You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

637 lines
19 KiB

8 years ago
7 years ago
Add Keybase integration (#10297) * create account_identity_proofs table * add endpoint for keybase to check local proofs * add async task to update validity and liveness of proofs from keybase * first pass keybase proof CRUD * second pass keybase proof creation * clean up proof list and add badges * add avatar url to keybase api * Always highlight the “Identity Proofs” navigation item when interacting with proofs. * Update translations. * Add profile URL. * Reorder proofs. * Add proofs to bio. * Update settings/identity_proofs front-end. * Use `link_to`. * Only encode query params if they exist. URLs without params had a trailing `?`. * Only show live proofs. * change valid to active in proof list and update liveness before displaying * minor fixes * add keybase config at well-known path * extremely naive feature flagging off the identity proof UI * fixes for rubocop * make identity proofs page resilient to potential keybase issues * normalize i18n * tweaks for brakeman * remove two unused translations * cleanup and add more localizations * make keybase_contacts an admin setting * fix ExternalProofService my_domain * use Addressable::URI in identity proofs * use active model serializer for keybase proof config * more cleanup of keybase proof config * rename proof is_valid and is_live to proof_valid and proof_live * cleanup * assorted tweaks for more robust communication with keybase * Clean up * Small fixes * Display verified identity identically to verified links * Clean up unused CSS * Add caching for Keybase avatar URLs * Remove keybase_contacts setting
5 years ago
Add WebAuthn as an alternative 2FA method (#14466) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>
4 years ago
Add follower synchronization mechanism (#14510) * Add support for followers synchronization on the receiving end Check the `collectionSynchronization` attribute on `Create` and `Announce` activities and synchronize followers from provided collection if possible. * Add tests for followers synchronization on the receiving end * Add support for follower synchronization on the sender's end * Add tests for the sending end * Switch from AS attributes to HTTP header Replace the custom `collectionSynchronization` ActivityStreams attribute by an HTTP header (`X-AS-Collection-Synchronization`) with the same syntax as the `Signature` header and the following fields: - `collectionId` to specify which collection to synchronize - `digest` for the SHA256 hex-digest of the list of followers known on the receiving instance (where “receiving instance” is determined by accounts sharing the same host name for their ActivityPub actor `id`) - `url` of a collection that should be fetched by the instance actor Internally, move away from the webfinger-based `domain` attribute and use account `uri` prefix to group accounts. * Add environment variable to disable followers synchronization Since the whole mechanism relies on some new preconditions that, in some extremely rare cases, might not be met, add an environment variable (DISABLE_FOLLOWERS_SYNCHRONIZATION) to disable the mechanism altogether and avoid followers being incorrectly removed. The current conditions are: 1. all managed accounts' actor `id` and inbox URL have the same URI scheme and netloc. 2. all accounts whose actor `id` or inbox URL share the same URI scheme and netloc as a managed account must be managed by the same Mastodon instance as well. As far as Mastodon is concerned, breaking those preconditions require extensive configuration changes in the reverse proxy and might also cause other issues. Therefore, this environment variable provides a way out for people with highly unusual configurations, and can be safely ignored for the overwhelming majority of Mastodon administrators. * Only set follower synchronization header on non-public statuses This is to avoid unnecessary computations and allow Follow-related activities to be handled by the usual codepath instead of going through the synchronization mechanism (otherwise, any Follow/Undo/Accept activity would trigger the synchronization mechanism even if processing the activity itself would be enough to re-introduce synchronization) * Change how ActivityPub::SynchronizeFollowersService handles follow requests If the remote lists a local follower which we only know has sent a follow request, consider the follow request as accepted instead of sending an Undo. * Integrate review feeback - rename X-AS-Collection-Synchronization to Collection-Synchronization - various minor refactoring and code style changes * Only select required fields when computing followers_hash * Use actor URI rather than webfinger domain in synchronization endpoint * Change hash computation to be a XOR of individual hashes Makes it much easier to be memory-efficient, and avoid sorting discrepancy issues. * Marginally improve followers_hash computation speed * Further improve hash computation performances by using pluck_each
4 years ago
Add WebAuthn as an alternative 2FA method (#14466) * feat: add possibility of adding WebAuthn security keys to use as 2FA This adds a basic UI for enabling WebAuthn 2FA. We did a little refactor to the Settings page for editing the 2FA methods – now it will list the methods that are available to the user (TOTP and WebAuthn) and from there they'll be able to add or remove any of them. Also, it's worth mentioning that for enabling WebAuthn it's required to have TOTP enabled, so the first time that you go to the 2FA Settings page, you'll be asked to set it up. This work was inspired by the one donde by Github in their platform, and despite it could be approached in different ways, we decided to go with this one given that we feel that this gives a great UX. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add request for WebAuthn as second factor at login if enabled This commits adds the feature for using WebAuthn as a second factor for login when enabled. If users have WebAuthn enabled, now a page requesting for the use of a WebAuthn credential for log in will appear, although a link redirecting to the old page for logging in using a two-factor code will also be present. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: add possibility of deleting WebAuthn Credentials Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: disable WebAuthn when an Admin disables 2FA for a user Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * feat: remove ability to disable TOTP leaving only WebAuthn as 2FA Following examples form other platforms like Github, we decided to make Webauthn 2FA secondary to 2FA with TOTP, so that we removed the possibility of removing TOTP authentication only, leaving users with just WEbAuthn as 2FA. Instead, users will have to click on 'Disable 2FA' in order to remove second factor auth. The reason for WebAuthn being secondary to TOPT is that in that way, users will still be able to log in using their code from their phone's application if they don't have their security keys with them – or maybe even lost them. * We had to change a little the flow for setting up TOTP, given that now it's possible to setting up again if you already had TOTP, in order to let users modify their authenticator app – given that now it's not possible for them to disable TOTP and set it up again with another authenticator app. So, basically, now instead of storing the new `otp_secret` in the user, we store it in the session until the process of set up is finished. This was because, as it was before, when users clicked on 'Edit' in the new two-factor methods lists page, but then went back without finishing the flow, their `otp_secret` had been changed therefore invalidating their previous authenticator app, making them unable to log in again using TOTP. Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com> * refactor: fix eslint errors The PR build was failing given that linting returning some errors. This commit attempts to fix them. * refactor: normalize i18n translations The build was failing given that i18n translations files were not normalized. This commits fixes that. * refactor: avoid having the webauthn gem locked to a specific version * refactor: use symbols for routes without '/' * refactor: avoid sending webauthn disabled email when 2FA is disabled When an admins disable 2FA for users, we were sending two mails to them, one notifying that 2FA was disabled and the other to notify that WebAuthn was disabled. As the second one is redundant since the first email includes it, we can remove it and send just one email to users. * refactor: avoid creating new env variable for webauthn_origin config * refactor: improve flash error messages for webauthn pages Co-authored-by: Facundo Padula <facundo.padula@cedarcode.com>
4 years ago
Revamp post filtering system (#18058) * Add model for custom filter keywords * Use CustomFilterKeyword internally Does not change the API * Fix /filters/edit and /filters/new * Add migration tests * Remove whole_word column from custom_filters (covered by custom_filter_keywords) * Redesign /filters Instead of a list, present a card that displays more information and handles multiple keywords per filter. * Redesign /filters/new and /filters/edit to add and remove keywords This adds a new gem dependency: cocoon, as well as a npm dependency: cocoon-js-vanilla. Those are used to easily populate and remove form fields from the user interface when manipulating multiple keyword filters at once. * Add /api/v2/filters to edit filter with multiple keywords Entities: - `Filter`: `id`, `title`, `filter_action` (either `hide` or `warn`), `context` `keywords` - `FilterKeyword`: `id`, `keyword`, `whole_word` API endpoits: - `GET /api/v2/filters` to list filters (including keywords) - `POST /api/v2/filters` to create a new filter `keywords_attributes` can also be passed to create keywords in one request - `GET /api/v2/filters/:id` to read a particular filter - `PUT /api/v2/filters/:id` to update a new filter `keywords_attributes` can also be passed to edit, delete or add keywords in one request - `DELETE /api/v2/filters/:id` to delete a particular filter - `GET /api/v2/filters/:id/keywords` to list keywords for a filter - `POST /api/v2/filters/:filter_id/keywords/:id` to add a new keyword to a filter - `GET /api/v2/filter_keywords/:id` to read a particular keyword - `PUT /api/v2/filter_keywords/:id` to edit a particular keyword - `DELETE /api/v2/filter_keywords/:id` to delete a particular keyword * Change from `irreversible` boolean to `action` enum * Remove irrelevent `irreversible_must_be_within_context` check * Fix /filters/new and /filters/edit with update for filter_action * Fix Rubocop/Codeclimate complaining about task names * Refactor FeedManager#phrase_filtered? This moves regexp building and filter caching to the `CustomFilter` class. This does not change the functional behavior yet, but this changes how the cache is built, doing per-custom_filter regexps so that filters can be matched independently, while still offering caching. * Perform server-side filtering and output result in REST API * Fix numerous filters_changed events being sent when editing multiple keywords at once * Add some tests * Use the new API in the WebUI - use client-side logic for filters we have fetched rules for. This is so that filter changes can be retroactively applied without reloading the UI. - use server-side logic for filters we haven't fetched rules for yet (e.g. network error, or initial timeline loading) * Minor optimizations and refactoring * Perform server-side filtering on the streaming server * Change the wording of filter action labels * Fix issues pointed out by linter * Change design of “Show anyway” link in accordence to review comments * Drop “irreversible” filtering behavior * Move /api/v2/filter_keywords to /api/v1/filters/keywords * Rename `filter_results` attribute to `filtered` * Rename REST::LegacyFilterSerializer to REST::V1::FilterSerializer * Fix systemChannelId value in streaming server * Simplify code by removing client-side filtering code The simplifcation comes at a cost though: filters aren't retroactively applied anymore.
2 years ago
Revamp post filtering system (#18058) * Add model for custom filter keywords * Use CustomFilterKeyword internally Does not change the API * Fix /filters/edit and /filters/new * Add migration tests * Remove whole_word column from custom_filters (covered by custom_filter_keywords) * Redesign /filters Instead of a list, present a card that displays more information and handles multiple keywords per filter. * Redesign /filters/new and /filters/edit to add and remove keywords This adds a new gem dependency: cocoon, as well as a npm dependency: cocoon-js-vanilla. Those are used to easily populate and remove form fields from the user interface when manipulating multiple keyword filters at once. * Add /api/v2/filters to edit filter with multiple keywords Entities: - `Filter`: `id`, `title`, `filter_action` (either `hide` or `warn`), `context` `keywords` - `FilterKeyword`: `id`, `keyword`, `whole_word` API endpoits: - `GET /api/v2/filters` to list filters (including keywords) - `POST /api/v2/filters` to create a new filter `keywords_attributes` can also be passed to create keywords in one request - `GET /api/v2/filters/:id` to read a particular filter - `PUT /api/v2/filters/:id` to update a new filter `keywords_attributes` can also be passed to edit, delete or add keywords in one request - `DELETE /api/v2/filters/:id` to delete a particular filter - `GET /api/v2/filters/:id/keywords` to list keywords for a filter - `POST /api/v2/filters/:filter_id/keywords/:id` to add a new keyword to a filter - `GET /api/v2/filter_keywords/:id` to read a particular keyword - `PUT /api/v2/filter_keywords/:id` to edit a particular keyword - `DELETE /api/v2/filter_keywords/:id` to delete a particular keyword * Change from `irreversible` boolean to `action` enum * Remove irrelevent `irreversible_must_be_within_context` check * Fix /filters/new and /filters/edit with update for filter_action * Fix Rubocop/Codeclimate complaining about task names * Refactor FeedManager#phrase_filtered? This moves regexp building and filter caching to the `CustomFilter` class. This does not change the functional behavior yet, but this changes how the cache is built, doing per-custom_filter regexps so that filters can be matched independently, while still offering caching. * Perform server-side filtering and output result in REST API * Fix numerous filters_changed events being sent when editing multiple keywords at once * Add some tests * Use the new API in the WebUI - use client-side logic for filters we have fetched rules for. This is so that filter changes can be retroactively applied without reloading the UI. - use server-side logic for filters we haven't fetched rules for yet (e.g. network error, or initial timeline loading) * Minor optimizations and refactoring * Perform server-side filtering on the streaming server * Change the wording of filter action labels * Fix issues pointed out by linter * Change design of “Show anyway” link in accordence to review comments * Drop “irreversible” filtering behavior * Move /api/v2/filter_keywords to /api/v1/filters/keywords * Rename `filter_results` attribute to `filtered` * Rename REST::LegacyFilterSerializer to REST::V1::FilterSerializer * Fix systemChannelId value in streaming server * Simplify code by removing client-side filtering code The simplifcation comes at a cost though: filters aren't retroactively applied anymore.
2 years ago
Revamp post filtering system (#18058) * Add model for custom filter keywords * Use CustomFilterKeyword internally Does not change the API * Fix /filters/edit and /filters/new * Add migration tests * Remove whole_word column from custom_filters (covered by custom_filter_keywords) * Redesign /filters Instead of a list, present a card that displays more information and handles multiple keywords per filter. * Redesign /filters/new and /filters/edit to add and remove keywords This adds a new gem dependency: cocoon, as well as a npm dependency: cocoon-js-vanilla. Those are used to easily populate and remove form fields from the user interface when manipulating multiple keyword filters at once. * Add /api/v2/filters to edit filter with multiple keywords Entities: - `Filter`: `id`, `title`, `filter_action` (either `hide` or `warn`), `context` `keywords` - `FilterKeyword`: `id`, `keyword`, `whole_word` API endpoits: - `GET /api/v2/filters` to list filters (including keywords) - `POST /api/v2/filters` to create a new filter `keywords_attributes` can also be passed to create keywords in one request - `GET /api/v2/filters/:id` to read a particular filter - `PUT /api/v2/filters/:id` to update a new filter `keywords_attributes` can also be passed to edit, delete or add keywords in one request - `DELETE /api/v2/filters/:id` to delete a particular filter - `GET /api/v2/filters/:id/keywords` to list keywords for a filter - `POST /api/v2/filters/:filter_id/keywords/:id` to add a new keyword to a filter - `GET /api/v2/filter_keywords/:id` to read a particular keyword - `PUT /api/v2/filter_keywords/:id` to edit a particular keyword - `DELETE /api/v2/filter_keywords/:id` to delete a particular keyword * Change from `irreversible` boolean to `action` enum * Remove irrelevent `irreversible_must_be_within_context` check * Fix /filters/new and /filters/edit with update for filter_action * Fix Rubocop/Codeclimate complaining about task names * Refactor FeedManager#phrase_filtered? This moves regexp building and filter caching to the `CustomFilter` class. This does not change the functional behavior yet, but this changes how the cache is built, doing per-custom_filter regexps so that filters can be matched independently, while still offering caching. * Perform server-side filtering and output result in REST API * Fix numerous filters_changed events being sent when editing multiple keywords at once * Add some tests * Use the new API in the WebUI - use client-side logic for filters we have fetched rules for. This is so that filter changes can be retroactively applied without reloading the UI. - use server-side logic for filters we haven't fetched rules for yet (e.g. network error, or initial timeline loading) * Minor optimizations and refactoring * Perform server-side filtering on the streaming server * Change the wording of filter action labels * Fix issues pointed out by linter * Change design of “Show anyway” link in accordence to review comments * Drop “irreversible” filtering behavior * Move /api/v2/filter_keywords to /api/v1/filters/keywords * Rename `filter_results` attribute to `filtered` * Rename REST::LegacyFilterSerializer to REST::V1::FilterSerializer * Fix systemChannelId value in streaming server * Simplify code by removing client-side filtering code The simplifcation comes at a cost though: filters aren't retroactively applied anymore.
2 years ago
Revamp post filtering system (#18058) * Add model for custom filter keywords * Use CustomFilterKeyword internally Does not change the API * Fix /filters/edit and /filters/new * Add migration tests * Remove whole_word column from custom_filters (covered by custom_filter_keywords) * Redesign /filters Instead of a list, present a card that displays more information and handles multiple keywords per filter. * Redesign /filters/new and /filters/edit to add and remove keywords This adds a new gem dependency: cocoon, as well as a npm dependency: cocoon-js-vanilla. Those are used to easily populate and remove form fields from the user interface when manipulating multiple keyword filters at once. * Add /api/v2/filters to edit filter with multiple keywords Entities: - `Filter`: `id`, `title`, `filter_action` (either `hide` or `warn`), `context` `keywords` - `FilterKeyword`: `id`, `keyword`, `whole_word` API endpoits: - `GET /api/v2/filters` to list filters (including keywords) - `POST /api/v2/filters` to create a new filter `keywords_attributes` can also be passed to create keywords in one request - `GET /api/v2/filters/:id` to read a particular filter - `PUT /api/v2/filters/:id` to update a new filter `keywords_attributes` can also be passed to edit, delete or add keywords in one request - `DELETE /api/v2/filters/:id` to delete a particular filter - `GET /api/v2/filters/:id/keywords` to list keywords for a filter - `POST /api/v2/filters/:filter_id/keywords/:id` to add a new keyword to a filter - `GET /api/v2/filter_keywords/:id` to read a particular keyword - `PUT /api/v2/filter_keywords/:id` to edit a particular keyword - `DELETE /api/v2/filter_keywords/:id` to delete a particular keyword * Change from `irreversible` boolean to `action` enum * Remove irrelevent `irreversible_must_be_within_context` check * Fix /filters/new and /filters/edit with update for filter_action * Fix Rubocop/Codeclimate complaining about task names * Refactor FeedManager#phrase_filtered? This moves regexp building and filter caching to the `CustomFilter` class. This does not change the functional behavior yet, but this changes how the cache is built, doing per-custom_filter regexps so that filters can be matched independently, while still offering caching. * Perform server-side filtering and output result in REST API * Fix numerous filters_changed events being sent when editing multiple keywords at once * Add some tests * Use the new API in the WebUI - use client-side logic for filters we have fetched rules for. This is so that filter changes can be retroactively applied without reloading the UI. - use server-side logic for filters we haven't fetched rules for yet (e.g. network error, or initial timeline loading) * Minor optimizations and refactoring * Perform server-side filtering on the streaming server * Change the wording of filter action labels * Fix issues pointed out by linter * Change design of “Show anyway” link in accordence to review comments * Drop “irreversible” filtering behavior * Move /api/v2/filter_keywords to /api/v1/filters/keywords * Rename `filter_results` attribute to `filtered` * Rename REST::LegacyFilterSerializer to REST::V1::FilterSerializer * Fix systemChannelId value in streaming server * Simplify code by removing client-side filtering code The simplifcation comes at a cost though: filters aren't retroactively applied anymore.
2 years ago
Account domain blocks (#2381) * Add <ostatus:conversation /> tag to Atom input/output Only uses ref attribute (not href) because href would be the alternate link that's always included also. Creates new conversation for every non-reply status. Carries over conversation for every reply. Keeps remote URIs verbatim, generates local URIs on the fly like the rest of them. * Conversation muting - prevents notifications that reference a conversation (including replies, favourites, reblogs) from being created. API endpoints /api/v1/statuses/:id/mute and /api/v1/statuses/:id/unmute Currently no way to tell when a status/conversation is muted, so the web UI only has a "disable notifications" button, doesn't work as a toggle * Display "Dismiss notifications" on all statuses in notifications column, not just own * Add "muted" as a boolean attribute on statuses JSON For now always false on contained reblogs, since it's only relevant for statuses returned from the notifications endpoint, which are not nested Remove "Disable notifications" from detailed status view, since it's only relevant in the notifications column * Up max class length * Remove pending test for conversation mute * Add tests, clean up * Rename to "mute conversation" and "unmute conversation" * Raise validation error when trying to mute/unmute status without conversation * Adding account domain blocks that filter notifications and public timelines * Add tests for domain blocks in notifications, public timelines Filter reblogs of blocked domains from home * Add API for listing and creating account domain blocks * API for creating/deleting domain blocks, tests for Status#ancestors and Status#descendants, filter domain blocks from them * Filter domains in streaming API * Update account_domain_block_spec.rb
7 years ago
Revamp post filtering system (#18058) * Add model for custom filter keywords * Use CustomFilterKeyword internally Does not change the API * Fix /filters/edit and /filters/new * Add migration tests * Remove whole_word column from custom_filters (covered by custom_filter_keywords) * Redesign /filters Instead of a list, present a card that displays more information and handles multiple keywords per filter. * Redesign /filters/new and /filters/edit to add and remove keywords This adds a new gem dependency: cocoon, as well as a npm dependency: cocoon-js-vanilla. Those are used to easily populate and remove form fields from the user interface when manipulating multiple keyword filters at once. * Add /api/v2/filters to edit filter with multiple keywords Entities: - `Filter`: `id`, `title`, `filter_action` (either `hide` or `warn`), `context` `keywords` - `FilterKeyword`: `id`, `keyword`, `whole_word` API endpoits: - `GET /api/v2/filters` to list filters (including keywords) - `POST /api/v2/filters` to create a new filter `keywords_attributes` can also be passed to create keywords in one request - `GET /api/v2/filters/:id` to read a particular filter - `PUT /api/v2/filters/:id` to update a new filter `keywords_attributes` can also be passed to edit, delete or add keywords in one request - `DELETE /api/v2/filters/:id` to delete a particular filter - `GET /api/v2/filters/:id/keywords` to list keywords for a filter - `POST /api/v2/filters/:filter_id/keywords/:id` to add a new keyword to a filter - `GET /api/v2/filter_keywords/:id` to read a particular keyword - `PUT /api/v2/filter_keywords/:id` to edit a particular keyword - `DELETE /api/v2/filter_keywords/:id` to delete a particular keyword * Change from `irreversible` boolean to `action` enum * Remove irrelevent `irreversible_must_be_within_context` check * Fix /filters/new and /filters/edit with update for filter_action * Fix Rubocop/Codeclimate complaining about task names * Refactor FeedManager#phrase_filtered? This moves regexp building and filter caching to the `CustomFilter` class. This does not change the functional behavior yet, but this changes how the cache is built, doing per-custom_filter regexps so that filters can be matched independently, while still offering caching. * Perform server-side filtering and output result in REST API * Fix numerous filters_changed events being sent when editing multiple keywords at once * Add some tests * Use the new API in the WebUI - use client-side logic for filters we have fetched rules for. This is so that filter changes can be retroactively applied without reloading the UI. - use server-side logic for filters we haven't fetched rules for yet (e.g. network error, or initial timeline loading) * Minor optimizations and refactoring * Perform server-side filtering on the streaming server * Change the wording of filter action labels * Fix issues pointed out by linter * Change design of “Show anyway” link in accordence to review comments * Drop “irreversible” filtering behavior * Move /api/v2/filter_keywords to /api/v1/filters/keywords * Rename `filter_results` attribute to `filtered` * Rename REST::LegacyFilterSerializer to REST::V1::FilterSerializer * Fix systemChannelId value in streaming server * Simplify code by removing client-side filtering code The simplifcation comes at a cost though: filters aren't retroactively applied anymore.
2 years ago
Web Push Notifications (#3243) * feat: Register push subscription * feat: Notify when mentioned * feat: Boost, favourite, reply, follow, follow request * feat: Notification interaction * feat: Handle change of public key * feat: Unsubscribe if things go wrong * feat: Do not send normal notifications if push is enabled * feat: Focus client if open * refactor: Move push logic to WebPushSubscription * feat: Better title and body * feat: Localize messages * chore: Fix lint errors * feat: Settings * refactor: Lazy load * fix: Check if push settings exist * feat: Device-based preferences * refactor: Simplify logic * refactor: Pull request feedback * refactor: Pull request feedback * refactor: Create /api/web/push_subscriptions endpoint * feat: Spec PushSubscriptionController * refactor: WebPushSubscription => Web::PushSubscription * feat: Spec Web::PushSubscription * feat: Display first media attachment * feat: Support direction * fix: Stuff broken while rebasing * refactor: Integration with session activations * refactor: Cleanup * refactor: Simplify implementation * feat: Set VAPID keys via environment * chore: Comments * fix: Crash when no alerts * fix: Set VAPID keys in testing environment * fix: Follow link * feat: Notification actions * fix: Delete previous subscription * chore: Temporary logs * refactor: Move migration to a later date * fix: Fetch the correct session activation and misc bugs * refactor: Move migration to a later date * fix: Remove follow request (no notifications) * feat: Send administrator contact to push service * feat: Set time-to-live * fix: Do not show sensitive images * fix: Reducer crash in error handling * feat: Add badge * chore: Fix lint error * fix: Checkbox label overlap * fix: Check for payload support * fix: Rename action "type" (crash in latest Chrome) * feat: Action to expand notification * fix: Lint errors * fix: Unescape notification body * fix: Do not allow boosting if the status is hidden * feat: Add VAPID keys to the production sample environment * fix: Strip HTML tags from status * refactor: Better error messages * refactor: Handle browser not implementing the VAPID protocol (Samsung Internet) * fix: Error when target_status is nil * fix: Handle lack of image * fix: Delete reference to invalid subscriptions * feat: Better error handling * fix: Unescape HTML characters after tags are striped * refactor: Simpify code * fix: Modify to work with #4091 * Sort strings alphabetically * i18n: Updated Polish translation it annoys me that it's not fully localized :P * refactor: Use current_session in PushSubscriptionController * fix: Rebase mistake * fix: Set cacheName to mastodon * refactor: Pull request feedback * refactor: Remove logging statements * chore(yarn): Fix conflicts with master * chore(yarn): Copy latest from master * chore(yarn): Readd offline-plugin * refactor: Use save! and update! * refactor: Send notifications async * fix: Allow retry when push fails * fix: Save track for failed pushes * fix: Minify sw.js * fix: Remove account_id from fabricator
7 years ago
8 years ago
  1. # frozen_string_literal: true
  2. require 'sidekiq_unique_jobs/web'
  3. require 'sidekiq-scheduler/web'
  4. Rails.application.routes.draw do
  5. root 'home#index'
  6. mount LetterOpenerWeb::Engine, at: 'letter_opener' if Rails.env.development?
  7. get 'health', to: 'health#show'
  8. authenticate :user, lambda { |u| u.role&.can?(:view_devops) } do
  9. mount Sidekiq::Web, at: 'sidekiq', as: :sidekiq
  10. mount PgHero::Engine, at: 'pghero', as: :pghero
  11. end
  12. use_doorkeeper do
  13. controllers authorizations: 'oauth/authorizations',
  14. authorized_applications: 'oauth/authorized_applications',
  15. tokens: 'oauth/tokens'
  16. end
  17. get '.well-known/host-meta', to: 'well_known/host_meta#show', as: :host_meta, defaults: { format: 'xml' }
  18. get '.well-known/nodeinfo', to: 'well_known/nodeinfo#index', as: :nodeinfo, defaults: { format: 'json' }
  19. get '.well-known/webfinger', to: 'well_known/webfinger#show', as: :webfinger
  20. get '.well-known/change-password', to: redirect('/auth/edit')
  21. get '/nodeinfo/2.0', to: 'well_known/nodeinfo#show', as: :nodeinfo_schema
  22. get 'manifest', to: 'manifests#show', defaults: { format: 'json' }
  23. get 'intent', to: 'intents#show'
  24. get 'custom.css', to: 'custom_css#show', as: :custom_css
  25. resource :instance_actor, path: 'actor', only: [:show] do
  26. resource :inbox, only: [:create], module: :activitypub
  27. resource :outbox, only: [:show], module: :activitypub
  28. end
  29. devise_scope :user do
  30. get '/invite/:invite_code', to: 'auth/registrations#new', as: :public_invite
  31. namespace :auth do
  32. resource :setup, only: [:show, :update], controller: :setup
  33. resource :challenge, only: [:create], controller: :challenges
  34. get 'sessions/security_key_options', to: 'sessions#webauthn_options'
  35. end
  36. end
  37. devise_for :users, path: 'auth', controllers: {
  38. omniauth_callbacks: 'auth/omniauth_callbacks',
  39. sessions: 'auth/sessions',
  40. registrations: 'auth/registrations',
  41. passwords: 'auth/passwords',
  42. confirmations: 'auth/confirmations',
  43. }
  44. get '/users/:username', to: redirect('/@%{username}'), constraints: lambda { |req| req.format.nil? || req.format.html? }
  45. get '/authorize_follow', to: redirect { |_, request| "/authorize_interaction?#{request.params.to_query}" }
  46. resources :accounts, path: 'users', only: [:show], param: :username do
  47. get :remote_follow, to: 'remote_follow#new'
  48. post :remote_follow, to: 'remote_follow#create'
  49. resources :statuses, only: [:show] do
  50. member do
  51. get :activity
  52. get :embed
  53. end
  54. resources :replies, only: [:index], module: :activitypub
  55. end
  56. resources :followers, only: [:index], controller: :follower_accounts
  57. resources :following, only: [:index], controller: :following_accounts
  58. resource :follow, only: [:create], controller: :account_follow
  59. resource :unfollow, only: [:create], controller: :account_unfollow
  60. resource :outbox, only: [:show], module: :activitypub
  61. resource :inbox, only: [:create], module: :activitypub
  62. resource :claim, only: [:create], module: :activitypub
  63. resources :collections, only: [:show], module: :activitypub
  64. resource :followers_synchronization, only: [:show], module: :activitypub
  65. end
  66. resource :inbox, only: [:create], module: :activitypub
  67. get '/@:username', to: 'accounts#show', as: :short_account
  68. get '/@:username/with_replies', to: 'accounts#show', as: :short_account_with_replies
  69. get '/@:username/media', to: 'accounts#show', as: :short_account_media
  70. get '/@:username/tagged/:tag', to: 'accounts#show', as: :short_account_tag
  71. get '/@:account_username/:id', to: 'statuses#show', as: :short_account_status
  72. get '/@:account_username/:id/embed', to: 'statuses#embed', as: :embed_short_account_status
  73. get '/interact/:id', to: 'remote_interaction#new', as: :remote_interaction
  74. post '/interact/:id', to: 'remote_interaction#create'
  75. get '/explore', to: 'directories#index', as: :explore
  76. get '/settings', to: redirect('/settings/profile')
  77. namespace :settings do
  78. resource :profile, only: [:show, :update] do
  79. resources :pictures, only: :destroy
  80. end
  81. get :preferences, to: redirect('/settings/preferences/appearance')
  82. namespace :preferences do
  83. resource :appearance, only: [:show, :update], controller: :appearance
  84. resource :notifications, only: [:show, :update]
  85. resource :other, only: [:show, :update], controller: :other
  86. end
  87. resource :import, only: [:show, :create]
  88. resource :export, only: [:show, :create]
  89. namespace :exports, constraints: { format: :csv } do
  90. resources :follows, only: :index, controller: :following_accounts
  91. resources :blocks, only: :index, controller: :blocked_accounts
  92. resources :mutes, only: :index, controller: :muted_accounts
  93. resources :lists, only: :index, controller: :lists
  94. resources :domain_blocks, only: :index, controller: :blocked_domains
  95. resources :bookmarks, only: :index, controller: :bookmarks
  96. end
  97. resources :two_factor_authentication_methods, only: [:index] do
  98. collection do
  99. post :disable
  100. end
  101. end
  102. resource :otp_authentication, only: [:show, :create], controller: 'two_factor_authentication/otp_authentication'
  103. resources :webauthn_credentials, only: [:index, :new, :create, :destroy],
  104. path: 'security_keys',
  105. controller: 'two_factor_authentication/webauthn_credentials' do
  106. collection do
  107. get :options
  108. end
  109. end
  110. namespace :two_factor_authentication do
  111. resources :recovery_codes, only: [:create]
  112. resource :confirmation, only: [:new, :create]
  113. end
  114. resources :applications, except: [:edit] do
  115. member do
  116. post :regenerate
  117. end
  118. end
  119. resource :delete, only: [:show, :destroy]
  120. resource :migration, only: [:show, :create]
  121. namespace :migration do
  122. resource :redirect, only: [:new, :create, :destroy]
  123. end
  124. resources :aliases, only: [:index, :create, :destroy]
  125. resources :sessions, only: [:destroy]
  126. resources :featured_tags, only: [:index, :create, :destroy]
  127. resources :login_activities, only: [:index]
  128. end
  129. namespace :disputes do
  130. resources :strikes, only: [:show, :index] do
  131. resource :appeal, only: [:create]
  132. end
  133. end
  134. resources :media, only: [:show] do
  135. get :player
  136. end
  137. resources :tags, only: [:show]
  138. resources :emojis, only: [:show]
  139. resources :invites, only: [:index, :create, :destroy]
  140. resources :filters, except: [:show] do
  141. resources :statuses, only: [:index], controller: 'filters/statuses' do
  142. collection do
  143. post :batch
  144. end
  145. end
  146. end
  147. resource :relationships, only: [:show, :update]
  148. resource :statuses_cleanup, controller: :statuses_cleanup, only: [:show, :update]
  149. get '/public', to: 'public_timelines#show', as: :public_timeline
  150. get '/media_proxy/:id/(*any)', to: 'media_proxy#show', as: :media_proxy
  151. resource :authorize_interaction, only: [:show, :create]
  152. resource :share, only: [:show, :create]
  153. namespace :admin do
  154. get '/dashboard', to: 'dashboard#index'
  155. resources :domain_allows, only: [:new, :create, :show, :destroy]
  156. resources :domain_blocks, only: [:new, :create, :destroy, :update, :edit]
  157. resources :email_domain_blocks, only: [:index, :new, :create] do
  158. collection do
  159. post :batch
  160. end
  161. end
  162. resources :action_logs, only: [:index]
  163. resources :warning_presets, except: [:new]
  164. resources :announcements, except: [:show] do
  165. member do
  166. post :publish
  167. post :unpublish
  168. end
  169. end
  170. resource :settings, only: [:edit, :update]
  171. resources :site_uploads, only: [:destroy]
  172. resources :invites, only: [:index, :create, :destroy] do
  173. collection do
  174. post :deactivate_all
  175. end
  176. end
  177. resources :relays, only: [:index, :new, :create, :destroy] do
  178. member do
  179. post :enable
  180. post :disable
  181. end
  182. end
  183. resources :instances, only: [:index, :show, :destroy], constraints: { id: /[^\/]+/ } do
  184. member do
  185. post :clear_delivery_errors
  186. post :restart_delivery
  187. post :stop_delivery
  188. end
  189. end
  190. resources :rules
  191. resources :webhooks do
  192. member do
  193. post :enable
  194. post :disable
  195. end
  196. resource :secret, only: [], controller: 'webhooks/secrets' do
  197. post :rotate
  198. end
  199. end
  200. resources :reports, only: [:index, :show] do
  201. resources :actions, only: [:create], controller: 'reports/actions'
  202. member do
  203. post :assign_to_self
  204. post :unassign
  205. post :reopen
  206. post :resolve
  207. end
  208. end
  209. resources :report_notes, only: [:create, :destroy]
  210. resources :accounts, only: [:index, :show, :destroy] do
  211. member do
  212. post :enable
  213. post :unsensitive
  214. post :unsilence
  215. post :unsuspend
  216. post :redownload
  217. post :remove_avatar
  218. post :remove_header
  219. post :memorialize
  220. post :approve
  221. post :reject
  222. post :unblock_email
  223. end
  224. collection do
  225. post :batch
  226. end
  227. resource :change_email, only: [:show, :update]
  228. resource :reset, only: [:create]
  229. resource :action, only: [:new, :create], controller: 'account_actions'
  230. resources :statuses, only: [:index] do
  231. collection do
  232. post :batch
  233. end
  234. end
  235. resources :relationships, only: [:index]
  236. resource :confirmation, only: [:create] do
  237. collection do
  238. post :resend
  239. end
  240. end
  241. end
  242. resources :users, only: [] do
  243. resource :two_factor_authentication, only: [:destroy], controller: 'users/two_factor_authentications'
  244. resource :role, only: [:show, :update], controller: 'users/roles'
  245. end
  246. resources :custom_emojis, only: [:index, :new, :create] do
  247. collection do
  248. post :batch
  249. end
  250. end
  251. resources :ip_blocks, only: [:index, :new, :create] do
  252. collection do
  253. post :batch
  254. end
  255. end
  256. resources :roles, except: [:show]
  257. resources :account_moderation_notes, only: [:create, :destroy]
  258. resource :follow_recommendations, only: [:show, :update]
  259. resources :tags, only: [:show, :update]
  260. namespace :trends do
  261. resources :links, only: [:index] do
  262. collection do
  263. post :batch
  264. end
  265. end
  266. resources :tags, only: [:index] do
  267. collection do
  268. post :batch
  269. end
  270. end
  271. resources :statuses, only: [:index] do
  272. collection do
  273. post :batch
  274. end
  275. end
  276. namespace :links do
  277. resources :preview_card_providers, only: [:index], path: :publishers do
  278. collection do
  279. post :batch
  280. end
  281. end
  282. end
  283. end
  284. namespace :disputes do
  285. resources :appeals, only: [:index] do
  286. member do
  287. post :approve
  288. post :reject
  289. end
  290. end
  291. end
  292. end
  293. get '/admin', to: redirect('/admin/dashboard', status: 302)
  294. namespace :api do
  295. # OEmbed
  296. get '/oembed', to: 'oembed#show', as: :oembed
  297. # JSON / REST API
  298. namespace :v1 do
  299. resources :statuses, only: [:create, :show, :update, :destroy] do
  300. scope module: :statuses do
  301. resources :reblogged_by, controller: :reblogged_by_accounts, only: :index
  302. resources :favourited_by, controller: :favourited_by_accounts, only: :index
  303. resource :reblog, only: :create
  304. post :unreblog, to: 'reblogs#destroy'
  305. resource :favourite, only: :create
  306. post :unfavourite, to: 'favourites#destroy'
  307. resource :bookmark, only: :create
  308. post :unbookmark, to: 'bookmarks#destroy'
  309. resource :mute, only: :create
  310. post :unmute, to: 'mutes#destroy'
  311. resource :pin, only: :create
  312. post :unpin, to: 'pins#destroy'
  313. resource :history, only: :show
  314. resource :source, only: :show
  315. end
  316. member do
  317. get :context
  318. end
  319. end
  320. namespace :timelines do
  321. resource :home, only: :show, controller: :home
  322. resource :public, only: :show, controller: :public
  323. resources :tag, only: :show
  324. resources :list, only: :show
  325. end
  326. resources :streaming, only: [:index]
  327. resources :custom_emojis, only: [:index]
  328. resources :suggestions, only: [:index, :destroy]
  329. resources :scheduled_statuses, only: [:index, :show, :update, :destroy]
  330. resources :preferences, only: [:index]
  331. resources :announcements, only: [:index] do
  332. scope module: :announcements do
  333. resources :reactions, only: [:update, :destroy]
  334. end
  335. member do
  336. post :dismiss
  337. end
  338. end
  339. # namespace :crypto do
  340. # resources :deliveries, only: :create
  341. # namespace :keys do
  342. # resource :upload, only: [:create]
  343. # resource :query, only: [:create]
  344. # resource :claim, only: [:create]
  345. # resource :count, only: [:show]
  346. # end
  347. # resources :encrypted_messages, only: [:index] do
  348. # collection do
  349. # post :clear
  350. # end
  351. # end
  352. # end
  353. resources :conversations, only: [:index, :destroy] do
  354. member do
  355. post :read
  356. end
  357. end
  358. resources :media, only: [:create, :update, :show]
  359. resources :blocks, only: [:index]
  360. resources :mutes, only: [:index]
  361. resources :favourites, only: [:index]
  362. resources :bookmarks, only: [:index]
  363. resources :reports, only: [:create]
  364. resources :trends, only: [:index], controller: 'trends/tags'
  365. resources :filters, only: [:index, :create, :show, :update, :destroy] do
  366. resources :keywords, only: [:index, :create], controller: 'filters/keywords'
  367. resources :statuses, only: [:index, :create], controller: 'filters/statuses'
  368. end
  369. resources :endorsements, only: [:index]
  370. resources :markers, only: [:index, :create]
  371. namespace :filters do
  372. resources :keywords, only: [:show, :update, :destroy]
  373. resources :statuses, only: [:show, :destroy]
  374. end
  375. namespace :apps do
  376. get :verify_credentials, to: 'credentials#show'
  377. end
  378. resources :apps, only: [:create]
  379. namespace :trends do
  380. resources :links, only: [:index]
  381. resources :tags, only: [:index]
  382. resources :statuses, only: [:index]
  383. end
  384. namespace :emails do
  385. resources :confirmations, only: [:create]
  386. end
  387. resource :instance, only: [:show] do
  388. resources :peers, only: [:index], controller: 'instances/peers'
  389. resource :activity, only: [:show], controller: 'instances/activity'
  390. resources :rules, only: [:index], controller: 'instances/rules'
  391. end
  392. resource :domain_blocks, only: [:show, :create, :destroy]
  393. resource :directory, only: [:show]
  394. resources :follow_requests, only: [:index] do
  395. member do
  396. post :authorize
  397. post :reject
  398. end
  399. end
  400. resources :notifications, only: [:index, :show] do
  401. collection do
  402. post :clear
  403. end
  404. member do
  405. post :dismiss
  406. end
  407. end
  408. namespace :accounts do
  409. get :verify_credentials, to: 'credentials#show'
  410. patch :update_credentials, to: 'credentials#update'
  411. resource :search, only: :show, controller: :search
  412. resource :lookup, only: :show, controller: :lookup
  413. resources :relationships, only: :index
  414. resources :familiar_followers, only: :index
  415. end
  416. resources :accounts, only: [:create, :show] do
  417. resources :statuses, only: :index, controller: 'accounts/statuses'
  418. resources :followers, only: :index, controller: 'accounts/follower_accounts'
  419. resources :following, only: :index, controller: 'accounts/following_accounts'
  420. resources :lists, only: :index, controller: 'accounts/lists'
  421. resources :identity_proofs, only: :index, controller: 'accounts/identity_proofs'
  422. resources :featured_tags, only: :index, controller: 'accounts/featured_tags'
  423. member do
  424. post :follow
  425. post :unfollow
  426. post :remove_from_followers
  427. post :block
  428. post :unblock
  429. post :mute
  430. post :unmute
  431. end
  432. resource :pin, only: :create, controller: 'accounts/pins'
  433. post :unpin, to: 'accounts/pins#destroy'
  434. resource :note, only: :create, controller: 'accounts/notes'
  435. end
  436. resources :tags, only: [:show] do
  437. member do
  438. post :follow
  439. post :unfollow
  440. end
  441. end
  442. resources :followed_tags, only: [:index]
  443. resources :lists, only: [:index, :create, :show, :update, :destroy] do
  444. resource :accounts, only: [:show, :create, :destroy], controller: 'lists/accounts'
  445. end
  446. namespace :featured_tags do
  447. get :suggestions, to: 'suggestions#index'
  448. end
  449. resources :featured_tags, only: [:index, :create, :destroy]
  450. resources :polls, only: [:create, :show] do
  451. resources :votes, only: :create, controller: 'polls/votes'
  452. end
  453. namespace :push do
  454. resource :subscription, only: [:create, :show, :update, :destroy]
  455. end
  456. namespace :admin do
  457. resources :accounts, only: [:index, :show, :destroy] do
  458. member do
  459. post :enable
  460. post :unsensitive
  461. post :unsilence
  462. post :unsuspend
  463. post :approve
  464. post :reject
  465. end
  466. resource :action, only: [:create], controller: 'account_actions'
  467. end
  468. resources :reports, only: [:index, :update, :show] do
  469. member do
  470. post :assign_to_self
  471. post :unassign
  472. post :reopen
  473. post :resolve
  474. end
  475. end
  476. resources :domain_allows, only: [:index, :show, :create, :destroy]
  477. resources :domain_blocks, only: [:index, :show, :update, :create, :destroy]
  478. namespace :trends do
  479. resources :tags, only: [:index]
  480. resources :links, only: [:index]
  481. resources :statuses, only: [:index]
  482. end
  483. post :measures, to: 'measures#create'
  484. post :dimensions, to: 'dimensions#create'
  485. post :retention, to: 'retention#create'
  486. end
  487. end
  488. namespace :v2 do
  489. resources :media, only: [:create]
  490. get '/search', to: 'search#index', as: :search
  491. resources :suggestions, only: [:index]
  492. resources :filters, only: [:index, :create, :show, :update, :destroy]
  493. namespace :admin do
  494. resources :accounts, only: [:index]
  495. end
  496. end
  497. namespace :web do
  498. resource :settings, only: [:update]
  499. resource :embed, only: [:create]
  500. resources :push_subscriptions, only: [:create] do
  501. member do
  502. put :update
  503. end
  504. end
  505. end
  506. end
  507. get '/web/(*any)', to: 'home#index', as: :web
  508. get '/about', to: 'about#show'
  509. get '/about/more', to: 'about#more'
  510. get '/terms', to: 'about#terms'
  511. match '/', via: [:post, :put, :patch, :delete], to: 'application#raise_not_found', format: false
  512. match '*unmatched_route', via: :all, to: 'application#raise_not_found', format: false
  513. end