NULL)
2629 return HTTP_STATUS_BAD_REQUEST;
2630
2631 xs *cmd = xs_replace_n(q_path, "/api", "", 1);
2632
2633 snac snac = {0};
2634 int logged_in = process_auth_token(&snac, req);
2635
2636 if (strcmp(cmd, "/v1/apps") == 0) { /** **/
2637 const char *name = xs_dict_get(args, "client_name");
2638 const char *ruri = xs_dict_get(args, "redirect_uris");
2639 const char *scope = xs_dict_get(args, "scope");
2640
2641 /* Ice Cubes sends these values as query parameters, so try these */
2642 if (name == NULL && ruri == NULL && scope == NULL) {
2643 args = xs_dup(xs_dict_get(req, "q_vars"));
2644 name = xs_dict_get(args, "client_name");
2645 ruri = xs_dict_get(args, "redirect_uris");
2646 scope = xs_dict_get(args, "scope");
2647 }
2648
2649 if (xs_type(ruri) == XSTYPE_LIST)
2650 ruri = xs_dict_get(ruri, 0);
2651
2652 if (name && ruri) {
2653 xs *app = xs_dict_new();
2654 xs *id = xs_replace_i(tid(0), ".", "");
2655 xs *csec = random_str();
2656 xs *vkey = random_str();
2657 xs *cid = NULL;
2658
2659 /* pick a non-existent random cid */
2660 for (;;) {
2661 cid = random_str();
2662 xs *p_app = app_get(cid);
2663
2664 if (p_app == NULL)
2665 break;
2666
2667 xs_free(cid);
2668 }
2669
2670 app = xs_dict_append(app, "name", name);
2671 app = xs_dict_append(app, "redirect_uri", ruri);
2672 app = xs_dict_append(app, "client_id", cid);
2673 app = xs_dict_append(app, "client_secret", csec);
2674 app = xs_dict_append(app, "vapid_key", vkey);
2675 app = xs_dict_append(app, "id", id);
2676
2677 *body = xs_json_dumps(app, 4);
2678 *ctype = "application/json";
2679 status = HTTP_STATUS_OK;
2680
2681 app = xs_dict_append(app, "code", "");
2682
2683 if (scope)
2684 app = xs_dict_append(app, "scope", scope);
2685
2686 app_add(cid, app);
2687
2688 srv_debug(1, xs_fmt("mastoapi apps: new app %s", cid));
2689 }
2690 }
2691 else
2692 if (strcmp(cmd, "/v1/statuses") == 0) { /** **/
2693 if (logged_in) {
2694 /* post a new Note */
2695 const char *content = xs_dict_get(args, "status");
2696 const char *mid = xs_dict_get(args, "in_reply_to_id");
2697 const char *visibility = xs_dict_get(args, "visibility");
2698 const char *summary = xs_dict_get(args, "spoiler_text");
2699 const char *media_ids = xs_dict_get(args, "media_ids");
2700 const char *language = xs_dict_get(args, "language");
2701
2702 if (xs_is_null(media_ids))
2703 media_ids = xs_dict_get(args, "media_ids[]");
2704
2705 if (xs_is_null(media_ids))
2706 media_ids = xs_dict_get(args, "media_ids");
2707
2708 if (xs_is_null(visibility))
2709 visibility = "public";
2710
2711 xs *attach_list = xs_list_new();
2712 xs *irt = NULL;
2713
2714 /* is it a reply? */
2715 if (mid != NULL) {
2716 xs *r_msg = NULL;
2717 const char *md5 = MID_TO_MD5(mid);
2718
2719 if (valid_status(object_get_by_md5(md5, &r_msg)))
2720 irt = xs_dup(xs_dict_get(r_msg, "id"));
2721 }
2722
2723 /* does it have attachments? */
2724 if (!xs_is_null(media_ids)) {
2725 xs *mi = NULL;
2726
2727 if (xs_type(media_ids) == XSTYPE_LIST)
2728 mi = xs_dup(media_ids);
2729 else {
2730 mi = xs_list_new();
2731 mi = xs_list_append(mi, media_ids);
2732 }
2733
2734 xs_list *p = mi;
2735 const xs_str *v;
2736
2737 while (xs_list_iter(&p, &v)) {
2738 xs *l = xs_list_new();
2739 xs *url = xs_fmt("%s/s/%s", snac.actor, v);
2740 xs *desc = static_get_meta(&snac, v);
2741
2742 l = xs_list_append(l, url);
2743 l = xs_list_append(l, desc);
2744
2745 attach_list = xs_list_append(attach_list, l);
2746 }
2747 }
2748
2749 /* prepare the message */
2750 int scope = 1;
2751 if (strcmp(visibility, "unlisted") == 0)
2752 scope = 2;
2753 else
2754 if (strcmp(visibility, "public") == 0)
2755 scope = 0;
2756
2757 xs *msg = msg_note(&snac, content, NULL, irt, attach_list, scope, language, NULL);
2758
2759 if (!xs_is_null(summary) && *summary) {
2760 msg = xs_dict_set(msg, "sensitive", xs_stock(XSTYPE_TRUE));
2761 msg = xs_dict_set(msg, "summary", summary);
2762 }
2763
2764 /* scheduled? */
2765 const char *scheduled_at = xs_dict_get(args, "scheduled_at");
2766
2767 if (xs_is_string(scheduled_at) && *scheduled_at) {
2768 msg = xs_dict_set(msg, "published", scheduled_at);
2769
2770 schedule_add(&snac, xs_dict_get(msg, "id"), msg);
2771 }
2772 else {
2773 /* store */
2774 timeline_add(&snac, xs_dict_get(msg, "id"), msg);
2775
2776 /* 'Create' message */
2777 xs *c_msg = msg_create(&snac, msg);
2778 enqueue_message(&snac, c_msg);
2779
2780 timeline_touch(&snac);
2781 }
2782
2783 /* convert to a mastodon status as a response code */
2784 xs *st = mastoapi_status(&snac, msg);
2785
2786 *body = xs_json_dumps(st, 4);
2787 *ctype = "application/json";
2788 status = HTTP_STATUS_OK;
2789 }
2790 else
2791 status = HTTP_STATUS_UNAUTHORIZED;
2792 }
2793 else
2794 if (xs_startswith(cmd, "/v1/statuses")) { /** **/
2795 if (logged_in) {
2796 /* operations on a status */
2797 xs *l = xs_split(cmd, "/");
2798 const char *mid = xs_list_get(l, 3);
2799 const char *op = xs_list_get(l, 4);
2800
2801 if (!xs_is_null(mid)) {
2802 xs *msg = NULL;
2803 xs *out = NULL;
2804
2805 /* skip the 'fake' part of the id */
2806 mid = MID_TO_MD5(mid);
2807
2808 if (valid_status(timeline_get_by_md5(&snac, mid, &msg))) {
2809 const char *id = xs_dict_get(msg, "id");
2810
2811 if (op == NULL) {
2812 /* no operation (?) */
2813 }
2814 else
2815 if (strcmp(op, "favourite") == 0) { /** **/
2816 xs *n_msg = msg_admiration(&snac, id, "Like");
2817
2818 if (n_msg != NULL) {
2819 enqueue_message(&snac, n_msg);
2820 timeline_admire(&snac, xs_dict_get(n_msg, "object"), snac.actor, 1);
2821
2822 out = mastoapi_status(&snac, msg);
2823 }
2824 }
2825 else
2826 if (strcmp(op, "unfavourite") == 0) { /** **/
2827 xs *n_msg = msg_repulsion(&snac, id, "Like");
2828
2829 if (n_msg != NULL) {
2830 enqueue_message(&snac, n_msg);
2831
2832 out = mastoapi_status(&snac, msg);
2833 }
2834 }
2835 else
2836 if (strcmp(op, "reblog") == 0) { /** **/
2837 xs *n_msg = msg_admiration(&snac, id, "Announce");
2838
2839 if (n_msg != NULL) {
2840 enqueue_message(&snac, n_msg);
2841 timeline_admire(&snac, xs_dict_get(n_msg, "object"), snac.actor, 0);
2842
2843 out = mastoapi_status(&snac, msg);
2844 }
2845 }
2846 else
2847 if (strcmp(op, "unreblog") == 0) { /** **/
2848 xs *n_msg = msg_repulsion(&snac, id, "Announce");
2849
2850 if (n_msg != NULL) {
2851 enqueue_message(&snac, n_msg);
2852
2853 out = mastoapi_status(&snac, msg);
2854 }
2855 }
2856 else
2857 if (strcmp(op, "bookmark") == 0) { /** **/
2858 /* bookmark this message */
2859 if (bookmark(&snac, id) == 0)
2860 out = mastoapi_status(&snac, msg);
2861 else
2862 status = HTTP_STATUS_UNPROCESSABLE_CONTENT;
2863 }
2864 else
2865 if (strcmp(op, "unbookmark") == 0) { /** **/
2866 /* unbookmark this message */
2867 unbookmark(&snac, id);
2868 out = mastoapi_status(&snac, msg);
2869 }
2870 else
2871 if (strcmp(op, "pin") == 0) { /** **/
2872 /* pin this message */
2873 if (pin(&snac, id) == 0)
2874 out = mastoapi_status(&snac, msg);
2875 else
2876 status = HTTP_STATUS_UNPROCESSABLE_CONTENT;
2877 }
2878 else
2879 if (strcmp(op, "unpin") == 0) { /** **/
2880 /* unpin this message */
2881 unpin(&snac, id);
2882 out = mastoapi_status(&snac, msg);
2883 }
2884 else
2885 if (strcmp(op, "mute") == 0) { /** **/
2886 /* Mastodon's mute is snac's hide */
2887 }
2888 else
2889 if (strcmp(op, "unmute") == 0) { /** **/
2890 /* Mastodon's unmute is snac's unhide */
2891 }
2892 }
2893
2894 if (out != NULL) {
2895 *body = xs_json_dumps(out, 4);
2896 *ctype = "application/json";
2897 status = HTTP_STATUS_OK;
2898 }
2899 }
2900 }
2901 else
2902 status = HTTP_STATUS_UNAUTHORIZED;
2903 }
2904 else
2905 if (strcmp(cmd, "/v1/notifications/clear") == 0) { /** **/
2906 if (logged_in) {
2907 notify_clear(&snac);
2908 timeline_touch(&snac);
2909
2910 *body = xs_dup("{}");
2911 *ctype = "application/json";
2912 status = HTTP_STATUS_OK;
2913 }
2914 else
2915 status = HTTP_STATUS_UNAUTHORIZED;
2916 }
2917 else
2918 if (strcmp(cmd, "/v1/push/subscription") == 0) { /** **/
2919 /* I don't know what I'm doing */
2920 if (logged_in) {
2921 const char *v;
2922
2923 xs *wpush = xs_dict_new();
2924
2925 wpush = xs_dict_append(wpush, "id", "1");
2926
2927 v = xs_dict_get(args, "data");
2928 v = xs_dict_get(v, "alerts");
2929 wpush = xs_dict_append(wpush, "alerts", v);
2930
2931 v = xs_dict_get(args, "subscription");
2932 v = xs_dict_get(v, "endpoint");
2933 wpush = xs_dict_append(wpush, "endpoint", v);
2934
2935 xs *server_key = random_str();
2936 wpush = xs_dict_append(wpush, "server_key", server_key);
2937
2938 *body = xs_json_dumps(wpush, 4);
2939 *ctype = "application/json";
2940 status = HTTP_STATUS_OK;
2941 }
2942 else
2943 status = HTTP_STATUS_UNAUTHORIZED;
2944 }
2945 else
2946 if (strcmp(cmd, "/v1/media") == 0 || strcmp(cmd, "/v2/media") == 0) { /** **/
2947 if (logged_in) {
2948 const xs_list *file = xs_dict_get(args, "file");
2949 const char *desc = xs_dict_get(args, "description");
2950
2951 if (xs_is_null(desc))
2952 desc = "";
2953
2954 status = HTTP_STATUS_BAD_REQUEST;
2955
2956 if (xs_type(file) == XSTYPE_LIST) {
2957 const char *fn = xs_list_get(file, 0);
2958
2959 if (*fn != '\0') {
2960 char *ext = strrchr(fn, '.');
2961 xs *hash = xs_md5_hex(fn, strlen(fn));
2962 xs *id = xs_fmt("%s%s", hash, ext);
2963 xs *url = xs_fmt("%s/s/%s", snac.actor, id);
2964 int fo = xs_number_get(xs_list_get(file, 1));
2965 int fs = xs_number_get(xs_list_get(file, 2));
2966
2967 /* store */
2968 static_put(&snac, id, payload + fo, fs);
2969 static_put_meta(&snac, id, desc);
2970
2971 /* prepare a response */
2972 xs *rsp = xs_dict_new();
2973
2974 rsp = xs_dict_append(rsp, "id", id);
2975 rsp = xs_dict_append(rsp, "type", "image");
2976 rsp = xs_dict_append(rsp, "url", url);
2977 rsp = xs_dict_append(rsp, "preview_url", url);
2978 rsp = xs_dict_append(rsp, "remote_url", url);
2979 rsp = xs_dict_append(rsp, "description", desc);
2980
2981 *body = xs_json_dumps(rsp, 4);
2982 *ctype = "application/json";
2983 status = HTTP_STATUS_OK;
2984 }
2985 }
2986 }
2987 else
2988 status = HTTP_STATUS_UNAUTHORIZED;
2989 }
2990 else
2991 if (xs_startswith(cmd, "/v1/accounts")) { /** **/
2992 if (logged_in) {
2993 /* account-related information */
2994 xs *l = xs_split(cmd, "/");
2995 const char *md5 = xs_list_get(l, 3);
2996 const char *opt = xs_list_get(l, 4);
2997 xs *rsp = NULL;
2998
2999 if (!xs_is_null(md5) && *md5) {
3000 xs *actor_o = NULL;
3001
3002 if (xs_is_null(opt)) {
3003 /* ? */
3004 }
3005 else
3006 if (strcmp(opt, "follow") == 0) { /** **/
3007 if (valid_status(object_get_by_md5(md5, &actor_o))) {
3008 const char *actor = xs_dict_get(actor_o, "id");
3009
3010 xs *msg = msg_follow(&snac, actor);
3011
3012 if (msg != NULL) {
3013 /* reload the actor from the message, in may be different */
3014 actor = xs_dict_get(msg, "object");
3015
3016 following_add(&snac, actor, msg);
3017
3018 enqueue_output_by_actor(&snac, msg, actor, 0);
3019
3020 rsp = mastoapi_relationship(&snac, md5);
3021 }
3022 }
3023 }
3024 else
3025 if (strcmp(opt, "unfollow") == 0) { /** **/
3026 if (valid_status(object_get_by_md5(md5, &actor_o))) {
3027 const char *actor = xs_dict_get(actor_o, "id");
3028
3029 /* get the following object */
3030 xs *object = NULL;
3031
3032 if (valid_status(following_get(&snac, actor, &object))) {
3033 xs *msg = msg_undo(&snac, xs_dict_get(object, "object"));
3034
3035 following_del(&snac, actor);
3036
3037 enqueue_output_by_actor(&snac, msg, actor, 0);
3038
3039 rsp = mastoapi_relationship(&snac, md5);
3040 }
3041 }
3042 }
3043 else
3044 if (strcmp(opt, "block") == 0) { /** **/
3045 if (valid_status(object_get_by_md5(md5, &actor_o))) {
3046 const char *actor = xs_dict_get(actor_o, "id");
3047
3048 mute(&snac, actor);
3049
3050 rsp = mastoapi_relationship(&snac, md5);
3051 }
3052 }
3053 else
3054 if (strcmp(opt, "unblock") == 0) { /** **/
3055 if (valid_status(object_get_by_md5(md5, &actor_o))) {
3056 const char *actor = xs_dict_get(actor_o, "id");
3057
3058 unmute(&snac, actor);
3059
3060 rsp = mastoapi_relationship(&snac, md5);
3061 }
3062 }
3063 }
3064
3065 if (rsp != NULL) {
3066 *body = xs_json_dumps(rsp, 4);
3067 *ctype = "application/json";
3068 status = HTTP_STATUS_OK;
3069 }
3070 }
3071 else
3072 status = HTTP_STATUS_UNAUTHORIZED;
3073 }
3074 else
3075 if (xs_startswith(cmd, "/v1/polls")) { /** **/
3076 if (logged_in) {
3077 /* operations on a status */
3078 xs *l = xs_split(cmd, "/");
3079 const char *mid = xs_list_get(l, 3);
3080 const char *op = xs_list_get(l, 4);
3081
3082 if (!xs_is_null(mid)) {
3083 xs *msg = NULL;
3084 xs *out = NULL;
3085
3086 /* skip the 'fake' part of the id */
3087 mid = MID_TO_MD5(mid);
3088
3089 if (valid_status(timeline_get_by_md5(&snac, mid, &msg))) {
3090 const char *id = xs_dict_get(msg, "id");
3091 const char *atto = get_atto(msg);
3092
3093 const xs_list *opts = xs_dict_get(msg, "oneOf");
3094 if (opts == NULL)
3095 opts = xs_dict_get(msg, "anyOf");
3096
3097 if (op == NULL) {
3098 }
3099 else
3100 if (strcmp(op, "votes") == 0) {
3101 const xs_list *choices = xs_dict_get(args, "choices[]");
3102
3103 if (xs_is_null(choices))
3104 choices = xs_dict_get(args, "choices");
3105
3106 if (xs_type(choices) == XSTYPE_LIST) {
3107 const xs_str *v;
3108
3109 int c = 0;
3110 while (xs_list_next(choices, &v, &c)) {
3111 int io = atoi(v);
3112 const xs_dict *o = xs_list_get(opts, io);
3113
3114 if (o) {
3115 const char *name = xs_dict_get(o, "name");
3116
3117 xs *msg = msg_note(&snac, "", atto, (char *)id, NULL, 1, NULL, NULL);
3118 msg = xs_dict_append(msg, "name", name);
3119
3120 xs *c_msg = msg_create(&snac, msg);
3121 enqueue_message(&snac, c_msg);
3122 timeline_add(&snac, xs_dict_get(msg, "id"), msg);
3123 }
3124 }
3125
3126 out = mastoapi_poll(&snac, msg);
3127 }
3128 }
3129 }
3130
3131 if (out != NULL) {
3132 *body = xs_json_dumps(out, 4);
3133 *ctype = "application/json";
3134 status = HTTP_STATUS_OK;
3135 }
3136 }
3137 }
3138 else
3139 status = HTTP_STATUS_UNAUTHORIZED;
3140 }
3141 else
3142 if (strcmp(cmd, "/v1/lists") == 0) {
3143 if (logged_in) {
3144 const char *title = xs_dict_get(args, "title");
3145
3146 if (xs_type(title) == XSTYPE_STRING) {
3147 /* add the list */
3148 xs *out = xs_dict_new();
3149 xs *lid = list_maint(&snac, title, 1);
3150
3151 if (!xs_is_null(lid)) {
3152 out = xs_dict_append(out, "id", lid);
3153 out = xs_dict_append(out, "title", title);
3154 out = xs_dict_append(out, "replies_policy", xs_dict_get_def(args, "replies_policy", "list"));
3155 out = xs_dict_append(out, "exclusive", xs_stock(XSTYPE_FALSE));
3156
3157 status = HTTP_STATUS_OK;
3158 }
3159 else {
3160 out = xs_dict_append(out, "error", "cannot create list");
3161 status = HTTP_STATUS_UNPROCESSABLE_CONTENT;
3162 }
3163
3164 *body = xs_json_dumps(out, 4);
3165 *ctype = "application/json";
3166 }
3167 else
3168 status = HTTP_STATUS_UNPROCESSABLE_CONTENT;
3169 }
3170 }
3171 else
3172 if (xs_startswith(cmd, "/v1/lists/")) { /** list maintenance **/
3173 if (logged_in) {
3174 xs *l = xs_split(cmd, "/");
3175 const char *op = xs_list_get(l, -1);
3176 const char *id = xs_list_get(l, -2);
3177
3178 if (op && id && xs_is_hex(id)) {
3179 if (strcmp(op, "accounts") == 0) {
3180 const xs_list *accts = xs_dict_get(args, "account_ids[]");
3181
3182 if (xs_is_null(accts))
3183 accts = xs_dict_get(args, "account_ids");
3184
3185 int c = 0;
3186 const char *v;
3187
3188 while (xs_list_next(accts, &v, &c)) {
3189 list_content(&snac, id, v, 1);
3190 }
3191
3192 xs *out = xs_dict_new();
3193 *body = xs_json_dumps(out, 4);
3194 *ctype = "application/json";
3195 status = HTTP_STATUS_OK;
3196 }
3197 }
3198 }
3199 }
3200 else if (strcmp(cmd, "/v1/markers") == 0) { /** **/
3201 xs_str *json = NULL;
3202 if (logged_in) {
3203 const xs_str *home_marker = xs_dict_get(args, "home[last_read_id]");
3204 if (xs_is_null(home_marker)) {
3205 const xs_dict *home = xs_dict_get(args, "home");
3206 if (!xs_is_null(home))
3207 home_marker = xs_dict_get(home, "last_read_id");
3208 }
3209
3210 const xs_str *notify_marker = xs_dict_get(args, "notifications[last_read_id]");
3211 if (xs_is_null(notify_marker)) {
3212 const xs_dict *notify = xs_dict_get(args, "notifications");
3213 if (!xs_is_null(notify))
3214 notify_marker = xs_dict_get(notify, "last_read_id");
3215 }
3216 json = xs_json_dumps(markers_set(&snac, home_marker, notify_marker), 4);
3217 }
3218 if (!xs_is_null(json))
3219 *body = json;
3220 else
3221 *body = xs_dup("{}");
3222
3223 *ctype = "application/json";
3224 status = HTTP_STATUS_OK;
3225 }
3226 else
3227 status = HTTP_STATUS_UNPROCESSABLE_CONTENT;
3228
3229 /* user cleanup */
3230 if (logged_in)
3231 user_free(&snac);
3232
3233 srv_debug(1, xs_fmt("mastoapi_post_handler %s %d", q_path, status));
3234
3235 return status;
3236}
3237
3238
3239int mastoapi_delete_handler(const xs_dict *req, const char *q_path,
3240 const char *payload, int p_size,
3241 char **body, int *b_size, char **ctype)
3242{
3243 (void)p_size;
3244 (void)body;
3245 (void)b_size;
3246 (void)ctype;
3247
3248 if (!xs_startswith(q_path, "/api/v1/") && !xs_startswith(q_path, "/api/v2/"))
3249 return 0;
3250
3251 int status = HTTP_STATUS_NOT_FOUND;
3252 xs *args = NULL;
3253 const char *i_ctype = xs_dict_get(req, "content-type");
3254
3255 if (i_ctype && xs_startswith(i_ctype, "application/json")) {
3256 if (!xs_is_null(payload))
3257 args = xs_json_loads(payload);
3258 }
3259 else if (i_ctype && xs_startswith(i_ctype, "application/x-www-form-urlencoded"))
3260 {
3261 // Some apps send form data instead of json so we should cater for those
3262 if (!xs_is_null(payload)) {
3263 args = xs_url_vars(payload);
3264 }
3265 }
3266 else
3267 args = xs_dup(xs_dict_get(req, "p_vars"));
3268
3269 if (args == NULL)
3270 return HTTP_STATUS_BAD_REQUEST;
3271
3272 snac snac = {0};
3273 int logged_in = process_auth_token(&snac, req);
3274
3275 xs *cmd = xs_replace_n(q_path, "/api", "", 1);
3276
3277 if (xs_startswith(cmd, "/v1/push/subscription") || xs_startswith(cmd, "/v2/push/subscription")) { /** **/
3278 // pretend we deleted it, since it doesn't exist anyway
3279 status = HTTP_STATUS_OK;
3280 }
3281 else
3282 if (xs_startswith(cmd, "/v1/lists/")) {
3283 if (logged_in) {
3284 xs *l = xs_split(cmd, "/");
3285 const char *p = xs_list_get(l, -1);
3286
3287 if (p) {
3288 if (strcmp(p, "accounts") == 0) {
3289 /* delete account from list */
3290 p = xs_list_get(l, -2);
3291 const xs_list *accts = xs_dict_get(args, "account_ids[]");
3292
3293 if (xs_is_null(accts))
3294 accts = xs_dict_get(args, "account_ids");
3295
3296 int c = 0;
3297 const char *v;
3298
3299 while (xs_list_next(accts, &v, &c)) {
3300 list_content(&snac, p, v, 2);
3301 }
3302 }
3303 else {
3304 /* delete list */
3305 if (xs_is_hex(p)) {
3306 list_maint(&snac, p, 2);
3307 }
3308 }
3309 }
3310
3311 *ctype = "application/json";
3312 status = HTTP_STATUS_OK;
3313 }
3314 else
3315 status = HTTP_STATUS_UNAUTHORIZED;
3316 }
3317
3318 /* user cleanup */
3319 if (logged_in)
3320 user_free(&snac);
3321
3322 srv_debug(1, xs_fmt("mastoapi_delete_handler %s %d", q_path, status));
3323
3324 return status;
3325}
3326
3327
3328int mastoapi_put_handler(const xs_dict *req, const char *q_path,
3329 const char *payload, int p_size,
3330 char **body, int *b_size, char **ctype)
3331{
3332 (void)p_size;
3333 (void)b_size;
3334
3335 if (!xs_startswith(q_path, "/api/v1/") && !xs_startswith(q_path, "/api/v2/"))
3336 return 0;
3337
3338 int status = HTTP_STATUS_NOT_FOUND;
3339 xs *args = NULL;
3340 const char *i_ctype = xs_dict_get(req, "content-type");
3341
3342 if (i_ctype && xs_startswith(i_ctype, "application/json")) {
3343 if (!xs_is_null(payload))
3344 args = xs_json_loads(payload);
3345 }
3346 else
3347 args = xs_dup(xs_dict_get(req, "p_vars"));
3348
3349 if (args == NULL)
3350 return HTTP_STATUS_BAD_REQUEST;
3351
3352 xs *cmd = xs_replace_n(q_path, "/api", "", 1);
3353
3354 snac snac = {0};
3355 int logged_in = process_auth_token(&snac, req);
3356
3357 if (xs_startswith(cmd, "/v1/media") || xs_startswith(cmd, "/v2/media")) { /** **/
3358 if (logged_in) {
3359 xs *l = xs_split(cmd, "/");
3360 const char *stid = xs_list_get(l, 3);
3361
3362 if (!xs_is_null(stid)) {
3363 const char *desc = xs_dict_get(args, "description");
3364
3365 /* set the image metadata */
3366 static_put_meta(&snac, stid, desc);
3367
3368 /* prepare a response */
3369 xs *rsp = xs_dict_new();
3370 xs *url = xs_fmt("%s/s/%s", snac.actor, stid);
3371
3372 rsp = xs_dict_append(rsp, "id", stid);
3373 rsp = xs_dict_append(rsp, "type", "image");
3374 rsp = xs_dict_append(rsp, "url", url);
3375 rsp = xs_dict_append(rsp, "preview_url", url);
3376 rsp = xs_dict_append(rsp, "remote_url", url);
3377 rsp = xs_dict_append(rsp, "description", desc);
3378
3379 *body = xs_json_dumps(rsp, 4);
3380 *ctype = "application/json";
3381 status = HTTP_STATUS_OK;
3382 }
3383 }
3384 else
3385 status = HTTP_STATUS_UNAUTHORIZED;
3386 }
3387 else
3388 if (xs_startswith(cmd, "/v1/statuses")) {
3389 if (logged_in) {
3390 xs *l = xs_split(cmd, "/");
3391 const char *mid = xs_list_get(l, 3);
3392
3393 if (!xs_is_null(mid)) {
3394 const char *md5 = MID_TO_MD5(mid);
3395 xs *rsp = NULL;
3396 xs *msg = NULL;
3397
3398 if (valid_status(timeline_get_by_md5(&snac, md5, &msg))) {
3399 const char *content = xs_dict_get(args, "status");
3400 xs *atls = xs_list_new();
3401 xs *f_content = not_really_markdown(content, &atls, NULL);
3402
3403 /* replace fields with new content */
3404 msg = xs_dict_set(msg, "sourceContent", content);
3405 msg = xs_dict_set(msg, "content", f_content);
3406
3407 xs *updated = xs_str_utctime(0, ISO_DATE_SPEC);
3408 msg = xs_dict_set(msg, "updated", updated);
3409
3410 /* overwrite object, not updating the indexes */
3411 object_add_ow(xs_dict_get(msg, "id"), msg);
3412
3413 /* update message */
3414 xs *c_msg = msg_update(&snac, msg);
3415
3416 enqueue_message(&snac, c_msg);
3417
3418 rsp = mastoapi_status(&snac, msg);
3419 }
3420
3421 if (rsp != NULL) {
3422 *body = xs_json_dumps(rsp, 4);
3423 *ctype = "application/json";
3424 status = HTTP_STATUS_OK;
3425 }
3426 }
3427 }
3428 else
3429 status = HTTP_STATUS_UNAUTHORIZED;
3430 }
3431
3432 /* user cleanup */
3433 if (logged_in)
3434 user_free(&snac);
3435
3436 srv_debug(1, xs_fmt("mastoapi_put_handler %s %d", q_path, status));
3437
3438 return status;
3439}
3440
3441void persist_image(const char *key, const xs_val *data, const char *payload, snac *snac)
3442/* Store header or avatar */
3443{
3444 if (data != NULL) {
3445 if (xs_type(data) == XSTYPE_LIST) {
3446 const char *fn = xs_list_get(data, 0);
3447
3448 if (fn && *fn) {
3449 const char *ext = strrchr(fn, '.');
3450
3451 /* Mona iOS sends always jpg as application/octet-stream with no filename */
3452 if (ext == NULL || strcmp(fn, key) == 0) {
3453 ext = ".jpg";
3454 }
3455
3456 /* Make sure we have a unique file name, otherwise updated images will not be
3457 * re-loaded by clients. */
3458 xs *rnd = random_str();
3459 xs *hash = xs_md5_hex(rnd, strlen(rnd));
3460 xs *id = xs_fmt("%s%s", hash, ext);
3461 xs *url = xs_fmt("%s/s/%s", snac->actor, id);
3462 int fo = xs_number_get(xs_list_get(data, 1));
3463 int fs = xs_number_get(xs_list_get(data, 2));
3464
3465 /* store */
3466 static_put(snac, id, payload + fo, fs);
3467
3468 snac->config = xs_dict_set(snac->config, key, url);
3469 }
3470 }
3471 }
3472}
3473
3474int mastoapi_patch_handler(const xs_dict *req, const char *q_path,
3475 const char *payload, int p_size,
3476 char **body, int *b_size, char **ctype)
3477/* Handle profile updates */
3478{
3479 (void)p_size;
3480 (void)b_size;
3481
3482 if (!xs_startswith(q_path, "/api/v1/"))
3483 return 0;
3484
3485 int status = HTTP_STATUS_NOT_FOUND;
3486 xs *args = NULL;
3487 const char *i_ctype = xs_dict_get(req, "content-type");
3488
3489 if (i_ctype && xs_startswith(i_ctype, "application/json")) {
3490 if (!xs_is_null(payload))
3491 args = xs_json_loads(payload);
3492 }
3493 else if (i_ctype && xs_startswith(i_ctype, "application/x-www-form-urlencoded"))
3494 {
3495 // Some apps send form data instead of json so we should cater for those
3496 if (!xs_is_null(payload)) {
3497 args = xs_url_vars(payload);
3498 }
3499 }
3500 else
3501 args = xs_dup(xs_dict_get(req, "p_vars"));
3502
3503 if (args == NULL)
3504 return HTTP_STATUS_BAD_REQUEST;
3505
3506 xs *cmd = xs_replace_n(q_path, "/api", "", 1);
3507
3508 snac snac = {0};
3509 int logged_in = process_auth_token(&snac, req);
3510
3511 if (xs_startswith(cmd, "/v1/accounts/update_credentials")) {
3512 /* Update user profile fields */
3513 if (logged_in) {
3514 int c = 0;
3515 const xs_str *k;
3516 const xs_val *v;
3517 const xs_str *field_name = NULL;
3518 xs *new_fields = xs_dict_new();
3519 while (xs_dict_next(args, &k, &v, &c)) {
3520 if (strcmp(k, "display_name") == 0) {
3521 if (v != NULL)
3522 snac.config = xs_dict_set(snac.config, "name", v);
3523 }
3524 else
3525 if (strcmp(k, "note") == 0) {
3526 if (v != NULL)
3527 snac.config = xs_dict_set(snac.config, "bio", v);
3528 }
3529 else
3530 if (strcmp(k, "bot") == 0) {
3531 if (v != NULL)
3532 snac.config = xs_dict_set(snac.config, "bot",
3533 (strcmp(v, "true") == 0 ||
3534 strcmp(v, "1") == 0) ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
3535 }
3536 else
3537 if (strcmp(k, "source[sensitive]") == 0) {
3538 if (v != NULL)
3539 snac.config = xs_dict_set(snac.config, "cw",
3540 strcmp(v, "true") == 0 ? "open" : "");
3541 }
3542 else
3543 if (strcmp(k, "source[privacy]") == 0) {
3544 if (v != NULL)
3545 snac.config = xs_dict_set(snac.config, "private",
3546 strcmp(v, "private") == 0 ? xs_stock(XSTYPE_TRUE) : xs_stock(XSTYPE_FALSE));
3547 }
3548 else
3549 if (strcmp(k, "header") == 0) {
3550 persist_image("header", v, payload, &snac);
3551 }
3552 else
3553 if (strcmp(k, "avatar") == 0) {
3554 persist_image("avatar", v, payload, &snac);
3555 }
3556 else
3557 if (xs_between("fields_attributes", k, "[name]")) {
3558 field_name = strcmp(v, "") != 0 ? v : NULL;
3559 }
3560 else
3561 if (xs_between("fields_attributes", k, "[value]")) {
3562 if (field_name != NULL) {
3563 new_fields = xs_dict_set(new_fields, field_name, v);
3564 snac.config = xs_dict_set(snac.config, "metadata", new_fields);
3565 }
3566 }
3567 /* we don't have support for the following options, yet
3568 - discoverable (0/1)
3569 - locked (0/1)
3570 */
3571 }
3572
3573 /* Persist profile */
3574 if (user_persist(&snac, 1) == 0)
3575 credentials_get(body, ctype, &status, snac);
3576 else
3577 status = HTTP_STATUS_INTERNAL_SERVER_ERROR;
3578 }
3579 else
3580 status = HTTP_STATUS_UNAUTHORIZED;
3581 }
3582
3583 /* user cleanup */
3584 if (logged_in)
3585 user_free(&snac);
3586
3587 srv_debug(1, xs_fmt("mastoapi_patch_handler %s %d", q_path, status));
3588
3589 return status;
3590}
3591
3592
3593void mastoapi_purge(void)
3594{
3595 xs *spec = xs_fmt("%s/app/" "*.json", srv_basedir);
3596 xs *files = xs_glob(spec, 1, 0);
3597 xs_list *p = files;
3598 const xs_str *v;
3599
3600 time_t mt = time(NULL) - 3600;
3601
3602 while (xs_list_iter(&p, &v)) {
3603 xs *cid = xs_replace(v, ".json", "");
3604 xs *fn = _app_fn(cid);
3605
3606 if (mtime(fn) < mt) {
3607 /* get the app */
3608 xs *app = app_get(cid);
3609
3610 if (app) {
3611 /* old apps with no uid are incomplete cruft */
3612 const char *uid = xs_dict_get(app, "uid");
3613
3614 if (xs_is_null(uid) || *uid == '\0') {
3615 unlink(fn);
3616 srv_debug(2, xs_fmt("purged %s", fn));
3617 }
3618 }
3619 }
3620 }
3621}
3622
3623
3624#endif /* #ifndef NO_MASTODON_API */
