In private mode, block access to many public APIs

packages/backend/src/server/api/call.ts

@@ -7,6 +7,8 @@ import { limiter } from './limiter.js';
 import endpoints, { IEndpointMeta } from './endpoints.js';
 import { ApiError } from './error.js';
 import { apiLogger } from './logger.js';
+import { AccessToken } from '@/models/entities/access-token.js';
+import { fetchMeta } from '@/misc/fetch-meta.js';
 
 const accessDenied = {
 	message: 'Access denied.',
@@ -93,6 +95,17 @@ export default async (endpoint: string, user: CacheableLocalUser | null | undefi
 		});
 	}
 
+	// private mode
+	const meta = await fetchMeta();
+	if (meta.privateMode && ep.meta.requireCredentialPrivateMode && user == null) {
+		throw new ApiError({
+			message: 'Credential required.',
+			code: 'CREDENTIAL_REQUIRED',
+			id: '1384574d-a912-4b81-8601-c7b1c4085df1',
+			httpStatusCode: 401
+		});
+	}
+
 	// Cast non JSON input
 	if ((ep.meta.requireFile || ctx?.method === 'GET') && ep.params.properties) {
 		for (const k of Object.keys(ep.params.properties)) {

packages/backend/src/server/api/endpoints/announcements.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['meta'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/channels/featured.ts

@@ -5,6 +5,7 @@ export const meta = {
 	tags: ['channels'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/channels/show.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['channels'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/channels/timeline.ts

@@ -8,6 +8,7 @@ export const meta = {
 	tags: ['notes', 'channels'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/charts/active-users.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	tags: ['charts', 'users'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(activeUsersChart.schema),
 

packages/backend/src/server/api/endpoints/charts/ap-request.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	tags: ['charts'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(apRequestChart.schema),
 

packages/backend/src/server/api/endpoints/charts/drive.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	tags: ['charts', 'drive'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(driveChart.schema),
 

packages/backend/src/server/api/endpoints/charts/federation.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	tags: ['charts'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(federationChart.schema),
 

packages/backend/src/server/api/endpoints/charts/hashtag.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	tags: ['charts', 'hashtags'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(hashtagChart.schema),
 

packages/backend/src/server/api/endpoints/charts/instance.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	tags: ['charts'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(instanceChart.schema),
 

packages/backend/src/server/api/endpoints/charts/notes.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	tags: ['charts', 'notes'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(notesChart.schema),
 

packages/backend/src/server/api/endpoints/charts/user/drive.ts

@@ -4,6 +4,7 @@ import define from '../../../define.js';
 
 export const meta = {
 	tags: ['charts', 'drive', 'users'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(perUserDriveChart.schema),
 

packages/backend/src/server/api/endpoints/charts/user/following.ts

@@ -4,6 +4,7 @@ import define from '../../../define.js';
 
 export const meta = {
 	tags: ['charts', 'users', 'following'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(perUserFollowingChart.schema),
 

packages/backend/src/server/api/endpoints/charts/user/notes.ts

@@ -4,6 +4,7 @@ import define from '../../../define.js';
 
 export const meta = {
 	tags: ['charts', 'users', 'notes'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(perUserNotesChart.schema),
 

packages/backend/src/server/api/endpoints/charts/user/reactions.ts

@@ -4,6 +4,7 @@ import define from '../../../define.js';
 
 export const meta = {
 	tags: ['charts', 'users', 'reactions'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(perUserReactionsChart.schema),
 

packages/backend/src/server/api/endpoints/charts/users.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	tags: ['charts', 'users'],
+	requireCredentialPrivateMode: true,
 
 	res: getJsonSchema(usersChart.schema),
 

packages/backend/src/server/api/endpoints/clips/notes.ts

@@ -10,6 +10,7 @@ export const meta = {
 	tags: ['account', 'notes', 'clips'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	kind: 'read:account',
 

packages/backend/src/server/api/endpoints/clips/show.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['clips', 'account'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	kind: 'read:account',
 

packages/backend/src/server/api/endpoints/federation/followers.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/federation/following.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/federation/instances.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/federation/show-instance.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		oneOf: [{

packages/backend/src/server/api/endpoints/federation/users.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/gallery/featured.ts

@@ -5,6 +5,7 @@ export const meta = {
 	tags: ['gallery'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/gallery/popular.ts

@@ -5,6 +5,7 @@ export const meta = {
 	tags: ['gallery'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/gallery/posts.ts

@@ -4,6 +4,7 @@ import { makePaginationQuery } from '../../common/make-pagination-query.js';
 
 export const meta = {
 	tags: ['gallery'],
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/gallery/posts/show.ts

@@ -6,6 +6,7 @@ export const meta = {
 	tags: ['gallery'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	errors: {
 		noSuchPost: {

packages/backend/src/server/api/endpoints/get-online-users-count.ts

@@ -7,6 +7,7 @@ export const meta = {
 	tags: ['meta'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/hashtags/list.ts

@@ -5,6 +5,7 @@ export const meta = {
 	tags: ['hashtags'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/hashtags/search.ts

@@ -5,6 +5,7 @@ export const meta = {
 	tags: ['hashtags'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/hashtags/show.ts

@@ -7,6 +7,7 @@ export const meta = {
 	tags: ['hashtags'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/hashtags/trend.ts

@@ -24,6 +24,7 @@ export const meta = {
 	tags: ['hashtags'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/hashtags/users.ts

@@ -4,6 +4,7 @@ import define from '../../define.js';
 
 export const meta = {
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	tags: ['hashtags', 'users'],
 

packages/backend/src/server/api/endpoints/meta.ts

@@ -277,7 +277,7 @@ export const paramDef = {
 } as const;
 
 // eslint-disable-next-line import/no-default-export
-export default define(meta, paramDef, async (ps, me) => {
+export default define(meta, paramDef, async (ps, me): Promise<Record<string, any>> => {
 	const instance = await fetchMeta(true);
 
 	const emojis = await Emojis.find({
@@ -294,7 +294,7 @@ export default define(meta, paramDef, async (ps, me) => {
 		},
 	});
 
-	return {
+	const response: Record<string, any> = {
 		maintainerName: instance.maintainerName,
 		maintainerEmail: instance.maintainerEmail,
 
@@ -305,6 +305,10 @@ export default define(meta, paramDef, async (ps, me) => {
 		description: instance.description,
 		langs: instance.langs,
 		tosUrl: instance.ToSUrl,
+
+		secureMode: instance.secureMode,
+		privateMode: instance.privateMode,
+
 		disableRegistration: instance.disableRegistration,
 		disableLocalTimeline: instance.disableLocalTimeline,
 		disableGlobalTimeline: instance.disableGlobalTimeline,
@@ -322,7 +326,7 @@ export default define(meta, paramDef, async (ps, me) => {
 		backgroundImageUrl: instance.backgroundImageUrl,
 		logoImageUrl: instance.logoImageUrl,
 		maxNoteTextLength: MAX_NOTE_TEXT_LENGTH, // 後方互換性のため
-		emojis: await Emojis.packMany(emojis),
+		emojis: instance.privateMode && !me ? [] : await Emojis.packMany(emojis),
 		defaultLightTheme: instance.defaultLightTheme,
 		defaultDarkTheme: instance.defaultDarkTheme,
 		enableEmail: instance.enableEmail,
@@ -335,16 +339,20 @@ export default define(meta, paramDef, async (ps, me) => {
 
 		translatorAvailable: instance.deeplAuthKey != null,
 
-		pinnedPages: instance.pinnedPages,
+		pinnedPages: instance.privateMode && !me ? [] : instance.pinnedPages,
-		pinnedClipId: instance.pinnedClipId,
+		pinnedClipId: instance.privateMode && !me ? [] : instance.pinnedClipId,
 		cacheRemoteFiles: instance.cacheRemoteFiles,
 		requireSetup: (await Users.countBy({
 			host: IsNull(),
 		})) === 0,
+	};
 
-		proxyAccountName: instance.proxyAccountId ? (await Users.pack(instance.proxyAccountId).catch(() => null))?.username : null,
+	if (ps.detail) {
-
+		if (!instance.privateMode || me) {
-		features: {
+			const proxyAccount = instance.proxyAccountId ? await Users.pack(instance.proxyAccountId).catch(() => null) : null;
+			response.proxyAccountName = proxyAccount ? proxyAccount.username : null;
+		}
+		response.features = {
 			registration: !instance.disableRegistration,
 			localTimeLine: !instance.disableLocalTimeline,
 			globalTimeLine: !instance.disableGlobalTimeline,
@@ -358,6 +366,8 @@ export default define(meta, paramDef, async (ps, me) => {
 			discord: instance.enableDiscordIntegration,
 			serviceWorker: instance.enableServiceWorker,
 			miauth: true,
-		},
+		};
-	};
+	}
+
+	return response;
 });

packages/backend/src/server/api/endpoints/notes.ts

@@ -5,6 +5,7 @@ import { makePaginationQuery } from '../common/make-pagination-query.js';
 export const meta = {
 	tags: ['notes'],
 
+	requireCredentialPrivateMode: true,
 	res: {
 		type: 'array',
 		optional: false, nullable: false,

packages/backend/src/server/api/endpoints/notes/children.ts

@@ -9,6 +9,7 @@ export const meta = {
 	tags: ['notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Get a list of children of a notes. Children includes replies as well as quote renotes that quote the respective post. A post will not be duplicated if it is a reply and a quote of a note in this thread. For depths larger than 1 the threading has to be computed by the client.',
 
@@ -21,7 +22,7 @@ export const meta = {
 			ref: 'Note',
 		},
 	},
-} as const;
+};
 
 export const paramDef = {
 	type: 'object',

packages/backend/src/server/api/endpoints/notes/clips.ts

@@ -8,6 +8,7 @@ export const meta = {
 	tags: ['clips', 'notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/notes/conversation.ts

@@ -8,6 +8,7 @@ export const meta = {
 	tags: ['notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/notes/featured.ts

@@ -7,6 +7,7 @@ export const meta = {
 	tags: ['notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/notes/global-timeline.ts

@@ -13,6 +13,7 @@ import { generateMutedRenotesQuery } from '../../common/generated-muted-renote-q
 export const meta = {
 	tags: ['notes'],
 
+	requireCredentialPrivateMode: true,
 	res: {
 		type: 'array',
 		optional: false, nullable: false,

packages/backend/src/server/api/endpoints/notes/local-timeline.ts

@@ -15,6 +15,7 @@ import { generateMutedRenotesQuery } from '../../common/generated-muted-renote-q
 
 export const meta = {
 	tags: ['notes'],
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/notes/reactions.ts

@@ -9,6 +9,7 @@ export const meta = {
 	tags: ['notes', 'reactions'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	allowGet: true,
 	cacheSec: 60,

packages/backend/src/server/api/endpoints/notes/renotes.ts

@@ -11,6 +11,7 @@ export const meta = {
 	tags: ['notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/notes/replies.ts

@@ -9,6 +9,7 @@ export const meta = {
 	tags: ['notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/notes/search-by-tag.ts

@@ -10,6 +10,7 @@ import { generateBlockedUserQuery } from '../../common/generate-block-query.js';
 
 export const meta = {
 	tags: ['notes', 'hashtags'],
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/notes/search.ts

@@ -12,6 +12,7 @@ export const meta = {
 	tags: ['notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/notes/show.ts

@@ -7,6 +7,7 @@ export const meta = {
 	tags: ['notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/notes/translate.ts

@@ -12,6 +12,7 @@ export const meta = {
 	tags: ['notes'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/pages/featured.ts

@@ -5,6 +5,7 @@ export const meta = {
 	tags: ['pages'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/pages/show.ts

@@ -8,6 +8,7 @@ export const meta = {
 	tags: ['pages'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/pinned-users.ts

@@ -9,6 +9,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/server-info.ts

@@ -4,6 +4,7 @@ import define from '../define.js';
 
 export const meta = {
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	tags: ['meta'],
 } as const;

packages/backend/src/server/api/endpoints/stats.ts

@@ -4,6 +4,7 @@ import define from '../define.js';
 
 export const meta = {
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	tags: ['meta'],
 

packages/backend/src/server/api/endpoints/users.ts

@@ -7,6 +7,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/users/clips.ts

@@ -4,6 +4,7 @@ import { makePaginationQuery } from '../../common/make-pagination-query.js';
 
 export const meta = {
 	tags: ['users', 'clips'],
+	requireCredentialPrivateMode: true,
 
 	description: 'Show all clips this user owns.',
 

packages/backend/src/server/api/endpoints/users/followers.ts

@@ -9,6 +9,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Show everyone that follows this user.',
 

packages/backend/src/server/api/endpoints/users/following.ts

@@ -9,6 +9,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Show everyone that this user is following.',
 

packages/backend/src/server/api/endpoints/users/gallery/posts.ts

@@ -4,6 +4,7 @@ import { makePaginationQuery } from '../../../common/make-pagination-query.js';
 
 export const meta = {
 	tags: ['users', 'gallery'],
+	requireCredentialPrivateMode: true,
 
 	description: 'Show all gallery posts by the given user.',
 

packages/backend/src/server/api/endpoints/users/get-frequently-replied-users.ts

@@ -9,6 +9,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Get a list of other users that the specified user frequently replies to.',
 

packages/backend/src/server/api/endpoints/users/notes.ts

@@ -11,6 +11,7 @@ import { generateBlockedUserQuery } from '../../common/generate-block-query.js';
 export const meta = {
 	tags: ['users', 'notes'],
 
+	requireCredentialPrivateMode: true,
 	description: 'Show all notes that this user created.',
 
 	res: {

packages/backend/src/server/api/endpoints/users/pages.ts

@@ -4,6 +4,7 @@ import { makePaginationQuery } from '../../common/make-pagination-query.js';
 
 export const meta = {
 	tags: ['users', 'pages'],
+	requireCredentialPrivateMode: true,
 
 	description: 'Show all pages this user created.',
 

packages/backend/src/server/api/endpoints/users/reactions.ts

@@ -8,6 +8,7 @@ export const meta = {
 	tags: ['users', 'reactions'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Show all reactions this user made.',
 

packages/backend/src/server/api/endpoints/users/search-by-username-and-host.ts

@@ -7,6 +7,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Search for a user by username and/or host.',
 

packages/backend/src/server/api/endpoints/users/search.ts

@@ -7,6 +7,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Search for users.',
 

packages/backend/src/server/api/endpoints/users/show.ts

@@ -10,6 +10,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Show the properties of a user.',
 

packages/backend/src/server/api/endpoints/users/stats.ts

@@ -7,6 +7,7 @@ export const meta = {
 	tags: ['users'],
 
 	requireCredential: false,
+	requireCredentialPrivateMode: true,
 
 	description: 'Show statistics about a user.',