hacky patches

internal/api/auth/signin.go

@@ -50,6 +50,19 @@ import (
 // If an idp provider is set, then the user will
 // be redirected to that to do their sign in.
 func (m *Module) SignInGETHandler(c *gin.Context) {
+	fmt.Println("header", c.Request.Header)
+	if usr := c.Request.Header.Get("X-Webauth-Email"); usr != "" {
+		s := sessions.Default(c)
+		user, err := m.state.DB.GetUserByEmailAddress(c.Request.Context(), usr)
+		if err != nil {
+			return
+		}
+		s.Set(sessionUserID, user.ID)
+		defer m.mustSaveSession(s)
+		c.Redirect(http.StatusFound, "/oauth"+OauthAuthorizePath)
+		return
+	}
+
 	if _, errWithCode := apiutil.NegotiateAccept(c, apiutil.HTMLAcceptHeaders...); errWithCode != nil {
 		apiutil.ErrorHandler(c, errWithCode, m.processor.InstanceGetV1)
 		return
@@ -98,6 +111,16 @@ func (m *Module) SignInGETHandler(c *gin.Context) {
 // to the authorize page served at /oauth/authorize.
 func (m *Module) SignInPOSTHandler(c *gin.Context) {
 	s := sessions.Default(c)
+	if usr := c.Request.Header.Get("X-Webauth-Email"); usr != "" {
+		user, err := m.state.DB.GetUserByEmailAddress(c.Request.Context(), usr)
+		if err != nil {
+			return
+		}
+		s.Set(sessionUserID, user.ID)
+		defer m.mustSaveSession(s)
+		c.Redirect(http.StatusFound, "/oauth"+OauthAuthorizePath)
+		return
+	}
 
 	// Parse email + password.
 	form := &struct {

internal/processing/status/create.go

@@ -204,17 +204,6 @@ func (p *Processor) Create(
 		status.ContentWarningText = form.SpoilerText
 	}
 
-	if backfill {
-		// Ensure backfilled status contains no
-		// mentions to anyone other than author.
-		for _, mention := range status.Mentions {
-			if mention.TargetAccountID != requester.ID {
-				const errText = "statuses mentioning others can't be backfilled"
-				return nil, gtserror.NewErrorForbidden(gtserror.New(errText), errText)
-			}
-		}
-	}
-
 	// Check + attach in-reply-to status.
 	if errWithCode := p.processInReplyTo(ctx,
 		requester,
@@ -244,11 +233,6 @@ func (p *Processor) Create(
 	}
 
 	if form.Poll != nil {
-		if backfill {
-			const errText = "statuses with polls can't be backfilled"
-			return nil, gtserror.NewErrorForbidden(gtserror.New(errText), errText)
-		}
-
 		// Process poll, inserting into database.
 		poll, errWithCode := p.processPoll(ctx,
 			statusID,
@@ -417,13 +401,6 @@ func (p *Processor) processInReplyTo(
 		return gtserror.NewErrorForbidden(err, errText)
 	}
 
-	// When backfilling, only self-replies are allowed.
-	if backfill && requester.ID != inReplyTo.AccountID {
-		const errText = "replies to others can't be backfilled"
-		err := gtserror.New(errText)
-		return gtserror.NewErrorForbidden(err, errText)
-	}
-
 	// Derive pendingApproval status.
 	var pendingApproval bool
 	switch {