R8 the Mastodon API made real: featured tags, endorsements, notes, notify and languages, suggestions, the direct stream

Featured tags per persona (/api/v1/featured_tags, suggestions, tags/:name/feature, accounts' featured tags, max 10),
listed at /tattoos as Hashtags and sent as Add/Remove{Hashtag} to followers on the featured collection, as Mastodon
sends them; remote accounts' tags received and read from featuredTags. Endorsements (pin/endorse) and private notes
(PersonaNote) kept per persona and never federated; the relationship's notifying, languages, endorsed and note, with
follow's notify (status notifications) and languages (home filter). Reading preferences set on /clientapi. Suggestions
v1/v2 with dismissals and staff picks, never the persona or a sibling. conversation events on the direct stream.
translate, annual reports and the admin API answer. New collections backed up and removed with their persona.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Controllers/ClientToServer/PrivateAvatarController.cs

@@ -74,6 +74,51 @@ namespace PrivaPub.Controllers.ClientToServer
 			return Ok();
 		}
 
+		// how the persona's clients show what others post (R8): Mastodon's reading preferences, which its API only reads
+		[HttpGet, Route("/clientapi/avatar/private/preferences")]
+		public async Task<IActionResult> Preferences([FromQuery] string avatarId, [FromServices] StaticServices.DbEntities dbEntities, CancellationToken token)
+		{
+			var avatar = await OwnPersona(avatarId, dbEntities, token);
+			return avatar == default
+				? NotFound(new WebResult().Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound))
+				: Ok(PreferencesOf(avatar));
+		}
+
+		[HttpPost, Route("/clientapi/avatar/private/preferences")]
+		public async Task<IActionResult> SavePreferences(PersonaPreferencesForm form, [FromServices] StaticServices.DbEntities dbEntities, CancellationToken token)
+		{
+			if (!ModelState.IsValid)
+				return BadRequest(new WebResult().Invalidate(_localizer["Invalid model."]));
+			if (!Models.User.ExpandMediaModes.IsKnown(form.ExpandMedia))
+				return UnprocessableEntity(new WebResult().Invalidate(_localizer["Media are shown as default, show_all or hide_all."], StatusCodes.Status422UnprocessableEntity));
+			var avatar = await OwnPersona(form.AvatarId, dbEntities, token);
+			if (avatar == default)
+				return NotFound(new WebResult().Invalidate(_localizer["Avatar not found."], StatusCodes.Status404NotFound));
+			await MongoDB.Entities.DB.Default.Update<Models.User.Avatar>().MatchID(avatar.ID)
+				.Modify(a => a.Settings.ExpandMedia, form.ExpandMedia)
+				.Modify(a => a.Settings.ExpandSpoilers, form.ExpandSpoilers)
+				.ExecuteAsync(token);
+			avatar.Settings.ExpandMedia = form.ExpandMedia;
+			avatar.Settings.ExpandSpoilers = form.ExpandSpoilers;
+			return Ok(PreferencesOf(avatar));
+		}
+
+		// one of the login's own personas, not deleted (a suspended one keeps its preferences for when it is back)
+		async Task<Models.User.Avatar> OwnPersona(string avatarId, StaticServices.DbEntities dbEntities, CancellationToken token)
+		{
+			var rootId = User.GetUserId();
+			if (string.IsNullOrEmpty(avatarId) || !await dbEntities.RootToAvatars.Match(ra => ra.RootId == rootId && ra.AvatarId == avatarId).ExecuteAnyAsync(token))
+				return default;
+			return await dbEntities.Avatars.MatchID(avatarId).Match(a => !a.DeletionAt.HasValue).ExecuteFirstAsync(token);
+		}
+
+		static ViewPersonaPreferences PreferencesOf(Models.User.Avatar avatar) => new()
+		{
+			AvatarId = avatar.ID,
+			ExpandMedia = Models.User.ExpandMediaModes.IsKnown(avatar.Settings.ExpandMedia) ? avatar.Settings.ExpandMedia : Models.User.ExpandMediaModes.Default,
+			ExpandSpoilers = avatar.Settings.ExpandSpoilers
+		};
+
 		[HttpPost, Route("/clientapi/avatar/private/update")]
 		public async Task<IActionResult> UpdateAvatar(UpdateAvatarForm model)
 		{