mediagoblin/federation/views.py

   1 # GNU MediaGoblin -- federated, autonomous media hosting
   2 # Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
   3 #
   4 # This program is free software: you can redistribute it and/or modify
   5 # it under the terms of the GNU Affero General Public License as published by
   6 # the Free Software Foundation, either version 3 of the License, or
   7 # (at your option) any later version.
   8 #
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU Affero General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU Affero General Public License
  15 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16
  17 import json
  18 import io
  19 import mimetypes
  20
  21 from werkzeug.datastructures import FileStorage
  22
  23 from mediagoblin.decorators import oauth_required, require_active_login
  24 from mediagoblin.federation.decorators import user_has_privilege
  25 from mediagoblin.db.models import User, MediaEntry, MediaComment, Activity
  26 from mediagoblin.tools.federation import create_activity, create_generator
  27 from mediagoblin.tools.routing import extract_url_arguments
  28 from mediagoblin.tools.response import redirect, json_response, json_error, \
  29                                        render_404, render_to_response
  30 from mediagoblin.meddleware.csrf import csrf_exempt
  31 from mediagoblin.submit.lib import new_upload_entry, api_upload_request, \
  32                                     api_add_to_feed
  33
  34 # MediaTypes
  35 from mediagoblin.media_types.image import MEDIA_TYPE as IMAGE_MEDIA_TYPE
  36
  37 # Getters
  38 def get_profile(request):
  39     """
  40     Gets the user's profile for the endpoint requested.
  41
  42     For example an endpoint which is /api/{username}/feed
  43     as /api/cwebber/feed would get cwebber's profile. This
  44     will return a tuple (username, user_profile). If no user
  45     can be found then this function returns a (None, None).
  46     """
  47     username = request.matchdict["username"]
  48     user = User.query.filter_by(username=username).first()
  49
  50     if user is None:
  51         return None, None
  52
  53     return user, user.serialize(request)
  54
  55
  56 # Endpoints
  57 @oauth_required
  58 def profile_endpoint(request):
  59     """ This is /api/user/<username>/profile - This will give profile info """
  60     user, user_profile = get_profile(request)
  61
  62     if user is None:
  63         username = request.matchdict["username"]
  64         return json_error(
  65             "No such 'user' with username '{0}'".format(username),
  66             status=404
  67         )
  68
  69     # user profiles are public so return information
  70     return json_response(user_profile)
  71
  72 @oauth_required
  73 def user_endpoint(request):
  74     """ This is /api/user/<username> - This will get the user """
  75     user, user_profile = get_profile(request)
  76
  77     if user is None:
  78         username = request.matchdict["username"]
  79         return json_error(
  80             "No such 'user' with username '{0}'".format(username),
  81             status=404
  82         )
  83
  84     return json_response({
  85         "nickname": user.username,
  86         "updated": user.created.isoformat(),
  87         "published": user.created.isoformat(),
  88         "profile": user_profile,
  89     })
  90
  91 @oauth_required
  92 @csrf_exempt
  93 @user_has_privilege(u'uploader')
  94 def uploads_endpoint(request):
  95     """ Endpoint for file uploads """
  96     username = request.matchdict["username"]
  97     requested_user = User.query.filter_by(username=username).first()
  98
  99     if requested_user is None:
 100         return json_error("No such 'user' with id '{0}'".format(username), 404)
 101
 102     if request.method == "POST":
 103         # Ensure that the user is only able to upload to their own
 104         # upload endpoint.
 105         if requested_user.id != request.user.id:
 106             return json_error(
 107                 "Not able to post to another users feed.",
 108                 status=403
 109             )
 110
 111         # Wrap the data in the werkzeug file wrapper
 112         if "Content-Type" not in request.headers:
 113             return json_error(
 114                 "Must supply 'Content-Type' header to upload media."
 115             )
 116
 117         mimetype = request.headers["Content-Type"]
 118         filename = mimetypes.guess_all_extensions(mimetype)
 119         filename = 'unknown' + filename[0] if filename else filename
 120         file_data = FileStorage(
 121             stream=io.BytesIO(request.data),
 122             filename=filename,
 123             content_type=mimetype
 124         )
 125
 126         # Find media manager
 127         entry = new_upload_entry(request.user)
 128         entry.media_type = IMAGE_MEDIA_TYPE
 129         return api_upload_request(request, file_data, entry)
 130
 131     return json_error("Not yet implemented", 501)
 132
 133 @oauth_required
 134 @csrf_exempt
 135 def inbox_endpoint(request, inbox=None):
 136     """ This is the user's inbox
 137
 138     Currently because we don't have the ability to represent the inbox in the
 139     database this is not a "real" inbox in the pump.io/Activity streams 1.0
 140     sense but instead just gives back all the data on the website
 141
 142     inbox: allows you to pass a query in to limit inbox scope
 143     """
 144     username = request.matchdict["username"]
 145     user = User.query.filter_by(username=username).first()
 146
 147     if user is None:
 148         return json_error("No such 'user' with id '{0}'".format(username), 404)
 149
 150
 151     # Only the user who's authorized should be able to read their inbox
 152     if user.id != request.user.id:
 153         return json_error(
 154             "Only '{0}' can read this inbox.".format(user.username),
 155             403
 156         )
 157
 158     if inbox is None:
 159         inbox = Activity.query
 160
 161     # Count how many items for the "totalItems" field
 162     total_items = inbox.count()
 163
 164     # We want to make a query for all media on the site and then apply GET
 165     # limits where we can.
 166     inbox = inbox.order_by(Activity.published.desc())
 167
 168     # Limit by the "count" (default: 20)
 169     try:
 170         limit = int(request.args.get("count", 20))
 171     except ValueError:
 172         limit = 20
 173
 174     # Prevent the count being too big (pump uses 200 so we shall)
 175     limit = limit if limit <= 200 else 200
 176
 177     # Apply the limit
 178     inbox = inbox.limit(limit)
 179
 180     # Offset (default: no offset - first <count> results)
 181     inbox = inbox.offset(request.args.get("offset", 0))
 182
 183     # build the inbox feed
 184     feed = {
 185         "displayName": "Activities for {0}".format(user.username),
 186         "author": user.serialize(request),
 187         "objectTypes": ["activity"],
 188         "url": request.base_url,
 189         "links": {"self": {"href": request.url}},
 190         "items": [],
 191         "totalItems": total_items,
 192     }
 193
 194     for activity in inbox:
 195         try:
 196             feed["items"].append(activity.serialize(request))
 197         except AttributeError:
 198             # As with the feed endpint this occurs because of how we our
 199             # hard-deletion method. Some activites might exist where the
 200             # Activity object and/or target no longer exist, for this case we
 201             # should just skip them.
 202             pass
 203
 204     return json_response(feed)
 205
 206 @oauth_required
 207 @csrf_exempt
 208 def inbox_minor_endpoint(request):
 209     """ Inbox subset for less important Activities """
 210     inbox = Activity.query.filter(
 211         (Activity.verb == "update") | (Activity.verb == "delete")
 212     )
 213
 214     return inbox_endpoint(request=request, inbox=inbox)
 215
 216 @oauth_required
 217 @csrf_exempt
 218 def inbox_major_endpoint(request):
 219     """ Inbox subset for most important Activities """
 220     inbox = Activity.query.filter_by(verb="post")
 221     return inbox_endpoint(request=request, inbox=inbox)
 222
 223 @oauth_required
 224 @csrf_exempt
 225 def feed_endpoint(request, outbox=None):
 226     """ Handles the user's outbox - /api/user/<username>/feed """
 227     username = request.matchdict["username"]
 228     requested_user = User.query.filter_by(username=username).first()
 229
 230     # check if the user exists
 231     if requested_user is None:
 232         return json_error("No such 'user' with id '{0}'".format(username), 404)
 233
 234     if request.data:
 235         data = json.loads(request.data.decode())
 236     else:
 237         data = {"verb": None, "object": {}}
 238
 239
 240     if request.method in ["POST", "PUT"]:
 241         # Validate that the activity is valid
 242         if "verb" not in data or "object" not in data:
 243             return json_error("Invalid activity provided.")
 244
 245         # Check that the verb is valid
 246         if data["verb"] not in ["post", "update", "delete"]:
 247             return json_error("Verb not yet implemented", 501)
 248
 249         # We need to check that the user they're posting to is
 250         # the person that they are.
 251         if requested_user.id != request.user.id:
 252             return json_error(
 253                 "Not able to post to another users feed.",
 254                 status=403
 255             )
 256
 257         # Handle new posts
 258         if data["verb"] == "post":
 259             obj = data.get("object", None)
 260             if obj is None:
 261                 return json_error("Could not find 'object' element.")
 262
 263             if obj.get("objectType", None) == "comment":
 264                 # post a comment
 265                 if not request.user.has_privilege(u'commenter'):
 266                     return json_error(
 267                         "Privilege 'commenter' required to comment.",
 268                         status=403
 269                     )
 270
 271                 comment = MediaComment(author=request.user.id)
 272                 comment.unserialize(data["object"], request)
 273                 comment.save()
 274
 275                 # Create activity for comment
 276                 generator = create_generator(request)
 277                 activity = create_activity(
 278                     verb="post",
 279                     actor=request.user,
 280                     obj=comment,
 281                     target=comment.get_entry,
 282                     generator=generator
 283                 )
 284
 285                 return json_response(activity.serialize(request))
 286
 287             elif obj.get("objectType", None) == "image":
 288                 # Posting an image to the feed
 289                 media_id = int(extract_url_arguments(
 290                     url=data["object"]["id"],
 291                     urlmap=request.app.url_map
 292                 )["id"])
 293
 294                 media = MediaEntry.query.filter_by(id=media_id).first()
 295
 296                 if media is None:
 297                     return json_response(
 298                         "No such 'image' with id '{0}'".format(media_id),
 299                         status=404
 300                     )
 301
 302                 if media.uploader != request.user.id:
 303                     return json_error(
 304                         "Privilege 'commenter' required to comment.",
 305                         status=403
 306                     )
 307
 308
 309                 if not media.unserialize(data["object"]):
 310                     return json_error(
 311                         "Invalid 'image' with id '{0}'".format(media_id)
 312                     )
 313
 314
 315                 # Add location if one exists
 316                 if "location" in data:
 317                     Location.create(data["location"], self)
 318
 319                 media.save()
 320                 activity = api_add_to_feed(request, media)
 321
 322                 return json_response(activity.serialize(request))
 323
 324             elif obj.get("objectType", None) is None:
 325                 # They need to tell us what type of object they're giving us.
 326                 return json_error("No objectType specified.")
 327             else:
 328                 # Oh no! We don't know about this type of object (yet)
 329                 object_type = obj.get("objectType", None)
 330                 return json_error(
 331                     "Unknown object type '{0}'.".format(object_type)
 332                 )
 333
 334         # Updating existing objects
 335         if data["verb"] == "update":
 336             # Check we've got a valid object
 337             obj = data.get("object", None)
 338
 339             if obj is None:
 340                 return json_error("Could not find 'object' element.")
 341
 342             if "objectType" not in obj:
 343                 return json_error("No objectType specified.")
 344
 345             if "id" not in obj:
 346                 return json_error("Object ID has not been specified.")
 347
 348             obj_id = int(extract_url_arguments(
 349                 url=obj["id"],
 350                 urlmap=request.app.url_map
 351             )["id"])
 352
 353             # Now try and find object
 354             if obj["objectType"] == "comment":
 355                 if not request.user.has_privilege(u'commenter'):
 356                     return json_error(
 357                         "Privilege 'commenter' required to comment.",
 358                         status=403
 359                     )
 360
 361                 comment = MediaComment.query.filter_by(id=obj_id).first()
 362                 if comment is None:
 363                     return json_error(
 364                         "No such 'comment' with id '{0}'.".format(obj_id)
 365                     )
 366
 367                 # Check that the person trying to update the comment is
 368                 # the author of the comment.
 369                 if comment.author != request.user.id:
 370                     return json_error(
 371                         "Only author of comment is able to update comment.",
 372                         status=403
 373                     )
 374
 375                 if not comment.unserialize(data["object"], request):
 376                     return json_error(
 377                         "Invalid 'comment' with id '{0}'".format(obj["id"])
 378                     )
 379
 380                 comment.save()
 381
 382                 # Create an update activity
 383                 generator = create_generator(request)
 384                 activity = create_activity(
 385                     verb="update",
 386                     actor=request.user,
 387                     obj=comment,
 388                     generator=generator
 389                 )
 390
 391                 return json_response(activity.serialize(request))
 392
 393             elif obj["objectType"] == "image":
 394                 image = MediaEntry.query.filter_by(id=obj_id).first()
 395                 if image is None:
 396                     return json_error(
 397                         "No such 'image' with the id '{0}'.".format(obj["id"])
 398                     )
 399
 400                 # Check that the person trying to update the comment is
 401                 # the author of the comment.
 402                 if image.uploader != request.user.id:
 403                     return json_error(
 404                         "Only uploader of image is able to update image.",
 405                         status=403
 406                     )
 407
 408                 if not image.unserialize(obj):
 409                     return json_error(
 410                         "Invalid 'image' with id '{0}'".format(obj_id)
 411                     )
 412                 image.generate_slug()
 413                 image.save()
 414
 415                 # Create an update activity
 416                 generator = create_generator(request)
 417                 activity = create_activity(
 418                     verb="update",
 419                     actor=request.user,
 420                     obj=image,
 421                     generator=generator
 422                 )
 423
 424                 return json_response(activity.serialize(request))
 425             elif obj["objectType"] == "person":
 426                 # check this is the same user
 427                 if "id" not in obj or obj["id"] != requested_user.id:
 428                     return json_error(
 429                         "Incorrect user id, unable to update"
 430                     )
 431
 432                 requested_user.unserialize(obj)
 433                 requested_user.save()
 434
 435                 generator = create_generator(request)
 436                 activity = create_activity(
 437                     verb="update",
 438                     actor=request.user,
 439                     obj=requested_user,
 440                     generator=generator
 441                 )
 442
 443                 return json_response(activity.serialize(request))
 444
 445         elif data["verb"] == "delete":
 446             obj = data.get("object", None)
 447             if obj is None:
 448                 return json_error("Could not find 'object' element.")
 449
 450             if "objectType" not in obj:
 451                 return json_error("No objectType specified.")
 452
 453             if "id" not in obj:
 454                 return json_error("Object ID has not been specified.")
 455
 456             # Parse out the object ID
 457             obj_id = int(extract_url_arguments(
 458                 url=obj["id"],
 459                 urlmap=request.app.url_map
 460             )["id"])
 461
 462             if obj.get("objectType", None) == "comment":
 463                 # Find the comment asked for
 464                 comment = MediaComment.query.filter_by(
 465                     id=obj_id,
 466                     author=request.user.id
 467                 ).first()
 468
 469                 if comment is None:
 470                     return json_error(
 471                         "No such 'comment' with id '{0}'.".format(obj_id)
 472                     )
 473
 474                 # Make a delete activity
 475                 generator = create_generator(request)
 476                 activity = create_activity(
 477                     verb="delete",
 478                     actor=request.user,
 479                     obj=comment,
 480                     generator=generator
 481                 )
 482
 483                 # Unfortunately this has to be done while hard deletion exists
 484                 context = activity.serialize(request)
 485
 486                 # now we can delete the comment
 487                 comment.delete()
 488
 489                 return json_response(context)
 490
 491             if obj.get("objectType", None) == "image":
 492                 # Find the image
 493                 entry = MediaEntry.query.filter_by(
 494                     id=obj_id,
 495                     uploader=request.user.id
 496                 ).first()
 497
 498                 if entry is None:
 499                     return json_error(
 500                         "No such 'image' with id '{0}'.".format(obj_id)
 501                     )
 502
 503                 # Make the delete activity
 504                 generator = create_generator(request)
 505                 activity = create_activity(
 506                     verb="delete",
 507                     actor=request.user,
 508                     obj=entry,
 509                     generator=generator
 510                 )
 511
 512                 # This is because we have hard deletion
 513                 context = activity.serialize(request)
 514
 515                 # Now we can delete the image
 516                 entry.delete()
 517
 518                 return json_response(context)
 519
 520     elif request.method != "GET":
 521         return json_error(
 522             "Unsupported HTTP method {0}".format(request.method),
 523             status=501
 524         )
 525
 526     feed = {
 527         "displayName": "Activities by {user}@{host}".format(
 528             user=request.user.username,
 529             host=request.host
 530         ),
 531         "objectTypes": ["activity"],
 532         "url": request.base_url,
 533         "links": {"self": {"href": request.url}},
 534         "author": request.user.serialize(request),
 535         "items": [],
 536     }
 537
 538     # Create outbox
 539     if outbox is None:
 540         outbox = Activity.query.filter_by(actor=request.user.id)
 541     else:
 542         outbox = outbox.filter_by(actor=request.user.id)
 543
 544     # We want the newest things at the top (issue: #1055)
 545     outbox = outbox.order_by(Activity.published.desc())
 546
 547     # Limit by the "count" (default: 20)
 548     limit = request.args.get("count", 20)
 549
 550     try:
 551         limit = int(limit)
 552     except ValueError:
 553         limit = 20
 554
 555     # The upper most limit should be 200
 556     limit = limit if limit < 200 else 200
 557
 558     # apply the limit
 559     outbox = outbox.limit(limit)
 560
 561     # Offset (default: no offset - first <count>  result)
 562     outbox = outbox.offset(request.args.get("offset", 0))
 563
 564     # Build feed.
 565     for activity in outbox:
 566         try:
 567             feed["items"].append(activity.serialize(request))
 568         except AttributeError:
 569             # This occurs because of how we hard-deletion and the object
 570             # no longer existing anymore. We want to keep the Activity
 571             # in case someone wishes to look it up but we shouldn't display
 572             # it in the feed.
 573             pass
 574     feed["totalItems"] = len(feed["items"])
 575
 576     return json_response(feed)
 577
 578 @oauth_required
 579 def feed_minor_endpoint(request):
 580     """ Outbox for minor activities such as updates """
 581     # If it's anything but GET pass it along
 582     if request.method != "GET":
 583         return feed_endpoint(request)
 584
 585     outbox = Activity.query.filter(
 586         (Activity.verb == "update") | (Activity.verb == "delete")
 587     )
 588     return feed_endpoint(request, outbox=outbox)
 589
 590 @oauth_required
 591 def feed_major_endpoint(request):
 592     """ Outbox for all major activities """
 593     # If it's anything but a GET pass it along
 594     if request.method != "GET":
 595         return feed_endpoint(request)
 596
 597     outbox = Activity.query.filter_by(verb="post")
 598     return feed_endpoint(request, outbox=outbox)
 599
 600 @oauth_required
 601 def object_endpoint(request):
 602     """ Lookup for a object type """
 603     object_type = request.matchdict["object_type"]
 604     try:
 605         object_id = request.matchdict["id"]
 606     except ValueError:
 607         error = "Invalid object ID '{0}' for '{1}'".format(
 608             request.matchdict["id"],
 609             object_type
 610         )
 611         return json_error(error)
 612
 613     if object_type not in ["image"]:
 614         # not sure why this is 404, maybe ask evan. Maybe 400?
 615         return json_error(
 616             "Unknown type: {0}".format(object_type),
 617             status=404
 618         )
 619
 620     media = MediaEntry.query.filter_by(id=object_id).first()
 621     if media is None:
 622         return json_error(
 623             "Can't find '{0}' with ID '{1}'".format(object_type, object_id),
 624             status=404
 625         )
 626
 627     return json_response(media.serialize(request))
 628
 629 @oauth_required
 630 def object_comments(request):
 631     """ Looks up for the comments on a object """
 632     media = MediaEntry.query.filter_by(id=request.matchdict["id"]).first()
 633     if media is None:
 634         return json_error("Can't find '{0}' with ID '{1}'".format(
 635             request.matchdict["object_type"],
 636             request.matchdict["id"]
 637         ), 404)
 638
 639     comments = media.serialize(request)
 640     comments = comments.get("replies", {
 641         "totalItems": 0,
 642         "items": [],
 643         "url": request.urlgen(
 644             "mediagoblin.federation.object.comments",
 645             object_type=media.object_type,
 646             id=media.id,
 647             qualified=True
 648         )
 649     })
 650
 651     comments["displayName"] = "Replies to {0}".format(comments["url"])
 652     comments["links"] = {
 653         "first": comments["url"],
 654         "self": comments["url"],
 655     }
 656     return json_response(comments)
 657
 658 ##
 659 # RFC6415 - Web Host Metadata
 660 ##
 661 def host_meta(request):
 662     """
 663     This provides the host-meta URL information that is outlined
 664     in RFC6415. By default this should provide XRD+XML however
 665     if the client accepts JSON we will provide that over XRD+XML.
 666     The 'Accept' header is used to decude this.
 667
 668     A client should use this endpoint to determine what URLs to
 669     use for OAuth endpoints.
 670     """
 671
 672     links = [
 673         {
 674             "rel": "lrdd",
 675             "type": "application/json",
 676             "href": request.urlgen(
 677                 "mediagoblin.webfinger.well-known.webfinger",
 678                 qualified=True
 679             )
 680         },
 681         {
 682             "rel": "registration_endpoint",
 683             "href": request.urlgen(
 684                 "mediagoblin.oauth.client_register",
 685                 qualified=True
 686             ),
 687         },
 688         {
 689             "rel": "http://apinamespace.org/oauth/request_token",
 690             "href": request.urlgen(
 691                 "mediagoblin.oauth.request_token",
 692                 qualified=True
 693             ),
 694         },
 695         {
 696             "rel": "http://apinamespace.org/oauth/authorize",
 697             "href": request.urlgen(
 698                 "mediagoblin.oauth.authorize",
 699                 qualified=True
 700             ),
 701         },
 702         {
 703             "rel": "http://apinamespace.org/oauth/access_token",
 704             "href": request.urlgen(
 705                 "mediagoblin.oauth.access_token",
 706                 qualified=True
 707             ),
 708         },
 709         {
 710             "rel": "http://apinamespace.org/activitypub/whoami",
 711             "href": request.urlgen(
 712                 "mediagoblin.webfinger.whoami",
 713                 qualified=True
 714             ),
 715         },
 716     ]
 717
 718     if "application/json" in request.accept_mimetypes:
 719         return json_response({"links": links})
 720
 721     # provide XML+XRD
 722     return render_to_response(
 723         request,
 724         "mediagoblin/federation/host-meta.xml",
 725         {"links": links},
 726         mimetype="application/xrd+xml"
 727     )
 728
 729 def lrdd_lookup(request):
 730     """
 731     This is the lrdd endpoint which can lookup a user (or
 732     other things such as activities). This is as specified by
 733     RFC6415.
 734
 735     The cleint must provide a 'resource' as a GET parameter which
 736     should be the query to be looked up.
 737     """
 738
 739     if "resource" not in request.args:
 740         return json_error("No resource parameter", status=400)
 741
 742     resource = request.args["resource"]
 743
 744     if "@" in resource:
 745         # Lets pull out the username
 746         resource = resource[5:] if resource.startswith("acct:") else resource
 747         username, host = resource.split("@", 1)
 748
 749         # Now lookup the user
 750         user = User.query.filter_by(username=username).first()
 751
 752         if user is None:
 753             return json_error(
 754                 "Can't find 'user' with username '{0}'".format(username))
 755
 756         return json_response([
 757             {
 758                 "rel": "http://webfinger.net/rel/profile-page",
 759                 "href": user.url_for_self(request.urlgen),
 760                 "type": "text/html"
 761             },
 762             {
 763                 "rel": "self",
 764                 "href": request.urlgen(
 765                     "mediagoblin.federation.user",
 766                     username=user.username,
 767                     qualified=True
 768                 )
 769             },
 770             {
 771                 "rel": "activity-outbox",
 772                 "href": request.urlgen(
 773                     "mediagoblin.federation.feed",
 774                     username=user.username,
 775                     qualified=True
 776                 )
 777             }
 778         ])
 779     else:
 780         return json_error("Unrecognized resource parameter", status=404)
 781
 782
 783 def whoami(request):
 784     """ /api/whoami - HTTP redirect to API profile """
 785     if request.user is None:
 786         return json_error("Not logged in.", status=401)
 787
 788     profile = request.urlgen(
 789         "mediagoblin.federation.user.profile",
 790         username=request.user.username,
 791         qualified=True
 792     )
 793
 794     return redirect(request, location=profile)
 795
 796 @require_active_login
 797 def activity_view(request):
 798     """ /<username>/activity/<id> - Display activity
 799
 800     This should display a HTML presentation of the activity
 801     this is NOT an API endpoint.
 802     """
 803     # Get the user object.
 804     username = request.matchdict["username"]
 805     user = User.query.filter_by(username=username).first()
 806
 807     activity_id = request.matchdict["id"]
 808
 809     if request.user is None:
 810         return render_404(request)
 811
 812     activity = Activity.query.filter_by(
 813         id=activity_id,
 814         author=user.id
 815     ).first()
 816     if activity is None:
 817         return render_404(request)
 818
 819     return render_to_response(
 820         request,
 821         "mediagoblin/federation/activity.html",
 822         {"activity": activity}
 823     )
 824
 825