From dd7ef0dc41584089a97444d8192bc61505108e6c Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Tue, 8 Aug 2017 21:52:15 +0200
Subject: Add ActivityPub inbox (#4216)

* Add ActivityPub inbox

* Handle ActivityPub deletes

* Handle ActivityPub creates

* Handle ActivityPub announces

* Stubs for handling all activities that need to be handled

* Add ActivityPub actor resolving

* Handle conversation URI passing in ActivityPub

* Handle content language in ActivityPub

* Send accept header when fetching actor, handle JSON parse errors

* Test for ActivityPub::FetchRemoteAccountService

* Handle public key and icon/image when embedded/as array/as resolvable URI

* Implement ActivityPub::FetchRemoteStatusService

* Add stubs for more interactions

* Undo activities implemented

* Handle out of order activities

* Hook up ActivityPub to ResolveRemoteAccountService, handle
Update Account activities

* Add fragment IDs to all transient activity serializers

* Add tests and fixes

* Add stubs for missing tests

* Add more tests

* Add more tests
---
 app/helpers/jsonld_helper.rb | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 app/helpers/jsonld_helper.rb

(limited to 'app/helpers')

diff --git a/app/helpers/jsonld_helper.rb b/app/helpers/jsonld_helper.rb
new file mode 100644
index 000000000..b0db025bc
--- /dev/null
+++ b/app/helpers/jsonld_helper.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module JsonLdHelper
+  def equals_or_includes?(haystack, needle)
+    haystack.is_a?(Array) ? haystack.include?(needle) : haystack == needle
+  end
+
+  def first_of_value(value)
+    value.is_a?(Array) ? value.first : value
+  end
+
+  def supported_context?(json)
+    equals_or_includes?(json['@context'], ActivityPub::TagManager::CONTEXT)
+  end
+
+  def fetch_resource(uri)
+    response = build_request(uri).perform
+    return if response.code != 200
+    Oj.load(response.to_s, mode: :strict)
+  rescue Oj::ParseError
+    nil
+  end
+
+  private
+
+  def build_request(uri)
+    request = Request.new(:get, uri)
+    request.add_headers('Accept' => 'application/activity+json')
+    request
+  end
+end
-- 
cgit 


From 4e75f0d88932511ad154773f4c77a485367ed36c Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Mon, 14 Aug 2017 02:29:36 +0200
Subject: Hook up URL-based resource look-up to ActivityPub (#4589)

---
 app/helpers/jsonld_helper.rb                       |  8 ++-
 .../activitypub/fetch_remote_account_service.rb    |  4 +-
 .../activitypub/fetch_remote_status_service.rb     |  4 +-
 app/services/fetch_atom_service.rb                 | 72 ++++++++++++++--------
 app/services/fetch_remote_account_service.rb       | 15 +++--
 app/services/fetch_remote_status_service.rb        | 15 +++--
 .../api/subscriptions_controller_spec.rb           | 26 ++++----
 spec/services/process_feed_service_spec.rb         |  5 +-
 8 files changed, 92 insertions(+), 57 deletions(-)

(limited to 'app/helpers')

diff --git a/app/helpers/jsonld_helper.rb b/app/helpers/jsonld_helper.rb
index b0db025bc..c750a7038 100644
--- a/app/helpers/jsonld_helper.rb
+++ b/app/helpers/jsonld_helper.rb
@@ -16,7 +16,11 @@ module JsonLdHelper
   def fetch_resource(uri)
     response = build_request(uri).perform
     return if response.code != 200
-    Oj.load(response.to_s, mode: :strict)
+    body_to_json(response.to_s)
+  end
+
+  def body_to_json(body)
+    body.nil? ? nil : Oj.load(body, mode: :strict)
   rescue Oj::ParseError
     nil
   end
@@ -25,7 +29,7 @@ module JsonLdHelper
 
   def build_request(uri)
     request = Request.new(:get, uri)
-    request.add_headers('Accept' => 'application/activity+json')
+    request.add_headers('Accept' => 'application/activity+json, application/ld+json')
     request
   end
 end
diff --git a/app/services/activitypub/fetch_remote_account_service.rb b/app/services/activitypub/fetch_remote_account_service.rb
index e443b9463..3eeca585e 100644
--- a/app/services/activitypub/fetch_remote_account_service.rb
+++ b/app/services/activitypub/fetch_remote_account_service.rb
@@ -5,8 +5,8 @@ class ActivityPub::FetchRemoteAccountService < BaseService
 
   # Should be called when uri has already been checked for locality
   # Does a WebFinger roundtrip on each call
-  def call(uri)
-    @json = fetch_resource(uri)
+  def call(uri, prefetched_json = nil)
+    @json = body_to_json(prefetched_json) || fetch_resource(uri)
 
     return unless supported_context? && expected_type?
 
diff --git a/app/services/activitypub/fetch_remote_status_service.rb b/app/services/activitypub/fetch_remote_status_service.rb
index 80305c53d..993e5389c 100644
--- a/app/services/activitypub/fetch_remote_status_service.rb
+++ b/app/services/activitypub/fetch_remote_status_service.rb
@@ -4,8 +4,8 @@ class ActivityPub::FetchRemoteStatusService < BaseService
   include JsonLdHelper
 
   # Should be called when uri has already been checked for locality
-  def call(uri)
-    @json = fetch_resource(uri)
+  def call(uri, prefetched_json = nil)
+    @json = body_to_json(prefetched_json) || fetch_resource(uri)
 
     return unless supported_context? && expected_type?
 
diff --git a/app/services/fetch_atom_service.rb b/app/services/fetch_atom_service.rb
index 3ac441e3e..c6a4dc2e9 100644
--- a/app/services/fetch_atom_service.rb
+++ b/app/services/fetch_atom_service.rb
@@ -4,18 +4,10 @@ class FetchAtomService < BaseService
   def call(url)
     return if url.blank?
 
-    response = Request.new(:head, url).perform
+    @url = url
 
-    Rails.logger.debug "Remote status HEAD request returned code #{response.code}"
-
-    response = Request.new(:get, url).perform if response.code == 405
-
-    Rails.logger.debug "Remote status GET request returned code #{response.code}"
-
-    return nil if response.code != 200
-    return [url, fetch(url)] if response.mime_type == 'application/atom+xml'
-    return process_headers(url, response) if response['Link'].present?
-    process_html(fetch(url))
+    perform_request
+    process_response
   rescue OpenSSL::SSL::SSLError => e
     Rails.logger.debug "SSL error: #{e}"
     nil
@@ -26,27 +18,57 @@ class FetchAtomService < BaseService
 
   private
 
-  def process_html(body)
-    Rails.logger.debug 'Processing HTML'
+  def perform_request
+    @response = Request.new(:get, @url)
+                       .add_headers('Accept' => 'application/activity+json, application/ld+json, application/atom+xml, text/html')
+                       .perform
+  end
 
-    page = Nokogiri::HTML(body)
-    alternate_link = page.xpath('//link[@rel="alternate"]').find { |link| link['type'] == 'application/atom+xml' }
+  def process_response(terminal = false)
+    return nil if @response.code != 200
 
-    return nil if alternate_link.nil?
-    [alternate_link['href'], fetch(alternate_link['href'])]
+    if @response.mime_type == 'application/atom+xml'
+      [@url, @response.to_s, :ostatus]
+    elsif ['application/activity+json', 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"'].include?(@response.mime_type)
+      [@url, @response.to_s, :activitypub]
+    elsif @response['Link'] && !terminal
+      process_headers
+    elsif @response.mime_type == 'text/html' && !terminal
+      process_html
+    end
   end
 
-  def process_headers(url, response)
-    Rails.logger.debug 'Processing link header'
+  def process_html
+    page = Nokogiri::HTML(@response.to_s)
 
-    link_header    = LinkHeader.parse(response['Link'].is_a?(Array) ? response['Link'].first : response['Link'])
-    alternate_link = link_header.find_link(%w(rel alternate), %w(type application/atom+xml))
+    json_link = page.xpath('//link[@rel="alternate"]').find { |link| ['application/activity+json', 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"'].include?(link['type']) }
+    atom_link = page.xpath('//link[@rel="alternate"]').find { |link| link['type'] == 'application/atom+xml' }
 
-    return process_html(fetch(url)) if alternate_link.nil?
-    [alternate_link.href, fetch(alternate_link.href)]
+    if !json_link.nil?
+      @url = json_link['href']
+      perform_request
+      process_response(true)
+    elsif !atom_link.nil?
+      @url = atom_link['href']
+      perform_request
+      process_response(true)
+    end
   end
 
-  def fetch(url)
-    Request.new(:get, url).perform.to_s
+  def process_headers
+    link_header = LinkHeader.parse(@response['Link'].is_a?(Array) ? @response['Link'].first : @response['Link'])
+
+    json_link = link_header.find_link(%w(rel alternate), %w(type application/activity+json)) || link_header.find_link(%w(rel alternate), ['type', 'application/ld+json; profile="https://www.w3.org/ns/activitystreams"'])
+    atom_link = link_header.find_link(%w(rel alternate), %w(type application/atom+xml))
+
+    if !json_link.nil?
+      @url = json_link.href
+      perform_request
+      process_response(true)
+    elsif !atom_link.nil?
+      @url = atom_link.href
+      perform_request
+      process_response(true)
+    end
   end
 end
diff --git a/app/services/fetch_remote_account_service.rb b/app/services/fetch_remote_account_service.rb
index 8eed0d454..41b5374b4 100644
--- a/app/services/fetch_remote_account_service.rb
+++ b/app/services/fetch_remote_account_service.rb
@@ -5,14 +5,19 @@ class FetchRemoteAccountService < BaseService
 
   def call(url, prefetched_body = nil)
     if prefetched_body.nil?
-      atom_url, body = FetchAtomService.new.call(url)
+      resource_url, body, protocol = FetchAtomService.new.call(url)
     else
-      atom_url = url
-      body     = prefetched_body
+      resource_url = url
+      body         = prefetched_body
+      protocol     = :ostatus
     end
 
-    return nil if atom_url.nil?
-    process_atom(atom_url, body)
+    case protocol
+    when :ostatus
+      process_atom(resource_url, body)
+    when :activitypub
+      ActivityPub::FetchRemoteAccountService.new.call(resource_url, body)
+    end
   end
 
   private
diff --git a/app/services/fetch_remote_status_service.rb b/app/services/fetch_remote_status_service.rb
index b9f5f97b1..30d8d2538 100644
--- a/app/services/fetch_remote_status_service.rb
+++ b/app/services/fetch_remote_status_service.rb
@@ -5,14 +5,19 @@ class FetchRemoteStatusService < BaseService
 
   def call(url, prefetched_body = nil)
     if prefetched_body.nil?
-      atom_url, body = FetchAtomService.new.call(url)
+      resource_url, body, protocol = FetchAtomService.new.call(url)
     else
-      atom_url = url
-      body     = prefetched_body
+      resource_url = url
+      body         = prefetched_body
+      protocol     = :ostatus
     end
 
-    return nil if atom_url.nil?
-    process_atom(atom_url, body)
+    case protocol
+    when :ostatus
+      process_atom(resource_url, body)
+    when :activitypub
+      ActivityPub::FetchRemoteStatusService.new.call(resource_url, body)
+    end
   end
 
   private
diff --git a/spec/controllers/api/subscriptions_controller_spec.rb b/spec/controllers/api/subscriptions_controller_spec.rb
index 76f9740ca..d90da9e32 100644
--- a/spec/controllers/api/subscriptions_controller_spec.rb
+++ b/spec/controllers/api/subscriptions_controller_spec.rb
@@ -38,19 +38,19 @@ RSpec.describe Api::SubscriptionsController, type: :controller do
     before do
       stub_request(:post, "https://quitter.no/main/push/hub").to_return(:status => 200, :body => "", :headers => {})
       stub_request(:get, "https://quitter.no/avatar/7477-300-20160211190340.png").to_return(request_fixture('avatar.txt'))
-      stub_request(:head, "https://quitter.no/notice/1269244").to_return(status: 404)
-      stub_request(:head, "https://quitter.no/notice/1265331").to_return(status: 404)
-      stub_request(:head, "https://community.highlandarrow.com/notice/54411").to_return(status: 404)
-      stub_request(:head, "https://community.highlandarrow.com/notice/53857").to_return(status: 404)
-      stub_request(:head, "https://community.highlandarrow.com/notice/51852").to_return(status: 404)
-      stub_request(:head, "https://social.umeahackerspace.se/notice/424348").to_return(status: 404)
-      stub_request(:head, "https://community.highlandarrow.com/notice/50467").to_return(status: 404)
-      stub_request(:head, "https://quitter.no/notice/1243309").to_return(status: 404)
-      stub_request(:head, "https://quitter.no/user/7477").to_return(status: 404)
-      stub_request(:head, "https://community.highlandarrow.com/user/1").to_return(status: 404)
-      stub_request(:head, "https://social.umeahackerspace.se/user/2").to_return(status: 404)
-      stub_request(:head, "https://gs.kawa-kun.com/user/2").to_return(status: 404)
-      stub_request(:head, "https://mastodon.social/users/Gargron").to_return(status: 404)
+      stub_request(:get, "https://quitter.no/notice/1269244").to_return(status: 404)
+      stub_request(:get, "https://quitter.no/notice/1265331").to_return(status: 404)
+      stub_request(:get, "https://community.highlandarrow.com/notice/54411").to_return(status: 404)
+      stub_request(:get, "https://community.highlandarrow.com/notice/53857").to_return(status: 404)
+      stub_request(:get, "https://community.highlandarrow.com/notice/51852").to_return(status: 404)
+      stub_request(:get, "https://social.umeahackerspace.se/notice/424348").to_return(status: 404)
+      stub_request(:get, "https://community.highlandarrow.com/notice/50467").to_return(status: 404)
+      stub_request(:get, "https://quitter.no/notice/1243309").to_return(status: 404)
+      stub_request(:get, "https://quitter.no/user/7477").to_return(status: 404)
+      stub_request(:any, "https://community.highlandarrow.com/user/1").to_return(status: 404)
+      stub_request(:any, "https://social.umeahackerspace.se/user/2").to_return(status: 404)
+      stub_request(:any, "https://gs.kawa-kun.com/user/2").to_return(status: 404)
+      stub_request(:any, "https://mastodon.social/users/Gargron").to_return(status: 404)
 
       request.env['HTTP_X_HUB_SIGNATURE'] = "sha1=#{OpenSSL::HMAC.hexdigest('sha1', 'abc', feed)}"
       request.env['RAW_POST_DATA'] = feed
diff --git a/spec/services/process_feed_service_spec.rb b/spec/services/process_feed_service_spec.rb
index 5e34370ee..aca675dc6 100644
--- a/spec/services/process_feed_service_spec.rb
+++ b/spec/services/process_feed_service_spec.rb
@@ -124,8 +124,7 @@ RSpec.describe ProcessFeedService do
 </entry>
 XML
 
-    stub_request(:head, 'https://overwatch.com/users/tracer/updates/1').to_return(status: 200, headers: { 'Content-Type' => 'application/atom+xml' })
-    stub_request(:get, 'https://overwatch.com/users/tracer/updates/1').to_return(status: 200, body: real_body)
+    stub_request(:get, 'https://overwatch.com/users/tracer/updates/1').to_return(status: 200, body: real_body, headers: { 'Content-Type' => 'application/atom+xml' })
 
     bad_actor = Fabricate(:account, username: 'sombra', domain: 'talon.xyz')
 
@@ -168,7 +167,7 @@ XML
   end
 
   it 'ignores reblogs if it failed to retreive reblogged statuses' do
-    stub_request(:head, 'https://overwatch.com/users/tracer/updates/1').to_return(status: 404)
+    stub_request(:get, 'https://overwatch.com/users/tracer/updates/1').to_return(status: 404)
 
     actor = Fabricate(:account, username: 'tracer', domain: 'overwatch.com')
 
-- 
cgit 


From ca7ea1aba92f97e93f3c49e972f686a78779fd71 Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Wed, 16 Aug 2017 17:12:58 +0200
Subject: Redesign public profiles (#4608)

* Redesign public profiles

* Responsive design

* Change public profile status filtering defaults and add options

- No longer displays private/direct toots even if you are permitted access
- By default omits replies
- "With replies" option
- "Media only" option

* Redesign account grid cards

* Fix style issues
---
 app/controllers/accounts_controller.rb    |  41 +++++-
 app/helpers/application_helper.rb         |   4 +
 app/javascript/styles/accounts.scss       | 230 ++++++++++++++++++++++--------
 app/javascript/styles/landing_strip.scss  |  13 ++
 app/javascript/styles/stream_entries.scss |  17 +++
 app/models/account.rb                     |   1 +
 app/views/accounts/_grid_card.html.haml   |  11 +-
 app/views/accounts/_header.html.haml      |  57 +++++---
 app/views/accounts/show.html.haml         |   7 +-
 app/views/shared/_landing_strip.html.haml |   9 +-
 config/locales/en.yml                     |   6 +-
 config/routes.rb                          |   2 +
 12 files changed, 310 insertions(+), 88 deletions(-)

(limited to 'app/helpers')

diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb
index 4dc0a783d..c6b98628e 100644
--- a/app/controllers/accounts_controller.rb
+++ b/app/controllers/accounts_controller.rb
@@ -7,8 +7,14 @@ class AccountsController < ApplicationController
   def show
     respond_to do |format|
       format.html do
-        @statuses = @account.statuses.permitted_for(@account, current_account).paginate_by_max_id(20, params[:max_id], params[:since_id])
+        if current_account && @account.blocking?(current_account)
+          @statuses = []
+          return
+        end
+
+        @statuses = filtered_statuses.paginate_by_max_id(20, params[:max_id], params[:since_id])
         @statuses = cache_collection(@statuses, Status)
+        @next_url = next_url unless @statuses.empty?
       end
 
       format.atom do
@@ -24,7 +30,40 @@ class AccountsController < ApplicationController
 
   private
 
+  def filtered_statuses
+    default_statuses.tap do |statuses|
+      statuses.merge!(only_media_scope) if request.path.ends_with?('/media')
+      statuses.merge!(no_replies_scope) unless request.path.ends_with?('/with_replies')
+    end
+  end
+
+  def default_statuses
+    @account.statuses.where(visibility: [:public, :unlisted])
+  end
+
+  def only_media_scope
+    Status.where(id: account_media_status_ids)
+  end
+
+  def account_media_status_ids
+    @account.media_attachments.attached.reorder(nil).select(:status_id).distinct
+  end
+
+  def no_replies_scope
+    Status.without_replies
+  end
+
   def set_account
     @account = Account.find_local!(params[:username])
   end
+
+  def next_url
+    if request.path.ends_with?('/media')
+      short_account_media_url(@account, max_id: @statuses.last.id)
+    elsif request.path.ends_with?('/with_replies')
+      short_account_with_replies_url(@account, max_id: @statuses.last.id)
+    else
+      short_account_url(@account, max_id: @statuses.last.id)
+    end
+  end
 end
diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index 9f50d8bdb..61d4442c1 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -5,6 +5,10 @@ module ApplicationHelper
     current_page?(path) ? 'active' : ''
   end
 
+  def active_link_to(label, path, options = {})
+    link_to label, path, options.merge(class: active_nav_class(path))
+  end
+
   def show_landing_strip?
     !user_signed_in? && !single_user_mode?
   end
diff --git a/app/javascript/styles/accounts.scss b/app/javascript/styles/accounts.scss
index 66da75828..f1fbe873b 100644
--- a/app/javascript/styles/accounts.scss
+++ b/app/javascript/styles/accounts.scss
@@ -1,21 +1,15 @@
 .card {
-  background: $ui-base-color;
+  background-color: lighten($ui-base-color, 4%);
   background-size: cover;
   background-position: center;
-  padding: 60px 0;
-  padding-bottom: 0;
   border-radius: 4px 4px 0 0;
   box-shadow: 0 0 15px rgba($base-shadow-color, 0.2);
   overflow: hidden;
   position: relative;
-
-  @media screen and (max-width: 740px) {
-    border-radius: 0;
-    box-shadow: none;
-  }
+  display: flex;
 
   &::after {
-    background: linear-gradient(rgba($base-shadow-color, 0.5), rgba($base-shadow-color, 0.8));
+    background: rgba(darken($ui-base-color, 8%), 0.5);
     display: block;
     content: "";
     position: absolute;
@@ -26,6 +20,31 @@
     z-index: 1;
   }
 
+  @media screen and (max-width: 740px) {
+    border-radius: 0;
+    box-shadow: none;
+  }
+
+  .card__illustration {
+    padding: 60px 0;
+    position: relative;
+    flex: 1 1 auto;
+    display: flex;
+    justify-content: center;
+    align-items: center;
+  }
+
+  .card__bio {
+    max-width: 260px;
+    flex: 1 1 auto;
+    display: flex;
+    flex-direction: column;
+    justify-content: space-between;
+    background: rgba(darken($ui-base-color, 8%), 0.8);
+    position: relative;
+    z-index: 2;
+  }
+
   &.compact {
     padding: 30px 0;
     border-radius: 4px;
@@ -44,11 +63,12 @@
     font-size: 20px;
     line-height: 18px * 1.5;
     color: $primary-text-color;
+    padding: 10px 15px;
+    padding-bottom: 0;
     font-weight: 500;
-    text-align: center;
     position: relative;
     z-index: 2;
-    text-shadow: 0 0 2px $base-shadow-color;
+    margin-bottom: 30px;
 
     small {
       display: block;
@@ -61,7 +81,6 @@
   .avatar {
     width: 120px;
     margin: 0 auto;
-    margin-bottom: 15px;
     position: relative;
     z-index: 2;
 
@@ -70,43 +89,68 @@
       height: 120px;
       display: block;
       border-radius: 120px;
+      box-shadow: 0 0 15px rgba($base-shadow-color, 0.2);
     }
   }
 
   .controls {
     position: absolute;
-    top: 10px;
-    right: 10px;
+    top: 15px;
+    left: 15px;
     z-index: 2;
+
+    .icon-button {
+      color: rgba($white, 0.8);
+      text-decoration: none;
+      font-size: 13px;
+      line-height: 13px;
+      font-weight: 500;
+
+      .fa {
+        font-weight: 400;
+        margin-right: 5px;
+      }
+
+      &:hover,
+      &:active,
+      &:focus {
+        color: $white;
+      }
+    }
   }
 
-  .details {
-    display: flex;
-    margin-top: 30px;
-    position: relative;
-    z-index: 2;
-    flex-direction: row;
+  .roles {
+    margin-bottom: 30px;
+    padding: 0 15px;
   }
 
   .details-counters {
+    margin-top: 30px;
     display: flex;
     flex-direction: row;
-    order: 0;
+    width: 100%;
   }
 
   .counter {
-    width: 80px;
+    width: 33.3%;
+    box-sizing: border-box;
+    flex: 0 0 auto;
     color: $ui-primary-color;
     padding: 5px 10px 0;
     margin-bottom: 10px;
-    border-right: 1px solid $ui-primary-color;
+    border-right: 1px solid lighten($ui-base-color, 4%);
     cursor: default;
+    text-align: center;
     position: relative;
 
     a {
       display: block;
     }
 
+    &:last-child {
+      border-right: 0;
+    }
+
     &::after {
       display: block;
       content: "";
@@ -116,7 +160,7 @@
       width: 100%;
       border-bottom: 4px solid $ui-primary-color;
       opacity: 0.5;
-      transition: all 0.8s ease;
+      transition: all 400ms ease;
     }
 
     &.active {
@@ -129,7 +173,7 @@
     &:hover {
       &::after {
         opacity: 1;
-        transition-duration: 0.2s;
+        transition-duration: 100ms;
       }
     }
 
@@ -140,44 +184,40 @@
 
     .counter-label {
       font-size: 12px;
-      text-transform: uppercase;
       display: block;
       margin-bottom: 5px;
-      text-shadow: 0 0 2px $base-shadow-color;
     }
 
     .counter-number {
       font-weight: 500;
       font-size: 18px;
       color: $primary-text-color;
+      font-family: 'mastodon-font-display', sans-serif;
     }
   }
 
   .bio {
-    flex: 1;
     font-size: 14px;
     line-height: 18px;
-    padding: 5px 10px;
+    padding: 0 15px;
     color: $ui-secondary-color;
-    order: 1;
   }
 
   @media screen and (max-width: 480px) {
-    .details {
-      display: block;
-    }
+    display: block;
 
-    .bio {
-      text-align: center;
-      margin-bottom: 20px;
+    .card__bio {
+      max-width: none;
     }
 
-    .counter {
-      flex: 1 1 auto;
+    .name,
+    .roles {
+      text-align: center;
+      margin-bottom: 15px;
     }
 
-    .counter:last-child {
-      border-right: none;
+    .bio {
+      margin-bottom: 15px;
     }
   }
 }
@@ -264,13 +304,15 @@
 
 .accounts-grid {
   box-shadow: 0 0 15px rgba($base-shadow-color, 0.2);
-  background: $simple-background-color;
+  background: darken($simple-background-color, 8%);
   border-radius: 0 0 4px 4px;
   padding: 20px 10px;
   padding-bottom: 10px;
   overflow: hidden;
   display: flex;
   flex-wrap: wrap;
+  z-index: 2;
+  position: relative;
 
   @media screen and (max-width: 740px) {
     border-radius: 0;
@@ -280,10 +322,11 @@
   .account-grid-card {
     box-sizing: border-box;
     width: 335px;
-    border: 1px solid $ui-secondary-color;
+    background: $simple-background-color;
     border-radius: 4px;
     color: $ui-base-color;
     margin-bottom: 10px;
+    position: relative;
 
     &:nth-child(odd) {
       margin-right: 10px;
@@ -291,26 +334,52 @@
 
     .account-grid-card__header {
       overflow: hidden;
-      padding: 10px;
-      border-bottom: 1px solid $ui-secondary-color;
+      height: 100px;
+      border-radius: 4px 4px 0 0;
+      background-color: lighten($ui-base-color, 4%);
+      background-size: cover;
+      background-position: center;
+      position: relative;
+
+      &::after {
+        background: rgba(darken($ui-base-color, 8%), 0.5);
+        display: block;
+        content: "";
+        position: absolute;
+        left: 0;
+        top: 0;
+        width: 100%;
+        height: 100%;
+        z-index: 1;
+      }
+    }
+
+    .account-grid-card__avatar {
+      box-sizing: border-box;
+      padding: 15px;
+      position: absolute;
+      z-index: 2;
+      top: 100px - (40px + 2px);
+      left: -2px;
     }
 
     .avatar {
-      width: 60px;
-      height: 60px;
-      float: left;
-      margin-right: 15px;
+      width: 80px;
+      height: 80px;
 
       img {
         display: block;
-        width: 60px;
-        height: 60px;
-        border-radius: 60px;
+        width: 80px;
+        height: 80px;
+        border-radius: 80px;
+        border: 2px solid $simple-background-color;
       }
     }
 
     .name {
+      padding: 15px;
       padding-top: 10px;
+      padding-left: 15px + 80px + 15px;
 
       a {
         display: block;
@@ -318,6 +387,7 @@
         text-decoration: none;
         text-overflow: ellipsis;
         overflow: hidden;
+        font-weight: 500;
 
         &:hover {
           .display_name {
@@ -328,30 +398,36 @@
     }
 
     .display_name {
-      font-size: 14px;
+      font-size: 16px;
       display: block;
     }
 
     .username {
-      color: $ui-highlight-color;
+      color: lighten($ui-base-color, 34%);
+      font-size: 14px;
+      font-weight: 400;
     }
 
     .note {
-      padding: 10px;
+      padding: 10px 15px;
       padding-top: 15px;
-      color: $ui-primary-color;
+      box-sizing: border-box;
+      color: lighten($ui-base-color, 26%);
       word-wrap: break-word;
+      min-height: 80px;
     }
   }
 }
 
 .nothing-here {
+  width: 100%;
+  display: block;
   color: $ui-primary-color;
   font-size: 14px;
   font-weight: 500;
   text-align: center;
-  padding: 15px 0;
-  padding-bottom: 25px;
+  padding: 60px 0;
+  padding-top: 55px;
   cursor: default;
 }
 
@@ -416,3 +492,43 @@
     color: $ui-base-color;
   }
 }
+
+.activity-stream-tabs {
+  background: $simple-background-color;
+  border-bottom: 1px solid $ui-secondary-color;
+  position: relative;
+  z-index: 2;
+
+  a {
+    display: inline-block;
+    padding: 15px;
+    text-decoration: none;
+    color: $ui-highlight-color;
+    text-transform: uppercase;
+    font-weight: 500;
+
+    &:hover,
+    &:active,
+    &:focus {
+      color: lighten($ui-highlight-color, 8%);
+    }
+
+    &.active {
+      color: $ui-base-color;
+      cursor: default;
+    }
+  }
+}
+
+.account-role {
+  display: inline-block;
+  padding: 4px 6px;
+  cursor: default;
+  border-radius: 3px;
+  font-size: 12px;
+  line-height: 12px;
+  font-weight: 500;
+  color: $success-green;
+  background-color: rgba($success-green, 0.1);
+  border: 1px solid rgba($success-green, 0.5);
+}
diff --git a/app/javascript/styles/landing_strip.scss b/app/javascript/styles/landing_strip.scss
index d2ac5b822..15ff84912 100644
--- a/app/javascript/styles/landing_strip.scss
+++ b/app/javascript/styles/landing_strip.scss
@@ -5,6 +5,8 @@
   padding: 14px;
   border-radius: 4px;
   margin-bottom: 20px;
+  display: flex;
+  align-items: center;
 
   strong,
   a {
@@ -15,4 +17,15 @@
     color: inherit;
     text-decoration: underline;
   }
+
+  .logo {
+    width: 30px;
+    height: 30px;
+    flex: 0 0 auto;
+    margin-right: 15px;
+  }
+
+  @media screen and (max-width: 740px) {
+    margin-bottom: 0;
+  }
 }
diff --git a/app/javascript/styles/stream_entries.scss b/app/javascript/styles/stream_entries.scss
index 9e062c57e..1192e2a80 100644
--- a/app/javascript/styles/stream_entries.scss
+++ b/app/javascript/styles/stream_entries.scss
@@ -8,6 +8,7 @@
     .detailed-status.light,
     .status.light {
       border-bottom: 1px solid $ui-secondary-color;
+      animation: none;
     }
 
     &:last-child {
@@ -34,6 +35,14 @@
         }
       }
     }
+
+    @media screen and (max-width: 740px) {
+      &,
+      .detailed-status.light,
+      .status.light {
+        border-radius: 0 !important;
+      }
+    }
   }
 
   &.with-header {
@@ -44,6 +53,14 @@
         .status.light {
           border-radius: 0;
         }
+
+        &:last-child {
+          &,
+          .detailed-status.light,
+          .status.light {
+            border-radius: 0 0 4px 4px;
+          }
+        }
       }
     }
   }
diff --git a/app/models/account.rb b/app/models/account.rb
index a7264353e..c4c168160 100644
--- a/app/models/account.rb
+++ b/app/models/account.rb
@@ -105,6 +105,7 @@ class Account < ApplicationRecord
            :current_sign_in_ip,
            :current_sign_in_at,
            :confirmed?,
+           :admin?,
            :locale,
            to: :user,
            prefix: true,
diff --git a/app/views/accounts/_grid_card.html.haml b/app/views/accounts/_grid_card.html.haml
index 0571d1d5e..305eb2c44 100644
--- a/app/views/accounts/_grid_card.html.haml
+++ b/app/views/accounts/_grid_card.html.haml
@@ -1,8 +1,9 @@
 .account-grid-card
-  .account-grid-card__header
+  .account-grid-card__header{ style: "background-image: url(#{account.header.url(:original)})" }
+  .account-grid-card__avatar
     .avatar= image_tag account.avatar.url(:original)
-    .name
-      = link_to TagManager.instance.url_for(account) do
-        %span.display_name.emojify= display_name(account)
-        %span.username @#{account.acct}
+  .name
+    = link_to TagManager.instance.url_for(account) do
+      %span.display_name.emojify= display_name(account)
+      %span.username @#{account.acct}
   %p.note.emojify= truncate(strip_tags(account.note), length: 150)
diff --git a/app/views/accounts/_header.html.haml b/app/views/accounts/_header.html.haml
index 6451a5573..8009e903e 100644
--- a/app/views/accounts/_header.html.haml
+++ b/app/views/accounts/_header.html.haml
@@ -1,34 +1,51 @@
 .card.h-card.p-author{ style: "background-image: url(#{account.header.url(:original)})" }
-  - if user_signed_in? && current_account.id != account.id && !current_account.requested?(account)
-    .controls
-      - if current_account.following?(account)
-        = link_to t('accounts.unfollow'), account_unfollow_path(account), data: { method: :post }, class: 'button'
-      - else
-        = link_to t('accounts.follow'), account_follow_path(account), data: { method: :post }, class: 'button'
-  - elsif !user_signed_in?
-    .controls
-      .remote-follow
-        = link_to t('accounts.remote_follow'), account_remote_follow_path(account), class: 'button'
-  .avatar= image_tag account.avatar.url(:original), class: 'u-photo'
-  %h1.name
-    %span.p-name.emojify= display_name(account)
-    %small
-      %span @#{account.username}
-      = fa_icon('lock') if account.locked?
-  .details
+  .card__illustration
+    - if user_signed_in? && current_account.id != account.id && !current_account.requested?(account)
+      .controls
+        - if current_account.following?(account)
+          = link_to account_unfollow_path(account), data: { method: :post }, class: 'icon-button' do
+            = fa_icon 'user-times'
+            = t('accounts.unfollow')
+        - else
+          = link_to account_follow_path(account), data: { method: :post }, class: 'icon-button' do
+            = fa_icon 'user-plus'
+            = t('accounts.follow')
+    - elsif !user_signed_in?
+      .controls
+        .remote-follow
+          = link_to account_remote_follow_path(account), class: 'icon-button' do
+            = fa_icon 'user-plus'
+            = t('accounts.remote_follow')
+
+    .avatar= image_tag account.avatar.url(:original), class: 'u-photo'
+
+  .card__bio
+    %h1.name
+      %span.p-name.emojify= display_name(account)
+      %small
+        %span @#{account.local_username_and_domain}
+        = fa_icon('lock') if account.locked?
+
+    - if account.user_admin?
+      .roles
+        .account-role
+          = t 'accounts.roles.admin'
+
     .bio
       .account__header__content.p-note.emojify= Formatter.instance.simplified_format(account)
 
     .details-counters
       .counter{ class: active_nav_class(short_account_url(account)) }
         = link_to short_account_url(account), class: 'u-url u-uid' do
-          %span.counter-label= t('accounts.posts')
           %span.counter-number= number_with_delimiter account.statuses_count
+          %span.counter-label= t('accounts.posts')
+
       .counter{ class: active_nav_class(account_following_index_url(account)) }
         = link_to account_following_index_url(account) do
-          %span.counter-label= t('accounts.following')
           %span.counter-number= number_with_delimiter account.following_count
+          %span.counter-label= t('accounts.following')
+
       .counter{ class: active_nav_class(account_followers_url(account)) }
         = link_to account_followers_url(account) do
-          %span.counter-label= t('accounts.followers')
           %span.counter-number= number_with_delimiter account.followers_count
+          %span.counter-label= t('accounts.followers')
diff --git a/app/views/accounts/show.html.haml b/app/views/accounts/show.html.haml
index 74e695fc3..ec44f4c74 100644
--- a/app/views/accounts/show.html.haml
+++ b/app/views/accounts/show.html.haml
@@ -20,6 +20,11 @@
 
   = render 'header', account: @account
 
+  .activity-stream-tabs
+    = active_link_to t('accounts.posts'), short_account_url(@account)
+    = active_link_to t('accounts.posts_with_replies'), short_account_with_replies_url(@account)
+    = active_link_to t('accounts.media'), short_account_media_url(@account)
+
   - if @statuses.empty?
     .accounts-grid
       = render 'nothing_here'
@@ -29,4 +34,4 @@
 
   - if @statuses.size == 20
     .pagination
-      = link_to safe_join([t('pagination.next'), fa_icon('chevron-right')], ' '), short_account_url(@account, max_id: @statuses.last.id), class: 'next', rel: 'next'
+      = link_to safe_join([t('pagination.next'), fa_icon('chevron-right')], ' '), @next_url, class: 'next', rel: 'next'
diff --git a/app/views/shared/_landing_strip.html.haml b/app/views/shared/_landing_strip.html.haml
index 35461a8cb..ae26fc1ff 100644
--- a/app/views/shared/_landing_strip.html.haml
+++ b/app/views/shared/_landing_strip.html.haml
@@ -1,5 +1,8 @@
 .landing-strip
-  = t('landing_strip_html', name: content_tag(:span, display_name(account), class: :emojify), link_to_root_path: link_to(content_tag(:strong, site_hostname), root_path))
+  = image_tag asset_pack_path('logo.svg'), class: 'logo'
 
-  - if open_registrations?
-    = t('landing_strip_signup_html', sign_up_path: new_user_registration_path)
+  %div
+    = t('landing_strip_html', name: content_tag(:span, display_name(account), class: :emojify), link_to_root_path: link_to(content_tag(:strong, site_hostname), root_path))
+
+    - if open_registrations?
+      = t('landing_strip_signup_html', sign_up_path: new_user_registration_path)
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 210bfc5b4..97f46c3af 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -40,7 +40,11 @@ en:
     nothing_here: There is nothing here!
     people_followed_by: People whom %{name} follows
     people_who_follow: People who follow %{name}
-    posts: Posts
+    posts: Toots
+    posts_with_replies: Toots with replies
+    media: Media
+    roles:
+      admin: Admin
     remote_follow: Remote follow
     reserved_username: The username is reserved
     unfollow: Unfollow
diff --git a/config/routes.rb b/config/routes.rb
index f75de5304..1a39dfeac 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -56,6 +56,8 @@ Rails.application.routes.draw do
   end
 
   get '/@:username', to: 'accounts#show', as: :short_account
+  get '/@:username/with_replies', to: 'accounts#show', as: :short_account_with_replies
+  get '/@:username/media', to: 'accounts#show', as: :short_account_media
   get '/@:account_username/:id', to: 'statuses#show', as: :short_account_status
 
   namespace :settings do
-- 
cgit 


From 075d6a1e13aa6477c656e9dbe03e6720cb4e2b32 Mon Sep 17 00:00:00 2001
From: nullkal <nullkal@users.noreply.github.com>
Date: Fri, 18 Aug 2017 00:52:40 +0900
Subject: Show what protocol is used for accounts in admin/accounts#index
 (#4622)

* Show what protocol used for in admin/accounts#index

* Add frozen_string_literal
---
 app/helpers/account_helper.rb               | 14 ++++++++++++++
 app/views/admin/accounts/_account.html.haml |  3 +++
 app/views/admin/accounts/index.html.haml    |  1 +
 app/views/admin/accounts/show.html.haml     |  2 +-
 spec/helpers/account_helper_spec.rb         | 30 +++++++++++++++++++++++++++++
 5 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 app/helpers/account_helper.rb
 create mode 100644 spec/helpers/account_helper_spec.rb

(limited to 'app/helpers')

diff --git a/app/helpers/account_helper.rb b/app/helpers/account_helper.rb
new file mode 100644
index 000000000..00d4fc657
--- /dev/null
+++ b/app/helpers/account_helper.rb
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module AccountHelper
+  def protocol_for_display(protocol)
+    case protocol
+    when 'activitypub'
+      'ActivityPub'
+    when 'ostatus'
+      'OStatus'
+    else
+      protocol
+    end
+  end
+end
diff --git a/app/views/admin/accounts/_account.html.haml b/app/views/admin/accounts/_account.html.haml
index c513776b7..a7fca6b3e 100644
--- a/app/views/admin/accounts/_account.html.haml
+++ b/app/views/admin/accounts/_account.html.haml
@@ -4,6 +4,9 @@
   %td.domain
     - unless account.local?
       = link_to account.domain, admin_accounts_path(by_domain: account.domain)
+  %td.protocol
+    - unless account.local?
+      = protocol_for_display(account.protocol)
   %td.confirmed
     - if account.local?
       - if account.user_confirmed?
diff --git a/app/views/admin/accounts/index.html.haml b/app/views/admin/accounts/index.html.haml
index 07c8d1632..1f36aeb31 100644
--- a/app/views/admin/accounts/index.html.haml
+++ b/app/views/admin/accounts/index.html.haml
@@ -55,6 +55,7 @@
     %tr
       %th= t('admin.accounts.username')
       %th= t('admin.accounts.domain')
+      %th= t('admin.accounts.protocol')
       %th= t('admin.accounts.confirmed')
       %th= fa_icon 'paper-plane-o'
       %th
diff --git a/app/views/admin/accounts/show.html.haml b/app/views/admin/accounts/show.html.haml
index 5c781e817..f0e4e303c 100644
--- a/app/views/admin/accounts/show.html.haml
+++ b/app/views/admin/accounts/show.html.haml
@@ -33,7 +33,7 @@
         %td= link_to @account.url, @account.url
       %tr
         %th= t('admin.accounts.protocol')
-        %td= @account.protocol
+        %td= protocol_for_display(@account.protocol)
 
       - if @account.ostatus?
         %tr
diff --git a/spec/helpers/account_helper_spec.rb b/spec/helpers/account_helper_spec.rb
new file mode 100644
index 000000000..63e7c78b6
--- /dev/null
+++ b/spec/helpers/account_helper_spec.rb
@@ -0,0 +1,30 @@
+require 'rails_helper'
+
+# Specs in this file have access to a helper object that includes
+# the AccountHelper. For example:
+#
+# describe AccountHelper do
+#   describe "string concat" do
+#     it "concats two strings with spaces" do
+#       expect(helper.concat_strings("this","that")).to eq("this that")
+#     end
+#   end
+# end
+RSpec.describe AccountHelper, type: :helper do
+  describe '#protocol_for_display' do
+    it "returns OStatus when the protocol is 'ostatus'" do
+      protocol = 'ostatus'
+      expect(protocol_for_display(protocol)).to eq 'OStatus'
+    end
+
+    it "returns ActivityPub when the protocol is 'activitypub'" do
+      protocol = 'activitypub'
+      expect(protocol_for_display(protocol)).to eq 'ActivityPub'
+    end
+
+    it "returns the same string when the protocol is unknown" do
+      protocol = 'wave'
+      expect(protocol_for_display(protocol)).to eq protocol
+    end
+  end
+end
-- 
cgit 


From efec02f1538adc7f75ba9ca3716ea25b3f2ef4df Mon Sep 17 00:00:00 2001
From: nightpool <eg1290@gmail.com>
Date: Thu, 17 Aug 2017 17:20:50 -0400
Subject: use existing inflections instead of custom helper (#4624)

* use existing inflections instead of custom helper

* use ActiveSupport versions
---
 app/helpers/account_helper.rb               | 14 --------------
 app/views/admin/accounts/_account.html.haml |  2 +-
 app/views/admin/accounts/show.html.haml     |  2 +-
 spec/helpers/account_helper_spec.rb         | 30 -----------------------------
 4 files changed, 2 insertions(+), 46 deletions(-)
 delete mode 100644 app/helpers/account_helper.rb
 delete mode 100644 spec/helpers/account_helper_spec.rb

(limited to 'app/helpers')

diff --git a/app/helpers/account_helper.rb b/app/helpers/account_helper.rb
deleted file mode 100644
index 00d4fc657..000000000
--- a/app/helpers/account_helper.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-module AccountHelper
-  def protocol_for_display(protocol)
-    case protocol
-    when 'activitypub'
-      'ActivityPub'
-    when 'ostatus'
-      'OStatus'
-    else
-      protocol
-    end
-  end
-end
diff --git a/app/views/admin/accounts/_account.html.haml b/app/views/admin/accounts/_account.html.haml
index a7fca6b3e..5265d77f6 100644
--- a/app/views/admin/accounts/_account.html.haml
+++ b/app/views/admin/accounts/_account.html.haml
@@ -6,7 +6,7 @@
       = link_to account.domain, admin_accounts_path(by_domain: account.domain)
   %td.protocol
     - unless account.local?
-      = protocol_for_display(account.protocol)
+      = account.protocol.humanize
   %td.confirmed
     - if account.local?
       - if account.user_confirmed?
diff --git a/app/views/admin/accounts/show.html.haml b/app/views/admin/accounts/show.html.haml
index f0e4e303c..18bcd5e8e 100644
--- a/app/views/admin/accounts/show.html.haml
+++ b/app/views/admin/accounts/show.html.haml
@@ -33,7 +33,7 @@
         %td= link_to @account.url, @account.url
       %tr
         %th= t('admin.accounts.protocol')
-        %td= protocol_for_display(@account.protocol)
+        %td= @account.protocol.humanize
 
       - if @account.ostatus?
         %tr
diff --git a/spec/helpers/account_helper_spec.rb b/spec/helpers/account_helper_spec.rb
deleted file mode 100644
index 63e7c78b6..000000000
--- a/spec/helpers/account_helper_spec.rb
+++ /dev/null
@@ -1,30 +0,0 @@
-require 'rails_helper'
-
-# Specs in this file have access to a helper object that includes
-# the AccountHelper. For example:
-#
-# describe AccountHelper do
-#   describe "string concat" do
-#     it "concats two strings with spaces" do
-#       expect(helper.concat_strings("this","that")).to eq("this that")
-#     end
-#   end
-# end
-RSpec.describe AccountHelper, type: :helper do
-  describe '#protocol_for_display' do
-    it "returns OStatus when the protocol is 'ostatus'" do
-      protocol = 'ostatus'
-      expect(protocol_for_display(protocol)).to eq 'OStatus'
-    end
-
-    it "returns ActivityPub when the protocol is 'activitypub'" do
-      protocol = 'activitypub'
-      expect(protocol_for_display(protocol)).to eq 'ActivityPub'
-    end
-
-    it "returns the same string when the protocol is unknown" do
-      protocol = 'wave'
-      expect(protocol_for_display(protocol)).to eq protocol
-    end
-  end
-end
-- 
cgit 


From 10e9a9a3f9969dc5d83238b24f46fa96b28c3c0b Mon Sep 17 00:00:00 2001
From: Yamagishi Kazutoshi <ykzts@desire.sh>
Date: Mon, 21 Aug 2017 19:42:16 +0900
Subject: Use URI.join even when S3 enabled (#4652)

---
 app/helpers/routing_helper.rb       |  4 +++-
 spec/helpers/routing_helper_spec.rb | 43 +++++++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 spec/helpers/routing_helper_spec.rb

(limited to 'app/helpers')

diff --git a/app/helpers/routing_helper.rb b/app/helpers/routing_helper.rb
index 8126176ba..1fbf77ec3 100644
--- a/app/helpers/routing_helper.rb
+++ b/app/helpers/routing_helper.rb
@@ -12,6 +12,8 @@ module RoutingHelper
   end
 
   def full_asset_url(source, options = {})
-    Rails.configuration.x.use_s3 ? source : URI.join(root_url, ActionController::Base.helpers.asset_url(source, options)).to_s
+    source = ActionController::Base.helpers.asset_url(source, options) unless Rails.configuration.x.use_s3
+
+    URI.join(root_url, source).to_s
   end
 end
diff --git a/spec/helpers/routing_helper_spec.rb b/spec/helpers/routing_helper_spec.rb
new file mode 100644
index 000000000..940392c9b
--- /dev/null
+++ b/spec/helpers/routing_helper_spec.rb
@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe RoutingHelper, type: :helper do
+  describe '.full_asset_url' do
+    around do |example|
+      use_s3 = Rails.configuration.x.use_s3
+      example.run
+      Rails.configuration.x.use_s3 = use_s3
+    end
+
+    shared_examples 'returns full path URL' do
+      it 'with host' do
+        url = helper.full_asset_url('https://example.com/avatars/000/000/002/original/icon.png')
+
+        expect(url).to eq 'https://example.com/avatars/000/000/002/original/icon.png'
+      end
+
+      it 'without host' do
+        url = helper.full_asset_url('/avatars/original/missing.png', skip_pipeline: true)
+
+        expect(url).to eq 'http://test.host/avatars/original/missing.png'
+      end
+    end
+
+    context 'Do not use S3' do
+      before do
+        Rails.configuration.x.use_s3 = false
+      end
+
+      it_behaves_like 'returns full path URL'
+    end
+
+    context 'Use S3' do
+      before do
+        Rails.configuration.x.use_s3 = true
+      end
+
+      it_behaves_like 'returns full path URL'
+    end
+  end
+end
-- 
cgit 


From 72bb3e03fdf4d8c886d41f3459000b336a3a362b Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Mon, 21 Aug 2017 22:57:34 +0200
Subject: Support more variations of ActivityPub keyId in signature (#4630)

- Tries to avoid performing HTTP request if the keyId is an actor URI
- Likewise if the URI is a fragment URI on top of actor URI
- Resolves public key, returns owner if the owner links back to the key
---
 app/controllers/concerns/signature_verification.rb |  4 +-
 app/helpers/jsonld_helper.rb                       |  6 ++-
 app/lib/activitypub/activity.rb                    |  2 +-
 app/lib/activitypub/activity/accept.rb             |  2 +-
 app/lib/activitypub/activity/reject.rb             |  2 +-
 app/lib/activitypub/activity/undo.rb               |  2 +-
 app/lib/activitypub/tag_manager.rb                 |  2 +-
 .../activitypub/fetch_remote_key_service.rb        | 47 ++++++++++++++++++++++
 8 files changed, 60 insertions(+), 7 deletions(-)
 create mode 100644 app/services/activitypub/fetch_remote_key_service.rb

(limited to 'app/helpers')

diff --git a/app/controllers/concerns/signature_verification.rb b/app/controllers/concerns/signature_verification.rb
index aeb8da879..4211283ed 100644
--- a/app/controllers/concerns/signature_verification.rb
+++ b/app/controllers/concerns/signature_verification.rb
@@ -98,7 +98,9 @@ module SignatureVerification
     if key_id.start_with?('acct:')
       ResolveRemoteAccountService.new.call(key_id.gsub(/\Aacct:/, ''))
     elsif !ActivityPub::TagManager.instance.local_uri?(key_id)
-      ActivityPub::FetchRemoteAccountService.new.call(key_id)
+      account   = ActivityPub::TagManager.instance.uri_to_resource(key_id, Account)
+      account ||= ActivityPub::FetchRemoteKeyService.new.call(key_id)
+      account
     end
   end
 end
diff --git a/app/helpers/jsonld_helper.rb b/app/helpers/jsonld_helper.rb
index c750a7038..d8b3ddf18 100644
--- a/app/helpers/jsonld_helper.rb
+++ b/app/helpers/jsonld_helper.rb
@@ -9,6 +9,10 @@ module JsonLdHelper
     value.is_a?(Array) ? value.first : value
   end
 
+  def value_or_id(value)
+    value.is_a?(String) ? value : value['id']
+  end
+
   def supported_context?(json)
     equals_or_includes?(json['@context'], ActivityPub::TagManager::CONTEXT)
   end
@@ -20,7 +24,7 @@ module JsonLdHelper
   end
 
   def body_to_json(body)
-    body.nil? ? nil : Oj.load(body, mode: :strict)
+    body.is_a?(String) ? Oj.load(body, mode: :strict) : body
   rescue Oj::ParseError
     nil
   end
diff --git a/app/lib/activitypub/activity.rb b/app/lib/activitypub/activity.rb
index f8de8060c..14e3ca784 100644
--- a/app/lib/activitypub/activity.rb
+++ b/app/lib/activitypub/activity.rb
@@ -58,7 +58,7 @@ class ActivityPub::Activity
   end
 
   def object_uri
-    @object_uri ||= @object.is_a?(String) ? @object : @object['id']
+    @object_uri ||= value_or_id(@object)
   end
 
   def redis
diff --git a/app/lib/activitypub/activity/accept.rb b/app/lib/activitypub/activity/accept.rb
index 44c432ae7..bd90c9019 100644
--- a/app/lib/activitypub/activity/accept.rb
+++ b/app/lib/activitypub/activity/accept.rb
@@ -20,6 +20,6 @@ class ActivityPub::Activity::Accept < ActivityPub::Activity
   end
 
   def target_uri
-    @target_uri ||= @object['actor']
+    @target_uri ||= value_or_id(@object['actor'])
   end
 end
diff --git a/app/lib/activitypub/activity/reject.rb b/app/lib/activitypub/activity/reject.rb
index 6a234994e..d815feeb6 100644
--- a/app/lib/activitypub/activity/reject.rb
+++ b/app/lib/activitypub/activity/reject.rb
@@ -20,6 +20,6 @@ class ActivityPub::Activity::Reject < ActivityPub::Activity
   end
 
   def target_uri
-    @target_uri ||= @object['actor']
+    @target_uri ||= value_or_id(@object['actor'])
   end
 end
diff --git a/app/lib/activitypub/activity/undo.rb b/app/lib/activitypub/activity/undo.rb
index 078e97ed4..097b1dba4 100644
--- a/app/lib/activitypub/activity/undo.rb
+++ b/app/lib/activitypub/activity/undo.rb
@@ -64,6 +64,6 @@ class ActivityPub::Activity::Undo < ActivityPub::Activity
   end
 
   def target_uri
-    @target_uri ||= @object['object'].is_a?(String) ? @object['object'] : @object['object']['id']
+    @target_uri ||= value_or_id(@object['object'])
   end
 end
diff --git a/app/lib/activitypub/tag_manager.rb b/app/lib/activitypub/tag_manager.rb
index 855881612..3c16006cb 100644
--- a/app/lib/activitypub/tag_manager.rb
+++ b/app/lib/activitypub/tag_manager.rb
@@ -93,7 +93,7 @@ class ActivityPub::TagManager
     elsif ::TagManager.instance.local_id?(uri)
       klass.find_by(id: ::TagManager.instance.unique_tag_to_local_id(uri, klass.to_s))
     else
-      klass.find_by(uri: uri)
+      klass.find_by(uri: uri.split('#').first)
     end
   end
 end
diff --git a/app/services/activitypub/fetch_remote_key_service.rb b/app/services/activitypub/fetch_remote_key_service.rb
new file mode 100644
index 000000000..ebd64071e
--- /dev/null
+++ b/app/services/activitypub/fetch_remote_key_service.rb
@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+class ActivityPub::FetchRemoteKeyService < BaseService
+  include JsonLdHelper
+
+  # Returns account that owns the key
+  def call(uri, prefetched_json = nil)
+    @json = body_to_json(prefetched_json) || fetch_resource(uri)
+
+    return unless supported_context?(@json) && expected_type?
+    return find_account(uri, @json) if person?
+
+    @owner = fetch_resource(owner_uri)
+
+    return unless supported_context?(@owner) && confirmed_owner?
+
+    find_account(owner_uri, @owner)
+  end
+
+  private
+
+  def find_account(uri, prefetched_json)
+    account   = ActivityPub::TagManager.instance.uri_to_resource(uri, Account)
+    account ||= ActivityPub::FetchRemoteAccountService.new.call(uri, prefetched_json)
+    account
+  end
+
+  def expected_type?
+    person? || public_key?
+  end
+
+  def person?
+    @json['type'] == 'Person'
+  end
+
+  def public_key?
+    @json['publicKeyPem'].present? && @json['owner'].present?
+  end
+
+  def owner_uri
+    @owner_uri ||= value_or_id(@json['owner'])
+  end
+
+  def confirmed_owner?
+    @owner['type'] == 'Person' && value_or_id(@owner['publicKey']) == @json['id']
+  end
+end
-- 
cgit 


From 5927b43c0fc74e66cd3a882b565ea70236559c02 Mon Sep 17 00:00:00 2001
From: unarist <m.unarist@gmail.com>
Date: Wed, 23 Aug 2017 03:00:49 +0900
Subject: Ignore empty response in ActivityPub::FetchRemoteStatusService
 (#4661)

* Ignore empty response in ActivityPub::FetchRemoteStatusService

This fixes `NoMethodError: undefined method `[]' for nil:NilClass` error.

* Check json.nil? in JsonLdHelper#supported_context?
---
 app/helpers/jsonld_helper.rb       | 2 +-
 app/services/fetch_atom_service.rb | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'app/helpers')

diff --git a/app/helpers/jsonld_helper.rb b/app/helpers/jsonld_helper.rb
index d8b3ddf18..8355eb055 100644
--- a/app/helpers/jsonld_helper.rb
+++ b/app/helpers/jsonld_helper.rb
@@ -14,7 +14,7 @@ module JsonLdHelper
   end
 
   def supported_context?(json)
-    equals_or_includes?(json['@context'], ActivityPub::TagManager::CONTEXT)
+    !json.nil? && equals_or_includes?(json['@context'], ActivityPub::TagManager::CONTEXT)
   end
 
   def fetch_resource(uri)
diff --git a/app/services/fetch_atom_service.rb b/app/services/fetch_atom_service.rb
index 3cf39e006..afda50ae4 100644
--- a/app/services/fetch_atom_service.rb
+++ b/app/services/fetch_atom_service.rb
@@ -82,7 +82,7 @@ class FetchAtomService < BaseService
 
   def supported_activity?(body)
     json = body_to_json(body)
-    return false if json.nil? || !supported_context?(json)
+    return false unless supported_context?(json)
     json['type'] == 'Person' ? json['inbox'].present? : true
   end
 end
-- 
cgit 


From 00840f4f2edb8d1d46638ccbc90a1f4462d0867a Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 26 Aug 2017 13:47:38 +0200
Subject: Add handling of Linked Data Signatures in payloads (#4687)

* Add handling of Linked Data Signatures in payloads

* Add a way to sign JSON, fix canonicalization of signature options

* Fix signatureValue encoding, send out signed JSON when distributing

* Add missing security context
---
 .rubocop.yml                                       |  1 +
 Gemfile                                            |  3 +
 Gemfile.lock                                       | 16 ++++
 app/helpers/jsonld_helper.rb                       | 13 ++++
 app/lib/activitypub/adapter.rb                     |  2 +-
 app/lib/activitypub/linked_data_signature.rb       | 56 ++++++++++++++
 .../activitypub/process_collection_service.rb      | 11 +++
 app/services/authorize_follow_service.rb           |  4 +-
 app/services/batched_remove_status_service.rb      |  8 +-
 app/services/block_service.rb                      |  4 +-
 app/services/favourite_service.rb                  |  4 +-
 app/services/follow_service.rb                     |  4 +-
 app/services/process_mentions_service.rb           |  4 +-
 app/services/reblog_service.rb                     |  4 +-
 app/services/reject_follow_service.rb              |  4 +-
 app/services/remove_status_service.rb              | 10 ++-
 app/services/unblock_service.rb                    |  4 +-
 app/services/unfavourite_service.rb                |  4 +-
 app/services/unfollow_service.rb                   |  4 +-
 app/workers/activitypub/distribution_worker.rb     |  8 +-
 config/initializers/json_ld.rb                     |  4 +
 lib/json_ld/identity.rb                            | 86 ++++++++++++++++++++++
 lib/json_ld/security.rb                            | 50 +++++++++++++
 spec/lib/activitypub/linked_data_signature_spec.rb | 86 ++++++++++++++++++++++
 .../activitypub/process_collection_service_spec.rb |  5 +-
 25 files changed, 369 insertions(+), 30 deletions(-)
 create mode 100644 app/lib/activitypub/linked_data_signature.rb
 create mode 100644 config/initializers/json_ld.rb
 create mode 100644 lib/json_ld/identity.rb
 create mode 100644 lib/json_ld/security.rb
 create mode 100644 spec/lib/activitypub/linked_data_signature_spec.rb

(limited to 'app/helpers')

diff --git a/.rubocop.yml b/.rubocop.yml
index ae3697174..a36aa5cae 100644
--- a/.rubocop.yml
+++ b/.rubocop.yml
@@ -10,6 +10,7 @@ AllCops:
   - 'node_modules/**/*'
   - 'Vagrantfile'
   - 'vendor/**/*'
+  - 'lib/json_ld/*'
 
 Bundler/OrderedGems:
   Enabled: false
diff --git a/Gemfile b/Gemfile
index 52ac43b9a..ae90697f1 100644
--- a/Gemfile
+++ b/Gemfile
@@ -68,6 +68,9 @@ gem 'tzinfo-data', '~> 1.2017'
 gem 'webpacker', '~> 2.0'
 gem 'webpush'
 
+gem 'json-ld-preloaded', '~> 2.2.1'
+gem 'rdf-normalize', '~> 0.3.1'
+
 group :development, :test do
   gem 'fabrication', '~> 2.16'
   gem 'fuubar', '~> 2.2'
diff --git a/Gemfile.lock b/Gemfile.lock
index adc37f7de..cd4573637 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -179,6 +179,8 @@ GEM
       activesupport (>= 4.0.1)
       hamlit (>= 1.2.0)
       railties (>= 4.0.1)
+    hamster (3.0.0)
+      concurrent-ruby (~> 1.0)
     hashdiff (0.3.5)
     highline (1.7.8)
     hiredis (0.6.1)
@@ -211,6 +213,13 @@ GEM
     idn-ruby (0.1.0)
     jmespath (1.3.1)
     json (2.1.0)
+    json-ld (2.1.5)
+      multi_json (~> 1.12)
+      rdf (~> 2.2)
+    json-ld-preloaded (2.2.1)
+      json-ld (~> 2.1, >= 2.1.5)
+      multi_json (~> 1.11)
+      rdf (~> 2.2)
     jsonapi-renderer (0.1.3)
     jwt (1.5.6)
     kaminari (1.0.1)
@@ -348,6 +357,11 @@ GEM
     rainbow (2.2.2)
       rake
     rake (12.0.0)
+    rdf (2.2.8)
+      hamster (~> 3.0)
+      link_header (~> 0.0, >= 0.0.8)
+    rdf-normalize (0.3.2)
+      rdf (~> 2.0)
     redis (3.3.3)
     redis-actionpack (5.0.1)
       actionpack (>= 4.0, < 6)
@@ -531,6 +545,7 @@ DEPENDENCIES
   httplog (~> 0.99)
   i18n-tasks (~> 0.9)
   idn-ruby
+  json-ld-preloaded (~> 2.2.1)
   kaminari (~> 1.0)
   letter_opener (~> 1.4)
   letter_opener_web (~> 1.3)
@@ -560,6 +575,7 @@ DEPENDENCIES
   rails-controller-testing (~> 1.0)
   rails-i18n (~> 5.0)
   rails-settings-cached (~> 0.6)
+  rdf-normalize (~> 0.3.1)
   redis (~> 3.3)
   redis-namespace (~> 1.5)
   redis-rails (~> 5.0)
diff --git a/app/helpers/jsonld_helper.rb b/app/helpers/jsonld_helper.rb
index 8355eb055..09446c8be 100644
--- a/app/helpers/jsonld_helper.rb
+++ b/app/helpers/jsonld_helper.rb
@@ -17,6 +17,11 @@ module JsonLdHelper
     !json.nil? && equals_or_includes?(json['@context'], ActivityPub::TagManager::CONTEXT)
   end
 
+  def canonicalize(json)
+    graph = RDF::Graph.new << JSON::LD::API.toRdf(json)
+    graph.dump(:normalize)
+  end
+
   def fetch_resource(uri)
     response = build_request(uri).perform
     return if response.code != 200
@@ -29,6 +34,14 @@ module JsonLdHelper
     nil
   end
 
+  def merge_context(context, new_context)
+    if context.is_a?(Array)
+      context << new_context
+    else
+      [context, new_context]
+    end
+  end
+
   private
 
   def build_request(uri)
diff --git a/app/lib/activitypub/adapter.rb b/app/lib/activitypub/adapter.rb
index df132f019..92210579e 100644
--- a/app/lib/activitypub/adapter.rb
+++ b/app/lib/activitypub/adapter.rb
@@ -11,7 +11,7 @@ class ActivityPub::Adapter < ActiveModelSerializers::Adapter::Base
 
   def serializable_hash(options = nil)
     options = serialization_options(options)
-    serialized_hash = { '@context': ActivityPub::TagManager::CONTEXT }.merge(ActiveModelSerializers::Adapter::Attributes.new(serializer, instance_options).serializable_hash(options))
+    serialized_hash = { '@context': [ActivityPub::TagManager::CONTEXT, 'https://w3id.org/security/v1'] }.merge(ActiveModelSerializers::Adapter::Attributes.new(serializer, instance_options).serializable_hash(options))
     self.class.transform_key_casing!(serialized_hash, instance_options)
   end
 end
diff --git a/app/lib/activitypub/linked_data_signature.rb b/app/lib/activitypub/linked_data_signature.rb
new file mode 100644
index 000000000..7173aed19
--- /dev/null
+++ b/app/lib/activitypub/linked_data_signature.rb
@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+class ActivityPub::LinkedDataSignature
+  include JsonLdHelper
+
+  CONTEXT = 'https://w3id.org/identity/v1'
+
+  def initialize(json)
+    @json = json
+  end
+
+  def verify_account!
+    return unless @json['signature'].is_a?(Hash)
+
+    type        = @json['signature']['type']
+    creator_uri = @json['signature']['creator']
+    signature   = @json['signature']['signatureValue']
+
+    return unless type == 'RsaSignature2017'
+
+    creator   = ActivityPub::TagManager.instance.uri_to_resource(creator_uri, Account)
+    creator ||= ActivityPub::FetchRemoteKeyService.new.call(creator_uri)
+
+    return if creator.nil?
+
+    options_hash   = hash(@json['signature'].without('type', 'id', 'signatureValue').merge('@context' => CONTEXT))
+    document_hash  = hash(@json.without('signature'))
+    to_be_verified = options_hash + document_hash
+
+    if creator.keypair.public_key.verify(OpenSSL::Digest::SHA256.new, Base64.decode64(signature), to_be_verified)
+      creator
+    end
+  end
+
+  def sign!(creator)
+    options = {
+      'type'    => 'RsaSignature2017',
+      'creator' => [ActivityPub::TagManager.instance.uri_for(creator), '#main-key'].join,
+      'created' => Time.now.utc.iso8601,
+    }
+
+    options_hash  = hash(options.without('type', 'id', 'signatureValue').merge('@context' => CONTEXT))
+    document_hash = hash(@json.without('signature'))
+    to_be_signed  = options_hash + document_hash
+
+    signature = Base64.strict_encode64(creator.keypair.sign(OpenSSL::Digest::SHA256.new, to_be_signed))
+
+    @json.merge('@context' => merge_context(@json['@context'], CONTEXT), 'signature' => options.merge('signatureValue' => signature))
+  end
+
+  private
+
+  def hash(obj)
+    Digest::SHA256.hexdigest(canonicalize(obj))
+  end
+end
diff --git a/app/services/activitypub/process_collection_service.rb b/app/services/activitypub/process_collection_service.rb
index cd861c075..2cf15553d 100644
--- a/app/services/activitypub/process_collection_service.rb
+++ b/app/services/activitypub/process_collection_service.rb
@@ -9,6 +9,8 @@ class ActivityPub::ProcessCollectionService < BaseService
 
     return if @account.suspended? || !supported_context?
 
+    verify_account! if different_actor?
+
     case @json['type']
     when 'Collection', 'CollectionPage'
       process_items @json['items']
@@ -23,6 +25,10 @@ class ActivityPub::ProcessCollectionService < BaseService
 
   private
 
+  def different_actor?
+    @json['actor'].present? && value_or_id(@json['actor']) != @account.uri && @json['signature'].present?
+  end
+
   def process_items(items)
     items.reverse_each.map { |item| process_item(item) }.compact
   end
@@ -35,4 +41,9 @@ class ActivityPub::ProcessCollectionService < BaseService
     activity = ActivityPub::Activity.factory(item, @account)
     activity&.perform
   end
+
+  def verify_account!
+    account  = ActivityPub::LinkedDataSignature.new(@json).verify_account!
+    @account = account unless account.nil?
+  end
 end
diff --git a/app/services/authorize_follow_service.rb b/app/services/authorize_follow_service.rb
index 6f036dc5a..b1bff8962 100644
--- a/app/services/authorize_follow_service.rb
+++ b/app/services/authorize_follow_service.rb
@@ -24,11 +24,11 @@ class AuthorizeFollowService < BaseService
   end
 
   def build_json(follow_request)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       follow_request,
       serializer: ActivityPub::AcceptFollowSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(follow_request.target_account))
   end
 
   def build_xml(follow_request)
diff --git a/app/services/batched_remove_status_service.rb b/app/services/batched_remove_status_service.rb
index e6c8c9208..c90f4401d 100644
--- a/app/services/batched_remove_status_service.rb
+++ b/app/services/batched_remove_status_service.rb
@@ -138,10 +138,14 @@ class BatchedRemoveStatusService < BaseService
   def build_json(status)
     return @activity_json[status.id] if @activity_json.key?(status.id)
 
-    @activity_json[status.id] = ActiveModelSerializers::SerializableResource.new(
+    @activity_json[status.id] = sign_json(status, ActiveModelSerializers::SerializableResource.new(
       status,
       serializer: ActivityPub::DeleteSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json)
+  end
+
+  def sign_json(status, json)
+    Oj.dump(ActivityPub::LinkedDataSignature.new(json).sign!(status.account))
   end
 end
diff --git a/app/services/block_service.rb b/app/services/block_service.rb
index f2253226b..b39c3eef2 100644
--- a/app/services/block_service.rb
+++ b/app/services/block_service.rb
@@ -27,11 +27,11 @@ class BlockService < BaseService
   end
 
   def build_json(block)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       block,
       serializer: ActivityPub::BlockSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(block.account))
   end
 
   def build_xml(block)
diff --git a/app/services/favourite_service.rb b/app/services/favourite_service.rb
index 4aa935170..44df3ed13 100644
--- a/app/services/favourite_service.rb
+++ b/app/services/favourite_service.rb
@@ -34,11 +34,11 @@ class FavouriteService < BaseService
   end
 
   def build_json(favourite)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       favourite,
       serializer: ActivityPub::LikeSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(favourite.account))
   end
 
   def build_xml(favourite)
diff --git a/app/services/follow_service.rb b/app/services/follow_service.rb
index 2be625cd8..a92eb6b88 100644
--- a/app/services/follow_service.rb
+++ b/app/services/follow_service.rb
@@ -67,10 +67,10 @@ class FollowService < BaseService
   end
 
   def build_json(follow_request)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       follow_request,
       serializer: ActivityPub::FollowSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(follow_request.account))
   end
 end
diff --git a/app/services/process_mentions_service.rb b/app/services/process_mentions_service.rb
index 2b8a77147..f123bf869 100644
--- a/app/services/process_mentions_service.rb
+++ b/app/services/process_mentions_service.rb
@@ -47,11 +47,11 @@ class ProcessMentionsService < BaseService
   end
 
   def build_json(status)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       status,
       serializer: ActivityPub::ActivitySerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(status.account))
   end
 
   def follow_remote_account_service
diff --git a/app/services/reblog_service.rb b/app/services/reblog_service.rb
index 7f886af7c..5ed16c64b 100644
--- a/app/services/reblog_service.rb
+++ b/app/services/reblog_service.rb
@@ -42,10 +42,10 @@ class ReblogService < BaseService
   end
 
   def build_json(reblog)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       reblog,
       serializer: ActivityPub::ActivitySerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(reblog.account))
   end
 end
diff --git a/app/services/reject_follow_service.rb b/app/services/reject_follow_service.rb
index a91266aa4..c1f7bcb60 100644
--- a/app/services/reject_follow_service.rb
+++ b/app/services/reject_follow_service.rb
@@ -19,11 +19,11 @@ class RejectFollowService < BaseService
   end
 
   def build_json(follow_request)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       follow_request,
       serializer: ActivityPub::RejectFollowSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(follow_request.target_account))
   end
 
   def build_xml(follow_request)
diff --git a/app/services/remove_status_service.rb b/app/services/remove_status_service.rb
index fcccbaa24..62eea677f 100644
--- a/app/services/remove_status_service.rb
+++ b/app/services/remove_status_service.rb
@@ -56,7 +56,7 @@ class RemoveStatusService < BaseService
 
     # ActivityPub
     ActivityPub::DeliveryWorker.push_bulk(target_accounts.select(&:activitypub?).uniq(&:inbox_url)) do |inbox_url|
-      [activity_json, @account.id, inbox_url]
+      [signed_activity_json, @account.id, inbox_url]
     end
   end
 
@@ -66,7 +66,7 @@ class RemoveStatusService < BaseService
 
     # ActivityPub
     ActivityPub::DeliveryWorker.push_bulk(@account.followers.inboxes) do |inbox_url|
-      [activity_json, @account.id, inbox_url]
+      [signed_activity_json, @account.id, inbox_url]
     end
   end
 
@@ -74,12 +74,16 @@ class RemoveStatusService < BaseService
     @salmon_xml ||= stream_entry_to_xml(@stream_entry)
   end
 
+  def signed_activity_json
+    @signed_activity_json ||= Oj.dump(ActivityPub::LinkedDataSignature.new(activity_json).sign!(@account))
+  end
+
   def activity_json
     @activity_json ||= ActiveModelSerializers::SerializableResource.new(
       @status,
       serializer: ActivityPub::DeleteSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json
   end
 
   def remove_reblogs
diff --git a/app/services/unblock_service.rb b/app/services/unblock_service.rb
index 72fc5ab15..869f62d1c 100644
--- a/app/services/unblock_service.rb
+++ b/app/services/unblock_service.rb
@@ -20,11 +20,11 @@ class UnblockService < BaseService
   end
 
   def build_json(unblock)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       unblock,
       serializer: ActivityPub::UndoBlockSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(unblock.account))
   end
 
   def build_xml(block)
diff --git a/app/services/unfavourite_service.rb b/app/services/unfavourite_service.rb
index e53798e66..2fda11bd6 100644
--- a/app/services/unfavourite_service.rb
+++ b/app/services/unfavourite_service.rb
@@ -21,11 +21,11 @@ class UnfavouriteService < BaseService
   end
 
   def build_json(favourite)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       favourite,
       serializer: ActivityPub::UndoLikeSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(favourite.account))
   end
 
   def build_xml(favourite)
diff --git a/app/services/unfollow_service.rb b/app/services/unfollow_service.rb
index 10af75146..bf151ee28 100644
--- a/app/services/unfollow_service.rb
+++ b/app/services/unfollow_service.rb
@@ -23,11 +23,11 @@ class UnfollowService < BaseService
   end
 
   def build_json(follow)
-    ActiveModelSerializers::SerializableResource.new(
+    Oj.dump(ActivityPub::LinkedDataSignature.new(ActiveModelSerializers::SerializableResource.new(
       follow,
       serializer: ActivityPub::UndoFollowSerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json).sign!(follow.account))
   end
 
   def build_xml(follow)
diff --git a/app/workers/activitypub/distribution_worker.rb b/app/workers/activitypub/distribution_worker.rb
index 004dd25d1..14bb933c0 100644
--- a/app/workers/activitypub/distribution_worker.rb
+++ b/app/workers/activitypub/distribution_worker.rb
@@ -12,7 +12,7 @@ class ActivityPub::DistributionWorker
     return if skip_distribution?
 
     ActivityPub::DeliveryWorker.push_bulk(inboxes) do |inbox_url|
-      [payload, @account.id, inbox_url]
+      [signed_payload, @account.id, inbox_url]
     end
   rescue ActiveRecord::RecordNotFound
     true
@@ -28,11 +28,15 @@ class ActivityPub::DistributionWorker
     @inboxes ||= @account.followers.inboxes
   end
 
+  def signed_payload
+    @signed_payload ||= Oj.dump(ActivityPub::LinkedDataSignature.new(payload).sign!(@account))
+  end
+
   def payload
     @payload ||= ActiveModelSerializers::SerializableResource.new(
       @status,
       serializer: ActivityPub::ActivitySerializer,
       adapter: ActivityPub::Adapter
-    ).to_json
+    ).as_json
   end
 end
diff --git a/config/initializers/json_ld.rb b/config/initializers/json_ld.rb
new file mode 100644
index 000000000..408e6490d
--- /dev/null
+++ b/config/initializers/json_ld.rb
@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require_relative '../../lib/json_ld/identity'
+require_relative '../../lib/json_ld/security'
diff --git a/lib/json_ld/identity.rb b/lib/json_ld/identity.rb
new file mode 100644
index 000000000..cfe50b956
--- /dev/null
+++ b/lib/json_ld/identity.rb
@@ -0,0 +1,86 @@
+# -*- encoding: utf-8 -*-
+# frozen_string_literal: true
+# This file generated automatically from https://w3id.org/identity/v1
+require 'json/ld'
+class JSON::LD::Context
+  add_preloaded("https://w3id.org/identity/v1") do
+    new(processingMode: "json-ld-1.0", term_definitions: {
+      "Credential" => TermDefinition.new("Credential", id: "https://w3id.org/credentials#Credential", simple: true),
+      "CryptographicKey" => TermDefinition.new("CryptographicKey", id: "https://w3id.org/security#Key", simple: true),
+      "CryptographicKeyCredential" => TermDefinition.new("CryptographicKeyCredential", id: "https://w3id.org/credentials#CryptographicKeyCredential", simple: true),
+      "EncryptedMessage" => TermDefinition.new("EncryptedMessage", id: "https://w3id.org/security#EncryptedMessage", simple: true),
+      "GraphSignature2012" => TermDefinition.new("GraphSignature2012", id: "https://w3id.org/security#GraphSignature2012", simple: true),
+      "Group" => TermDefinition.new("Group", id: "https://www.w3.org/ns/activitystreams#Group", simple: true),
+      "Identity" => TermDefinition.new("Identity", id: "https://w3id.org/identity#Identity", simple: true),
+      "LinkedDataSignature2015" => TermDefinition.new("LinkedDataSignature2015", id: "https://w3id.org/security#LinkedDataSignature2015", simple: true),
+      "Organization" => TermDefinition.new("Organization", id: "http://schema.org/Organization", simple: true),
+      "Person" => TermDefinition.new("Person", id: "http://schema.org/Person", simple: true),
+      "PostalAddress" => TermDefinition.new("PostalAddress", id: "http://schema.org/PostalAddress", simple: true),
+      "about" => TermDefinition.new("about", id: "http://schema.org/about", type_mapping: "@id"),
+      "accessControl" => TermDefinition.new("accessControl", id: "https://w3id.org/permissions#accessControl", type_mapping: "@id"),
+      "address" => TermDefinition.new("address", id: "http://schema.org/address", type_mapping: "@id"),
+      "addressCountry" => TermDefinition.new("addressCountry", id: "http://schema.org/addressCountry", simple: true),
+      "addressLocality" => TermDefinition.new("addressLocality", id: "http://schema.org/addressLocality", simple: true),
+      "addressRegion" => TermDefinition.new("addressRegion", id: "http://schema.org/addressRegion", simple: true),
+      "cipherAlgorithm" => TermDefinition.new("cipherAlgorithm", id: "https://w3id.org/security#cipherAlgorithm", simple: true),
+      "cipherData" => TermDefinition.new("cipherData", id: "https://w3id.org/security#cipherData", simple: true),
+      "cipherKey" => TermDefinition.new("cipherKey", id: "https://w3id.org/security#cipherKey", simple: true),
+      "claim" => TermDefinition.new("claim", id: "https://w3id.org/credentials#claim", type_mapping: "@id"),
+      "comment" => TermDefinition.new("comment", id: "http://www.w3.org/2000/01/rdf-schema#comment", simple: true),
+      "created" => TermDefinition.new("created", id: "http://purl.org/dc/terms/created", type_mapping: "http://www.w3.org/2001/XMLSchema#dateTime"),
+      "creator" => TermDefinition.new("creator", id: "http://purl.org/dc/terms/creator", type_mapping: "@id"),
+      "cred" => TermDefinition.new("cred", id: "https://w3id.org/credentials#", simple: true, prefix: true),
+      "credential" => TermDefinition.new("credential", id: "https://w3id.org/credentials#credential", type_mapping: "@id"),
+      "dc" => TermDefinition.new("dc", id: "http://purl.org/dc/terms/", simple: true, prefix: true),
+      "description" => TermDefinition.new("description", id: "http://schema.org/description", simple: true),
+      "digestAlgorithm" => TermDefinition.new("digestAlgorithm", id: "https://w3id.org/security#digestAlgorithm", simple: true),
+      "digestValue" => TermDefinition.new("digestValue", id: "https://w3id.org/security#digestValue", simple: true),
+      "domain" => TermDefinition.new("domain", id: "https://w3id.org/security#domain", simple: true),
+      "email" => TermDefinition.new("email", id: "http://schema.org/email", simple: true),
+      "expires" => TermDefinition.new("expires", id: "https://w3id.org/security#expiration", type_mapping: "http://www.w3.org/2001/XMLSchema#dateTime"),
+      "familyName" => TermDefinition.new("familyName", id: "http://schema.org/familyName", simple: true),
+      "givenName" => TermDefinition.new("givenName", id: "http://schema.org/givenName", simple: true),
+      "id" => TermDefinition.new("id", id: "@id", simple: true),
+      "identity" => TermDefinition.new("identity", id: "https://w3id.org/identity#", simple: true, prefix: true),
+      "identityService" => TermDefinition.new("identityService", id: "https://w3id.org/identity#identityService", type_mapping: "@id"),
+      "idp" => TermDefinition.new("idp", id: "https://w3id.org/identity#idp", type_mapping: "@id"),
+      "image" => TermDefinition.new("image", id: "http://schema.org/image", type_mapping: "@id"),
+      "initializationVector" => TermDefinition.new("initializationVector", id: "https://w3id.org/security#initializationVector", simple: true),
+      "issued" => TermDefinition.new("issued", id: "https://w3id.org/credentials#issued", type_mapping: "http://www.w3.org/2001/XMLSchema#dateTime"),
+      "issuer" => TermDefinition.new("issuer", id: "https://w3id.org/credentials#issuer", type_mapping: "@id"),
+      "label" => TermDefinition.new("label", id: "http://www.w3.org/2000/01/rdf-schema#label", simple: true),
+      "member" => TermDefinition.new("member", id: "http://schema.org/member", type_mapping: "@id"),
+      "memberOf" => TermDefinition.new("memberOf", id: "http://schema.org/memberOf", type_mapping: "@id"),
+      "name" => TermDefinition.new("name", id: "http://schema.org/name", simple: true),
+      "nonce" => TermDefinition.new("nonce", id: "https://w3id.org/security#nonce", simple: true),
+      "normalizationAlgorithm" => TermDefinition.new("normalizationAlgorithm", id: "https://w3id.org/security#normalizationAlgorithm", simple: true),
+      "owner" => TermDefinition.new("owner", id: "https://w3id.org/security#owner", type_mapping: "@id"),
+      "password" => TermDefinition.new("password", id: "https://w3id.org/security#password", simple: true),
+      "paymentProcessor" => TermDefinition.new("paymentProcessor", id: "https://w3id.org/payswarm#processor", simple: true),
+      "perm" => TermDefinition.new("perm", id: "https://w3id.org/permissions#", simple: true, prefix: true),
+      "postalCode" => TermDefinition.new("postalCode", id: "http://schema.org/postalCode", simple: true),
+      "preferences" => TermDefinition.new("preferences", id: "https://w3id.org/payswarm#preferences", type_mapping: "@vocab"),
+      "privateKey" => TermDefinition.new("privateKey", id: "https://w3id.org/security#privateKey", type_mapping: "@id"),
+      "privateKeyPem" => TermDefinition.new("privateKeyPem", id: "https://w3id.org/security#privateKeyPem", simple: true),
+      "ps" => TermDefinition.new("ps", id: "https://w3id.org/payswarm#", simple: true, prefix: true),
+      "publicKey" => TermDefinition.new("publicKey", id: "https://w3id.org/security#publicKey", type_mapping: "@id"),
+      "publicKeyPem" => TermDefinition.new("publicKeyPem", id: "https://w3id.org/security#publicKeyPem", simple: true),
+      "publicKeyService" => TermDefinition.new("publicKeyService", id: "https://w3id.org/security#publicKeyService", type_mapping: "@id"),
+      "rdf" => TermDefinition.new("rdf", id: "http://www.w3.org/1999/02/22-rdf-syntax-ns#", simple: true, prefix: true),
+      "rdfs" => TermDefinition.new("rdfs", id: "http://www.w3.org/2000/01/rdf-schema#", simple: true, prefix: true),
+      "recipient" => TermDefinition.new("recipient", id: "https://w3id.org/credentials#recipient", type_mapping: "@id"),
+      "revoked" => TermDefinition.new("revoked", id: "https://w3id.org/security#revoked", type_mapping: "http://www.w3.org/2001/XMLSchema#dateTime"),
+      "schema" => TermDefinition.new("schema", id: "http://schema.org/", simple: true, prefix: true),
+      "sec" => TermDefinition.new("sec", id: "https://w3id.org/security#", simple: true, prefix: true),
+      "signature" => TermDefinition.new("signature", id: "https://w3id.org/security#signature", simple: true),
+      "signatureAlgorithm" => TermDefinition.new("signatureAlgorithm", id: "https://w3id.org/security#signatureAlgorithm", simple: true),
+      "signatureValue" => TermDefinition.new("signatureValue", id: "https://w3id.org/security#signatureValue", simple: true),
+      "streetAddress" => TermDefinition.new("streetAddress", id: "http://schema.org/streetAddress", simple: true),
+      "title" => TermDefinition.new("title", id: "http://purl.org/dc/terms/title", simple: true),
+      "type" => TermDefinition.new("type", id: "@type", simple: true),
+      "url" => TermDefinition.new("url", id: "http://schema.org/url", type_mapping: "@id"),
+      "writePermission" => TermDefinition.new("writePermission", id: "https://w3id.org/permissions#writePermission", type_mapping: "@id"),
+      "xsd" => TermDefinition.new("xsd", id: "http://www.w3.org/2001/XMLSchema#", simple: true, prefix: true)
+    })
+  end
+end
diff --git a/lib/json_ld/security.rb b/lib/json_ld/security.rb
new file mode 100644
index 000000000..1230206f0
--- /dev/null
+++ b/lib/json_ld/security.rb
@@ -0,0 +1,50 @@
+# -*- encoding: utf-8 -*-
+# frozen_string_literal: true
+# This file generated automatically from https://w3id.org/security/v1
+require 'json/ld'
+class JSON::LD::Context
+  add_preloaded("https://w3id.org/security/v1") do
+    new(processingMode: "json-ld-1.0", term_definitions: {
+      "CryptographicKey" => TermDefinition.new("CryptographicKey", id: "https://w3id.org/security#Key", simple: true),
+      "EcdsaKoblitzSignature2016" => TermDefinition.new("EcdsaKoblitzSignature2016", id: "https://w3id.org/security#EcdsaKoblitzSignature2016", simple: true),
+      "EncryptedMessage" => TermDefinition.new("EncryptedMessage", id: "https://w3id.org/security#EncryptedMessage", simple: true),
+      "GraphSignature2012" => TermDefinition.new("GraphSignature2012", id: "https://w3id.org/security#GraphSignature2012", simple: true),
+      "LinkedDataSignature2015" => TermDefinition.new("LinkedDataSignature2015", id: "https://w3id.org/security#LinkedDataSignature2015", simple: true),
+      "LinkedDataSignature2016" => TermDefinition.new("LinkedDataSignature2016", id: "https://w3id.org/security#LinkedDataSignature2016", simple: true),
+      "authenticationTag" => TermDefinition.new("authenticationTag", id: "https://w3id.org/security#authenticationTag", simple: true),
+      "canonicalizationAlgorithm" => TermDefinition.new("canonicalizationAlgorithm", id: "https://w3id.org/security#canonicalizationAlgorithm", simple: true),
+      "cipherAlgorithm" => TermDefinition.new("cipherAlgorithm", id: "https://w3id.org/security#cipherAlgorithm", simple: true),
+      "cipherData" => TermDefinition.new("cipherData", id: "https://w3id.org/security#cipherData", simple: true),
+      "cipherKey" => TermDefinition.new("cipherKey", id: "https://w3id.org/security#cipherKey", simple: true),
+      "created" => TermDefinition.new("created", id: "http://purl.org/dc/terms/created", type_mapping: "http://www.w3.org/2001/XMLSchema#dateTime"),
+      "creator" => TermDefinition.new("creator", id: "http://purl.org/dc/terms/creator", type_mapping: "@id"),
+      "dc" => TermDefinition.new("dc", id: "http://purl.org/dc/terms/", simple: true, prefix: true),
+      "digestAlgorithm" => TermDefinition.new("digestAlgorithm", id: "https://w3id.org/security#digestAlgorithm", simple: true),
+      "digestValue" => TermDefinition.new("digestValue", id: "https://w3id.org/security#digestValue", simple: true),
+      "domain" => TermDefinition.new("domain", id: "https://w3id.org/security#domain", simple: true),
+      "encryptionKey" => TermDefinition.new("encryptionKey", id: "https://w3id.org/security#encryptionKey", simple: true),
+      "expiration" => TermDefinition.new("expiration", id: "https://w3id.org/security#expiration", type_mapping: "http://www.w3.org/2001/XMLSchema#dateTime"),
+      "expires" => TermDefinition.new("expires", id: "https://w3id.org/security#expiration", type_mapping: "http://www.w3.org/2001/XMLSchema#dateTime"),
+      "id" => TermDefinition.new("id", id: "@id", simple: true),
+      "initializationVector" => TermDefinition.new("initializationVector", id: "https://w3id.org/security#initializationVector", simple: true),
+      "iterationCount" => TermDefinition.new("iterationCount", id: "https://w3id.org/security#iterationCount", simple: true),
+      "nonce" => TermDefinition.new("nonce", id: "https://w3id.org/security#nonce", simple: true),
+      "normalizationAlgorithm" => TermDefinition.new("normalizationAlgorithm", id: "https://w3id.org/security#normalizationAlgorithm", simple: true),
+      "owner" => TermDefinition.new("owner", id: "https://w3id.org/security#owner", type_mapping: "@id"),
+      "password" => TermDefinition.new("password", id: "https://w3id.org/security#password", simple: true),
+      "privateKey" => TermDefinition.new("privateKey", id: "https://w3id.org/security#privateKey", type_mapping: "@id"),
+      "privateKeyPem" => TermDefinition.new("privateKeyPem", id: "https://w3id.org/security#privateKeyPem", simple: true),
+      "publicKey" => TermDefinition.new("publicKey", id: "https://w3id.org/security#publicKey", type_mapping: "@id"),
+      "publicKeyPem" => TermDefinition.new("publicKeyPem", id: "https://w3id.org/security#publicKeyPem", simple: true),
+      "publicKeyService" => TermDefinition.new("publicKeyService", id: "https://w3id.org/security#publicKeyService", type_mapping: "@id"),
+      "revoked" => TermDefinition.new("revoked", id: "https://w3id.org/security#revoked", type_mapping: "http://www.w3.org/2001/XMLSchema#dateTime"),
+      "salt" => TermDefinition.new("salt", id: "https://w3id.org/security#salt", simple: true),
+      "sec" => TermDefinition.new("sec", id: "https://w3id.org/security#", simple: true, prefix: true),
+      "signature" => TermDefinition.new("signature", id: "https://w3id.org/security#signature", simple: true),
+      "signatureAlgorithm" => TermDefinition.new("signatureAlgorithm", id: "https://w3id.org/security#signingAlgorithm", simple: true),
+      "signatureValue" => TermDefinition.new("signatureValue", id: "https://w3id.org/security#signatureValue", simple: true),
+      "type" => TermDefinition.new("type", id: "@type", simple: true),
+      "xsd" => TermDefinition.new("xsd", id: "http://www.w3.org/2001/XMLSchema#", simple: true, prefix: true)
+    })
+  end
+end
diff --git a/spec/lib/activitypub/linked_data_signature_spec.rb b/spec/lib/activitypub/linked_data_signature_spec.rb
new file mode 100644
index 000000000..ee4b68028
--- /dev/null
+++ b/spec/lib/activitypub/linked_data_signature_spec.rb
@@ -0,0 +1,86 @@
+require 'rails_helper'
+
+RSpec.describe ActivityPub::LinkedDataSignature do
+  include JsonLdHelper
+
+  let!(:sender) { Fabricate(:account, uri: 'http://example.com/alice') }
+
+  let(:raw_json) do
+    {
+      '@context' => 'https://www.w3.org/ns/activitystreams',
+      'id' => 'http://example.com/hello-world',
+    }
+  end
+
+  let(:json) { raw_json.merge('signature' => signature) }
+
+  subject { described_class.new(json) }
+
+  describe '#verify_account!' do
+    context 'when signature matches' do
+      let(:raw_signature) do
+        {
+          'creator' => 'http://example.com/alice',
+          'created' => '2017-09-23T20:21:34Z',
+        }
+      end
+
+      let(:signature) { raw_signature.merge('type' => 'RsaSignature2017', 'signatureValue' => sign(sender, raw_signature, raw_json)) }
+
+      it 'returns creator' do
+        expect(subject.verify_account!).to eq sender
+      end
+    end
+
+    context 'when signature is missing' do
+      let(:signature) { nil }
+
+      it 'returns nil' do
+        expect(subject.verify_account!).to be_nil
+      end
+    end
+
+    context 'when signature is tampered' do
+      let(:raw_signature) do
+        {
+          'creator' => 'http://example.com/alice',
+          'created' => '2017-09-23T20:21:34Z',
+        }
+      end
+
+      let(:signature) { raw_signature.merge('type' => 'RsaSignature2017', 'signatureValue' => 's69F3mfddd99dGjmvjdjjs81e12jn121Gkm1') }
+
+      it 'returns nil' do
+        expect(subject.verify_account!).to be_nil
+      end
+    end
+  end
+
+  describe '#sign!' do
+    subject { described_class.new(raw_json).sign!(sender) }
+
+    it 'returns a hash' do
+      expect(subject).to be_a Hash
+    end
+
+    it 'contains signature context' do
+      expect(subject['@context']).to include('https://www.w3.org/ns/activitystreams', 'https://w3id.org/identity/v1')
+    end
+
+    it 'contains signature' do
+      expect(subject['signature']).to be_a Hash
+      expect(subject['signature']['signatureValue']).to be_present
+    end
+
+    it 'can be verified again' do
+      expect(described_class.new(subject).verify_account!).to eq sender
+    end
+  end
+
+  def sign(from_account, options, document)
+    options_hash   = Digest::SHA256.hexdigest(canonicalize(options.merge('@context' => ActivityPub::LinkedDataSignature::CONTEXT)))
+    document_hash  = Digest::SHA256.hexdigest(canonicalize(document))
+    to_be_verified = options_hash + document_hash
+    Base64.strict_encode64(from_account.keypair.sign(OpenSSL::Digest::SHA256.new, to_be_verified))
+  end
+end
diff --git a/spec/services/activitypub/process_collection_service_spec.rb b/spec/services/activitypub/process_collection_service_spec.rb
index 6486483f6..bf3bc82aa 100644
--- a/spec/services/activitypub/process_collection_service_spec.rb
+++ b/spec/services/activitypub/process_collection_service_spec.rb
@@ -1,9 +1,10 @@
 require 'rails_helper'
 
 RSpec.describe ActivityPub::ProcessCollectionService do
-  subject { ActivityPub::ProcessCollectionService.new }
+  subject { described_class.new }
 
   describe '#call' do
-    pending
+    context 'when actor is the sender'
+    context 'when actor differs from sender'
   end
 end
-- 
cgit 


From 0d5d11eeff048a5022a6eef68d299856f5bb9860 Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sat, 26 Aug 2017 19:55:10 +0200
Subject: Add _:inReplyToAtomUri to ActivityPub (#4702)

---
 app/helpers/jsonld_helper.rb                       |  2 +-
 app/lib/activitypub/activity/create.rb             | 17 ++++++++++++++---
 app/serializers/activitypub/activity_serializer.rb |  6 +++++-
 app/serializers/activitypub/note_serializer.rb     |  7 +++++++
 4 files changed, 27 insertions(+), 5 deletions(-)

(limited to 'app/helpers')

diff --git a/app/helpers/jsonld_helper.rb b/app/helpers/jsonld_helper.rb
index 09446c8be..d82a07332 100644
--- a/app/helpers/jsonld_helper.rb
+++ b/app/helpers/jsonld_helper.rb
@@ -10,7 +10,7 @@ module JsonLdHelper
   end
 
   def value_or_id(value)
-    value.is_a?(String) ? value : value['id']
+    value.is_a?(String) || value.nil? ? value : value['id']
   end
 
   def supported_context?(json)
diff --git a/app/lib/activitypub/activity/create.rb b/app/lib/activitypub/activity/create.rb
index 5c59c4b24..114aed84f 100644
--- a/app/lib/activitypub/activity/create.rb
+++ b/app/lib/activitypub/activity/create.rb
@@ -91,7 +91,7 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
 
   def resolve_thread(status)
     return unless status.reply? && status.thread.nil?
-    ThreadResolveWorker.perform_async(status.id, @object['inReplyTo'])
+    ThreadResolveWorker.perform_async(status.id, in_reply_to_uri)
   end
 
   def conversation_from_uri(uri)
@@ -118,8 +118,19 @@ class ActivityPub::Activity::Create < ActivityPub::Activity
   end
 
   def replied_to_status
-    return if @object['inReplyTo'].blank?
-    @replied_to_status ||= status_from_uri(@object['inReplyTo'])
+    return @replied_to_status if defined?(@replied_to_status)
+
+    if in_reply_to_uri.blank?
+      @replied_to_status = nil
+    else
+      @replied_to_status   = status_from_uri(in_reply_to_uri)
+      @replied_to_status ||= status_from_uri(@object['_:inReplyToAtomUri']) if @object['_:inReplyToAtomUri'].present?
+      @replied_to_status
+    end
+  end
+
+  def in_reply_to_uri
+    value_or_id(@object['inReplyTo'])
   end
 
   def text_from_content
diff --git a/app/serializers/activitypub/activity_serializer.rb b/app/serializers/activitypub/activity_serializer.rb
index d20ee9920..349495e84 100644
--- a/app/serializers/activitypub/activity_serializer.rb
+++ b/app/serializers/activitypub/activity_serializer.rb
@@ -10,7 +10,7 @@ class ActivityPub::ActivitySerializer < ActiveModel::Serializer
   end
 
   def type
-    object.reblog? ? 'Announce' : 'Create'
+    announce? ? 'Announce' : 'Create'
   end
 
   def actor
@@ -24,4 +24,8 @@ class ActivityPub::ActivitySerializer < ActiveModel::Serializer
   def cc
     ActivityPub::TagManager.instance.cc(object)
   end
+
+  def announce?
+    object.reblog?
+  end
 end
diff --git a/app/serializers/activitypub/note_serializer.rb b/app/serializers/activitypub/note_serializer.rb
index 4061b9ce4..15031dfdc 100644
--- a/app/serializers/activitypub/note_serializer.rb
+++ b/app/serializers/activitypub/note_serializer.rb
@@ -9,6 +9,7 @@ class ActivityPub::NoteSerializer < ActiveModel::Serializer
   has_many :virtual_tags, key: :tag
 
   attribute :atom_uri, key: '_:atomUri', if: :local?
+  attribute :in_reply_to_atom_uri, key: '_:inReplyToAtomUri'
 
   def id
     ActivityPub::TagManager.instance.uri_for(object)
@@ -64,6 +65,12 @@ class ActivityPub::NoteSerializer < ActiveModel::Serializer
     ::TagManager.instance.uri_for(object)
   end
 
+  def in_reply_to_atom_uri
+    return unless object.reply?
+
+    ::TagManager.instance.uri_for(object.thread)
+  end
+
   def local?
     object.account.local?
   end
-- 
cgit 


From e95bdec7c5da63930fc2e08e67e4358fec19296d Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Wed, 30 Aug 2017 10:23:43 +0200
Subject: Update status embeds (#4742)

- Use statuses controller for embeds instead of stream entries controller
- Prefer /@:username/:id/embed URL for embeds
- Use /@:username as author_url in OEmbed
- Add follow link to embeds which opens web intent in new window
- Use redis cache in development
- Cache entire embed
---
 app/controllers/api/oembed_controller.rb           |  8 ++--
 app/controllers/statuses_controller.rb             |  5 ++
 app/controllers/stream_entries_controller.rb       |  5 +-
 app/helpers/stream_entries_helper.rb               |  2 +-
 app/javascript/packs/public.js                     |  7 +++
 app/javascript/styles/stream_entries.scss          | 30 ++++++++++++
 app/lib/status_finder.rb                           | 34 +++++++++++++
 app/lib/stream_entry_finder.rb                     | 34 -------------
 app/serializers/oembed_serializer.rb               |  4 +-
 .../stream_entries/_detailed_status.html.haml      |  5 ++
 app/views/stream_entries/embed.html.haml           |  5 +-
 config/brakeman.ignore                             | 50 ++++++++++----------
 config/environments/development.rb                 |  5 +-
 config/routes.rb                                   |  2 +
 spec/controllers/stream_entries_controller_spec.rb |  6 +--
 spec/lib/status_finder_spec.rb                     | 55 ++++++++++++++++++++++
 spec/lib/stream_entry_finder_spec.rb               | 55 ----------------------
 17 files changed, 179 insertions(+), 133 deletions(-)
 create mode 100644 app/lib/status_finder.rb
 delete mode 100644 app/lib/stream_entry_finder.rb
 create mode 100644 spec/lib/status_finder_spec.rb
 delete mode 100644 spec/lib/stream_entry_finder_spec.rb

(limited to 'app/helpers')

diff --git a/app/controllers/api/oembed_controller.rb b/app/controllers/api/oembed_controller.rb
index f8c87dd16..37a163cd3 100644
--- a/app/controllers/api/oembed_controller.rb
+++ b/app/controllers/api/oembed_controller.rb
@@ -4,14 +4,14 @@ class Api::OEmbedController < Api::BaseController
   respond_to :json
 
   def show
-    @stream_entry = find_stream_entry.stream_entry
-    render json: @stream_entry, serializer: OEmbedSerializer, width: maxwidth_or_default, height: maxheight_or_default
+    @status = status_finder.status
+    render json: @status, serializer: OEmbedSerializer, width: maxwidth_or_default, height: maxheight_or_default
   end
 
   private
 
-  def find_stream_entry
-    StreamEntryFinder.new(params[:url])
+  def status_finder
+    StatusFinder.new(params[:url])
   end
 
   def maxwidth_or_default
diff --git a/app/controllers/statuses_controller.rb b/app/controllers/statuses_controller.rb
index a9768d092..65206ea96 100644
--- a/app/controllers/statuses_controller.rb
+++ b/app/controllers/statuses_controller.rb
@@ -30,6 +30,11 @@ class StatusesController < ApplicationController
     render json: @status, serializer: ActivityPub::ActivitySerializer, adapter: ActivityPub::Adapter, content_type: 'application/activity+json'
   end
 
+  def embed
+    response.headers['X-Frame-Options'] = 'ALLOWALL'
+    render 'stream_entries/embed', layout: 'embedded'
+  end
+
   private
 
   def set_account
diff --git a/app/controllers/stream_entries_controller.rb b/app/controllers/stream_entries_controller.rb
index ccb15495e..cc579dbc8 100644
--- a/app/controllers/stream_entries_controller.rb
+++ b/app/controllers/stream_entries_controller.rb
@@ -25,10 +25,7 @@ class StreamEntriesController < ApplicationController
   end
 
   def embed
-    response.headers['X-Frame-Options'] = 'ALLOWALL'
-    return gone if @stream_entry.activity.nil?
-
-    render layout: 'embedded'
+    redirect_to embed_short_account_status_url(@account, @stream_entry.activity), status: 301
   end
 
   private
diff --git a/app/helpers/stream_entries_helper.rb b/app/helpers/stream_entries_helper.rb
index 4ef7cffb0..445114985 100644
--- a/app/helpers/stream_entries_helper.rb
+++ b/app/helpers/stream_entries_helper.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module StreamEntriesHelper
-  EMBEDDED_CONTROLLER = 'stream_entries'
+  EMBEDDED_CONTROLLER = 'statuses'
   EMBEDDED_ACTION = 'embed'
 
   def display_name(account)
diff --git a/app/javascript/packs/public.js b/app/javascript/packs/public.js
index d8a0f4eee..ce12041e6 100644
--- a/app/javascript/packs/public.js
+++ b/app/javascript/packs/public.js
@@ -38,6 +38,13 @@ function main() {
       content.title = dateTimeFormat.format(datetime);
       content.textContent = relativeFormat.format(datetime);
     });
+
+    [].forEach.call(document.querySelectorAll('.logo-button'), (content) => {
+      content.addEventListener('click', (e) => {
+        e.preventDefault();
+        window.open(e.target.href, 'mastodon-intent', 'width=400,height=400,resizable=no,menubar=no,status=no,scrollbars=yes');
+      });
+    });
   });
 
   delegate(document, '.video-player video', 'click', ({ target }) => {
diff --git a/app/javascript/styles/stream_entries.scss b/app/javascript/styles/stream_entries.scss
index 1192e2a80..7048ab110 100644
--- a/app/javascript/styles/stream_entries.scss
+++ b/app/javascript/styles/stream_entries.scss
@@ -421,3 +421,33 @@
     }
   }
 }
+
+.button.button-secondary.logo-button {
+  position: absolute;
+  right: 14px;
+  top: 14px;
+  font-size: 14px;
+
+  svg {
+    width: 20px;
+    height: auto;
+    vertical-align: middle;
+    margin-right: 5px;
+
+    path:first-child {
+      fill: $ui-primary-color;
+    }
+
+    path:last-child {
+      fill: $simple-background-color;
+    }
+  }
+
+  &:active,
+  &:focus,
+  &:hover {
+    svg path:first-child {
+      fill: lighten($ui-primary-color, 4%);
+    }
+  }
+}
diff --git a/app/lib/status_finder.rb b/app/lib/status_finder.rb
new file mode 100644
index 000000000..bd910f12b
--- /dev/null
+++ b/app/lib/status_finder.rb
@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+class StatusFinder
+  attr_reader :url
+
+  def initialize(url)
+    @url = url
+  end
+
+  def status
+    verify_action!
+
+    case recognized_params[:controller]
+    when 'stream_entries'
+      StreamEntry.find(recognized_params[:id]).status
+    when 'statuses'
+      Status.find(recognized_params[:id])
+    else
+      raise ActiveRecord::RecordNotFound
+    end
+  end
+
+  private
+
+  def recognized_params
+    Rails.application.routes.recognize_path(url)
+  end
+
+  def verify_action!
+    unless recognized_params[:action] == 'show'
+      raise ActiveRecord::RecordNotFound
+    end
+  end
+end
diff --git a/app/lib/stream_entry_finder.rb b/app/lib/stream_entry_finder.rb
deleted file mode 100644
index 0ea33229c..000000000
--- a/app/lib/stream_entry_finder.rb
+++ /dev/null
@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-
-class StreamEntryFinder
-  attr_reader :url
-
-  def initialize(url)
-    @url = url
-  end
-
-  def stream_entry
-    verify_action!
-
-    case recognized_params[:controller]
-    when 'stream_entries'
-      StreamEntry.find(recognized_params[:id])
-    when 'statuses'
-      Status.find(recognized_params[:id]).stream_entry
-    else
-      raise ActiveRecord::RecordNotFound
-    end
-  end
-
-  private
-
-  def recognized_params
-    Rails.application.routes.recognize_path(url)
-  end
-
-  def verify_action!
-    unless recognized_params[:action] == 'show'
-      raise ActiveRecord::RecordNotFound
-    end
-  end
-end
diff --git a/app/serializers/oembed_serializer.rb b/app/serializers/oembed_serializer.rb
index 78376d253..0c2ced859 100644
--- a/app/serializers/oembed_serializer.rb
+++ b/app/serializers/oembed_serializer.rb
@@ -21,7 +21,7 @@ class OEmbedSerializer < ActiveModel::Serializer
   end
 
   def author_url
-    account_url(object.account)
+    short_account_url(object.account)
   end
 
   def provider_name
@@ -38,7 +38,7 @@ class OEmbedSerializer < ActiveModel::Serializer
 
   def html
     tag :iframe,
-        src: embed_account_stream_entry_url(object.account, object),
+        src: embed_short_account_status_url(object.account, object),
         style: 'width: 100%; overflow: hidden',
         frameborder: '0',
         scrolling: 'no',
diff --git a/app/views/stream_entries/_detailed_status.html.haml b/app/views/stream_entries/_detailed_status.html.haml
index 193cc6470..107202b75 100644
--- a/app/views/stream_entries/_detailed_status.html.haml
+++ b/app/views/stream_entries/_detailed_status.html.haml
@@ -1,4 +1,9 @@
 .detailed-status.light
+  - if embedded_view?
+    = link_to "web+mastodon://follow?uri=#{status.account.local_username_and_domain}", class: 'button button-secondary logo-button', target: '_new' do
+      = render file: Rails.root.join('app', 'javascript', 'images', 'logo.svg')
+      = t('accounts.follow')
+
   = link_to TagManager.instance.url_for(status.account), class: 'detailed-status__display-name p-author h-card', target: stream_link_target, rel: 'noopener' do
     %div
       .avatar
diff --git a/app/views/stream_entries/embed.html.haml b/app/views/stream_entries/embed.html.haml
index 5df82528b..b703c15d2 100644
--- a/app/views/stream_entries/embed.html.haml
+++ b/app/views/stream_entries/embed.html.haml
@@ -1,2 +1,3 @@
-.activity-stream.activity-stream-headless
-  = render @type, @type.to_sym => @stream_entry.activity, centered: true
+- cache @stream_entry.activity do
+  .activity-stream.activity-stream-headless
+    = render "stream_entries/#{@type}", @type.to_sym => @stream_entry.activity, centered: true
diff --git a/config/brakeman.ignore b/config/brakeman.ignore
index f9bc77069..dbb59dd07 100644
--- a/config/brakeman.ignore
+++ b/config/brakeman.ignore
@@ -1,5 +1,24 @@
 {
   "ignored_warnings": [
+    {
+      "warning_type": "Dynamic Render Path",
+      "warning_code": 15,
+      "fingerprint": "44d3f14e05d8fbb5b23e13ac02f15aa38b2a2f0f03b9ba76bab7f98e155a4a4e",
+      "check_name": "Render",
+      "message": "Render path contains parameter value",
+      "file": "app/views/stream_entries/embed.html.haml",
+      "line": 3,
+      "link": "http://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
+      "code": "render(action => \"stream_entries/#{Account.find_local!(params[:account_username]).statuses.find(params[:id]).stream_entry.activity_type.downcase}\", { Account.find_local!(params[:account_username]).statuses.find(params[:id]).stream_entry.activity_type.downcase.to_sym => Account.find_local!(params[:account_username]).statuses.find(params[:id]).stream_entry.activity, :centered => true })",
+      "render_path": [{"type":"controller","class":"StatusesController","method":"embed","line":35,"file":"app/controllers/statuses_controller.rb"}],
+      "location": {
+        "type": "template",
+        "template": "stream_entries/embed"
+      },
+      "user_input": "params[:id]",
+      "confidence": "Weak",
+      "note": ""
+    },
     {
       "warning_type": "Dynamic Render Path",
       "warning_code": 15,
@@ -7,10 +26,10 @@
       "check_name": "Render",
       "message": "Render path contains parameter value",
       "file": "app/views/admin/accounts/index.html.haml",
-      "line": 32,
+      "line": 63,
       "link": "http://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
       "code": "render(action => filtered_accounts.page(params[:page]), {})",
-      "render_path": [{"type":"controller","class":"Admin::AccountsController","method":"index","line":7,"file":"app/controllers/admin/accounts_controller.rb"}],
+      "render_path": [{"type":"controller","class":"Admin::AccountsController","method":"index","line":10,"file":"app/controllers/admin/accounts_controller.rb"}],
       "location": {
         "type": "template",
         "template": "admin/accounts/index"
@@ -39,25 +58,6 @@
       "confidence": "High",
       "note": ""
     },
-    {
-      "warning_type": "Dynamic Render Path",
-      "warning_code": 15,
-      "fingerprint": "c417f9d44ab05dd9cf3d5ec9df2324a5036774c151181787b32c4c940623191b",
-      "check_name": "Render",
-      "message": "Render path contains parameter value",
-      "file": "app/views/stream_entries/embed.html.haml",
-      "line": 2,
-      "link": "http://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
-      "code": "render(action => Account.find_local!(params[:account_username]).stream_entries.where(:activity_type => \"Status\").find(params[:id]).activity_type.downcase, { Account.find_local!(params[:account_username]).stream_entries.where(:activity_type => \"Status\").find(params[:id]).activity_type.downcase.to_sym => Account.find_local!(params[:account_username]).stream_entries.where(:activity_type => \"Status\").find(params[:id]).activity, :centered => true })",
-      "render_path": [{"type":"controller","class":"StreamEntriesController","method":"embed","line":32,"file":"app/controllers/stream_entries_controller.rb"}],
-      "location": {
-        "type": "template",
-        "template": "stream_entries/embed"
-      },
-      "user_input": "params[:id]",
-      "confidence": "Weak",
-      "note": ""
-    },
     {
       "warning_type": "Dynamic Render Path",
       "warning_code": 15,
@@ -84,10 +84,10 @@
       "check_name": "Render",
       "message": "Render path contains parameter value",
       "file": "app/views/stream_entries/show.html.haml",
-      "line": 19,
+      "line": 23,
       "link": "http://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
       "code": "render(partial => \"stream_entries/#{Account.find_local!(params[:account_username]).statuses.find(params[:id]).stream_entry.activity_type.downcase}\", { :locals => ({ Account.find_local!(params[:account_username]).statuses.find(params[:id]).stream_entry.activity_type.downcase.to_sym => Account.find_local!(params[:account_username]).statuses.find(params[:id]).stream_entry.activity, :include_threads => true }) })",
-      "render_path": [{"type":"controller","class":"StatusesController","method":"show","line":15,"file":"app/controllers/statuses_controller.rb"}],
+      "render_path": [{"type":"controller","class":"StatusesController","method":"show","line":20,"file":"app/controllers/statuses_controller.rb"}],
       "location": {
         "type": "template",
         "template": "stream_entries/show"
@@ -97,6 +97,6 @@
       "note": ""
     }
   ],
-  "updated": "2017-05-07 08:26:06 +0900",
-  "brakeman_version": "3.6.1"
+  "updated": "2017-08-30 05:14:04 +0200",
+  "brakeman_version": "3.7.2"
 }
diff --git a/config/environments/development.rb b/config/environments/development.rb
index 4c60965c8..59bc2c3e2 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -16,9 +16,10 @@ Rails.application.configure do
   if Rails.root.join('tmp/caching-dev.txt').exist?
     config.action_controller.perform_caching = true
 
-    config.cache_store = :memory_store
+    config.cache_store = :redis_store, ENV['REDIS_URL'], REDIS_CACHE_PARAMS
+
     config.public_file_server.headers = {
-      'Cache-Control' => "public, max-age=#{2.days.seconds.to_i}"
+      'Cache-Control' => "public, max-age=#{2.days.seconds.to_i}",
     }
   else
     config.action_controller.perform_caching = false
diff --git a/config/routes.rb b/config/routes.rb
index 7588805c0..f8f145e1d 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -44,6 +44,7 @@ Rails.application.routes.draw do
     resources :statuses, only: [:show] do
       member do
         get :activity
+        get :embed
       end
     end
 
@@ -59,6 +60,7 @@ Rails.application.routes.draw do
   get '/@:username/with_replies', to: 'accounts#show', as: :short_account_with_replies
   get '/@:username/media', to: 'accounts#show', as: :short_account_media
   get '/@:account_username/:id', to: 'statuses#show', as: :short_account_status
+  get '/@:account_username/:id/embed', to: 'statuses#embed', as: :embed_short_account_status
 
   namespace :settings do
     resource :profile, only: [:show, :update]
diff --git a/spec/controllers/stream_entries_controller_spec.rb b/spec/controllers/stream_entries_controller_spec.rb
index 808cf667c..f81e2be7b 100644
--- a/spec/controllers/stream_entries_controller_spec.rb
+++ b/spec/controllers/stream_entries_controller_spec.rb
@@ -88,14 +88,12 @@ RSpec.describe StreamEntriesController, type: :controller do
   describe 'GET #embed' do
     include_examples 'before_action', :embed
 
-    it 'returns embedded view of status' do
+    it 'redirects to new embed page' do
       status = Fabricate(:status)
 
       get :embed, params: { account_username: status.account.username, id: status.stream_entry.id }
 
-      expect(response).to have_http_status(:success)
-      expect(response.headers['X-Frame-Options']).to eq 'ALLOWALL'
-      expect(response).to render_template(layout: 'embedded')
+      expect(response).to redirect_to(embed_short_account_status_url(status.account, status))
     end
   end
 end
diff --git a/spec/lib/status_finder_spec.rb b/spec/lib/status_finder_spec.rb
new file mode 100644
index 000000000..5c2f2dbe8
--- /dev/null
+++ b/spec/lib/status_finder_spec.rb
@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe StatusFinder do
+  include RoutingHelper
+
+  describe '#status' do
+    context 'with a status url' do
+      let(:status) { Fabricate(:status) }
+      let(:url) { short_account_status_url(account_username: status.account.username, id: status.id) }
+      subject { described_class.new(url) }
+
+      it 'finds the stream entry' do
+        expect(subject.status).to eq(status)
+      end
+
+      it 'raises an error if action is not :show' do
+        recognized = Rails.application.routes.recognize_path(url)
+        expect(recognized).to receive(:[]).with(:action).and_return(:create)
+        expect(Rails.application.routes).to receive(:recognize_path).with(url).and_return(recognized)
+
+        expect { subject.status }.to raise_error(ActiveRecord::RecordNotFound)
+      end
+    end
+
+    context 'with a stream entry url' do
+      let(:stream_entry) { Fabricate(:stream_entry) }
+      let(:url) { account_stream_entry_url(stream_entry.account, stream_entry) }
+      subject { described_class.new(url) }
+
+      it 'finds the stream entry' do
+        expect(subject.status).to eq(stream_entry.status)
+      end
+    end
+
+    context 'with a plausible url' do
+      let(:url) { 'https://example.com/users/test/updates/123/embed' }
+      subject { described_class.new(url) }
+
+      it 'raises an error' do
+        expect { subject.status }.to raise_error(ActiveRecord::RecordNotFound)
+      end
+    end
+
+    context 'with an unrecognized url' do
+      let(:url) { 'https://example.com/about' }
+      subject { described_class.new(url) }
+
+      it 'raises an error' do
+        expect { subject.status }.to raise_error(ActiveRecord::RecordNotFound)
+      end
+    end
+  end
+end
diff --git a/spec/lib/stream_entry_finder_spec.rb b/spec/lib/stream_entry_finder_spec.rb
deleted file mode 100644
index 64e03c36a..000000000
--- a/spec/lib/stream_entry_finder_spec.rb
+++ /dev/null
@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-describe StreamEntryFinder do
-  include RoutingHelper
-
-  describe '#stream_entry' do
-    context 'with a status url' do
-      let(:status) { Fabricate(:status) }
-      let(:url) { short_account_status_url(account_username: status.account.username, id: status.id) }
-      subject { described_class.new(url) }
-
-      it 'finds the stream entry' do
-        expect(subject.stream_entry).to eq(status.stream_entry)
-      end
-
-      it 'raises an error if action is not :show' do
-        recognized = Rails.application.routes.recognize_path(url)
-        expect(recognized).to receive(:[]).with(:action).and_return(:create)
-        expect(Rails.application.routes).to receive(:recognize_path).with(url).and_return(recognized)
-
-        expect { subject.stream_entry }.to raise_error(ActiveRecord::RecordNotFound)
-      end
-    end
-
-    context 'with a stream entry url' do
-      let(:stream_entry) { Fabricate(:stream_entry) }
-      let(:url) { account_stream_entry_url(stream_entry.account, stream_entry) }
-      subject { described_class.new(url) }
-
-      it 'finds the stream entry' do
-        expect(subject.stream_entry).to eq(stream_entry)
-      end
-    end
-
-    context 'with a plausible url' do
-      let(:url) { 'https://example.com/users/test/updates/123/embed' }
-      subject { described_class.new(url) }
-
-      it 'raises an error' do
-        expect { subject.stream_entry }.to raise_error(ActiveRecord::RecordNotFound)
-      end
-    end
-
-    context 'with an unrecognized url' do
-      let(:url) { 'https://example.com/about' }
-      subject { described_class.new(url) }
-
-      it 'raises an error' do
-        expect { subject.stream_entry }.to raise_error(ActiveRecord::RecordNotFound)
-      end
-    end
-  end
-end
-- 
cgit 


From 6994664a1391d6a027caec3d5ca9e022f41a0711 Mon Sep 17 00:00:00 2001
From: Adam Thurlow <thurloat@gmail.com>
Date: Tue, 5 Sep 2017 18:17:06 -0300
Subject: swift-enable the paperclip! :paperclip: (#2322)

---
 Gemfile                          |  1 +
 Gemfile.lock                     | 15 +++++++++++++++
 app/helpers/routing_helper.rb    |  8 +++++++-
 config/initializers/ostatus.rb   |  1 +
 config/initializers/paperclip.rb | 15 +++++++++++++++
 5 files changed, 39 insertions(+), 1 deletion(-)

(limited to 'app/helpers')

diff --git a/Gemfile b/Gemfile
index ae90697f1..486e72cc4 100644
--- a/Gemfile
+++ b/Gemfile
@@ -15,6 +15,7 @@ gem 'pghero', '~> 1.7'
 gem 'dotenv-rails', '~> 2.2'
 
 gem 'aws-sdk', '~> 2.9'
+gem 'fog-openstack', '~> 0.1'
 gem 'paperclip', '~> 5.1'
 gem 'paperclip-av-transcoder', '~> 0.6'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 4a3f20e09..ef99e0d7b 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -154,12 +154,25 @@ GEM
     erubis (2.7.0)
     et-orbi (1.0.5)
       tzinfo
+    excon (0.58.0)
     execjs (2.7.0)
     fabrication (2.16.2)
     faker (1.7.3)
       i18n (~> 0.5)
     fast_blank (1.0.0)
     ffi (1.9.18)
+    fog-core (1.45.0)
+      builder
+      excon (~> 0.58)
+      formatador (~> 0.2)
+    fog-json (1.0.2)
+      fog-core (~> 1.0)
+      multi_json (~> 1.10)
+    fog-openstack (0.1.21)
+      fog-core (>= 1.40)
+      fog-json (>= 1.0)
+      ipaddress (>= 0.8)
+    formatador (0.2.5)
     fuubar (2.2.0)
       rspec-core (~> 3.0)
       ruby-progressbar (~> 1.4)
@@ -211,6 +224,7 @@ GEM
       rainbow (~> 2.2)
       terminal-table (>= 1.5.1)
     idn-ruby (0.1.0)
+    ipaddress (0.8.3)
     jmespath (1.3.1)
     json (2.1.0)
     json-ld (2.1.5)
@@ -535,6 +549,7 @@ DEPENDENCIES
   fabrication (~> 2.16)
   faker (~> 1.7)
   fast_blank (~> 1.0)
+  fog-openstack (~> 0.1)
   fuubar (~> 2.2)
   goldfinger (~> 2.0)
   hamlit-rails (~> 0.2)
diff --git a/app/helpers/routing_helper.rb b/app/helpers/routing_helper.rb
index 1fbf77ec3..f4693358c 100644
--- a/app/helpers/routing_helper.rb
+++ b/app/helpers/routing_helper.rb
@@ -12,8 +12,14 @@ module RoutingHelper
   end
 
   def full_asset_url(source, options = {})
-    source = ActionController::Base.helpers.asset_url(source, options) unless Rails.configuration.x.use_s3
+    source = ActionController::Base.helpers.asset_url(source, options) unless use_storage?
 
     URI.join(root_url, source).to_s
   end
+
+  private
+
+  def use_storage?
+    Rails.configuration.x.use_s3 || Rails.configuration.x.use_swift
+  end
 end
diff --git a/config/initializers/ostatus.rb b/config/initializers/ostatus.rb
index a885545f8..c00aba0de 100644
--- a/config/initializers/ostatus.rb
+++ b/config/initializers/ostatus.rb
@@ -12,6 +12,7 @@ Rails.application.configure do
   config.x.web_domain   = web_host
   config.x.use_https    = https
   config.x.use_s3       = ENV['S3_ENABLED'] == 'true'
+  config.x.use_swift    = ENV['SWIFT_ENABLED'] == 'true'
 
   config.x.alternate_domains = alternate_domains.split(/\s*,\s*/)
 
diff --git a/config/initializers/paperclip.rb b/config/initializers/paperclip.rb
index 740c1a953..e9f455251 100644
--- a/config/initializers/paperclip.rb
+++ b/config/initializers/paperclip.rb
@@ -40,6 +40,21 @@ if ENV['S3_ENABLED'] == 'true'
     Paperclip::Attachment.default_options[:url]           = ':s3_alias_url'
     Paperclip::Attachment.default_options[:s3_host_alias] = ENV['S3_CLOUDFRONT_HOST']
   end
+elsif ENV['SWIFT_ENABLED'] == 'true'
+  Paperclip::Attachment.default_options.merge!(
+    path: ':class/:attachment/:id_partition/:style/:filename',
+    storage: :fog,
+    fog_credentials: {
+      provider: 'OpenStack',
+      openstack_username: ENV.fetch('SWIFT_USERNAME'),
+      openstack_tenant: ENV.fetch('SWIFT_TENANT'),
+      openstack_api_key: ENV.fetch('SWIFT_PASSWORD'),
+      openstack_auth_url: ENV.fetch('SWIFT_AUTH_URL'),
+    },
+    fog_directory: ENV.fetch('SWIFT_CONTAINER'),
+    fog_host: ENV.fetch('SWIFT_OBJECT_URL'),
+    fog_public: true
+  )
 else
   Paperclip::Attachment.default_options[:path] = (ENV['PAPERCLIP_ROOT_PATH'] || ':rails_root/public/system') + '/:class/:attachment/:id_partition/:style/:filename'
   Paperclip::Attachment.default_options[:url]  = (ENV['PAPERCLIP_ROOT_URL'] || '/system') + '/:class/:attachment/:id_partition/:style/:filename'
-- 
cgit