From 3e062aed360ca54c26733b175d00d0d4671f3591 Mon Sep 17 00:00:00 2001
From: Andrew Godwin
Date: Sun, 11 Dec 2022 00:25:48 -0700
Subject: Timelines working

---
 api/decorators.py       |  19 +++++++++
 api/middleware.py       |  27 ++++++++++++
 api/schemas/__init__.py | 108 ++++++++++++++++++++++++++++++++++++++++++++++++
 api/views/__init__.py   |   3 ++
 api/views/accounts.py   |   9 ++++
 api/views/apps.py       |  14 ++-----
 api/views/instance.py   |   1 -
 api/views/oauth.py      |   4 --
 api/views/timelines.py  |  23 +++++++++++
 9 files changed, 192 insertions(+), 16 deletions(-)
 create mode 100644 api/decorators.py
 create mode 100644 api/middleware.py
 create mode 100644 api/schemas/__init__.py
 create mode 100644 api/views/accounts.py
 create mode 100644 api/views/timelines.py

(limited to 'api')

diff --git a/api/decorators.py b/api/decorators.py
new file mode 100644
index 0000000..b60cc05
--- /dev/null
+++ b/api/decorators.py
@@ -0,0 +1,19 @@
+from functools import wraps
+
+from django.http import JsonResponse
+
+
+def identity_required(function):
+    """
+    API version of the identity_required decorator that just makes sure the
+    token is tied to one, not an app only.
+    """
+
+    @wraps(function)
+    def inner(request, *args, **kwargs):
+        # They need an identity
+        if not request.identity:
+            return JsonResponse({"error": "identity_token_required"}, status=400)
+        return function(request, *args, **kwargs)
+
+    return inner
diff --git a/api/middleware.py b/api/middleware.py
new file mode 100644
index 0000000..84eddca
--- /dev/null
+++ b/api/middleware.py
@@ -0,0 +1,27 @@
+from django.http import HttpResponse
+
+from api.models import Token
+
+
+class ApiTokenMiddleware:
+    """
+    Adds request.user and request.identity if an API token appears.
+    Also nukes request.session so it can't be used accidentally.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        auth_header = request.headers.get("authorization", None)
+        if auth_header and auth_header.startswith("Bearer "):
+            token_value = auth_header[7:]
+            try:
+                token = Token.objects.get(token=token_value)
+            except Token.DoesNotExist:
+                return HttpResponse("Invalid Bearer token", status=400)
+            request.user = token.user
+            request.identity = token.identity
+            request.session = None
+        response = self.get_response(request)
+        return response
diff --git a/api/schemas/__init__.py b/api/schemas/__init__.py
new file mode 100644
index 0000000..cc0660c
--- /dev/null
+++ b/api/schemas/__init__.py
@@ -0,0 +1,108 @@
+from typing import Literal, Optional, Union
+
+from ninja import Field, Schema
+
+
+class Application(Schema):
+    id: str
+    name: str
+    website: str | None
+    client_id: str
+    client_secret: str
+    redirect_uri: str = Field(alias="redirect_uris")
+
+
+class CustomEmoji(Schema):
+    shortcode: str
+    url: str
+    static_url: str
+    visible_in_picker: bool
+    category: str
+
+
+class AccountField(Schema):
+    name: str
+    value: str
+    verified_at: str | None
+
+
+class Account(Schema):
+    id: str
+    username: str
+    acct: str
+    url: str
+    display_name: str
+    note: str
+    avatar: str
+    avatar_static: str
+    header: str
+    header_static: str
+    locked: bool
+    fields: list[AccountField]
+    emojis: list[CustomEmoji]
+    bot: bool
+    group: bool
+    discoverable: bool
+    moved: Union[None, bool, "Account"]
+    suspended: bool
+    limited: bool
+    created_at: str
+    last_status_at: str | None = Field(...)
+    statuses_count: int
+    followers_count: int
+    following_count: int
+
+
+class MediaAttachment(Schema):
+    id: str
+    type: Literal["unknown", "image", "gifv", "video", "audio"]
+    url: str
+    preview_url: str
+    remote_url: str | None
+    meta: dict
+    description: str | None
+    blurhash: str | None
+
+
+class StatusMention(Schema):
+    id: str
+    username: str
+    url: str
+    acct: str
+
+
+class StatusTag(Schema):
+    name: str
+    url: str
+
+
+class Status(Schema):
+    id: str
+    uri: str
+    created_at: str
+    account: Account
+    content: str
+    visibility: Literal["public", "unlisted", "private", "direct"]
+    sensitive: bool
+    spoiler_text: str
+    media_attachments: list[MediaAttachment]
+    mentions: list[StatusMention]
+    tags: list[StatusTag]
+    emojis: list[CustomEmoji]
+    reblogs_count: int
+    favourites_count: int
+    replies_count: int
+    url: str | None = Field(...)
+    in_reply_to_id: str | None = Field(...)
+    in_reply_to_account_id: str | None = Field(...)
+    reblog: Optional["Status"] = Field(...)
+    poll: None = Field(...)
+    card: None = Field(...)
+    language: None = Field(...)
+    text: str | None = Field(...)
+    edited_at: str | None
+    favourited: bool | None
+    reblogged: bool | None
+    muted: bool | None
+    bookmarked: bool | None
+    pinned: bool | None
diff --git a/api/views/__init__.py b/api/views/__init__.py
index d661e7c..93cf419 100644
--- a/api/views/__init__.py
+++ b/api/views/__init__.py
@@ -1,3 +1,6 @@
+from .accounts import *  # noqa
 from .apps import *  # noqa
 from .base import api  # noqa
 from .instance import *  # noqa
+from .oauth import *  # noqa
+from .timelines import *  # noqa
diff --git a/api/views/accounts.py b/api/views/accounts.py
new file mode 100644
index 0000000..79906dc
--- /dev/null
+++ b/api/views/accounts.py
@@ -0,0 +1,9 @@
+from .. import schemas
+from ..decorators import identity_required
+from .base import api
+
+
+@api.get("/v1/accounts/verify_credentials", response=schemas.Account)
+@identity_required
+def verify_credentials(request):
+    return request.identity.to_mastodon_json()
diff --git a/api/views/apps.py b/api/views/apps.py
index 33ecf0f..1642ee9 100644
--- a/api/views/apps.py
+++ b/api/views/apps.py
@@ -1,7 +1,8 @@
 import secrets
 
-from ninja import Field, Schema
+from ninja import Schema
 
+from .. import schemas
 from ..models import Application
 from .base import api
 
@@ -13,16 +14,7 @@ class CreateApplicationSchema(Schema):
     website: None | str = None
 
 
-class ApplicationSchema(Schema):
-    id: str
-    name: str
-    website: str | None
-    client_id: str
-    client_secret: str
-    redirect_uri: str = Field(alias="redirect_uris")
-
-
-@api.post("/v1/apps", response=ApplicationSchema)
+@api.post("/v1/apps", response=schemas.Application)
 def add_app(request, details: CreateApplicationSchema):
     client_id = "tk-" + secrets.token_urlsafe(16)
     client_secret = secrets.token_urlsafe(40)
diff --git a/api/views/instance.py b/api/views/instance.py
index 5923d30..eef258d 100644
--- a/api/views/instance.py
+++ b/api/views/instance.py
@@ -9,7 +9,6 @@ from .base import api
 
 
 @api.get("/v1/instance")
-@api.get("/v1/instance/")
 def instance_info(request):
     return {
         "uri": request.headers.get("host", settings.SETUP.MAIN_DOMAIN),
diff --git a/api/views/oauth.py b/api/views/oauth.py
index 6be2778..b97ce5a 100644
--- a/api/views/oauth.py
+++ b/api/views/oauth.py
@@ -66,7 +66,6 @@ class AuthorizationView(LoginRequiredMixin, TemplateView):
 class TokenView(View):
     def post(self, request):
         grant_type = request.POST["grant_type"]
-        scopes = set(self.request.POST.get("scope", "read").split())
         try:
             application = Application.objects.get(
                 client_id=self.request.POST["client_id"]
@@ -84,9 +83,6 @@ class TokenView(View):
                 token = Token.objects.get(code=code, application=application)
             except Token.DoesNotExist:
                 return JsonResponse({"error": "invalid_code"}, status=400)
-            # Verify the scopes match the token
-            if scopes != set(token.scopes):
-                return JsonResponse({"error": "invalid_scope"}, status=400)
             # Update the token to remove its code
             token.code = None
             token.save()
diff --git a/api/views/timelines.py b/api/views/timelines.py
new file mode 100644
index 0000000..5de0e0f
--- /dev/null
+++ b/api/views/timelines.py
@@ -0,0 +1,23 @@
+from activities.models import TimelineEvent
+
+from .. import schemas
+from ..decorators import identity_required
+from .base import api
+
+
+@api.get("/v1/timelines/home", response=list[schemas.Status])
+@identity_required
+def home(request):
+    if request.GET.get("max_id"):
+        return []
+    limit = int(request.GET.get("limit", "20"))
+    events = (
+        TimelineEvent.objects.filter(
+            identity=request.identity,
+            type__in=[TimelineEvent.Types.post],
+        )
+        .select_related("subject_post", "subject_post__author")
+        .prefetch_related("subject_post__attachments")
+        .order_by("-created")[:limit]
+    )
+    return [event.subject_post.to_mastodon_json() for event in events]
-- 
cgit v1.2.3