Merge branch 'master' into glitch-soc/merge-upstream

Conflicts:
- `app/controllers/activitypub/collections_controller.rb`:
  Conflict due to glitch-soc having to take care of local-only
  pinned toots in that controller.
  Took upstream's changes and restored the local-only special
  handling.
- `app/controllers/auth/sessions_controller.rb`:
  Minor conflicts due to the theming system, applied upstream
  changes, adapted the following two files for glitch-soc's
  theming system:
  - `app/controllers/concerns/sign_in_token_authentication_concern.rb`
  - `app/controllers/concerns/two_factor_authentication_concern.rb`
- `app/services/backup_service.rb`:
  Minor conflict due to glitch-soc having to handle local-only
  toots specially. Applied upstream changes and restored
  the local-only special handling.
- `app/views/admin/custom_emojis/index.html.haml`:
  Minor conflict due to the theming system.
- `package.json`:
  Upstream dependency updated, too close to a glitch-soc-only
  dependency in the file.
- `yarn.lock`:
  Upstream dependency updated, too close to a glitch-soc-only
  dependency in the file.

diff --cc Gemfile
Simple merge

diff --cc Gemfile.lock
Simple merge

diff --cc app/controllers/accounts_controller.rb
Simple merge

diff --cc app/controllers/activitypub/collections_controller.rb
index 9ca216e4fa728f509f326003ccfb3812c9feb1eb,380de54f5dc41354174c6f1bbc1947348e3520ac..e62fba7487f0d8a434c1b90931c60d7e440e1b9e
--- 1/app/controllers/activitypub/collections_controller.rb
--- 2/app/controllers/activitypub/collections_controller.rb
+++ b/app/controllers/activitypub/collections_controller.rb
@@@ -16,9 -17,25 +17,25 @@@ class ActivityPub::CollectionsControlle
  
    private
  
-   def set_statuses
-     @statuses = scope_for_collection
-     @statuses = cache_collection(@statuses, Status)
+   def set_items
+     case params[:id]
+     when 'featured'
+       @items = begin
+         # Because in public fetch mode we cache the response, there would be no
+         # benefit from performing the check below, since a blocked account or domain
+         # would likely be served the cache from the reverse proxy anyway
+ 
+         if authorized_fetch_mode? && !signed_request_account.nil? && (@account.blocking?(signed_request_account) || (!signed_request_account.domain.nil? && @account.domain_blocking?(signed_request_account.domain)))
+           []
+         else
 -          cache_collection(@account.pinned_statuses, Status)
++          cache_collection(@account.pinned_statuses.not_local_only, Status)
+         end
+       end
+     when 'devices'
+       @items = @account.devices
+     else
+       not_found
+     end
    end
  
    def set_size

diff --cc app/controllers/auth/sessions_controller.rb
index c36561b862a3d3208b622c1a8bec099081d81af5,2415e2ef322b2daa2cc599ed08970dbf6a211539..c54f6643ad737213e79d46ae4704fb596048a2a3
--- 1/app/controllers/auth/sessions_controller.rb
--- 2/app/controllers/auth/sessions_controller.rb
+++ b/app/controllers/auth/sessions_controller.rb
@@@ -8,8 -8,8 +8,10 @@@ class Auth::SessionsController < Devise
    skip_before_action :require_no_authentication, only: [:create]
    skip_before_action :require_functional!
  
-   prepend_before_action :authenticate_with_two_factor, if: :two_factor_enabled?, only: [:create]
 +  prepend_before_action :set_pack
++
+   include TwoFactorAuthenticationConcern
+   include SignInTokenAuthenticationConcern
  
    before_action :set_instance_presenter, only: [:new]
    before_action :set_body_classes

diff --cc app/controllers/concerns/sign_in_token_authentication_concern.rb
index 0000000000000000000000000000000000000000,a177aacafa54c1c81aa9c1f008ab7a8d25696d55..88c009b19de575e00a87f4058231ae2b57ee71a8
mode 000000,100644..100644
--- /dev/null
--- 2/app/controllers/concerns/sign_in_token_authentication_concern.rb
+++ b/app/controllers/concerns/sign_in_token_authentication_concern.rb
@@@ -1,0 -1,49 +1,50 @@@
+ # frozen_string_literal: true
+ 
+ module SignInTokenAuthenticationConcern
+   extend ActiveSupport::Concern
+ 
+   included do
+     prepend_before_action :authenticate_with_sign_in_token, if: :sign_in_token_required?, only: [:create]
+   end
+ 
+   def sign_in_token_required?
+     find_user&.suspicious_sign_in?(request.remote_ip)
+   end
+ 
+   def valid_sign_in_token_attempt?(user)
+     Devise.secure_compare(user.sign_in_token, user_params[:sign_in_token_attempt])
+   end
+ 
+   def authenticate_with_sign_in_token
+     user = self.resource = find_user
+ 
+     if user_params[:sign_in_token_attempt].present? && session[:attempt_user_id]
+       authenticate_with_sign_in_token_attempt(user)
+     elsif user.present? && user.external_or_valid_password?(user_params[:password])
+       prompt_for_sign_in_token(user)
+     end
+   end
+ 
+   def authenticate_with_sign_in_token_attempt(user)
+     if valid_sign_in_token_attempt?(user)
+       session.delete(:attempt_user_id)
+       remember_me(user)
+       sign_in(user)
+     else
+       flash.now[:alert] = I18n.t('users.invalid_sign_in_token')
+       prompt_for_sign_in_token(user)
+     end
+   end
+ 
+   def prompt_for_sign_in_token(user)
+     if user.sign_in_token_expired?
+       user.generate_sign_in_token && user.save
+       UserMailer.sign_in_token(user, request.remote_ip, request.user_agent, Time.now.utc.to_s).deliver_later!
+     end
+ 
+     session[:attempt_user_id] = user.id
++    use_pack 'auth'
+     @body_classes = 'lighter'
+     render :sign_in_token
+   end
+ end

diff --cc app/controllers/concerns/two_factor_authentication_concern.rb
index 0000000000000000000000000000000000000000,cdd8d14afedd938111412705dcdb9a4edeca7715..0d9f874551017824d0ba49058452c3b1670328ed
mode 000000,100644..100644
--- /dev/null
--- 2/app/controllers/concerns/two_factor_authentication_concern.rb
+++ b/app/controllers/concerns/two_factor_authentication_concern.rb
@@@ -1,0 -1,47 +1,48 @@@
+ # frozen_string_literal: true
+ 
+ module TwoFactorAuthenticationConcern
+   extend ActiveSupport::Concern
+ 
+   included do
+     prepend_before_action :authenticate_with_two_factor, if: :two_factor_enabled?, only: [:create]
+   end
+ 
+   def two_factor_enabled?
+     find_user&.otp_required_for_login?
+   end
+ 
+   def valid_otp_attempt?(user)
+     user.validate_and_consume_otp!(user_params[:otp_attempt]) ||
+       user.invalidate_otp_backup_code!(user_params[:otp_attempt])
+   rescue OpenSSL::Cipher::CipherError
+     false
+   end
+ 
+   def authenticate_with_two_factor
+     user = self.resource = find_user
+ 
+     if user_params[:otp_attempt].present? && session[:attempt_user_id]
+       authenticate_with_two_factor_attempt(user)
+     elsif user.present? && user.external_or_valid_password?(user_params[:password])
+       prompt_for_two_factor(user)
+     end
+   end
+ 
+   def authenticate_with_two_factor_attempt(user)
+     if valid_otp_attempt?(user)
+       session.delete(:attempt_user_id)
+       remember_me(user)
+       sign_in(user)
+     else
+       flash.now[:alert] = I18n.t('users.invalid_otp_token')
+       prompt_for_two_factor(user)
+     end
+   end
+ 
+   def prompt_for_two_factor(user)
+     session[:attempt_user_id] = user.id
++    use_pack 'auth'
+     @body_classes = 'lighter'
+     render :two_factor
+   end
+ end

diff --cc app/controllers/statuses_controller.rb
Simple merge

diff --cc app/controllers/tags_controller.rb
Simple merge

diff --cc app/helpers/application_helper.rb
Simple merge

diff --cc app/javascript/mastodon/locales/en.json
Simple merge

diff --cc app/javascript/styles/mastodon/components.scss
Simple merge

diff --cc app/lib/feed_manager.rb
Simple merge

diff --cc app/models/account.rb
Simple merge

diff --cc app/models/user.rb
index c8dbd2fd3c4a64d32725e41137c3a84ec6d1a206,306e2d4355c771ab46c9852321d425f9cda95f4b..a05d98d88d1decaff5291948959d9ec5d8cfc3c9
--- 1/app/models/user.rb
--- 2/app/models/user.rb
+++ b/app/models/user.rb
@@@ -107,14 -109,13 +109,14 @@@ class User < ApplicationRecor
  
    has_many :session_activations, dependent: :destroy
  
 -  delegate :auto_play_gif, :default_sensitive, :unfollow_modal, :boost_modal, :delete_modal,
 -           :reduce_motion, :system_font_ui, :noindex, :theme, :display_media, :hide_network,
 +  delegate :auto_play_gif, :default_sensitive, :unfollow_modal, :boost_modal, :favourite_modal, :delete_modal,
 +           :reduce_motion, :system_font_ui, :noindex, :flavour, :skin, :display_media, :hide_network, :hide_followers_count,
             :expand_spoilers, :default_language, :aggregate_reblogs, :show_application,
             :advanced_layout, :use_blurhash, :use_pending_items, :trends, :crop_images,
 +           :default_content_type, :system_emoji_font,
             to: :settings, prefix: :setting, allow_nil: false
  
-   attr_reader :invite_code
+   attr_reader :invite_code, :sign_in_token_attempt
    attr_writer :external
  
    def confirmed?
@@@ -168,8 -169,12 +170,12 @@@
      true
    end
  
+   def suspicious_sign_in?(ip)
+     !otp_required_for_login? && current_sign_in_at.present? && current_sign_in_at < 2.weeks.ago && !recent_ip?(ip)
+   end
+ 
    def functional?
 -    confirmed? && approved? && !disabled? && !account.suspended? && account.moved_to_account_id.nil?
 +    confirmed? && approved? && !disabled? && !account.suspended?
    end
  
    def unconfirmed_or_pending?

diff --cc app/serializers/initial_state_serializer.rb
Simple merge

diff --cc app/services/backup_service.rb
index 989fd6784d6722e785403ad42f1b200b31f4b9c2,6a1575616e49fbe15997c7b1faed6d1e725ae1ec..749c84736e8b700c6cfe2d549629bc5656ada3f3
--- 1/app/services/backup_service.rb
--- 2/app/services/backup_service.rb
+++ b/app/services/backup_service.rb
@@@ -22,7 -22,7 +22,7 @@@ class BackupService < BaseServic
  
      account.statuses.with_includes.reorder(nil).find_in_batches do |statuses|
        statuses.each do |status|
-         item = serialize_payload(status, ActivityPub::ActivitySerializer, signer: @account, allow_local_only: true)
 -        item = serialize_payload(ActivityPub::ActivityPresenter.from_status(status), ActivityPub::ActivitySerializer, signer: @account)
++        item = serialize_payload(ActivityPub::ActivityPresenter.from_status(status), ActivityPub::ActivitySerializer, signer: @account, allow_local_only: true)
          item.delete(:'@context')
  
          unless item[:type] == 'Announce' || item[:object][:attachment].blank?

diff --cc app/services/process_mentions_service.rb
Simple merge

diff --cc app/services/reblog_service.rb
Simple merge

diff --cc app/views/about/more.html.haml
Simple merge

diff --cc app/views/admin/custom_emojis/index.html.haml
index d3705a36ec24dd855bc23d0adfb83e6ad8d76837,c96a1ce00aa43bd8215c7b29e08b8cb59ade7191..45cb7bee0569b892bdc7b5fb47db30d4c6304504
--- 1/app/views/admin/custom_emojis/index.html.haml
--- 2/app/views/admin/custom_emojis/index.html.haml
+++ b/app/views/admin/custom_emojis/index.html.haml
@@@ -1,8 -1,12 +1,9 @@@
  - content_for :page_title do
    = t('admin.custom_emojis.title')
  
- - content_for :heading_actions do
-   = link_to t('admin.custom_emojis.upload'), new_admin_custom_emoji_path, class: 'button'
 -- content_for :header_tags do
 -  = javascript_pack_tag 'admin', integrity: true, async: true, crossorigin: 'anonymous'
 -
+ - if can?(:create, :custom_emoji)
+   - content_for :heading_actions do
+     = link_to t('admin.custom_emojis.upload'), new_admin_custom_emoji_path, class: 'button'
  
  .filters
    .filter-subset

diff --cc app/views/statuses/_simple_status.html.haml
Simple merge

diff --cc config/routes.rb
Simple merge

diff --cc config/webpack/shared.js
Simple merge

diff --cc db/schema.rb
Simple merge

diff --cc package.json
index 53937fab410006d418e1cd43c6bfd917657fcc1b,65be5a0410ed0730959038535b408388c2862d31..afb16618f20285360ef14d53885258426a5ab0bf
--- 1/package.json
--- 2/package.json
+++ b/package.json
@@@ -73,8 -72,7 +73,8 @@@
      "@rails/ujs": "^6.0.3",
      "array-includes": "^3.1.1",
      "arrow-key-navigation": "^1.1.0",
-     "autoprefixer": "^9.7.6",
 +    "atrament": "0.2.4",
+     "autoprefixer": "^9.8.0",
      "axios": "^0.19.2",
      "babel-loader": "^8.1.0",
      "babel-plugin-lodash": "^3.3.4",
@@@ -96,8 -94,7 +96,8 @@@
      "escape-html": "^1.0.3",
      "exif-js": "^2.3.0",
      "express": "^4.17.1",
-     "file-loader": "^5.1.0",
 +    "favico.js": "^0.3.10",
+     "file-loader": "^6.0.0",
      "font-awesome": "^4.7.0",
      "glob": "^7.1.6",
      "history": "^4.10.1",

diff --cc streaming/index.js
Simple merge

diff --cc yarn.lock
index 08dfacf7a1aff1e2e8e669ca46b91b87c21982b7,06b9c5b189ca9ea8bc1634f2ec2a9eaa8b67459f..d08113ec8424d6ecfdb170e4a657b983725333b4
--- 1/yarn.lock
--- 2/yarn.lock
+++ b/yarn.lock
@@@ -1933,18 -2060,13 +2060,18 @@@ atob@^2.1.2
    resolved "https://registry.yarnpkg.com/atob/-/atob-2.1.2.tgz#6d9517eb9e030d2436666651e86bd9f6f13533c9"
    integrity sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==
  
- autoprefixer@^9.7.6:
-   version "9.7.6"
-   resolved "https://registry.yarnpkg.com/autoprefixer/-/autoprefixer-9.7.6.tgz#63ac5bbc0ce7934e6997207d5bb00d68fa8293a4"
-   integrity sha512-F7cYpbN7uVVhACZTeeIeealwdGM6wMtfWARVLTy5xmKtgVdBNJvbDRoCK3YO1orcs7gv/KwYlb3iXwu9Ug9BkQ==
 +atrament@0.2.4:
 +  version "0.2.4"
 +  resolved "https://registry.yarnpkg.com/atrament/-/atrament-0.2.4.tgz#6f78196edfcd194e568b7c0b9c88201ec371ac66"
 +  integrity sha512-hSA9VwW6COMwvRhSEO4uZweZ91YGOdHqwvslNyrJZG+8mzc4qx/qMsDZBuAeXFeWZO/QKtRjIXguOUy1aNMl3A==
 +
+ autoprefixer@^9.8.0:
+   version "9.8.0"
+   resolved "https://registry.yarnpkg.com/autoprefixer/-/autoprefixer-9.8.0.tgz#68e2d2bef7ba4c3a65436f662d0a56a741e56511"
+   integrity sha512-D96ZiIHXbDmU02dBaemyAg53ez+6F5yZmapmgKcjm35yEe1uVDYI8hGW3VYoGRaG290ZFf91YxHrR518vC0u/A==
    dependencies:
-     browserslist "^4.11.1"
-     caniuse-lite "^1.0.30001039"
+     browserslist "^4.12.0"
+     caniuse-lite "^1.0.30001061"
      chalk "^2.4.2"
      normalize-range "^0.1.2"
      num2fraction "^1.2.2"
@@@ -4494,11 -4621,13 +4626,18 @@@ fast-levenshtein@~2.0.6
    resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917"
    integrity sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=
  
 +favico.js@^0.3.10:
 +  version "0.3.10"
 +  resolved "https://registry.yarnpkg.com/favico.js/-/favico.js-0.3.10.tgz#80586e27a117f24a8d51c18a99bdc714d4339301"
 +  integrity sha1-gFhuJ6EX8kqNUcGKmb3HFNQzkwE=
 +
+ fastq@^1.6.0:
+   version "1.8.0"
+   resolved "https://registry.yarnpkg.com/fastq/-/fastq-1.8.0.tgz#550e1f9f59bbc65fe185cb6a9b4d95357107f481"
+   integrity sha512-SMIZoZdLh/fgofivvIkmknUXyPnvxRE3DhtZ5Me3Mrsk5gyPL42F0xr51TdRXskBxHfMp+07bcYzfsYEsSQA9Q==
+   dependencies:
+     reusify "^1.0.4"
+ 
  faye-websocket@^0.10.0:
    version "0.10.0"
    resolved "https://registry.yarnpkg.com/faye-websocket/-/faye-websocket-0.10.0.tgz#4e492f8d04dfb6f89003507f6edbf2d501e7c6f4"