statuses_controller.rb 3.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586
  1. # frozen_string_literal: true
  2. class Api::V1::StatusesController < Api::BaseController
  3. include Authorization
  4. before_action -> { authorize_if_got_token! :read, :'read:statuses' }, except: [:create, :destroy]
  5. before_action -> { doorkeeper_authorize! :write, :'write:statuses' }, only: [:create, :destroy]
  6. before_action :require_user!, except: [:show, :context, :card]
  7. before_action :set_status, only: [:show, :context, :card]
  8. respond_to :json
  9. # This API was originally unlimited, pagination cannot be introduced without
  10. # breaking backwards-compatibility. Arbitrarily high number to cover most
  11. # conversations as quasi-unlimited, it would be too much work to render more
  12. # than this anyway
  13. CONTEXT_LIMIT = 4_096
  14. def show
  15. @status = cache_collection([@status], Status).first
  16. render json: @status, serializer: REST::StatusSerializer
  17. end
  18. def context
  19. ancestors_results = @status.in_reply_to_id.nil? ? [] : @status.ancestors(CONTEXT_LIMIT, current_account)
  20. descendants_results = @status.descendants(CONTEXT_LIMIT, current_account)
  21. loaded_ancestors = cache_collection(ancestors_results, Status)
  22. loaded_descendants = cache_collection(descendants_results, Status)
  23. @context = Context.new(ancestors: loaded_ancestors, descendants: loaded_descendants)
  24. statuses = [@status] + @context.ancestors + @context.descendants
  25. render json: @context, serializer: REST::ContextSerializer, relationships: StatusRelationshipsPresenter.new(statuses, current_user&.account_id)
  26. end
  27. def card
  28. @card = @status.preview_cards.first
  29. if @card.nil?
  30. render_empty
  31. else
  32. render json: @card, serializer: REST::PreviewCardSerializer
  33. end
  34. end
  35. def create
  36. @status = PostStatusService.new.call(current_user.account,
  37. status_params[:status],
  38. status_params[:in_reply_to_id].blank? ? nil : Status.find(status_params[:in_reply_to_id]),
  39. media_ids: status_params[:media_ids],
  40. sensitive: status_params[:sensitive],
  41. spoiler_text: status_params[:spoiler_text],
  42. visibility: status_params[:visibility],
  43. application: doorkeeper_token.application,
  44. idempotency: request.headers['Idempotency-Key'])
  45. render json: @status, serializer: REST::StatusSerializer
  46. end
  47. def destroy
  48. @status = Status.where(account_id: current_user.account).find(params[:id])
  49. authorize @status, :destroy?
  50. RemovalWorker.perform_async(@status.id)
  51. render_empty
  52. end
  53. private
  54. def set_status
  55. @status = Status.find(params[:id])
  56. authorize @status, :show?
  57. rescue Mastodon::NotPermittedError
  58. # Reraise in order to get a 404 instead of a 403 error code
  59. raise ActiveRecord::RecordNotFound
  60. end
  61. def status_params
  62. params.permit(:status, :in_reply_to_id, :sensitive, :spoiler_text, :visibility, media_ids: [])
  63. end
  64. def pagination_params(core_params)
  65. params.slice(:limit).permit(:limit).merge(core_params)
  66. end
  67. end