R8 the Mastodon API made real: featured tags, endorsements, notes, notify and languages, suggestions, the direct stream

Featured tags per persona (/api/v1/featured_tags, suggestions, tags/:name/feature, accounts' featured tags, max 10), listed at /tattoos as Hashtags and sent as Add/Remove{Hashtag} to followers on the featured collection, as Mastodon sends them; remote accounts' tags received and read from featuredTags. Endorsements (pin/endorse) and private notes (PersonaNote) kept per persona and never federated; the relationship's notifying, languages, endorsed and note, with follow's notify (status notifications) and languages (home filter). Reading preferences set on /clientapi. Suggestions v1/v2 with dismissals and staff picks, never the persona or a sibling. conversation events on the direct stream. translate, annual reports and the admin API answer. New collections backed up and removed with their persona. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof
2026-10-18 08:38:11 +02:00
1 parent d08fbabaa5
commit 87529bca49
@@ -275,6 +275,7 @@ namespace PrivaPub.Controllers.ClientToServer
 					DeletedAt = r.DeletedAt
 				}).ToList(),
 				Relays = await RelayViews(settings, token),
+				StaffPicks = await StaffPickViews(settings, token),
 				Media = new ViewMediaLimits
 				{
 					QuotaBytesPerRoot = limits.QuotaBytesPerRoot,
@@ -387,6 +388,103 @@ namespace PrivaPub.Controllers.ClientToServer

 		#endregion

+		#region staff picks
+
+		// the accounts suggested first to every persona (completion program R8, Domain/Social/Suggestions): a persona here or an
+		// account elsewhere the administrators choose, in their order; kept in the settings, changed only here, every change in
+		// the staff's log (an entry about a persona of the acting login keeps no actor, ModerationLog)
+		[HttpGet, Route("/clientapi/admin/staff-picks")]
+		public async Task<IActionResult> StaffPicks(CancellationToken token)
+		{
+			if (await Administrator(token) == default)
+				return Forbid();
+			return Ok(await StaffPickViews(_settings.Current, token));
+		}
+
+		[HttpPost, Route("/clientapi/admin/staff-picks/insert")]
+		public async Task<IActionResult> InsertStaffPick(StaffPickForm form, CancellationToken token)
+		{
+			var admin = await Administrator(token);
+			if (admin == default)
+				return Forbid();
+			var id = form.AccountId?.Trim();
+			var picked = await Pickable(id, token);
+			if (picked == default)
+				return Refused(StatusCodes.Status404NotFound, "No such account to suggest.");
+			if (_settings.Current.StaffPicks.Contains(id))
+				return Refused(StatusCodes.Status409Conflict, "This account is suggested already.");
+			if (_settings.Current.StaffPicks.Count >= MaxStaffPicks)
+				return Refused(StatusCodes.Status422UnprocessableEntity, "40 accounts at most are suggested.");
+			var saved = await _settings.Update(settings =>
+			{
+				if (!settings.StaffPicks.Contains(id))
+					settings.StaffPicks.Add(id);
+			}, admin.ID, token);
+			await _log.Write(admin.ID, AdminActions.StaffPickInsert, picked.Value.IsLocal ? AdminTargets.Persona : AdminTargets.Account, id, picked.Value.Handle,
+				token: token);
+			return Ok(await StaffPickViews(saved, token));
+		}
+
+		[HttpPost, Route("/clientapi/admin/staff-picks/delete")]
+		public async Task<IActionResult> DeleteStaffPick([FromQuery] string accountId, CancellationToken token)
+		{
+			var admin = await Administrator(token);
+			if (admin == default)
+				return Forbid();
+			accountId = accountId?.Trim();
+			if (string.IsNullOrEmpty(accountId) || !_settings.Current.StaffPicks.Contains(accountId))
+				return NotFound();
+			var view = (await StaffPickViews(_settings.Current, token)).FirstOrDefault(p => p.AccountId == accountId);
+			var saved = await _settings.Update(settings => settings.StaffPicks.Remove(accountId), admin.ID, token);
+			await _log.Write(admin.ID, AdminActions.StaffPickDelete, view?.IsLocal == true ? AdminTargets.Persona : AdminTargets.Account, accountId,
+				view?.Handle ?? accountId, token: token);
+			return Ok(await StaffPickViews(saved, token));
+		}
+
+		const int MaxStaffPicks = 40;
+
+		// a persona that may be shown, or an account elsewhere that is a person (no group, feed or server's actor), neither
+		// suspended nor deleted
+		async Task<(bool IsLocal, string Handle)?> Pickable(string id, CancellationToken token)
+		{
+			if (string.IsNullOrEmpty(id) || id.Length > 64)
+				return default;
+			var avatar = await DB.Default.Find<Avatar>().Match(a => a.ID == id && !a.DeletionAt.HasValue && !a.SuspendedAt.HasValue).ExecuteFirstAsync(token);
+			if (avatar != default)
+				return (await Counted.HeldBackPersonas(token)).Contains(avatar.ID) ? ((bool, string)?)null : (true, _localActors.FromAvatar(avatar).Handle);
+			var foreign = await DB.Default.Find<ForeignAvatar>().Match(f => f.ID == id && !f.DeletionAt.HasValue && !f.SuspendedAt.HasValue
+				&& (f.AvatarType == AvatarType.Person || f.AvatarType == AvatarType.Service || f.AvatarType == AvatarType.Organization)).ExecuteFirstAsync(token);
+			return foreign == default ? ((bool, string)?)null : (false, $"{foreign.UserName}@{foreign.Domain}");
+		}
+
+		async Task<List<ViewStaffPick>> StaffPickViews(ServerSettings settings, CancellationToken token)
+		{
+			var ids = (settings.StaffPicks ?? new()).ToList();
+			var held = await Counted.HeldBackPersonas(token);
+			var avatars = (await DB.Default.Find<Avatar>().Match(a => ids.Contains(a.ID)).ExecuteAsync(token)).ToDictionary(a => a.ID);
+			var foreigns = (await DB.Default.Find<ForeignAvatar>().Match(f => ids.Contains(f.ID)).ExecuteAsync(token)).ToDictionary(f => f.ID);
+			return ids.Select(id => avatars.TryGetValue(id, out var avatar)
+				? new ViewStaffPick
+				{
+					AccountId = id,
+					IsLocal = true,
+					Handle = _localActors.FromAvatar(avatar).Handle,
+					Name = avatar.Name,
+					IsShown = avatar.DeletionAt == default && avatar.SuspendedAt == default && avatar.SilencedAt == default && !held.Contains(id)
+				}
+				: foreigns.TryGetValue(id, out var foreign)
+				? new ViewStaffPick
+				{
+					AccountId = id,
+					Handle = $"{foreign.UserName}@{foreign.Domain}",
+					Name = foreign.Name,
+					IsShown = foreign.DeletionAt == default && foreign.SuspendedAt == default && foreign.SilencedAt == default
+				}
+				: new ViewStaffPick { AccountId = id, IsShown = false }).ToList();
+		}
+
+		#endregion
+
 		#region relays

 		[HttpGet, Route("/clientapi/admin/relays")]
@@ -74,6 +74,51 @@ namespace PrivaPub.Controllers.ClientToServer
 			return Ok();
 		}

+		// how the persona's clients show what others post (R8): Mastodon's reading preferences, which its API only reads
+		[HttpGet, Route("/clientapi/avatar/private/preferences")]
+		public async Task<IActionResult> Preferences([FromQuery] string avatarId, [FromServices] StaticServices.DbEntities dbEntities, CancellationToken token)
+		{
+			var avatar = await OwnPersona(avatarId, dbEntities, token);
+			return avatar == default
+				? NotFound(new WebResult().Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound))
+				: Ok(PreferencesOf(avatar));
+		}
+
+		[HttpPost, Route("/clientapi/avatar/private/preferences")]
+		public async Task<IActionResult> SavePreferences(PersonaPreferencesForm form, [FromServices] StaticServices.DbEntities dbEntities, CancellationToken token)
+		{
+			if (!ModelState.IsValid)
+				return BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
+			if (!Models.User.ExpandMediaModes.IsKnown(form.ExpandMedia))
+				return UnprocessableEntity(new WebResult().Invalidate(_localizer["Media are shown as default, show_all or hide_all."], StatusCodes.Status422UnprocessableEntity));
+			var avatar = await OwnPersona(form.AvatarId, dbEntities, token);
+			if (avatar == default)
+				return NotFound(new WebResult().Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound));
+			await MongoDB.Entities.DB.Default.Update<Models.User.Avatar>().MatchID(avatar.ID)
+				.Modify(a => a.Settings.ExpandMedia, form.ExpandMedia)
+				.Modify(a => a.Settings.ExpandSpoilers, form.ExpandSpoilers)
+				.ExecuteAsync(token);
+			avatar.Settings.ExpandMedia = form.ExpandMedia;
+			avatar.Settings.ExpandSpoilers = form.ExpandSpoilers;
+			return Ok(PreferencesOf(avatar));
+		}
+
+		// one of the login's own personas, not deleted (a suspended one keeps its preferences for when it is back)
+		async Task<Models.User.Avatar> OwnPersona(string avatarId, StaticServices.DbEntities dbEntities, CancellationToken token)
+		{
+			var rootId = User.GetUserId();
+			if (string.IsNullOrEmpty(avatarId) || !await dbEntities.RootToAvatars.Match(ra => ra.RootId == rootId && ra.AvatarId == avatarId).ExecuteAnyAsync(token))
+				return default;
+			return await dbEntities.Avatars.MatchID(avatarId).Match(a => !a.DeletionAt.HasValue).ExecuteFirstAsync(token);
+		}
+
+		static ViewPersonaPreferences PreferencesOf(Models.User.Avatar avatar) => new()
+		{
+			AvatarId = avatar.ID,
+			ExpandMedia = Models.User.ExpandMediaModes.IsKnown(avatar.Settings.ExpandMedia) ? avatar.Settings.ExpandMedia : Models.User.ExpandMediaModes.Default,
+			ExpandSpoilers = avatar.Settings.ExpandSpoilers
+		};
+
 		[HttpPost, Route("/clientapi/avatar/private/update")]
 		public async Task<IActionResult> UpdateAvatar(UpdateAvatarForm model)
 		{