Merge remote-tracking branch 'misskey-original/develop' into develop

# Conflicts:
#	package.json
#	packages/backend/src/server/api/stream/ChannelsService.ts
#	packages/frontend/src/components/MkPostForm.vue
#	packages/frontend/src/pages/custom-emojis-manager.vue
#	packages/frontend/src/pages/settings/mute-block.vue

.github/workflows/lint.yml

@@ -78,4 +78,6 @@ jobs:
         cache: 'pnpm'
     - run: corepack enable
     - run: pnpm i --frozen-lockfile
+    - run: pnpm --filter misskey-js run build
+      if: ${{ matrix.workspace == 'backend' }}
     - run: pnpm --filter ${{ matrix.workspace }} run typecheck

CHANGELOG.md

@@ -14,19 +14,28 @@
 
 ## 2023.12.1
 
+### Note
+- アクセストークンの権限が再整理されたため、一部のAPIが古いAPIトークンでは動作しなくなりました。\
+  権限不足になる場合には権限を再設定して再生成してください。
+
 ### General
 - Enhance: ローカリゼーションの更新
 - Fix: 自分のdirect noteがuser list timelineに追加されない
 
 ### Client
-- Fix: 一部のモデログ(logYellowでの表示対象)について、表示の色が変わらない問題を修正
 - Feat: AiScript専用のMFM構文`$[clickable.ev=EVENTNAME ...]`を追加。`Mk:C:mfm`のオプション`onClickEv`に関数を渡すと、クリック時に`EVENTNAME`を引数にして呼び出す
+- Enhance: MFM入力補助ボタンを投稿フォームに表示できるように #12787
+- Fix: 一部のモデログ(logYellowでの表示対象)について、表示の色が変わらない問題を修正
+- Fix: `fg`/`bg`MFMに長い単語を指定すると、オーバーフローされずはみ出る問題を修正
 
 ### Server
 - Enhance: センシティブワードの設定がハッシュタグトレンドにも適用されるようになりました
+- Enhance: `oauth/token`エンドポイントのCORS対応
 - Fix: 1702718871541-ffVisibility.jsのdownが壊れている
 - Fix:「非センシティブのみ（リモートはいいねのみ）」を設定していても、センシティブに設定されたカスタム絵文字をリアクションできる問題を修正
 - Fix: ロールアサイン時の通知で，ロールアイコンが縮小されずに表示される問題を修正
+- Fix: サードパーティアプリケーションがWebsocket APIに無条件にアクセスできる問題を修正
+- Fix: サードパーティアプリケーションがユーザーの許可なしに非公開の情報を見ることができる問題を修正
 
 ## 2023.12.0
 
@@ -131,7 +140,6 @@
 - Fix: モデレーションログがモデレーターは閲覧できないように修正
 - Fix: ハッシュタグのトレンド除外設定が即時に効果を持つように修正
 - Fix: HTTP Digestヘッダのアルゴリズム部分に大文字の"SHA-256"しか使えない
-- Fix: 管理者用APIのアクセス権限が適切に設定されていない問題を修正
 
 ## 2023.11.1
 

locales/en-US.yml

@@ -121,6 +121,8 @@ sensitive: "Sensitive"
 add: "Add"
 reaction: "Reactions"
 reactions: "Reactions"
+emojiPicker: "Emoji picker"
+emojiPickerDisplay: "Emoji picker display"
 reactionSettingDescription2: "Drag to reorder, click to delete, press \"+\" to add."
 rememberNoteVisibility: "Remember note visibility settings"
 attachCancel: "Remove attachment"
@@ -262,6 +264,7 @@ removed: "Successfully deleted"
 removeAreYouSure: "Are you sure that you want to remove \"{x}\"?"
 deleteAreYouSure: "Are you sure that you want to delete \"{x}\"?"
 resetAreYouSure: "Really reset?"
+areYouSure: "Are you sure?"
 saved: "Saved"
 messaging: "Chat"
 upload: "Upload"
@@ -878,6 +881,8 @@ makeReactionsPublicDescription: "This will make the list of all your past reacti
 classic: "Classic"
 muteThread: "Mute thread"
 unmuteThread: "Unmute thread"
+followingVisibility: "Visibility of follows"
+followersVisibility: "Visibility of followers"
 continueThread: "View thread continuation"
 deleteAccountConfirm: "This will irreversibly delete your account. Proceed?"
 incorrectPassword: "Incorrect password."
@@ -1992,6 +1997,7 @@ _widgets:
   _userList:
     chooseList: "Select a list"
   clicker: "Clicker"
+  birthdayFollowings: "Users who celebrate their birthday today"
 _cw:
   hide: "Hide"
   show: "Show content"
@@ -2350,6 +2356,8 @@ _dataSaver:
   _avatar:
     title: "Avatar image"
     description: "Stop avatar image animation. Animated images can be larger in file size than normal  images, potentially leading to further reductions in data traffic."
+  _urlPreview:
+    title: "URL preview thumbnails"
   _code:
     title: "Code highlighting"
     description: "If code highlighting notations are used in MFM, etc., they will not load until tapped. Syntax highlighting requires downloading the highlight definition files for each programming language. Therefore, disabling the automatic loading of these files is expected to reduce the amount of communication data."

locales/es-ES.yml

@@ -1289,6 +1289,8 @@ _serverSettings:
   shortName: "Nombre corto"
   shortNameDescription: "Forma corta del nombre de la instancia que puede mostrarse si el nombre completo es demasiado largo."
   fanoutTimelineDescription: "Incrementa el rendimiento de forma significativa cuando se obtienen las líneas de tiempo y reduce la carga en la base de datos. A cambio, el uso de la memoria en Redis incrementará. Considera desactivar esta opción en caso de que tu servidor tenga poca memoria o detectes inestabilidad."
+  fanoutTimelineDbFallback: "Cargar desde la base de datos"
+  fanoutTimelineDbFallbackDescription: "Cuando esta opción está habilitada, la carga de peticiones adicionales de la línea de tiempo se hará desde la base de datos cuando éstas no se encuentren en la caché. Al deshabilitar esta opción se reduce la carga del servidor, pero limita el número de líneas de tiempo que pueden obtenerse."
 _accountMigration:
   moveFrom: "Trasladar de otra cuenta a ésta"
   moveFromSub: "Crear un alias para otra cuenta."
@@ -1833,6 +1835,14 @@ _sfx:
   notification: "Notificaciones"
   antenna: "Antena receptora"
   channel: "Notificaciones del canal"
+  reaction: "Al seleccionar una reacción"
+_soundSettings:
+  driveFile: "Usar un archivo de audio en Drive"
+  driveFileWarn: "Selecciona un archivo de audio en Drive."
+  driveFileTypeWarn: "Este archivo es incompatible"
+  driveFileTypeWarnDescription: "Selecciona un archivo de audio"
+  driveFileDurationWarn: "La duración del audio es demasiado larga."
+  driveFileDurationWarnDescription: "Usar un audio de larga duración puede llegar a molestar mientras usas Misskey. ¿Quieres continuar?"
 _ago:
   future: "Futuro"
   justNow: "Justo ahora"
@@ -2333,3 +2343,13 @@ _externalResourceInstaller:
 _dataSaver:
   _media:
     title: "Cargando Multimedia"
+    description: "Desactiva la carga automática de imágenes y vídeos. Tendrás que tocar en las imágenes y vídeos ocultos para cargarlos."
+  _avatar:
+    title: "Avatares animados"
+    description: "Desactiva la animación de los avatares. Las imágenes animadas pueden llegar a ser de mayor tamaño que las normales, por lo que al desactivarlas puedes reducir el consumo de datos."
+  _urlPreview:
+    title: "Vista previa de URLs"
+    description: "Desactiva la carga de vistas previas de las URLs."
+  _code:
+    title: "Resaltar código"
+    description: "Si se usa resaltado de código en MFM, etc., no se cargará hasta pulsar en ello. El resaltado de sintaxis requiere la descarga de archivos de definición para cada lenguaje de programación. Debido a esto, al deshabilitar la carga automática de estos archivos reducirás el consumo de datos."

locales/fr-FR.yml

@@ -162,6 +162,7 @@ addEmoji: "Ajouter un émoji"
 settingGuide: "Configuration proposée"
 cacheRemoteFiles: "Mise en cache des fichiers distants"
 cacheRemoteFilesDescription: "Lorsque cette option est désactivée, les fichiers distants sont chargés directement depuis l’instance distante. La désactiver diminuera certes l’utilisation de l’espace de stockage local mais augmentera le trafic réseau puisque les miniatures ne seront plus générées."
+youCanCleanRemoteFilesCache: "Vous pouvez supprimer tous les caches en cliquant le bouton 🗑️ dans la gestion des fichiers."
 cacheRemoteSensitiveFiles: "Mettre en cache les fichiers distants sensibles"
 cacheRemoteSensitiveFilesDescription: "Si vous désactivez ce paramètre, les fichiers sensibles distants ne seront pas mis en cache et un lien direct sera utilisé à la place"
 flagAsBot: "Ce compte est un robot"
@@ -726,6 +727,7 @@ lockedAccountInfo: "À moins que vous ne définissiez la visibilité de votre no
 alwaysMarkSensitive: "Marquer les médias comme contenu sensible par défaut"
 loadRawImages: "Affichage complet des images jointes au lieu des vignettes"
 disableShowingAnimatedImages: "Désactiver l'animation des images"
+highlightSensitiveMedia: "Mettre en évidence les médias sensibles"
 verificationEmailSent: "Un e-mail de vérification a été envoyé. Veuillez accéder au lien pour compléter la vérification."
 notSet: "Non défini"
 emailVerified: "Votre adresse e-mail a été vérifiée."
@@ -979,6 +981,7 @@ show: "Affichage"
 neverShow: "Ne plus afficher"
 remindMeLater: "Peut-être plus tard"
 didYouLikeMisskey: "Avez-vous aimé Misskey ?"
+pleaseDonate: "Misskey est le logiciel libre utilisé par {host}. Merci de faire un don pour que nous puissions continuer à le développer !"
 roles: "Rôles"
 role: "Rôles"
 noRole: "Aucun rôle"
@@ -991,8 +994,10 @@ manageCustomEmojis: "Gestion des émojis personnalisés"
 manageAvatarDecorations: "Gérer les décorations d'avatar"
 youCannotCreateAnymore: "Vous avez atteint la limite de création."
 cannotPerformTemporary: "Temporairement indisponible"
+cannotPerformTemporaryDescription: "Temporairement indisponible puisque le nombre d'opérations dépasse la limite. Veuillez patienter un peu, puis réessayer."
 invalidParamError: "Paramètres invalides"
 permissionDeniedError: "Opération refusée"
+permissionDeniedErrorDescription: "Ce compte n'a pas la permission d'effectuer cette opération."
 preset: "Préréglage"
 selectFromPresets: "Sélectionner à partir des préréglages"
 achievements: "Accomplissements"
@@ -1021,6 +1026,7 @@ likeOnlyForRemote: "Toutes (mentions j'aime seulement pour les instances distant
 nonSensitiveOnly: "Non sensibles seulement"
 nonSensitiveOnlyForLocalLikeOnlyForRemote: "Non sensibles seulement (mentions j'aime seulement pour les instances distantes)"
 rolesAssignedToMe: "Rôles attribués à moi"
+resetPasswordConfirm: "Souhaitez-vous réinitialiser votre mot de passe ?"
 sensitiveWords: "Mots sensibles"
 hiddenTags: "Hashtags cachés"
 hiddenTagsDescription: "Les hashtags définis ne s'afficheront pas dans les tendances. Vous pouvez définir plusieurs hashtags en faisant un saut de ligne."
@@ -1082,6 +1088,7 @@ installed: "Installé"
 branding: "Image de marque"
 expirationDate: "Date d’expiration"
 waitingForMailAuth: "En attente de la vérification de l'adresse courriel"
+inviteCodeCreator: "Créateur·rice de ce code d'invitation"
 usedAt: "Utilisé le"
 unused: "Non-utilisé"
 used: "Utilisé"
@@ -1765,6 +1772,7 @@ _visibility:
   followersDescription: "Publier à vos abonné·e·s uniquement"
   specified: "Direct"
   specifiedDescription: "Publier uniquement aux utilisateur·rice·s mentionné·e·s"
+  disableFederation: "Défédérer"
 _postForm:
   replyPlaceholder: "Répondre à cette note ..."
   quotePlaceholder: "Citez cette note ..."

locales/index.d.ts

@@ -1227,6 +1227,8 @@ export interface Locale {
     "overwriteContentConfirm": string;
     "seasonalScreenEffect": string;
     "decorate": string;
+    "addMfmFunction": string;
+    "enableQuickAddMfmFunction": string;
     "_announcement": {
         "forExistingUsers": string;
         "forExistingUsersDescription": string;
@@ -2126,6 +2128,55 @@ export interface Locale {
         "write:flash": string;
         "read:flash-likes": string;
         "write:flash-likes": string;
+        "read:admin:abuse-user-reports": string;
+        "write:admin:delete-account": string;
+        "write:admin:delete-all-files-of-a-user": string;
+        "read:admin:index-stats": string;
+        "read:admin:table-stats": string;
+        "read:admin:user-ips": string;
+        "read:admin:meta": string;
+        "write:admin:reset-password": string;
+        "write:admin:resolve-abuse-user-report": string;
+        "write:admin:send-email": string;
+        "read:admin:server-info": string;
+        "read:admin:show-moderation-log": string;
+        "read:admin:show-user": string;
+        "read:admin:show-users": string;
+        "write:admin:suspend-user": string;
+        "write:admin:unset-user-avatar": string;
+        "write:admin:unset-user-banner": string;
+        "write:admin:unsuspend-user": string;
+        "write:admin:meta": string;
+        "write:admin:user-note": string;
+        "write:admin:roles": string;
+        "read:admin:roles": string;
+        "write:admin:relays": string;
+        "read:admin:relays": string;
+        "write:admin:invite-codes": string;
+        "read:admin:invite-codes": string;
+        "write:admin:announcements": string;
+        "read:admin:announcements": string;
+        "write:admin:avatar-decorations": string;
+        "read:admin:avatar-decorations": string;
+        "write:admin:federation": string;
+        "write:admin:account": string;
+        "read:admin:account": string;
+        "write:admin:emoji": string;
+        "read:admin:emoji": string;
+        "write:admin:queue": string;
+        "read:admin:queue": string;
+        "write:admin:promo": string;
+        "write:admin:drive": string;
+        "read:admin:drive": string;
+        "read:admin:stream": string;
+        "write:admin:ad": string;
+        "read:admin:ad": string;
+        "write:invite-codes": string;
+        "read:invite-codes": string;
+        "write:clip-favorite": string;
+        "read:clip-favorite": string;
+        "read:federation": string;
+        "write:report-abuse": string;
     };
     "_auth": {
         "shareAccessTitle": string;

locales/ja-JP.yml

@@ -1224,6 +1224,8 @@ remainingN: "残り: {n}"
 overwriteContentConfirm: "現在の内容に上書きされますがよろしいですか？"
 seasonalScreenEffect: "季節に応じた画面の演出"
 decorate: "デコる"
+addMfmFunction: "装飾を追加"
+enableQuickAddMfmFunction: "高度なMFMのピッカーを表示する"
 
 _announcement:
   forExistingUsers: "既存ユーザーのみ"
@@ -2031,6 +2033,55 @@ _permissions:
   "write:flash": "Playを操作する"
   "read:flash-likes": "Playのいいねを見る"
   "write:flash-likes": "Playのいいねを操作する"
+  "read:admin:abuse-user-reports": "ユーザーからの通報を見る"
+  "write:admin:delete-account": "ユーザーアカウントを削除する"
+  "write:admin:delete-all-files-of-a-user": "ユーザーのすべてのファイルを削除する"
+  "read:admin:index-stats": "データベースインデックスに関する情報を見る"
+  "read:admin:table-stats": "データベーステーブルに関する情報を見る"
+  "read:admin:user-ips": "ユーザーのIPアドレスを見る"
+  "read:admin:meta": "インスタンスのメタデータを見る"
+  "write:admin:reset-password": "ユーザーのパスワードをリセットする"
+  "write:admin:resolve-abuse-user-report": "ユーザーからの通報を解決する"
+  "write:admin:send-email": "メールを送る"
+  "read:admin:server-info": "サーバーの情報を見る"
+  "read:admin:show-moderation-log": "モデレーションログを見る"
+  "read:admin:show-user": "ユーザーのプライベートな情報を見る"
+  "read:admin:show-users": "ユーザーのプライベートな情報を見る"
+  "write:admin:suspend-user": "ユーザーを凍結する"
+  "write:admin:unset-user-avatar": "ユーザーのアバターを削除する"
+  "write:admin:unset-user-banner": "ユーザーのバーナーを削除する"
+  "write:admin:unsuspend-user": "ユーザーの凍結を解除する"
+  "write:admin:meta": "インスタンスのメタデータを操作する"
+  "write:admin:user-note": "モデレーションノートを操作する"
+  "write:admin:roles": "ロールを操作する"
+  "read:admin:roles": "ロールを見る"
+  "write:admin:relays": "リレーを操作する"
+  "read:admin:relays": "リレーを見る"
+  "write:admin:invite-codes": "招待コードを操作する"
+  "read:admin:invite-codes": "招待コードを見る"
+  "write:admin:announcements": "お知らせを操作する"
+  "read:admin:announcements": "お知らせを見る"
+  "write:admin:avatar-decorations": "アバターデコレーションを操作する"
+  "read:admin:avatar-decorations": "アバターデコレーションを見る"
+  "write:admin:federation": "連合に関する情報を操作する"
+  "write:admin:account": "ユーザーアカウントを操作する"
+  "read:admin:account": "ユーザーに関する情報を見る"
+  "write:admin:emoji": "絵文字を操作する"
+  "read:admin:emoji": "絵文字を見る"
+  "write:admin:queue": "ジョブキューを操作する"
+  "read:admin:queue": "ジョブキューに関する情報を見る"
+  "write:admin:promo": "プロモーションノートを操作する"
+  "write:admin:drive": "ユーザーのドライブを操作する"
+  "read:admin:drive": "ユーザーのドライブの関する情報を見る"
+  "read:admin:stream": "管理者用のWebsocket APIを使う"
+  "write:admin:ad": "広告を操作する"
+  "read:admin:ad": "広告を見る"
+  "write:invite-codes": "招待コードを作成する"
+  "read:invite-codes": "招待コードを取得する"
+  "write:clip-favorite": "クリップのいいねを操作する"
+  "read:clip-favorite": "クリップのいいねを見る"
+  "read:federation": "連合に関する情報を取得する"
+  "write:report-abuse": "違反を報告する"
 
 _auth:
   shareAccessTitle: "アプリへのアクセス許可"

locales/ko-GS.yml

@@ -298,7 +298,7 @@ light: "볽엄"
 dark: "어덥엄"
 lightThemes: "볽언 테마"
 darkThemes: "어덥언 테마"
-syncDeviceDarkMode: "드라이브으 어덥엄 모드하고 같구로 마추기"
+syncDeviceDarkMode: "디바이스 쪽 어덥엄 모드하고 같구로 마추기"
 drive: "드라이브"
 fileName: "파일 이럼"
 selectFile: "파일 개리기"
@@ -425,20 +425,145 @@ moderationLogs: "중재 일지"
 nUsersMentioned: "{n}멩이 이바구하고 잇어예"
 securityKeyAndPasskey: "보안키·패스키"
 securityKey: "보안키"
+lastUsed: "마지막 쓰임"
+lastUsedAt: "마지막 쓰임: {t}"
 unregister: "맨걸기 무루기"
+passwordLessLogin: "비밀번호 없시 로그인"
+passwordLessLoginDescription: "비밀번호 말고 보안키나 패스키 같은 것만 써 가 로그인합니다."
+resetPassword: "비밀번호 재설정"
+newPasswordIs: "새 비밀번호는 \"{password}\" 입니다"
+reduceUiAnimation: "화면 움직임 효과들을 수ᇚ후기"
 share: "노누기"
 notFound: "몬 찾앗십니다"
+notFoundDescription: "고런 주소로 들어가는 하멘은 없십니다."
+uploadFolder: "기본 업로드 위치"
+markAsReadAllNotifications: "모든 알림 이럿다고 표시"
+markAsReadAllUnreadNotes: "모든 글 이럿다고 표시"
+markAsReadAllTalkMessages: "모든 대화 이럿다고 표시"
 help: "도움말"
+inputMessageHere: "여따가 메시지를 입력해주이소"
+close: "닫기"
 invites: "초대하기"
+members: "멤버"
+transfer: "양도"
+title: "제목"
+text: "글"
+enable: "키기"
+next: "다음"
 retype: "다시 서기"
 noteOf: "{user}님으 노트"
+quoteAttached: "따옴"
+quoteQuestion: "따와가 작성하겠십니까?"
+noMessagesYet: "아직 대화가 없십니다"
+newMessageExists: "새 메시지가 있십니다"
+onlyOneFileCanBeAttached: "메시지엔 파일 하나까제밖에 몬 넣십니다"
 invitations: "초대하기"
 checking: "학인하고 잇십니다"
 passwordMatched: "맞십니다"
 passwordNotMatched: "안 맞십니다"
+signinFailed: "로그인 몬 했십니다. 고 이름이랑 비밀번호 제대로 썼는가 확인해 주이소."
+or: "아니면"
 language: "언어"
+uiLanguage: "UI 표시 언어"
+aboutX: "{x}에 대해서"
+emojiStyle: "이모지 모양"
+native: "기본"
+disableDrawer: "드로어 메뉴 쓰지 않기"
+showNoteActionsOnlyHover: "마우스 올맀을 때만 노트 액션 버턴 보이기"
+noHistory: "기록이 없십니다"
+signinHistory: "로그인 기록"
+enableAdvancedMfm: "복잡한 MFM 키기"
+enableAnimatedMfm: "정신사나운 MFM 키기"
+doing: "잠만예"
+category: "카테고리"
+tags: "태그"
+docSource: "요 문서의 원본"
+createAccount: "게정 맨걸기"
+existingAccount: "원래 게정"
+regenerate: "엎고 다시 맨걸기"
+fontSize: "글자 크기"
+mediaListWithOneImageAppearance: "사진 하나짜리 미디어 목록의 높이"
+limitTo: "{x}로 제한"
+noFollowRequests: "지둘리는 팔로우 요청이 없십니다"
+openImageInNewTab: "새 탭서 사진 열기"
+dashboard: "대시보드"
+local: "로컬"
 remote: "웬겍"
+total: "합계"
+weekOverWeekChanges: "저번주보다"
+dayOverDayChanges: "어제보다"
+appearance: "모냥"
+clientSettings: "클라이언트 설정"
+accountSettings: "게정 설정"
+promotion: "선전"
+promote: "선전하기"
+numberOfDays: "며칠동안"
+hideThisNote: "요 노트를 수ᇚ후기"
+showFeaturedNotesInTimeline: "타임라인에다 추천 노트 보이기"
+objectStorage: "오브젝트 스토리지"
+useObjectStorage: "오브젝트 스토리지 키기"
+objectStorageBaseUrl: "Base URL"
+objectStorageBaseUrlDesc: "오브젝트 (미디어) 참조 링크 만들 때 쓰는 URL임다. CDN 내지 프락시를 쓴다 카멘은 그 URL을 갖다 늫고, 아이면 써먹을 서비스네 가이드를 봐봐가 공개적으로 접근할 수 있는 주소를 여 넣어 주이소. 그니께, 내가 AWS S3을 쓴다 카면은 'https://<bucket>.s3.amazonaws.com', GCS를 쓴다 카면 'https://storage.googleapis.com/<bucket>' 처럼 쓰믄 되입니더."
+objectStorageBucket: "Bucket"
+objectStorageBucketDesc: "써먹을 서비스의 바께쓰 이름을 여 써 주이소."
+objectStoragePrefix: "Prefix"
+objectStoragePrefixDesc: "요 Prefix 디렉토리 안에다가 파일이 들어감다."
+objectStorageEndpoint: "Endpoint"
+objectStorageEndpointDesc: "AWS S3을 쓸라멘 요는 비워두고, 아이멘은 그 서비스 가이드에 맞게 endpoint를 넣어 주이소. '<host>' 내지 '<host>:<port>'처럼 넣십니다."
+objectStorageRegion: "Region"
+objectStorageRegionDesc: "'xx-east-1' 같은 region 이름을 옇어 주이소. 써먹을 서비스에 region 개념 같은 게 읎다! 카면은 대신에 'us-east-1'을 옇어 놓으이소. AWS 설정 파일이나 환경 변수를 갖다 끌어다 쓸 거면은 요는 비워 두이소."
+objectStorageUseSSL: "SSL 쓰기"
+objectStorageUseSSLDesc: "API 호출할 때 HTTPS 안 쓸거면은 꺼 두이소"
+objectStorageUseProxy: "연결에 프락시 사용"
+objectStorageUseProxyDesc: "오브젝트 스토리지 API 호출에 프락시 안 쓸 거면 꺼 두이소"
+objectStorageSetPublicRead: "업로드할 때 'public-read' 설정하기"
+s3ForcePathStyleDesc: "s3ForcePathStyle을 키면, 바께쓰 이름을 URL의 호스트명 말고 경로의 일부로써 취급합니다. 셀프 호스트 Minio 같은 걸 굴릴라믄 켜놔야 될 수도 있십니다."
+serverLogs: "서버 로그"
+deleteAll: "말캉 뭉캐기"
+showFixedPostForm: "타임라인 우에 글 작성 칸 박기"
+showFixedPostFormInChannel: "채널 타임라인 우에 글 작성 칸 박기"
+withRepliesByDefaultForNewlyFollowed: "팔로우 할 때 기본적으로 답걸도 타임라인에 나오게 하기"
+newNoteRecived: "새 노트 있어예"
+sounds: "소리"
+sound: "소리"
+listen: "듣기"
+none: "없음"
+showInPage: "바닥서 보기"
+popout: "새 창 열기"
+volume: "음량"
+masterVolume: "대빵 음량"
+notUseSound: "음소거하기"
+useSoundOnlyWhenActive: "Misskey가 활성화되어 있을 때만 소리 내기"
+details: "좀 더"
+chooseEmoji: "이모지 선택"
+unableToProcess: "작업 다 몬 했십니다"
+recentUsed: "최근 쓴 놈"
+install: "설치"
+uninstall: "삭제"
+installedApps: "설치된 애플리케이션"
+nothing: "뭣도 없어예"
+installedDate: "설치한 날"
+lastUsedDate: "마지막 사용"
+state: "상태"
+sort: "정렬하기"
+ascendingOrder: "작은 순"
+descendingOrder: "큰 순"
+scratchpad: "스크래치 패드"
+scratchpadDescription: "스크래치 패드는 AiScript를 끼적거리는 창입니더. Misskey랑 갖다 이리저리 상호작용하는 코드를 서가 굴리멘은 그 결과도 바로 확인할 수 있십니다."
+output: "출력"
 script: "스크립트"
+disablePagesScript: "온갖 바닥서 AiScript를 쓰지 않음"
+updateRemoteUser: "원겍 사용자 근황 알아오기"
+unsetUserAvatar: "아바타 치우기"
+unsetUserAvatarConfirm: "아바타 갖다 치울까예?"
+unsetUserBanner: "배너 치우기"
+unsetUserBannerConfirm: "배너 갖다 치울까예?"
+deleteAllFiles: "파일 말캉 뭉캐기"
+deleteAllFilesConfirm: "파일을 싸그리 다 뭉캐삐릴까예?"
+removeAllFollowing: "팔로잉 말캉 무루기"
+removeAllFollowingDescription: "{host} 서버랑 걸어놓은 모든 팔로잉을 무룹니다. 고 서버가 아예 없어지삐맀든가, 그런 경우에 하이소."
+userSuspended: "요 게정은... 얼어 있십니다."
+userSilenced: "요 게정은... 수ᇚ혀 있십니다."
 manage: "간리"
 emailServer: "전자우펜 서버"
 email: "전자우펜"
@@ -581,4 +706,5 @@ _moderationLogTypes:
   suspend: "얼우기"
   deleteNote: "노트 뭉캐기"
   deleteUserAnnouncement: "사용자 공지 걸 뭉캐기"
+  resetPassword: "비밀번호 재설정"
   resolveAbuseReport: "신고 해겔하기"

locales/ru-RU.yml

@@ -120,6 +120,12 @@ sensitive: "Содержимое не для всех"
 add: "Добавить"
 reaction: "Реакции"
 reactions: "Реакции"
+emojiPicker: "Палитра эмодзи"
+pinnedEmojisForReactionSettingDescription: "Здесь можно закрепить эмодзи для реакций"
+pinnedEmojisSettingDescription: "Здесь можно закрепить эмодзи в общей палитре"
+emojiPickerDisplay: "Внешний вид палитры"
+overwriteFromPinnedEmojisForReaction: "Заменить на эмодзи из списка реакций"
+overwriteFromPinnedEmojis: "Заменить на эмодзи из общего списка закреплённых"
 reactionSettingDescription2: "Расставляйте перетаскиванием, удаляйте нажатием, добавляйте кнопкой «+»."
 rememberNoteVisibility: "Запоминать видимость заметок"
 attachCancel: "Удалить вложение"
@@ -1053,6 +1059,8 @@ options: "Настройки ролей"
 specifyUser: "Указанный пользователь"
 failedToPreviewUrl: "Предварительный просмотр недоступен"
 update: "Обновить"
+rolesThatCanBeUsedThisEmojiAsReaction: "Роли тех, кому можно использовать эти эмодзи как реакцию"
+rolesThatCanBeUsedThisEmojiAsReactionEmptyDescription: "Если здесь ничего не указать, в качестве реакции эту эмодзи сможет использовать каждый."
 later: "Позже"
 goToMisskey: "К Misskey"
 additionalEmojiDictionary: "Дополнительные словари эмодзи"

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "misskey",
-	"version": "2023.12.0-PrisMisskey.1",
+	"version": "2023.12.1-PrisMisskey.1",
 	"codename": "nasubi",
 	"repository": {
 		"type": "git",

packages/backend/package.json

@@ -68,7 +68,7 @@
 		"@discordapp/twemoji": "15.0.2",
 		"@fastify/accepts": "4.3.0",
 		"@fastify/cookie": "9.2.0",
-		"@fastify/cors": "8.4.2",
+		"@fastify/cors": "8.5.0",
 		"@fastify/express": "2.3.0",
 		"@fastify/http-proxy": "9.3.0",
 		"@fastify/multipart": "8.0.0",

packages/backend/src/misc/api-permissions.ts

@@ -1,40 +0,0 @@
-/*
- * SPDX-FileCopyrightText: syuilo and other misskey contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- */
-
-export const kinds = [
-	'read:account',
-	'write:account',
-	'read:blocks',
-	'write:blocks',
-	'read:drive',
-	'write:drive',
-	'read:favorites',
-	'write:favorites',
-	'read:following',
-	'write:following',
-	'read:messaging',
-	'write:messaging',
-	'read:mutes',
-	'write:mutes',
-	'write:notes',
-	'read:notifications',
-	'write:notifications',
-	'read:reactions',
-	'write:reactions',
-	'write:votes',
-	'read:pages',
-	'write:pages',
-	'write:page-likes',
-	'read:page-likes',
-	'read:user-groups',
-	'write:user-groups',
-	'read:channels',
-	'write:channels',
-	'read:gallery',
-	'write:gallery',
-	'read:gallery-likes',
-	'write:gallery-likes',
-];
-// IF YOU ADD KINDS(PERMISSIONS), YOU MUST ADD TRANSLATIONS (under _permissions).

packages/backend/src/server/ServerService.ts

@@ -107,7 +107,8 @@ export class ServerService implements OnApplicationShutdown {
 		fastify.register(this.activityPubServerService.createServer);
 		fastify.register(this.nodeinfoServerService.createServer);
 		fastify.register(this.wellKnownServerService.createServer);
-		fastify.register(this.oauth2ProviderService.createServer);
+		fastify.register(this.oauth2ProviderService.createServer, { prefix: '/oauth' });
+		fastify.register(this.oauth2ProviderService.createTokenServer, { prefix: '/oauth/token' });
 
 		fastify.get<{ Params: { path: string }; Querystring: { static?: any; badge?: any; }; }>('/emoji/:path(.*)', async (request, reply) => {
 			const path = request.params.path;

packages/backend/src/server/WellKnownServerService.ts

@@ -16,6 +16,7 @@ import * as Acct from '@/misc/acct.js';
 import { UserEntityService } from '@/core/entities/UserEntityService.js';
 import { bindThis } from '@/decorators.js';
 import { NodeinfoServerService } from './NodeinfoServerService.js';
+import { OAuth2ProviderService } from './oauth/OAuth2ProviderService.js';
 import type { FindOptionsWhere } from 'typeorm';
 import type { FastifyInstance, FastifyPluginOptions } from 'fastify';
 
@@ -30,6 +31,7 @@ export class WellKnownServerService {
 
 		private nodeinfoServerService: NodeinfoServerService,
 		private userEntityService: UserEntityService,
+		private oauth2ProviderService: OAuth2ProviderService,
 	) {
 		//this.createServer = this.createServer.bind(this);
 	}
@@ -87,6 +89,10 @@ export class WellKnownServerService {
 			return { links: this.nodeinfoServerService.getLinks() };
 		});
 
+		fastify.get('/.well-known/oauth-authorization-server', async () => {
+			return this.oauth2ProviderService.generateRFC8414();
+		});
+
 		/* TODO
 fastify.get('/.well-known/change-password', async (request, reply) => {
 });

packages/backend/src/server/api/ApiCallService.ts

@@ -330,7 +330,8 @@ export class ApiCallService implements OnApplicationShutdown {
 			}
 		}
 
-		if (token && ep.meta.kind && !token.permission.some(p => p === ep.meta.kind)) {
+		if (token && ((ep.meta.kind && !token.permission.some(p => p === ep.meta.kind))
+			|| (!ep.meta.kind && (ep.meta.requireCredential || ep.meta.requireModerator || ep.meta.requireAdmin)))) {
 			throw new ApiError({
 				message: 'Your app does not have the necessary permissions to use this endpoint.',
 				code: 'PERMISSION_DENIED',

packages/backend/src/server/api/StreamingApiServerService.ts

@@ -71,6 +71,10 @@ export class StreamingApiServerService {
 
 			try {
 				[user, app] = await this.authenticateService.authenticate(token);
+
+				if (app !== null && !app.permission.some(p => p === 'read:account')) {
+					throw new AuthenticationError('Your app does not have necessary permissions to use websocket API.');
+				}
 			} catch (e) {
 				if (e instanceof AuthenticationError) {
 					socket.write([

packages/backend/src/server/api/endpoints.ts

@@ -4,6 +4,7 @@
  */
 
 import type { Schema } from '@/misc/json-schema.js';
+import { permissions } from 'misskey-js';
 import { RolePolicies } from '@/core/RoleService.js';
 import * as ep___admin_emoji_setlocalOnlyBulk from './endpoints/admin/emoji/set-localonly-bulk.js';
 import * as ep___admin_emoji_setisSensitiveBulk from './endpoints/admin/emoji/set-issensitive-bulk.js';
@@ -743,7 +744,7 @@ const eps = [
 	['retention', ep___retention],
 ];
 
-export interface IEndpointMeta {
+interface IEndpointMetaBase {
 	readonly stability?: 'deprecated' | 'experimental' | 'stable';
 
 	readonly tags?: ReadonlyArray<string>;
@@ -842,6 +843,23 @@ export interface IEndpointMeta {
 	readonly cacheSec?: number;
 }
 
+export type IEndpointMeta = (Omit<IEndpointMetaBase, 'requireCrential' | 'requireModerator' | 'requireAdmin'> & {
+	requireCredential?: false,
+	requireAdmin?: false,
+	requireModerator?: false,
+}) | (Omit<IEndpointMetaBase, 'secure'> & {
+	secure: true,
+}) | (Omit<IEndpointMetaBase, 'requireCredential' | 'kind'> & {
+	requireCredential: true,
+	kind: (typeof permissions)[number],
+}) | (Omit<IEndpointMetaBase, 'requireModerator' | 'kind'> & {
+	requireModerator: true,
+	kind: (typeof permissions)[number],
+}) | (Omit<IEndpointMetaBase, 'requireAdmin' | 'kind'> & {
+	requireAdmin: true,
+	kind: (typeof permissions)[number],
+})
+
 export interface IEndpoint {
 	name: string;
 	meta: IEndpointMeta;

packages/backend/src/server/api/endpoints/admin/abuse-user-reports.ts

@@ -13,10 +13,9 @@ import { AbuseUserReportEntityService } from '@/core/entities/AbuseUserReportEnt
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:abuse-user-reports',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/accounts/create.ts

@@ -15,8 +15,6 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	res: {
 		type: 'object',
 		optional: false, nullable: false,
@@ -48,12 +46,12 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 		private userEntityService: UserEntityService,
 		private signupService: SignupService,
 	) {
-		super(meta, paramDef, async (ps, _me) => {
+		super(meta, paramDef, async (ps, _me, token) => {
 			const me = _me ? await this.usersRepository.findOneByOrFail({ id: _me.id }) : null;
 			const noUsers = (await this.usersRepository.countBy({
 				host: IsNull(),
 			})) === 0;
-			if (!noUsers && !me?.isRoot) throw new Error('access denied');
+			if ((!noUsers && !me?.isRoot) || token !== null) throw new Error('access denied');
 
 			const { account, secret } = await this.signupService.signup({
 				username: ps.username,

packages/backend/src/server/api/endpoints/admin/accounts/delete.ts

@@ -14,10 +14,9 @@ import { UserEntityService } from '@/core/entities/UserEntityService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:account',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/accounts/find-by-email.ts

@@ -13,10 +13,9 @@ import { ApiError } from '@/server/api/error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'read:admin:account',
 
 	errors: {
 		userNotFound: {

packages/backend/src/server/api/endpoints/admin/ad/create.ts

@@ -13,10 +13,9 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:ad',
 	res: {
 		type: 'object',
 		optional: false,

packages/backend/src/server/api/endpoints/admin/ad/delete.ts

@@ -13,10 +13,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:ad',
 
 	errors: {
 		noSuchAd: {

packages/backend/src/server/api/endpoints/admin/ad/list.ts

@@ -12,10 +12,9 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:ad',
 	res: {
 		type: 'array',
 		optional: false,

packages/backend/src/server/api/endpoints/admin/ad/update.ts

@@ -13,10 +13,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:ad',
 
 	errors: {
 		noSuchAd: {

packages/backend/src/server/api/endpoints/admin/announcements/create.ts

@@ -10,10 +10,9 @@ import { AnnouncementService } from '@/core/AnnouncementService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:announcements',
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/admin/announcements/delete.ts

@@ -13,10 +13,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:announcements',
 
 	errors: {
 		noSuchAnnouncement: {

packages/backend/src/server/api/endpoints/admin/announcements/list.ts

@@ -14,10 +14,9 @@ import { IdService } from '@/core/IdService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:announcements',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/announcements/update.ts

@@ -13,10 +13,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:announcements',
 
 	errors: {
 		noSuchAnnouncement: {

packages/backend/src/server/api/endpoints/admin/avatar-decorations/create.ts

@@ -10,10 +10,9 @@ import { AvatarDecorationService } from '@/core/AvatarDecorationService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageAvatarDecorations',
+	kind: 'write:admin:avatar-decorations',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/avatar-decorations/delete.ts

@@ -12,10 +12,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageAvatarDecorations',
+	kind: 'write:admin:avatar-decorations',
 	errors: {
 	},
 } as const;

packages/backend/src/server/api/endpoints/admin/avatar-decorations/list.ts

@@ -15,10 +15,9 @@ import { AvatarDecorationService } from '@/core/AvatarDecorationService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageAvatarDecorations',
+	kind: 'read:admin:avatar-decorations',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/avatar-decorations/update.ts

@@ -12,10 +12,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageAvatarDecorations',
+	kind: 'write:admin:avatar-decorations',
 
 	errors: {
 	},

packages/backend/src/server/api/endpoints/admin/delete-account.ts

@@ -12,10 +12,9 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:delete-account',
 
 	res: {
 	},

packages/backend/src/server/api/endpoints/admin/delete-all-files-of-a-user.ts

@@ -12,10 +12,9 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:delete-all-files-of-a-user',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/drive/clean-remote-files.ts

@@ -10,10 +10,9 @@ import { QueueService } from '@/core/QueueService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:drive',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/drive/cleanup.ts

@@ -13,10 +13,9 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:drive',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/drive/files.ts

@@ -13,10 +13,9 @@ import { DriveFileEntityService } from '@/core/entities/DriveFileEntityService.j
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:drive',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/drive/show-file.ts

@@ -14,10 +14,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:drive',
 
 	errors: {
 		noSuchFile: {

packages/backend/src/server/api/endpoints/admin/emoji/add-aliases-bulk.ts

@@ -10,10 +10,9 @@ import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/emoji/add.ts

@@ -14,10 +14,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 
 	errors: {
 		noSuchFile: {

packages/backend/src/server/api/endpoints/admin/emoji/copy.ts

@@ -16,10 +16,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 
 	errors: {
 		noSuchEmoji: {

packages/backend/src/server/api/endpoints/admin/emoji/delete-bulk.ts

@@ -10,10 +10,9 @@ import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/emoji/delete.ts

@@ -10,10 +10,9 @@ import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 
 	errors: {
 		noSuchEmoji: {

packages/backend/src/server/api/endpoints/admin/emoji/import-zip.ts

@@ -8,7 +8,7 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import { QueueService } from '@/core/QueueService.js';
 
 export const meta = {
-	kind: 'write:admin',
+	secure: true,
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
 } as const;

packages/backend/src/server/api/endpoints/admin/emoji/list-remote.ts

@@ -15,10 +15,9 @@ import { sqlLikeEscape } from '@/misc/sql-like-escape.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'read:admin:emoji',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/emoji/list.ts

@@ -15,10 +15,9 @@ import { EmojiEntityService } from '@/core/entities/EmojiEntityService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'read:admin:emoji',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/emoji/remove-aliases-bulk.ts

@@ -10,10 +10,9 @@ import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/emoji/set-aliases-bulk.ts

@@ -10,10 +10,9 @@ import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/emoji/set-category-bulk.ts

@@ -10,10 +10,9 @@ import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/emoji/set-license-bulk.ts

@@ -10,10 +10,9 @@ import { CustomEmojiService } from '@/core/CustomEmojiService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/emoji/update.ts

@@ -14,10 +14,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireRolePolicy: 'canManageCustomEmojis',
+	kind: 'write:admin:emoji',
 
 	errors: {
 		noSuchEmoji: {

packages/backend/src/server/api/endpoints/admin/federation/delete-all-files.ts

@@ -12,10 +12,9 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:federation',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/federation/refresh-remote-instance-metadata.ts

@@ -13,10 +13,9 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:federation',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/federation/remove-all-following.ts

@@ -12,10 +12,9 @@ import { QueueService } from '@/core/QueueService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:federation',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/federation/update-instance.ts

@@ -14,10 +14,9 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:federation',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/get-index-stats.ts

@@ -11,8 +11,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	requireCredential: true,
 	requireAdmin: true,
-
+	kind: 'read:admin:index-stats',
-	kind: 'read:admin',
 
 	tags: ['admin'],
 	res: {

packages/backend/src/server/api/endpoints/admin/get-table-stats.ts

@@ -11,8 +11,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	requireCredential: true,
 	requireAdmin: true,
-
+	kind: 'read:admin:table-stats',
-	kind: 'read:admin',
 
 	tags: ['admin'],
 

packages/backend/src/server/api/endpoints/admin/get-user-ips.ts

@@ -12,10 +12,9 @@ import { IdService } from '@/core/IdService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:user-ips',
 	res: {
 		type: 'array',
 		optional: false,
@@ -34,7 +33,7 @@ export const meta = {
 				},
 			},
 		},
-	}
+	},
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/invite/create.ts

@@ -16,10 +16,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:invite-codes',
 
 	errors: {
 		invalidDateTime: {

packages/backend/src/server/api/endpoints/admin/invite/list.ts

@@ -12,10 +12,9 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:invite-codes',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/meta.ts

@@ -13,10 +13,9 @@ import { DEFAULT_POLICIES } from '@/core/RoleService.js';
 export const meta = {
 	tags: ['meta'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'read:admin:meta',
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/admin/promo/create.ts

@@ -13,10 +13,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:promo',
 
 	errors: {
 		noSuchNote: {

packages/backend/src/server/api/endpoints/admin/queue/clear.ts

@@ -11,10 +11,9 @@ import { QueueService } from '@/core/QueueService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:queue',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/queue/deliver-delayed.ts

@@ -11,10 +11,9 @@ import type { DeliverQueue } from '@/core/QueueModule.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:queue',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/queue/inbox-delayed.ts

@@ -11,10 +11,9 @@ import type { InboxQueue } from '@/core/QueueModule.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:queue',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/queue/promote.ts

@@ -11,10 +11,9 @@ import { QueueService } from '@/core/QueueService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:queue',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/queue/stats.ts

@@ -10,10 +10,9 @@ import type { DbQueue, DeliverQueue, EndedPollNotificationQueue, InboxQueue, Obj
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:emoji',
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/admin/relays/add.ts

@@ -12,10 +12,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:relays',
 
 	errors: {
 		invalidUrl: {

packages/backend/src/server/api/endpoints/admin/relays/list.ts

@@ -10,10 +10,9 @@ import { RelayService } from '@/core/RelayService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:relays',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/relays/remove.ts

@@ -10,10 +10,9 @@ import { RelayService } from '@/core/RelayService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:relays',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/reset-password.ts

@@ -14,10 +14,9 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:reset-password',
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/admin/resolve-abuse-user-report.ts

@@ -15,10 +15,9 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:resolve-abuse-user-report',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/roles/assign.ts

@@ -13,10 +13,9 @@ import { RoleService } from '@/core/RoleService.js';
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:roles',
 
 	errors: {
 		noSuchRole: {

packages/backend/src/server/api/endpoints/admin/roles/create.ts

@@ -11,10 +11,9 @@ import { RoleService } from '@/core/RoleService.js';
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:roles',
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/admin/roles/delete.ts

@@ -13,10 +13,9 @@ import { RoleService } from '@/core/RoleService.js';
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:roles',
 
 	errors: {
 		noSuchRole: {

packages/backend/src/server/api/endpoints/admin/roles/list.ts

@@ -12,10 +12,9 @@ import { RoleEntityService } from '@/core/entities/RoleEntityService.js';
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:roles',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/roles/show.ts

@@ -13,10 +13,9 @@ import { RoleEntityService } from '@/core/entities/RoleEntityService.js';
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'read:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:roles',
 
 	errors: {
 		noSuchRole: {

packages/backend/src/server/api/endpoints/admin/roles/unassign.ts

@@ -13,10 +13,9 @@ import { RoleService } from '@/core/RoleService.js';
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:roles',
 
 	errors: {
 		noSuchRole: {

packages/backend/src/server/api/endpoints/admin/roles/update-default-policies.ts

@@ -11,10 +11,9 @@ import { MetaService } from '@/core/MetaService.js';
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:roles',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/roles/update.ts

@@ -14,10 +14,9 @@ import { RoleService } from '@/core/RoleService.js';
 export const meta = {
 	tags: ['admin', 'role'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:roles',
 
 	errors: {
 		noSuchRole: {

packages/backend/src/server/api/endpoints/admin/roles/users.ts

@@ -16,10 +16,9 @@ import { ApiError } from '../../../error.js';
 export const meta = {
 	tags: ['admin', 'role', 'users'],
 
-	kind: 'read:admin',
-
 	requireCredential: false,
 	requireAdmin: true,
+	kind: 'read:admin:roles',
 
 	errors: {
 		noSuchRole: {

packages/backend/src/server/api/endpoints/admin/send-email.ts

@@ -10,10 +10,9 @@ import { EmailService } from '@/core/EmailService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:send-email',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/server-info.ts

@@ -14,11 +14,10 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'read:admin:server-info',
 
 	tags: ['admin', 'meta'],
 
-	kind: 'read:admin',
-
 	res: {
 		type: 'object',
 		optional: false, nullable: false,

packages/backend/src/server/api/endpoints/admin/show-moderation-logs.ts

@@ -15,8 +15,7 @@ export const meta = {
 
 	requireCredential: true,
 	requireAdmin: true,
-
+	kind: 'read:admin:show-moderation-log',
-	kind: 'read:admin',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/show-user.ts

@@ -16,8 +16,7 @@ export const meta = {
 
 	requireCredential: true,
 	requireModerator: true,
-
+	kind: 'read:admin:show-user',
-	kind: 'read:admin',
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/admin/show-users.ts

@@ -16,8 +16,7 @@ export const meta = {
 
 	requireCredential: true,
 	requireModerator: true,
-
+	kind: 'read:admin:show-users',
-	kind: 'read:admin',
 
 	res: {
 		type: 'array',

packages/backend/src/server/api/endpoints/admin/suspend-user.ts

@@ -19,10 +19,9 @@ import { QueueService } from '@/core/QueueService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:suspend-user',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/unset-user-avatar.ts

@@ -12,10 +12,9 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:unset-user-avatar',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/unset-user-banner.ts

@@ -12,10 +12,9 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:unset-user-banner',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/unsuspend-user.ts

@@ -13,10 +13,9 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:unsuspend-user',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/update-meta.ts

@@ -12,10 +12,9 @@ import { MetaService } from '@/core/MetaService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireAdmin: true,
+	kind: 'write:admin:meta',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/admin/update-user-note.ts

@@ -12,10 +12,9 @@ import { ModerationLogService } from '@/core/ModerationLogService.js';
 export const meta = {
 	tags: ['admin'],
 
-	kind: 'write:admin',
-
 	requireCredential: true,
 	requireModerator: true,
+	kind: 'write:admin:user-note',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/ap/get.ts

@@ -12,6 +12,7 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: true,
+	kind: 'read:federation',
 
 	limit: {
 		duration: ms('1hour'),

packages/backend/src/server/api/endpoints/ap/show.ts

@@ -25,6 +25,7 @@ export const meta = {
 	tags: ['federation'],
 
 	requireCredential: true,
+	kind: 'read:account',
 
 	limit: {
 		duration: ms('1hour'),

packages/backend/src/server/api/endpoints/federation/update-remote-user.ts

@@ -11,7 +11,7 @@ import { GetterService } from '@/server/api/GetterService.js';
 export const meta = {
 	tags: ['federation'],
 
-	requireCredential: true,
+	requireCredential: false,
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/fetch-external-resources.ts

@@ -14,6 +14,7 @@ export const meta = {
 	tags: ['meta'],
 
 	requireCredential: true,
+	secure: true,
 
 	limit: {
 		duration: ms('1hour'),

packages/backend/src/server/api/endpoints/i.ts

@@ -14,6 +14,7 @@ export const meta = {
 	tags: ['account'],
 
 	requireCredential: true,
+	kind: "read:account",
 
 	res: {
 		type: 'object',

packages/backend/src/server/api/endpoints/i/claim-achievement.ts

@@ -10,6 +10,7 @@ import { AchievementService, ACHIEVEMENT_TYPES } from '@/core/AchievementService
 export const meta = {
 	requireCredential: true,
 	prohibitMoved: true,
+	kind: 'write:account',
 } as const;
 
 export const paramDef = {

packages/backend/src/server/api/endpoints/i/registry/get-all.ts

@@ -9,6 +9,7 @@ import { RegistryApiService } from '@/core/RegistryApiService.js';
 
 export const meta = {
 	requireCredential: true,
+	kind: 'read:account',
 
 	res: {
 		type: 'object',