feat: require credentials for various endpoints (#3)

2025-12-20 04:04:16 +00:00 · 2025-05-19 16:34:06 +00:00
parent df322ebadc
commit 60af374a81
58 changed files with 228 additions and 114 deletions
--- a/packages/backend/src/server/api/endpoints/announcements.ts
+++ b/packages/backend/src/server/api/endpoints/announcements.ts
@@ -14,7 +14,7 @@ import type { AnnouncementsRepository } from '@/models/_.js';
 export const meta = {
 	tags: ['meta'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/announcements/show.ts
+++ b/packages/backend/src/server/api/endpoints/announcements/show.ts
@@ -12,7 +12,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['meta'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'object',
--- a/packages/backend/src/server/api/endpoints/channels/featured.ts
+++ b/packages/backend/src/server/api/endpoints/channels/featured.ts
@@ -12,7 +12,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['channels'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/channels/search.ts
+++ b/packages/backend/src/server/api/endpoints/channels/search.ts
@@ -15,7 +15,7 @@ import { sqlLikeEscape } from '@/misc/sql-like-escape.js';
 export const meta = {
 	tags: ['channels'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/channels/show.ts
+++ b/packages/backend/src/server/api/endpoints/channels/show.ts
@@ -13,7 +13,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['channels'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'object',
--- a/packages/backend/src/server/api/endpoints/channels/timeline.ts
+++ b/packages/backend/src/server/api/endpoints/channels/timeline.ts
@@ -19,7 +19,7 @@ import { Brackets } from 'typeorm';
 export const meta = {
 	tags: ['notes', 'channels'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/clips/notes.ts
+++ b/packages/backend/src/server/api/endpoints/clips/notes.ts
@@ -14,7 +14,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['account', 'notes', 'clips'],

-	requireCredential: false,
+	requireCredential: true,

 	kind: 'read:account',

--- a/packages/backend/src/server/api/endpoints/clips/show.ts
+++ b/packages/backend/src/server/api/endpoints/clips/show.ts
@@ -13,7 +13,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['clips', 'account'],

-	requireCredential: false,
+	requireCredential: true,

 	kind: 'read:account',

--- a/packages/backend/src/server/api/endpoints/emoji.ts
+++ b/packages/backend/src/server/api/endpoints/emoji.ts
@@ -13,7 +13,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['meta'],

-	requireCredential: false,
+	requireCredential: true,
 	allowGet: true,
 	cacheSec: 3600,

--- a/packages/backend/src/server/api/endpoints/emojis.ts
+++ b/packages/backend/src/server/api/endpoints/emojis.ts
@@ -12,7 +12,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['meta'],

-	requireCredential: false,
+	requireCredential: true,
 	allowGet: true,
 	cacheSec: 3600,

--- a/packages/backend/src/server/api/endpoints/endpoint.ts
+++ b/packages/backend/src/server/api/endpoints/endpoint.ts
@@ -8,7 +8,7 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import endpoints from '../endpoints.js';

 export const meta = {
-	requireCredential: false,
+	requireCredential: true,

 	tags: ['meta'],

--- a/packages/backend/src/server/api/endpoints/endpoints.ts
+++ b/packages/backend/src/server/api/endpoints/endpoints.ts
@@ -8,7 +8,7 @@ import { Endpoint } from '@/server/api/endpoint-base.js';
 import endpoints from '../endpoints.js';

 export const meta = {
-	requireCredential: false,
+	requireCredential: true,

 	tags: ['meta'],

--- a/packages/backend/src/server/api/endpoints/fetch-rss.ts
+++ b/packages/backend/src/server/api/endpoints/fetch-rss.ts
@@ -13,7 +13,7 @@ import type { FeedItem } from 'domutils';
 export const meta = {
 	tags: ['meta'],

-	requireCredential: false,
+	requireCredential: true,
 	allowGet: true,
 	cacheSec: 60 * 3,

--- a/packages/backend/src/server/api/endpoints/hashtags/list.ts
+++ b/packages/backend/src/server/api/endpoints/hashtags/list.ts
@@ -12,7 +12,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['hashtags'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/hashtags/search.ts
+++ b/packages/backend/src/server/api/endpoints/hashtags/search.ts
@@ -12,7 +12,7 @@ import { sqlLikeEscape } from '@/misc/sql-like-escape.js';
 export const meta = {
 	tags: ['hashtags'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/hashtags/show.ts
+++ b/packages/backend/src/server/api/endpoints/hashtags/show.ts
@@ -14,7 +14,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['hashtags'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'object',
--- a/packages/backend/src/server/api/endpoints/hashtags/trend.ts
+++ b/packages/backend/src/server/api/endpoints/hashtags/trend.ts
@@ -12,7 +12,7 @@ import { HashtagService } from '@/core/HashtagService.js';
 export const meta = {
 	tags: ['hashtags'],

-	requireCredential: false,
+	requireCredential: true,
 	allowGet: true,
 	cacheSec: 60 * 1,

--- a/packages/backend/src/server/api/endpoints/hashtags/users.ts
+++ b/packages/backend/src/server/api/endpoints/hashtags/users.ts
@@ -13,7 +13,7 @@ import { DI } from '@/di-symbols.js';
 import { RoleService } from '@/core/RoleService.js';

 export const meta = {
-	requireCredential: false,
+	requireCredential: true,

 	tags: ['hashtags', 'users'],

--- a/packages/backend/src/server/api/endpoints/notes.ts
+++ b/packages/backend/src/server/api/endpoints/notes.ts
@@ -13,6 +13,8 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['notes'],

+	requireCredential: true,
+
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
--- a/packages/backend/src/server/api/endpoints/notes/bubble-timeline.ts
+++ b/packages/backend/src/server/api/endpoints/notes/bubble-timeline.ts
@@ -16,6 +16,8 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['notes'],

+	requireCredential: true,
+
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
--- a/packages/backend/src/server/api/endpoints/notes/children.ts
+++ b/packages/backend/src/server/api/endpoints/notes/children.ts
@@ -14,7 +14,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/notes/clips.ts
+++ b/packages/backend/src/server/api/endpoints/notes/clips.ts
@@ -15,7 +15,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['clips', 'notes'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/notes/conversation.ts
+++ b/packages/backend/src/server/api/endpoints/notes/conversation.ts
@@ -15,7 +15,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/notes/featured.ts
+++ b/packages/backend/src/server/api/endpoints/notes/featured.ts
@@ -18,9 +18,10 @@ import { RoleService } from '@/core/RoleService.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,
 	allowGet: true,
 	cacheSec: 3600,
+	kind: 'read:account',

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/notes/global-timeline.ts
+++ b/packages/backend/src/server/api/endpoints/notes/global-timeline.ts
@@ -17,6 +17,8 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['notes'],

+	requireCredential: true,
+
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
--- a/packages/backend/src/server/api/endpoints/notes/local-timeline.ts
+++ b/packages/backend/src/server/api/endpoints/notes/local-timeline.ts
@@ -20,6 +20,8 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['notes'],

+	requireCredential: true,
+
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
--- a/packages/backend/src/server/api/endpoints/notes/reactions.ts
+++ b/packages/backend/src/server/api/endpoints/notes/reactions.ts
@@ -15,7 +15,7 @@ import { QueryService } from '@/core/QueryService.js';
 export const meta = {
 	tags: ['notes', 'reactions'],

-	requireCredential: false,
+	requireCredential: true,

 	allowGet: true,
 	cacheSec: 60,
--- a/packages/backend/src/server/api/endpoints/notes/renotes.ts
+++ b/packages/backend/src/server/api/endpoints/notes/renotes.ts
@@ -15,7 +15,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/notes/replies.ts
+++ b/packages/backend/src/server/api/endpoints/notes/replies.ts
@@ -13,7 +13,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
+++ b/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
@@ -16,6 +16,8 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['notes', 'hashtags'],

+	requireCredential: true,
+
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
--- a/packages/backend/src/server/api/endpoints/notes/search.ts
+++ b/packages/backend/src/server/api/endpoints/notes/search.ts
@@ -13,7 +13,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/notes/show.ts
+++ b/packages/backend/src/server/api/endpoints/notes/show.ts
@@ -14,7 +14,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'object',
--- a/packages/backend/src/server/api/endpoints/notes/versions.ts
+++ b/packages/backend/src/server/api/endpoints/notes/versions.ts
@@ -14,7 +14,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/pages/featured.ts
+++ b/packages/backend/src/server/api/endpoints/pages/featured.ts
@@ -12,7 +12,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['pages'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/pages/show.ts
+++ b/packages/backend/src/server/api/endpoints/pages/show.ts
@@ -15,7 +15,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['pages'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'object',
--- a/packages/backend/src/server/api/endpoints/pinned-users.ts
+++ b/packages/backend/src/server/api/endpoints/pinned-users.ts
@@ -15,7 +15,7 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['users'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/roles/show.ts
+++ b/packages/backend/src/server/api/endpoints/roles/show.ts
@@ -13,7 +13,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['role', 'users'],

-	requireCredential: false,
+	requireCredential: true,

 	errors: {
 		noSuchRole: {
--- a/packages/backend/src/server/api/endpoints/roles/users.ts
+++ b/packages/backend/src/server/api/endpoints/roles/users.ts
@@ -15,7 +15,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['role', 'users'],

-	requireCredential: false,
+	requireCredential: true,

 	errors: {
 		noSuchRole: {
--- a/packages/backend/src/server/api/endpoints/users.ts
+++ b/packages/backend/src/server/api/endpoints/users.ts
@@ -16,7 +16,7 @@ import type { SelectQueryBuilder } from 'typeorm';
 export const meta = {
 	tags: ['users'],

-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/users/achievements.ts
+++ b/packages/backend/src/server/api/endpoints/users/achievements.ts
@@ -9,7 +9,7 @@ import type { UserProfilesRepository } from '@/models/_.js';
 import { DI } from '@/di-symbols.js';

 export const meta = {
-	requireCredential: false,
+	requireCredential: true,

 	res: {
 		type: 'array',
--- a/packages/backend/src/server/api/endpoints/users/clips.ts
+++ b/packages/backend/src/server/api/endpoints/users/clips.ts
@@ -13,6 +13,8 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['users', 'clips'],

+	requireCredential: true,
+
 	description: 'Show all clips this user owns.',

 	res: {
--- a/packages/backend/src/server/api/endpoints/users/featured-notes.ts
+++ b/packages/backend/src/server/api/endpoints/users/featured-notes.ts
@@ -16,7 +16,7 @@ import { QueryService } from '@/core/QueryService.js';
 export const meta = {
 	tags: ['notes'],

-	requireCredential: false,
+	requireCredential: true,
 	allowGet: true,
 	cacheSec: 3600,

--- a/packages/backend/src/server/api/endpoints/users/flashs.ts
+++ b/packages/backend/src/server/api/endpoints/users/flashs.ts
@@ -13,6 +13,8 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['users', 'flashs'],

+	requireCredential: true,
+
 	description: 'Show all flashs this user created.',

 	res: {
--- a/packages/backend/src/server/api/endpoints/users/followers.ts
+++ b/packages/backend/src/server/api/endpoints/users/followers.ts
@@ -18,7 +18,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['users'],

-	requireCredential: false,
+	requireCredential: true,

 	description: 'Show everyone that follows this user.',

--- a/packages/backend/src/server/api/endpoints/users/following.ts
+++ b/packages/backend/src/server/api/endpoints/users/following.ts
@@ -19,7 +19,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['users'],

-	requireCredential: false,
+	requireCredential: true,

 	description: 'Show everyone that this user is following.',

--- a/packages/backend/src/server/api/endpoints/users/get-frequently-replied-users.ts
+++ b/packages/backend/src/server/api/endpoints/users/get-frequently-replied-users.ts
@@ -16,7 +16,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['users'],

-	requireCredential: false,
+	requireCredential: true,

 	description: 'Get a list of other users that the specified user frequently replies to.',

--- a/packages/backend/src/server/api/endpoints/users/notes.ts
+++ b/packages/backend/src/server/api/endpoints/users/notes.ts
@@ -21,6 +21,8 @@ import { isQuote, isRenote } from '@/misc/is-renote.js';
 export const meta = {
 	tags: ['users', 'notes'],

+	requireCredential: true,
+
 	res: {
 		type: 'array',
 		optional: false, nullable: false,
--- a/packages/backend/src/server/api/endpoints/users/pages.ts
+++ b/packages/backend/src/server/api/endpoints/users/pages.ts
@@ -13,6 +13,8 @@ import { DI } from '@/di-symbols.js';
 export const meta = {
 	tags: ['users', 'pages'],

+	requireCredential: true,
+
 	description: 'Show all pages this user created.',

 	res: {
--- a/packages/backend/src/server/api/endpoints/users/reactions.ts
+++ b/packages/backend/src/server/api/endpoints/users/reactions.ts
@@ -18,7 +18,7 @@ import { ApiError } from '../../error.js';
 export const meta = {
 	tags: ['users', 'reactions'],

-	requireCredential: false,
+	requireCredential: true,

 	description: 'Show all reactions this user made.',

--- a/packages/backend/src/server/api/endpoints/users/search-by-username-and-host.ts
+++ b/packages/backend/src/server/api/endpoints/users/search-by-username-and-host.ts
@@ -10,7 +10,7 @@ import { UserSearchService } from '@/core/UserSearchService.js';
 export const meta = {
 	tags: ['users'],

-	requireCredential: false,
+	requireCredential: true,

 	description: 'Search for a user by username and/or host.',

--- a/packages/backend/src/server/api/endpoints/users/search.ts
+++ b/packages/backend/src/server/api/endpoints/users/search.ts
@@ -12,7 +12,7 @@ import { UserSearchService } from '@/core/UserSearchService.js';
 export const meta = {
 	tags: ['users'],

-	requireCredential: false,
+	requireCredential: true,

 	description: 'Search for users.',

--- a/packages/backend/src/server/api/endpoints/users/show.ts
+++ b/packages/backend/src/server/api/endpoints/users/show.ts
@@ -21,7 +21,7 @@ import type { FindOptionsWhere } from 'typeorm';
 export const meta = {
 	tags: ['users'],

-	requireCredential: false,
+	requireCredential: true,

 	description: 'Show the properties of a user.',

--- a/packages/frontend/package.json
+++ b/packages/frontend/package.json
@@ -18,12 +18,14 @@
 	"dependencies": {
 		"@discordapp/twemoji": "15.1.0",
 		"@github/webauthn-json": "2.1.1",
+		"@iconify/vue": "^4.3.0",
 		"@mcaptcha/vanilla-glue": "0.1.0-alpha-3",
 		"@misskey-dev/browser-image-resizer": "2024.1.0",
 		"@phosphor-icons/web": "2.1.2",
 		"@ruffle-rs/ruffle": "0.1.0-nightly.2024.10.15",
 		"@sentry/vue": "9.14.0",
 		"@syuilo/aiscript": "0.19.0",
+		"@types/js-cookie": "^3.0.6",
 		"aiscript-vscode": "github:aiscript-dev/aiscript-vscode#v0.1.15",
 		"broadcast-channel": "7.1.0",
 		"buraha": "0.0.1",
@@ -42,6 +44,7 @@
 		"idb-keyval": "6.2.1",
 		"insert-text-at-cursor": "0.3.0",
 		"is-file-animated": "1.0.2",
+		"js-cookie": "^3.0.5",
 		"json5": "2.2.3",
 		"katex": "0.16.22",
 		"matter-js": "0.20.0",
--- a/packages/frontend/src/pages/note.vue
+++ b/packages/frontend/src/pages/note.vue
@@ -4,49 +4,73 @@ SPDX-License-Identifier: AGPL-3.0-only
 -->

 <template>
-<PageWithHeader :actions="headerActions" :displayBackButton="true" :tabs="headerTabs">
-	<div class="_spacer" style="--MI_SPACER-w: 800px;">
-		<div>
-			<Transition :name="prefer.s.animation ? 'fade' : ''" mode="out-in">
-				<div v-if="note">
-					<div v-if="showNext" class="_margin">
-						<MkNotes class="" :pagination="showNext === 'channel' ? nextChannelPagination : nextUserPagination" :noGap="true" :disableAutoLoad="true"/>
-					</div>
-
-					<div class="_margin">
-						<div v-if="!showNext" class="_buttons" :class="$style.loadNext">
-							<MkButton v-if="note.channelId" rounded :class="$style.loadButton" @click="showNext = 'channel'"><i class="ti ti-chevron-up"></i> <i class="ti ti-device-tv"></i></MkButton>
-							<MkButton rounded :class="$style.loadButton" @click="showNext = 'user'"><i class="ti ti-chevron-up"></i> <i class="ti ti-user"></i></MkButton>
-						</div>
-						<div class="_margin _gaps_s">
-							<MkRemoteCaution v-if="note.user.host != null" :href="note.url ?? note.uri"/>
-							<SkErrorList :errors="note.processErrors"/>
-							<DynamicNoteDetailed :key="note.id" v-model:note="note" :initialTab="initialTab" :class="$style.note" :expandAllCws="expandAllCws"/>
-						</div>
-						<div v-if="clips && clips.length > 0" class="_margin">
-							<div style="font-weight: bold; padding: 12px;">{{ i18n.ts.clip }}</div>
-							<div class="_gaps">
-								<MkClipPreview v-for="item in clips" :key="item.id" :clip="item"/>
-							</div>
-						</div>
-						<div v-if="!showPrev" class="_buttons" :class="$style.loadPrev">
-							<MkButton v-if="note.channelId" rounded :class="$style.loadButton" @click="showPrev = 'channel'"><i class="ti ti-chevron-down"></i> <i class="ti ti-device-tv"></i></MkButton>
-							<MkButton rounded :class="$style.loadButton" @click="showPrev = 'user'"><i class="ti ti-chevron-down"></i> <i class="ti ti-user"></i></MkButton>
-						</div>
-					</div>
-
-					<div v-if="showPrev" class="_margin">
-						<MkNotes class="" :pagination="showPrev === 'channel' ? prevChannelPagination : prevUserPagination" :noGap="true"/>
-					</div>
-				</div>
-				<MkError v-else-if="error" @retry="fetchNote()"/>
-				<MkLoading v-else/>
-			</Transition>
+	<div class="userNotLoggedIn" v-if="notLoggedIn">
+		<Icon style="font-size: 70px; color: var(--MI_THEME-accent); margin: auto;" icon="solar:danger-triangle-bold" />
+		<div style="font-size: 15px;">
+			You cant view notes without logging in
 		</div>
 	</div>
-</PageWithHeader>
+	<PageWithHeader v-if="!notLoggedIn" :actions="headerActions" :displayBackButton="true" :tabs="headerTabs">
+		<div class="_spacer" style="--MI_SPACER-w: 800px;">
+			<div>
+				<Transition :name="prefer.s.animation ? 'fade' : ''" mode="out-in">
+					<div v-if="note">
+						<div v-if="showNext" class="_margin">
+							<MkNotes class=""
+								:pagination="showNext === 'channel' ? nextChannelPagination : nextUserPagination"
+								:noGap="true" :disableAutoLoad="true" />
+						</div>
+
+						<div class="_margin">
+							<div v-if="!showNext" class="_buttons" :class="$style.loadNext">
+								<MkButton v-if="note.channelId" rounded :class="$style.loadButton"
+									@click="showNext = 'channel'"><i class="ti ti-chevron-up"></i> <i
+										class="ti ti-device-tv"></i></MkButton>
+								<MkButton rounded :class="$style.loadButton" @click="showNext = 'user'"><i
+										class="ti ti-chevron-up"></i> <i class="ti ti-user"></i></MkButton>
+							</div>
+							<div class="_margin _gaps_s">
+								<MkRemoteCaution v-if="note.user.host != null" :href="note.url ?? note.uri" />
+								<SkErrorList :errors="note.processErrors" />
+								<DynamicNoteDetailed :key="note.id" v-model:note="note" :initialTab="initialTab"
+									:class="$style.note" :expandAllCws="expandAllCws" />
+							</div>
+							<div v-if="clips && clips.length > 0" class="_margin">
+								<div style="font-weight: bold; padding: 12px;">{{ i18n.ts.clip }}</div>
+								<div class="_gaps">
+									<MkClipPreview v-for="item in clips" :key="item.id" :clip="item" />
+								</div>
+							</div>
+
+							<div v-if="showPrev" class="_margin">
+								<MkNotes class=""
+									:pagination="showPrev === 'channel' ? prevChannelPagination : prevUserPagination"
+									:noGap="true" />
+							</div>
+						</div>
+
+						<div v-if="showPrev" class="_margin">
+							<MkNotes class=""
+								:pagination="showPrev === 'channel' ? prevChannelPagination : prevUserPagination"
+								:noGap="true" />
+						</div>
+					</div>
+					<MkError v-else-if="error" @retry="fetchNote()" />
+					<MkLoading v-else />
+				</Transition>
+			</div>
+		</div>
+	</PageWithHeader>
 </template>

+<style scoped>
+.userNotLoggedIn {
+	text-align: center;
+	padding: 32px;
+	margin-top: 35vh;
+}
+</style>
+
 <script lang="ts" setup>
 import { computed, watch, ref } from 'vue';
 import * as Misskey from 'misskey-js';
@@ -66,6 +90,7 @@ import { prefer } from '@/preferences.js';
 import { pleaseLogin } from '@/utility/please-login.js';
 import { getAppearNote } from '@/utility/get-appear-note.js';
 import { serverContext, assertServerContext } from '@/server-context.js';
+import { Icon } from '@iconify/vue'
 import { $i } from '@/i.js';

 // contextは非ログイン状態の情報しかないためログイン時は利用できない
@@ -80,6 +105,7 @@ const note = ref<null | Misskey.entities.Note>(CTX_NOTE);
 const clips = ref<Misskey.entities.Clip[]>();
 const showPrev = ref<'user' | 'channel' | false>(false);
 const showNext = ref<'user' | 'channel' | false>(false);
+const notLoggedIn = ref(!$i);
 const expandAllCws = ref(false);
 const error = ref();

@@ -173,18 +199,24 @@ const headerActions = computed(() => note.value ? [

 const headerTabs = computed(() => []);

-definePage(() => ({
-	title: i18n.ts.note,
-	...note.value ? {
-		subtitle: dateString(note.value.createdAt),
-		avatar: note.value.user,
-		path: `/notes/${note.value.id}`,
-		share: {
-			title: i18n.tsx.noteOf({ user: note.value.user.name ?? note.value.user.username }),
-			text: note.value.text,
-		},
-	} : {},
-}));
+definePage(() => {
+	if (notLoggedIn.value) return {
+		title: i18n.ts.note,
+	};
+
+	return {
+		title: i18n.ts.note,
+		...note.value ? {
+			subtitle: dateString(note.value.createdAt),
+			avatar: note.value.user,
+			path: `/notes/${note.value.id}`,
+			share: {
+				title: i18n.tsx.noteOf({ user: note.value.user.name ?? note.value.user.username }),
+				text: note.value.text,
+			},
+		} : {},
+	};
+});
 </script>

 <style lang="scss" module>
@@ -192,6 +224,7 @@ definePage(() => ({
 .fade-leave-active {
 	transition: opacity 0.125s ease;
 }
+
 .fade-enter-from,
 .fade-leave-to {
 	opacity: 0;
--- a/packages/frontend/src/pages/user/index.vue
+++ b/packages/frontend/src/pages/user/index.vue
@@ -4,8 +4,14 @@ SPDX-License-Identifier: AGPL-3.0-only
 -->

 <template>
-<PageWithHeader v-model:tab="tab" :displayBackButton="true" :tabs="headerTabs" :actions="headerActions" :swipable="isTouchUsing" :page="'user'">
-	<div v-if="user">
+<PageWithHeader v-if="!notLoggedIn" v-model:tab="tab" :displayBackButton="true" :tabs="headerTabs" :actions="headerActions" :swipable="isTouchUsing" :page="'user'">
+		<div class="userNotLoggedIn" v-if="notLoggedIn">
+			<Icon style="font-size: 70px; color: var(--MI_THEME-accent); margin: auto;" icon="solar:danger-triangle-bold"/>
+			<div style="font-size: 15px;">
+				You cant view user accounts without logging in
+			</div>
+		</div>
+	<div v-else-if="user">
 		<XHome v-if="tab === 'home'" :user="user" @unfoldFiles="() => { tab = 'files'; }"/>
 		<div v-else-if="tab === 'notes'" class="_spacer" style="--MI_SPACER-w: 800px;">
 			<XTimeline :user="user"/>
@@ -26,6 +32,14 @@ SPDX-License-Identifier: AGPL-3.0-only
 </PageWithHeader>
 </template>

+<style scoped>
+.userNotLoggedIn {
+	text-align: center;
+	padding: 32px;
+	margin-top: 35vh;
+}
+</style>
+
 <script lang="ts" setup>
 import { defineAsyncComponent, computed, watch, ref } from 'vue';
 import * as Misskey from 'misskey-js';
@@ -35,6 +49,7 @@ import { definePage } from '@/page.js';
 import { i18n } from '@/i18n.js';
 import { $i } from '@/i.js';
 import { serverContext, assertServerContext } from '@/server-context.js';
+import { Icon } from '@iconify/vue'
 import { isTouchUsing } from '@/utility/touch.js';

 const XHome = defineAsyncComponent(() => import('./home.vue'));
@@ -64,6 +79,7 @@ const tab = ref(props.page);

 const user = ref<null | Misskey.entities.UserDetailed>(CTX_USER);
 const error = ref<any>(null);
+const notLoggedIn = ref(!$i);

 function fetchUser(): void {
 	if (props.acct == null) return;
@@ -142,18 +158,25 @@ const headerTabs = computed(() => user.value ? [{
 	icon: 'ti ti-code',
 }] : []);

-definePage(() => ({
-	title: i18n.ts.user,
-	icon: 'ti ti-user',
-	...user.value ? {
-		title: user.value.name ? ` (@${user.value.username})` : `@${user.value.username}`,
-		subtitle: `@${getAcct(user.value)}`,
-		userName: user.value,
-		avatar: user.value,
-		path: `/@${user.value.username}`,
-		share: {
-			title: user.value.name,
-		},
-	} : {},
-}));
+definePage(() => {
+	if (notLoggedIn.value) return {
+		title: i18n.ts.user,
+		icon: 'ti ti-user',
+	};
+
+	return {
+		title: i18n.ts.user,
+		icon: 'ti ti-user',
+		...user.value ? {
+			title: user.value.name ? ` (@${user.value.username})` : `@${user.value.username}`,
+			subtitle: `@${getAcct(user.value)}`,
+			userName: user.value,
+			avatar: user.value,
+			path: `/@${user.value.username}`,
+			share: {
+				title: user.value.name,
+			},
+		} : {},
+	};
+});
 </script>
--- a/packages/frontend/src/utility/misskey-api.ts
+++ b/packages/frontend/src/utility/misskey-api.ts
@@ -7,6 +7,7 @@ import * as Misskey from 'misskey-js';
 import { ref } from 'vue';
 import { apiUrl } from '@@/js/config.js';
 import { $i } from '@/i.js';
+import Cookies from 'js-cookie'
 export const pendingApiRequestsCount = ref(0);

 export type Endpoint = keyof Misskey.Endpoints;
@@ -63,7 +64,7 @@ export function misskeyApi<
 		window.fetch(`${apiUrl}/${endpoint}`, {
 			method: 'POST',
 			body: JSON.stringify(data),
-			credentials: 'omit',
+			credentials: 'same-origin',
 			cache: 'no-cache',
 			headers,
 			signal,
@@ -120,10 +121,10 @@ export function misskeyApiGet<
 		// Don't let the body value leak through
 		query.delete('i');

-		// Send request
+
 		window.fetch(`${apiUrl}/${endpoint}?${query}`, {
 			method: 'GET',
-			credentials: 'omit',
+			credentials: 'same-origin',
 			cache: 'default',
 			headers,
 			signal,
--- a/packages/misskey-js/src/api.ts
+++ b/packages/misskey-js/src/api.ts
@@ -109,7 +109,7 @@ export class APIClient {
 				headers: {
 					'Content-Type': mediaType,
 				},
-				credentials: 'omit',
+				credentials: 'same-origin',
 				cache: 'no-cache',
 			}).then(async (res) => {
 				const body = res.status === 204 ? null : await res.json();
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -673,6 +673,9 @@ importers:
      '@github/webauthn-json':
        specifier: 2.1.1
        version: 2.1.1
+      '@iconify/vue':
+        specifier: ^4.3.0
+        version: 4.3.0(vue@3.5.12(typescript@5.6.3))
      '@mcaptcha/vanilla-glue':
        specifier: 0.1.0-alpha-3
        version: 0.1.0-alpha-3
@@ -691,6 +694,9 @@ importers:
      '@syuilo/aiscript':
        specifier: 0.19.0
        version: 0.19.0
+      '@types/js-cookie':
+        specifier: ^3.0.6
+        version: 3.0.6
      aiscript-vscode:
        specifier: github:aiscript-dev/aiscript-vscode#v0.1.15
        version: https://codeload.github.com/aiscript-dev/aiscript-vscode/tar.gz/c3cde89e79a41d93540cf8a48cd619c3f2dcb1b7
@@ -745,6 +751,9 @@ importers:
      is-file-animated:
        specifier: 1.0.2
        version: 1.0.2
+      js-cookie:
+        specifier: ^3.0.5
+        version: 3.0.5
      json5:
        specifier: 2.2.3
        version: 2.2.3
@@ -2311,6 +2320,14 @@ packages:
    resolution: {integrity: sha512-xeO57FpIu4p1Ri3Jq/EXq4ClRm86dVF2z/+kvFnyqVYRavTZmaFaUBbWCOuuTh0o/g7DSsk6kc2vrS4Vl5oPOQ==}
    engines: {node: '>=18.18'}

+  '@iconify/types@2.0.0':
+    resolution: {integrity: sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==}
+
+  '@iconify/vue@4.3.0':
+    resolution: {integrity: sha512-Xq0h6zMrHBbrW8jXJ9fISi+x8oDQllg5hTDkDuxnWiskJ63rpJu9CvJshj8VniHVTbsxCg9fVoPAaNp3RQI5OQ==}
+    peerDependencies:
+      vue: '>=3'
+
  '@img/sharp-darwin-arm64@0.34.1':
    resolution: {integrity: sha512-pn44xgBtgpEbZsu+lWf2KNb6OAf70X68k+yk69Ic2Xz11zHR/w24/U49XT7AeRwJ0Px+mhALhU5LPci1Aymk7A==}
    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
@@ -4143,6 +4160,9 @@ packages:
  '@types/jest@29.5.14':
    resolution: {integrity: sha512-ZN+4sdnLUbo8EVvVc2ao0GFW6oVrQRPn4K2lglySj7APvSrgzxHiNNK99us4WDMi57xxA2yggblIAMNhXOotLQ==}

+  '@types/js-cookie@3.0.6':
+    resolution: {integrity: sha512-wkw9yd1kEXOPnvEeEV1Go1MmxtBJL0RR79aOTAApecWFVu7w0NNXNqhcWgvw2YgZDYadliXkl14pa3WXw5jlCQ==}
+
  '@types/js-yaml@4.0.9':
    resolution: {integrity: sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==}

@@ -7290,6 +7310,10 @@ packages:
    engines: {node: '>=12'}
    hasBin: true

+  js-cookie@3.0.5:
+    resolution: {integrity: sha512-cEiJEAEoIbWfCZYKWhVwFuvPX1gETRYPw6LlaTKoxD3s2AkXzkCjnp6h0V77ozyqj0jakteJ4YqDJT830+lVGw==}
+    engines: {node: '>=14'}
+
  js-stringify@1.0.2:
    resolution: {integrity: sha512-rtS5ATOo2Q5k1G+DADISilDA6lv79zIiwFd6CcjuIxGKLFm5C+RLImRscVap9k55i+MOZwgliw+NejvkLuGD5g==}

@@ -12055,6 +12079,13 @@ snapshots:

  '@humanwhocodes/retry@0.4.2': {}

+  '@iconify/types@2.0.0': {}
+
+  '@iconify/vue@4.3.0(vue@3.5.12(typescript@5.6.3))':
+    dependencies:
+      '@iconify/types': 2.0.0
+      vue: 3.5.12(typescript@5.6.3)
+
  '@img/sharp-darwin-arm64@0.34.1':
    optionalDependencies:
      '@img/sharp-libvips-darwin-arm64': 1.1.0
@@ -14308,6 +14339,8 @@ snapshots:
      expect: 29.7.0
      pretty-format: 29.7.0

+  '@types/js-cookie@3.0.6': {}
+
  '@types/js-yaml@4.0.9': {}

  '@types/json-schema@7.0.15': {}
@@ -18309,6 +18342,8 @@ snapshots:
      glob: 8.1.0
      nopt: 6.0.0

+  js-cookie@3.0.5: {}
+
  js-stringify@1.0.2: {}

  js-tokens@4.0.0: {}