Merge branch 'dialyzer-fixes' into 'develop'

More dialyzer fixes

See merge request pleroma/pleroma!4050

lib/pleroma/upload.ex

@@ -51,6 +51,7 @@ defmodule Pleroma.Upload do
           | {:size_limit, nil | non_neg_integer()}
           | {:uploader, module()}
           | {:filters, [module()]}
+          | {:actor, String.t()}
 
   @type t :: %__MODULE__{
           id: String.t(),

lib/pleroma/web/admin_api/controllers/config_controller.ex

@@ -9,7 +9,7 @@ defmodule Pleroma.Web.AdminAPI.ConfigController do
   alias Pleroma.ConfigDB
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action == :update)
 
   plug(
@@ -76,7 +76,7 @@ def descriptions(conn, _params) do
     json(conn, translate_descriptions(descriptions))
   end
 
-  def show(conn, %{only_db: true}) do
+  def show(%{private: %{open_api_spex: %{params: %{only_db: true}}}} = conn, _) do
     with :ok <- configurable_from_database() do
       configs = Pleroma.Repo.all(ConfigDB)
 
@@ -128,7 +128,7 @@ def show(conn, _params) do
     end
   end
 
-  def update(%{body_params: %{configs: configs}} = conn, _) do
+  def update(%{private: %{open_api_spex: %{body_params: %{configs: configs}}}} = conn, _) do
     with :ok <- configurable_from_database() do
       results =
         configs

lib/pleroma/web/admin_api/controllers/instance_document_controller.ex

@@ -9,7 +9,7 @@ defmodule Pleroma.Web.AdminAPI.InstanceDocumentController do
   alias Pleroma.Web.Plugs.InstanceStatic
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   action_fallback(Pleroma.Web.AdminAPI.FallbackController)
 
@@ -18,7 +18,7 @@ defmodule Pleroma.Web.AdminAPI.InstanceDocumentController do
   plug(OAuthScopesPlug, %{scopes: ["admin:read"]} when action == :show)
   plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action in [:update, :delete])
 
-  def show(conn, %{name: document_name}) do
+  def show(%{private: %{open_api_spex: %{params: %{name: document_name}}}} = conn, _) do
     with {:ok, url} <- InstanceDocument.get(document_name),
          {:ok, content} <- File.read(InstanceStatic.file_path(url)) do
       conn
@@ -27,13 +27,18 @@ def show(conn, %{name: document_name}) do
     end
   end
 
-  def update(%{body_params: %{file: file}} = conn, %{name: document_name}) do
+  def update(
+        %{
+          private: %{open_api_spex: %{body_params: %{file: file}, params: %{name: document_name}}}
+        } = conn,
+        _
+      ) do
     with {:ok, url} <- InstanceDocument.put(document_name, file.path) do
       json(conn, %{"url" => url})
     end
   end
 
-  def delete(conn, %{name: document_name}) do
+  def delete(%{private: %{open_api_spex: %{params: %{name: document_name}}}} = conn, _) do
     with :ok <- InstanceDocument.delete(document_name) do
       json(conn, %{})
     end

lib/pleroma/web/admin_api/controllers/invite_controller.ex

@@ -13,7 +13,7 @@ defmodule Pleroma.Web.AdminAPI.InviteController do
 
   require Logger
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["admin:read:invites"]} when action == :index)
 
   plug(
@@ -33,14 +33,14 @@ def index(conn, _params) do
   end
 
   @doc "Create an account registration invite token"
-  def create(%{body_params: params} = conn, _) do
+  def create(%{private: %{open_api_spex: %{body_params: params}}} = conn, _) do
     {:ok, invite} = UserInviteToken.create_invite(params)
 
     render(conn, "show.json", invite: invite)
   end
 
   @doc "Revokes invite by token"
-  def revoke(%{body_params: %{token: token}} = conn, _) do
+  def revoke(%{private: %{open_api_spex: %{body_params: %{token: token}}}} = conn, _) do
     with {:ok, invite} <- UserInviteToken.find_by_token(token),
          {:ok, updated_invite} = UserInviteToken.update_invite(invite, %{used: true}) do
       render(conn, "show.json", invite: updated_invite)
@@ -51,7 +51,13 @@ def revoke(%{body_params: %{token: token}} = conn, _) do
   end
 
   @doc "Sends registration invite via email"
-  def email(%{assigns: %{user: user}, body_params: %{email: email} = params} = conn, _) do
+  def email(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{email: email} = params}}
+        } = conn,
+        _
+      ) do
     with {_, false} <- {:registrations_open, Config.get([:instance, :registrations_open])},
          {_, true} <- {:invites_enabled, Config.get([:instance, :invites_enabled])},
          {:ok, invite_token} <- UserInviteToken.create_invite(),

lib/pleroma/web/admin_api/controllers/media_proxy_cache_controller.ex

@@ -11,7 +11,7 @@ defmodule Pleroma.Web.AdminAPI.MediaProxyCacheController do
 
   @cachex Pleroma.Config.get([:cachex, :provider], Cachex)
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -27,7 +27,7 @@ defmodule Pleroma.Web.AdminAPI.MediaProxyCacheController do
 
   defdelegate open_api_operation(action), to: Spec.MediaProxyCacheOperation
 
-  def index(%{assigns: %{user: _}} = conn, params) do
+  def index(%{assigns: %{user: _}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     entries = fetch_entries(params)
     urls = paginate_entries(entries, params.page, params.page_size)
 
@@ -59,12 +59,19 @@ defp paginate_entries(entries, page, page_size) do
     Enum.slice(entries, offset, page_size)
   end
 
-  def delete(%{assigns: %{user: _}, body_params: %{urls: urls}} = conn, _) do
+  def delete(
+        %{assigns: %{user: _}, private: %{open_api_spex: %{body_params: %{urls: urls}}}} = conn,
+        _
+      ) do
     MediaProxy.remove_from_banned_urls(urls)
     json(conn, %{})
   end
 
-  def purge(%{assigns: %{user: _}, body_params: %{urls: urls, ban: ban}} = conn, _) do
+  def purge(
+        %{assigns: %{user: _}, private: %{open_api_spex: %{body_params: %{urls: urls, ban: ban}}}} =
+          conn,
+        _
+      ) do
     MediaProxy.Invalidation.purge(urls)
 
     if ban do

lib/pleroma/web/admin_api/controllers/relay_controller.ex

@@ -11,7 +11,7 @@ defmodule Pleroma.Web.AdminAPI.RelayController do
 
   require Logger
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -31,7 +31,13 @@ def index(conn, _params) do
     end
   end
 
-  def follow(%{assigns: %{user: admin}, body_params: %{relay_url: target}} = conn, _) do
+  def follow(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{relay_url: target}}}
+        } = conn,
+        _
+      ) do
     with {:ok, _message} <- Relay.follow(target) do
       ModerationLog.insert_log(%{action: "relay_follow", actor: admin, target: target})
 
@@ -44,7 +50,13 @@ def follow(%{assigns: %{user: admin}, body_params: %{relay_url: target}} = conn,
     end
   end
 
-  def unfollow(%{assigns: %{user: admin}, body_params: %{relay_url: target} = params} = conn, _) do
+  def unfollow(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{relay_url: target} = params}}
+        } = conn,
+        _
+      ) do
     with {:ok, _message} <- Relay.unfollow(target, %{force: params[:force]}) do
       ModerationLog.insert_log(%{action: "relay_unfollow", actor: admin, target: target})
 

lib/pleroma/web/admin_api/controllers/report_controller.ex

@@ -18,7 +18,7 @@ defmodule Pleroma.Web.AdminAPI.ReportController do
 
   require Logger
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["admin:read:reports"]} when action in [:index, :show])
 
   plug(
@@ -31,13 +31,13 @@ defmodule Pleroma.Web.AdminAPI.ReportController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.ReportOperation
 
-  def index(conn, params) do
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     reports = Utils.get_reports(params, params.page, params.page_size)
 
     render(conn, "index.json", reports: reports)
   end
 
-  def show(conn, %{id: id}) do
+  def show(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %Activity{} = report <- Activity.get_report(id) do
       render(conn, "show.json", Report.extract_report_info(report))
     else
@@ -45,7 +45,13 @@ def show(conn, %{id: id}) do
     end
   end
 
-  def update(%{assigns: %{user: admin}, body_params: %{reports: reports}} = conn, _) do
+  def update(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{reports: reports}}}
+        } = conn,
+        _
+      ) do
     result =
       Enum.map(reports, fn report ->
         case CommonAPI.update_report_state(report.id, report.state) do
@@ -73,9 +79,13 @@ def update(%{assigns: %{user: admin}, body_params: %{reports: reports}} = conn,
     end
   end
 
-  def notes_create(%{assigns: %{user: user}, body_params: %{content: content}} = conn, %{
+  def notes_create(
-        id: report_id
+        %{
-      }) do
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{content: content}, params: %{id: report_id}}}
+        } = conn,
+        _
+      ) do
     with {:ok, _} <- ReportNote.create(user.id, report_id, content),
          report <- Activity.get_by_id_with_user_actor(report_id) do
       ModerationLog.insert_log(%{
@@ -92,10 +102,20 @@ def notes_create(%{assigns: %{user: user}, body_params: %{content: content}} = c
     end
   end
 
-  def notes_delete(%{assigns: %{user: user}} = conn, %{
+  def notes_delete(
+        %{
+          assigns: %{user: user},
+          private: %{
+            open_api_spex: %{
+              params: %{
                 id: note_id,
                 report_id: report_id
-      }) do
+              }
+            }
+          }
+        } = conn,
+        _
+      ) do
     with {:ok, note} <- ReportNote.destroy(note_id),
          report <- Activity.get_by_id_with_user_actor(report_id) do
       ModerationLog.insert_log(%{

lib/pleroma/web/admin_api/controllers/user_controller.ex

@@ -18,7 +18,7 @@ defmodule Pleroma.Web.AdminAPI.UserController do
 
   @users_page_size 50
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -51,13 +51,22 @@ defmodule Pleroma.Web.AdminAPI.UserController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.UserOperation
 
-  def delete(conn, %{nickname: nickname}) do
+  def delete(%{private: %{open_api_spex: %{params: %{nickname: nickname}}}} = conn, _) do
     conn
-    |> Map.put(:body_params, %{nicknames: [nickname]})
+    |> do_deletes([nickname])
-    |> delete(%{})
   end
 
-  def delete(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def delete(
+        %{
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
+    conn
+    |> do_deletes(nicknames)
+  end
+
+  defp do_deletes(%{assigns: %{user: admin}} = conn, nicknames) when is_list(nicknames) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
 
     Enum.each(users, fn user ->
@@ -77,10 +86,14 @@ def delete(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = co
   def follow(
         %{
           assigns: %{user: admin},
+          private: %{
+            open_api_spex: %{
               body_params: %{
                 follower: follower_nick,
                 followed: followed_nick
               }
+            }
+          }
         } = conn,
         _
       ) do
@@ -102,10 +115,14 @@ def follow(
   def unfollow(
         %{
           assigns: %{user: admin},
+          private: %{
+            open_api_spex: %{
               body_params: %{
                 follower: follower_nick,
                 followed: followed_nick
               }
+            }
+          }
         } = conn,
         _
       ) do
@@ -124,7 +141,13 @@ def unfollow(
     json(conn, "ok")
   end
 
-  def create(%{assigns: %{user: admin}, body_params: %{users: users}} = conn, _) do
+  def create(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{users: users}}}
+        } = conn,
+        _
+      ) do
     changesets =
       users
       |> Enum.map(fn %{nickname: nickname, email: email, password: password} ->
@@ -178,7 +201,13 @@ def create(%{assigns: %{user: admin}, body_params: %{users: users}} = conn, _) d
     end
   end
 
-  def show(%{assigns: %{user: admin}} = conn, %{nickname: nickname}) do
+  def show(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{params: %{nickname: nickname}}}
+        } = conn,
+        _
+      ) do
     with %User{} = user <- User.get_cached_by_nickname_or_id(nickname, for: admin) do
       render(conn, "show.json", %{user: user})
     else
@@ -186,7 +215,11 @@ def show(%{assigns: %{user: admin}} = conn, %{nickname: nickname}) do
     end
   end
 
-  def toggle_activation(%{assigns: %{user: admin}} = conn, %{nickname: nickname}) do
+  def toggle_activation(
+        %{assigns: %{user: admin}, private: %{open_api_spex: %{params: %{nickname: nickname}}}} =
+          conn,
+        _
+      ) do
     user = User.get_cached_by_nickname(nickname)
 
     {:ok, updated_user} = User.set_activation(user, !user.is_active)
@@ -202,7 +235,13 @@ def toggle_activation(%{assigns: %{user: admin}} = conn, %{nickname: nickname})
     render(conn, "show.json", user: updated_user)
   end
 
-  def activate(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def activate(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.set_activation(users, true)
 
@@ -215,7 +254,13 @@ def activate(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} =
     render(conn, "index.json", users: updated_users)
   end
 
-  def deactivate(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def deactivate(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.set_activation(users, false)
 
@@ -228,7 +273,13 @@ def deactivate(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}}
     render(conn, "index.json", users: updated_users)
   end
 
-  def approve(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def approve(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.approve(users)
 
@@ -241,7 +292,13 @@ def approve(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = c
     render(conn, "index.json", users: updated_users)
   end
 
-  def suggest(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def suggest(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.set_suggestion(users, true)
 
@@ -254,7 +311,13 @@ def suggest(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = c
     render(conn, "index.json", users: updated_users)
   end
 
-  def unsuggest(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} = conn, _) do
+  def unsuggest(
+        %{
+          assigns: %{user: admin},
+          private: %{open_api_spex: %{body_params: %{nicknames: nicknames}}}
+        } = conn,
+        _
+      ) do
     users = Enum.map(nicknames, &User.get_cached_by_nickname/1)
     {:ok, updated_users} = User.set_suggestion(users, false)
 
@@ -267,7 +330,7 @@ def unsuggest(%{assigns: %{user: admin}, body_params: %{nicknames: nicknames}} =
     render(conn, "index.json", users: updated_users)
   end
 
-  def index(conn, params) do
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     {page, page_size} = page_params(params)
     filters = maybe_parse_filters(params[:filters])
 

lib/pleroma/web/controller_helper.ex

@@ -53,10 +53,15 @@ def add_link_headers(conn, entries, extra_params) do
     end
   end
 
+  # TODO: Only fetch the params from open_api_spex when everything is converted
   @id_keys Pagination.page_keys() -- ["limit", "order"]
   defp build_pagination_fields(conn, min_id, max_id, extra_params) do
     params =
+      if Map.has_key?(conn.private, :open_api_spex) do
+        get_in(conn, [Access.key(:private), Access.key(:open_api_spex), Access.key(:params)])
+      else
         conn.params
+      end
       |> Map.drop(Map.keys(conn.path_params) |> Enum.map(&String.to_existing_atom/1))
       |> Map.merge(extra_params)
       |> Map.drop(@id_keys)
@@ -85,8 +90,8 @@ def get_pagination_fields(conn, entries, extra_params \\ %{}) do
     end
   end
 
-  def assign_account_by_id(conn, _) do
+  def assign_account_by_id(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
-    case Pleroma.User.get_cached_by_id(conn.params.id) do
+    case Pleroma.User.get_cached_by_id(id) do
       %Pleroma.User{} = account -> assign(conn, :account, account)
       nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) |> halt()
     end

lib/pleroma/web/mastodon_api/controllers/account_controller.ex

@@ -30,7 +30,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   alias Pleroma.Web.TwitterAPI.TwitterAPI
   alias Pleroma.Web.Utils.Params
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(:skip_auth when action in [:create, :lookup])
 
@@ -92,7 +92,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
 
   plug(
     RateLimiter,
-    [name: :relation_id_action, params: [:id, :uri]] when action in @relationship_actions
+    [name: :relation_id_action, params: ["id", "uri"]] when action in @relationship_actions
   )
 
   plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
@@ -104,7 +104,10 @@ defmodule Pleroma.Web.MastodonAPI.AccountController do
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AccountOperation
 
   @doc "POST /api/v1/accounts"
-  def create(%{assigns: %{app: app}, body_params: params} = conn, _params) do
+  def create(
+        %{assigns: %{app: app}, private: %{open_api_spex: %{body_params: params}}} = conn,
+        _params
+      ) do
     with :ok <- validate_email_param(params),
          :ok <- TwitterAPI.validate_captcha(app, params),
          {:ok, user} <- TwitterAPI.register_user(params),
@@ -168,7 +171,10 @@ def verify_credentials(%{assigns: %{user: user}} = conn, _) do
   end
 
   @doc "PATCH /api/v1/accounts/update_credentials"
-  def update_credentials(%{assigns: %{user: user}, body_params: params} = conn, _params) do
+  def update_credentials(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn,
+        _params
+      ) do
     params =
       params
       |> Enum.filter(fn {_, value} -> not is_nil(value) end)
@@ -289,7 +295,10 @@ defp normalize_fields_attributes(fields) do
   end
 
   @doc "GET /api/v1/accounts/relationships"
-  def relationships(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def relationships(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     targets = User.get_all_by_ids(List.wrap(id))
 
     render(conn, "relationships.json", user: user, targets: targets)
@@ -299,7 +308,13 @@ def relationships(%{assigns: %{user: user}} = conn, %{id: id}) do
   def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])
 
   @doc "GET /api/v1/accounts/:id"
-  def show(%{assigns: %{user: for_user}} = conn, %{id: nickname_or_id} = params) do
+  def show(
+        %{
+          assigns: %{user: for_user},
+          private: %{open_api_spex: %{params: %{id: nickname_or_id} = params}}
+        } = conn,
+        _params
+      ) do
     with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
          :visible <- User.visible_for(user, for_user) do
       render(conn, "show.json",
@@ -313,7 +328,10 @@ def show(%{assigns: %{user: for_user}} = conn, %{id: nickname_or_id} = params) d
   end
 
   @doc "GET /api/v1/accounts/:id/statuses"
-  def statuses(%{assigns: %{user: reading_user}} = conn, params) do
+  def statuses(
+        %{assigns: %{user: reading_user}, private: %{open_api_spex: %{params: params}}} = conn,
+        _params
+      ) do
     with %User{} = user <- User.get_cached_by_nickname_or_id(params.id, for: reading_user),
          :visible <- User.visible_for(user, reading_user) do
       params =
@@ -348,7 +366,11 @@ defp user_visibility_error(conn, error) do
   end
 
   @doc "GET /api/v1/accounts/:id/followers"
-  def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
+  def followers(
+        %{assigns: %{user: for_user, account: user}, private: %{open_api_spex: %{params: params}}} =
+          conn,
+        _params
+      ) do
     params =
       params
       |> Enum.map(fn {key, value} -> {to_string(key), value} end)
@@ -373,7 +395,11 @@ def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
   end
 
   @doc "GET /api/v1/accounts/:id/following"
-  def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
+  def following(
+        %{assigns: %{user: for_user, account: user}, private: %{open_api_spex: %{params: params}}} =
+          conn,
+        _params
+      ) do
     params =
       params
       |> Enum.map(fn {key, value} -> {to_string(key), value} end)
@@ -411,7 +437,13 @@ def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
     {:error, "Can not follow yourself"}
   end
 
-  def follow(%{body_params: params, assigns: %{user: follower, account: followed}} = conn, _) do
+  def follow(
+        %{
+          assigns: %{user: follower, account: followed},
+          private: %{open_api_spex: %{body_params: params}}
+        } = conn,
+        _
+      ) do
     with {:ok, follower} <- MastodonAPI.follow(follower, followed, params) do
       render(conn, "relationship.json", user: follower, target: followed)
     else
@@ -431,7 +463,13 @@ def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) d
   end
 
   @doc "POST /api/v1/accounts/:id/mute"
-  def mute(%{assigns: %{user: muter, account: muted}, body_params: params} = conn, _params) do
+  def mute(
+        %{
+          assigns: %{user: muter, account: muted},
+          private: %{open_api_spex: %{body_params: params}}
+        } = conn,
+        _params
+      ) do
     params =
       params
       |> Map.put_new(:duration, Map.get(params, :expires_in, 0))
@@ -472,7 +510,10 @@ def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
 
   @doc "POST /api/v1/accounts/:id/note"
   def note(
-        %{assigns: %{user: noter, account: target}, body_params: %{comment: comment}} = conn,
+        %{
+          assigns: %{user: noter, account: target},
+          private: %{open_api_spex: %{body_params: %{comment: comment}}}
+        } = conn,
         _params
       ) do
     with {:ok, _user_note} <- UserNote.create(noter, target, comment) do
@@ -513,7 +554,7 @@ def remove_from_followers(%{assigns: %{user: followed, account: follower}} = con
   end
 
   @doc "POST /api/v1/follows"
-  def follow_by_uri(%{body_params: %{uri: uri}} = conn, _) do
+  def follow_by_uri(%{private: %{open_api_spex: %{body_params: %{uri: uri}}}} = conn, _) do
     case User.get_cached_by_nickname(uri) do
       %User{} = user ->
         conn
@@ -561,7 +602,7 @@ def blocks(%{assigns: %{user: user}} = conn, params) do
   end
 
   @doc "GET /api/v1/accounts/lookup"
-  def lookup(conn, %{acct: nickname} = _params) do
+  def lookup(%{private: %{open_api_spex: %{params: %{acct: nickname}}}} = conn, _params) do
     with %User{} = user <- User.get_by_nickname(nickname) do
       render(conn, "show.json",
         user: user,

lib/pleroma/web/mastodon_api/controllers/follow_request_controller.ex

@@ -9,7 +9,7 @@ defmodule Pleroma.Web.MastodonAPI.FollowRequestController do
   alias Pleroma.Web.CommonAPI
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(:assign_follower when action != :index)
 
   action_fallback(:errors)
@@ -44,7 +44,7 @@ def reject(%{assigns: %{user: followed, follower: follower}} = conn, _params) do
     end
   end
 
-  defp assign_follower(%{params: %{id: id}} = conn, _) do
+  defp assign_follower(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     case User.get_cached_by_id(id) do
       %User{} = follower -> assign(conn, :follower, follower)
       nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) |> halt()

lib/pleroma/web/mastodon_api/controllers/list_controller.ex

@@ -11,7 +11,7 @@ defmodule Pleroma.Web.MastodonAPI.ListController do
 
   @oauth_read_actions [:index, :show, :list_accounts]
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(:list_by_id_and_user when action not in [:index, :create])
   plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action in @oauth_read_actions)
   plug(OAuthScopesPlug, %{scopes: ["write:lists"]} when action not in @oauth_read_actions)
@@ -21,25 +21,33 @@ defmodule Pleroma.Web.MastodonAPI.ListController do
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ListOperation
 
   # GET /api/v1/lists
-  def index(%{assigns: %{user: user}} = conn, opts) do
+  def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
-    lists = Pleroma.List.for_user(user, opts)
+    lists = Pleroma.List.for_user(user, params)
     render(conn, "index.json", lists: lists)
   end
 
   # POST /api/v1/lists
-  def create(%{assigns: %{user: user}, body_params: %{title: title}} = conn, _) do
+  def create(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{title: title}}}} =
+          conn,
+        _
+      ) do
     with {:ok, %Pleroma.List{} = list} <- Pleroma.List.create(title, user) do
       render(conn, "show.json", list: list)
     end
   end
 
-  # GET /api/v1/lists/:id
+  # GET /api/v1/lists/:idOB
   def show(%{assigns: %{list: list}} = conn, _) do
     render(conn, "show.json", list: list)
   end
 
   # PUT /api/v1/lists/:id
-  def update(%{assigns: %{list: list}, body_params: %{title: title}} = conn, _) do
+  def update(
+        %{assigns: %{list: list}, private: %{open_api_spex: %{body_params: %{title: title}}}} =
+          conn,
+        _
+      ) do
     with {:ok, list} <- Pleroma.List.rename(list, title) do
       render(conn, "show.json", list: list)
     end
@@ -62,7 +70,13 @@ def list_accounts(%{assigns: %{user: user, list: list}} = conn, _) do
   end
 
   # POST /api/v1/lists/:id/accounts
-  def add_to_list(%{assigns: %{list: list}, body_params: %{account_ids: account_ids}} = conn, _) do
+  def add_to_list(
+        %{
+          assigns: %{list: list},
+          private: %{open_api_spex: %{body_params: %{account_ids: account_ids}}}
+        } = conn,
+        _
+      ) do
     Enum.each(account_ids, fn account_id ->
       with %User{} = followed <- User.get_cached_by_id(account_id) do
         Pleroma.List.follow(list, followed)
@@ -74,9 +88,22 @@ def add_to_list(%{assigns: %{list: list}, body_params: %{account_ids: account_id
 
   # DELETE /api/v1/lists/:id/accounts
   def remove_from_list(
-        %{assigns: %{list: list}, params: %{account_ids: account_ids}} = conn,
+        %{
+          private: %{open_api_spex: %{params: %{account_ids: account_ids}}}
+        } = conn,
         _
       ) do
+    do_remove_from_list(conn, account_ids)
+  end
+
+  def remove_from_list(
+        %{private: %{open_api_spex: %{body_params: %{account_ids: account_ids}}}} = conn,
+        _
+      ) do
+    do_remove_from_list(conn, account_ids)
+  end
+
+  defp do_remove_from_list(%{assigns: %{list: list}} = conn, account_ids) do
     Enum.each(account_ids, fn account_id ->
       with %User{} = followed <- User.get_cached_by_id(account_id) do
         Pleroma.List.unfollow(list, followed)
@@ -86,11 +113,10 @@ def remove_from_list(
     json(conn, %{})
   end
 
-  def remove_from_list(%{body_params: params} = conn, _) do
+  defp list_by_id_and_user(
-    remove_from_list(%{conn | params: params}, %{})
+         %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
-  end
+         _
-
+       ) do
-  defp list_by_id_and_user(%{assigns: %{user: user}, params: %{id: id}} = conn, _) do
     case Pleroma.List.get(id, user) do
       %Pleroma.List{} = list -> assign(conn, :list, list)
       nil -> conn |> render_error(:not_found, "List not found") |> halt()

lib/pleroma/web/mastodon_api/controllers/media_controller.ex

@@ -12,7 +12,7 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
 
   action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
   plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:create, :create2])
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(OAuthScopesPlug, %{scopes: ["read:media"]} when action == :show)
   plug(OAuthScopesPlug, %{scopes: ["write:media"]} when action != :show)
@@ -20,7 +20,11 @@ defmodule Pleroma.Web.MastodonAPI.MediaController do
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.MediaOperation
 
   @doc "POST /api/v1/media"
-  def create(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
+  def create(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file} = data}}} =
+          conn,
+        _
+      ) do
     with {:ok, object} <-
            ActivityPub.upload(
              file,
@@ -36,7 +40,11 @@ def create(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn,
   def create(_conn, _data), do: {:error, :bad_request}
 
   @doc "POST /api/v2/media"
-  def create2(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn, _) do
+  def create2(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file} = data}}} =
+          conn,
+        _
+      ) do
     with {:ok, object} <-
            ActivityPub.upload(
              file,
@@ -54,7 +62,15 @@ def create2(%{assigns: %{user: user}, body_params: %{file: file} = data} = conn,
   def create2(_conn, _data), do: {:error, :bad_request}
 
   @doc "PUT /api/v1/media/:id"
-  def update(%{assigns: %{user: user}, body_params: %{description: description}} = conn, %{id: id}) do
+  def update(
+        %{
+          assigns: %{user: user},
+          private: %{
+            open_api_spex: %{body_params: %{description: description}, params: %{id: id}}
+          }
+        } = conn,
+        _
+      ) do
     with %Object{} = object <- Object.get_by_id(id),
          :ok <- Object.authorize_access(object, user),
          {:ok, %Object{data: data}} <- Object.update_data(object, %{"name" => description}) do
@@ -67,7 +83,7 @@ def update(%{assigns: %{user: user}, body_params: %{description: description}} =
   def update(conn, data), do: show(conn, data)
 
   @doc "GET /api/v1/media/:id"
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %Object{data: data, id: object_id} = object <- Object.get_by_id(id),
          :ok <- Object.authorize_access(object, user) do
       attachment_data = Map.put(data, "id", object_id)

lib/pleroma/web/mastodon_api/controllers/notification_controller.ex

@@ -13,7 +13,7 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
 
   @oauth_read_actions [:show, :index]
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -24,24 +24,6 @@ defmodule Pleroma.Web.MastodonAPI.NotificationController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.NotificationOperation
 
-  # GET /api/v1/notifications
-  def index(conn, %{account_id: account_id} = params) do
-    case Pleroma.User.get_cached_by_id(account_id) do
-      %{ap_id: account_ap_id} ->
-        params =
-          params
-          |> Map.delete(:account_id)
-          |> Map.put(:account_ap_id, account_ap_id)
-
-        index(conn, params)
-
-      _ ->
-        conn
-        |> put_status(:not_found)
-        |> json(%{"error" => "Account is not found"})
-    end
-  end
-
   @default_notification_types ~w{
       mention
       follow
@@ -53,7 +35,30 @@ def index(conn, %{account_id: account_id} = params) do
       poll
       update
     }
-  def index(%{assigns: %{user: user}} = conn, params) do
+
+  # GET /api/v1/notifications
+  def index(%{private: %{open_api_spex: %{params: %{account_id: account_id} = params}}} = conn, _) do
+    case Pleroma.User.get_cached_by_id(account_id) do
+      %{ap_id: account_ap_id} ->
+        params =
+          params
+          |> Map.delete(:account_id)
+          |> Map.put(:account_ap_id, account_ap_id)
+
+        do_get_notifications(conn, params)
+
+      _ ->
+        conn
+        |> put_status(:not_found)
+        |> json(%{"error" => "Account is not found"})
+    end
+  end
+
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
+    do_get_notifications(conn, params)
+  end
+
+  defp do_get_notifications(%{assigns: %{user: user}} = conn, params) do
     params =
       Map.new(params, fn {k, v} -> {to_string(k), v} end)
       |> Map.put_new("types", Map.get(params, :include_types, @default_notification_types))
@@ -69,7 +74,7 @@ def index(%{assigns: %{user: user}} = conn, params) do
   end
 
   # GET /api/v1/notifications/:id
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with {:ok, notification} <- Notification.get(user, id) do
       render(conn, "show.json", notification: notification, for: user)
     else
@@ -88,8 +93,20 @@ def clear(%{assigns: %{user: user}} = conn, _params) do
 
   # POST /api/v1/notifications/:id/dismiss
 
-  def dismiss(%{assigns: %{user: user}} = conn, %{id: id} = _params) do
+  def dismiss(%{private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
-    with {:ok, _notif} <- Notification.dismiss(user, id) do
+    do_dismiss(conn, id)
+  end
+
+  # POST /api/v1/notifications/dismiss (deprecated)
+  def dismiss_via_body(
+        %{private: %{open_api_spex: %{body_params: %{id: id}}}} = conn,
+        _
+      ) do
+    do_dismiss(conn, id)
+  end
+
+  defp do_dismiss(%{assigns: %{user: user}} = conn, notification_id) do
+    with {:ok, _notif} <- Notification.dismiss(user, notification_id) do
       json(conn, %{})
     else
       {:error, reason} ->
@@ -99,13 +116,11 @@ def dismiss(%{assigns: %{user: user}} = conn, %{id: id} = _params) do
     end
   end
 
-  # POST /api/v1/notifications/dismiss (deprecated)
-  def dismiss_via_body(%{body_params: params} = conn, _) do
-    dismiss(conn, params)
-  end
-
   # DELETE /api/v1/notifications/destroy_multiple
-  def destroy_multiple(%{assigns: %{user: user}} = conn, %{ids: ids} = _params) do
+  def destroy_multiple(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{ids: ids}}}} = conn,
+        _
+      ) do
     Notification.destroy_multiple(user, ids)
     json(conn, %{})
   end

lib/pleroma/web/mastodon_api/controllers/poll_controller.ex

@@ -15,7 +15,7 @@ defmodule Pleroma.Web.MastodonAPI.PollController do
 
   action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     OAuthScopesPlug,
@@ -29,7 +29,7 @@ defmodule Pleroma.Web.MastodonAPI.PollController do
   @cachex Pleroma.Config.get([:cachex, :provider], Cachex)
 
   @doc "GET /api/v1/polls/:id"
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %Object{} = object <- Object.get_by_id_and_maybe_refetch(id, interval: 60),
          %Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
          true <- Visibility.visible_for_user?(activity, user) do
@@ -41,7 +41,13 @@ def show(%{assigns: %{user: user}} = conn, %{id: id}) do
   end
 
   @doc "POST /api/v1/polls/:id/votes"
-  def vote(%{assigns: %{user: user}, body_params: %{choices: choices}} = conn, %{id: id}) do
+  def vote(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{choices: choices}, params: %{id: id}}}
+        } = conn,
+        _
+      ) do
     with %Object{data: %{"type" => "Question"}} = object <- Object.get_by_id(id),
          %Activity{} = activity <- Activity.get_create_by_object_ap_id(object.data["id"]),
          true <- Visibility.visible_for_user?(activity, user),

lib/pleroma/web/mastodon_api/controllers/scheduled_activity_controller.ex

@@ -13,7 +13,7 @@ defmodule Pleroma.Web.MastodonAPI.ScheduledActivityController do
 
   @oauth_read_actions [:show, :index]
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["read:statuses"]} when action in @oauth_read_actions)
   plug(OAuthScopesPlug, %{scopes: ["write:statuses"]} when action not in @oauth_read_actions)
   plug(:assign_scheduled_activity when action != :index)
@@ -23,7 +23,7 @@ defmodule Pleroma.Web.MastodonAPI.ScheduledActivityController do
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ScheduledActivityOperation
 
   @doc "GET /api/v1/scheduled_statuses"
-  def index(%{assigns: %{user: user}} = conn, params) do
+  def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     params = Map.new(params, fn {key, value} -> {to_string(key), value} end)
 
     with scheduled_activities <- MastodonAPI.get_scheduled_activities(user, params) do
@@ -39,7 +39,13 @@ def show(%{assigns: %{scheduled_activity: scheduled_activity}} = conn, _params)
   end
 
   @doc "PUT /api/v1/scheduled_statuses/:id"
-  def update(%{assigns: %{scheduled_activity: scheduled_activity}, body_params: params} = conn, _) do
+  def update(
+        %{
+          assigns: %{scheduled_activity: scheduled_activity},
+          private: %{open_api_spex: %{body_params: params}}
+        } = conn,
+        _
+      ) do
     with {:ok, scheduled_activity} <- ScheduledActivity.update(scheduled_activity, params) do
       render(conn, "show.json", scheduled_activity: scheduled_activity)
     end
@@ -52,7 +58,10 @@ def delete(%{assigns: %{scheduled_activity: scheduled_activity}} = conn, _params
     end
   end
 
-  defp assign_scheduled_activity(%{assigns: %{user: user}, params: %{id: id}} = conn, _) do
+  defp assign_scheduled_activity(
+         %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+         _
+       ) do
     case ScheduledActivity.get(user, id) do
       %ScheduledActivity{} = activity -> assign(conn, :scheduled_activity, activity)
       nil -> Pleroma.Web.MastodonAPI.FallbackController.call(conn, {:error, :not_found}) |> halt()

lib/pleroma/web/mastodon_api/controllers/search_controller.ex

@@ -18,7 +18,7 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
 
   @search_limit 40
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   # Note: Mastodon doesn't allow unauthenticated access (requires read:accounts / read:search)
   plug(OAuthScopesPlug, %{scopes: ["read:search"], fallback: :proceed_unauthenticated})
@@ -29,7 +29,11 @@ defmodule Pleroma.Web.MastodonAPI.SearchController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.SearchOperation
 
-  def account_search(%{assigns: %{user: user}} = conn, %{q: query} = params) do
+  def account_search(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{q: query} = params}}} =
+          conn,
+        _
+      ) do
     accounts = User.search(query, search_options(params, user))
 
     conn
@@ -44,7 +48,12 @@ def account_search(%{assigns: %{user: user}} = conn, %{q: query} = params) do
   def search2(conn, params), do: do_search(:v2, conn, params)
   def search(conn, params), do: do_search(:v1, conn, params)
 
-  defp do_search(version, %{assigns: %{user: user}} = conn, %{q: query} = params) do
+  defp do_search(
+         version,
+         %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{q: query} = params}}} =
+           conn,
+         _
+       ) do
     query = String.trim(query)
     options = search_options(params, user)
     timeout = Keyword.get(Repo.config(), :timeout, 15_000)

lib/pleroma/web/mastodon_api/controllers/status_controller.ex

@@ -25,7 +25,7 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
   alias Pleroma.Web.Plugs.OAuthScopesPlug
   alias Pleroma.Web.Plugs.RateLimiter
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(:skip_public_check when action in [:index, :show])
 
@@ -110,7 +110,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusController do
 
   `ids` query param is required
   """
-  def index(%{assigns: %{user: user}} = conn, %{ids: ids} = params) do
+  def index(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{ids: ids} = params}}} =
+          conn,
+        _
+      ) do
     limit = 100
 
     activities =
@@ -134,7 +138,9 @@ def index(%{assigns: %{user: user}} = conn, %{ids: ids} = params) do
   def create(
         %{
           assigns: %{user: user},
-          body_params: %{status: _, scheduled_at: scheduled_at} = params
+          private: %{
+            open_api_spex: %{body_params: %{status: _, scheduled_at: scheduled_at} = params}
+          }
         } = conn,
         _
       )
@@ -156,7 +162,13 @@ def create(
     else
       {:far_enough, _} ->
         params = Map.drop(params, [:scheduled_at])
-        create(%Plug.Conn{conn | body_params: params}, %{})
+
+        put_in(
+          conn,
+          [Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
+          params
+        )
+        |> do_create
 
       error ->
         error
@@ -164,7 +176,35 @@ def create(
   end
 
   # Creates a regular status
-  def create(%{assigns: %{user: user}, body_params: %{status: _} = params} = conn, _) do
+  def create(
+        %{
+          private: %{open_api_spex: %{body_params: %{status: _}}}
+        } = conn,
+        _
+      ) do
+    do_create(conn)
+  end
+
+  def create(
+        %{
+          assigns: %{user: _user},
+          private: %{open_api_spex: %{body_params: %{media_ids: _} = params}}
+        } = conn,
+        _
+      ) do
+    params = Map.put(params, :status, "")
+
+    put_in(
+      conn,
+      [Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
+      params
+    )
+    |> do_create
+  end
+
+  defp do_create(
+         %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn
+       ) do
     params =
       Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
       |> put_application(conn)
@@ -189,13 +229,11 @@ def create(%{assigns: %{user: user}, body_params: %{status: _} = params} = conn,
     end
   end
 
-  def create(%{assigns: %{user: _user}, body_params: %{media_ids: _} = params} = conn, _) do
-    params = Map.put(params, :status, "")
-    create(%Plug.Conn{conn | body_params: params}, %{})
-  end
-
   @doc "GET /api/v1/statuses/:id/history"
-  def show_history(%{assigns: assigns} = conn, %{id: id} = params) do
+  def show_history(
+        %{assigns: assigns, private: %{open_api_spex: %{params: %{id: id} = params}}} = conn,
+        _
+      ) do
     with user = assigns[:user],
          %Activity{} = activity <- Activity.get_by_id_with_object(id),
          true <- Visibility.visible_for_user?(activity, user) do
@@ -211,7 +249,7 @@ def show_history(%{assigns: assigns} = conn, %{id: id} = params) do
   end
 
   @doc "GET /api/v1/statuses/:id/source"
-  def show_source(%{assigns: assigns} = conn, %{id: id} = _params) do
+  def show_source(%{assigns: assigns, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with user = assigns[:user],
          %Activity{} = activity <- Activity.get_by_id_with_object(id),
          true <- Visibility.visible_for_user?(activity, user) do
@@ -225,7 +263,13 @@ def show_source(%{assigns: assigns} = conn, %{id: id} = _params) do
   end
 
   @doc "PUT /api/v1/statuses/:id"
-  def update(%{assigns: %{user: user}, body_params: body_params} = conn, %{id: id} = params) do
+  def update(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: body_params, params: %{id: id} = params}}
+        } = conn,
+        _
+      ) do
     with {_, %Activity{}} = {_, activity} <- {:activity, Activity.get_by_id_with_object(id)},
          {_, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
          {_, true} <- {:is_create, activity.data["type"] == "Create"},
@@ -248,7 +292,11 @@ def update(%{assigns: %{user: user}, body_params: body_params} = conn, %{id: id}
   end
 
   @doc "GET /api/v1/statuses/:id"
-  def show(%{assigns: %{user: user}} = conn, %{id: id} = params) do
+  def show(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id} = params}}} =
+          conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          true <- Visibility.visible_for_user?(activity, user) do
       try_render(conn, "show.json",
@@ -263,7 +311,7 @@ def show(%{assigns: %{user: user}} = conn, %{id: id} = params) do
   end
 
   @doc "DELETE /api/v1/statuses/:id"
-  def delete(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def delete(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          {:ok, %Activity{}} <- CommonAPI.delete(id, user) do
       try_render(conn, "show.json",
@@ -278,7 +326,13 @@ def delete(%{assigns: %{user: user}} = conn, %{id: id}) do
   end
 
   @doc "POST /api/v1/statuses/:id/reblog"
-  def reblog(%{assigns: %{user: user}, body_params: params} = conn, %{id: ap_id_or_id}) do
+  def reblog(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: params, params: %{id: ap_id_or_id}}}
+        } = conn,
+        _
+      ) do
     with {:ok, announce} <- CommonAPI.repeat(ap_id_or_id, user, params),
          %Activity{} = announce <- Activity.normalize(announce.data) do
       try_render(conn, "show.json", %{activity: announce, for: user, as: :activity})
@@ -286,7 +340,11 @@ def reblog(%{assigns: %{user: user}, body_params: params} = conn, %{id: ap_id_or
   end
 
   @doc "POST /api/v1/statuses/:id/unreblog"
-  def unreblog(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
+  def unreblog(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, _unannounce} <- CommonAPI.unrepeat(activity_id, user),
          %Activity{} = activity <- Activity.get_by_id(activity_id) do
       try_render(conn, "show.json", %{activity: activity, for: user, as: :activity})
@@ -294,7 +352,11 @@ def unreblog(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
   end
 
   @doc "POST /api/v1/statuses/:id/favourite"
-  def favourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
+  def favourite(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, _fav} <- CommonAPI.favorite(user, activity_id),
          %Activity{} = activity <- Activity.get_by_id(activity_id) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
@@ -302,7 +364,11 @@ def favourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
   end
 
   @doc "POST /api/v1/statuses/:id/unfavourite"
-  def unfavourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
+  def unfavourite(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, _unfav} <- CommonAPI.unfavorite(activity_id, user),
          %Activity{} = activity <- Activity.get_by_id(activity_id) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
@@ -310,7 +376,11 @@ def unfavourite(%{assigns: %{user: user}} = conn, %{id: activity_id}) do
   end
 
   @doc "POST /api/v1/statuses/:id/pin"
-  def pin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
+  def pin(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
     else
@@ -329,14 +399,21 @@ def pin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
   end
 
   @doc "POST /api/v1/statuses/:id/unpin"
-  def unpin(%{assigns: %{user: user}} = conn, %{id: ap_id_or_id}) do
+  def unpin(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
+          conn,
+        _
+      ) do
     with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
     end
   end
 
   @doc "POST /api/v1/statuses/:id/bookmark"
-  def bookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def bookmark(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          %User{} = user <- User.get_cached_by_nickname(user.nickname),
          true <- Visibility.visible_for_user?(activity, user),
@@ -346,7 +423,10 @@ def bookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
   end
 
   @doc "POST /api/v1/statuses/:id/unbookmark"
-  def unbookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def unbookmark(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          %User{} = user <- User.get_cached_by_nickname(user.nickname),
          true <- Visibility.visible_for_user?(activity, user),
@@ -356,7 +436,13 @@ def unbookmark(%{assigns: %{user: user}} = conn, %{id: id}) do
   end
 
   @doc "POST /api/v1/statuses/:id/mute"
-  def mute_conversation(%{assigns: %{user: user}, body_params: params} = conn, %{id: id}) do
+  def mute_conversation(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: params, params: %{id: id}}}
+        } = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id(id),
          {:ok, activity} <- CommonAPI.add_mute(user, activity, params) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
@@ -364,7 +450,13 @@ def mute_conversation(%{assigns: %{user: user}, body_params: params} = conn, %{i
   end
 
   @doc "POST /api/v1/statuses/:id/unmute"
-  def unmute_conversation(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def unmute_conversation(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{params: %{id: id}}}
+        } = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id(id),
          {:ok, activity} <- CommonAPI.remove_mute(user, activity) do
       try_render(conn, "show.json", activity: activity, for: user, as: :activity)
@@ -373,7 +465,10 @@ def unmute_conversation(%{assigns: %{user: user}} = conn, %{id: id}) do
 
   @doc "GET /api/v1/statuses/:id/card"
   @deprecated "https://github.com/tootsuite/mastodon/pull/11213"
-  def card(%{assigns: %{user: user}} = conn, %{id: status_id}) do
+  def card(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: status_id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id(status_id),
          true <- Visibility.visible_for_user?(activity, user) do
       data = Pleroma.Web.RichMedia.Helpers.fetch_data_for_activity(activity)
@@ -384,7 +479,10 @@ def card(%{assigns: %{user: user}} = conn, %{id: status_id}) do
   end
 
   @doc "GET /api/v1/statuses/:id/favourited_by"
-  def favourited_by(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def favourited_by(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with true <- Pleroma.Config.get([:instance, :show_reactions]),
          %Activity{} = activity <- Activity.get_by_id_with_object(id),
          {:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
@@ -405,7 +503,10 @@ def favourited_by(%{assigns: %{user: user}} = conn, %{id: id}) do
   end
 
   @doc "GET /api/v1/statuses/:id/reblogged_by"
-  def reblogged_by(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def reblogged_by(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id_with_object(id),
          {:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
          %Object{data: %{"announcements" => announces, "id" => ap_id}} <-
@@ -437,7 +538,10 @@ def reblogged_by(%{assigns: %{user: user}} = conn, %{id: id}) do
   end
 
   @doc "GET /api/v1/statuses/:id/context"
-  def context(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def context(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
+        _
+      ) do
     with %Activity{} = activity <- Activity.get_by_id(id) do
       activities =
         ActivityPub.fetch_activities_for_context(activity.data["context"], %{
@@ -451,7 +555,10 @@ def context(%{assigns: %{user: user}} = conn, %{id: id}) do
   end
 
   @doc "GET /api/v1/favourites"
-  def favourites(%{assigns: %{user: %User{} = user}} = conn, params) do
+  def favourites(
+        %{assigns: %{user: %User{} = user}, private: %{open_api_spex: %{params: params}}} = conn,
+        _
+      ) do
     activities = ActivityPub.fetch_favourites(user, params)
 
     conn
@@ -464,7 +571,7 @@ def favourites(%{assigns: %{user: %User{} = user}} = conn, params) do
   end
 
   @doc "GET /api/v1/bookmarks"
-  def bookmarks(%{assigns: %{user: user}} = conn, params) do
+  def bookmarks(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     user = User.get_cached_by_id(user.id)
 
     bookmarks =

lib/pleroma/web/pleroma_api/controllers/chat_controller.ex

@@ -38,14 +38,24 @@ defmodule Pleroma.Web.PleromaAPI.ChatController do
     %{scopes: ["read:chats"]} when action in [:messages, :index, :index2, :show]
   )
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.ChatOperation
 
-  def delete_message(%{assigns: %{user: %{id: user_id} = user}} = conn, %{
+  def delete_message(
+        %{
+          assigns: %{user: %{id: user_id} = user},
+          private: %{
+            open_api_spex: %{
+              params: %{
                 message_id: message_id,
                 id: chat_id
-      }) do
+              }
+            }
+          }
+        } = conn,
+        _
+      ) do
     with %MessageReference{} = cm_ref <-
            MessageReference.get_by_id(message_id),
          ^chat_id <- to_string(cm_ref.chat_id),
@@ -72,8 +82,11 @@ defp remove_or_delete(
   defp remove_or_delete(cm_ref, _), do: MessageReference.delete(cm_ref)
 
   def post_chat_message(
-        %{body_params: params, assigns: %{user: user}} = conn,
+        %{
-        %{id: id}
+          private: %{open_api_spex: %{body_params: params, params: %{id: id}}},
+          assigns: %{user: user}
+        } = conn,
+        _
       ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id),
          {_, %User{} = recipient} <- {:user, User.get_cached_by_ap_id(chat.recipient)},
@@ -106,8 +119,11 @@ def post_chat_message(
   end
 
   def mark_message_as_read(
-        %{assigns: %{user: %{id: user_id}}} = conn,
+        %{
-        %{id: chat_id, message_id: message_id}
+          assigns: %{user: %{id: user_id}},
+          private: %{open_api_spex: %{params: %{id: chat_id, message_id: message_id}}}
+        } = conn,
+        _
       ) do
     with %MessageReference{} = cm_ref <- MessageReference.get_by_id(message_id),
          ^chat_id <- to_string(cm_ref.chat_id),
@@ -120,8 +136,16 @@ def mark_message_as_read(
   end
 
   def mark_as_read(
-        %{body_params: %{last_read_id: last_read_id}, assigns: %{user: user}} = conn,
+        %{
-        %{id: id}
+          assigns: %{user: user},
+          private: %{
+            open_api_spex: %{
+              body_params: %{last_read_id: last_read_id},
+              params: %{id: id}
+            }
+          }
+        } = conn,
+        _
       ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id),
          {_n, _} <- MessageReference.set_all_seen_for_chat(chat, last_read_id) do
@@ -129,7 +153,13 @@ def mark_as_read(
     end
   end
 
-  def messages(%{assigns: %{user: user}} = conn, %{id: id} = params) do
+  def messages(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{params: %{id: id} = params}}
+        } = conn,
+        _
+      ) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id) do
       chat_message_refs =
         chat
@@ -143,7 +173,7 @@ def messages(%{assigns: %{user: user}} = conn, %{id: id} = params) do
     end
   end
 
-  def index(%{assigns: %{user: user}} = conn, params) do
+  def index(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     chats =
       index_query(user, params)
       |> Repo.all()
@@ -151,7 +181,7 @@ def index(%{assigns: %{user: user}} = conn, params) do
     render(conn, "index.json", chats: chats)
   end
 
-  def index2(%{assigns: %{user: user}} = conn, params) do
+  def index2(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
     chats =
       index_query(user, params)
       |> Pagination.fetch_paginated(params)
@@ -171,14 +201,14 @@ defp index_query(%{id: user_id} = user, params) do
     |> where([c], c.recipient not in ^exclude_users)
   end
 
-  def create(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def create(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with %User{ap_id: recipient} <- User.get_cached_by_id(id),
          {:ok, %Chat{} = chat} <- Chat.get_or_create(user.id, recipient) do
       render(conn, "show.json", chat: chat)
     end
   end
 
-  def show(%{assigns: %{user: user}} = conn, %{id: id}) do
+  def show(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
     with {:ok, chat} <- Chat.get_by_user_and_id(user, id) do
       render(conn, "show.json", chat: chat)
     end

lib/pleroma/web/pleroma_api/controllers/emoji_file_controller.ex

@@ -8,7 +8,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
   alias Pleroma.Emoji.Pack
   alias Pleroma.Web.ApiSpec
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -22,7 +22,10 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
 
   defdelegate open_api_operation(action), to: ApiSpec.PleromaEmojiFileOperation
 
-  def create(%{body_params: params} = conn, %{name: pack_name}) do
+  def create(
+        %{private: %{open_api_spex: %{body_params: params, params: %{name: pack_name}}}} = conn,
+        _
+      ) do
     filename = params[:filename] || get_filename(params[:file])
     shortcode = params[:shortcode] || Path.basename(filename, Path.extname(filename))
 
@@ -49,7 +52,17 @@ def create(%{body_params: params} = conn, %{name: pack_name}) do
     end
   end
 
-  def update(%{body_params: %{shortcode: shortcode} = params} = conn, %{name: pack_name}) do
+  def update(
+        %{
+          private: %{
+            open_api_spex: %{
+              body_params: %{shortcode: shortcode} = params,
+              params: %{name: pack_name}
+            }
+          }
+        } = conn,
+        _
+      ) do
     new_shortcode = params[:new_shortcode]
     new_filename = params[:new_filename]
     force = params[:force]
@@ -80,7 +93,10 @@ def update(%{body_params: %{shortcode: shortcode} = params} = conn, %{name: pack
     end
   end
 
-  def delete(conn, %{name: pack_name, shortcode: shortcode}) do
+  def delete(
+        %{private: %{open_api_spex: %{params: %{name: pack_name, shortcode: shortcode}}}} = conn,
+        _
+      ) do
     with {:ok, pack} <- Pack.load_pack(pack_name),
          {:ok, pack} <- Pack.delete_file(pack, shortcode) do
       json(conn, pack.files)

lib/pleroma/web/pleroma_api/controllers/emoji_pack_controller.ex

@@ -7,7 +7,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
 
   alias Pleroma.Emoji.Pack
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -26,7 +26,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaEmojiPackOperation
 
-  def remote(conn, params) do
+  def remote(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     with {:ok, packs} <-
            Pack.list_remote(url: params.url, page_size: params.page_size, page: params.page) do
       json(conn, packs)
@@ -38,7 +38,7 @@ def remote(conn, params) do
     end
   end
 
-  def index(conn, params) do
+  def index(%{private: %{open_api_spex: %{params: params}}} = conn, _) do
     emoji_path =
       [:instance, :static_dir]
       |> Pleroma.Config.get!()
@@ -61,7 +61,11 @@ def index(conn, params) do
     end
   end
 
-  def show(conn, %{name: name, page: page, page_size: page_size}) do
+  def show(
+        %{private: %{open_api_spex: %{params: %{name: name, page: page, page_size: page_size}}}} =
+          conn,
+        _
+      ) do
     name = String.trim(name)
 
     with {:ok, pack} <- Pack.show(name: name, page: page, page_size: page_size) do
@@ -90,7 +94,7 @@ def show(conn, %{name: name, page: page, page_size: page_size}) do
     end
   end
 
-  def archive(conn, %{name: name}) do
+  def archive(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     with {:ok, archive} <- Pack.get_archive(name) do
       send_download(conn, {:binary, archive}, filename: "#{name}.zip")
     else
@@ -109,7 +113,10 @@ def archive(conn, %{name: name}) do
     end
   end
 
-  def download(%{body_params: %{url: url, name: name} = params} = conn, _) do
+  def download(
+        %{private: %{open_api_spex: %{body_params: %{url: url, name: name} = params}}} = conn,
+        _
+      ) do
     with {:ok, _pack} <- Pack.download(name, url, params[:as]) do
       json(conn, "ok")
     else
@@ -130,7 +137,7 @@ def download(%{body_params: %{url: url, name: name} = params} = conn, _) do
     end
   end
 
-  def create(conn, %{name: name}) do
+  def create(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     name = String.trim(name)
 
     with {:ok, _pack} <- Pack.create(name) do
@@ -159,7 +166,7 @@ def create(conn, %{name: name}) do
     end
   end
 
-  def delete(conn, %{name: name}) do
+  def delete(%{private: %{open_api_spex: %{params: %{name: name}}}} = conn, _) do
     name = String.trim(name)
 
     with {:ok, deleted} when deleted != [] <- Pack.delete(name) do
@@ -184,7 +191,11 @@ def delete(conn, %{name: name}) do
     end
   end
 
-  def update(%{body_params: %{metadata: metadata}} = conn, %{name: name}) do
+  def update(
+        %{private: %{open_api_spex: %{body_params: %{metadata: metadata}, params: %{name: name}}}} =
+          conn,
+        _
+      ) do
     with {:ok, pack} <- Pack.update_metadata(name, metadata) do
       json(conn, pack.pack)
     else

lib/pleroma/web/pleroma_api/controllers/mascot_controller.ex

@@ -10,7 +10,7 @@ defmodule Pleroma.Web.PleromaAPI.MascotController do
   alias Pleroma.Web.Plugs.OAuthScopesPlug
 
   plug(Majic.Plug, [pool: Pleroma.MajicPool] when action in [:update])
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   plug(OAuthScopesPlug, %{scopes: ["read:accounts"]} when action == :show)
   plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action != :show)
 
@@ -22,7 +22,11 @@ def show(%{assigns: %{user: user}} = conn, _params) do
   end
 
   @doc "PUT /api/v1/pleroma/mascot"
-  def update(%{assigns: %{user: user}, body_params: %{file: file}} = conn, _) do
+  def update(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{file: file}}}} =
+          conn,
+        _
+      ) do
     with {:content_type, "image" <> _} <- {:content_type, file.content_type},
          {:ok, object} <- ActivityPub.upload(file, actor: User.ap_id(user)) do
       attachment = render_attachment(object)

lib/pleroma/web/pleroma_api/controllers/notification_controller.ex

@@ -7,7 +7,7 @@ defmodule Pleroma.Web.PleromaAPI.NotificationController do
 
   alias Pleroma.Notification
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
 
   plug(
     Pleroma.Web.Plugs.OAuthScopesPlug,
@@ -16,7 +16,13 @@ defmodule Pleroma.Web.PleromaAPI.NotificationController do
 
   defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.PleromaNotificationOperation
 
-  def mark_as_read(%{assigns: %{user: user}, body_params: %{id: notification_id}} = conn, _) do
+  def mark_as_read(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: %{id: notification_id}}}
+        } = conn,
+        _
+      ) do
     with {:ok, notification} <- Notification.read_one(user, notification_id) do
       render(conn, "show.json", notification: notification, for: user)
     else
@@ -27,7 +33,11 @@ def mark_as_read(%{assigns: %{user: user}, body_params: %{id: notification_id}}
     end
   end
 
-  def mark_as_read(%{assigns: %{user: user}, body_params: %{max_id: max_id}} = conn, _) do
+  def mark_as_read(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: %{max_id: max_id}}}} =
+          conn,
+        _
+      ) do
     notifications =
       user
       |> Notification.set_read_up_to(max_id)

lib/pleroma/web/pleroma_api/controllers/user_import_controller.ex

@@ -15,14 +15,21 @@ defmodule Pleroma.Web.PleromaAPI.UserImportController do
   plug(OAuthScopesPlug, %{scopes: ["follow", "write:blocks"]} when action == :blocks)
   plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action == :mutes)
 
-  plug(Pleroma.Web.ApiSpec.CastAndValidate)
+  plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)
   defdelegate open_api_operation(action), to: ApiSpec.UserImportOperation
 
-  def follow(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
+  def follow(
-    follow(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_follow(conn, list)
   end
 
-  def follow(%{assigns: %{user: follower}, body_params: %{list: list}} = conn, _) do
+  def follow(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_follow(conn, list)
+
+  def do_follow(%{assigns: %{user: follower}} = conn, list) do
     identifiers =
       list
       |> String.split("\n")
@@ -35,20 +42,34 @@ def follow(%{assigns: %{user: follower}, body_params: %{list: list}} = conn, _)
     json(conn, "job started")
   end
 
-  def blocks(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
+  def blocks(
-    blocks(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_block(conn, list)
   end
 
-  def blocks(%{assigns: %{user: blocker}, body_params: %{list: list}} = conn, _) do
+  def blocks(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_block(conn, list)
+
+  defp do_block(%{assigns: %{user: blocker}} = conn, list) do
     User.Import.blocks_import(blocker, prepare_user_identifiers(list))
     json(conn, "job started")
   end
 
-  def mutes(%{body_params: %{list: %Plug.Upload{path: path}}} = conn, _) do
+  def mutes(
-    mutes(%Plug.Conn{conn | body_params: %{list: File.read!(path)}}, %{})
+        %{private: %{open_api_spex: %{body_params: %{list: %Plug.Upload{path: path}}}}} = conn,
+        _
+      ) do
+    list = File.read!(path)
+    do_mute(conn, list)
   end
 
-  def mutes(%{assigns: %{user: user}, body_params: %{list: list}} = conn, _) do
+  def mutes(%{private: %{open_api_spex: %{body_params: %{list: list}}}} = conn, _),
+    do: do_mute(conn, list)
+
+  defp do_mute(%{assigns: %{user: user}} = conn, list) do
     User.Import.mutes_import(user, prepare_user_identifiers(list))
     json(conn, "job started")
   end

lib/pleroma/web/twitter_api/controllers/util_controller.ex

@@ -18,7 +18,8 @@ defmodule Pleroma.Web.TwitterAPI.UtilController do
   alias Pleroma.Web.WebFinger
 
   plug(
-    Pleroma.Web.ApiSpec.CastAndValidate
+    Pleroma.Web.ApiSpec.CastAndValidate,
+    [replace_params: false]
     when action != :remote_subscribe and action != :show_subscribe_form
   )
 
@@ -150,7 +151,10 @@ def remote_subscribe(conn, %{"status" => %{"status_id" => id, "profile" => profi
     end
   end
 
-  def remote_interaction(%{body_params: %{ap_id: ap_id, profile: profile}} = conn, _params) do
+  def remote_interaction(
+        %{private: %{open_api_spex: %{body_params: %{ap_id: ap_id, profile: profile}}}} = conn,
+        _params
+      ) do
     with {:ok, %{"subscribe_address" => template}} <- WebFinger.finger(profile) do
       conn
       |> json(%{url: String.replace(template, "{uri}", ap_id)})
@@ -187,7 +191,10 @@ def update_notification_settings(%{assigns: %{user: user}} = conn, params) do
     end
   end
 
-  def change_password(%{assigns: %{user: user}, body_params: body_params} = conn, %{}) do
+  def change_password(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
+        _
+      ) do
     case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
       {:ok, user} ->
         with {:ok, _user} <-
@@ -210,7 +217,10 @@ def change_password(%{assigns: %{user: user}, body_params: body_params} = conn,
     end
   end
 
-  def change_email(%{assigns: %{user: user}, body_params: body_params} = conn, %{}) do
+  def change_email(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
+        _
+      ) do
     case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
       {:ok, user} ->
         with {:ok, _user} <- User.change_email(user, body_params.email) do
@@ -229,7 +239,13 @@ def change_email(%{assigns: %{user: user}, body_params: body_params} = conn, %{}
     end
   end
 
-  def delete_account(%{assigns: %{user: user}, body_params: body_params} = conn, params) do
+  def delete_account(
+        %{
+          assigns: %{user: user},
+          private: %{open_api_spex: %{body_params: body_params, params: params}}
+        } = conn,
+        _
+      ) do
     # This endpoint can accept a query param or JSON body for backwards-compatibility.
     # Submitting a JSON body is recommended, so passwords don't end up in server logs.
     password = body_params[:password] || params[:password] || ""
@@ -244,7 +260,10 @@ def delete_account(%{assigns: %{user: user}, body_params: body_params} = conn, p
     end
   end
 
-  def disable_account(%{assigns: %{user: user}} = conn, params) do
+  def disable_account(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn,
+        _
+      ) do
     case CommonAPI.Utils.confirm_current_password(user, params[:password]) do
       {:ok, user} ->
         User.set_activation_async(user, false)
@@ -255,7 +274,10 @@ def disable_account(%{assigns: %{user: user}} = conn, params) do
     end
   end
 
-  def move_account(%{assigns: %{user: user}, body_params: body_params} = conn, %{}) do
+  def move_account(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
+        _
+      ) do
     case CommonAPI.Utils.confirm_current_password(user, body_params.password) do
       {:ok, user} ->
         with {:ok, target_user} <- find_or_fetch_user_by_nickname(body_params.target_account),
@@ -276,7 +298,10 @@ def move_account(%{assigns: %{user: user}, body_params: body_params} = conn, %{}
     end
   end
 
-  def add_alias(%{assigns: %{user: user}, body_params: body_params} = conn, _) do
+  def add_alias(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
+        _
+      ) do
     with {:ok, alias_user} <- find_user_by_nickname(body_params.alias),
          {:ok, _user} <- user |> User.add_alias(alias_user) do
       json(conn, %{status: "success"})
@@ -291,7 +316,10 @@ def add_alias(%{assigns: %{user: user}, body_params: body_params} = conn, _) do
     end
   end
 
-  def delete_alias(%{assigns: %{user: user}, body_params: body_params} = conn, _) do
+  def delete_alias(
+        %{assigns: %{user: user}, private: %{open_api_spex: %{body_params: body_params}}} = conn,
+        _
+      ) do
     with {:ok, alias_user} <- find_user_by_nickname(body_params.alias),
          {:ok, _user} <- user |> User.delete_alias(alias_user) do
       json(conn, %{status: "success"})
@@ -306,7 +334,7 @@ def delete_alias(%{assigns: %{user: user}, body_params: body_params} = conn, _)
     end
   end
 
-  def list_aliases(%{assigns: %{user: user}} = conn, %{}) do
+  def list_aliases(%{assigns: %{user: user}} = conn, _) do
     alias_nicks =
       user
       |> User.alias_users()

test/pleroma/web/admin_api/controllers/config_controller_test.exs

@@ -873,7 +873,7 @@ test "tuples with more than two values", %{conn: conn} do
                                   %{
                                     "tuple" => [
                                       ":_",
-                                      "Phoenix.Endpoint.Cowboy2Handler",
+                                      "Plug.Cowboy.Handler",
                                       %{"tuple" => ["Pleroma.Web.Endpoint", []]}
                                     ]
                                   }
@@ -937,7 +937,7 @@ test "tuples with more than two values", %{conn: conn} do
                                        %{
                                          "tuple" => [
                                            ":_",
-                                           "Phoenix.Endpoint.Cowboy2Handler",
+                                           "Plug.Cowboy.Handler",
                                            %{"tuple" => ["Pleroma.Web.Endpoint", []]}
                                          ]
                                        }