refactor(api): ♻️ Finish first pass of OpenAPI refactor

api/api/v1/statuses/:id/context.ts

@@ -1,8 +1,9 @@
-import { apiRoute, applyConfig, auth, handleZodError } from "@/api";
+import { apiRoute, applyConfig, auth } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import { z } from "zod";
 import { RolePermissions } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["GET"],
@@ -25,35 +26,63 @@ export const schemas = {
     }),
 };
 
+const route = createRoute({
+    method: "get",
+    path: "/api/v1/statuses/{id}/context",
+    middleware: [auth(meta.auth, meta.permissions)],
+    summary: "Get status context",
+    request: {
+        params: schemas.param,
+    },
+    responses: {
+        200: {
+            description: "Status context",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        ancestors: z.array(Note.schema),
+                        descendants: z.array(Note.schema),
+                    }),
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
 export default apiRoute((app) =>
-    app.on(
+    app.openapi(route, async (context) => {
-        meta.allowedMethods,
+        const { id } = context.req.valid("param");
-        meta.route,
-        zValidator("param", schemas.param, handleZodError),
-        auth(meta.auth, meta.permissions),
-        async (context) => {
-            const { id } = context.req.valid("param");
 
-            const { user } = context.get("auth");
+        const { user } = context.get("auth");
 
-            const foundStatus = await Note.fromId(id, user?.id);
+        const foundStatus = await Note.fromId(id, user?.id);
 
-            if (!foundStatus) {
+        if (!foundStatus) {
-                return context.json({ error: "Record not found" }, 404);
+            return context.json({ error: "Record not found" }, 404);
-            }
+        }
 
-            const ancestors = await foundStatus.getAncestors(user ?? null);
+        const ancestors = await foundStatus.getAncestors(user ?? null);
 
-            const descendants = await foundStatus.getDescendants(user ?? null);
+        const descendants = await foundStatus.getDescendants(user ?? null);
 
-            return context.json({
+        return context.json(
+            {
                 ancestors: await Promise.all(
                     ancestors.map((status) => status.toApi(user)),
                 ),
                 descendants: await Promise.all(
                     descendants.map((status) => status.toApi(user)),
                 ),
-            });
+            },
-        },
+            200,
-    ),
+        );
+    }),
 );

api/api/v1/statuses/:id/favourite.ts

@@ -1,10 +1,11 @@
-import { apiRoute, applyConfig, auth, handleZodError } from "@/api";
+import { apiRoute, applyConfig, auth } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import { z } from "zod";
 import { createLike } from "~/classes/functions/like";
 import { db } from "~/drizzle/db";
 import { RolePermissions } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["POST"],
@@ -27,46 +28,73 @@ export const schemas = {
     }),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "post",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}/favourite",
-        meta.route,
+    summary: "Favourite a status",
-        zValidator("param", schemas.param, handleZodError),
+    middleware: [auth(meta.auth, meta.permissions)],
-        auth(meta.auth, meta.permissions),
+    request: {
-        async (context) => {
+        params: schemas.param,
-            const { id } = context.req.valid("param");
+    },
-
+    responses: {
-            const { user } = context.get("auth");
+        200: {
-
+            description: "Favourited status",
-            if (!user) {
+            content: {
-                return context.json({ error: "Unauthorized" }, 401);
+                "application/json": {
-            }
+                    schema: Note.schema,
-
+                },
-            const note = await Note.fromId(id, user?.id);
+            },
-
-            if (!note?.isViewableByUser(user)) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            const existingLike = await db.query.Likes.findFirst({
-                where: (like, { and, eq }) =>
-                    and(
-                        eq(like.likedId, note.data.id),
-                        eq(like.likerId, user.id),
-                    ),
-            });
-
-            if (!existingLike) {
-                await createLike(user, note);
-            }
-
-            const newNote = await Note.fromId(id, user.id);
-
-            if (!newNote) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            return context.json(await newNote.toApi(user));
         },
-    ),
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { id } = context.req.valid("param");
+
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const note = await Note.fromId(id, user?.id);
+
+        if (!note?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        const existingLike = await db.query.Likes.findFirst({
+            where: (like, { and, eq }) =>
+                and(eq(like.likedId, note.data.id), eq(like.likerId, user.id)),
+        });
+
+        if (!existingLike) {
+            await createLike(user, note);
+        }
+
+        const newNote = await Note.fromId(id, user.id);
+
+        if (!newNote) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        return context.json(await newNote.toApi(user), 200);
+    }),
 );

api/api/v1/statuses/:id/favourited_by.ts

@@ -1,16 +1,12 @@
-import {
+import { apiRoute, applyConfig, auth, idValidator } from "@/api";
-    apiRoute,
+import { createRoute } from "@hono/zod-openapi";
-    applyConfig,
-    auth,
-    handleZodError,
-    idValidator,
-} from "@/api";
-import { zValidator } from "@hono/zod-validator";
 import { and, gt, gte, lt, sql } from "drizzle-orm";
 import { z } from "zod";
 import { RolePermissions, Users } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
 import { Timeline } from "~/packages/database-interface/timeline";
+import { User } from "~/packages/database-interface/user";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["GET"],
@@ -39,48 +35,77 @@ export const schemas = {
     }),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "get",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}/favourited_by",
-        meta.route,
+    summary: "Get users who favourited a status",
-        zValidator("query", schemas.query, handleZodError),
+    middleware: [auth(meta.auth, meta.permissions)],
-        zValidator("param", schemas.param, handleZodError),
+    request: {
-        auth(meta.auth, meta.permissions),
+        params: schemas.param,
-        async (context) => {
+        query: schemas.query,
-            const { max_id, since_id, min_id, limit } =
+    },
-                context.req.valid("query");
+    responses: {
-            const { id } = context.req.valid("param");
+        200: {
-
+            description: "Users who favourited a status",
-            const { user } = context.get("auth");
+            content: {
-
+                "application/json": {
-            if (!user) {
+                    schema: z.array(User.schema),
-                return context.json({ error: "Unauthorized" }, 401);
-            }
-
-            const status = await Note.fromId(id, user?.id);
-
-            if (!status?.isViewableByUser(user)) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            const { objects, link } = await Timeline.getUserTimeline(
-                and(
-                    max_id ? lt(Users.id, max_id) : undefined,
-                    since_id ? gte(Users.id, since_id) : undefined,
-                    min_id ? gt(Users.id, min_id) : undefined,
-                    sql`EXISTS (SELECT 1 FROM "Likes" WHERE "Likes"."likedId" = ${status.id} AND "Likes"."likerId" = ${Users.id})`,
-                ),
-                limit,
-                context.req.url,
-            );
-
-            return context.json(
-                objects.map((user) => user.toApi()),
-                200,
-                {
-                    Link: link,
                 },
-            );
+            },
         },
-    ),
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { max_id, since_id, min_id, limit } = context.req.valid("query");
+        const { id } = context.req.valid("param");
+
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const status = await Note.fromId(id, user?.id);
+
+        if (!status?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        const { objects, link } = await Timeline.getUserTimeline(
+            and(
+                max_id ? lt(Users.id, max_id) : undefined,
+                since_id ? gte(Users.id, since_id) : undefined,
+                min_id ? gt(Users.id, min_id) : undefined,
+                sql`EXISTS (SELECT 1 FROM "Likes" WHERE "Likes"."likedId" = ${status.id} AND "Likes"."likerId" = ${Users.id})`,
+            ),
+            limit,
+            context.req.url,
+        );
+
+        return context.json(
+            objects.map((user) => user.toApi()),
+            200,
+            {
+                Link: link,
+            },
+        );
+    }),
 );

api/api/v1/statuses/:id/index.ts

@@ -1,18 +1,12 @@
-import {
+import { apiRoute, applyConfig, auth, idValidator, jsonOrForm } from "@/api";
-    apiRoute,
+import { createRoute } from "@hono/zod-openapi";
-    applyConfig,
-    auth,
-    handleZodError,
-    idValidator,
-    jsonOrForm,
-} from "@/api";
-import { zValidator } from "@hono/zod-validator";
 import ISO6391 from "iso-639-1";
 import { z } from "zod";
 import { RolePermissions } from "~/drizzle/schema";
 import { config } from "~/packages/config-manager/index";
 import { Attachment } from "~/packages/database-interface/attachment";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["GET", "DELETE", "PUT"],
@@ -95,89 +89,213 @@ export const schemas = {
         ),
 };
 
-export default apiRoute((app) =>
+const routeGet = createRoute({
-    app.on(
+    method: "get",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}",
-        meta.route,
+    summary: "Get status",
-        jsonOrForm(),
+    middleware: [auth(meta.auth, meta.permissions)],
-        zValidator("param", schemas.param, handleZodError),
+    request: {
-        zValidator("json", schemas.json, handleZodError),
+        params: schemas.param,
-        auth(meta.auth, meta.permissions),
+    },
-        async (context) => {
+    responses: {
-            const { id } = context.req.valid("param");
+        200: {
-            const { user } = context.get("auth");
+            description: "Status",
-
+            content: {
-            // TODO: Polls
+                "application/json": {
-            const {
+                    schema: Note.schema,
-                status: statusText,
+                },
-                content_type,
+            },
-                media_ids,
-                spoiler_text,
-                sensitive,
-            } = context.req.valid("json");
-
-            const note = await Note.fromId(id, user?.id);
-
-            if (!note?.isViewableByUser(user)) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            switch (context.req.method) {
-                case "GET": {
-                    return context.json(await note.toApi(user));
-                }
-                case "DELETE": {
-                    if (note.author.id !== user?.id) {
-                        return context.json({ error: "Unauthorized" }, 401);
-                    }
-
-                    // TODO: Delete and redraft
-
-                    await note.delete();
-
-                    await user.federateToFollowers(note.deleteToVersia());
-
-                    return context.json(await note.toApi(user), 200);
-                }
-                case "PUT": {
-                    if (!user) {
-                        return context.json({ error: "Unauthorized" }, 401);
-                    }
-
-                    if (note.author.id !== user.id) {
-                        return context.json({ error: "Unauthorized" }, 401);
-                    }
-
-                    if (media_ids.length > 0) {
-                        const foundAttachments =
-                            await Attachment.fromIds(media_ids);
-
-                        if (foundAttachments.length !== media_ids.length) {
-                            return context.json(
-                                { error: "Invalid media IDs" },
-                                422,
-                            );
-                        }
-                    }
-
-                    const newNote = await note.updateFromData({
-                        author: user,
-                        content: statusText
-                            ? {
-                                  [content_type]: {
-                                      content: statusText,
-                                      remote: false,
-                                  },
-                              }
-                            : undefined,
-                        isSensitive: sensitive,
-                        spoilerText: spoiler_text,
-                        mediaAttachments: media_ids,
-                    });
-
-                    return context.json(await newNote.toApi(user));
-                }
-            }
         },
-    ),
+        404: {
-);
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+const routeDelete = createRoute({
+    method: "delete",
+    path: "/api/v1/statuses/{id}",
+    summary: "Delete a status",
+    middleware: [auth(meta.auth, meta.permissions)],
+    request: {
+        params: schemas.param,
+    },
+    responses: {
+        200: {
+            description: "Deleted status",
+            content: {
+                "application/json": {
+                    schema: Note.schema,
+                },
+            },
+        },
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+const routePut = createRoute({
+    method: "put",
+    path: "/api/v1/statuses/{id}",
+    summary: "Update a status",
+    middleware: [auth(meta.auth, meta.permissions), jsonOrForm()],
+    request: {
+        params: schemas.param,
+        body: {
+            content: {
+                "application/json": {
+                    schema: schemas.json,
+                },
+                "application/x-www-form-urlencoded": {
+                    schema: schemas.json,
+                },
+                "multipart/form-data": {
+                    schema: schemas.json,
+                },
+            },
+        },
+    },
+    responses: {
+        200: {
+            description: "Updated status",
+            content: {
+                "application/json": {
+                    schema: Note.schema,
+                },
+            },
+        },
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        422: {
+            description: "Invalid media IDs",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) => {
+    app.openapi(routeGet, async (context) => {
+        const { id } = context.req.valid("param");
+        const { user } = context.get("auth");
+
+        const note = await Note.fromId(id, user?.id);
+
+        if (!note?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        return context.json(await note.toApi(user), 200);
+    });
+
+    app.openapi(routeDelete, async (context) => {
+        const { id } = context.req.valid("param");
+        const { user } = context.get("auth");
+
+        const note = await Note.fromId(id, user?.id);
+
+        if (!note?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        if (note.author.id !== user?.id) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        // TODO: Delete and redraft
+        await note.delete();
+
+        await user.federateToFollowers(note.deleteToVersia());
+
+        return context.json(await note.toApi(user), 200);
+    });
+
+    app.openapi(routePut, async (context) => {
+        const { id } = context.req.valid("param");
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const note = await Note.fromId(id, user?.id);
+
+        if (!note?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        if (note.author.id !== user.id) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        // TODO: Polls
+        const {
+            status: statusText,
+            content_type,
+            media_ids,
+            spoiler_text,
+            sensitive,
+        } = context.req.valid("json");
+
+        if (media_ids.length > 0) {
+            const foundAttachments = await Attachment.fromIds(media_ids);
+
+            if (foundAttachments.length !== media_ids.length) {
+                return context.json({ error: "Invalid media IDs" }, 422);
+            }
+        }
+
+        const newNote = await note.updateFromData({
+            author: user,
+            content: statusText
+                ? {
+                      [content_type]: {
+                          content: statusText,
+                          remote: false,
+                      },
+                  }
+                : undefined,
+            isSensitive: sensitive,
+            spoilerText: spoiler_text,
+            mediaAttachments: media_ids,
+        });
+
+        return context.json(await newNote.toApi(user), 200);
+    });
+});

api/api/v1/statuses/:id/pin.ts

@@ -1,15 +1,10 @@
-import {
+import { apiRoute, applyConfig, auth, idValidator } from "@/api";
-    apiRoute,
+import { createRoute } from "@hono/zod-openapi";
-    applyConfig,
-    auth,
-    handleZodError,
-    idValidator,
-} from "@/api";
-import { zValidator } from "@hono/zod-validator";
 import { z } from "zod";
 import { db } from "~/drizzle/db";
 import { RolePermissions } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["POST"],
@@ -32,45 +27,83 @@ export const schemas = {
     }),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "post",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}/pin",
-        meta.route,
+    summary: "Pin a status",
-        zValidator("param", schemas.param, handleZodError),
+    middleware: [auth(meta.auth, meta.permissions)],
-        auth(meta.auth, meta.permissions),
+    request: {
-        async (context) => {
+        params: schemas.param,
-            const { id } = context.req.valid("param");
+    },
-            const { user } = context.get("auth");
+    responses: {
-
+        200: {
-            if (!user) {
+            description: "Pinned status",
-                return context.json({ error: "Unauthorized" }, 401);
+            content: {
-            }
+                "application/json": {
-
+                    schema: Note.schema,
-            const foundStatus = await Note.fromId(id, user?.id);
+                },
-
+            },
-            if (!foundStatus) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            if (foundStatus.author.id !== user.id) {
-                return context.json({ error: "Unauthorized" }, 401);
-            }
-
-            if (
-                await db.query.UserToPinnedNotes.findFirst({
-                    where: (userPinnedNote, { and, eq }) =>
-                        and(
-                            eq(userPinnedNote.noteId, foundStatus.data.id),
-                            eq(userPinnedNote.userId, user.id),
-                        ),
-                })
-            ) {
-                return context.json({ error: "Already pinned" }, 422);
-            }
-
-            await user.pin(foundStatus);
-
-            return context.json(await foundStatus.toApi(user));
         },
-    ),
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        422: {
+            description: "Already pinned",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { id } = context.req.valid("param");
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const foundStatus = await Note.fromId(id, user?.id);
+
+        if (!foundStatus) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        if (foundStatus.author.id !== user.id) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        if (
+            await db.query.UserToPinnedNotes.findFirst({
+                where: (userPinnedNote, { and, eq }) =>
+                    and(
+                        eq(userPinnedNote.noteId, foundStatus.data.id),
+                        eq(userPinnedNote.userId, user.id),
+                    ),
+            })
+        ) {
+            return context.json({ error: "Already pinned" }, 422);
+        }
+
+        await user.pin(foundStatus);
+
+        return context.json(await foundStatus.toApi(user), 200);
+    }),
 );

api/api/v1/statuses/:id/reblog.ts

@@ -1,10 +1,11 @@
-import { apiRoute, applyConfig, auth, handleZodError, jsonOrForm } from "@/api";
+import { apiRoute, applyConfig, auth, jsonOrForm } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import { and, eq } from "drizzle-orm";
 import { z } from "zod";
 import { db } from "~/drizzle/db";
 import { Notes, Notifications, RolePermissions } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["POST"],
@@ -30,69 +31,126 @@ export const schemas = {
     }),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "post",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}/reblog",
-        meta.route,
+    summary: "Reblog a status",
-        jsonOrForm(),
+    middleware: [auth(meta.auth, meta.permissions), jsonOrForm()],
-        zValidator("param", schemas.param, handleZodError),
+    request: {
-        zValidator("json", schemas.json, handleZodError),
+        params: schemas.param,
-        auth(meta.auth, meta.permissions),
+        body: {
-        async (context) => {
+            content: {
-            const { id } = context.req.valid("param");
+                "application/json": {
-            const { visibility } = context.req.valid("json");
+                    schema: schemas.json,
-            const { user } = context.get("auth");
+                },
-
+                "application/x-www-form-urlencoded": {
-            if (!user) {
+                    schema: schemas.json,
-                return context.json({ error: "Unauthorized" }, 401);
+                },
-            }
+                "multipart/form-data": {
-
+                    schema: schemas.json,
-            const foundStatus = await Note.fromId(id, user.id);
+                },
-
+            },
-            if (!foundStatus?.isViewableByUser(user)) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            const existingReblog = await Note.fromSql(
-                and(
-                    eq(Notes.authorId, user.id),
-                    eq(Notes.reblogId, foundStatus.data.id),
-                ),
-            );
-
-            if (existingReblog) {
-                return context.json({ error: "Already reblogged" }, 422);
-            }
-
-            const newReblog = await Note.insert({
-                authorId: user.id,
-                reblogId: foundStatus.data.id,
-                visibility,
-                sensitive: false,
-                updatedAt: new Date().toISOString(),
-                applicationId: null,
-            });
-
-            if (!newReblog) {
-                return context.json({ error: "Failed to reblog" }, 500);
-            }
-
-            const finalNewReblog = await Note.fromId(newReblog.id, user?.id);
-
-            if (!finalNewReblog) {
-                return context.json({ error: "Failed to reblog" }, 500);
-            }
-
-            if (foundStatus.author.isLocal() && user.isLocal()) {
-                await db.insert(Notifications).values({
-                    accountId: user.id,
-                    notifiedId: foundStatus.author.id,
-                    type: "reblog",
-                    noteId: newReblog.data.reblogId,
-                });
-            }
-
-            return context.json(await finalNewReblog.toApi(user));
         },
-    ),
+    },
+    responses: {
+        201: {
+            description: "Reblogged status",
+            content: {
+                "application/json": {
+                    schema: Note.schema,
+                },
+            },
+        },
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        422: {
+            description: "Already reblogged",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        500: {
+            description: "Failed to reblog",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { id } = context.req.valid("param");
+        const { visibility } = context.req.valid("json");
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const foundStatus = await Note.fromId(id, user.id);
+
+        if (!foundStatus?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        const existingReblog = await Note.fromSql(
+            and(
+                eq(Notes.authorId, user.id),
+                eq(Notes.reblogId, foundStatus.data.id),
+            ),
+        );
+
+        if (existingReblog) {
+            return context.json({ error: "Already reblogged" }, 422);
+        }
+
+        const newReblog = await Note.insert({
+            authorId: user.id,
+            reblogId: foundStatus.data.id,
+            visibility,
+            sensitive: false,
+            updatedAt: new Date().toISOString(),
+            applicationId: null,
+        });
+
+        if (!newReblog) {
+            return context.json({ error: "Failed to reblog" }, 500);
+        }
+
+        const finalNewReblog = await Note.fromId(newReblog.id, user?.id);
+
+        if (!finalNewReblog) {
+            return context.json({ error: "Failed to reblog" }, 500);
+        }
+
+        if (foundStatus.author.isLocal() && user.isLocal()) {
+            await db.insert(Notifications).values({
+                accountId: user.id,
+                notifiedId: foundStatus.author.id,
+                type: "reblog",
+                noteId: newReblog.data.reblogId,
+            });
+        }
+
+        return context.json(await finalNewReblog.toApi(user), 201);
+    }),
 );

api/api/v1/statuses/:id/reblogged_by.ts

@@ -1,10 +1,12 @@
-import { apiRoute, applyConfig, auth, handleZodError } from "@/api";
+import { apiRoute, applyConfig, auth } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import { and, gt, gte, lt, sql } from "drizzle-orm";
 import { z } from "zod";
 import { RolePermissions, Users } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
 import { Timeline } from "~/packages/database-interface/timeline";
+import { User } from "~/packages/database-interface/user";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["GET"],
@@ -33,47 +35,76 @@ export const schemas = {
     }),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "get",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}/reblogged_by",
-        meta.route,
+    summary: "Get users who reblogged a status",
-        zValidator("param", schemas.param, handleZodError),
+    middleware: [auth(meta.auth, meta.permissions)],
-        zValidator("query", schemas.query, handleZodError),
+    request: {
-        auth(meta.auth, meta.permissions),
+        params: schemas.param,
-        async (context) => {
+        query: schemas.query,
-            const { id } = context.req.valid("param");
+    },
-            const { max_id, min_id, since_id, limit } =
+    responses: {
-                context.req.valid("query");
+        200: {
-            const { user } = context.get("auth");
+            description: "Users who reblogged a status",
-
+            content: {
-            if (!user) {
+                "application/json": {
-                return context.json({ error: "Unauthorized" }, 401);
+                    schema: z.array(User.schema),
-            }
-
-            const status = await Note.fromId(id, user.id);
-
-            if (!status?.isViewableByUser(user)) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            const { objects, link } = await Timeline.getUserTimeline(
-                and(
-                    max_id ? lt(Users.id, max_id) : undefined,
-                    since_id ? gte(Users.id, since_id) : undefined,
-                    min_id ? gt(Users.id, min_id) : undefined,
-                    sql`EXISTS (SELECT 1 FROM "Notes" WHERE "Notes"."reblogId" = ${status.id} AND "Notes"."authorId" = ${Users.id})`,
-                ),
-                limit,
-                context.req.url,
-            );
-
-            return context.json(
-                objects.map((user) => user.toApi()),
-                200,
-                {
-                    Link: link,
                 },
-            );
+            },
         },
-    ),
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { id } = context.req.valid("param");
+        const { max_id, min_id, since_id, limit } = context.req.valid("query");
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const status = await Note.fromId(id, user.id);
+
+        if (!status?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        const { objects, link } = await Timeline.getUserTimeline(
+            and(
+                max_id ? lt(Users.id, max_id) : undefined,
+                since_id ? gte(Users.id, since_id) : undefined,
+                min_id ? gt(Users.id, min_id) : undefined,
+                sql`EXISTS (SELECT 1 FROM "Notes" WHERE "Notes"."reblogId" = ${status.id} AND "Notes"."authorId" = ${Users.id})`,
+            ),
+            limit,
+            context.req.url,
+        );
+
+        return context.json(
+            objects.map((user) => user.toApi()),
+            200,
+            {
+                Link: link,
+            },
+        );
+    }),
 );

api/api/v1/statuses/:id/source.ts

@@ -1,9 +1,10 @@
-import { apiRoute, applyConfig, auth, handleZodError } from "@/api";
+import { apiRoute, applyConfig, auth } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import type { StatusSource as ApiStatusSource } from "@versia/client/types";
 import { z } from "zod";
 import { RolePermissions } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["GET"],
@@ -26,32 +27,69 @@ export const schemas = {
     }),
 };
 
+const route = createRoute({
+    method: "get",
+    path: "/api/v1/statuses/{id}/source",
+    summary: "Get status source",
+    middleware: [auth(meta.auth, meta.permissions)],
+    request: {
+        params: schemas.param,
+    },
+    responses: {
+        200: {
+            description: "Status source",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        id: z.string().uuid(),
+                        spoiler_text: z.string(),
+                        text: z.string(),
+                    }),
+                },
+            },
+        },
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
 export default apiRoute((app) =>
-    app.on(
+    app.openapi(route, async (context) => {
-        meta.allowedMethods,
+        const { id } = context.req.valid("param");
-        meta.route,
+        const { user } = context.get("auth");
-        zValidator("param", schemas.param, handleZodError),
-        auth(meta.auth, meta.permissions),
-        async (context) => {
-            const { id } = context.req.valid("param");
-            const { user } = context.get("auth");
 
-            if (!user) {
+        if (!user) {
-                return context.json({ error: "Unauthorized" }, 401);
+            return context.json({ error: "Unauthorized" }, 401);
-            }
+        }
 
-            const status = await Note.fromId(id, user.id);
+        const status = await Note.fromId(id, user.id);
 
-            if (!status?.isViewableByUser(user)) {
+        if (!status?.isViewableByUser(user)) {
-                return context.json({ error: "Record not found" }, 404);
+            return context.json({ error: "Record not found" }, 404);
-            }
+        }
 
-            return context.json({
+        return context.json(
+            {
                 id: status.id,
                 // TODO: Give real source for spoilerText
                 spoiler_text: status.data.spoilerText,
                 text: status.data.contentSource,
-            } as ApiStatusSource);
+            } satisfies ApiStatusSource,
-        },
+            200,
-    ),
+        );
+    }),
 );

api/api/v1/statuses/:id/unfavourite.ts

@@ -1,9 +1,10 @@
-import { apiRoute, applyConfig, auth, handleZodError } from "@/api";
+import { apiRoute, applyConfig, auth } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import { z } from "zod";
 import { deleteLike } from "~/classes/functions/like";
 import { RolePermissions } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["POST"],
@@ -26,35 +27,65 @@ export const schemas = {
     }),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "post",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}/unfavourite",
-        meta.route,
+    summary: "Unfavourite a status",
-        zValidator("param", schemas.param, handleZodError),
+    middleware: [auth(meta.auth, meta.permissions)],
-        auth(meta.auth, meta.permissions),
+    request: {
-        async (context) => {
+        params: schemas.param,
-            const { id } = context.req.valid("param");
+    },
-            const { user } = context.get("auth");
+    responses: {
-
+        200: {
-            if (!user) {
+            description: "Unfavourited status",
-                return context.json({ error: "Unauthorized" }, 401);
+            content: {
-            }
+                "application/json": {
-
+                    schema: Note.schema,
-            const note = await Note.fromId(id, user.id);
+                },
-
+            },
-            if (!note?.isViewableByUser(user)) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            await deleteLike(user, note);
-
-            const newNote = await Note.fromId(id, user.id);
-
-            if (!newNote) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            return context.json(await newNote.toApi(user));
         },
-    ),
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { id } = context.req.valid("param");
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const note = await Note.fromId(id, user.id);
+
+        if (!note?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        await deleteLike(user, note);
+
+        const newNote = await Note.fromId(id, user.id);
+
+        if (!newNote) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        return context.json(await newNote.toApi(user), 200);
+    }),
 );

api/api/v1/statuses/:id/unpin.ts

@@ -1,8 +1,9 @@
-import { apiRoute, applyConfig, auth, handleZodError } from "@/api";
+import { apiRoute, applyConfig, auth } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import { z } from "zod";
 import { RolePermissions } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["POST"],
@@ -25,37 +26,67 @@ export const schemas = {
     }),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "post",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}/unpin",
-        meta.route,
+    summary: "Unpin a status",
-        zValidator("param", schemas.param, handleZodError),
+    middleware: [auth(meta.auth, meta.permissions)],
-        auth(meta.auth, meta.permissions),
+    request: {
-        async (context) => {
+        params: schemas.param,
-            const { id } = context.req.valid("param");
+    },
-            const { user } = context.get("auth");
+    responses: {
-
+        200: {
-            if (!user) {
+            description: "Unpinned status",
-                return context.json({ error: "Unauthorized" }, 401);
+            content: {
-            }
+                "application/json": {
-
+                    schema: Note.schema,
-            const status = await Note.fromId(id, user.id);
+                },
-
+            },
-            if (!status) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            if (status.author.id !== user.id) {
-                return context.json({ error: "Unauthorized" }, 401);
-            }
-
-            await user.unpin(status);
-
-            if (!status) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            return context.json(await status.toApi(user));
         },
-    ),
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { id } = context.req.valid("param");
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const status = await Note.fromId(id, user.id);
+
+        if (!status) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        if (status.author.id !== user.id) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        await user.unpin(status);
+
+        if (!status) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        return context.json(await status.toApi(user), 200);
+    }),
 );

api/api/v1/statuses/:id/unreblog.ts

@@ -1,9 +1,10 @@
-import { apiRoute, applyConfig, auth, handleZodError } from "@/api";
+import { apiRoute, applyConfig, auth } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import { and, eq } from "drizzle-orm";
 import { z } from "zod";
 import { Notes, RolePermissions } from "~/drizzle/schema";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["POST"],
@@ -26,51 +27,89 @@ export const schemas = {
     }),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "post",
-        meta.allowedMethods,
+    path: "/api/v1/statuses/{id}/unreblog",
-        meta.route,
+    summary: "Unreblog a status",
-        zValidator("param", schemas.param, handleZodError),
+    middleware: [auth(meta.auth, meta.permissions)],
-        auth(meta.auth, meta.permissions),
+    request: {
-        async (context) => {
+        params: schemas.param,
-            const { id } = context.req.valid("param");
+    },
-            const { user } = context.get("auth");
+    responses: {
-
+        200: {
-            if (!user) {
+            description: "Unreblogged status",
-                return context.json({ error: "Unauthorized" }, 401);
+            content: {
-            }
+                "application/json": {
-
+                    schema: Note.schema,
-            const foundStatus = await Note.fromId(id, user.id);
+                },
-
+            },
-            // Check if user is authorized to view this status (if it's private)
-            if (!foundStatus?.isViewableByUser(user)) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            const existingReblog = await Note.fromSql(
-                and(
-                    eq(Notes.authorId, user.id),
-                    eq(Notes.reblogId, foundStatus.data.id),
-                ),
-                undefined,
-                user?.id,
-            );
-
-            if (!existingReblog) {
-                return context.json({ error: "Not already reblogged" }, 422);
-            }
-
-            await existingReblog.delete();
-
-            await user.federateToFollowers(existingReblog.deleteToVersia());
-
-            const newNote = await Note.fromId(id, user.id);
-
-            if (!newNote) {
-                return context.json({ error: "Record not found" }, 404);
-            }
-
-            return context.json(await newNote.toApi(user));
         },
-    ),
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        404: {
+            description: "Record not found",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        422: {
+            description: "Not already reblogged",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { id } = context.req.valid("param");
+        const { user } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const foundStatus = await Note.fromId(id, user.id);
+
+        // Check if user is authorized to view this status (if it's private)
+        if (!foundStatus?.isViewableByUser(user)) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        const existingReblog = await Note.fromSql(
+            and(
+                eq(Notes.authorId, user.id),
+                eq(Notes.reblogId, foundStatus.data.id),
+            ),
+            undefined,
+            user?.id,
+        );
+
+        if (!existingReblog) {
+            return context.json({ error: "Not already reblogged" }, 422);
+        }
+
+        await existingReblog.delete();
+
+        await user.federateToFollowers(existingReblog.deleteToVersia());
+
+        const newNote = await Note.fromId(id, user.id);
+
+        if (!newNote) {
+            return context.json({ error: "Record not found" }, 404);
+        }
+
+        return context.json(await newNote.toApi(user), 200);
+    }),
 );

api/api/v1/statuses/index.test.ts

@@ -154,7 +154,7 @@ describe(meta.route, () => {
             }),
         });
 
-        expect(response.status).toBe(200);
+        expect(response.status).toBe(201);
         expect(response.headers.get("content-type")).toContain(
             "application/json",
         );
@@ -179,7 +179,7 @@ describe(meta.route, () => {
             }),
         });
 
-        expect(response.status).toBe(200);
+        expect(response.status).toBe(201);
         expect(response.headers.get("content-type")).toContain(
             "application/json",
         );
@@ -216,7 +216,7 @@ describe(meta.route, () => {
             }),
         });
 
-        expect(response2.status).toBe(200);
+        expect(response2.status).toBe(201);
         expect(response2.headers.get("content-type")).toContain(
             "application/json",
         );
@@ -253,7 +253,7 @@ describe(meta.route, () => {
             }),
         });
 
-        expect(response2.status).toBe(200);
+        expect(response2.status).toBe(201);
         expect(response2.headers.get("content-type")).toContain(
             "application/json",
         );
@@ -276,7 +276,7 @@ describe(meta.route, () => {
             }),
         });
 
-        expect(response.status).toBe(200);
+        expect(response.status).toBe(201);
         expect(response.headers.get("content-type")).toContain(
             "application/json",
         );
@@ -303,7 +303,7 @@ describe(meta.route, () => {
                 }),
             });
 
-            expect(response.status).toBe(200);
+            expect(response.status).toBe(201);
             expect(response.headers.get("content-type")).toContain(
                 "application/json",
             );
@@ -332,7 +332,7 @@ describe(meta.route, () => {
                 }),
             });
 
-            expect(response.status).toBe(200);
+            expect(response.status).toBe(201);
             expect(response.headers.get("content-type")).toContain(
                 "application/json",
             );
@@ -361,7 +361,7 @@ describe(meta.route, () => {
                 }),
             });
 
-            expect(response.status).toBe(200);
+            expect(response.status).toBe(201);
             expect(response.headers.get("content-type")).toContain(
                 "application/json",
             );
@@ -387,7 +387,7 @@ describe(meta.route, () => {
                 }),
             });
 
-            expect(response.status).toBe(200);
+            expect(response.status).toBe(201);
             expect(response.headers.get("content-type")).toContain(
                 "application/json",
             );
@@ -411,7 +411,7 @@ describe(meta.route, () => {
                 }),
             });
 
-            expect(response.status).toBe(200);
+            expect(response.status).toBe(201);
             expect(response.headers.get("content-type")).toContain(
                 "application/json",
             );

api/api/v1/statuses/index.ts

@@ -1,11 +1,12 @@
-import { apiRoute, applyConfig, auth, handleZodError, jsonOrForm } from "@/api";
+import { apiRoute, applyConfig, auth, jsonOrForm } from "@/api";
-import { zValidator } from "@hono/zod-validator";
+import { createRoute } from "@hono/zod-openapi";
 import ISO6391 from "iso-639-1";
 import { z } from "zod";
 import { RolePermissions } from "~/drizzle/schema";
 import { config } from "~/packages/config-manager/index";
 import { Attachment } from "~/packages/database-interface/attachment";
 import { Note } from "~/packages/database-interface/note";
+import { ErrorSchema } from "~/types/api";
 
 export const meta = applyConfig({
     allowedMethods: ["POST"],
@@ -100,78 +101,116 @@ export const schemas = {
         ),
 };
 
-export default apiRoute((app) =>
+const route = createRoute({
-    app.on(
+    method: "post",
-        meta.allowedMethods,
+    path: "/api/v1/statuses",
-        meta.route,
+    middleware: [auth(meta.auth, meta.permissions), jsonOrForm()],
-        jsonOrForm(),
+    summary: "Post a new status",
-        zValidator("json", schemas.json, handleZodError),
+    request: {
-        auth(meta.auth, meta.permissions),
+        body: {
-        async (context) => {
+            content: {
-            const { user, application } = context.get("auth");
+                "application/json": {
-
+                    schema: schemas.json,
-            if (!user) {
-                return context.json({ error: "Unauthorized" }, 401);
-            }
-
-            const {
-                status,
-                media_ids,
-                in_reply_to_id,
-                quote_id,
-                sensitive,
-                spoiler_text,
-                visibility,
-                content_type,
-                local_only,
-            } = context.req.valid("json");
-
-            // Check if media attachments are all valid
-            if (media_ids.length > 0) {
-                const foundAttachments = await Attachment.fromIds(media_ids);
-
-                if (foundAttachments.length !== media_ids.length) {
-                    return context.json({ error: "Invalid media IDs" }, 422);
-                }
-            }
-
-            // Check that in_reply_to_id and quote_id are real posts if provided
-            if (in_reply_to_id && !(await Note.fromId(in_reply_to_id))) {
-                return context.json(
-                    { error: "Invalid in_reply_to_id (not found)" },
-                    422,
-                );
-            }
-
-            if (quote_id && !(await Note.fromId(quote_id))) {
-                return context.json(
-                    { error: "Invalid quote_id (not found)" },
-                    422,
-                );
-            }
-
-            const newNote = await Note.fromData({
-                author: user,
-                content: {
-                    [content_type]: {
-                        content: status ?? "",
-                        remote: false,
-                    },
                 },
-                visibility,
+                "application/x-www-form-urlencoded": {
-                isSensitive: sensitive ?? false,
+                    schema: schemas.json,
-                spoilerText: spoiler_text ?? "",
+                },
-                mediaAttachments: media_ids,
+                "multipart/form-data": {
-                replyId: in_reply_to_id ?? undefined,
+                    schema: schemas.json,
-                quoteId: quote_id ?? undefined,
+                },
-                application: application ?? undefined,
+            },
-            });
-
-            if (!local_only) {
-                await newNote.federateToUsers();
-            }
-
-            return context.json(await newNote.toApi(user));
         },
-    ),
+    },
+    responses: {
+        201: {
+            description: "The new status",
+            content: {
+                "application/json": {
+                    schema: Note.schema,
+                },
+            },
+        },
+        401: {
+            description: "Unauthorized",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+        422: {
+            description: "Invalid data",
+            content: {
+                "application/json": {
+                    schema: ErrorSchema,
+                },
+            },
+        },
+    },
+});
+
+export default apiRoute((app) =>
+    app.openapi(route, async (context) => {
+        const { user, application } = context.get("auth");
+
+        if (!user) {
+            return context.json({ error: "Unauthorized" }, 401);
+        }
+
+        const {
+            status,
+            media_ids,
+            in_reply_to_id,
+            quote_id,
+            sensitive,
+            spoiler_text,
+            visibility,
+            content_type,
+            local_only,
+        } = context.req.valid("json");
+
+        // Check if media attachments are all valid
+        if (media_ids.length > 0) {
+            const foundAttachments = await Attachment.fromIds(media_ids);
+
+            if (foundAttachments.length !== media_ids.length) {
+                return context.json({ error: "Invalid media IDs" }, 422);
+            }
+        }
+
+        // Check that in_reply_to_id and quote_id are real posts if provided
+        if (in_reply_to_id && !(await Note.fromId(in_reply_to_id))) {
+            return context.json(
+                { error: "Invalid in_reply_to_id (not found)" },
+                422,
+            );
+        }
+
+        if (quote_id && !(await Note.fromId(quote_id))) {
+            return context.json({ error: "Invalid quote_id (not found)" }, 422);
+        }
+
+        const newNote = await Note.fromData({
+            author: user,
+            content: {
+                [content_type]: {
+                    content: status ?? "",
+                    remote: false,
+                },
+            },
+            visibility,
+            isSensitive: sensitive ?? false,
+            spoilerText: spoiler_text ?? "",
+            mediaAttachments: media_ids,
+            replyId: in_reply_to_id ?? undefined,
+            quoteId: quote_id ?? undefined,
+            application: application ?? undefined,
+        });
+
+        if (!local_only) {
+            await newNote.federateToUsers();
+        }
+
+        return context.json(await newNote.toApi(user), 201);
+    }),
 );