api/funkwhale_api/common/management/commands/createsuperuser.py

+from django.conf import settings
+from django.contrib.auth.management.commands.createsuperuser import (
+    Command as BaseCommand,
+)
+from django.core.management.base import CommandError
+
+
+class Command(BaseCommand):
+    def handle(self, *apps_label, **options):
+        """
+        Creating Django Superusers would bypass some of our username checks, which can lead to unexpected behaviour.
+        We therefore prohibit the execution of the command.
+        """
+        force = settings.FORCE
+        if not force == 1:
+            raise CommandError(
+                "Running createsuperuser on your Funkwhale instance bypasses some of our checks "
+                "which can lead to unexpected behavior of your instance. We therefore suggest to "
+                "run `funkwhale-manage fw users create --superuser` instead."
+            )
+
+        return super().handle(*apps_label, **options)

api/funkwhale_api/common/management/commands/gitpod.py

+import os
+
+import debugpy
+import uvicorn
+from django.core.management import call_command
+from django.core.management.commands.migrate import Command as BaseCommand
+
+from funkwhale_api.common import preferences
+from funkwhale_api.music.models import Library
+from funkwhale_api.users.models import User
+
+
+class Command(BaseCommand):
+    help = "Manage gitpod environment"
+
+    def add_arguments(self, parser):
+        parser.add_argument("command", nargs="?", type=str)
+
+    def handle(self, *args, **options):
+        command = options["command"]
+
+        if not command:
+            return self.show_help()
+
+        if command == "init":
+            return self.init()
+
+        if command == "dev":
+            return self.dev()
+
+    def show_help(self):
+        self.stdout.write("")
+        self.stdout.write("Available commands:")
+        self.stdout.write("init - Initialize gitpod workspace")
+        self.stdout.write("dev - Run Funkwhale in development mode with debug server")
+        self.stdout.write("")
+
+    def init(self):
+        user = User.objects.get(username="gitpod")
+
+        # Allow anonymous access
+        preferences.set("common__api_authentication_required", False)
+
+        # Download music catalog
+        os.system(
+            "git clone https://dev.funkwhale.audio/funkwhale/catalog.git /tmp/catalog"
+        )
+        os.system("mv -f /tmp/catalog/music /workspace/funkwhale/data")
+        os.system("rm -rf /tmp/catalog/music")
+
+        # Import music catalog into library
+        call_command(
+            "create_library",
+            "gitpod",
+            name="funkwhale/catalog",
+            privacy_level="everyone",
+        )
+        call_command(
+            "import_files",
+            Library.objects.get(actor=user.actor).uuid,
+            "/workspace/funkwhale/data/music/",
+            recursive=True,
+            in_place=True,
+            no_input=False,
+        )
+
+    def dev(self):
+        debugpy.listen(5678)
+        uvicorn.run(
+            "config.asgi:application",
+            host="0.0.0.0",
+            port=5000,
+            reload=True,
+            reload_dirs=[
+                "/workspace/funkwhale/api/config/",
+                "/workspace/funkwhale/api/funkwhale_api/",
+            ],
+        )

api/funkwhale_api/common/management/commands/inplace_to_s3.py

+import pathlib
+from argparse import RawTextHelpFormatter
+
+from django.core.management.base import BaseCommand
+from django.db import transaction
+
+from funkwhale_api.music import models
+
+
+class Command(BaseCommand):
+    help = """
+    Update the reference for Uploads that have been imported with --in-place and are now moved to s3.
+
+    Please note: This does not move any file! Make sure you already moved the files to your s3 bucket.
+
+    Specify --source to filter the reference to update to files from a specific in-place directory. If no
+    --source is given, all in-place imported track references will be updated.
+
+    Specify --target to specify a subdirectory in the S3 bucket where you moved the files. If no --target is
+    given, the file is expected to be stored in the same path as before.
+
+    Examples:
+
+    Music File: /music/Artist/Album/track.ogg
+    --source: /music
+    --target unset
+
+    All files imported from /music will be updated and expected to be in the same folder structure in the bucket
+
+    Music File: /music/Artist/Album/track.ogg
+    --source: /music
+    --target: /in_place
+
+    The music file is expected to be stored in the bucket in the directory /in_place/Artist/Album/track.ogg
+    """
+
+    def create_parser(self, *args, **kwargs):
+        parser = super().create_parser(*args, **kwargs)
+        parser.formatter_class = RawTextHelpFormatter
+        return parser
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--no-dry-run",
+            action="store_false",
+            dest="dry_run",
+            default=True,
+            help="Disable dry run mode and apply updates for real on the database",
+        )
+        parser.add_argument(
+            "--source",
+            type=pathlib.Path,
+            required=True,
+            help="Specify the path of the directory where the files originally were stored to update their reference.",
+        )
+        parser.add_argument(
+            "--target",
+            type=pathlib.Path,
+            help="Specify a subdirectory in the S3 bucket where you moved the files to.",
+        )
+
+    @transaction.atomic
+    def handle(self, *args, **options):
+        if options["dry_run"]:
+            self.stdout.write("Dry-run on, will not touch the database")
+        else:
+            self.stdout.write("Dry-run off, *changing the database*")
+        self.stdout.write("")
+
+        prefix = f"file://{options['source']}"
+
+        to_change = models.Upload.objects.filter(source__startswith=prefix)
+
+        self.stdout.write(f"Found {to_change.count()} uploads to update.")
+
+        target = options.get("target")
+        if target is None:
+            target = options["source"]
+
+        for upl in to_change:
+            upl.audio_file = str(upl.source).replace(str(prefix), str(target))
+            upl.source = None
+            self.stdout.write(f"Upload expected in {upl.audio_file}")
+            if not options["dry_run"]:
+                upl.save()
+
+        self.stdout.write("")
+        if options["dry_run"]:
+            self.stdout.write(
+                "Nothing was updated, rerun this command with --no-dry-run to apply the changes"
+            )
+        else:
+            self.stdout.write("Updating completed!")
+
+        self.stdout.write("")

api/funkwhale_api/common/management/commands/load_test_data.py

@@ -5,14 +5,12 @@ from django.conf import settings
 from django.core.management.base import BaseCommand
 from django.db import transaction
 
-
 from funkwhale_api.federation import keys
 from funkwhale_api.federation import models as federation_models
 from funkwhale_api.music import models as music_models
 from funkwhale_api.tags import models as tags_models
 from funkwhale_api.users import models as users_models
 
-
 BATCH_SIZE = 500
 
 
@@ -48,7 +46,6 @@ def create_local_accounts(factories, count, dependencies):
 
 def create_taggable_items(dependency):
     def inner(factories, count, dependencies):
-
         objs = []
         tagged_objects = dependencies.get(
             dependency, list(CONFIG_BY_ID[dependency]["model"].objects.all().only("pk"))
@@ -71,22 +68,33 @@ def create_taggable_items(dependency):
 
 
 CONFIG = [
+    {
+        "id": "artist_credit",
+        "model": music_models.ArtistCredit,
+        "factory": "music.ArtistCredit",
+        "factory_kwargs": {"joinphrase": ""},
+        "depends_on": [
+            {"field": "artist", "id": "artists", "default_factor": 0.5},
+        ],
+    },
     {
         "id": "tracks",
         "model": music_models.Track,
         "factory": "music.Track",
-        "factory_kwargs": {"artist": None, "album": None},
+        "factory_kwargs": {"album": None},
         "depends_on": [
             {"field": "album", "id": "albums", "default_factor": 0.1},
-            {"field": "artist", "id": "artists", "default_factor": 0.05},
+            {"field": "artist_credit", "id": "artist_credit", "default_factor": 0.05},
         ],
     },
     {
         "id": "albums",
         "model": music_models.Album,
         "factory": "music.Album",
-        "factory_kwargs": {"artist": None},
-        "depends_on": [{"field": "artist", "id": "artists", "default_factor": 0.3}],
+        "factory_kwargs": {},
+        "depends_on": [
+            {"field": "artist_credit", "id": "artist_credit", "default_factor": 0.3}
+        ],
     },
     {"id": "artists", "model": music_models.Artist, "factory": "music.Artist"},
     {
@@ -238,6 +246,7 @@ class Command(BaseCommand):
 
     def handle(self, *args, **options):
         from django.apps import apps
+
         from funkwhale_api import factories
 
         app_names = [app.name for app in apps.app_configs.values()]
@@ -261,7 +270,6 @@ class Command(BaseCommand):
 
         self.stdout.write("")
         if options["dry_run"]:
-
             self.stdout.write(
                 "Run this command with --no-dry-run to commit the changes to the database"
             )
@@ -313,12 +321,23 @@ class Command(BaseCommand):
                 candidates = list(queryset.values_list("pk", flat=True))
                 picked_pks = [random.choice(candidates) for _ in objects]
                 picked_objects = {o.pk: o for o in queryset.filter(pk__in=picked_pks)}
+
+            saved_obj = []
             for i, obj in enumerate(objects):
                 if create_dependencies:
                     value = random.choice(candidates)
                 else:
                     value = picked_objects[picked_pks[i]]
+                if dependency["field"] == "artist_credit":
+                    obj.save()
+                    obj.artist_credit.set([value])
+                    saved_obj.append(obj)
+
+                else:
                     setattr(obj, dependency["field"], value)
+            if saved_obj:
+                return saved_obj
+
         if not handler:
             objects = row["model"].objects.bulk_create(objects, batch_size=BATCH_SIZE)
         results[row["id"]] = objects

api/funkwhale_api/common/management/commands/makemigrations.py

-import os
-
+from django.conf import settings
 from django.core.management.base import CommandError
 from django.core.management.commands.makemigrations import Command as BaseCommand
 
@@ -11,8 +10,8 @@ class Command(BaseCommand):
 
         We ensure the command is disabled, unless a specific env var is provided.
         """
-        force = os.environ.get("FORCE") == "1"
-        if not force:
+        force = settings.FORCE
+        if not force == 1:
             raise CommandError(
                 "Running makemigrations on your Funkwhale instance can have desastrous"
                 " consequences. This command is disabled, and should only be run in "

api/funkwhale_api/common/management/commands/script.py

@@ -26,7 +26,7 @@ class Command(BaseCommand):
             script = available_scripts[name]
         except KeyError:
             raise CommandError(
-                "{} is not a valid script. Run python manage.py script for a "
+                "{} is not a valid script. Run funkwhale-manage script for a "
                 "list of available scripts".format(name)
             )
 
@@ -43,14 +43,14 @@ class Command(BaseCommand):
     def show_help(self):
         self.stdout.write("")
         self.stdout.write("Available scripts:")
-        self.stdout.write("Launch with: python manage.py <script_name>")
+        self.stdout.write("Launch with: funkwhale-manage script <script_name>")
         available_scripts = self.get_scripts()
         for name, script in sorted(available_scripts.items()):
             self.stdout.write("")
             self.stdout.write(self.style.SUCCESS(name))
             self.stdout.write("")
             for line in script["help"].splitlines():
-                self.stdout.write("     {}".format(line))
+                self.stdout.write(f"     {line}")
         self.stdout.write("")
 
     def get_scripts(self):

api/funkwhale_api/common/management/commands/testdata.py

+from django.core.management.commands.migrate import Command as BaseCommand
+
+from funkwhale_api.federation import factories
+from funkwhale_api.federation.models import Actor
+
+
+class Command(BaseCommand):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        self.help = "Helper to generate randomized testdata"
+        self.type_choices = {"notifications": self.handle_notifications}
+        self.missing_args_message = f"Please specify one of the following sub-commands: {*self.type_choices.keys(), }"
+
+    def add_arguments(self, parser):
+        subparsers = parser.add_subparsers(dest="subcommand")
+
+        notification_parser = subparsers.add_parser("notifications")
+        notification_parser.add_argument(
+            "username", type=str, help="Username to send the notifications to"
+        )
+        notification_parser.add_argument(
+            "--count", type=int, help="Number of elements to create", default=1
+        )
+
+    def handle(self, *args, **options):
+        self.type_choices[options["subcommand"]](options)
+
+    def handle_notifications(self, options):
+        self.stdout.write(
+            f"Create {options['count']} notification(s) for {options['username']}"
+        )
+        try:
+            actor = Actor.objects.get(preferred_username=options["username"])
+        except Actor.DoesNotExist:
+            self.stdout.write(
+                "The user you want to create notifications for does not exist"
+            )
+            return
+
+        follow_activity = factories.ActivityFactory(type="Follow")
+        for _ in range(options["count"]):
+            factories.InboxItemFactory(actor=actor, activity=follow_activity)

api/funkwhale_api/common/middleware.py

 import html
-import logging
 import io
+import logging
 import os
 import re
 import time
+import tracemalloc
 import urllib.parse
 import xml.sax.saxutils
 
-from django import http
+from django import http, urls
 from django.conf import settings
+from django.contrib import auth
 from django.core.cache import caches
-from django import urls
+from django.middleware import csrf
 from rest_framework import views
 
 from funkwhale_api.federation import utils as federation_utils
 
-from . import preferences
-from . import session
-from . import throttling
-from . import utils
+from . import preferences, session, throttling, utils
 
 EXCLUDED_PATHS = ["/api", "/federation", "/.well-known"]
 
@@ -79,9 +78,14 @@ def serve_spa(request):
         # We add the style add the end of the body to ensure it has the highest
         # priority (since it will come after other stylesheets)
         body, tail = tail.split("</body>", 1)
-        css = "<style>{}</style>".format(css)
+        css = f"<style>{css}</style>"
         tail = body + "\n" + css + "\n</body>" + tail
-    return http.HttpResponse(head + tail)
+
+    # set a csrf token so that visitor can login / query API if needed
+    token = csrf.get_token(request)
+    response = http.HttpResponse(head + tail)
+    response.set_cookie("csrftoken", token, max_age=None)
+    return response
 
 
 MANIFEST_LINK_REGEX = re.compile(r"<link [^>]*rel=(?:'|\")?manifest(?:'|\")?[^>]*>")
@@ -89,13 +93,13 @@ TITLE_REGEX = re.compile(r"<title>.*</title>")
 
 
 def replace_manifest_url(head, new_url):
-    replacement = '<link rel=manifest href="{}">'.format(new_url)
+    replacement = f'<link rel=manifest href="{new_url}">'
     head = MANIFEST_LINK_REGEX.sub(replacement, head)
     return head
 
 
 def replace_title(head, new_title):
-    replacement = "<title>{}</title>".format(html.escape(new_title))
+    replacement = f"<title>{html.escape(new_title)}</title>"
     head = TITLE_REGEX.sub(replacement, head)
     return head
 
@@ -106,20 +110,23 @@ def get_spa_html(spa_url):
 
 def get_spa_file(spa_url, name):
     if spa_url.startswith("/"):
-        # XXX: spa_url is an absolute path to index.html, on the local disk.
+        # spa_url is an absolute path to index.html, on the local disk.
         # However, we may want to access manifest.json or other files as well, so we
         # strip the filename
         path = os.path.join(os.path.dirname(spa_url), name)
         # we try to open a local file
         with open(path, "rb") as f:
             return f.read().decode("utf-8")
-    cache_key = "spa-file:{}:{}".format(spa_url, name)
+    cache_key = f"spa-file:{spa_url}:{name}"
     cached = caches["local"].get(cache_key)
     if cached:
         return cached
 
-    response = session.get_session().get(utils.join_url(spa_url, name),)
+    response = session.get_session().get(
+        utils.join_url(spa_url, name),
+    )
     response.raise_for_status()
+    response.encoding = "utf-8"
     content = response.text
     caches["local"].set(cache_key, content, settings.FUNKWHALE_SPA_HTML_CACHE_DURATION)
     return content
@@ -143,7 +150,9 @@ def get_default_head_tags(path):
         {
             "tag": "meta",
             "property": "og:image",
-            "content": utils.join_url(settings.FUNKWHALE_URL, "/front/favicon.png"),
+            "content": utils.join_url(
+                settings.FUNKWHALE_URL, "/android-chrome-512x512.png"
+            ),
         },
         {
             "tag": "meta",
@@ -160,15 +169,10 @@ def render_tags(tags):
     <meta hello="world" />
     """
     for tag in tags:
-
         yield "<{tag} {attrs} />".format(
             tag=tag.pop("tag"),
             attrs=" ".join(
-                [
-                    '{}="{}"'.format(a, html.escape(str(v)))
-                    for a, v in sorted(tag.items())
-                    if v
-                ]
+                [f'{a}="{html.escape(str(v))}"' for a, v in sorted(tag.items()) if v]
             ),
         )
 
@@ -276,6 +280,25 @@ def monkey_patch_rest_initialize_request():
 monkey_patch_rest_initialize_request()
 
 
+def monkey_patch_auth_get_user():
+    """
+    We need an actor on our users for many endpoints, so we monkey patch
+    auth.get_user to create it if it's missing
+    """
+    original = auth.get_user
+
+    def replacement(request):
+        r = original(request)
+        if not r.is_anonymous and not r.actor:
+            r.create_actor()
+        return r
+
+    setattr(auth, "get_user", replacement)
+
+
+monkey_patch_auth_get_user()
+
+
 class ThrottleStatusMiddleware:
     """
     Include useful information regarding throttling in API responses to
@@ -379,3 +402,19 @@ class ProfilerMiddleware:
         response = http.HttpResponse("<pre>%s</pre>" % stream.getvalue())
 
         return response
+
+
+class PymallocMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if tracemalloc.is_tracing():
+            snapshot = tracemalloc.take_snapshot()
+            stats = snapshot.statistics("lineno")
+
+            print("Memory trace")
+            for stat in stats[:25]:
+                print(stat)
+
+        return self.get_response(request)

api/funkwhale_api/common/migrations/0002_mutation.py

@@ -36,8 +36,8 @@ class Migration(migrations.Migration):
                     models.UUIDField(db_index=True, default=uuid.uuid4, unique=True),
                 ),
                 ("type", models.CharField(db_index=True, max_length=100)),
-                ("is_approved", models.NullBooleanField(default=None)),
-                ("is_applied", models.NullBooleanField(default=None)),
+                ("is_approved", models.BooleanField(default=None, null=True)),
+                ("is_applied", models.BooleanField(default=None, null=True)),
                 (
                     "creation_date",
                     models.DateTimeField(

api/funkwhale_api/common/migrations/0008_auto_20200701_1317.py

+# Generated by Django 3.0.8 on 2020-07-01 13:17
+
+from django.conf import settings
+import django.contrib.postgres.fields.jsonb
+from django.db import migrations, models
+import django.db.models.deletion
+import django.utils.timezone
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('common', '0007_auto_20200116_1610'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='attachment',
+            name='url',
+            field=models.URLField(blank=True, max_length=500, null=True),
+        ),
+        migrations.CreateModel(
+            name='PluginConfiguration',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('code', models.CharField(max_length=100)),
+                ('conf', django.contrib.postgres.fields.jsonb.JSONField(blank=True, null=True)),
+                ('enabled', models.BooleanField(default=False)),
+                ('creation_date', models.DateTimeField(default=django.utils.timezone.now)),
+                ('user', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='plugins', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'unique_together': {('user', 'code')},
+            },
+        ),
+    ]

api/funkwhale_api/common/migrations/0009_auto_20220627_1915.py

+# Generated by Django 3.2.13 on 2022-06-27 19:15
+
+import django.core.serializers.json
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('common', '0008_auto_20200701_1317'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='mutation',
+            name='is_applied',
+            field=models.BooleanField(default=None, null=True),
+        ),
+        migrations.AlterField(
+            model_name='mutation',
+            name='is_approved',
+            field=models.BooleanField(default=None, null=True),
+        ),
+        migrations.AlterField(
+            model_name='mutation',
+            name='payload',
+            field=models.JSONField(encoder=django.core.serializers.json.DjangoJSONEncoder),
+        ),
+        migrations.AlterField(
+            model_name='mutation',
+            name='previous_state',
+            field=models.JSONField(default=None, encoder=django.core.serializers.json.DjangoJSONEncoder, null=True),
+        ),
+        migrations.AlterField(
+            model_name='pluginconfiguration',
+            name='conf',
+            field=models.JSONField(blank=True, null=True),
+        ),
+    ]

api/funkwhale_api/common/mixins.py

-from rest_framework import serializers
-
 from django.db.models import Q
 from django.shortcuts import get_object_or_404
+from rest_framework import serializers
 
 
-class MultipleLookupDetailMixin(object):
+class MultipleLookupDetailMixin:
     lookup_value_regex = "[^/]+"
     lookup_field = "composite"
 

api/funkwhale_api/common/models.py

-import uuid
-import magic
 import mimetypes
+import uuid
 
-from django.contrib.postgres.fields import JSONField
+import magic
+from django.conf import settings
 from django.contrib.contenttypes.fields import GenericForeignKey
 from django.contrib.contenttypes.models import ContentType
-from django.conf import settings
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db import connections, models, transaction
-from django.db.models import Lookup
+from django.db.models import JSONField, Lookup
 from django.db.models.fields import Field
 from django.db.models.sql.compiler import SQLCompiler
 from django.dispatch import receiver
-from django.utils import timezone
 from django.urls import reverse
-
+from django.utils import timezone
 from versatileimagefield.fields import VersatileImageField
 from versatileimagefield.image_warmer import VersatileImageFieldWarmer
 
 from funkwhale_api.federation import utils as federation_utils
 
-from . import utils
-from . import validators
-
+from . import utils, validators
 
 CONTENT_TEXT_MAX_LENGTH = 5000
 CONTENT_TEXT_SUPPORTED_TYPES = [
@@ -40,7 +36,7 @@ class NotEqual(Lookup):
         lhs, lhs_params = self.process_lhs(compiler, connection)
         rhs, rhs_params = self.process_rhs(compiler, connection)
         params = lhs_params + rhs_params
-        return "%s <> %s" % (lhs, rhs), params
+        return f"{lhs} <> {rhs}", params
 
 
 class NullsLastSQLCompiler(SQLCompiler):
@@ -64,12 +60,12 @@ class NullsLastSQLCompiler(SQLCompiler):
 class NullsLastQuery(models.sql.query.Query):
     """Use a custom compiler to inject 'NULLS LAST' (for PostgreSQL)."""
 
-    def get_compiler(self, using=None, connection=None):
+    def get_compiler(self, using=None, connection=None, elide_empty=True):
         if using is None and connection is None:
             raise ValueError("Need either using or connection")
         if using:
             connection = connections[using]
-        return NullsLastSQLCompiler(self, connection, using)
+        return NullsLastSQLCompiler(self, connection, using, elide_empty)
 
 
 class NullsLastQuerySet(models.QuerySet):
@@ -81,8 +77,8 @@ class NullsLastQuerySet(models.QuerySet):
 class LocalFromFidQuerySet:
     def local(self, include=True):
         host = settings.FEDERATION_HOSTNAME
-        query = models.Q(fid__startswith="http://{}/".format(host)) | models.Q(
-            fid__startswith="https://{}/".format(host)
+        query = models.Q(fid__startswith=f"http://{host}/") | models.Q(
+            fid__startswith=f"https://{host}/"
         )
         if include:
             return self.filter(query)
@@ -116,10 +112,10 @@ class Mutation(models.Model):
 
     type = models.CharField(max_length=100, db_index=True)
     # None = no choice, True = approved, False = refused
-    is_approved = models.NullBooleanField(default=None)
+    is_approved = models.BooleanField(default=None, null=True)
 
     # None = not applied, True = applied, False = failed
-    is_applied = models.NullBooleanField(default=None)
+    is_applied = models.BooleanField(default=None, null=True)
     creation_date = models.DateTimeField(default=timezone.now, db_index=True)
     applied_date = models.DateTimeField(null=True, blank=True, db_index=True)
     summary = models.TextField(max_length=2000, null=True, blank=True)
@@ -187,7 +183,7 @@ class AttachmentQuerySet(models.QuerySet):
             field_query = ~models.Q(**{field: None})
             query = query | field_query if query else field_query
 
-        if include is False:
+        if not include:
             query = ~query
 
         return self.filter(query)
@@ -222,7 +218,8 @@ class Attachment(models.Model):
         validators=[
             validators.ImageDimensionsValidator(min_width=50, min_height=50),
             validators.FileValidator(
-                allowed_extensions=["png", "jpg", "jpeg"], max_size=1024 * 1024 * 5,
+                allowed_extensions=["png", "jpg", "jpeg"],
+                max_size=1024 * 1024 * 5,
             ),
         ],
     )
@@ -260,6 +257,13 @@ class Attachment(models.Model):
         proxy_url = reverse("api:v1:attachments-proxy", kwargs={"uuid": self.uuid})
         return federation_utils.full_url(proxy_url + "?next=original")
 
+    @property
+    def download_url_small_square_crop(self):
+        if self.file:
+            return utils.media_url(self.file.crop["50x50"].url)
+        proxy_url = reverse("api:v1:attachments-proxy", kwargs={"uuid": self.uuid})
+        return federation_utils.full_url(proxy_url + "?next=small_square_crop")
+
     @property
     def download_url_medium_square_crop(self):
         if self.file:
@@ -267,6 +271,13 @@ class Attachment(models.Model):
         proxy_url = reverse("api:v1:attachments-proxy", kwargs={"uuid": self.uuid})
         return federation_utils.full_url(proxy_url + "?next=medium_square_crop")
 
+    @property
+    def download_url_large_square_crop(self):
+        if self.file:
+            return utils.media_url(self.file.crop["600x600"].url)
+        proxy_url = reverse("api:v1:attachments-proxy", kwargs={"uuid": self.uuid})
+        return federation_utils.full_url(proxy_url + "?next=large_square_crop")
+
 
 class MutationAttachment(models.Model):
     """
@@ -358,8 +369,29 @@ CONTENT_FKS = {
 def remove_attached_content(sender, instance, **kwargs):
     fk_fields = CONTENT_FKS.get(instance._meta.label, [])
     for field in fk_fields:
-        if getattr(instance, "{}_id".format(field)):
+        if getattr(instance, f"{field}_id"):
             try:
                 getattr(instance, field).delete()
             except Content.DoesNotExist:
                 pass
+
+
+class PluginConfiguration(models.Model):
+    """
+    Store plugin configuration in DB
+    """
+
+    code = models.CharField(max_length=100)
+    user = models.ForeignKey(
+        "users.User",
+        related_name="plugins",
+        on_delete=models.CASCADE,
+        null=True,
+        blank=True,
+    )
+    conf = JSONField(null=True, blank=True)
+    enabled = models.BooleanField(default=False)
+    creation_date = models.DateTimeField(default=timezone.now)
+
+    class Meta:
+        unique_together = ("user", "code")

api/funkwhale_api/common/mutations.py

 import persisting_theory
-
-from rest_framework import serializers
-
 from django.db import models, transaction
+from rest_framework import serializers
 
 
 class ConfNotFound(KeyError):
@@ -45,7 +43,7 @@ class Registry(persisting_theory.Registry):
 
     def has_perm(self, perm, type, obj, actor):
         if perm not in ["approve", "suggest"]:
-            raise ValueError("Invalid permission {}".format(perm))
+            raise ValueError(f"Invalid permission {perm}")
         conf = self.get_conf(type, obj)
         checker = conf["perm_checkers"].get(perm)
         if not checker:
@@ -56,7 +54,7 @@ class Registry(persisting_theory.Registry):
         try:
             type_conf = self[type]
         except KeyError:
-            raise ConfNotFound("{} is not a registered mutation".format(type))
+            raise ConfNotFound(f"{type} is not a registered mutation")
 
         try:
             conf = type_conf[obj.__class__]
@@ -65,7 +63,7 @@ class Registry(persisting_theory.Registry):
                 conf = type_conf[None]
             except KeyError:
                 raise ConfNotFound(
-                    "No mutation configuration found for {}".format(obj.__class__)
+                    f"No mutation configuration found for {obj.__class__}"
                 )
         return conf
 

api/funkwhale_api/common/permissions.py

@@ -2,7 +2,6 @@ import operator
 
 from django.core.exceptions import ObjectDoesNotExist
 from django.http import Http404
-
 from rest_framework.permissions import BasePermission
 
 from funkwhale_api.common import preferences
@@ -57,3 +56,59 @@ class OwnerPermission(BasePermission):
         if not owner or not request.user.is_authenticated or owner != request.user:
             raise owner_exception
         return True
+
+
+class PrivacyLevelPermission(BasePermission):
+    """
+    Ensure the request actor have access to the object considering the privacylevel configuration
+    of the user.
+    request.user is None if actor, else its Anonymous if user is not auth.
+    """
+
+    def has_object_permission(self, request, view, obj):
+        if (
+            not hasattr(obj, "user")
+            and hasattr(obj, "actor")
+            and not obj.actor.is_local
+        ):
+            # it's a remote actor object. It should be public.
+            # But we could trigger an update of the remote actor data
+            # to avoid leaking data (#2326)
+            return True
+
+        if hasattr(obj, "privacy_level"):
+            privacy_level = obj.privacy_level
+        elif hasattr(obj, "actor") and obj.actor.user:
+            privacy_level = obj.actor.user.privacy_level
+        else:
+            privacy_level = obj.user.privacy_level
+
+        obj_actor = obj.actor if hasattr(obj, "actor") else obj.user.actor
+
+        if privacy_level == "everyone":
+            return True
+
+        # user is anonymous
+        if hasattr(request, "actor"):
+            request_actor = request.actor
+        elif request.user and request.user.is_authenticated:
+            request_actor = request.user.actor
+        else:
+            return False
+
+        if privacy_level == "instance":
+            # user is local
+            if request.user and hasattr(request.user, "actor"):
+                return True
+            elif hasattr(request, "actor") and request.actor and request.actor.is_local:
+                return True
+            else:
+                return False
+
+        elif privacy_level == "me" and obj_actor == request_actor:
+            return True
+
+        elif request_actor in obj_actor.get_approved_followers():
+            return True
+        else:
+            return False

api/funkwhale_api/common/preferences.py

 import json
 
 from django import forms
-from django.contrib.postgres.forms import JSONField
 from django.conf import settings
+from django.forms import JSONField
 from dynamic_preferences import serializers, types
 from dynamic_preferences.registries import global_preferences_registry
 
 
-class DefaultFromSettingMixin(object):
+class DefaultFromSettingMixin:
     def get_default(self):
         return getattr(settings, self.setting)
 
@@ -38,7 +38,7 @@ class StringListSerializer(serializers.BaseSerializer):
 
         if type(value) not in [list, tuple]:
             raise cls.exception(
-                "Cannot serialize, value {} is not a list or a tuple".format(value)
+                f"Cannot serialize, value {value} is not a list or a tuple"
             )
 
         if cls.sort:
@@ -57,7 +57,7 @@ class StringListPreference(types.BasePreferenceType):
     field_class = forms.MultipleChoiceField
 
     def get_api_additional_data(self):
-        d = super(StringListPreference, self).get_api_additional_data()
+        d = super().get_api_additional_data()
         d["choices"] = self.get("choices")
         return d
 
@@ -72,14 +72,14 @@ class JSONSerializer(serializers.BaseSerializer):
         data_serializer = cls.data_serializer_class(data=value)
         if not data_serializer.is_valid():
             raise cls.exception(
-                "{} is not a valid value: {}".format(value, data_serializer.errors)
+                f"{value} is not a valid value: {data_serializer.errors}"
             )
         value = data_serializer.validated_data
         try:
             return json.dumps(value, sort_keys=True)
         except TypeError:
             raise cls.exception(
-                "Cannot serialize, value {} is not JSON serializable".format(value)
+                f"Cannot serialize, value {value} is not JSON serializable"
             )
 
     @classmethod
@@ -93,7 +93,6 @@ class SerializedPreference(types.BasePreferenceType):
     serializer
     """
 
-    serializer = JSONSerializer
     data_serializer_class = None
     field_class = JSONField
     widget = forms.Textarea

api/funkwhale_api/common/renderers.py

+from rest_framework.renderers import JSONRenderer
+
+
+class ActivityStreamRenderer(JSONRenderer):
+    media_type = "application/activity+json"

api/funkwhale_api/common/routers.py

-from rest_framework.routers import SimpleRouter
+from rest_framework.routers import DefaultRouter
 
 
-class OptionalSlashRouter(SimpleRouter):
+class OptionalSlashRouter(DefaultRouter):
     def __init__(self):
         super().__init__()
         self.trailing_slash = "/?"

api/funkwhale_api/common/scripts/__init__.py

-from . import create_actors
-from . import create_image_variations
-from . import django_permissions_to_user_permissions
-from . import migrate_to_user_libraries
-from . import delete_pre_017_federated_uploads
-from . import test
-
+from . import (
+    create_actors,
+    delete_pre_017_federated_uploads,
+    django_permissions_to_user_permissions,
+    migrate_to_user_libraries,
+    test,
+)
 
 __all__ = [
     "create_actors",
-    "create_image_variations",
     "django_permissions_to_user_permissions",
     "migrate_to_user_libraries",
     "delete_pre_017_federated_uploads",