Merge branch 'release/2.8.0' into 'stable'

Release/2.8.0 See merge request pleroma/pleroma!4295
2024-12-21 23:56:30 +00:00 · 2024-12-19 10:15:30 +00:00 · 2024-12-19 10:15:30 +00:00 · 1170dfdd49
commit 1170dfdd49
parent 31487e5be4 c0fdd0e2cf
215 changed files with 4472 additions and 1977 deletions
--- a/.gitignore
+++ b/.gitignore
@ -63,3 +63,6 @@ pleroma.iml

 archive-*
 .gitlab-ci-local
+
+# Test files should be named *.exs
+test/pleroma/**/*.ex
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -1,14 +1,15 @@
-image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13.4-otp-25
+image: git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.14.5-otp-25

 variables: &global_variables
  # Only used for the release
-  ELIXIR_VER: 1.13.4
+  ELIXIR_VER: 1.14.5
  POSTGRES_DB: pleroma_test
  POSTGRES_USER: postgres
  POSTGRES_PASSWORD: postgres
  DB_HOST: postgres
  DB_PORT: "5432"
  MIX_ENV: test
+  GIT_STRATEGY: fetch

 workflow:
  rules:
@ -70,7 +71,7 @@ check-changelog:
  tags:
    - amd64

-build-1.13.4-otp-25:
+build-1.14.5-otp-25:
  extends:
  - .build_changes_policy
  - .using-ci-base
@ -118,7 +119,7 @@ benchmark:
    - mix ecto.migrate
    - mix pleroma.load_testing

-unit-testing-1.13.4-otp-25:
+unit-testing-1.14.5-otp-25:
  extends:
  - .build_changes_policy
  - .using-ci-base
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -4,6 +4,65 @@ All notable changes to this project will be documented in this file.

 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

+## 2.8.0
+
+### Changed
+- Metadata: Do not include .atom feed links for remote accounts
+- Bumped `fast_html` to v2.3.0, which notably allows to use system-installed lexbor with passing `WITH_SYSTEM_LEXBOR=1` environment variable at build-time
+- Dedupe upload filter now uses a three-level sharding directory structure
+- Deprecate `/api/v1/pleroma/accounts/:id/subscribe`/`unsubscribe`
+- Restrict incoming activities from unknown actors to a subset that does not imply a previous relationship and early rejection of unrecognized activity types.
+- Elixir 1.14 and Erlang/OTP 23 is now the minimum supported release
+- Support `id` param in `GET /api/v1/statuses`
+- LDAP authentication has been refactored to operate as a GenServer process which will maintain an active connection to the LDAP server.
+- Fix 'Setting a marker should mark notifications as read'
+- Adjust more Oban workers to enforce unique job constraints.
+- Oban updated to 2.18.3
+- Publisher behavior improvement when snoozing Oban jobs due to Gun connection pool contention.
+- Poll results refreshing is handled asynchronously and will not attempt to keep fetching updates to a closed poll.
+- Tuning for release builds to lower CPU usage.
+- Rich Media preview fetching will skip making an HTTP HEAD request to check a URL for allowed content type and length if the Tesla adapter is Gun or Finch
+- Fix nonexisting user will not generate metadata for search engine opt-out
+- Update Oban to 2.18
+- Worker configuration is no longer available. This only affects custom max_retries values for a couple Oban queues.
+
+### Added
+- Add metadata provider for ActivityPub alternate links
+- Added support for argon2 passwords and their conversion for migration from Akkoma fork to upstream.
+- Respect :restrict_unauthenticated for hashtag rss/atom feeds
+- LDAP configuration now permits overriding the CA root certificate file for TLS validation.
+- LDAP now supports users changing their passwords
+- Include list id in StatusView
+- Added MRF.FODirectReply which changes replies to followers-only posts to be direct.
+- Add `id_filter` to MRF to filter URLs and their domain prior to fetching
+- Added MRF.QuietReply which prevents replies to public posts from being published to the timelines
+- Add `group_key` to notifications
+- Allow providing avatar/header descriptions
+- Added RemoteReportPolicy from Rebased for handling bogus federated reports
+- scrubbers/default: Allow "mention hashtag" classes used by Mastodon
+- Added dependencies for Swoosh's Mua mail adapter
+- Include session scopes in TokenView
+
+### Fixed
+- Verify a local Update sent through AP C2S so users can only update their own objects
+- Fixed malformed follow requests that cause them to appear stuck pending due to the recipient being unable to process them.
+- Fix incoming Block activities being rejected
+- STARTTLS certificate and hostname verification for LDAP authentication
+- LDAPS connections (implicit TLS) are now supported.
+- Fix /api/v2/media returning the wrong status code (202) for media processed synchronously
+- Miscellaneous fixes for Meilisearch support
+- Fix pleroma_ctl mix task calls sometimes not being found
+- Add a rate limiter to the OAuth App creation endpoint and ensure registered apps are assigned to users.
+- ReceiverWorker will cancel processing jobs instead of retrying if the user cannot be fetched due to 403, 404, or 410 errors or if the account is disabled locally.
+- Address case where instance reachability status couldn't be updated
+- Remote Fetcher Worker recognizes more permanent failure errors
+- StreamerView: Do not leak follows count if hidden
+- Imports of blocks, mutes, and follows would retry repeatedly due to incorrect error handling and all work executed in a single job
+- Make vapid_config return empty array, fixing preloading for instances without push notifications configured
+
+### Removed
+- Remove stub for /api/v1/accounts/:id/identity_proofs (deprecated by Mastodon 3.5.0)
+
 ## 2.7.1

 ### Changed
--- a/7
+++ b/7
@ -1,7 +1,8 @@
+# https://hub.docker.com/r/hexpm/elixir/tags
 ARG ELIXIR_IMG=hexpm/elixir
-ARG ELIXIR_VER=1.13.4
-ARG ERLANG_VER=24.3.4.15
-ARG ALPINE_VER=3.17.5
+ARG ELIXIR_VER=1.14.5
+ARG ERLANG_VER=25.3.2.14
+ARG ALPINE_VER=3.17.9

 FROM ${ELIXIR_IMG}:${ELIXIR_VER}-erlang-${ERLANG_VER}-alpine-${ALPINE_VER} as build

--- a/ci/elixir-1.12/build_and_push.sh
+++ b/ci/elixir-1.12/build_and_push.sh
@ -1 +0,0 @@
-docker buildx build --platform linux/amd64,linux/arm64,linux/arm/v7 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.12 --push .
--- a/ci/elixir-1.13.4-otp-25/Dockerfile
+++ b/ci/elixir-1.13.4-otp-25/Dockerfile
@ -1,8 +0,0 @@
-FROM elixir:1.13.4-otp-25
-
-# Single RUN statement, otherwise intermediate images are created
-# https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run
-RUN apt-get update &&\
-	apt-get install -y libmagic-dev cmake libimage-exiftool-perl ffmpeg &&\
-	mix local.hex --force &&\
-	mix local.rebar --force
--- a/ci/elixir-1.14.5-otp-25/Dockerfile
+++ b/ci/elixir-1.14.5-otp-25/Dockerfile
@ -1,4 +1,4 @@
-FROM elixir:1.12.3
+FROM elixir:1.14.5-otp-25

 # Single RUN statement, otherwise intermediate images are created
 # https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run
--- a/ci/elixir-1.14.5-otp-25/build_and_push.sh
+++ b/ci/elixir-1.14.5-otp-25/build_and_push.sh
@ -1 +1 @@
-docker buildx build --platform linux/amd64,linux/arm64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.13.4-otp-25 --push .
+docker buildx build --platform linux/amd64,linux/arm64 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.14.5-otp-25 --push .
--- a/config/config.exs
+++ b/config/config.exs
@ -344,7 +344,7 @@ config :pleroma, :manifest,
  icons: [
    %{
      src: "/static/logo.svg",
-      sizes: "144x144",
+      sizes: "512x512",
      purpose: "any",
      type: "image/svg+xml"
    }
@ -434,6 +434,11 @@ config :pleroma, :mrf_follow_bot, follower_nickname: nil

 config :pleroma, :mrf_inline_quote, template: "<bdi>RT:</bdi> {url}"

+config :pleroma, :mrf_remote_report,
+  reject_all: false,
+  reject_anonymous: true,
+  reject_empty_message: true
+
 config :pleroma, :mrf_force_mention,
  mention_parent: true,
  mention_quoted: true
@ -597,14 +602,8 @@ config :pleroma, Oban,
  plugins: [{Oban.Plugins.Pruner, max_age: 900}],
  crontab: [
    {"0 0 * * 0", Pleroma.Workers.Cron.DigestEmailsWorker},
-    {"0 0 * * *", Pleroma.Workers.Cron.NewUsersDigestWorker}
-  ]
-
-config :pleroma, :workers,
-  retries: [
-    federator_incoming: 5,
-    federator_outgoing: 5,
-    search_indexing: 2
+    {"0 0 * * *", Pleroma.Workers.Cron.NewUsersDigestWorker},
+    {"*/10 * * * *", Pleroma.Workers.Cron.AppCleanupWorker}
  ]

 config :pleroma, Pleroma.Formatter,
@ -618,14 +617,17 @@ config :pleroma, Pleroma.Formatter,

 config :pleroma, :ldap,
  enabled: System.get_env("LDAP_ENABLED") == "true",
-  host: System.get_env("LDAP_HOST") || "localhost",
-  port: String.to_integer(System.get_env("LDAP_PORT") || "389"),
+  host: System.get_env("LDAP_HOST", "localhost"),
+  port: String.to_integer(System.get_env("LDAP_PORT", "389")),
  ssl: System.get_env("LDAP_SSL") == "true",
  sslopts: [],
  tls: System.get_env("LDAP_TLS") == "true",
  tlsopts: [],
-  base: System.get_env("LDAP_BASE") || "dc=example,dc=com",
-  uid: System.get_env("LDAP_UID") || "cn"
+  base: System.get_env("LDAP_BASE", "dc=example,dc=com"),
+  uid: System.get_env("LDAP_UID", "cn"),
+  # defaults to CAStore's Mozilla roots
+  cacertfile: System.get_env("LDAP_CACERTFILE", nil),
+  mail: System.get_env("LDAP_MAIL", "mail")

 oauth_consumer_strategies =
  System.get_env("OAUTH_CONSUMER_STRATEGIES")
@ -718,6 +720,7 @@ config :pleroma, :rate_limit,
  timeline: {500, 3},
  search: [{1000, 10}, {1000, 30}],
  app_account_creation: {1_800_000, 25},
+  oauth_app_creation: {900_000, 5},
  relations_actions: {10_000, 10},
  relation_id_action: {60_000, 2},
  statuses_actions: {10_000, 15},
--- a/config/description.exs
+++ b/config/description.exs
@ -2013,23 +2013,6 @@ config :pleroma, :config_description, [
      }
    ]
  },
-  %{
-    group: :pleroma,
-    key: :workers,
-    type: :group,
-    description: "Includes custom worker options not interpretable directly by `Oban`",
-    children: [
-      %{
-        key: :retries,
-        type: {:keyword, :integer},
-        description: "Max retry attempts for failed jobs, per `Oban` queue",
-        suggestions: [
-          federator_incoming: 5,
-          federator_outgoing: 5
-        ]
-      }
-    ]
-  },
  %{
    group: :pleroma,
    key: Pleroma.Web.Metadata,
@ -2258,14 +2241,8 @@ config :pleroma, :config_description, [
        label: "SSL options",
        type: :keyword,
        description: "Additional SSL options",
-        suggestions: [cacertfile: "path/to/file/with/PEM/cacerts", verify: :verify_peer],
+        suggestions: [verify: :verify_peer],
        children: [
-          %{
-            key: :cacertfile,
-            type: :string,
-            description: "Path to file with PEM encoded cacerts",
-            suggestions: ["path/to/file/with/PEM/cacerts"]
-          },
          %{
            key: :verify,
            type: :atom,
@ -2285,14 +2262,8 @@ config :pleroma, :config_description, [
        label: "TLS options",
        type: :keyword,
        description: "Additional TLS options",
-        suggestions: [cacertfile: "path/to/file/with/PEM/cacerts", verify: :verify_peer],
+        suggestions: [verify: :verify_peer],
        children: [
-          %{
-            key: :cacertfile,
-            type: :string,
-            description: "Path to file with PEM encoded cacerts",
-            suggestions: ["path/to/file/with/PEM/cacerts"]
-          },
          %{
            key: :verify,
            type: :atom,
@ -2309,11 +2280,25 @@ config :pleroma, :config_description, [
      },
      %{
        key: :uid,
-        label: "UID",
+        label: "UID Attribute",
        type: :string,
        description:
          "LDAP attribute name to authenticate the user, e.g. when \"cn\", the filter will be \"cn=username,base\"",
        suggestions: ["cn"]
+      },
+      %{
+        key: :cacertfile,
+        label: "CACertfile",
+        type: :string,
+        description: "Path to CA certificate file"
+      },
+      %{
+        key: :mail,
+        label: "Mail Attribute",
+        type: :string,
+        description:
+          "LDAP attribute name to use as the email address when automatically registering the user on first login",
+        suggestions: ["mail"]
      }
    ]
  },
--- a/docs/configuration/cheatsheet.md
+++ b/docs/configuration/cheatsheet.md
@ -742,6 +742,21 @@ config :pleroma, Pleroma.Emails.Mailer,
  auth: :always
 ```

+An example for Mua adapter:
+
+```elixir
+config :pleroma, Pleroma.Emails.Mailer,
+  enabled: true,
+  adapter: Swoosh.Adapters.Mua,
+  relay: "mail.example.com",
+  port: 465,
+  auth: [
+    username: "YOUR_USERNAME@domain.tld",
+    password: "YOUR_SMTP_PASSWORD"
+  ],
+  protocol: :ssl
+```
+
 ### :email_notifications

 Email notifications settings.
@ -968,12 +983,13 @@ Pleroma account will be created with the same name as the LDAP user name.
 * `enabled`: enables LDAP authentication
 * `host`: LDAP server hostname
 * `port`: LDAP port, e.g. 389 or 636
-* `ssl`: true to use SSL, usually implies the port 636
+* `ssl`: true to use implicit SSL/TLS, usually port 636
 * `sslopts`: additional SSL options
-* `tls`: true to start TLS, usually implies the port 389
+* `tls`: true to use explicit TLS (STARTTLS), usually port 389
 * `tlsopts`: additional TLS options
 * `base`: LDAP base, e.g. "dc=example,dc=com"
 * `uid`: LDAP attribute name to authenticate the user, e.g. when "cn", the filter will be "cn=username,base"
+* `cacertfile`: Path to alternate CA root certificates file

 Note, if your LDAP server is an Active Directory server the correct value is commonly `uid: "cn"`, but if you use an
 OpenLDAP server the value may be `uid: "uid"`.
--- a/docs/development/API/admin_api.md
+++ b/docs/development/API/admin_api.md
@ -433,7 +433,7 @@ Response:
 * On success: URL of the unfollowed relay

 ```json
-{"https://example.com/relay"}
+"https://example.com/relay"
 ```

 ## `POST /api/v1/pleroma/admin/users/invite_token`
@ -1193,20 +1193,23 @@ Loads json generated from `config/descriptions.exs`.
 - Response:

 ```json
-[
-  {
-    "id": 1234,
-    "data": {
-      "actor": {
-        "id": 1,
-        "nickname": "lain"
+{
+  "items": [
+    {
+      "id": 1234,
+      "data": {
+        "actor": {
+          "id": 1,
+          "nickname": "lain"
+        },
+        "action": "relay_follow"
      },
-      "action": "relay_follow"
-    },
-    "time": 1502812026, // timestamp
-    "message": "[2017-08-15 15:47:06] @nick0 followed relay: https://example.org/relay" // log message
-  }
-]
+      "time": 1502812026, // timestamp
+      "message": "[2017-08-15 15:47:06] @nick0 followed relay: https://example.org/relay" // log message
+    }
+  ],
+  "total": 1
+}
 ```

 ## `POST /api/v1/pleroma/admin/reload_emoji`
--- a/docs/development/API/differences_in_mastoapi_responses.md
+++ b/docs/development/API/differences_in_mastoapi_responses.md
@ -42,6 +42,7 @@ Has these additional fields under the `pleroma` object:
 - `quotes_count`: the count of status quotes.
 - `non_anonymous`: true if the source post specifies the poll results are not anonymous. Currently only implemented by Smithereen.
 - `bookmark_folder`: the ID of the folder bookmark is stored within (if any).
+- `list_id`: the ID of the list the post is addressed to (if any, only returned to author).

 The `GET /api/v1/statuses/:id/source` endpoint additionally has the following attributes:

@ -103,7 +104,7 @@ Has these additional fields under the `pleroma` object:
 - `background_image`: nullable URL string, background image of the user
 - `tags`: Lists an array of tags for the user
 - `relationship` (object): Includes fields as documented for Mastodon API https://docs.joinmastodon.org/entities/relationship/
- `is_moderator`: boolean, nullable,  true if user is a moderator
+- `is_moderator`: boolean, nullable, true if user is a moderator
 - `is_admin`: boolean, nullable, true if user is an admin
 - `confirmation_pending`: boolean, true if a new user account is waiting on email confirmation to be activated
 - `hide_favorites`: boolean, true when the user has hiding favorites enabled
@ -120,6 +121,8 @@ Has these additional fields under the `pleroma` object:
 - `notification_settings`: object, can be absent. See `/api/v1/pleroma/notification_settings` for the parameters/keys returned.
 - `accepts_chat_messages`: boolean, but can be null if we don't have that information about a user
 - `favicon`: nullable URL string, Favicon image of the user's instance
+- `avatar_description`: string, image description for user avatar, defaults to empty string
+- `header_description`: string, image description for user banner, defaults to empty string

 ### Source

@ -255,6 +258,8 @@ Additional parameters can be added to the JSON body/Form data:
 - `actor_type` - the type of this account.
 - `accepts_chat_messages` - if false, this account will reject all chat messages.
 - `language` - user's preferred language for receiving emails (digest, confirmation, etc.)
+- `avatar_description` - image description for user avatar
+- `header_description` - image description for user banner

 All images (avatar, banner and background) can be reset to the default by sending an empty string ("") instead of a file.

@ -510,12 +515,6 @@ Pleroma is generally compatible with the Mastodon 2.7.2 API, but some newer feat

 - `GET /api/v1/trends`: Returns an empty array, `[]`

-### Identity proofs
-
-*Added in Mastodon 2.8.0*
-
- `GET /api/v1/identity_proofs`: Returns an empty array, `[]`
-
 ### Featured tags

 *Added in Mastodon 3.0.0*
--- a/docs/development/API/pleroma_api.md
+++ b/docs/development/API/pleroma_api.md
@ -145,6 +145,9 @@ See [Admin-API](admin_api.md)

 ## `/api/v1/pleroma/accounts/:id/subscribe`
 ### Subscribe to receive notifications for all statuses posted by a user
+
+Deprecated. `notify` parameter in `POST /api/v1/accounts/:id/follow` should be used instead.
+
 * Method `POST`
 * Authentication: required
 * Params:
@ -171,6 +174,9 @@ See [Admin-API](admin_api.md)

 ## `/api/v1/pleroma/accounts/:id/unsubscribe`
 ### Unsubscribe to stop receiving notifications from user statuses
+
+Deprecated. `notify` parameter in `POST /api/v1/accounts/:id/follow` should be used instead.
+
 * Method `POST`
 * Authentication: required
 * Params:
--- a/docs/installation/debian_based_en.md
+++ b/docs/installation/debian_based_en.md
@ -69,12 +69,18 @@ cd /opt/pleroma
 sudo -Hu pleroma mix deps.get
 ```

-* Generate the configuration: `sudo -Hu pleroma MIX_ENV=prod mix pleroma.instance gen`
+* Generate the configuration: 
+
+```shell
+sudo -Hu pleroma MIX_ENV=prod mix pleroma.instance gen`
+```
+
+* During this process:
  * Answer with `yes` if it asks you to install `rebar3`.
  * This may take some time, because parts of pleroma get compiled first.
  * After that it will ask you a few questions about your instance and generates a configuration file in `config/generated_config.exs`.

-* Check the configuration and if all looks right, rename it, so Pleroma will load it (`prod.secret.exs` for productive instance, `dev.secret.exs` for development instances):
+* Check the configuration and if all looks right, rename it, so Pleroma will load it (`prod.secret.exs` for production instances, `dev.secret.exs` for development instances):

 ```shell
 sudo -Hu pleroma mv config/{generated_config.exs,prod.secret.exs}
--- a/docs/installation/debian_based_jp.md
+++ b/docs/installation/debian_based_jp.md
@ -14,7 +14,7 @@ Note: This article is potentially outdated because at this time we may not have

 - PostgreSQL 11.0以上 (Ubuntu16.04では9.5しか提供されていないので，[](https://www.postgresql.org/download/linux/ubuntu/)こちらから新しいバージョンを入手してください)
 - `postgresql-contrib` 11.0以上 (同上)
- Elixir 1.13 以上 ([Debianのリポジトリからインストールしないこと！！！ ここからインストールすること！](https://elixir-lang.org/install.html#unix-and-unix-like)。または [asdf](https://github.com/asdf-vm/asdf) をpleromaユーザーでインストールしてください)
+- Elixir 1.14 以上 ([Debianのリポジトリからインストールしないこと！！！ ここからインストールすること！](https://elixir-lang.org/install.html#unix-and-unix-like)。または [asdf](https://github.com/asdf-vm/asdf) をpleromaユーザーでインストールしてください)
 - `erlang-dev`
 - `erlang-nox`
 - `git`
--- a/docs/installation/freebsd_en.md
+++ b/docs/installation/freebsd_en.md
@ -31,7 +31,7 @@ Setup the required services to automatically start at boot, using `sysrc(8)`.
 ### Install media / graphics packages (optional, see [`docs/installation/optional/media_graphics_packages.md`](../installation/optional/media_graphics_packages.md))

 ```shell
-# pkg install imagemagick ffmpeg p5-Image-ExifTool
+# pkg install imagemagick ffmpeg p5-Image-ExifTool vips
 ```

 ## Configuring Pleroma
--- a/docs/installation/generic_dependencies.include
+++ b/docs/installation/generic_dependencies.include
@ -1,8 +1,8 @@
 ## Required dependencies

 * PostgreSQL >=11.0
-* Elixir >=1.13.0 <1.17
-* Erlang OTP >=22.2.0 (supported: <27)
+* Elixir >=1.14.0 <1.17
+* Erlang OTP >=23.0.0 (supported: <27)
 * git
 * file / libmagic
 * gcc or clang
--- a/docs/installation/openbsd_en.md
+++ b/docs/installation/openbsd_en.md
@ -12,7 +12,7 @@ For any additional information regarding commands and configuration files mentio
 To install them, run the following command (with doas or as root):

 ```
-pkg_add elixir gmake git postgresql-server postgresql-contrib cmake ffmpeg ImageMagick
+pkg_add elixir gmake git postgresql-server postgresql-contrib cmake ffmpeg ImageMagick libvips
 ```

 Pleroma requires a reverse proxy, OpenBSD has relayd in base (and is used in this guide) and packages/ports are available for nginx (www/nginx) and apache (www/apache-httpd). Independently of the reverse proxy, [acme-client(1)](https://man.openbsd.org/acme-client) can be used to get a certificate from Let's Encrypt.
--- a/docs/installation/openbsd_fi.md
+++ b/docs/installation/openbsd_fi.md
@ -18,7 +18,7 @@ Matrix-kanava #pleroma:libera.chat ovat hyviä paikkoja löytää apua

 Asenna tarvittava ohjelmisto:

-`# pkg_add git elixir gmake postgresql-server-10.3 postgresql-contrib-10.3 cmake ffmpeg ImageMagick`
+`# pkg_add git elixir gmake postgresql-server-10.3 postgresql-contrib-10.3 cmake ffmpeg ImageMagick libvips`

 #### Optional software

--- a/installation/openldap/pw_self_service.ldif
+++ b/installation/openldap/pw_self_service.ldif
@ -0,0 +1,7 @@
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+add: olcAccess
+olcAccess: {1}to attrs=userPassword
+  by self write
+  by anonymous auth
+  by * none
--- a/lib/mix/tasks/pleroma/database.ex
+++ b/lib/mix/tasks/pleroma/database.ex
@ -295,10 +295,12 @@ defmodule Mix.Tasks.Pleroma.Database do
          |> DateTime.from_naive!("Etc/UTC")
          |> Timex.shift(days: days)

-        Pleroma.Workers.PurgeExpiredActivity.enqueue(%{
-          activity_id: activity.id,
-          expires_at: expires_at
-        })
+        Pleroma.Workers.PurgeExpiredActivity.enqueue(
+          %{
+            activity_id: activity.id
+          },
+          scheduled_at: expires_at
+        )
      end)
    end)
    |> Stream.run()
--- a/lib/mix/tasks/pleroma/search/meilisearch.ex
+++ b/lib/mix/tasks/pleroma/search/meilisearch.ex
@ -9,7 +9,7 @@ defmodule Mix.Tasks.Pleroma.Search.Meilisearch do
  import Ecto.Query

  import Pleroma.Search.Meilisearch,
-    only: [meili_post: 2, meili_put: 2, meili_get: 1, meili_delete: 1]
+    only: [meili_put: 2, meili_get: 1, meili_delete: 1]

  def run(["index"]) do
    start_pleroma()
@ -28,7 +28,7 @@ defmodule Mix.Tasks.Pleroma.Search.Meilisearch do
    end

    {:ok, _} =
-      meili_post(
+      meili_put(
        "/indexes/objects/settings/ranking-rules",
        [
          "published:desc",
@ -42,7 +42,7 @@ defmodule Mix.Tasks.Pleroma.Search.Meilisearch do
      )

    {:ok, _} =
-      meili_post(
+      meili_put(
        "/indexes/objects/settings/searchable-attributes",
        [
          "content"
--- a/lib/pleroma/application.ex
+++ b/lib/pleroma/application.ex
@ -94,6 +94,7 @@ defmodule Pleroma.Application do
    children =
      [
        Pleroma.PromEx,
+        Pleroma.LDAP,
        Pleroma.Repo,
        Config.TransferTask,
        Pleroma.Emoji,
--- a/lib/pleroma/config/transfer_task.ex
+++ b/lib/pleroma/config/transfer_task.ex
@ -22,7 +22,8 @@ defmodule Pleroma.Config.TransferTask do
      {:pleroma, :markup},
      {:pleroma, :streamer},
      {:pleroma, :pools},
-      {:pleroma, :connections_pool}
+      {:pleroma, :connections_pool},
+      {:pleroma, :ldap}
    ]

  defp reboot_time_subkeys,
--- a/lib/pleroma/constants.ex
+++ b/lib/pleroma/constants.ex
@ -85,6 +85,41 @@ defmodule Pleroma.Constants do
    ]
  )

+  const(activity_types,
+    do: [
+      "Block",
+      "Create",
+      "Update",
+      "Delete",
+      "Follow",
+      "Accept",
+      "Reject",
+      "Add",
+      "Remove",
+      "Like",
+      "Announce",
+      "Undo",
+      "Flag",
+      "EmojiReact"
+    ]
+  )
+
+  const(allowed_activity_types_from_strangers,
+    do: [
+      "Block",
+      "Create",
+      "Flag",
+      "Follow",
+      "Like",
+      "EmojiReact",
+      "Announce"
+    ]
+  )
+
+  const(object_types,
+    do: ~w[Event Question Answer Audio Video Image Article Note Page ChatMessage]
+  )
+
  # basic regex, just there to weed out potential mistakes
  # https://datatracker.ietf.org/doc/html/rfc2045#section-5.1
  const(mime_regex,
--- a/lib/pleroma/emails/mailer.ex
+++ b/lib/pleroma/emails/mailer.ex
@ -25,7 +25,8 @@ defmodule Pleroma.Emails.Mailer do
      |> :erlang.term_to_binary()
      |> Base.encode64()

-    MailerWorker.enqueue("email", %{"encoded_email" => encoded_email, "config" => config})
+    MailerWorker.new(%{"op" => "email", "encoded_email" => encoded_email, "config" => config})
+    |> Oban.insert()
  end

  @doc "callback to perform send email from queue"
--- a/lib/pleroma/filter.ex
+++ b/lib/pleroma/filter.ex
@ -133,10 +133,13 @@ defmodule Pleroma.Filter do
  defp maybe_add_expires_at(changeset, _), do: changeset

  defp maybe_add_expiration_job(%{expires_at: %NaiveDateTime{} = expires_at} = filter) do
-    Pleroma.Workers.PurgeExpiredFilter.enqueue(%{
-      filter_id: filter.id,
-      expires_at: DateTime.from_naive!(expires_at, "Etc/UTC")
-    })
+    Pleroma.Workers.PurgeExpiredFilter.new(
+      %{
+        filter_id: filter.id
+      },
+      scheduled_at: DateTime.from_naive!(expires_at, "Etc/UTC")
+    )
+    |> Oban.insert()
  end

  defp maybe_add_expiration_job(_), do: {:ok, nil}
--- a/lib/pleroma/frontend.ex
+++ b/lib/pleroma/frontend.ex
@ -74,11 +74,14 @@ defmodule Pleroma.Frontend do

        new_file_path = Path.join(dest, path)

-        new_file_path
+        path
        |> Path.dirname()
+        |> then(&Path.join(dest, &1))
        |> File.mkdir_p!()

-        File.write!(new_file_path, data)
+        if not File.dir?(new_file_path) do
+          File.write!(new_file_path, data)
+        end
      end)
    end
  end
--- a/lib/pleroma/http/adapter_helper.ex
+++ b/lib/pleroma/http/adapter_helper.ex
@ -52,6 +52,7 @@ defmodule Pleroma.HTTP.AdapterHelper do
    case adapter() do
      Tesla.Adapter.Gun -> AdapterHelper.Gun
      Tesla.Adapter.Hackney -> AdapterHelper.Hackney
+      {Tesla.Adapter.Finch, _} -> AdapterHelper.Finch
      _ -> AdapterHelper.Default
    end
  end
@ -118,4 +119,13 @@ defmodule Pleroma.HTTP.AdapterHelper do
        host_charlist
    end
  end
+
+  @spec can_stream? :: bool()
+  def can_stream? do
+    case Application.get_env(:tesla, :adapter) do
+      Tesla.Adapter.Gun -> true
+      {Tesla.Adapter.Finch, _} -> true
+      _ -> false
+    end
+  end
 end
--- a/lib/pleroma/http/adapter_helper/finch.ex
+++ b/lib/pleroma/http/adapter_helper/finch.ex
@ -0,0 +1,33 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.HTTP.AdapterHelper.Finch do
+  @behaviour Pleroma.HTTP.AdapterHelper
+
+  alias Pleroma.Config
+  alias Pleroma.HTTP.AdapterHelper
+
+  @spec options(keyword(), URI.t()) :: keyword()
+  def options(incoming_opts \\ [], %URI{} = _uri) do
+    proxy =
+      [:http, :proxy_url]
+      |> Config.get()
+      |> AdapterHelper.format_proxy()
+
+    config_opts = Config.get([:http, :adapter], [])
+
+    config_opts
+    |> Keyword.merge(incoming_opts)
+    |> AdapterHelper.maybe_add_proxy(proxy)
+    |> maybe_stream()
+  end
+
+  # Finch uses [response: :stream]
+  defp maybe_stream(opts) do
+    case Keyword.pop(opts, :stream, nil) do
+      {true, opts} -> Keyword.put(opts, :response, :stream)
+      {_, opts} -> opts
+    end
+  end
+end
--- a/lib/pleroma/http/adapter_helper/gun.ex
+++ b/lib/pleroma/http/adapter_helper/gun.ex
@ -32,6 +32,7 @@ defmodule Pleroma.HTTP.AdapterHelper.Gun do
    |> AdapterHelper.maybe_add_proxy(proxy)
    |> Keyword.merge(incoming_opts)
    |> put_timeout()
+    |> maybe_stream()
  end

  defp add_scheme_opts(opts, %{scheme: "http"}), do: opts
@ -47,6 +48,14 @@ defmodule Pleroma.HTTP.AdapterHelper.Gun do
    Keyword.put(opts, :timeout, recv_timeout)
  end

+  # Gun uses [body_as: :stream]
+  defp maybe_stream(opts) do
+    case Keyword.pop(opts, :stream, nil) do
+      {true, opts} -> Keyword.put(opts, :body_as, :stream)
+      {_, opts} -> opts
+    end
+  end
+
  @spec pool_timeout(pool()) :: non_neg_integer()
  def pool_timeout(pool) do
    default = Config.get([:pools, :default, :recv_timeout], 5_000)
--- a/lib/pleroma/instances/instance.ex
+++ b/lib/pleroma/instances/instance.ex
@ -297,7 +297,8 @@ defmodule Pleroma.Instances.Instance do
  all of those users' activities and notifications.
  """
  def delete_users_and_activities(host) when is_binary(host) do
-    DeleteWorker.enqueue("delete_instance", %{"host" => host})
+    DeleteWorker.new(%{"op" => "delete_instance", "host" => host})
+    |> Oban.insert()
  end

  def perform(:delete_instance, host) when is_binary(host) do
--- a/lib/pleroma/ldap.ex
+++ b/lib/pleroma/ldap.ex
@ -0,0 +1,271 @@
+defmodule Pleroma.LDAP do
+  use GenServer
+
+  require Logger
+
+  alias Pleroma.Config
+  alias Pleroma.User
+
+  import Pleroma.Web.Auth.Helpers, only: [fetch_user: 1]
+
+  @connection_timeout 2_000
+  @search_timeout 2_000
+
+  def start_link(_) do
+    GenServer.start_link(__MODULE__, [], name: __MODULE__)
+  end
+
+  def bind_user(name, password) do
+    GenServer.call(__MODULE__, {:bind_user, name, password})
+  end
+
+  def change_password(name, password, new_password) do
+    GenServer.call(__MODULE__, {:change_password, name, password, new_password})
+  end
+
+  @impl true
+  def init(state) do
+    case {Config.get(Pleroma.Web.Auth.Authenticator), Config.get([:ldap, :enabled])} do
+      {Pleroma.Web.Auth.LDAPAuthenticator, true} ->
+        {:ok, state, {:continue, :connect}}
+
+      {Pleroma.Web.Auth.LDAPAuthenticator, false} ->
+        Logger.error(
+          "LDAP Authenticator enabled but :pleroma, :ldap is not enabled. Auth will not work."
+        )
+
+        {:ok, state}
+
+      {_, true} ->
+        Logger.warning(
+          ":pleroma, :ldap is enabled but Pleroma.Web.Authenticator is not set to the LDAPAuthenticator. LDAP will not be used."
+        )
+
+        {:ok, state}
+
+      _ ->
+        {:ok, state}
+    end
+  end
+
+  @impl true
+  def handle_continue(:connect, _state), do: do_handle_connect()
+
+  @impl true
+  def handle_info(:connect, _state), do: do_handle_connect()
+
+  def handle_info({:bind_after_reconnect, name, password, from}, state) do
+    result = do_bind_user(state[:handle], name, password)
+
+    GenServer.reply(from, result)
+
+    {:noreply, state}
+  end
+
+  @impl true
+  def handle_call({:bind_user, name, password}, from, state) do
+    case do_bind_user(state[:handle], name, password) do
+      :needs_reconnect ->
+        Process.send(self(), {:bind_after_reconnect, name, password, from}, [])
+        {:noreply, state, {:continue, :connect}}
+
+      result ->
+        {:reply, result, state, :hibernate}
+    end
+  end
+
+  def handle_call({:change_password, name, password, new_password}, _from, state) do
+    result = change_password(state[:handle], name, password, new_password)
+
+    {:reply, result, state, :hibernate}
+  end
+
+  @impl true
+  def terminate(_, state) do
+    handle = Keyword.get(state, :handle)
+
+    if not is_nil(handle) do
+      :eldap.close(handle)
+    end
+
+    :ok
+  end
+
+  defp do_handle_connect do
+    state =
+      case connect() do
+        {:ok, handle} ->
+          :eldap.controlling_process(handle, self())
+          Process.link(handle)
+          [handle: handle]
+
+        _ ->
+          Logger.error("Failed to connect to LDAP. Retrying in 5000ms")
+          Process.send_after(self(), :connect, 5_000)
+          []
+      end
+
+    {:noreply, state}
+  end
+
+  defp connect do
+    ldap = Config.get(:ldap, [])
+    host = Keyword.get(ldap, :host, "localhost")
+    port = Keyword.get(ldap, :port, 389)
+    ssl = Keyword.get(ldap, :ssl, false)
+    tls = Keyword.get(ldap, :tls, false)
+    cacertfile = Keyword.get(ldap, :cacertfile) || CAStore.file_path()
+
+    if ssl, do: Application.ensure_all_started(:ssl)
+
+    default_secure_opts = [
+      verify: :verify_peer,
+      cacerts: decode_certfile(cacertfile),
+      customize_hostname_check: [
+        fqdn_fun: fn _ -> to_charlist(host) end
+      ]
+    ]
+
+    sslopts = Keyword.merge(default_secure_opts, Keyword.get(ldap, :sslopts, []))
+    tlsopts = Keyword.merge(default_secure_opts, Keyword.get(ldap, :tlsopts, []))
+
+    default_options = [{:port, port}, {:ssl, ssl}, {:timeout, @connection_timeout}]
+
+    # :sslopts can only be included in :eldap.open/2 when {ssl: true}
+    # or the connection will fail
+    options =
+      if ssl do
+        default_options ++ [{:sslopts, sslopts}]
+      else
+        default_options
+      end
+
+    case :eldap.open([to_charlist(host)], options) do
+      {:ok, handle} ->
+        try do
+          cond do
+            tls ->
+              case :eldap.start_tls(
+                     handle,
+                     tlsopts,
+                     @connection_timeout
+                   ) do
+                :ok ->
+                  {:ok, handle}
+
+                error ->
+                  Logger.error("Could not start TLS: #{inspect(error)}")
+                  :eldap.close(handle)
+              end
+
+            true ->
+              {:ok, handle}
+          end
+        after
+          :ok
+        end
+
+      {:error, error} ->
+        Logger.error("Could not open LDAP connection: #{inspect(error)}")
+        {:error, {:ldap_connection_error, error}}
+    end
+  end
+
+  defp do_bind_user(handle, name, password) do
+    dn = make_dn(name)
+
+    case :eldap.simple_bind(handle, dn, password) do
+      :ok ->
+        case fetch_user(name) do
+          %User{} = user ->
+            user
+
+          _ ->
+            register_user(handle, ldap_base(), ldap_uid(), name)
+        end
+
+      # eldap does not inform us of socket closure
+      # until it is used
+      {:error, {:gen_tcp_error, :closed}} ->
+        :eldap.close(handle)
+        :needs_reconnect
+
+      {:error, error} = e ->
+        Logger.error("Could not bind LDAP user #{name}: #{inspect(error)}")
+        e
+    end
+  end
+
+  defp register_user(handle, base, uid, name) do
+    case :eldap.search(handle, [
+           {:base, to_charlist(base)},
+           {:filter, :eldap.equalityMatch(to_charlist(uid), to_charlist(name))},
+           {:scope, :eldap.wholeSubtree()},
+           {:timeout, @search_timeout}
+         ]) do
+      # The :eldap_search_result record structure changed in OTP 24.3 and added a controls field
+      # https://github.com/erlang/otp/pull/5538
+      {:ok, {:eldap_search_result, [{:eldap_entry, _object, attributes}], _referrals}} ->
+        try_register(name, attributes)
+
+      {:ok, {:eldap_search_result, [{:eldap_entry, _object, attributes}], _referrals, _controls}} ->
+        try_register(name, attributes)
+
+      error ->
+        Logger.error("Couldn't register user because LDAP search failed: #{inspect(error)}")
+        {:error, {:ldap_search_error, error}}
+    end
+  end
+
+  defp try_register(name, attributes) do
+    mail_attribute = Config.get([:ldap, :mail])
+
+    params = %{
+      name: name,
+      nickname: name,
+      password: nil
+    }
+
+    params =
+      case List.keyfind(attributes, to_charlist(mail_attribute), 0) do
+        {_, [mail]} -> Map.put_new(params, :email, :erlang.list_to_binary(mail))
+        _ -> params
+      end
+
+    changeset = User.register_changeset_ldap(%User{}, params)
+
+    case User.register(changeset) do
+      {:ok, user} -> user
+      error -> error
+    end
+  end
+
+  defp change_password(handle, name, password, new_password) do
+    dn = make_dn(name)
+
+    with :ok <- :eldap.simple_bind(handle, dn, password) do
+      :eldap.modify_password(handle, dn, to_charlist(new_password), to_charlist(password))
+    end
+  end
+
+  defp decode_certfile(file) do
+    with {:ok, data} <- File.read(file) do
+      data
+      |> :public_key.pem_decode()
+      |> Enum.map(fn {_, b, _} -> b end)
+    else
+      _ ->
+        Logger.error("Unable to read certfile: #{file}")
+        []
+    end
+  end
+
+  defp ldap_uid, do: to_charlist(Config.get([:ldap, :uid], "cn"))
+  defp ldap_base, do: to_charlist(Config.get([:ldap, :base]))
+
+  defp make_dn(name) do
+    uid = ldap_uid()
+    base = ldap_base()
+    ~c"#{uid}=#{name},#{base}"
+  end
+end
--- a/lib/pleroma/maps.ex
+++ b/lib/pleroma/maps.ex
@ -20,15 +20,13 @@ defmodule Pleroma.Maps do
  end

  def filter_empty_values(data) do
-    # TODO: Change to Map.filter in Elixir 1.13+
    data
-    |> Enum.filter(fn
+    |> Map.filter(fn
      {_k, nil} -> false
      {_k, ""} -> false
      {_k, []} -> false
      {_k, %{} = v} -> Map.keys(v) != []
      {_k, _v} -> true
    end)
-    |> Map.new()
  end
 end
--- a/lib/pleroma/mfa/token.ex
+++ b/lib/pleroma/mfa/token.ex
@ -52,11 +52,14 @@ defmodule Pleroma.MFA.Token do
  @spec create(User.t(), Authorization.t() | nil) :: {:ok, t()} | {:error, Ecto.Changeset.t()}
  def create(user, authorization \\ nil) do
    with {:ok, token} <- do_create(user, authorization) do
-      Pleroma.Workers.PurgeExpiredToken.enqueue(%{
-        token_id: token.id,
-        valid_until: DateTime.from_naive!(token.valid_until, "Etc/UTC"),
-        mod: __MODULE__
-      })
+      Pleroma.Workers.PurgeExpiredToken.new(
+        %{
+          token_id: token.id,
+          mod: __MODULE__
+        },
+        scheduled_at: DateTime.from_naive!(token.valid_until, "Etc/UTC")
+      )
+      |> Oban.insert()

      {:ok, token}
    end
--- a/lib/pleroma/object.ex
+++ b/lib/pleroma/object.ex
@ -99,27 +99,6 @@ defmodule Pleroma.Object do
  def get_by_id(nil), do: nil
  def get_by_id(id), do: Repo.get(Object, id)

-  @spec get_by_id_and_maybe_refetch(integer(), list()) :: Object.t() | nil
-  def get_by_id_and_maybe_refetch(id, opts \\ []) do
-    with %Object{updated_at: updated_at} = object <- get_by_id(id) do
-      if opts[:interval] &&
-           NaiveDateTime.diff(NaiveDateTime.utc_now(), updated_at) > opts[:interval] do
-        case Fetcher.refetch_object(object) do
-          {:ok, %Object{} = object} ->
-            object
-
-          e ->
-            Logger.error("Couldn't refresh #{object.data["id"]}:\n#{inspect(e)}")
-            object
-        end
-      else
-        object
-      end
-    else
-      nil -> nil
-    end
-  end
-
  def get_by_ap_id(nil), do: nil

  def get_by_ap_id(ap_id) do
@ -255,7 +234,8 @@ defmodule Pleroma.Object do
  @spec cleanup_attachments(boolean(), Object.t()) ::
          {:ok, Oban.Job.t() | nil}
  def cleanup_attachments(true, %Object{} = object) do
-    AttachmentsCleanupWorker.enqueue("cleanup_attachments", %{"object" => object})
+    AttachmentsCleanupWorker.new(%{"op" => "cleanup_attachments", "object" => object})
+    |> Oban.insert()
  end

  def cleanup_attachments(_, _), do: {:ok, nil}
--- a/lib/pleroma/object/fetcher.ex
+++ b/lib/pleroma/object/fetcher.ex
@ -58,8 +58,12 @@ defmodule Pleroma.Object.Fetcher do
    end
  end

+  @typep fetcher_errors ::
+           :error | :reject | :allowed_depth | :fetch | :containment | :transmogrifier
+
  # Note: will create a Create activity, which we need internally at the moment.
-  @spec fetch_object_from_id(String.t(), list()) :: {:ok, Object.t()} | {:error | :reject, any()}
+  @spec fetch_object_from_id(String.t(), list()) ::
+          {:ok, Object.t()} | {fetcher_errors(), any()} | Pipeline.errors()
  def fetch_object_from_id(id, options \\ []) do
    with {_, nil} <- {:fetch_object, Object.get_cached_by_ap_id(id)},
         {_, true} <- {:allowed_depth, Federator.allowed_thread_distance?(options[:depth])},
@ -73,50 +77,22 @@ defmodule Pleroma.Object.Fetcher do
           {:object, data, Object.normalize(activity, fetch: false)} do
      {:ok, object}
    else
-      {:allowed_depth, false} = e ->
-        log_fetch_error(id, e)
-        {:error, :allowed_depth}
-
-      {:containment, reason} = e ->
-        log_fetch_error(id, e)
-        {:error, reason}
-
-      {:transmogrifier, {:error, {:reject, reason}}} = e ->
-        log_fetch_error(id, e)
-        {:reject, reason}
-
-      {:transmogrifier, {:reject, reason}} = e ->
-        log_fetch_error(id, e)
-        {:reject, reason}
-
-      {:transmogrifier, reason} = e ->
-        log_fetch_error(id, e)
-        {:error, reason}
-
-      {:object, data, nil} ->
-        reinject_object(%Object{}, data)
-
      {:normalize, object = %Object{}} ->
        {:ok, object}

      {:fetch_object, %Object{} = object} ->
        {:ok, object}

-      {:fetch, {:error, reason}} = e ->
-        log_fetch_error(id, e)
-        {:error, reason}
+      {:object, data, nil} ->
+        reinject_object(%Object{}, data)

      e ->
-        log_fetch_error(id, e)
-        {:error, e}
+        Logger.metadata(object: id)
+        Logger.error("Object rejected while fetching #{id} #{inspect(e)}")
+        e
    end
  end

-  defp log_fetch_error(id, error) do
-    Logger.metadata(object: id)
-    Logger.error("Object rejected while fetching #{id} #{inspect(error)}")
-  end
-
  defp prepare_activity_params(data) do
    %{
      "type" => "Create",
@ -169,6 +145,7 @@ defmodule Pleroma.Object.Fetcher do
    Logger.debug("Fetching object #{id} via AP")

    with {:scheme, true} <- {:scheme, String.starts_with?(id, "http")},
+         {_, true} <- {:mrf, MRF.id_filter(id)},
         {:ok, body} <- get_object(id),
         {:ok, data} <- safe_json_decode(body),
         :ok <- Containment.contain_origin_from_id(id, data) do
@ -184,6 +161,9 @@ defmodule Pleroma.Object.Fetcher do
      {:error, e} ->
        {:error, e}

+      {:mrf, false} ->
+        {:error, {:reject, "Filtered by id"}}
+
      e ->
        {:error, e}
    end
--- a/lib/pleroma/release_tasks.ex
+++ b/lib/pleroma/release_tasks.ex
@ -16,17 +16,24 @@ defmodule Pleroma.ReleaseTasks do
    end
  end

+  def find_module(task) do
+    module_name =
+      task
+      |> String.split(".")
+      |> Enum.map(&String.capitalize/1)
+      |> then(fn x -> [Mix, Tasks, Pleroma] ++ x end)
+      |> Module.concat()
+
+    case Code.ensure_loaded(module_name) do
+      {:module, _} -> module_name
+      _ -> nil
+    end
+  end
+
  defp mix_task(task, args) do
    Application.load(:pleroma)
-    {:ok, modules} = :application.get_key(:pleroma, :modules)

-    module =
-      Enum.find(modules, fn module ->
-        module = Module.split(module)
-
-        match?(["Mix", "Tasks", "Pleroma" | _], module) and
-          String.downcase(List.last(module)) == task
-      end)
+    module = find_module(task)

    if module do
      module.run(args)
--- a/lib/pleroma/search.ex
+++ b/lib/pleroma/search.ex
@ -2,11 +2,13 @@ defmodule Pleroma.Search do
  alias Pleroma.Workers.SearchIndexingWorker

  def add_to_index(%Pleroma.Activity{id: activity_id}) do
-    SearchIndexingWorker.enqueue("add_to_index", %{"activity" => activity_id})
+    SearchIndexingWorker.new(%{"op" => "add_to_index", "activity" => activity_id})
+    |> Oban.insert()
  end

  def remove_from_index(%Pleroma.Object{id: object_id}) do
-    SearchIndexingWorker.enqueue("remove_from_index", %{"object" => object_id})
+    SearchIndexingWorker.new(%{"op" => "remove_from_index", "object" => object_id})
+    |> Oban.insert()
  end

  def search(query, options) do
--- a/lib/pleroma/search/meilisearch.ex
+++ b/lib/pleroma/search/meilisearch.ex
@ -122,6 +122,7 @@ defmodule Pleroma.Search.Meilisearch do
    # Only index public or unlisted Notes
    if not is_nil(object) and object.data["type"] == "Note" and
         not is_nil(object.data["content"]) and
+         not is_nil(object.data["published"]) and
         (Pleroma.Constants.as_public() in object.data["to"] or
            Pleroma.Constants.as_public() in object.data["cc"]) and
         object.data["content"] not in ["", "."] do
--- a/lib/pleroma/upload/filter/dedupe.ex
+++ b/lib/pleroma/upload/filter/dedupe.ex
@ -17,8 +17,16 @@ defmodule Pleroma.Upload.Filter.Dedupe do
      |> Base.encode16(case: :lower)

    filename = shasum <> "." <> extension
-    {:ok, :filtered, %Upload{upload | id: shasum, path: filename}}
+
+    {:ok, :filtered, %Upload{upload | id: shasum, path: shard_path(filename)}}
  end

  def filter(_), do: {:ok, :noop}
+
+  @spec shard_path(String.t()) :: String.t()
+  def shard_path(
+        <<a::binary-size(2), b::binary-size(2), c::binary-size(2), _::binary>> = filename
+      ) do
+    Path.join([a, b, c, filename])
+  end
 end
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@ -419,6 +419,11 @@ defmodule Pleroma.User do
    end
  end

+  def image_description(image, default \\ "")
+
+  def image_description(%{"name" => name}, _default), do: name
+  def image_description(_, default), do: default
+
  # Should probably be renamed or removed
  @spec ap_id(User.t()) :: String.t()
  def ap_id(%User{nickname: nickname}), do: "#{Endpoint.url()}/users/#{nickname}"
@ -586,16 +591,26 @@ defmodule Pleroma.User do
    |> validate_length(:bio, max: bio_limit)
    |> validate_length(:name, min: 1, max: name_limit)
    |> validate_inclusion(:actor_type, Pleroma.Constants.allowed_user_actor_types())
+    |> validate_image_description(:avatar_description, params)
+    |> validate_image_description(:header_description, params)
    |> put_fields()
    |> put_emoji()
    |> put_change_if_present(:bio, &{:ok, parse_bio(&1, struct)})
-    |> put_change_if_present(:avatar, &put_upload(&1, :avatar))
-    |> put_change_if_present(:banner, &put_upload(&1, :banner))
+    |> put_change_if_present(
+      :avatar,
+      &put_upload(&1, :avatar, Map.get(params, :avatar_description))
+    )
+    |> put_change_if_present(
+      :banner,
+      &put_upload(&1, :banner, Map.get(params, :header_description))
+    )
    |> put_change_if_present(:background, &put_upload(&1, :background))
    |> put_change_if_present(
      :pleroma_settings_store,
      &{:ok, Map.merge(struct.pleroma_settings_store, &1)}
    )
+    |> maybe_update_image_description(:avatar, Map.get(params, :avatar_description))
+    |> maybe_update_image_description(:banner, Map.get(params, :header_description))
    |> validate_fields(false)
  end

@ -674,13 +689,41 @@ defmodule Pleroma.User do
    end
  end

-  defp put_upload(value, type) do
+  defp put_upload(value, type, description \\ nil) do
    with %Plug.Upload{} <- value,
-         {:ok, object} <- ActivityPub.upload(value, type: type) do
+         {:ok, object} <- ActivityPub.upload(value, type: type, description: description) do
      {:ok, object.data}
    end
  end

+  defp validate_image_description(changeset, key, params) do
+    description_limit = Config.get([:instance, :description_limit], 5_000)
+    description = Map.get(params, key)
+
+    if is_binary(description) and String.length(description) > description_limit do
+      changeset
+      |> add_error(key, "#{key} is too long")
+    else
+      changeset
+    end
+  end
+
+  defp maybe_update_image_description(changeset, image_field, description)
+       when is_binary(description) do
+    with {:image_missing, true} <- {:image_missing, not changed?(changeset, image_field)},
+         {:existing_image, %{"id" => id}} <-
+           {:existing_image, Map.get(changeset.data, image_field)},
+         {:object, %Object{} = object} <- {:object, Object.get_by_ap_id(id)},
+         {:ok, object} <- Object.update_data(object, %{"name" => description}) do
+      put_change(changeset, image_field, object.data)
+    else
+      {:description_too_long, true} -> {:error}
+      _ -> changeset
+    end
+  end
+
+  defp maybe_update_image_description(changeset, _, _), do: changeset
+
  def update_as_admin_changeset(struct, params) do
    struct
    |> update_changeset(params)
@ -738,7 +781,8 @@ defmodule Pleroma.User do
  end

  def force_password_reset_async(user) do
-    BackgroundWorker.enqueue("force_password_reset", %{"user_id" => user.id})
+    BackgroundWorker.new(%{"op" => "force_password_reset", "user_id" => user.id})
+    |> Oban.insert()
  end

  @spec force_password_reset(User.t()) :: {:ok, User.t()} | {:error, Ecto.Changeset.t()}
@ -1220,7 +1264,8 @@ defmodule Pleroma.User do
  def update_and_set_cache(changeset) do
    with {:ok, user} <- Repo.update(changeset, stale_error_field: :id) do
      if get_change(changeset, :raw_fields) do
-        BackgroundWorker.enqueue("verify_fields_links", %{"user_id" => user.id})
+        BackgroundWorker.new(%{"op" => "verify_fields_links", "user_id" => user.id})
+        |> Oban.insert()
      end

      set_cache(user)
@ -1591,11 +1636,11 @@ defmodule Pleroma.User do
              )) ||
             {:ok, nil} do
      if duration > 0 do
-        Pleroma.Workers.MuteExpireWorker.enqueue(
-          "unmute_user",
-          %{"muter_id" => muter.id, "mutee_id" => mutee.id},
+        Pleroma.Workers.MuteExpireWorker.new(
+          %{"op" => "unmute_user", "muter_id" => muter.id, "mutee_id" => mutee.id},
          scheduled_at: expires_at
        )
+        |> Oban.insert()
      end

      @cachex.del(:user_cache, "muted_users_ap_ids:#{muter.ap_id}")
@ -1838,7 +1883,8 @@ defmodule Pleroma.User do
  defp maybe_filter_on_ap_id(query, _ap_ids), do: query

  def set_activation_async(user, status \\ true) do
-    BackgroundWorker.enqueue("user_activation", %{"user_id" => user.id, "status" => status})
+    BackgroundWorker.new(%{"op" => "user_activation", "user_id" => user.id, "status" => status})
+    |> Oban.insert()
  end

  @spec set_activation([User.t()], boolean()) :: {:ok, User.t()} | {:error, Ecto.Changeset.t()}
@ -1985,7 +2031,9 @@ defmodule Pleroma.User do
  def delete(%User{} = user) do
    # Purge the user immediately
    purge(user)
-    DeleteWorker.enqueue("delete_user", %{"user_id" => user.id})
+
+    DeleteWorker.new(%{"op" => "delete_user", "user_id" => user.id})
+    |> Oban.insert()
  end

  # *Actually* delete the user from the DB
--- a/lib/pleroma/user/backup.ex
+++ b/lib/pleroma/user/backup.ex
@ -92,9 +92,6 @@ defmodule Pleroma.User.Backup do
    else
      true ->
        {:error, "Backup is missing id. Please insert it into the Repo first."}
-
-      e ->
-        {:error, e}
    end
  end

@ -121,14 +118,13 @@ defmodule Pleroma.User.Backup do
  end

  defp permitted?(user) do
-    with {_, %__MODULE__{inserted_at: inserted_at}} <- {:last, get_last(user)},
-         days = Config.get([__MODULE__, :limit_days]),
-         diff = Timex.diff(NaiveDateTime.utc_now(), inserted_at, :days),
-         {_, true} <- {:diff, diff > days} do
-      true
+    with {_, %__MODULE__{inserted_at: inserted_at}} <- {:last, get_last(user)} do
+      days = Config.get([__MODULE__, :limit_days])
+      diff = Timex.diff(NaiveDateTime.utc_now(), inserted_at, :days)
+
+      diff > days
    else
      {:last, nil} -> true
-      {:diff, false} -> false
    end
  end

@ -297,9 +293,6 @@ defmodule Pleroma.User.Backup do
              )

              acc
-
-            _ ->
-              acc
          end
        end)

--- a/lib/pleroma/user/import.ex
+++ b/lib/pleroma/user/import.ex
@ -5,81 +5,107 @@
 defmodule Pleroma.User.Import do
  use Ecto.Schema

+  alias Pleroma.Repo
  alias Pleroma.User
  alias Pleroma.Web.CommonAPI
  alias Pleroma.Workers.BackgroundWorker

  require Logger

-  @spec perform(atom(), User.t(), list()) :: :ok | list() | {:error, any()}
-  def perform(:mutes_import, %User{} = user, [_ | _] = identifiers) do
-    Enum.map(
-      identifiers,
-      fn identifier ->
-        with {:ok, %User{} = muted_user} <- User.get_or_fetch(identifier),
-             {:ok, _} <- User.mute(user, muted_user) do
-          muted_user
-        else
-          error -> handle_error(:mutes_import, identifier, error)
-        end
-      end
-    )
+  @spec perform(atom(), User.t(), String.t()) :: :ok | {:error, any()}
+  def perform(:mute_import, %User{} = user, actor) do
+    with {:ok, %User{} = muted_user} <- User.get_or_fetch(actor),
+         {_, false} <- {:existing_mute, User.mutes_user?(user, muted_user)},
+         {:ok, _} <- User.mute(user, muted_user) do
+      {:ok, muted_user}
+    else
+      {:existing_mute, true} -> :ok
+      error -> handle_error(:mutes_import, actor, error)
+    end
  end

-  def perform(:blocks_import, %User{} = blocker, [_ | _] = identifiers) do
-    Enum.map(
-      identifiers,
-      fn identifier ->
-        with {:ok, %User{} = blocked} <- User.get_or_fetch(identifier),
-             {:ok, _block} <- CommonAPI.block(blocked, blocker) do
-          blocked
-        else
-          error -> handle_error(:blocks_import, identifier, error)
-        end
-      end
-    )
+  def perform(:block_import, %User{} = user, actor) do
+    with {:ok, %User{} = blocked} <- User.get_or_fetch(actor),
+         {_, false} <- {:existing_block, User.blocks_user?(user, blocked)},
+         {:ok, _block} <- CommonAPI.block(blocked, user) do
+      {:ok, blocked}
+    else
+      {:existing_block, true} -> :ok
+      error -> handle_error(:blocks_import, actor, error)
+    end
  end

-  def perform(:follow_import, %User{} = follower, [_ | _] = identifiers) do
-    Enum.map(
-      identifiers,
-      fn identifier ->
-        with {:ok, %User{} = followed} <- User.get_or_fetch(identifier),
-             {:ok, follower, followed} <- User.maybe_direct_follow(follower, followed),
-             {:ok, _, _, _} <- CommonAPI.follow(followed, follower) do
-          followed
-        else
-          error -> handle_error(:follow_import, identifier, error)
-        end
-      end
-    )
+  def perform(:follow_import, %User{} = user, actor) do
+    with {:ok, %User{} = followed} <- User.get_or_fetch(actor),
+         {_, false} <- {:existing_follow, User.following?(user, followed)},
+         {:ok, user, followed} <- User.maybe_direct_follow(user, followed),
+         {:ok, _, _, _} <- CommonAPI.follow(followed, user) do
+      {:ok, followed}
+    else
+      {:existing_follow, true} -> :ok
+      error -> handle_error(:follow_import, actor, error)
+    end
  end

-  def perform(_, _, _), do: :ok
-
  defp handle_error(op, user_id, error) do
    Logger.debug("#{op} failed for #{user_id} with: #{inspect(error)}")
-    error
+    {:error, error}
  end

-  def blocks_import(%User{} = blocker, [_ | _] = identifiers) do
-    BackgroundWorker.enqueue(
-      "blocks_import",
-      %{"user_id" => blocker.id, "identifiers" => identifiers}
-    )
+  def blocks_import(%User{} = user, [_ | _] = actors) do
+    jobs =
+      Repo.checkout(fn ->
+        Enum.reduce(actors, [], fn actor, acc ->
+          {:ok, job} =
+            BackgroundWorker.new(%{
+              "op" => "block_import",
+              "user_id" => user.id,
+              "actor" => actor
+            })
+            |> Oban.insert()
+
+          acc ++ [job]
+        end)
+      end)
+
+    {:ok, jobs}
  end

-  def follow_import(%User{} = follower, [_ | _] = identifiers) do
-    BackgroundWorker.enqueue(
-      "follow_import",
-      %{"user_id" => follower.id, "identifiers" => identifiers}
-    )
+  def follows_import(%User{} = user, [_ | _] = actors) do
+    jobs =
+      Repo.checkout(fn ->
+        Enum.reduce(actors, [], fn actor, acc ->
+          {:ok, job} =
+            BackgroundWorker.new(%{
+              "op" => "follow_import",
+              "user_id" => user.id,
+              "actor" => actor
+            })
+            |> Oban.insert()
+
+          acc ++ [job]
+        end)
+      end)
+
+    {:ok, jobs}
  end

-  def mutes_import(%User{} = user, [_ | _] = identifiers) do
-    BackgroundWorker.enqueue(
-      "mutes_import",
-      %{"user_id" => user.id, "identifiers" => identifiers}
-    )
+  def mutes_import(%User{} = user, [_ | _] = actors) do
+    jobs =
+      Repo.checkout(fn ->
+        Enum.reduce(actors, [], fn actor, acc ->
+          {:ok, job} =
+            BackgroundWorker.new(%{
+              "op" => "mute_import",
+              "user_id" => user.id,
+              "actor" => actor
+            })
+            |> Oban.insert()
+
+          acc ++ [job]
+        end)
+      end)
+
+    {:ok, jobs}
  end
 end
--- a/lib/pleroma/web/activity_pub/activity_pub.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub.ex
@ -222,10 +222,12 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
         %{data: %{"expires_at" => %DateTime{} = expires_at}} = activity
       ) do
    with {:ok, _job} <-
-           Pleroma.Workers.PurgeExpiredActivity.enqueue(%{
-             activity_id: activity.id,
-             expires_at: expires_at
-           }) do
+           Pleroma.Workers.PurgeExpiredActivity.enqueue(
+             %{
+               activity_id: activity.id
+             },
+             scheduled_at: expires_at
+           ) do
      {:ok, activity}
    end
  end
@ -446,10 +448,12 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
         _ <- notify_and_stream(activity) do
      maybe_federate(activity)

-      BackgroundWorker.enqueue("move_following", %{
+      BackgroundWorker.new(%{
+        "op" => "move_following",
        "origin_id" => origin.id,
        "target_id" => target.id
      })
+      |> Oban.insert()

      {:ok, activity}
    else
@ -1538,16 +1542,23 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do

  defp get_actor_url(_url), do: nil

-  defp normalize_image(%{"url" => url}) do
+  defp normalize_image(%{"url" => url} = data) do
    %{
      "type" => "Image",
      "url" => [%{"href" => url}]
    }
+    |> maybe_put_description(data)
  end

  defp normalize_image(urls) when is_list(urls), do: urls |> List.first() |> normalize_image()
  defp normalize_image(_), do: nil

+  defp maybe_put_description(map, %{"name" => description}) when is_binary(description) do
+    Map.put(map, "name", description)
+  end
+
+  defp maybe_put_description(map, _), do: map
+
  defp object_to_user_data(data, additional) do
    fields =
      data
@ -1797,10 +1808,12 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
    # enqueue a task to fetch all pinned objects
    Enum.each(pins, fn {ap_id, _} ->
      if is_nil(Object.get_cached_by_ap_id(ap_id)) do
-        Pleroma.Workers.RemoteFetcherWorker.enqueue("fetch_remote", %{
+        Pleroma.Workers.RemoteFetcherWorker.new(%{
+          "op" => "fetch_remote",
          "id" => ap_id,
          "depth" => 1
        })
+        |> Oban.insert()
      end
    end)
  end
--- a/lib/pleroma/web/activity_pub/activity_pub_controller.ex
+++ b/lib/pleroma/web/activity_pub/activity_pub_controller.ex
@ -311,7 +311,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
      post_inbox_relayed_create(conn, params)
    else
      conn
-      |> put_status(:bad_request)
+      |> put_status(403)
      |> json("Not federating")
    end
  end
@ -482,7 +482,7 @@ defmodule Pleroma.Web.ActivityPub.ActivityPubController do
        |> put_status(:forbidden)
        |> json(message)

-      {:error, message} ->
+      {:error, message} when is_binary(message) ->
        conn
        |> put_status(:bad_request)
        |> json(message)
--- a/lib/pleroma/web/activity_pub/mrf.ex
+++ b/lib/pleroma/web/activity_pub/mrf.ex
@ -108,6 +108,14 @@ defmodule Pleroma.Web.ActivityPub.MRF do

  def filter(%{} = object), do: get_policies() |> filter(object)

+  def id_filter(policies, id) when is_binary(id) do
+    policies
+    |> Enum.filter(&function_exported?(&1, :id_filter, 1))
+    |> Enum.all?(& &1.id_filter(id))
+  end
+
+  def id_filter(id) when is_binary(id), do: get_policies() |> id_filter(id)
+
  @impl true
  def pipeline_filter(%{} = message, meta) do
    object = meta[:object_data]
--- a/lib/pleroma/web/activity_pub/mrf/anti_followbot_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/anti_followbot_policy.ex
@ -63,20 +63,20 @@ defmodule Pleroma.Web.ActivityPub.MRF.AntiFollowbotPolicy do
  end

  @impl true
-  def filter(%{"type" => "Follow", "actor" => actor_id} = message) do
+  def filter(%{"type" => "Follow", "actor" => actor_id} = activity) do
    %User{} = actor = normalize_by_ap_id(actor_id)

    score = determine_if_followbot(actor)

-    if score < 0.8 || bot_allowed?(message, actor) do
-      {:ok, message}
+    if score < 0.8 || bot_allowed?(activity, actor) do
+      {:ok, activity}
    else
      {:reject, "[AntiFollowbotPolicy] Scored #{actor_id} as #{score}"}
    end
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/anti_link_spam_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/anti_link_spam_policy.ex
@ -29,17 +29,17 @@ defmodule Pleroma.Web.ActivityPub.MRF.AntiLinkSpamPolicy do
  defp contains_links?(_), do: false

  @impl true
-  def filter(%{"type" => "Create", "actor" => actor, "object" => object} = message) do
+  def filter(%{"type" => "Create", "actor" => actor, "object" => object} = activity) do
    with {:ok, %User{local: false} = u} <- User.get_or_fetch_by_ap_id(actor),
         {:contains_links, true} <- {:contains_links, contains_links?(object)},
         {:old_user, true} <- {:old_user, old_user?(u)} do
-      {:ok, message}
+      {:ok, activity}
    else
      {:ok, %User{local: true}} ->
-        {:ok, message}
+        {:ok, activity}

      {:contains_links, false} ->
-        {:ok, message}
+        {:ok, activity}

      {:old_user, false} ->
        {:reject, "[AntiLinkSpamPolicy] User has no posts nor followers"}
@ -53,7 +53,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.AntiLinkSpamPolicy do
  end

  # in all other cases, pass through
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/anti_mention_spam_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/anti_mention_spam_policy.ex
@ -22,11 +22,11 @@ defmodule Pleroma.Web.ActivityPub.MRF.AntiMentionSpamPolicy do
  end

  # copied from HellthreadPolicy
-  defp get_recipient_count(message) do
-    recipients = (message["to"] || []) ++ (message["cc"] || [])
+  defp get_recipient_count(activity) do
+    recipients = (activity["to"] || []) ++ (activity["cc"] || [])

    follower_collection =
-      User.get_cached_by_ap_id(message["actor"] || message["attributedTo"]).follower_address
+      User.get_cached_by_ap_id(activity["actor"] || activity["attributedTo"]).follower_address

    if Enum.member?(recipients, Pleroma.Constants.as_public()) do
      recipients =
@ -80,7 +80,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.AntiMentionSpamPolicy do
  end

  # in all other cases, pass through
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/dnsrbl_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/dnsrbl_policy.ex
@ -38,18 +38,18 @@ defmodule Pleroma.Web.ActivityPub.MRF.DNSRBLPolicy do
  @query_timeout 500

  @impl true
-  def filter(%{"actor" => actor} = object) do
+  def filter(%{"actor" => actor} = activity) do
    actor_info = URI.parse(actor)

-    with {:ok, object} <- check_rbl(actor_info, object) do
-      {:ok, object}
+    with {:ok, activity} <- check_rbl(actor_info, activity) do
+      {:ok, activity}
    else
      _ -> {:reject, "[DNSRBLPolicy]"}
    end
  end

  @impl true
-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe do
@ -90,7 +90,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.DNSRBLPolicy do
    }
  end

-  defp check_rbl(%{host: actor_host}, object) do
+  defp check_rbl(%{host: actor_host}, activity) do
    with false <- match?(^actor_host, Pleroma.Web.Endpoint.host()),
         zone when not is_nil(zone) <- Keyword.get(Config.get([:mrf_dnsrbl]), :zone) do
      query =
@ -100,7 +100,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.DNSRBLPolicy do
      rbl_response = rblquery(query)

      if Enum.empty?(rbl_response) do
-        {:ok, object}
+        {:ok, activity}
      else
        Task.start(fn ->
          reason =
@ -117,7 +117,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.DNSRBLPolicy do
        :error
      end
    else
-      _ -> {:ok, object}
+      _ -> {:ok, activity}
    end
  end

--- a/lib/pleroma/web/activity_pub/mrf/drop_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/drop_policy.ex
@ -8,9 +8,15 @@ defmodule Pleroma.Web.ActivityPub.MRF.DropPolicy do
  @behaviour Pleroma.Web.ActivityPub.MRF.Policy

  @impl true
-  def filter(object) do
-    Logger.debug("REJECTING #{inspect(object)}")
-    {:reject, object}
+  def filter(activity) do
+    Logger.debug("REJECTING #{inspect(activity)}")
+    {:reject, activity}
+  end
+
+  @impl true
+  def id_filter(id) do
+    Logger.debug("REJECTING #{id}")
+    false
  end

  @impl true
--- a/lib/pleroma/web/activity_pub/mrf/emoji_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/emoji_policy.ex
@ -28,11 +28,11 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
    Pleroma.Config.get([:mrf_emoji, :federated_timeline_removal_shortcode], [])
  end

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def history_awareness, do: :manual

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
-  def filter(%{"type" => type, "object" => %{"type" => objtype} = object} = message)
+  @impl true
+  def filter(%{"type" => type, "object" => %{"type" => objtype} = object} = activity)
      when type in ["Create", "Update"] and objtype in Pleroma.Constants.status_object_types() do
    with {:ok, object} <-
           Updater.do_with_history(object, fn object ->
@ -42,13 +42,13 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
           Updater.do_with_history(object, fn object ->
             {:ok, process_remove(object, :shortcode, config_remove_shortcode())}
           end),
-         activity <- Map.put(message, "object", object),
+         activity <- Map.put(activity, "object", object),
         activity <- maybe_delist(activity) do
      {:ok, activity}
    end
  end

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def filter(%{"type" => type} = object) when type in Pleroma.Constants.actor_types() do
    with object <- process_remove(object, :url, config_remove_url()),
         object <- process_remove(object, :shortcode, config_remove_shortcode()) do
@ -56,7 +56,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
    end
  end

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def filter(%{"type" => "EmojiReact"} = object) do
    with {:ok, _} <-
           matched_emoji_checker(config_remove_url(), config_remove_shortcode()).(object) do
@ -67,9 +67,9 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
    end
  end

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
-  def filter(message) do
-    {:ok, message}
+  @impl true
+  def filter(activity) do
+    {:ok, activity}
  end

  defp match_string?(string, pattern) when is_binary(pattern) do
@ -214,7 +214,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
    )
  end

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def describe do
    mrf_emoji =
      Pleroma.Config.get(:mrf_emoji, [])
@ -226,7 +226,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
    {:ok, %{mrf_emoji: mrf_emoji}}
  end

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def config_description do
    %{
      key: :mrf_emoji,
@ -239,7 +239,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
          key: :remove_url,
          type: {:list, :string},
          description: """
-            A list of patterns which result in emoji whose URL matches being removed from the message. This will apply to statuses, emoji reactions, and user profiles.
+            A list of patterns which result in emoji whose URL matches being removed from the activity. This will apply to statuses, emoji reactions, and user profiles.

            Each pattern can be a string or [Regex](https://hexdocs.pm/elixir/Regex.html) in the format of `~r/PATTERN/`.
          """,
@ -249,7 +249,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
          key: :remove_shortcode,
          type: {:list, :string},
          description: """
-            A list of patterns which result in emoji whose shortcode matches being removed from the message. This will apply to statuses, emoji reactions, and user profiles.
+            A list of patterns which result in emoji whose shortcode matches being removed from the activity. This will apply to statuses, emoji reactions, and user profiles.

            Each pattern can be a string or [Regex](https://hexdocs.pm/elixir/Regex.html) in the format of `~r/PATTERN/`.
          """,
@ -259,7 +259,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
          key: :federated_timeline_removal_url,
          type: {:list, :string},
          description: """
-            A list of patterns which result in message with emojis whose URLs match being removed from federated timelines (a.k.a unlisted). This will apply only to statuses.
+            A list of patterns which result in activity with emojis whose URLs match being removed from federated timelines (a.k.a unlisted). This will apply only to statuses.

            Each pattern can be a string or [Regex](https://hexdocs.pm/elixir/Regex.html) in the format of `~r/PATTERN/`.
          """,
@ -269,7 +269,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.EmojiPolicy do
          key: :federated_timeline_removal_shortcode,
          type: {:list, :string},
          description: """
-            A list of patterns which result in message with emojis whose shortcodes match being removed from federated timelines (a.k.a unlisted). This will apply only to statuses.
+            A list of patterns which result in activities with emojis whose shortcodes match being removed from federated timelines (a.k.a unlisted). This will apply only to statuses.

            Each pattern can be a string or [Regex](https://hexdocs.pm/elixir/Regex.html) in the format of `~r/PATTERN/`.
          """,
--- a/lib/pleroma/web/activity_pub/mrf/ensure_re_prepended.ex
+++ b/lib/pleroma/web/activity_pub/mrf/ensure_re_prepended.ex
@ -29,19 +29,19 @@ defmodule Pleroma.Web.ActivityPub.MRF.EnsureRePrepended do

  def filter_by_summary(_in_reply_to, child), do: child

-  def filter(%{"type" => type, "object" => child_object} = object)
-      when type in ["Create", "Update"] and is_map(child_object) do
+  def filter(%{"type" => type, "object" => object} = activity)
+      when type in ["Create", "Update"] and is_map(object) do
    child =
-      child_object["inReplyTo"]
+      object["inReplyTo"]
      |> Object.normalize(fetch: false)
-      |> filter_by_summary(child_object)
+      |> filter_by_summary(object)

-    object = Map.put(object, "object", child)
+    activity = Map.put(activity, "object", child)

-    {:ok, object}
+    {:ok, activity}
  end

-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  def describe, do: {:ok, %{}}
 end
--- a/lib/pleroma/web/activity_pub/mrf/fo_direct_reply.ex
+++ b/lib/pleroma/web/activity_pub/mrf/fo_direct_reply.ex
@ -0,0 +1,53 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2024 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.FODirectReply do
+  @moduledoc """
+  FODirectReply alters the scope of replies to activities which are Followers Only to be Direct. The purpose of this policy is to prevent broken threads for followers of the reply author because their response was to a user that they are not also following.
+  """
+
+  alias Pleroma.Object
+  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Visibility
+
+  @behaviour Pleroma.Web.ActivityPub.MRF.Policy
+
+  @impl true
+  def filter(
+        %{
+          "type" => "Create",
+          "to" => to,
+          "object" => %{
+            "actor" => actor,
+            "type" => "Note",
+            "inReplyTo" => in_reply_to
+          }
+        } = activity
+      ) do
+    with true <- is_binary(in_reply_to),
+         %User{follower_address: followers_collection, local: true} <- User.get_by_ap_id(actor),
+         %Object{} = in_reply_to_object <- Object.get_by_ap_id(in_reply_to),
+         "private" <- Visibility.get_visibility(in_reply_to_object) do
+      direct_to = to -- [followers_collection]
+
+      updated_activity =
+        activity
+        |> Map.put("cc", [])
+        |> Map.put("to", direct_to)
+        |> Map.put("directMessage", true)
+        |> put_in(["object", "cc"], [])
+        |> put_in(["object", "to"], direct_to)
+
+      {:ok, updated_activity}
+    else
+      _ -> {:ok, activity}
+    end
+  end
+
+  @impl true
+  def filter(activity), do: {:ok, activity}
+
+  @impl true
+  def describe, do: {:ok, %{}}
+end
--- a/lib/pleroma/web/activity_pub/mrf/follow_bot_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/follow_bot_policy.ex
@ -11,12 +11,12 @@ defmodule Pleroma.Web.ActivityPub.MRF.FollowBotPolicy do
  require Logger

  @impl true
-  def filter(message) do
+  def filter(activity) do
    with follower_nickname <- Config.get([:mrf_follow_bot, :follower_nickname]),
         %User{actor_type: "Service"} = follower <-
           User.get_cached_by_nickname(follower_nickname),
-         %{"type" => "Create", "object" => %{"type" => "Note"}} <- message do
-      try_follow(follower, message)
+         %{"type" => "Create", "object" => %{"type" => "Note"}} <- activity do
+      try_follow(follower, activity)
    else
      nil ->
        Logger.warning(
@ -24,17 +24,17 @@ defmodule Pleroma.Web.ActivityPub.MRF.FollowBotPolicy do
            account does not exist, or the account is not correctly configured as a bot."
        )

-        {:ok, message}
+        {:ok, activity}

      _ ->
-        {:ok, message}
+        {:ok, activity}
    end
  end

-  defp try_follow(follower, message) do
-    to = Map.get(message, "to", [])
-    cc = Map.get(message, "cc", [])
-    actor = [message["actor"]]
+  defp try_follow(follower, activity) do
+    to = Map.get(activity, "to", [])
+    cc = Map.get(activity, "cc", [])
+    actor = [activity["actor"]]

    Enum.concat([to, cc, actor])
    |> List.flatten()
@ -53,7 +53,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.FollowBotPolicy do
      end
    end)

-    {:ok, message}
+    {:ok, activity}
  end

  @impl true
--- a/lib/pleroma/web/activity_pub/mrf/force_bot_unlisted_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/force_bot_unlisted_policy.ex
@ -22,7 +22,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.ForceBotUnlistedPolicy do
          "cc" => cc,
          "actor" => actor,
          "object" => object
-        } = message
+        } = activity
      ) do
    user = User.get_cached_by_ap_id(actor)
    isbot = check_if_bot(user)
@ -36,20 +36,20 @@ defmodule Pleroma.Web.ActivityPub.MRF.ForceBotUnlistedPolicy do
        |> Map.put("to", to)
        |> Map.put("cc", cc)

-      message =
-        message
+      activity =
+        activity
        |> Map.put("to", to)
        |> Map.put("cc", cc)
        |> Map.put("object", object)

-      {:ok, message}
+      {:ok, activity}
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/force_mention.ex
+++ b/lib/pleroma/web/activity_pub/mrf/force_mention.ex
@ -52,7 +52,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.ForceMention do
  end

  @impl true
-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/force_mentions_in_content.ex
+++ b/lib/pleroma/web/activity_pub/mrf/force_mentions_in_content.ex
@ -79,18 +79,18 @@ defmodule Pleroma.Web.ActivityPub.MRF.ForceMentionsInContent do
        %{
          "type" => type,
          "object" => %{"type" => "Note", "to" => to, "inReplyTo" => in_reply_to}
-        } = object
+        } = activity
      )
      when type in ["Create", "Update"] and is_list(to) and is_binary(in_reply_to) do
    # image-only posts from pleroma apparently reach this MRF without the content field
-    content = object["object"]["content"] || ""
+    content = activity["object"]["content"] || ""

    # Get the replied-to user for sorting
-    replied_to_user = get_replied_to_user(object["object"])
+    replied_to_user = get_replied_to_user(activity["object"])

    mention_users =
      to
-      |> clean_recipients(object)
+      |> clean_recipients(activity)
      |> Enum.map(&User.get_cached_by_ap_id/1)
      |> Enum.reject(&is_nil/1)
      |> sort_replied_user(replied_to_user)
@ -126,11 +126,11 @@ defmodule Pleroma.Web.ActivityPub.MRF.ForceMentionsInContent do
          content
      end

-    {:ok, put_in(object["object"]["content"], content)}
+    {:ok, put_in(activity["object"]["content"], content)}
  end

  @impl true
-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/hashtag_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/hashtag_policy.ex
@ -9,7 +9,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.HashtagPolicy do
  alias Pleroma.Object

  @moduledoc """
-  Reject, TWKN-remove or Set-Sensitive messages with specific hashtags (without the leading #)
+  Reject, TWKN-remove or Set-Sensitive activities with specific hashtags (without the leading #)

  Note: This MRF Policy is always enabled, if you want to disable it you have to set empty lists.
  """
@ -19,40 +19,40 @@ defmodule Pleroma.Web.ActivityPub.MRF.HashtagPolicy do
  @impl true
  def history_awareness, do: :manual

-  defp check_reject(message, hashtags) do
+  defp check_reject(activity, hashtags) do
    if Enum.any?(Config.get([:mrf_hashtag, :reject]), fn match -> match in hashtags end) do
      {:reject, "[HashtagPolicy] Matches with rejected keyword"}
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

-  defp check_ftl_removal(%{"to" => to} = message, hashtags) do
+  defp check_ftl_removal(%{"to" => to} = activity, hashtags) do
    if Pleroma.Constants.as_public() in to and
         Enum.any?(Config.get([:mrf_hashtag, :federated_timeline_removal]), fn match ->
           match in hashtags
         end) do
      to = List.delete(to, Pleroma.Constants.as_public())
-      cc = [Pleroma.Constants.as_public() | message["cc"] || []]
+      cc = [Pleroma.Constants.as_public() | activity["cc"] || []]

-      message =
-        message
+      activity =
+        activity
        |> Map.put("to", to)
        |> Map.put("cc", cc)
        |> Kernel.put_in(["object", "to"], to)
        |> Kernel.put_in(["object", "cc"], cc)

-      {:ok, message}
+      {:ok, activity}
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

-  defp check_ftl_removal(message, _hashtags), do: {:ok, message}
+  defp check_ftl_removal(activity, _hashtags), do: {:ok, activity}

-  defp check_sensitive(message) do
+  defp check_sensitive(activity) do
    {:ok, new_object} =
-      Object.Updater.do_with_history(message["object"], fn object ->
+      Object.Updater.do_with_history(activity["object"], fn object ->
        hashtags = Object.hashtags(%Object{data: object})

        if Enum.any?(Config.get([:mrf_hashtag, :sensitive]), fn match -> match in hashtags end) do
@ -62,11 +62,12 @@ defmodule Pleroma.Web.ActivityPub.MRF.HashtagPolicy do
        end
      end)

-    {:ok, Map.put(message, "object", new_object)}
+    {:ok, Map.put(activity, "object", new_object)}
  end

  @impl true
-  def filter(%{"type" => type, "object" => object} = message) when type in ["Create", "Update"] do
+  def filter(%{"type" => type, "object" => object} = activity)
+      when type in ["Create", "Update"] do
    history_items =
      with %{"formerRepresentations" => %{"orderedItems" => items}} <- object do
        items
@ -82,23 +83,23 @@ defmodule Pleroma.Web.ActivityPub.MRF.HashtagPolicy do
    hashtags = Object.hashtags(%Object{data: object}) ++ historical_hashtags

    if hashtags != [] do
-      with {:ok, message} <- check_reject(message, hashtags),
-           {:ok, message} <-
+      with {:ok, activity} <- check_reject(activity, hashtags),
+           {:ok, activity} <-
             (if type == "Create" do
-                check_ftl_removal(message, hashtags)
+                check_ftl_removal(activity, hashtags)
              else
-                {:ok, message}
+                {:ok, activity}
              end),
-           {:ok, message} <- check_sensitive(message) do
-        {:ok, message}
+           {:ok, activity} <- check_sensitive(activity) do
+        {:ok, activity}
      end
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe do
@ -120,21 +121,21 @@ defmodule Pleroma.Web.ActivityPub.MRF.HashtagPolicy do
        %{
          key: :reject,
          type: {:list, :string},
-          description: "A list of hashtags which result in message being rejected.",
+          description: "A list of hashtags which result in the activity being rejected.",
          suggestions: ["foo"]
        },
        %{
          key: :federated_timeline_removal,
          type: {:list, :string},
          description:
-            "A list of hashtags which result in message being removed from federated timelines (a.k.a unlisted).",
+            "A list of hashtags which result in the activity being removed from federated timelines (a.k.a unlisted).",
          suggestions: ["foo"]
        },
        %{
          key: :sensitive,
          type: {:list, :string},
          description:
-            "A list of hashtags which result in message being set as sensitive (a.k.a NSFW/R-18)",
+            "A list of hashtags which result in the activity being set as sensitive (a.k.a NSFW/R-18)",
          suggestions: ["nsfw", "r18"]
        }
      ]
--- a/lib/pleroma/web/activity_pub/mrf/hellthread_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/hellthread_policy.ex
@ -7,54 +7,54 @@ defmodule Pleroma.Web.ActivityPub.MRF.HellthreadPolicy do

  require Pleroma.Constants

-  @moduledoc "Block messages with too much mentions (configurable)"
+  @moduledoc "Block activities with too much mentions (configurable)"

  @behaviour Pleroma.Web.ActivityPub.MRF.Policy

-  defp delist_message(message, threshold) when threshold > 0 do
-    follower_collection = User.get_cached_by_ap_id(message["actor"]).follower_address
-    to = message["to"] || []
-    cc = message["cc"] || []
+  defp delist_activity(activity, threshold) when threshold > 0 do
+    follower_collection = User.get_cached_by_ap_id(activity["actor"]).follower_address
+    to = activity["to"] || []
+    cc = activity["cc"] || []

    follower_collection? = Enum.member?(to ++ cc, follower_collection)

-    message =
-      case get_recipient_count(message) do
+    activity =
+      case get_recipient_count(activity) do
        {:public, recipients}
        when follower_collection? and recipients > threshold ->
-          message
+          activity
          |> Map.put("to", [follower_collection])
          |> Map.put("cc", [Pleroma.Constants.as_public()])

        {:public, recipients} when recipients > threshold ->
-          message
+          activity
          |> Map.put("to", [])
          |> Map.put("cc", [Pleroma.Constants.as_public()])

        _ ->
-          message
+          activity
      end

-    {:ok, message}
+    {:ok, activity}
  end

-  defp delist_message(message, _threshold), do: {:ok, message}
+  defp delist_activity(activity, _threshold), do: {:ok, activity}

-  defp reject_message(message, threshold) when threshold > 0 do
-    with {_, recipients} <- get_recipient_count(message) do
+  defp reject_activity(activity, threshold) when threshold > 0 do
+    with {_, recipients} <- get_recipient_count(activity) do
      if recipients > threshold do
        {:reject, "[HellthreadPolicy] #{recipients} recipients is over the limit of #{threshold}"}
      else
-        {:ok, message}
+        {:ok, activity}
      end
    end
  end

-  defp reject_message(message, _threshold), do: {:ok, message}
+  defp reject_activity(activity, _threshold), do: {:ok, activity}

-  defp get_recipient_count(message) do
-    recipients = (message["to"] || []) ++ (message["cc"] || [])
-    follower_collection = User.get_cached_by_ap_id(message["actor"]).follower_address
+  defp get_recipient_count(activity) do
+    recipients = (activity["to"] || []) ++ (activity["cc"] || [])
+    follower_collection = User.get_cached_by_ap_id(activity["actor"]).follower_address

    if Enum.member?(recipients, Pleroma.Constants.as_public()) do
      recipients =
@ -73,7 +73,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.HellthreadPolicy do
  end

  @impl true
-  def filter(%{"type" => "Create", "object" => %{"type" => object_type}} = message)
+  def filter(%{"type" => "Create", "object" => %{"type" => object_type}} = activity)
      when object_type in ~w{Note Article} do
    reject_threshold =
      Pleroma.Config.get(
@ -83,16 +83,16 @@ defmodule Pleroma.Web.ActivityPub.MRF.HellthreadPolicy do

    delist_threshold = Pleroma.Config.get([:mrf_hellthread, :delist_threshold])

-    with {:ok, message} <- reject_message(message, reject_threshold),
-         {:ok, message} <- delist_message(message, delist_threshold) do
-      {:ok, message}
+    with {:ok, activity} <- reject_activity(activity, reject_threshold),
+         {:ok, activity} <- delist_activity(activity, delist_threshold) do
+      {:ok, activity}
    else
      e -> e
    end
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe,
@ -104,13 +104,13 @@ defmodule Pleroma.Web.ActivityPub.MRF.HellthreadPolicy do
      key: :mrf_hellthread,
      related_policy: "Pleroma.Web.ActivityPub.MRF.HellthreadPolicy",
      label: "MRF Hellthread",
-      description: "Block messages with excessive user mentions",
+      description: "Block activities with excessive user mentions",
      children: [
        %{
          key: :delist_threshold,
          type: :integer,
          description:
-            "Number of mentioned users after which the message gets removed from timelines and" <>
+            "Number of mentioned users after which the activity gets removed from timelines and" <>
              "disables notifications. Set to 0 to disable.",
          suggestions: [10]
        },
@ -118,7 +118,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.HellthreadPolicy do
          key: :reject_threshold,
          type: :integer,
          description:
-            "Number of mentioned users after which the messaged gets rejected. Set to 0 to disable.",
+            "Number of mentioned users after which the activity gets rejected. Set to 0 to disable.",
          suggestions: [20]
        }
      ]
--- a/lib/pleroma/web/activity_pub/mrf/inline_quote_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/inline_quote_policy.ex
@ -48,12 +48,12 @@ defmodule Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy do
  end

  @impl true
-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def history_awareness, do: :auto

  @impl true
--- a/lib/pleroma/web/activity_pub/mrf/keyword_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/keyword_policy.ex
@ -7,7 +7,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do

  alias Pleroma.Web.ActivityPub.MRF.Utils

-  @moduledoc "Reject or Word-Replace messages with a keyword or regex"
+  @moduledoc "Reject or Word-Replace activities with a keyword or regex"

  @behaviour Pleroma.Web.ActivityPub.MRF.Policy

@ -25,7 +25,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do
    |> Enum.join("\n")
  end

-  defp check_reject(%{"object" => %{} = object} = message) do
+  defp check_reject(%{"object" => %{} = object} = activity) do
    with {:ok, _new_object} <-
           Pleroma.Object.Updater.do_with_history(object, fn object ->
             payload = object_payload(object)
@ -35,16 +35,16 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do
                end) do
               {:reject, "[KeywordPolicy] Matches with rejected keyword"}
             else
-               {:ok, message}
+               {:ok, activity}
             end
           end) do
-      {:ok, message}
+      {:ok, activity}
    else
      e -> e
    end
  end

-  defp check_ftl_removal(%{"type" => "Create", "to" => to, "object" => %{} = object} = message) do
+  defp check_ftl_removal(%{"type" => "Create", "to" => to, "object" => %{} = object} = activity) do
    check_keyword = fn object ->
      payload = object_payload(object)

@ -67,24 +67,24 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do

    if Pleroma.Constants.as_public() in to and should_delist?.(object) do
      to = List.delete(to, Pleroma.Constants.as_public())
-      cc = [Pleroma.Constants.as_public() | message["cc"] || []]
+      cc = [Pleroma.Constants.as_public() | activity["cc"] || []]

-      message =
-        message
+      activity =
+        activity
        |> Map.put("to", to)
        |> Map.put("cc", cc)

-      {:ok, message}
+      {:ok, activity}
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

-  defp check_ftl_removal(message) do
-    {:ok, message}
+  defp check_ftl_removal(activity) do
+    {:ok, activity}
  end

-  defp check_replace(%{"object" => %{} = object} = message) do
+  defp check_replace(%{"object" => %{} = object} = activity) do
    replace_kw = fn object ->
      ["content", "name", "summary"]
      |> Enum.filter(fn field -> Map.has_key?(object, field) && object[field] end)
@ -103,18 +103,18 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do

    {:ok, object} = Pleroma.Object.Updater.do_with_history(object, replace_kw)

-    message = Map.put(message, "object", object)
+    activity = Map.put(activity, "object", object)

-    {:ok, message}
+    {:ok, activity}
  end

  @impl true
-  def filter(%{"type" => type, "object" => %{"content" => _content}} = message)
+  def filter(%{"type" => type, "object" => %{"content" => _content}} = activity)
      when type in ["Create", "Update"] do
-    with {:ok, message} <- check_reject(message),
-         {:ok, message} <- check_ftl_removal(message),
-         {:ok, message} <- check_replace(message) do
-      {:ok, message}
+    with {:ok, activity} <- check_reject(activity),
+         {:ok, activity} <- check_ftl_removal(activity),
+         {:ok, activity} <- check_replace(activity) do
+      {:ok, activity}
    else
      {:reject, nil} -> {:reject, "[KeywordPolicy] "}
      {:reject, _} = e -> e
@ -123,7 +123,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe do
@ -154,13 +154,13 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do
      related_policy: "Pleroma.Web.ActivityPub.MRF.KeywordPolicy",
      label: "MRF Keyword",
      description:
-        "Reject or Word-Replace messages matching a keyword or [Regex](https://hexdocs.pm/elixir/Regex.html).",
+        "Reject or Word-Replace activities matching a keyword or [Regex](https://hexdocs.pm/elixir/Regex.html).",
      children: [
        %{
          key: :reject,
          type: {:list, :string},
          description: """
-            A list of patterns which result in message being rejected.
+            A list of patterns which result in the activity being rejected.

            Each pattern can be a string or [Regex](https://hexdocs.pm/elixir/Regex.html) in the format of `~r/PATTERN/`.
          """,
@ -170,7 +170,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.KeywordPolicy do
          key: :federated_timeline_removal,
          type: {:list, :string},
          description: """
-            A list of patterns which result in message being removed from federated timelines (a.k.a unlisted).
+            A list of patterns which result in the activity being removed from federated timelines (a.k.a unlisted).

            Each pattern can be a string or [Regex](https://hexdocs.pm/elixir/Regex.html) in the format of `~r/PATTERN/`.
          """,
--- a/lib/pleroma/web/activity_pub/mrf/media_proxy_warming_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/media_proxy_warming_policy.ex
@ -31,7 +31,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy do
    HTTP.get(url, [], http_client_opts)
  end

-  defp preload(%{"object" => %{"attachment" => attachments}} = _message) do
+  defp preload(%{"object" => %{"attachment" => attachments}} = _activity) do
    Enum.each(attachments, fn
      %{"url" => url} when is_list(url) ->
        url
@ -49,15 +49,15 @@ defmodule Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy do
  end

  @impl true
-  def filter(%{"type" => type, "object" => %{"attachment" => attachments} = _object} = message)
+  def filter(%{"type" => type, "object" => %{"attachment" => attachments} = _object} = activity)
      when type in ["Create", "Update"] and is_list(attachments) and length(attachments) > 0 do
-    preload(message)
+    preload(activity)

-    {:ok, message}
+    {:ok, activity}
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/mention_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/mention_policy.ex
@ -3,25 +3,25 @@
 # SPDX-License-Identifier: AGPL-3.0-only

 defmodule Pleroma.Web.ActivityPub.MRF.MentionPolicy do
-  @moduledoc "Block messages which mention a user"
+  @moduledoc "Block activities which mention a user"

  @behaviour Pleroma.Web.ActivityPub.MRF.Policy

  @impl true
-  def filter(%{"type" => "Create"} = message) do
+  def filter(%{"type" => "Create"} = activity) do
    reject_actors = Pleroma.Config.get([:mrf_mention, :actors], [])
-    recipients = (message["to"] || []) ++ (message["cc"] || [])
+    recipients = (activity["to"] || []) ++ (activity["cc"] || [])

    if rejected_mention =
         Enum.find(recipients, fn recipient -> Enum.member?(reject_actors, recipient) end) do
      {:reject, "[MentionPolicy] Rejected for mention of #{rejected_mention}"}
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
@ -32,7 +32,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.MentionPolicy do
      key: :mrf_mention,
      related_policy: "Pleroma.Web.ActivityPub.MRF.MentionPolicy",
      label: "MRF Mention",
-      description: "Block messages which mention a specific user",
+      description: "Block activities which mention a specific user",
      children: [
        %{
          key: :actors,
--- a/lib/pleroma/web/activity_pub/mrf/no_empty_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/no_empty_policy.ex
@ -9,20 +9,20 @@ defmodule Pleroma.Web.ActivityPub.MRF.NoEmptyPolicy do
  alias Pleroma.Web.Endpoint

  @impl true
-  def filter(%{"actor" => actor} = object) do
+  def filter(%{"actor" => actor} = activity) do
    with true <- local?(actor),
-         true <- eligible_type?(object),
-         true <- note?(object),
-         false <- has_attachment?(object),
-         true <- only_mentions?(object) do
+         true <- eligible_type?(activity),
+         true <- note?(activity),
+         false <- has_attachment?(activity),
+         true <- only_mentions?(activity) do
      {:reject, "[NoEmptyPolicy]"}
    else
      _ ->
-        {:ok, object}
+        {:ok, activity}
    end
  end

-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  defp local?(actor) do
    if actor |> String.starts_with?("#{Endpoint.url()}") do
--- a/lib/pleroma/web/activity_pub/mrf/no_op_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/no_op_policy.ex
@ -7,8 +7,8 @@ defmodule Pleroma.Web.ActivityPub.MRF.NoOpPolicy do
  @behaviour Pleroma.Web.ActivityPub.MRF.Policy

  @impl true
-  def filter(object) do
-    {:ok, object}
+  def filter(activity) do
+    {:ok, activity}
  end

  @impl true
--- a/lib/pleroma/web/activity_pub/mrf/no_placeholder_text_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/no_placeholder_text_policy.ex
@ -13,15 +13,15 @@ defmodule Pleroma.Web.ActivityPub.MRF.NoPlaceholderTextPolicy do
  def filter(
        %{
          "type" => type,
-          "object" => %{"content" => content, "attachment" => _} = _child_object
-        } = object
+          "object" => %{"content" => content, "attachment" => _} = _object
+        } = activity
      )
      when type in ["Create", "Update"] and content in [".", "<p>.</p>"] do
-    {:ok, put_in(object, ["object", "content"], "")}
+    {:ok, put_in(activity, ["object", "content"], "")}
  end

  @impl true
-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/normalize_markup.ex
+++ b/lib/pleroma/web/activity_pub/mrf/normalize_markup.ex
@ -12,20 +12,20 @@ defmodule Pleroma.Web.ActivityPub.MRF.NormalizeMarkup do
  def history_awareness, do: :auto

  @impl true
-  def filter(%{"type" => type, "object" => child_object} = object)
+  def filter(%{"type" => type, "object" => object} = activity)
      when type in ["Create", "Update"] do
    scrub_policy = Pleroma.Config.get([:mrf_normalize_markup, :scrub_policy])

    content =
-      child_object["content"]
+      object["content"]
      |> HTML.filter_tags(scrub_policy)

-    object = put_in(object, ["object", "content"], content)
+    activity = put_in(activity, ["object", "content"], content)

-    {:ok, object}
+    {:ok, activity}
  end

-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/nsfw_api_policy.ex
@ -122,52 +122,52 @@ defmodule Pleroma.Web.ActivityPub.MRF.NsfwApiPolicy do
    end
  end

-  def check_object_nsfw(%{"object" => %{} = child_object} = object) do
-    case check_object_nsfw(child_object) do
-      {:sfw, _} -> {:sfw, object}
-      {:nsfw, _} -> {:nsfw, object}
+  def check_object_nsfw(%{"object" => %{} = object} = activity) do
+    case check_object_nsfw(object) do
+      {:sfw, _} -> {:sfw, activity}
+      {:nsfw, _} -> {:nsfw, activity}
    end
  end

  def check_object_nsfw(object), do: {:sfw, object}

  @impl true
-  def filter(object) do
-    with {:sfw, object} <- check_object_nsfw(object) do
-      {:ok, object}
+  def filter(activity) do
+    with {:sfw, activity} <- check_object_nsfw(activity) do
+      {:ok, activity}
    else
-      {:nsfw, _data} -> handle_nsfw(object)
+      {:nsfw, _data} -> handle_nsfw(activity)
    end
  end

-  defp handle_nsfw(object) do
+  defp handle_nsfw(activity) do
    if Config.get([@policy, :reject]) do
-      {:reject, object}
+      {:reject, activity}
    else
      {:ok,
-       object
+       activity
       |> maybe_unlist()
       |> maybe_mark_sensitive()}
    end
  end

-  defp maybe_unlist(object) do
+  defp maybe_unlist(activity) do
    if Config.get([@policy, :unlist]) do
-      unlist(object)
+      unlist(activity)
    else
-      object
+      activity
    end
  end

-  defp maybe_mark_sensitive(object) do
+  defp maybe_mark_sensitive(activity) do
    if Config.get([@policy, :mark_sensitive]) do
-      mark_sensitive(object)
+      mark_sensitive(activity)
    else
-      object
+      activity
    end
  end

-  def unlist(%{"to" => to, "cc" => cc, "actor" => actor} = object) do
+  def unlist(%{"to" => to, "cc" => cc, "actor" => actor} = activity) do
    with %User{} = user <- User.get_cached_by_ap_id(actor) do
      to =
        [user.follower_address | to]
@ -179,7 +179,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.NsfwApiPolicy do
        |> List.delete(user.follower_address)
        |> Enum.uniq()

-      object
+      activity
      |> Map.put("to", to)
      |> Map.put("cc", cc)
    else
@ -187,14 +187,14 @@ defmodule Pleroma.Web.ActivityPub.MRF.NsfwApiPolicy do
    end
  end

-  def mark_sensitive(%{"object" => child_object} = object) when is_map(child_object) do
-    Map.put(object, "object", mark_sensitive(child_object))
+  def mark_sensitive(%{"object" => object} = activity) when is_map(object) do
+    Map.put(activity, "object", mark_sensitive(object))
  end

-  def mark_sensitive(object) when is_map(object) do
-    tags = (object["tag"] || []) ++ ["nsfw"]
+  def mark_sensitive(activity) when is_map(activity) do
+    tags = (activity["tag"] || []) ++ ["nsfw"]

-    object
+    activity
    |> Map.put("tag", tags)
    |> Map.put("sensitive", true)
  end
--- a/lib/pleroma/web/activity_pub/mrf/object_age_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/object_age_policy.ex
@ -11,12 +11,12 @@ defmodule Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy do
  @moduledoc "Filter activities depending on their age"
  @behaviour Pleroma.Web.ActivityPub.MRF.Policy

-  defp check_date(%{"object" => %{"published" => published}} = message) do
+  defp check_date(%{"object" => %{"published" => published}} = activity) do
    with %DateTime{} = now <- DateTime.utc_now(),
         {:ok, %DateTime{} = then, _} <- DateTime.from_iso8601(published),
         max_ttl <- Config.get([:mrf_object_age, :threshold]),
         {:ttl, false} <- {:ttl, DateTime.diff(now, then) > max_ttl} do
-      {:ok, message}
+      {:ok, activity}
    else
      {:ttl, true} ->
        {:reject, nil}
@ -26,73 +26,73 @@ defmodule Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy do
    end
  end

-  defp check_reject(message, actions) do
+  defp check_reject(activity, actions) do
    if :reject in actions do
      {:reject, "[ObjectAgePolicy]"}
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

-  defp check_delist(message, actions) do
+  defp check_delist(activity, actions) do
    if :delist in actions do
-      with %User{} = user <- User.get_cached_by_ap_id(message["actor"]) do
+      with %User{} = user <- User.get_cached_by_ap_id(activity["actor"]) do
        to =
-          List.delete(message["to"] || [], Pleroma.Constants.as_public()) ++
+          List.delete(activity["to"] || [], Pleroma.Constants.as_public()) ++
            [user.follower_address]

        cc =
-          List.delete(message["cc"] || [], user.follower_address) ++
+          List.delete(activity["cc"] || [], user.follower_address) ++
            [Pleroma.Constants.as_public()]

-        message =
-          message
+        activity =
+          activity
          |> Map.put("to", to)
          |> Map.put("cc", cc)
          |> Kernel.put_in(["object", "to"], to)
          |> Kernel.put_in(["object", "cc"], cc)

-        {:ok, message}
+        {:ok, activity}
      else
        _e ->
          {:reject, "[ObjectAgePolicy] Unhandled error"}
      end
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

-  defp check_strip_followers(message, actions) do
+  defp check_strip_followers(activity, actions) do
    if :strip_followers in actions do
-      with %User{} = user <- User.get_cached_by_ap_id(message["actor"]) do
-        to = List.delete(message["to"] || [], user.follower_address)
-        cc = List.delete(message["cc"] || [], user.follower_address)
+      with %User{} = user <- User.get_cached_by_ap_id(activity["actor"]) do
+        to = List.delete(activity["to"] || [], user.follower_address)
+        cc = List.delete(activity["cc"] || [], user.follower_address)

-        message =
-          message
+        activity =
+          activity
          |> Map.put("to", to)
          |> Map.put("cc", cc)
          |> Kernel.put_in(["object", "to"], to)
          |> Kernel.put_in(["object", "cc"], cc)

-        {:ok, message}
+        {:ok, activity}
      else
        _e ->
          {:reject, "[ObjectAgePolicy] Unhandled error"}
      end
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

  @impl true
-  def filter(%{"type" => "Create", "object" => %{"published" => _}} = message) do
+  def filter(%{"type" => "Create", "object" => %{"published" => _}} = activity) do
    with actions <- Config.get([:mrf_object_age, :actions]),
-         {:reject, _} <- check_date(message),
-         {:ok, message} <- check_reject(message, actions),
-         {:ok, message} <- check_delist(message, actions),
-         {:ok, message} <- check_strip_followers(message, actions) do
-      {:ok, message}
+         {:reject, _} <- check_date(activity),
+         {:ok, activity} <- check_reject(activity, actions),
+         {:ok, activity} <- check_delist(activity, actions),
+         {:ok, activity} <- check_strip_followers(activity, actions) do
+      {:ok, activity}
    else
      # check_date() is allowed to short-circuit the pipeline
      e -> e
@ -100,7 +100,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy do
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe do
@ -131,8 +131,8 @@ defmodule Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy do
          type: {:list, :atom},
          description:
            "A list of actions to apply to the post. `:delist` removes the post from public timelines; " <>
-              "`:strip_followers` removes followers from the ActivityPub recipient list ensuring they won't be delivered to home timelines, additionally for followers-only it degrades to a direct message; " <>
-              "`:reject` rejects the message entirely",
+              "`:strip_followers` removes followers from the ActivityPub recipient list ensuring they won't be delivered to home timelines, additionally for followers-only it degrades to a direct activity; " <>
+              "`:reject` rejects the activity entirely",
          suggestions: [:delist, :strip_followers, :reject]
        }
      ]
--- a/lib/pleroma/web/activity_pub/mrf/policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/policy.ex
@ -3,7 +3,8 @@
 # SPDX-License-Identifier: AGPL-3.0-only

 defmodule Pleroma.Web.ActivityPub.MRF.Policy do
-  @callback filter(map()) :: {:ok | :reject, map()}
+  @callback filter(Pleroma.Activity.t()) :: {:ok | :reject, Pleroma.Activity.t()}
+  @callback id_filter(String.t()) :: boolean()
  @callback describe() :: {:ok | :error, map()}
  @callback config_description() :: %{
              optional(:children) => [map()],
@ -13,5 +14,5 @@ defmodule Pleroma.Web.ActivityPub.MRF.Policy do
              description: String.t()
            }
  @callback history_awareness() :: :auto | :manual
-  @optional_callbacks config_description: 0, history_awareness: 0
+  @optional_callbacks config_description: 0, history_awareness: 0, id_filter: 1
 end
--- a/lib/pleroma/web/activity_pub/mrf/quiet_reply.ex
+++ b/lib/pleroma/web/activity_pub/mrf/quiet_reply.ex
@ -0,0 +1,60 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2023 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.MRF.QuietReply do
+  @moduledoc """
+  QuietReply alters the scope of activities from local users when replying by enforcing them to be "Unlisted" or "Quiet Public". This delivers the activity to all the expected recipients and instances, but it will not be published in the Federated / The Whole Known Network timelines. It will still be published to the Home timelines of the user's followers and visible to anyone who opens the thread.
+  """
+  require Pleroma.Constants
+
+  alias Pleroma.User
+
+  @behaviour Pleroma.Web.ActivityPub.MRF.Policy
+
+  @impl true
+  def history_awareness, do: :auto
+
+  @impl true
+  def filter(
+        %{
+          "type" => "Create",
+          "to" => to,
+          "cc" => cc,
+          "object" => %{
+            "actor" => actor,
+            "type" => "Note",
+            "inReplyTo" => in_reply_to
+          }
+        } = activity
+      ) do
+    with true <- is_binary(in_reply_to),
+         false <- match?([], cc),
+         %User{follower_address: followers_collection, local: true} <-
+           User.get_by_ap_id(actor) do
+      updated_to =
+        to
+        |> Kernel.++([followers_collection])
+        |> Kernel.--([Pleroma.Constants.as_public()])
+
+      updated_cc = [Pleroma.Constants.as_public()]
+
+      updated_activity =
+        activity
+        |> Map.put("to", updated_to)
+        |> Map.put("cc", updated_cc)
+        |> put_in(["object", "to"], updated_to)
+        |> put_in(["object", "cc"], updated_cc)
+
+      {:ok, updated_activity}
+    else
+      _ -> {:ok, activity}
+    end
+  end
+
+  @impl true
+  def filter(activity), do: {:ok, activity}
+
+  @impl true
+  def describe, do: {:ok, %{}}
+end
--- a/lib/pleroma/web/activity_pub/mrf/quote_to_link_tag_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/quote_to_link_tag_policy.ex
@ -10,18 +10,18 @@ defmodule Pleroma.Web.ActivityPub.MRF.QuoteToLinkTagPolicy do

  require Pleroma.Constants

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def filter(%{"object" => %{"quoteUrl" => _} = object} = activity) do
    {:ok, Map.put(activity, "object", filter_object(object))}
  end

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
-  def filter(object), do: {:ok, object}
+  @impl true
+  def filter(activity), do: {:ok, activity}

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def describe, do: {:ok, %{}}

-  @impl Pleroma.Web.ActivityPub.MRF.Policy
+  @impl true
  def history_awareness, do: :auto

  defp filter_object(%{"quoteUrl" => quote_url} = object) do
--- a/lib/pleroma/web/activity_pub/mrf/remote_report_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/remote_report_policy.ex
@ -0,0 +1,118 @@
+defmodule Pleroma.Web.ActivityPub.MRF.RemoteReportPolicy do
+  @moduledoc "Drop remote reports if they don't contain enough information."
+  @behaviour Pleroma.Web.ActivityPub.MRF.Policy
+
+  alias Pleroma.Config
+
+  @impl true
+  def filter(%{"type" => "Flag"} = object) do
+    with {_, false} <- {:local, local?(object)},
+         {:ok, _} <- maybe_reject_all(object),
+         {:ok, _} <- maybe_reject_anonymous(object),
+         {:ok, _} <- maybe_reject_third_party(object),
+         {:ok, _} <- maybe_reject_empty_message(object) do
+      {:ok, object}
+    else
+      {:local, true} -> {:ok, object}
+      {:reject, message} -> {:reject, message}
+      error -> {:reject, error}
+    end
+  end
+
+  def filter(object), do: {:ok, object}
+
+  defp maybe_reject_all(object) do
+    if Config.get([:mrf_remote_report, :reject_all]) do
+      {:reject, "[RemoteReportPolicy] Remote report"}
+    else
+      {:ok, object}
+    end
+  end
+
+  defp maybe_reject_anonymous(%{"actor" => actor} = object) do
+    with true <- Config.get([:mrf_remote_report, :reject_anonymous]),
+         %URI{path: "/actor"} <- URI.parse(actor) do
+      {:reject, "[RemoteReportPolicy] Anonymous: #{actor}"}
+    else
+      _ -> {:ok, object}
+    end
+  end
+
+  defp maybe_reject_third_party(%{"object" => objects} = object) do
+    {_, to} =
+      case objects do
+        [head | tail] when is_binary(head) -> {tail, head}
+        s when is_binary(s) -> {[], s}
+        _ -> {[], ""}
+      end
+
+    with true <- Config.get([:mrf_remote_report, :reject_third_party]),
+         false <- String.starts_with?(to, Pleroma.Web.Endpoint.url()) do
+      {:reject, "[RemoteReportPolicy] Third-party: #{to}"}
+    else
+      _ -> {:ok, object}
+    end
+  end
+
+  defp maybe_reject_empty_message(%{"content" => content} = object)
+       when is_binary(content) and content != "" do
+    {:ok, object}
+  end
+
+  defp maybe_reject_empty_message(object) do
+    if Config.get([:mrf_remote_report, :reject_empty_message]) do
+      {:reject, ["RemoteReportPolicy] No content"]}
+    else
+      {:ok, object}
+    end
+  end
+
+  defp local?(%{"actor" => actor}) do
+    String.starts_with?(actor, Pleroma.Web.Endpoint.url())
+  end
+
+  @impl true
+  def describe do
+    mrf_remote_report =
+      Config.get(:mrf_remote_report)
+      |> Enum.into(%{})
+
+    {:ok, %{mrf_remote_report: mrf_remote_report}}
+  end
+
+  @impl true
+  def config_description do
+    %{
+      key: :mrf_remote_report,
+      related_policy: "Pleroma.Web.ActivityPub.MRF.RemoteReportPolicy",
+      label: "MRF Remote Report",
+      description: "Drop remote reports if they don't contain enough information.",
+      children: [
+        %{
+          key: :reject_all,
+          type: :boolean,
+          description: "Reject all remote reports? (this option takes precedence)",
+          suggestions: [false]
+        },
+        %{
+          key: :reject_anonymous,
+          type: :boolean,
+          description: "Reject anonymous remote reports?",
+          suggestions: [true]
+        },
+        %{
+          key: :reject_third_party,
+          type: :boolean,
+          description: "Reject reports on users from third-party instances?",
+          suggestions: [true]
+        },
+        %{
+          key: :reject_empty_message,
+          type: :boolean,
+          description: "Reject remote reports with no message?",
+          suggestions: [true]
+        }
+      ]
+    }
+  end
+end
--- a/lib/pleroma/web/activity_pub/mrf/simple_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/simple_policy.ex
@ -13,20 +13,20 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do

  require Pleroma.Constants

-  defp check_accept(%{host: actor_host} = _actor_info, object) do
+  defp check_accept(%{host: actor_host} = _actor_info, activity) do
    accepts =
      instance_list(:accept)
      |> MRF.subdomains_regex()

    cond do
-      accepts == [] -> {:ok, object}
-      actor_host == Config.get([Pleroma.Web.Endpoint, :url, :host]) -> {:ok, object}
-      MRF.subdomain_match?(accepts, actor_host) -> {:ok, object}
+      accepts == [] -> {:ok, activity}
+      actor_host == Config.get([Pleroma.Web.Endpoint, :url, :host]) -> {:ok, activity}
+      MRF.subdomain_match?(accepts, actor_host) -> {:ok, activity}
      true -> {:reject, "[SimplePolicy] host not in accept list"}
    end
  end

-  defp check_reject(%{host: actor_host} = _actor_info, object) do
+  defp check_reject(%{host: actor_host} = _actor_info, activity) do
    rejects =
      instance_list(:reject)
      |> MRF.subdomains_regex()
@ -34,109 +34,109 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do
    if MRF.subdomain_match?(rejects, actor_host) do
      {:reject, "[SimplePolicy] host in reject list"}
    else
-      {:ok, object}
+      {:ok, activity}
    end
  end

  defp check_media_removal(
         %{host: actor_host} = _actor_info,
-         %{"type" => type, "object" => %{"attachment" => child_attachment}} = object
+         %{"type" => type, "object" => %{"attachment" => object_attachment}} = activity
       )
-       when length(child_attachment) > 0 and type in ["Create", "Update"] do
+       when length(object_attachment) > 0 and type in ["Create", "Update"] do
    media_removal =
      instance_list(:media_removal)
      |> MRF.subdomains_regex()

-    object =
+    activity =
      if MRF.subdomain_match?(media_removal, actor_host) do
-        child_object = Map.delete(object["object"], "attachment")
-        Map.put(object, "object", child_object)
+        object = Map.delete(activity["object"], "attachment")
+        Map.put(activity, "object", object)
      else
-        object
+        activity
      end

-    {:ok, object}
+    {:ok, activity}
  end

-  defp check_media_removal(_actor_info, object), do: {:ok, object}
+  defp check_media_removal(_actor_info, activity), do: {:ok, activity}

  defp check_media_nsfw(
         %{host: actor_host} = _actor_info,
         %{
           "type" => type,
-           "object" => %{} = _child_object
-         } = object
+           "object" => %{} = _object
+         } = activity
       )
       when type in ["Create", "Update"] do
    media_nsfw =
      instance_list(:media_nsfw)
      |> MRF.subdomains_regex()

-    object =
+    activity =
      if MRF.subdomain_match?(media_nsfw, actor_host) do
-        Kernel.put_in(object, ["object", "sensitive"], true)
+        Kernel.put_in(activity, ["object", "sensitive"], true)
      else
-        object
+        activity
      end

-    {:ok, object}
+    {:ok, activity}
  end

-  defp check_media_nsfw(_actor_info, object), do: {:ok, object}
+  defp check_media_nsfw(_actor_info, activity), do: {:ok, activity}

-  defp check_ftl_removal(%{host: actor_host} = _actor_info, object) do
+  defp check_ftl_removal(%{host: actor_host} = _actor_info, activity) do
    timeline_removal =
      instance_list(:federated_timeline_removal)
      |> MRF.subdomains_regex()

-    object =
+    activity =
      with true <- MRF.subdomain_match?(timeline_removal, actor_host),
-           user <- User.get_cached_by_ap_id(object["actor"]),
-           true <- Pleroma.Constants.as_public() in object["to"] do
-        to = List.delete(object["to"], Pleroma.Constants.as_public()) ++ [user.follower_address]
+           user <- User.get_cached_by_ap_id(activity["actor"]),
+           true <- Pleroma.Constants.as_public() in activity["to"] do
+        to = List.delete(activity["to"], Pleroma.Constants.as_public()) ++ [user.follower_address]

-        cc = List.delete(object["cc"], user.follower_address) ++ [Pleroma.Constants.as_public()]
+        cc = List.delete(activity["cc"], user.follower_address) ++ [Pleroma.Constants.as_public()]

-        object
+        activity
        |> Map.put("to", to)
        |> Map.put("cc", cc)
      else
-        _ -> object
+        _ -> activity
      end

-    {:ok, object}
+    {:ok, activity}
  end

  defp intersection(list1, list2) do
    list1 -- list1 -- list2
  end

-  defp check_followers_only(%{host: actor_host} = _actor_info, object) do
+  defp check_followers_only(%{host: actor_host} = _actor_info, activity) do
    followers_only =
      instance_list(:followers_only)
      |> MRF.subdomains_regex()

-    object =
+    activity =
      with true <- MRF.subdomain_match?(followers_only, actor_host),
-           user <- User.get_cached_by_ap_id(object["actor"]) do
+           user <- User.get_cached_by_ap_id(activity["actor"]) do
        # Don't use Map.get/3 intentionally, these must not be nil
-        fixed_to = object["to"] || []
-        fixed_cc = object["cc"] || []
+        fixed_to = activity["to"] || []
+        fixed_cc = activity["cc"] || []

        to = FollowingRelationship.followers_ap_ids(user, fixed_to)
        cc = FollowingRelationship.followers_ap_ids(user, fixed_cc)

-        object
+        activity
        |> Map.put("to", intersection([user.follower_address | to], fixed_to))
        |> Map.put("cc", intersection([user.follower_address | cc], fixed_cc))
      else
-        _ -> object
+        _ -> activity
      end

-    {:ok, object}
+    {:ok, activity}
  end

-  defp check_report_removal(%{host: actor_host} = _actor_info, %{"type" => "Flag"} = object) do
+  defp check_report_removal(%{host: actor_host} = _actor_info, %{"type" => "Flag"} = activity) do
    report_removal =
      instance_list(:report_removal)
      |> MRF.subdomains_regex()
@ -144,39 +144,39 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do
    if MRF.subdomain_match?(report_removal, actor_host) do
      {:reject, "[SimplePolicy] host in report_removal list"}
    else
-      {:ok, object}
+      {:ok, activity}
    end
  end

-  defp check_report_removal(_actor_info, object), do: {:ok, object}
+  defp check_report_removal(_actor_info, activity), do: {:ok, activity}

-  defp check_avatar_removal(%{host: actor_host} = _actor_info, %{"icon" => _icon} = object) do
+  defp check_avatar_removal(%{host: actor_host} = _actor_info, %{"icon" => _icon} = activity) do
    avatar_removal =
      instance_list(:avatar_removal)
      |> MRF.subdomains_regex()

    if MRF.subdomain_match?(avatar_removal, actor_host) do
-      {:ok, Map.delete(object, "icon")}
+      {:ok, Map.delete(activity, "icon")}
    else
-      {:ok, object}
+      {:ok, activity}
    end
  end

-  defp check_avatar_removal(_actor_info, object), do: {:ok, object}
+  defp check_avatar_removal(_actor_info, activity), do: {:ok, activity}

-  defp check_banner_removal(%{host: actor_host} = _actor_info, %{"image" => _image} = object) do
+  defp check_banner_removal(%{host: actor_host} = _actor_info, %{"image" => _image} = activity) do
    banner_removal =
      instance_list(:banner_removal)
      |> MRF.subdomains_regex()

    if MRF.subdomain_match?(banner_removal, actor_host) do
-      {:ok, Map.delete(object, "image")}
+      {:ok, Map.delete(activity, "image")}
    else
-      {:ok, object}
+      {:ok, activity}
    end
  end

-  defp check_banner_removal(_actor_info, object), do: {:ok, object}
+  defp check_banner_removal(_actor_info, activity), do: {:ok, activity}

  defp check_object(%{"object" => object} = activity) do
    with {:ok, _object} <- filter(object) do
@ -184,7 +184,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do
    end
  end

-  defp check_object(object), do: {:ok, object}
+  defp check_object(activity), do: {:ok, activity}

  defp instance_list(config_key) do
    Config.get([:mrf_simple, config_key])
@ -192,7 +192,19 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do
  end

  @impl true
-  def filter(%{"type" => "Delete", "actor" => actor} = object) do
+  def id_filter(id) do
+    host_info = URI.parse(id)
+
+    with {:ok, _} <- check_accept(host_info, %{}),
+         {:ok, _} <- check_reject(host_info, %{}) do
+      true
+    else
+      _ -> false
+    end
+  end
+
+  @impl true
+  def filter(%{"type" => "Delete", "actor" => actor} = activity) do
    %{host: actor_host} = URI.parse(actor)

    reject_deletes =
@ -202,54 +214,54 @@ defmodule Pleroma.Web.ActivityPub.MRF.SimplePolicy do
    if MRF.subdomain_match?(reject_deletes, actor_host) do
      {:reject, "[SimplePolicy] host in reject_deletes list"}
    else
-      {:ok, object}
+      {:ok, activity}
    end
  end

  @impl true
-  def filter(%{"actor" => actor} = object) do
+  def filter(%{"actor" => actor} = activity) do
    actor_info = URI.parse(actor)

-    with {:ok, object} <- check_accept(actor_info, object),
-         {:ok, object} <- check_reject(actor_info, object),
-         {:ok, object} <- check_media_removal(actor_info, object),
-         {:ok, object} <- check_media_nsfw(actor_info, object),
-         {:ok, object} <- check_ftl_removal(actor_info, object),
-         {:ok, object} <- check_followers_only(actor_info, object),
-         {:ok, object} <- check_report_removal(actor_info, object),
-         {:ok, object} <- check_object(object) do
-      {:ok, object}
+    with {:ok, activity} <- check_accept(actor_info, activity),
+         {:ok, activity} <- check_reject(actor_info, activity),
+         {:ok, activity} <- check_media_removal(actor_info, activity),
+         {:ok, activity} <- check_media_nsfw(actor_info, activity),
+         {:ok, activity} <- check_ftl_removal(actor_info, activity),
+         {:ok, activity} <- check_followers_only(actor_info, activity),
+         {:ok, activity} <- check_report_removal(actor_info, activity),
+         {:ok, activity} <- check_object(activity) do
+      {:ok, activity}
    else
      {:reject, _} = e -> e
    end
  end

-  def filter(%{"id" => actor, "type" => obj_type} = object)
-      when obj_type in ["Application", "Group", "Organization", "Person", "Service"] do
+  def filter(%{"id" => actor, "type" => actor_type} = activity)
+      when actor_type in ["Application", "Group", "Organization", "Person", "Service"] do
    actor_info = URI.parse(actor)

-    with {:ok, object} <- check_accept(actor_info, object),
-         {:ok, object} <- check_reject(actor_info, object),
-         {:ok, object} <- check_avatar_removal(actor_info, object),
-         {:ok, object} <- check_banner_removal(actor_info, object) do
-      {:ok, object}
+    with {:ok, activity} <- check_accept(actor_info, activity),
+         {:ok, activity} <- check_reject(actor_info, activity),
+         {:ok, activity} <- check_avatar_removal(actor_info, activity),
+         {:ok, activity} <- check_banner_removal(actor_info, activity) do
+      {:ok, activity}
    else
      {:reject, _} = e -> e
    end
  end

-  def filter(object) when is_binary(object) do
-    uri = URI.parse(object)
+  def filter(activity) when is_binary(activity) do
+    uri = URI.parse(activity)

-    with {:ok, object} <- check_accept(uri, object),
-         {:ok, object} <- check_reject(uri, object) do
-      {:ok, object}
+    with {:ok, activity} <- check_accept(uri, activity),
+         {:ok, activity} <- check_reject(uri, activity) do
+      {:ok, activity}
    else
      {:reject, _} = e -> e
    end
  end

-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe do
--- a/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/steal_emoji_policy.ex
@ -62,7 +62,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do
  end

  @impl true
-  def filter(%{"object" => %{"emoji" => foreign_emojis, "actor" => actor}} = message) do
+  def filter(%{"object" => %{"emoji" => foreign_emojis, "actor" => actor}} = activity) do
    host = URI.parse(actor).host

    if host != Pleroma.Web.Endpoint.host() and accept_host?(host) do
@ -97,10 +97,10 @@ defmodule Pleroma.Web.ActivityPub.MRF.StealEmojiPolicy do
      end
    end

-    {:ok, message}
+    {:ok, activity}
  end

-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  @spec config_description :: %{
--- a/lib/pleroma/web/activity_pub/mrf/subchain_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/subchain_policy.ex
@ -20,20 +20,20 @@ defmodule Pleroma.Web.ActivityPub.MRF.SubchainPolicy do
  end

  @impl true
-  def filter(%{"actor" => actor} = message) do
+  def filter(%{"actor" => actor} = activity) do
    with {:ok, match, subchain} <- lookup_subchain(actor) do
      Logger.debug(
        "[SubchainPolicy] Matched #{actor} against #{inspect(match)} with subchain #{inspect(subchain)}"
      )

-      MRF.filter(subchain, message)
+      MRF.filter(subchain, activity)
    else
-      _e -> {:ok, message}
+      _e -> {:ok, activity}
    end
  end

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
@ -45,7 +45,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.SubchainPolicy do
      related_policy: "Pleroma.Web.ActivityPub.MRF.SubchainPolicy",
      label: "MRF Subchain",
      description:
-        "This policy processes messages through an alternate pipeline when a given message matches certain criteria." <>
+        "This policy processes activities through an alternate pipeline when a given activity matches certain criteria." <>
          " All criteria are configured as a map of regular expressions to lists of policy modules.",
      children: [
        %{
--- a/lib/pleroma/web/activity_pub/mrf/tag_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/tag_policy.ex
@ -28,25 +28,25 @@ defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
         "mrf_tag:media-force-nsfw",
         %{
           "type" => type,
-           "object" => %{"attachment" => child_attachment}
-         } = message
+           "object" => %{"attachment" => object_attachment}
+         } = activity
       )
-       when length(child_attachment) > 0 and type in ["Create", "Update"] do
-    {:ok, Kernel.put_in(message, ["object", "sensitive"], true)}
+       when length(object_attachment) > 0 and type in ["Create", "Update"] do
+    {:ok, Kernel.put_in(activity, ["object", "sensitive"], true)}
  end

  defp process_tag(
         "mrf_tag:media-strip",
         %{
           "type" => type,
-           "object" => %{"attachment" => child_attachment} = object
-         } = message
+           "object" => %{"attachment" => object_attachment} = object
+         } = activity
       )
-       when length(child_attachment) > 0 and type in ["Create", "Update"] do
+       when length(object_attachment) > 0 and type in ["Create", "Update"] do
    object = Map.delete(object, "attachment")
-    message = Map.put(message, "object", object)
+    activity = Map.put(activity, "object", object)

-    {:ok, message}
+    {:ok, activity}
  end

  defp process_tag(
@ -57,7 +57,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
           "cc" => cc,
           "actor" => actor,
           "object" => object
-         } = message
+         } = activity
       ) do
    user = User.get_cached_by_ap_id(actor)

@ -70,15 +70,15 @@ defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
        |> Map.put("to", to)
        |> Map.put("cc", cc)

-      message =
-        message
+      activity =
+        activity
        |> Map.put("to", to)
        |> Map.put("cc", cc)
        |> Map.put("object", object)

-      {:ok, message}
+      {:ok, activity}
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

@ -90,7 +90,7 @@ defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
           "cc" => cc,
           "actor" => actor,
           "object" => object
-         } = message
+         } = activity
       ) do
    user = User.get_cached_by_ap_id(actor)

@ -104,26 +104,26 @@ defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
        |> Map.put("to", to)
        |> Map.put("cc", cc)

-      message =
-        message
+      activity =
+        activity
        |> Map.put("to", to)
        |> Map.put("cc", cc)
        |> Map.put("object", object)

-      {:ok, message}
+      {:ok, activity}
    else
-      {:ok, message}
+      {:ok, activity}
    end
  end

  defp process_tag(
         "mrf_tag:disable-remote-subscription",
-         %{"type" => "Follow", "actor" => actor} = message
+         %{"type" => "Follow", "actor" => actor} = activity
       ) do
    user = User.get_cached_by_ap_id(actor)

    if user.local == true do
-      {:ok, message}
+      {:ok, activity}
    else
      {:reject,
       "[TagPolicy] Follow from #{actor} tagged with mrf_tag:disable-remote-subscription"}
@ -133,14 +133,14 @@ defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
  defp process_tag("mrf_tag:disable-any-subscription", %{"type" => "Follow", "actor" => actor}),
    do: {:reject, "[TagPolicy] Follow from #{actor} tagged with mrf_tag:disable-any-subscription"}

-  defp process_tag(_, message), do: {:ok, message}
+  defp process_tag(_, activity), do: {:ok, activity}

-  def filter_message(actor, message) do
+  def filter_activity(actor, activity) do
    User.get_cached_by_ap_id(actor)
    |> get_tags()
-    |> Enum.reduce({:ok, message}, fn
-      tag, {:ok, message} ->
-        process_tag(tag, message)
+    |> Enum.reduce({:ok, activity}, fn
+      tag, {:ok, activity} ->
+        process_tag(tag, activity)

      _, error ->
        error
@ -148,15 +148,15 @@ defmodule Pleroma.Web.ActivityPub.MRF.TagPolicy do
  end

  @impl true
-  def filter(%{"object" => target_actor, "type" => "Follow"} = message),
-    do: filter_message(target_actor, message)
+  def filter(%{"object" => target_actor, "type" => "Follow"} = activity),
+    do: filter_activity(target_actor, activity)

  @impl true
-  def filter(%{"actor" => actor, "type" => type} = message) when type in ["Create", "Update"],
-    do: filter_message(actor, message)
+  def filter(%{"actor" => actor, "type" => type} = activity) when type in ["Create", "Update"],
+    do: filter_activity(actor, activity)

  @impl true
-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe, do: {:ok, %{}}
--- a/lib/pleroma/web/activity_pub/mrf/user_allow_list_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/user_allow_list_policy.ex
@ -8,18 +8,18 @@ defmodule Pleroma.Web.ActivityPub.MRF.UserAllowListPolicy do
  @moduledoc "Accept-list of users from specified instances"
  @behaviour Pleroma.Web.ActivityPub.MRF.Policy

-  defp filter_by_list(object, []), do: {:ok, object}
+  defp filter_by_list(activity, []), do: {:ok, activity}

-  defp filter_by_list(%{"actor" => actor} = object, allow_list) do
+  defp filter_by_list(%{"actor" => actor} = activity, allow_list) do
    if actor in allow_list do
-      {:ok, object}
+      {:ok, activity}
    else
      {:reject, "[UserAllowListPolicy] #{actor} not in the list"}
    end
  end

  @impl true
-  def filter(%{"actor" => actor} = object) do
+  def filter(%{"actor" => actor} = activity) do
    actor_info = URI.parse(actor)

    allow_list =
@ -28,10 +28,10 @@ defmodule Pleroma.Web.ActivityPub.MRF.UserAllowListPolicy do
        []
      )

-    filter_by_list(object, allow_list)
+    filter_by_list(activity, allow_list)
  end

-  def filter(object), do: {:ok, object}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe do
--- a/lib/pleroma/web/activity_pub/mrf/vocabulary_policy.ex
+++ b/lib/pleroma/web/activity_pub/mrf/vocabulary_policy.ex
@ -3,38 +3,38 @@
 # SPDX-License-Identifier: AGPL-3.0-only

 defmodule Pleroma.Web.ActivityPub.MRF.VocabularyPolicy do
-  @moduledoc "Filter messages which belong to certain activity vocabularies"
+  @moduledoc "Filter activities which belong to certain activity vocabularies"

  @behaviour Pleroma.Web.ActivityPub.MRF.Policy

  @impl true
-  def filter(%{"type" => "Undo", "object" => child_message} = message) do
-    with {:ok, _} <- filter(child_message) do
-      {:ok, message}
+  def filter(%{"type" => "Undo", "object" => object} = activity) do
+    with {:ok, _} <- filter(object) do
+      {:ok, activity}
    else
      {:reject, _} = e -> e
    end
  end

-  def filter(%{"type" => message_type} = message) do
+  def filter(%{"type" => activity_type} = activity) do
    with accepted_vocabulary <- Pleroma.Config.get([:mrf_vocabulary, :accept]),
         rejected_vocabulary <- Pleroma.Config.get([:mrf_vocabulary, :reject]),
         {_, true} <-
           {:accepted,
-            Enum.empty?(accepted_vocabulary) || Enum.member?(accepted_vocabulary, message_type)},
+            Enum.empty?(accepted_vocabulary) || Enum.member?(accepted_vocabulary, activity_type)},
         {_, false} <-
           {:rejected,
-            length(rejected_vocabulary) > 0 && Enum.member?(rejected_vocabulary, message_type)},
-         {:ok, _} <- filter(message["object"]) do
-      {:ok, message}
+            length(rejected_vocabulary) > 0 && Enum.member?(rejected_vocabulary, activity_type)},
+         {:ok, _} <- filter(activity["object"]) do
+      {:ok, activity}
    else
      {:reject, _} = e -> e
-      {:accepted, _} -> {:reject, "[VocabularyPolicy] #{message_type} not in accept list"}
-      {:rejected, _} -> {:reject, "[VocabularyPolicy] #{message_type} in reject list"}
+      {:accepted, _} -> {:reject, "[VocabularyPolicy] #{activity_type} not in accept list"}
+      {:rejected, _} -> {:reject, "[VocabularyPolicy] #{activity_type} in reject list"}
    end
  end

-  def filter(message), do: {:ok, message}
+  def filter(activity), do: {:ok, activity}

  @impl true
  def describe,
@ -46,20 +46,20 @@ defmodule Pleroma.Web.ActivityPub.MRF.VocabularyPolicy do
      key: :mrf_vocabulary,
      related_policy: "Pleroma.Web.ActivityPub.MRF.VocabularyPolicy",
      label: "MRF Vocabulary",
-      description: "Filter messages which belong to certain activity vocabularies",
+      description: "Filter activities which belong to certain activity vocabularies",
      children: [
        %{
          key: :accept,
          type: {:list, :string},
          description:
-            "A list of ActivityStreams terms to accept. If empty, all supported messages are accepted.",
+            "A list of ActivityStreams terms to accept. If empty, all supported activities are accepted.",
          suggestions: ["Create", "Follow", "Mention", "Announce", "Like"]
        },
        %{
          key: :reject,
          type: {:list, :string},
          description:
-            "A list of ActivityStreams terms to reject. If empty, no messages are rejected.",
+            "A list of ActivityStreams terms to reject. If empty, no activities are rejected.",
          suggestions: ["Create", "Follow", "Mention", "Announce", "Like"]
        }
      ]
--- a/lib/pleroma/web/activity_pub/object_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validator.ex
@ -11,6 +11,8 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do

  @behaviour Pleroma.Web.ActivityPub.ObjectValidator.Validating

+  import Pleroma.Constants, only: [activity_types: 0, object_types: 0]
+
  alias Pleroma.Activity
  alias Pleroma.EctoType.ActivityPub.ObjectValidators
  alias Pleroma.Object
@ -38,6 +40,16 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
  @impl true
  def validate(object, meta)

+  # This overload works together with the InboxGuardPlug
+  # and ensures that we are not accepting any activity type
+  # that cannot pass InboxGuardPlug.
+  # If we want to support any more activity types, make sure to
+  # add it in Pleroma.Constants's activity_types or object_types,
+  # and, if applicable, allowed_activity_types_from_strangers.
+  def validate(%{"type" => type}, _meta)
+      when type not in activity_types() and type not in object_types(),
+      do: {:error, :not_allowed_object_type}
+
  def validate(%{"type" => "Block"} = block_activity, meta) do
    with {:ok, block_activity} <-
           block_activity
@ -157,7 +169,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
         meta = Keyword.put(meta, :object_data, object_data),
         {:ok, update_activity} <-
           update_activity
-           |> UpdateValidator.cast_and_validate()
+           |> UpdateValidator.cast_and_validate(meta)
           |> Ecto.Changeset.apply_action(:insert) do
      update_activity = stringify_keys(update_activity)
      {:ok, update_activity, meta}
@ -165,7 +177,7 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
      {:local, _} ->
        with {:ok, object} <-
               update_activity
-               |> UpdateValidator.cast_and_validate()
+               |> UpdateValidator.cast_and_validate(meta)
               |> Ecto.Changeset.apply_action(:insert) do
          object = stringify_keys(object)
          {:ok, object, meta}
@ -195,9 +207,16 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidator do
        "Answer" -> AnswerValidator
      end

+    cast_func =
+      if type == "Update" do
+        fn o -> validator.cast_and_validate(o, meta) end
+      else
+        fn o -> validator.cast_and_validate(o) end
+      end
+
    with {:ok, object} <-
           object
-           |> validator.cast_and_validate()
+           |> cast_func.()
           |> Ecto.Changeset.apply_action(:insert) do
      object = stringify_keys(object)
      {:ok, object, meta}
--- a/lib/pleroma/web/activity_pub/object_validators/update_validator.ex
+++ b/lib/pleroma/web/activity_pub/object_validators/update_validator.ex
@ -6,6 +6,8 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.UpdateValidator do
  use Ecto.Schema

  alias Pleroma.EctoType.ActivityPub.ObjectValidators
+  alias Pleroma.Object
+  alias Pleroma.User

  import Ecto.Changeset
  import Pleroma.Web.ActivityPub.ObjectValidators.CommonValidations
@ -31,23 +33,50 @@ defmodule Pleroma.Web.ActivityPub.ObjectValidators.UpdateValidator do
    |> cast(data, __schema__(:fields))
  end

-  defp validate_data(cng) do
+  defp validate_data(cng, meta) do
    cng
    |> validate_required([:id, :type, :actor, :to, :cc, :object])
    |> validate_inclusion(:type, ["Update"])
    |> validate_actor_presence()
-    |> validate_updating_rights()
+    |> validate_updating_rights(meta)
  end

-  def cast_and_validate(data) do
+  def cast_and_validate(data, meta \\ []) do
    data
    |> cast_data
-    |> validate_data
+    |> validate_data(meta)
  end

-  # For now we only support updating users, and here the rule is easy:
-  # object id == actor id
-  def validate_updating_rights(cng) do
+  def validate_updating_rights(cng, meta) do
+    if meta[:local] do
+      validate_updating_rights_local(cng)
+    else
+      validate_updating_rights_remote(cng)
+    end
+  end
+
+  # For local Updates, verify the actor can edit the object
+  def validate_updating_rights_local(cng) do
+    actor = get_field(cng, :actor)
+    updated_object = get_field(cng, :object)
+
+    if {:ok, actor} == ObjectValidators.ObjectID.cast(updated_object) do
+      cng
+    else
+      with %User{} = user <- User.get_cached_by_ap_id(actor),
+           {_, %Object{} = orig_object} <- {:object, Object.normalize(updated_object)},
+           :ok <- Object.authorize_access(orig_object, user) do
+        cng
+      else
+        _e ->
+          cng
+          |> add_error(:object, "Can't be updated by this actor")
+      end
+    end
+  end
+
+  # For remote Updates, verify the host is the same.
+  def validate_updating_rights_remote(cng) do
    with actor = get_field(cng, :actor),
         object = get_field(cng, :object),
         {:ok, object_id} <- ObjectValidators.ObjectID.cast(object),
--- a/lib/pleroma/web/activity_pub/pipeline.ex
+++ b/lib/pleroma/web/activity_pub/pipeline.ex
@ -22,22 +22,27 @@ defmodule Pleroma.Web.ActivityPub.Pipeline do
  defp activity_pub, do: Config.get([:pipeline, :activity_pub], ActivityPub)
  defp config, do: Config.get([:pipeline, :config], Config)

-  @spec common_pipeline(map(), keyword()) ::
-          {:ok, Activity.t() | Object.t(), keyword()} | {:error | :reject, any()}
+  @type results :: {:ok, Activity.t() | Object.t(), keyword()}
+  @type errors :: {:error | :reject, any()}
+
+  # The Repo.transaction will wrap the result in an {:ok, _}
+  # and only returns an {:error, _} if the error encountered was related
+  # to the SQL transaction
+  @spec common_pipeline(map(), keyword()) :: results() | errors()
  def common_pipeline(object, meta) do
    case Repo.transaction(fn -> do_common_pipeline(object, meta) end, Utils.query_timeout()) do
      {:ok, {:ok, activity, meta}} ->
        side_effects().handle_after_transaction(meta)
        {:ok, activity, meta}

-      {:ok, value} ->
-        value
+      {:ok, {:error, _} = error} ->
+        error
+
+      {:ok, {:reject, _} = error} ->
+        error

      {:error, e} ->
        {:error, e}
-
-      {:reject, e} ->
-        {:reject, e}
    end
  end

--- a/lib/pleroma/web/activity_pub/publisher.ex
+++ b/lib/pleroma/web/activity_pub/publisher.ex
@ -11,6 +11,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
  alias Pleroma.Object
  alias Pleroma.Repo
  alias Pleroma.User
+  alias Pleroma.Web.ActivityPub.Publisher.Prepared
  alias Pleroma.Web.ActivityPub.Relay
  alias Pleroma.Web.ActivityPub.Transmogrifier
  alias Pleroma.Workers.PublisherWorker
@ -30,11 +31,11 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
  """
  @spec enqueue_one(map(), Keyword.t()) :: {:ok, %Oban.Job{}}
  def enqueue_one(%{} = params, worker_args \\ []) do
-    PublisherWorker.enqueue(
-      "publish_one",
-      %{"params" => params},
+    PublisherWorker.new(
+      %{"op" => "publish_one", "params" => params},
      worker_args
    )
+    |> Oban.insert()
  end

  @doc """
@ -76,14 +77,13 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
  end

  @doc """
-  Publish a single message to a peer.  Takes a struct with the following
-  parameters set:
-
+  Prepare an activity for publishing from an Oban job
  * `inbox`: the inbox to publish to
  * `activity_id`: the internal activity id
  * `cc`: the cc recipients relevant to this inbox (optional)
  """
-  def publish_one(%{inbox: inbox, activity_id: activity_id} = params) do
+  @spec prepare_one(map()) :: Prepared.t()
+  def prepare_one(%{inbox: inbox, activity_id: activity_id} = params) do
    activity = Activity.get_by_id_with_user_actor(activity_id)
    actor = activity.user_actor

@ -93,7 +93,7 @@ defmodule Pleroma.Web.ActivityPub.Publisher do

    {:ok, data} = Transmogrifier.prepare_outgoing(activity.data)

-    cc = Map.get(params, :cc)
+    cc = Map.get(params, :cc, [])

    json =
      data
@ -113,27 +113,54 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
        date: date
      })

+    %Prepared{
+      activity_id: activity_id,
+      json: json,
+      date: date,
+      signature: signature,
+      digest: digest,
+      inbox: inbox,
+      unreachable_since: params[:unreachable_since]
+    }
+  end
+
+  @doc """
+  Publish a single message to a peer.  Takes a struct with the following
+  parameters set:
+  * `activity_id`: the activity id
+  * `json`: the json payload
+  * `date`: the signed date from Pleroma.Signature.signed_date()
+  * `signature`: the signature from Pleroma.Signature.sign/2
+  * `digest`: base64 encoded the hash of the json payload prefixed with "SHA-256="
+  * `inbox`: the inbox URI of this delivery
+  * `unreachable_since`: timestamp the instance was marked unreachable
+
+  """
+  def publish_one(%Prepared{} = p) do
    with {:ok, %{status: code}} = result when code in 200..299 <-
           HTTP.post(
-             inbox,
-             json,
+             p.inbox,
+             p.json,
             [
               {"Content-Type", "application/activity+json"},
-               {"Date", date},
-               {"signature", signature},
-               {"digest", digest}
+               {"Date", p.date},
+               {"signature", p.signature},
+               {"digest", p.digest}
             ]
           ) do
-      if not Map.has_key?(params, :unreachable_since) || params[:unreachable_since] do
-        Instances.set_reachable(inbox)
+      if not is_nil(p.unreachable_since) do
+        Instances.set_reachable(p.inbox)
      end

      result
    else
      {_post_result, %{status: code} = response} = e ->
-        unless params[:unreachable_since], do: Instances.set_unreachable(inbox)
-        Logger.metadata(activity: activity_id, inbox: inbox, status: code)
-        Logger.error("Publisher failed to inbox #{inbox} with status #{code}")
+        if is_nil(p.unreachable_since) do
+          Instances.set_unreachable(p.inbox)
+        end
+
+        Logger.metadata(activity: p.activity_id, inbox: p.inbox, status: code)
+        Logger.error("Publisher failed to inbox #{p.inbox} with status #{code}")

        case response do
          %{status: 400} -> {:cancel, :bad_request}
@ -143,18 +170,27 @@ defmodule Pleroma.Web.ActivityPub.Publisher do
          _ -> {:error, e}
        end

+      {:error, {:already_started, _}} ->
+        Logger.debug("Publisher snoozing worker job due worker :already_started race condition")
+        connection_pool_snooze()
+
      {:error, :pool_full} ->
        Logger.debug("Publisher snoozing worker job due to full connection pool")
-        {:snooze, 30}
+        connection_pool_snooze()

      e ->
-        unless params[:unreachable_since], do: Instances.set_unreachable(inbox)
-        Logger.metadata(activity: activity_id, inbox: inbox)
-        Logger.error("Publisher failed to inbox #{inbox} #{inspect(e)}")
+        if is_nil(p.unreachable_since) do
+          Instances.set_unreachable(p.inbox)
+        end
+
+        Logger.metadata(activity: p.activity_id, inbox: p.inbox)
+        Logger.error("Publisher failed to inbox #{p.inbox} #{inspect(e)}")
        {:error, e}
    end
  end

+  defp connection_pool_snooze, do: {:snooze, 3}
+
  defp signature_host(%URI{port: port, scheme: scheme, host: host}) do
    if port == URI.default_port(scheme) do
      host
--- a/lib/pleroma/web/activity_pub/publisher/prepared.ex
+++ b/lib/pleroma/web/activity_pub/publisher/prepared.ex
@ -0,0 +1,8 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Publisher.Prepared do
+  @type t :: %__MODULE__{}
+  defstruct [:activity_id, :json, :date, :signature, :digest, :inbox, :unreachable_since]
+end
--- a/lib/pleroma/web/activity_pub/side_effects.ex
+++ b/lib/pleroma/web/activity_pub/side_effects.ex
@ -223,10 +223,12 @@ defmodule Pleroma.Web.ActivityPub.SideEffects do
      if Pleroma.Web.Federator.allowed_thread_distance?(reply_depth) and
           object.data["replies"] != nil do
        for reply_id <- object.data["replies"] do
-          Pleroma.Workers.RemoteFetcherWorker.enqueue("fetch_remote", %{
+          Pleroma.Workers.RemoteFetcherWorker.new(%{
+            "op" => "fetch_remote",
            "id" => reply_id,
            "depth" => reply_depth
          })
+          |> Oban.insert()
        end
      end

@ -410,10 +412,12 @@ defmodule Pleroma.Web.ActivityPub.SideEffects do
        {:ok, expires_at} =
          Pleroma.EctoType.ActivityPub.ObjectValidators.DateTime.cast(meta[:expires_at])

-        Pleroma.Workers.PurgeExpiredActivity.enqueue(%{
-          activity_id: meta[:activity_id],
-          expires_at: expires_at
-        })
+        Pleroma.Workers.PurgeExpiredActivity.enqueue(
+          %{
+            activity_id: meta[:activity_id]
+          },
+          scheduled_at: expires_at
+        )
      end

      {:ok, object, meta}
--- a/lib/pleroma/web/activity_pub/views/user_view.ex
+++ b/lib/pleroma/web/activity_pub/views/user_view.ex
@ -129,8 +129,22 @@ defmodule Pleroma.Web.ActivityPub.UserView do
      "vcard:bday" => birthday,
      "webfinger" => "acct:#{User.full_nickname(user)}"
    }
-    |> Map.merge(maybe_make_image(&User.avatar_url/2, "icon", user))
-    |> Map.merge(maybe_make_image(&User.banner_url/2, "image", user))
+    |> Map.merge(
+      maybe_make_image(
+        &User.avatar_url/2,
+        User.image_description(user.avatar, nil),
+        "icon",
+        user
+      )
+    )
+    |> Map.merge(
+      maybe_make_image(
+        &User.banner_url/2,
+        User.image_description(user.banner, nil),
+        "image",
+        user
+      )
+    )
    |> Map.merge(Utils.make_json_ld_header())
  end

@ -305,16 +319,24 @@ defmodule Pleroma.Web.ActivityPub.UserView do
    end
  end

-  defp maybe_make_image(func, key, user) do
+  defp maybe_make_image(func, description, key, user) do
    if image = func.(user, no_default: true) do
      %{
-        key => %{
-          "type" => "Image",
-          "url" => image
-        }
+        key =>
+          %{
+            "type" => "Image",
+            "url" => image
+          }
+          |> maybe_put_description(description)
      }
    else
      %{}
    end
  end
+
+  defp maybe_put_description(map, description) when is_binary(description) do
+    Map.put(map, "name", description)
+  end
+
+  defp maybe_put_description(map, _description), do: map
 end
--- a/lib/pleroma/web/api_spec/operations/account_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/account_operation.ex
@ -498,22 +498,6 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
    }
  end

-  def identity_proofs_operation do
-    %Operation{
-      tags: ["Retrieve account information"],
-      summary: "Identity proofs",
-      operationId: "AccountController.identity_proofs",
-      # Validators complains about unused path params otherwise
-      parameters: [
-        %Reference{"$ref": "#/components/parameters/accountIdOrNickname"}
-      ],
-      description: "Not implemented",
-      responses: %{
-        200 => empty_array_response()
-      }
-    }
-  end
-
  def familiar_followers_operation do
    %Operation{
      tags: ["Retrieve account information"],
@ -829,6 +813,16 @@ defmodule Pleroma.Web.ApiSpec.AccountOperation do
          allOf: [BooleanLike],
          nullable: true,
          description: "User's birthday will be visible"
+        },
+        avatar_description: %Schema{
+          type: :string,
+          nullable: true,
+          description: "Avatar image description."
+        },
+        header_description: %Schema{
+          type: :string,
+          nullable: true,
+          description: "Header image description."
        }
      },
      example: %{
--- a/lib/pleroma/web/api_spec/operations/media_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/media_operation.ex
@ -121,7 +121,7 @@ defmodule Pleroma.Web.ApiSpec.MediaOperation do
      security: [%{"oAuth" => ["write:media"]}],
      requestBody: Helpers.request_body("Parameters", create_request()),
      responses: %{
-        202 => Operation.response("Media", "application/json", Attachment),
+        200 => Operation.response("Media", "application/json", Attachment),
        400 => Operation.response("Media", "application/json", ApiError),
        422 => Operation.response("Media", "application/json", ApiError),
        500 => Operation.response("Media", "application/json", ApiError)
--- a/lib/pleroma/web/api_spec/operations/notification_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/notification_operation.ex
@ -158,6 +158,10 @@ defmodule Pleroma.Web.ApiSpec.NotificationOperation do
      type: :object,
      properties: %{
        id: %Schema{type: :string},
+        group_key: %Schema{
+          type: :string,
+          description: "Group key shared by similar notifications"
+        },
        type: notification_type(),
        created_at: %Schema{type: :string, format: :"date-time"},
        account: %Schema{
@ -180,6 +184,7 @@ defmodule Pleroma.Web.ApiSpec.NotificationOperation do
      },
      example: %{
        "id" => "34975861",
+        "group-key" => "ungrouped-34975861",
        "type" => "mention",
        "created_at" => "2019-11-23T07:49:02.064Z",
        "account" => Account.schema().example,
--- a/lib/pleroma/web/api_spec/operations/pleroma_account_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/pleroma_account_operation.ex
@ -85,9 +85,11 @@ defmodule Pleroma.Web.ApiSpec.PleromaAccountOperation do

  def subscribe_operation do
    %Operation{
+      deprecated: true,
      tags: ["Account actions"],
      summary: "Subscribe",
-      description: "Receive notifications for all statuses posted by the account.",
+      description:
+        "Receive notifications for all statuses posted by the account. Deprecated, use `notify: true` in follow operation instead.",
      operationId: "PleromaAPI.AccountController.subscribe",
      parameters: [id_param()],
      security: [%{"oAuth" => ["follow", "write:follows"]}],
@ -100,9 +102,11 @@ defmodule Pleroma.Web.ApiSpec.PleromaAccountOperation do

  def unsubscribe_operation do
    %Operation{
+      deprecated: true,
      tags: ["Account actions"],
      summary: "Unsubscribe",
-      description: "Stop receiving notifications for all statuses posted by the account.",
+      description:
+        "Stop receiving notifications for all statuses posted by the account.  Deprecated, use `notify: false` in follow operation instead.",
      operationId: "PleromaAPI.AccountController.unsubscribe",
      parameters: [id_param()],
      security: [%{"oAuth" => ["follow", "write:follows"]}],
--- a/lib/pleroma/web/api_spec/operations/status_operation.ex
+++ b/lib/pleroma/web/api_spec/operations/status_operation.ex
@ -31,11 +31,17 @@ defmodule Pleroma.Web.ApiSpec.StatusOperation do
      security: [%{"oAuth" => ["read:statuses"]}],
      parameters: [
        Operation.parameter(
-          :ids,
+          :id,
          :query,
          %Schema{type: :array, items: FlakeID},
          "Array of status IDs"
        ),
+        Operation.parameter(
+          :ids,
+          :query,
+          %Schema{type: :array, items: FlakeID},
+          "Deprecated, use `id` instead"
+        ),
        Operation.parameter(
          :with_muted,
          :query,
--- a/lib/pleroma/web/api_spec/schemas/account.ex
+++ b/lib/pleroma/web/api_spec/schemas/account.ex
@ -111,7 +111,9 @@ defmodule Pleroma.Web.ApiSpec.Schemas.Account do
            format: :uri,
            nullable: true,
            description: "Favicon image of the user's instance"
-          }
+          },
+          avatar_description: %Schema{type: :string},
+          header_description: %Schema{type: :string}
        }
      },
      source: %Schema{
@ -152,6 +154,7 @@ defmodule Pleroma.Web.ApiSpec.Schemas.Account do
    example: %{
      "acct" => "foobar",
      "avatar" => "https://mypleroma.com/images/avi.png",
+      "avatar_description" => "",
      "avatar_static" => "https://mypleroma.com/images/avi.png",
      "bot" => false,
      "created_at" => "2020-03-24T13:05:58.000Z",
@ -162,6 +165,7 @@ defmodule Pleroma.Web.ApiSpec.Schemas.Account do
      "followers_count" => 0,
      "following_count" => 1,
      "header" => "https://mypleroma.com/images/banner.png",
+      "header_description" => "",
      "header_static" => "https://mypleroma.com/images/banner.png",
      "id" => "9tKi3esbG7OQgZ2920",
      "locked" => false,
--- a/lib/pleroma/web/api_spec/schemas/status.ex
+++ b/lib/pleroma/web/api_spec/schemas/status.ex
@ -249,6 +249,12 @@ defmodule Pleroma.Web.ApiSpec.Schemas.Status do
            nullable: true,
            description:
              "A datetime (ISO 8601) that states when the post was pinned or `null` if the post is not pinned"
+          },
+          list_id: %Schema{
+            type: :integer,
+            nullable: true,
+            description:
+              "The ID of the list the post is addressed to (if any, only returned to author)"
          }
        }
      },
--- a/lib/pleroma/web/auth/authenticator.ex
+++ b/lib/pleroma/web/auth/authenticator.ex
@ -10,4 +10,9 @@ defmodule Pleroma.Web.Auth.Authenticator do
  @callback handle_error(Plug.Conn.t(), any()) :: any()
  @callback auth_template() :: String.t() | nil
  @callback oauth_consumer_template() :: String.t() | nil
+
+  @callback change_password(Pleroma.User.t(), String.t(), String.t(), String.t()) ::
+              {:ok, Pleroma.User.t()} | {:error, term()}
+
+  @optional_callbacks change_password: 4
 end
--- a/lib/pleroma/web/auth/ldap_authenticator.ex
+++ b/lib/pleroma/web/auth/ldap_authenticator.ex
@ -3,18 +3,14 @@
 # SPDX-License-Identifier: AGPL-3.0-only

 defmodule Pleroma.Web.Auth.LDAPAuthenticator do
+  alias Pleroma.LDAP
  alias Pleroma.User

-  require Logger
-
-  import Pleroma.Web.Auth.Helpers, only: [fetch_credentials: 1, fetch_user: 1]
+  import Pleroma.Web.Auth.Helpers, only: [fetch_credentials: 1]

  @behaviour Pleroma.Web.Auth.Authenticator
  @base Pleroma.Web.Auth.PleromaAuthenticator

-  @connection_timeout 10_000
-  @search_timeout 10_000
-
  defdelegate get_registration(conn), to: @base
  defdelegate create_from_registration(conn, registration), to: @base
  defdelegate handle_error(conn, error), to: @base
@ -24,7 +20,7 @@ defmodule Pleroma.Web.Auth.LDAPAuthenticator do
  def get_user(%Plug.Conn{} = conn) do
    with {:ldap, true} <- {:ldap, Pleroma.Config.get([:ldap, :enabled])},
         {:ok, {name, password}} <- fetch_credentials(conn),
-         %User{} = user <- ldap_user(name, password) do
+         %User{} = user <- LDAP.bind_user(name, password) do
      {:ok, user}
    else
      {:ldap, _} ->
@ -35,106 +31,12 @@ defmodule Pleroma.Web.Auth.LDAPAuthenticator do
    end
  end

-  defp ldap_user(name, password) do
-    ldap = Pleroma.Config.get(:ldap, [])
-    host = Keyword.get(ldap, :host, "localhost")
-    port = Keyword.get(ldap, :port, 389)
-    ssl = Keyword.get(ldap, :ssl, false)
-    sslopts = Keyword.get(ldap, :sslopts, [])
-
-    options =
-      [{:port, port}, {:ssl, ssl}, {:timeout, @connection_timeout}] ++
-        if sslopts != [], do: [{:sslopts, sslopts}], else: []
-
-    case :eldap.open([to_charlist(host)], options) do
-      {:ok, connection} ->
-        try do
-          if Keyword.get(ldap, :tls, false) do
-            :application.ensure_all_started(:ssl)
-
-            case :eldap.start_tls(
-                   connection,
-                   Keyword.get(ldap, :tlsopts, []),
-                   @connection_timeout
-                 ) do
-              :ok ->
-                :ok
-
-              error ->
-                Logger.error("Could not start TLS: #{inspect(error)}")
-            end
-          end
-
-          bind_user(connection, ldap, name, password)
-        after
-          :eldap.close(connection)
-        end
-
-      {:error, error} ->
-        Logger.error("Could not open LDAP connection: #{inspect(error)}")
-        {:error, {:ldap_connection_error, error}}
+  def change_password(user, password, new_password, new_password) do
+    case LDAP.change_password(user.nickname, password, new_password) do
+      :ok -> {:ok, user}
+      e -> e
    end
  end

-  defp bind_user(connection, ldap, name, password) do
-    uid = Keyword.get(ldap, :uid, "cn")
-    base = Keyword.get(ldap, :base)
-
-    case :eldap.simple_bind(connection, "#{uid}=#{name},#{base}", password) do
-      :ok ->
-        case fetch_user(name) do
-          %User{} = user ->
-            user
-
-          _ ->
-            register_user(connection, base, uid, name)
-        end
-
-      error ->
-        Logger.error("Could not bind LDAP user #{name}: #{inspect(error)}")
-        {:error, {:ldap_bind_error, error}}
-    end
-  end
-
-  defp register_user(connection, base, uid, name) do
-    case :eldap.search(connection, [
-           {:base, to_charlist(base)},
-           {:filter, :eldap.equalityMatch(to_charlist(uid), to_charlist(name))},
-           {:scope, :eldap.wholeSubtree()},
-           {:timeout, @search_timeout}
-         ]) do
-      # The :eldap_search_result record structure changed in OTP 24.3 and added a controls field
-      # https://github.com/erlang/otp/pull/5538
-      {:ok, {:eldap_search_result, [{:eldap_entry, _object, attributes}], _referrals}} ->
-        try_register(name, attributes)
-
-      {:ok, {:eldap_search_result, [{:eldap_entry, _object, attributes}], _referrals, _controls}} ->
-        try_register(name, attributes)
-
-      error ->
-        Logger.error("Couldn't register user because LDAP search failed: #{inspect(error)}")
-        {:error, {:ldap_search_error, error}}
-    end
-  end
-
-  defp try_register(name, attributes) do
-    params = %{
-      name: name,
-      nickname: name,
-      password: nil
-    }
-
-    params =
-      case List.keyfind(attributes, ~c"mail", 0) do
-        {_, [mail]} -> Map.put_new(params, :email, :erlang.list_to_binary(mail))
-        _ -> params
-      end
-
-    changeset = User.register_changeset_ldap(%User{}, params)
-
-    case User.register(changeset) do
-      {:ok, user} -> user
-      error -> error
-    end
-  end
+  def change_password(_, _, _, _), do: {:error, :password_confirmation}
 end
--- a/lib/pleroma/web/auth/pleroma_authenticator.ex
+++ b/lib/pleroma/web/auth/pleroma_authenticator.ex
@ -6,6 +6,7 @@ defmodule Pleroma.Web.Auth.PleromaAuthenticator do
  alias Pleroma.Registration
  alias Pleroma.Repo
  alias Pleroma.User
+  alias Pleroma.Web.CommonAPI
  alias Pleroma.Web.Plugs.AuthenticationPlug

  import Pleroma.Web.Auth.Helpers, only: [fetch_credentials: 1, fetch_user: 1]
@ -101,4 +102,23 @@ defmodule Pleroma.Web.Auth.PleromaAuthenticator do
  def auth_template, do: nil

  def oauth_consumer_template, do: nil
+
+  @doc "Changes Pleroma.User password in the database"
+  def change_password(user, password, new_password, new_password) do
+    case CommonAPI.Utils.confirm_current_password(user, password) do
+      {:ok, user} ->
+        with {:ok, _user} <-
+               User.reset_password(user, %{
+                 password: new_password,
+                 password_confirmation: new_password
+               }) do
+          {:ok, user}
+        end
+
+      error ->
+        error
+    end
+  end
+
+  def change_password(_, _, _, _), do: {:error, :password_confirmation}
 end
--- a/lib/pleroma/web/auth/wrapper_authenticator.ex
+++ b/lib/pleroma/web/auth/wrapper_authenticator.ex
@ -39,4 +39,8 @@ defmodule Pleroma.Web.Auth.WrapperAuthenticator do
    implementation().oauth_consumer_template() ||
      Pleroma.Config.get([:auth, :oauth_consumer_template], "consumer.html")
  end
+
+  @impl true
+  def change_password(user, password, new_password, new_password_confirmation),
+    do: implementation().change_password(user, password, new_password, new_password_confirmation)
 end
--- a/Show more
+++ b/Show more
				`@ -1 +0,0 @@`
				`docker buildx build --platform linux/amd64,linux/arm64,linux/arm/v7 -t git.pleroma.social:5050/pleroma/pleroma/ci-base:elixir-1.12 --push .`