T6: the Mastodon API over HTTP

88 integration tests drive the Mastodon client API through the whole server
(PrivaPubHost), with remote actors on an in-process Peer and deliveries read
from the job queue. Helpers live in Support/Host/MastodonHelpers.cs.

Coverage:
- Accounts: verify_credentials (no root id or login name); update_credentials
  with indexed and array fields_attributes (form and JSON), source[*],
  quote_policy, locked/bot, avatar and header uploads resized and stripped of
  EXIF and XMP; lookup (local, @domain, remote; a circle, the instance actor
  and a circle's id answer 404); search with and without resolve (only a
  signed-in persona resolves, the Peer is untouched otherwise), by post and
  actor address, hashtags, undiscoverable personas; account statuses with
  pinned, exclude_replies, exclude_reblogs, only_media, tagged and Link paging
  both ways; followers-only posts for followers (local and remote authors);
  community accounts; followers/following only to their owner; follow (open,
  locked, remote Follow delivery), unfollow and Undo; follow requests from
  local and remote followers answered with the original Follow;
  remove_from_followers; blocks with Reject and Block/Undo deliveries; mutes
  with duration and the notifications choice, never federated; domain blocks;
  relationships with junk ids; a banned login's tokens; reports forwarded as a
  Flag from the instance actor only; account stub routes.
- Statuses: each visibility's to/cc as delivered; CW as summary; replies to
  local and remote posts (mention, inReplyTo, the author's inbox); polls and
  votes (local, and remote votes only to the author without published); media
  attached only by its owner; quotes, the quotes list and revocation; edit
  history, source and the Update delivery; delete for redraft, the 410
  Tombstone and the Delete delivery; favourite/reblog counts with Like,
  Announce and their Undos; favourited_by, reblogged_by; bookmarks; pins;
  interaction_policy matching canQuote in the note and in the Update;
  strangers get 404 for followers-only and direct posts; a located post is
  unreachable by id for anyone else on every route; statuses?id[];
  Idempotency-Key; scopes; deleting a reblog.
- Timelines: home paging with max_id, since_id and min_id; public local and
  remote; tag (anonymous); list stub; favourites; conversations and read;
  markers; notifications with types[], exclude_types[], account_id, paging,
  get, dismiss, clear and unread_count.
- Instance: v1 and v2 (4.2.0 (compatible; PrivaPub)), peers, activity, rules,
  extended_description, apps and every stub route.
- Media: v1 and v2 uploads, owner-only GET and PUT, 422 for unsupported or
  unreadable files, video and audio made with ffmpeg lavfi sources and checked
  with ffprobe; every remote media address goes through the proxy; the proxy
  refuses unsigned URLs, streams ranges as 206 without caching, caches whole
  downloads and serves them with ranges, and streams anything over
  Media:MaxProxiedBytes (a SmallProxyHost) without caching.
- Provenance of local, delivered (signature) and fetched (instance actor,
  no signature, the trigger as activity) posts, visibility of provenance,
  instance descriptions; reading any of them makes no outbound request.
  Pleroma reactions with EmojiReact and Undo deliveries, and local reaction
  notifications.

Bugs fixed:
- remove_from_followers deleted the Follower row but never told a remote
  follower. It now sends Reject{Follow} with the stored Follow id, through
  RelationshipService.RemoveFollower, which Block now shares.
- VisibilityPolicy.CanSee refused followers-only posts to accepted followers,
  so a post in their home timeline answered 404 to GET, context, favourite and
  reply. Followers of the author (local or remote) may now see them.
- Account statuses of a remote account hid followers-only posts from
  personas that follow it.
- exclude_replies dropped the author's own threads; like Mastodon it now
  drops only replies to other accounts.
- A community account's statuses were always empty: they are now the posts
  addressed to the community.
- Pinning someone else's visible post answered 404; it answers 422 like
  Mastodon.
- GET /api/v1/notifications/:id answered 200 with null when the notification's
  post was gone; it answers 404.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

PrivaPub/Api/Mastodon/Controllers/AccountsController.cs

@@ -159,11 +159,14 @@ namespace PrivaPub.Api.Mastodon.Controllers
 				return Json(await _mapper.Statuses(pinIds.Select(id => pinnedPosts.FirstOrDefault(p => p.ID == id)).Where(p => p != default).ToList(), MyId, token));
 			}
 
-			var query = local != default
+			var query = local is { Kind: LocalActorKind.Group }
+				? _dbEntities.Posts.Match(p => p.GroupId == local.Id).Match(VisibilityPolicy.IsShown)
+				: local != default
 				? _dbEntities.Posts.Match(p => p.GroupUserId == local.Id && !p.IsFederatedCopy).Match(VisibilityPolicy.IsShown)
 				: _dbEntities.Posts.Match(p => p.ActorURI == remote.ActorURI && p.IsFederatedCopy).Match(VisibilityPolicy.IsShown);
-			var viewerFollows = MyId != default && local != default
-				&& await _dbEntities.Followings.Match(f => f.AvatarId == MyId && f.TargetAccountId == local.Id && f.State == FollowState.Accepted).ExecuteAnyAsync(token);
+			var viewerFollows = MyId != default && (local != default
+				? await _dbEntities.Followings.Match(f => f.AvatarId == MyId && f.TargetAccountId == local.Id && f.State == FollowState.Accepted).ExecuteAnyAsync(token)
+				: await _dbEntities.Followings.Match(f => f.AvatarId == MyId && f.TargetActorURI == remote.ActorURI && f.State == FollowState.Accepted).ExecuteAnyAsync(token));
 			if (MyId != id)
 				query.Match(viewerFollows
 					? p => p.Visibility == PostVisibility.Public || p.Visibility == PostVisibility.Unlisted || p.Visibility == PostVisibility.FollowersOnly
@@ -171,7 +174,10 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			else
 				query.Match(p => p.Visibility != PostVisibility.LocalGeo);
 			if (Params.Bool("exclude_replies") == true)
-				query.Match(p => p.InReplyToURI == null);
+			{
+				var self = local?.Id ?? remote.ID;
+				query.Match(p => p.InReplyToURI == null || p.InReplyToAccountId == self);
+			}
 			if (Params.Bool("exclude_reblogs") == true)
 				query.Match(p => p.ReblogOfPostId == null);
 			if (Params.Bool("only_media") == true)
@@ -235,9 +241,7 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			var uri = local?.Uri ?? remote?.ActorURI;
 			if (uri == default)
 				return NotFoundError();
-			await DB.Default.DeleteAsync<Follower>(f => f.LocalActorId == Me.Id && f.ActorURI == uri);
-			if (local != default)
-				await DB.Default.DeleteAsync<Following>(f => f.AvatarId == local.Id && f.TargetActorURI == Me.Uri);
+			await _relationships.RemoveFollower(Me, uri, id, token);
 			return Json(await Relationship(id, token));
 		}
 

PrivaPub/Api/Mastodon/Controllers/StatusesController.cs

@@ -326,7 +326,11 @@ namespace PrivaPub.Api.Mastodon.Controllers
 			var post = await _dbEntities.Posts.Match(p => p.ID == id && p.GroupUserId == MyId && !p.IsFederatedCopy && !p.DeletedAt.HasValue && p.ReblogOfPostId == null)
 				.ExecuteFirstAsync(token);
 			if (post == default)
-				return NotFoundError();
+				return await Visible(id, token) is { } other
+					? Error(StatusCodes.Status422UnprocessableEntity, other.ReblogOfPostId == null
+						? "Validation failed: Someone else's post cannot be pinned"
+						: "Validation failed: A boost cannot be pinned")
+					: NotFoundError();
 			if (post.Visibility is not (PostVisibility.Public or PostVisibility.Unlisted))
 				return Error(StatusCodes.Status422UnprocessableEntity, "Validation failed: Only public posts can be pinned");
 			if (await DB.Default.CountAsync<Models.Social.Pin>(p => p.AvatarId == MyId, token) >= MaxPins)

PrivaPub/Api/Mastodon/Controllers/TimelinesController.cs

@@ -198,7 +198,8 @@ namespace PrivaPub.Api.Mastodon.Controllers
 		public async Task<IActionResult> Get(string id, CancellationToken token)
 		{
 			var notification = await _dbEntities.Notifications.Match(n => n.ID == id && n.AvatarId == MyId).ExecuteFirstAsync(token);
-			return notification == default ? NotFoundError() : Json((await Map(new List<NotificationEntity> { notification }, token)).FirstOrDefault());
+			var mapped = notification == default ? default : (await Map(new List<NotificationEntity> { notification }, token)).FirstOrDefault();
+			return mapped == default ? NotFoundError() : Json(mapped);
 		}
 
 		[HttpPost("/api/v1/notifications/clear"), Scope("write:notifications")]

PrivaPub/Domain/Privacy/VisibilityPolicy.cs

@@ -2,6 +2,7 @@ using MongoDB.Entities;
 
 using PrivaPub.Models.Group;
 using PrivaPub.Models.Post;
+using PrivaPub.Models.Social;
 
 using System.Linq.Expressions;
 
@@ -41,8 +42,20 @@ namespace PrivaPub.Domain.Privacy
 				PostVisibility.Circle => !string.IsNullOrEmpty(post.GroupId) && await DB.Default.Find<GroupEntity>()
 					.Match(g => g.ID == post.GroupId && g.Members.Any(m => !m.IsForeign && m.AvatarId == viewerAvatarId))
 					.ExecuteAnyAsync(token),
+				PostVisibility.FollowersOnly => await FollowsAuthor(viewerAvatarId, post, token),
 				_ => false
 			};
 		}
+
+		static async Task<bool> FollowsAuthor(string viewerAvatarId, Post post, CancellationToken token)
+		{
+			if (!string.IsNullOrEmpty(post.ActorURI))
+				return await DB.Default.Find<Following>()
+					.Match(f => f.AvatarId == viewerAvatarId && f.TargetActorURI == post.ActorURI && f.State == FollowState.Accepted)
+					.ExecuteAnyAsync(token);
+			return !post.IsFederatedCopy && !string.IsNullOrEmpty(post.GroupUserId) && await DB.Default.Find<Following>()
+				.Match(f => f.AvatarId == viewerAvatarId && f.TargetIsLocal && f.TargetAccountId == post.GroupUserId && f.State == FollowState.Accepted)
+				.ExecuteAnyAsync(token);
+		}
 	}
 }

PrivaPub/Domain/Relationships/RelationshipService.cs

@@ -17,6 +17,7 @@ namespace PrivaPub.Domain.Relationships
 	{
 		Task Block(LocalActor me, string targetActorUri, string targetAccountId, CancellationToken token);
 		Task Unblock(LocalActor me, string targetActorUri, CancellationToken token);
+		Task RemoveFollower(LocalActor me, string followerActorUri, string followerAccountId, CancellationToken token);
 		Task Mute(LocalActor me, string targetActorUri, string targetAccountId, bool hideNotifications, TimeSpan? duration, CancellationToken token);
 		Task Unmute(LocalActor me, string targetActorUri, CancellationToken token);
 		Task BlockDomain(LocalActor me, string domain, CancellationToken token);
@@ -49,30 +50,34 @@ namespace PrivaPub.Domain.Relationships
 			}
 
 			await _follows.UnfollowAs(me, targetActorUri, token);
-			var follower = await _dbEntities.Followers.Match(f => f.LocalActorId == me.Id && f.ActorURI == targetActorUri).ExecuteFirstAsync(token);
-			if (follower != default)
-			{
-				await DB.Default.DeleteAsync<Follower>(follower.ID);
-				if (!targetActorUri.StartsWith(me.BaseAddress + "/", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrEmpty(follower.FollowActivityURI))
-				{
-					var reject = new JsonObject
-					{
-						["@context"] = ActivityPubRenderer.ActivityStreams,
-						["id"] = me.ActivityUri($"reject-{follower.ID}-{DateTime.UtcNow.Ticks}"),
-						["type"] = "Reject",
-						["actor"] = me.Uri,
-						["object"] = new JsonObject { ["id"] = follower.FollowActivityURI, ["type"] = "Follow", ["actor"] = targetActorUri, ["object"] = me.Uri }
-					};
-					await _delivery.Enqueue(me, new[] { follower.InboxURL }, reject, token);
-				}
-				else
-					await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == me.Uri && f.AvatarId == targetAccountId);
-			}
+			await RemoveFollower(me, targetActorUri, targetAccountId, token);
 			await Forget(me, targetAccountId, token);
 			if (block != default)
 				await Tell(me, targetActorUri, BlockActivity(me, block), token);
 		}
 
+		public async Task RemoveFollower(LocalActor me, string followerActorUri, string followerAccountId, CancellationToken token)
+		{
+			var follower = await _dbEntities.Followers.Match(f => f.LocalActorId == me.Id && f.ActorURI == followerActorUri).ExecuteFirstAsync(token);
+			if (follower == default)
+				return;
+			await DB.Default.DeleteAsync<Follower>(follower.ID);
+			if (!followerActorUri.StartsWith(me.BaseAddress + "/", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrEmpty(follower.FollowActivityURI))
+			{
+				var reject = new JsonObject
+				{
+					["@context"] = ActivityPubRenderer.ActivityStreams,
+					["id"] = me.ActivityUri($"reject-{follower.ID}-{DateTime.UtcNow.Ticks}"),
+					["type"] = "Reject",
+					["actor"] = me.Uri,
+					["object"] = new JsonObject { ["id"] = follower.FollowActivityURI, ["type"] = "Follow", ["actor"] = followerActorUri, ["object"] = me.Uri }
+				};
+				await _delivery.Enqueue(me, new[] { follower.InboxURL }, reject, token);
+			}
+			else
+				await DB.Default.DeleteAsync<Following>(f => f.TargetActorURI == me.Uri && f.AvatarId == followerAccountId);
+		}
+
 		public async Task Unblock(LocalActor me, string targetActorUri, CancellationToken token)
 		{
 			var block = await DB.Default.Find<Block>().Match(b => b.AvatarId == me.Id && b.TargetActorURI == targetActorUri).ExecuteFirstAsync(token);