Commit graph

479 commits

Author SHA1 Message Date
cdn0x12
bad427e7f0 [chore/docs] fix relative link to scraper deterrence (#4111)
# Description

While working on the doc translation update, I found a broken link. So I;m opening this separate PR to keep it clean from the translation stuff. Marked as draft currently for checking for any other typos :)

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4111
Co-authored-by: cdn0x12 <git@cdn0x12.dev>
Co-committed-by: cdn0x12 <git@cdn0x12.dev>
2025-05-03 09:28:43 +00:00
cdn0x12
4d6408015b [docs/zh] Update zh docs: synced to 6c879186 (#4117)
# Description

This PR updates the Chinese documentation to 6c879186 (the latest commit at present).

It also fixed a small typo in the original docs. Since the change is so minor, I didn't make a separate PR.

Last docs/zh update PR: #3884

## Checklist

Please put an x inside each checkbox to indicate that you've read and followed it: `[ ]` -> `[x]`

If this is a documentation change, only the first checkbox must be filled (you can delete the others if you want).

- [x] I/we have read the [GoToSocial contribution guidelines](https://codeberg.org/superseriousbusiness/gotosocial/src/branch/main/CONTRIBUTING.md).

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4117
Co-authored-by: cdn0x12 <git@cdn0x12.dev>
Co-committed-by: cdn0x12 <git@cdn0x12.dev>
2025-05-03 09:28:16 +00:00
tobi
ef0f8a55c6 [bugfix] Fix nil ptr exception on creating user without running server first (#4094)
# Description

> If this is a code change, please include a summary of what you've coded, and link to the issue(s) it closes/implements.
>
> If this is a documentation change, please briefly describe what you've changed and why.

closes https://codeberg.org/superseriousbusiness/gotosocial/issues/4049 by removing the silly defer statement. Adds a test too, and a warning in the docs.

## Checklist

Please put an x inside each checkbox to indicate that you've read and followed it: `[ ]` -> `[x]`

If this is a documentation change, only the first checkbox must be filled (you can delete the others if you want).

- [x] I/we have read the [GoToSocial contribution guidelines](https://codeberg.org/superseriousbusiness/gotosocial/src/branch/main/CONTRIBUTING.md).
- [x] I/we have discussed the proposed changes already, either in an issue on the repository, or in the Matrix chat.
- [x] I/we have not leveraged AI to create the proposed changes.
- [x] I/we have performed a self-review of added code.
- [x] I/we have written code that is legible and maintainable by others.
- [x] I/we have commented the added code, particularly in hard-to-understand areas.
- [x] I/we have made any necessary changes to documentation.
- [x] I/we have added tests that cover new code.
- [x] I/we have run tests and they pass locally with the changes.
- [x] I/we have run `go fmt ./...` and `golangci-lint run`.

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4094
Co-authored-by: tobi <tobi.smethurst@protonmail.com>
Co-committed-by: tobi <tobi.smethurst@protonmail.com>
2025-04-29 16:40:36 +00:00
kim
efc79528d2 [docs] small changes to the proof-of-work scraper deterrence docs (#4084)
- moves it to the advanced section
- adds it to the mkdocs config
- adds warning about it not covering RSS endpoints

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4084
Co-authored-by: kim <grufwub@gmail.com>
Co-committed-by: kim <grufwub@gmail.com>
2025-04-29 08:59:28 +00:00
kim
d8c4d9fc5a [feature] proof of work scraper deterrence (#4043)
This adds a proof-of-work based scraper deterrence to GoToSocial's middleware stack on profile and status web pages. Heavily inspired by https://github.com/TecharoHQ/anubis, but massively stripped back for our own usecase.

Todo:
- ~~add configuration option so this is disabled by default~~
- ~~fix whatever weirdness is preventing this working with CSP (even in debug)~~
- ~~use our standard templating mechanism going through apiutil helper func~~
- ~~probably some absurdly small performance improvements to be made in pooling re-used hex encode / hash encode buffers~~ the web endpoints aren't as hot a path as API / ActivityPub, will leave as-is for now as it is already very minimal and well optimized
- ~~verify the cryptographic assumptions re: using a portion of token as challenge data~~ this isn't a serious application of cryptography, if it turns out to be a problem we'll fix it, but it definitely should not be easily possible to guess a SHA256 hash from the first 1/4 of it even if mathematically it might make it a bit easier
- ~~theme / make look nice??~~
- ~~add a spinner~~
- ~~add entry in example configuration~~
- ~~add documentation~~

Verification page originally based on https://github.com/LucienV1/powtect

Co-authored-by: tobi <tobi.smethurst@protonmail.com>
Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4043
Reviewed-by: tobi <tsmethurst@noreply.codeberg.org>
Co-authored-by: kim <grufwub@gmail.com>
Co-committed-by: kim <grufwub@gmail.com>
2025-04-28 20:12:27 +00:00
tobi
afb4279d27 [docs] Move docs links to codeberg (#4074)
Update more links from github -> codeberg in the docs.

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4074
Co-authored-by: tobi <tobi.smethurst@protonmail.com>
Co-committed-by: tobi <tobi.smethurst@protonmail.com>
2025-04-28 12:08:51 +00:00
İ. Göktuğ Kayaalp
d3e9a9e563 [docs] clearer structure for "combining blocks and allows" section (#4065)
# Description

This patch moves figures around in `admin/federation_modes.md` in order to make the text more approachable. Reading it, I found that I dwelled long on the chart, not thinking that there would be an easier to read explanation below, so I thought it'd make sense to swap the places. I also felt like the warning at the bottom was important enough that it'd better be up near the top of the section, highlighting the importance of understanding the explanation below.

I did not see a commit message style guide in project docs so I improvised based on recent commit messages

## Checklist

Please put an x inside each checkbox to indicate that you've read and followed it: `[ ]` -> `[x]`

If this is a documentation change, only the first checkbox must be filled (you can delete the others if you want).

- [X] I/we have read the [GoToSocial contribution guidelines](https://codeberg.org/superseriousbusiness/gotosocial/src/branch/main/CONTRIBUTING.md).
- [ ] I/we have discussed the proposed changes already, either in an issue on the repository, or in the Matrix chat.
- [X] I/we have not leveraged AI to create the proposed changes.
- [ ] I/we have performed a self-review of added code.
- [ ] I/we have written code that is legible and maintainable by others.
- [ ] I/we have commented the added code, particularly in hard-to-understand areas.
- [ ] I/we have made any necessary changes to documentation.
- [ ] I/we have added tests that cover new code.
- [ ] I/we have run tests and they pass locally with the changes.
- [ ] I/we have run `go fmt ./...` and `golangci-lint run`.

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4065
Co-authored-by: İ. Göktuğ Kayaalp <self@gkayaalp.com>
Co-committed-by: İ. Göktuğ Kayaalp <self@gkayaalp.com>
2025-04-27 20:27:23 +00:00
Daenney
93c3c153f0 [chore] Rewrite all remaining Github links 2025-04-27 13:40:22 +02:00
tobi
5bfccdad3c [chore] add woodpecker ci/cd pipelines (#4061)
Removes our now unused drone stuff and adds pipelines for our new woodpecker instance.

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4061
Co-authored-by: tobi <tobi.smethurst@protonmail.com>
Co-committed-by: tobi <tobi.smethurst@protonmail.com>
2025-04-27 11:22:35 +00:00
Daenney
346962beb5 [chore] Fix daenney being bad at sed (#4060)
Co-authored-by: Daenney <daenney@users.noreply.github.com>
Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4060
Co-authored-by: Daenney <daenney@noreply.codeberg.org>
Co-committed-by: Daenney <daenney@noreply.codeberg.org>
2025-04-26 19:19:52 +00:00
Daenney
ab10266bff [feature] Move to code.superseriousbusiness.org 2025-04-26 15:38:43 +02:00
tobi
f7323c065a
[feature] Update attachment format, receive + send focalPoint prop + use it on the frontend (#4052)
* [feature] Update attachment format, receive + send `focalPoint` prop + use it on the frontend

* whoops

* boop

* restore function signature of ExtractAttachments
2025-04-26 15:03:05 +02:00
Ember
768ee70b88
[docs] Mention where to run the command to grant CREATE permissions (#4050) 2025-04-24 11:00:20 +02:00
tobi
d308fd0d0a
[chore] Little settings panel report view tweak (#4025) 2025-04-19 13:36:35 +02:00
OniriCorpe
b51aa23458
[docs] add a command to know if the system is compatible with the standard builds (#3980) 2025-04-11 12:42:18 +02:00
heddxh
1e59795ff4
[docs] add instruction about postgres permission (#3981) 2025-04-11 12:41:50 +02:00
tobi
e032c959e1
[feature] Implement /oauth/revoke for token revocation (#3983) 2025-04-10 16:24:17 +02:00
tobi
365b575341
[feature] add TOTP two-factor authentication (2FA) (#3960)
* [feature] add TOTP two-factor authentication (2FA)

* use byteutil.S2B to avoid allocations when comparing + generating password hashes

* don't bother with string conversion  for consts

* use io.ReadFull

* use MustGenerateSecret for backup codes

* rename util functions
2025-04-07 16:14:41 +02:00
tobi
b184432331
[feature] Allow editing domain blocks/allows, fix comment import (#3967)
* start implementing editing of existing domain permissions

* [feature] Allow editing domain blocks/allows, fix comment import

* [bugfix] Use "comment" via /api/v1/instance

* fix the stuff
2025-04-04 18:29:22 +02:00
Leonid Shevtsov
85fb63f46f
[docs] Fix Swagger URL for the "edit status" operation (#3932) 2025-03-30 10:21:08 +02:00
tobi
b6e481d63e
[feature] Allow user to choose "gallery" style layout for web view of profile (#3917)
* [feature] Allow user to choose "gallery" style web layout

* find a bug and squish it up and all day long you'll have good luck

* just a sec

* [performance] reindex public timeline + tinker with query a bit

* fiddling

* should be good now

* last bit of finagling, i'm done now i prommy

* panic normally
2025-03-26 15:59:39 +00:00
tobi
d5847e2d2b
[feature] Application creation + management via API + settings panel (#3906)
* [feature] Application creation + management via API + settings panel

* fix docs links

* add errnorows test

* use known application as shorter

* add comment about side effects
2025-03-17 14:06:17 +00:00
CDN
3db5bfa0f2
[docs/zh] update zh docs: synced to 98c4cae + fix typo (#3884)
* [docs/zh] update zh docs: synced to 98c4cae8

* fix typo

* sync the support matrix in README

* update mkdocs.yml: add new article
2025-03-10 10:24:37 +01:00
CDN
98c4cae89a
[chore] update links in CONTRIBUTING.md (#3881) 2025-03-08 18:48:11 +01:00
ewwwin
424f62dd70
[bugfix] Store and expose status content type (#3870)
* Add ContentType to internal models

* Add ContentType to API models StatusSource and StatusEdit

* Add helpers to convert between API/internal StatusContentType

* Write status content type on create/edit

* Add migration

* Update API docs

go run github.com/go-swagger/go-swagger/cmd/swagger generate spec --scan-models --exclude-deps --output docs/api/swagger.yaml

* ensure ContentType is updated anywhere Text is

* Update docs, take care of TODOs

* Set ContentType in more places where Text is set

* We don't actually use ContentType on the API status model

* Update StatusSource test

* Remove unused helper function I copied

* Revert change to StatusContentType swagger annotation

I'm going to include this in a follow-on PR instead.

* Add test for updating content type in edits

* Return a value from processContentType instead of modifying the existing status

Fixes an issue that was caught by the test I just added - the recorded edit would be marked with the *new* content type instead of the old one, which is obviously bad

* Add test for handling of statuses with no stored content type

* repurpose an existing test status instead of adding a new one to avoid breaking other tests

* Add test to ensure newly created statuses always have content type saved

* Do include content type on status API model actually

This is mostly important when deleting and redrafting.

The comment on `apimodel.Status.Text` implies that it's not sent except in response to status deletion, but actually this doesn't seem to be the case; it also appears to be present in responses to creations and normal fetches and stuff. So I'm treating `ContentType` the same here.

* Update new tests to check content type on API statuses

* Check content type of API statuses in all tests where text is checked

* update other api tests with status content type field

* Add test ensuring text and content type are returned when deleting a status

* Convert processContentType to free function and remove unused parameter

* check for the correct value in the deletion test

* Be explicit about this test status having an empty content type

* Use omitempty consistently on API models

* clean up the final diff a bit

* one more swagger regen for the road

* Handle nil statuses in processContentType

* Don't pass processContentType the entire edit form, it doesn't need it

* Move processContentType to common.go and use for creation as well

* Remove unused parameters to ContentTypeToAPIContentType
2025-03-06 16:31:52 +00:00
tobi
829143d263
[feature] Add token review / delete to backend + settings panel (#3845) 2025-03-04 10:01:25 +00:00
tobi
1b37944f8b
[feature] Refactor tokens, allow multiple app redirect_uris (#3849)
* [feature] Refactor tokens, allow multiple app redirect_uris

* move + tweak handlers a bit

* return error for unset oauth2.ClientStore funcs

* wrap UpdateToken with cache

* panic handling

* cheeky little time optimization

* unlock on error
2025-03-03 15:03:36 +00:00
tobi
8488ac9286
[chore] migrate oauth2 -> codeberg (#3857) 2025-03-02 16:42:51 +01:00
tobi
5d0e3d9c35
[chore] github.com/superseriousbusiness/httpsig -> codeberg.org/superseriousbusiness/httpsig (#3854) 2025-03-02 13:28:38 +01:00
tobi
e2e185d10b
[chore] github.com/superseriousbusiness/activity -> codeberg.org/superseriousbusiness/activity (#3853) 2025-03-02 12:48:00 +01:00
Xavier Vello
0118e03cda
[feature] Implement CSV import for mutes (#3696)
* Implement CSV import for mutes

* update swagger.yaml

* update documentation

* add ImportTestSuite.TestImportMutes

* fix comment typo
2025-03-01 11:37:40 +01:00
Vyr Cossont
d73acc70d5
Document importing posts (#3844) 2025-02-28 16:10:16 -08:00
tobi
eb720241da
[feature] Enforce OAuth token scopes (#3835)
* move tokenauth to apiutil

* enforce scopes

* docs

* update test models, remove deprecated "follow"

* file header

* tests

* tweak scope matcher

* simplify...

* fix tests

* log user out of settings panel in case of oauth error
2025-02-26 13:04:55 +01:00
mkljczk
96d39155f2
[docs] Fix swagger operation descriptions (#3830)
* Fix swagger operation descriptions

Signed-off-by: mkljczk <git@mkljczk.pl>

* generate a swagger file

Signed-off-by: mkljczk <git@mkljczk.pl>

---------

Signed-off-by: mkljczk <git@mkljczk.pl>
2025-02-25 12:47:48 +01:00
Elliot Blackburn
1c049ba295
[docs] correct docker version format (#3832)
The documentation explains that the release tag is in the format of `vX.Y.Z` for container images. This does not appear to be correct when looking at the image tags in dockerhub. It seems the `v` prefix has been dropped at some point, or was never in place.
2025-02-25 12:47:07 +01:00
tobi
c9de6c9a1e
[docs] Update interactionPolicy (#3703)
* [docs] Update interactionPolicy

* Update docs/federation/posts.md

Co-authored-by: Claire <claire.github-309c@sitedethib.com>

* brush up docs

* boobs

* finish up

---------

Co-authored-by: Claire <claire.github-309c@sitedethib.com>
2025-02-22 13:26:49 +01:00
Vyr Cossont
fccb0bc102
[feature] Implement backfilling statuses thru scheduled_at (#3685)
* Implement backfilling statuses thru scheduled_at

* Forbid mentioning others in backfills

* Update error messages & codes

* Add new tests for backfilled statuses

* Test that backfilling doesn't timeline or notify

* Fix check for absence of notification

* Test that backfills do not cause federation

* Fix type of apimodel.StatusCreateRequest.ScheduledAt in tests

* Add config file switch and min date check
2025-02-12 09:49:33 -08:00
tobi
787bdc1488
[feature] make account sign-up / backlog limits configurable (#3768) 2025-02-10 15:46:36 +01:00
CDN
62f25ea08a
[docs/zh] Update zh docs: synced to e10de84 (#3763)
* [docs/zh] Update zh docs: synced to e10de84

* [docs/zh] update mkdocs config of zh docs

* [docs/zh] update repo docs translations (README, ROADMAP, CONTRIBUTING) + update swagger schema metadata of docs/zh
2025-02-09 11:13:08 +01:00
CDN
2aa3524739
[chore] fix typo in docs (#3758)
* [chore] fix link reference in docs/admin/settings.md

* [docs] fix typo in docs/federation/posts.md
2025-02-09 11:12:46 +01:00
pnwmatt
e10de8464a
[bug] Add missing group property to the Account model (#3746)
* Stub out account's Group parameter

* Fix typo in Contributing documentation

* Update swagger and match style

* Update the swagger command to mimic test/swagger.sh

* Fix tests for new `group` param in Account model

* More test changes for new `group` param in Account

* Continuing test changes for `group` param stubbing

* Another round of `group` stubbing for tests
2025-02-08 13:04:30 +01:00
tobi
07d2770995
[feature] Change instance-stats-randomize to instance-stats-mode with multiple options; implement nodeinfo 2.1 (#3734)
* [feature] Change `instance-stats-randomize` to `instance-stats-mode` with multiple options; implement nodeinfo 2.1

* swaggalaggadingdong
2025-02-04 16:52:42 +01:00
Vyr Cossont
27844b7da2
[feature] Implement Web Push notification policy (#3721)
* Web Push: add policy column to subscriptions

* Web Push: add policy to API

* Web Push: test notification policy

* go-fmt unrelated file (how did this get thru?)
2025-02-03 10:25:53 +00:00
Vyr Cossont
f5eee56bb1
[bugfix] Swagger: fix media_ids[] param for creating statuses (#3722) 2025-02-01 17:14:49 -08:00
tobi
a55bd6d2bd
[feature] Add instance-stats-randomize config option (#3718)
* [feature] Add `instance-stats-randomize` config option

* don't use cache (overkill)
2025-01-31 19:27:18 +01:00
Marcus Jaschen
b3ecfe1e0a
[docs] remove -X POST from curl commands (#3665)
Daniel, author of curl, explains why `-X POST` is not
necessary and considered bad behavior:

https://daniel.haxx.se/blog/2015/09/11/unnecessary-use-of-curl-x/ for
2025-01-30 13:56:08 +01:00
tobi
bfe8144fda
[bugfix] Allow processing null ID emojis (#3702)
* [bugfix] Allow processing null ID emojis

* document emojis

* blah

* typo

* array thingy
2025-01-28 13:32:37 +01:00
tobi
9048290948
[chore] skip trusted-proxies warning if ip excepted from rate limiting (#3699)
* [chore] skip `trusted-proxies` warning if ip excepted from rate limiting

* weep

* typo

* fix env parsing test
2025-01-27 19:21:13 +01:00
tobi
2a46681147
[chore] Allow suppressing trusted-proxies warning by disabling rate limiting (#3686) 2025-01-26 11:21:57 +00:00
Vyr Cossont
3ab2d8621b
[docs] Swagger: fix filter context params by moving enum list from the list type to the item type (#3684)
Reported by `@modulus:matrix.org`
2025-01-26 09:51:28 +01:00