Merge branch '1.0.4' into 'master'

1.0.4 See merge request framasoft/mobilizon!803
2021-01-22 12:33:52 +01:00 · 2021-01-22 12:33:52 +01:00 · d9d357456b
parent 58fe7b74a5 208886fbea
commit d9d357456b
31 changed files with 1354 additions and 374 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -4,6 +4,48 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## 1.0.4 - 20-01-2020
+
+### Added
+
+- Added interface to approve/reject group follow requests
+- Added UI for group public Atom/ICS feeds
+- Attach ICS files representing the event to notifications and participations emails
+- Add initial support to build Elixir releases
+
+### Changed
+
+- Added `<hr>` to allowed HTML tags
+- Events are now correctly ordered by their beginning date on search and group page
+
+### Fixed
+
+- Upgrade PWA support library to avoid a call to Google CDN
+- Fixed group avatar & banner upload
+- Fixed some events not showing on homepage
+- Fixed the `next` and `prev` attribute not being present in `CollectionPage` ActivityPub Collections
+- Added a text to explain that group discussions are restricted to members on discussion list page
+- Fixed ICS export timezone issues
+- Fixed remote interactions when the content was not local to the instance
+- Fixed a federation issue with group member removal
+- Fixed group remote subscription
+
+### Translations
+
+- Bengali (New!)
+- Catalan
+- Finnish
+- French
+- Galician
+- German
+- Italian
+- Norwegian
+- Polish
+- Portuguese (New!)
+- Slovenian (New!)
+- Spanish
+- Swedish
+
 ## 1.0.3 - 18-12-2020

 **This release adds new migrations, be sure to run them before restarting Mobilizon**
--- a/js/package.json
+++ b/js/package.json
@ -1,6 +1,6 @@
 {
  "name": "mobilizon",
-  "version": "1.0.3",
+  "version": "1.0.4",
  "private": true,
  "scripts": {
    "serve": "vue-cli-service serve",
@ -39,10 +39,10 @@
    "phoenix": "^1.4.11",
    "register-service-worker": "^1.7.1",
    "tippy.js": "^6.2.3",
-    "tiptap": "^1.26.0",
-    "tiptap-extensions": "^1.29.1",
+    "tiptap": "^1.31.0",
+    "tiptap-extensions": "^1.34.0",
    "unfetch": "^4.2.0",
-    "v-tooltip": "2.0.2",
+    "v-tooltip": "^2.1.2",
    "vue": "^2.6.11",
    "vue-apollo": "^3.0.3",
    "vue-class-component": "^7.2.3",
@ -52,7 +52,7 @@
    "vue-router": "^3.1.6",
    "vue-scrollto": "^2.17.1",
    "vue2-leaflet": "^2.0.3",
-    "vuedraggable": "2.23.2"
+    "vuedraggable": "^2.24.3"
  },
  "devDependencies": {
    "@types/jest": "^26.0.18",
@ -65,8 +65,8 @@
    "@types/prosemirror-state": "^1.2.4",
    "@types/prosemirror-view": "^1.11.4",
    "@types/vuedraggable": "^2.23.0",
-    "@typescript-eslint/eslint-plugin": "^4.0.1",
-    "@typescript-eslint/parser": "^4.0.1",
+    "@typescript-eslint/eslint-plugin": "4.13.0",
+    "@typescript-eslint/parser": "4.13.0",
    "@vue/cli-plugin-babel": "~4.5.10",
    "@vue/cli-plugin-e2e-cypress": "~4.5.10",
    "@vue/cli-plugin-eslint": "~4.5.10",
@ -83,7 +83,7 @@
    "eslint-plugin-prettier": "^3.1.3",
    "eslint-plugin-vue": "^7.0.0",
    "jest-junit": "^12.0.0",
-    "mock-apollo-client": "^0.4",
+    "mock-apollo-client": "^0.5",
    "prettier": "2.2.1",
    "prettier-eslint": "^12.0.0",
    "sass": "^1.29.0",
@ -95,8 +95,6 @@
    "webpack-cli": "^3.3"
  },
  "resolutions": {
-    "prosemirror-model": "1.9.1",
-    "prosemirror-state": "1.3.3",
    "workbox-webpack-plugin": "5.1.3"
  }
 }
--- a/js/src/graphql/followers.ts
+++ b/js/src/graphql/followers.ts
@ -0,0 +1,49 @@
+import gql from "graphql-tag";
+
+export const GROUP_FOLLOWERS = gql`
+  query(
+    $name: String!
+    $followersPage: Int
+    $followersLimit: Int
+    $approved: Boolean
+  ) {
+    group(preferredUsername: $name) {
+      id
+      preferredUsername
+      name
+      domain
+      followers(
+        page: $followersPage
+        limit: $followersLimit
+        approved: $approved
+      ) {
+        total
+        elements {
+          id
+          actor {
+            id
+            preferredUsername
+            name
+            domain
+            avatar {
+              id
+              url
+            }
+          }
+          approved
+          insertedAt
+          updatedAt
+        }
+      }
+    }
+  }
+`;
+
+export const UPDATE_FOLLOWER = gql`
+  mutation UpdateFollower($id: ID!, $approved: Boolean) {
+    updateFollower(id: $id, approved: $approved) {
+      id
+      approved
+    }
+  }
+`;
--- a/js/src/graphql/group.ts
+++ b/js/src/graphql/group.ts
@ -64,6 +64,7 @@ export const GROUP_FIELDS_FRAGMENTS = gql`
    suspended
    visibility
    openness
+    manuallyApprovesFollowers
    physicalAddress {
      description
      street
@ -265,6 +266,7 @@ export const UPDATE_GROUP = gql`
    $visibility: GroupVisibility
    $openness: Openness
    $physicalAddress: AddressInput
+    $manuallyApprovesFollowers: Boolean
  ) {
    updateGroup(
      id: $id
@ -275,6 +277,7 @@ export const UPDATE_GROUP = gql`
      visibility: $visibility
      openness: $openness
      physicalAddress: $physicalAddress
+      manuallyApprovesFollowers: $manuallyApprovesFollowers
    ) {
      id
      preferredUsername
@ -282,6 +285,7 @@ export const UPDATE_GROUP = gql`
      summary
      visibility
      openness
+      manuallyApprovesFollowers
      avatar {
        id
        url
--- a/js/src/i18n/en_US.json
+++ b/js/src/i18n/en_US.json
@ -829,5 +829,12 @@
  "It is possible that the content is not accessible on this instance, because this instance has blocked the profiles or groups behind this content.": "It is possible that the content is not accessible on this instance, because this instance has blocked the profiles or groups behind this content.",
  "Atom feed for events and posts": "Atom feed for events and posts",
  "ICS feed for events": "ICS feed for events",
-  "ICS/WebCal Feed": "ICS/WebCal Feed"
+  "ICS/WebCal Feed": "ICS/WebCal Feed",
+  "Group Followers": "Group Followers",
+  "Follower": "Follower",
+  "Reject": "Reject",
+  "No follower matches the filters": "No follower matches the filters",
+  "@{username}'s follow request was rejected": "@{username}'s follow request was rejected",
+  "Followers will receive new public events and posts.": "Followers will receive new public events and posts.",
+  "Manually approve new followers": "Manually approve new followers"
 }
--- a/js/src/i18n/fr_FR.json
+++ b/js/src/i18n/fr_FR.json
@ -274,7 +274,7 @@
  "Find an address": "Trouver une adresse",
  "Find an instance": "Trouver une instance",
  "Find another instance": "Trouver une autre instance",
-  "Followers": "Abonnés",
+  "Followers": "Abonné⋅es",
  "Followings": "Abonnements",
  "For instance: London": "Par exemple : Lyon",
  "For instance: London, Taekwondo, Architecture…": "Par exemple : Lyon, Taekwondo, Architecture…",
@ -925,5 +925,11 @@
  "© The OpenStreetMap Contributors": "© Les Contributeur⋅ices OpenStreetMap",
  "Atom feed for events and posts": "Flux Atom pour les événements et les billets",
  "ICS feed for events": "Flux ICS pour les événements",
-  "ICS/WebCal Feed": "Flux ICS/WebCal"
+  "ICS/WebCal Feed": "Flux ICS/WebCal",
+  "Group Followers": "Abonné⋅es au groupe",
+  "Follower": "Abonné⋅es",
+  "No follower matches the filters": "Aucun⋅e abonné⋅e ne correspond aux filtres",
+  "@{username}'s follow request was rejected": "La demande de suivi de @{username} a été rejettée",
+  "Followers will receive new public events and posts.": "Les abonnée⋅s recevront les nouveaux événements et billets publics.",
+  "Manually approve new followers": "Approuver les nouvelles demandes de suivi manuellement"
 }
--- a/js/src/i18n/langs.json
+++ b/js/src/i18n/langs.json
@ -1,6 +1,7 @@
 {
  "ar": "العربية",
  "be": "Беларуская мова",
+  "bn": "বাংলা",
  "ca": "Català",
  "cs": "čeština",
  "de": "Deutsch",
@ -22,5 +23,6 @@
  "pt": "Português",
  "pt_BR": "Português brasileiro",
  "ru": "Русский",
+  "sl": "Slovenščina",
  "sv": "Svenska"
 }
--- a/js/src/router/groups.ts
+++ b/js/src/router/groups.ts
@ -8,6 +8,7 @@ export enum GroupsRouteName {
  GROUP_SETTINGS = "GROUP_SETTINGS",
  GROUP_PUBLIC_SETTINGS = "GROUP_PUBLIC_SETTINGS",
  GROUP_MEMBERS_SETTINGS = "GROUP_MEMBERS_SETTINGS",
+  GROUP_FOLLOWERS_SETTINGS = "GROUP_FOLLOWERS_SETTINGS",
  RESOURCES = "RESOURCES",
  RESOURCE_FOLDER_ROOT = "RESOURCE_FOLDER_ROOT",
  RESOURCE_FOLDER = "RESOURCE_FOLDER",
@ -85,6 +86,13 @@ export const groupsRoutes: RouteConfig[] = [
          import("../views/Group/GroupMembers.vue"),
        props: true,
      },
+      {
+        path: "followers",
+        name: GroupsRouteName.GROUP_FOLLOWERS_SETTINGS,
+        component: (): Promise<EsModuleComponent> =>
+          import("../views/Group/GroupFollowers.vue"),
+        props: true,
+      },
    ],
  },
  {
--- a/js/src/types/actor/group.model.ts
+++ b/js/src/types/actor/group.model.ts
@ -19,6 +19,7 @@ export interface IGroup extends IActor {
  organizedEvents: Paginate<IEvent>;
  physicalAddress: IAddress;
  openness: Openness;
+  manuallyApprovesFollowers: boolean;
 }

 export class Group extends Actor implements IGroup {
@ -45,6 +46,8 @@ export class Group extends Actor implements IGroup {

  physicalAddress: IAddress = new Address();

+  manuallyApprovesFollowers = true;
+
  patch(hash: IGroup | Record<string, unknown>): void {
    Object.assign(this, hash);
  }
--- a/js/src/views/Group/GroupFollowers.vue
+++ b/js/src/views/Group/GroupFollowers.vue
@ -0,0 +1,261 @@
+<template>
+  <div>
+    <nav class="breadcrumb" aria-label="breadcrumbs">
+      <ul v-if="group">
+        <li>
+          <router-link
+            :to="{
+              name: RouteName.GROUP,
+              params: { preferredUsername: usernameWithDomain(group) },
+            }"
+            >{{ group.name }}</router-link
+          >
+        </li>
+        <li>
+          <router-link
+            :to="{
+              name: RouteName.GROUP_SETTINGS,
+              params: { preferredUsername: usernameWithDomain(group) },
+            }"
+            >{{ $t("Settings") }}</router-link
+          >
+        </li>
+        <li class="is-active">
+          <router-link
+            :to="{
+              name: RouteName.GROUP_FOLLOWERS_SETTINGS,
+              params: { preferredUsername: usernameWithDomain(group) },
+            }"
+            >{{ $t("Followers") }}</router-link
+          >
+        </li>
+      </ul>
+    </nav>
+    <section
+      class="container section"
+      v-if="group && isCurrentActorAGroupAdmin"
+    >
+      <h1>{{ $t("Group Followers") }} ({{ followers.total }})</h1>
+      <b-field :label="$t('Status')" horizontal>
+        <b-switch v-model="pending">{{ $t("Pending") }}</b-switch>
+      </b-field>
+      <b-table
+        v-if="followers"
+        :data="followers.elements"
+        ref="queueTable"
+        :loading="this.$apollo.loading"
+        paginated
+        backend-pagination
+        :current-page.sync="page"
+        :pagination-simple="true"
+        :aria-next-label="$t('Next page')"
+        :aria-previous-label="$t('Previous page')"
+        :aria-page-label="$t('Page')"
+        :aria-current-label="$t('Current page')"
+        :total="followers.total"
+        :per-page="FOLLOWERS_PER_PAGE"
+        backend-sorting
+        :default-sort-direction="'desc'"
+        :default-sort="['insertedAt', 'desc']"
+        @page-change="triggerLoadMoreFollowersPageChange"
+        @sort="(field, order) => $emit('sort', field, order)"
+      >
+        <b-table-column
+          field="actor.preferredUsername"
+          :label="$t('Follower')"
+          v-slot="props"
+        >
+          <article class="media">
+            <figure
+              class="media-left image is-48x48"
+              v-if="props.row.actor.avatar"
+            >
+              <img
+                class="is-rounded"
+                :src="props.row.actor.avatar.url"
+                alt=""
+              />
+            </figure>
+            <b-icon
+              class="media-left"
+              v-else
+              size="is-large"
+              icon="account-circle"
+            />
+            <div class="media-content">
+              <div class="content">
+                <span v-if="props.row.actor.name">{{
+                  props.row.actor.name
+                }}</span
+                ><br />
+                <span class="is-size-7 has-text-grey"
+                  >@{{ usernameWithDomain(props.row.actor) }}</span
+                >
+              </div>
+            </div>
+          </article>
+        </b-table-column>
+        <b-table-column field="insertedAt" :label="$t('Date')" v-slot="props">
+          <span class="has-text-centered">
+            {{ props.row.insertedAt | formatDateString }}<br />{{
+              props.row.insertedAt | formatTimeString
+            }}
+          </span>
+        </b-table-column>
+        <b-table-column field="actions" :label="$t('Actions')" v-slot="props">
+          <div class="buttons">
+            <b-button
+              v-if="!props.row.approved"
+              @click="updateFollower(props.row, true)"
+              icon-left="check"
+              type="is-success"
+              >{{ $t("Accept") }}</b-button
+            >
+            <b-button
+              @click="updateFollower(props.row, false)"
+              icon-left="close"
+              type="is-danger"
+              >{{ $t("Reject") }}</b-button
+            >
+          </div>
+        </b-table-column>
+        <template slot="empty">
+          <empty-content icon="account" inline>
+            {{ $t("No follower matches the filters") }}
+          </empty-content>
+        </template>
+      </b-table>
+    </section>
+    <b-message v-else-if="group">
+      {{ $t("You are not an administrator for this group.") }}
+    </b-message>
+  </div>
+</template>
+
+<script lang="ts">
+import { Component, Watch } from "vue-property-decorator";
+import GroupMixin from "@/mixins/group";
+import { mixins } from "vue-class-component";
+import { GROUP_FOLLOWERS, UPDATE_FOLLOWER } from "@/graphql/followers";
+import RouteName from "../../router/name";
+import { usernameWithDomain } from "../../types/actor";
+import EmptyContent from "@/components/Utils/EmptyContent.vue";
+import { IFollower } from "@/types/actor/follower.model";
+import { Paginate } from "@/types/paginate";
+
+@Component({
+  apollo: {
+    followers: {
+      query: GROUP_FOLLOWERS,
+      variables() {
+        return {
+          name: this.$route.params.preferredUsername,
+          followersPage: this.page,
+          followersLimit: this.FOLLOWERS_PER_PAGE,
+          approved: this.pending === null ? null : !this.pending,
+        };
+      },
+      update: (data) => data.group.followers,
+    },
+  },
+  components: {
+    EmptyContent,
+  },
+})
+export default class GroupFollowers extends mixins(GroupMixin) {
+  loading = true;
+
+  RouteName = RouteName;
+
+  page = parseInt((this.$route.query.page as string) || "1", 10);
+
+  pending: boolean | null =
+    (this.$route.query.pending as string) == "1" || null;
+
+  FOLLOWERS_PER_PAGE = 1;
+
+  usernameWithDomain = usernameWithDomain;
+
+  followers!: Paginate<IFollower>;
+
+  mounted(): void {
+    this.page = parseInt((this.$route.query.page as string) || "1", 10);
+  }
+
+  @Watch("page")
+  triggerLoadMoreFollowersPageChange(page: string): void {
+    this.$router.replace({
+      name: RouteName.GROUP_FOLLOWERS_SETTINGS,
+      query: { ...this.$route.query, page },
+    });
+  }
+
+  @Watch("pending")
+  triggerPendingStatusPageChange(pending: boolean): void {
+    this.$router.replace({
+      name: RouteName.GROUP_FOLLOWERS_SETTINGS,
+      query: { ...this.$route.query, ...{ pending: pending ? "1" : "0" } },
+    });
+  }
+
+  async loadMoreFollowers(): Promise<void> {
+    const { FOLLOWERS_PER_PAGE, group, page, pending } = this;
+    await this.$apollo.queries.followers.fetchMore({
+      // New variables
+      variables() {
+        return {
+          name: usernameWithDomain(group),
+          followersPage: page,
+          followersLimit: FOLLOWERS_PER_PAGE,
+          approved: !pending,
+        };
+      },
+      // Transform the previous result with new data
+      updateQuery: (previousResult, { fetchMoreResult }) => {
+        if (!fetchMoreResult) return previousResult;
+        const oldFollowers = previousResult.group.followers;
+        const newFollowers = fetchMoreResult.group.followers;
+        return {
+          elements: [...oldFollowers.elements, ...newFollowers.elements],
+          total: newFollowers.total,
+          __typename: oldFollowers.__typename,
+        };
+      },
+    });
+  }
+
+  async updateFollower(follower: IFollower, approved: boolean): Promise<void> {
+    const { FOLLOWERS_PER_PAGE, group, page, pending } = this;
+    try {
+      await this.$apollo.mutate<{ rejectFollower: IFollower }>({
+        mutation: UPDATE_FOLLOWER,
+        variables: {
+          id: follower.id,
+          approved,
+        },
+        refetchQueries: [
+          {
+            query: GROUP_FOLLOWERS,
+            variables: {
+              name: usernameWithDomain(group),
+              followersPage: page,
+              followersLimit: FOLLOWERS_PER_PAGE,
+              approved: !pending,
+            },
+          },
+        ],
+      });
+      this.$notifier.success(
+        this.$t("@{username}'s follow request was rejected", {
+          username: follower.actor.preferredUsername,
+        }) as string
+      );
+    } catch (error) {
+      console.error(error);
+      if (error.graphQLErrors && error.graphQLErrors.length > 0) {
+        this.$notifier.error(error.graphQLErrors[0].message);
+      }
+    }
+  }
+}
+</script>
--- a/js/src/views/Group/GroupSettings.vue
+++ b/js/src/views/Group/GroupSettings.vue
@ -134,6 +134,15 @@
          </b-radio>
        </div>

+        <b-field
+          :label="$t('Followers')"
+          :message="$t('Followers will receive new public events and posts.')"
+        >
+          <b-checkbox v-model="group.manuallyApprovesFollowers">
+            {{ $t("Manually approve new followers") }}
+          </b-checkbox>
+        </b-field>
+
        <full-address-auto-complete
          :label="$t('Group address')"
          v-model="group.physicalAddress"
--- a/js/src/views/Group/Settings.vue
+++ b/js/src/views/Group/Settings.vue
@ -16,6 +16,10 @@
              :title="this.$t('Members')"
              :to="{ name: RouteName.GROUP_MEMBERS_SETTINGS }"
            />
+            <SettingMenuItem
+              :title="this.$t('Followers')"
+              :to="{ name: RouteName.GROUP_FOLLOWERS_SETTINGS }"
+            />
          </SettingMenuSection>
        </ul>
      </aside>
--- a/js/yarn.lock
+++ b/js/yarn.lock
--- a/lib/federation/activity_pub/activity_pub.ex
+++ b/lib/federation/activity_pub/activity_pub.ex
@ -50,7 +50,6 @@ defmodule Mobilizon.Federation.ActivityPub do

  alias Mobilizon.Web.Endpoint
  alias Mobilizon.Web.Email.{Admin, Group, Mailer}
-  alias Mobilizon.Web.Email.Follow, as: FollowMailer

  require Logger

@ -320,13 +319,22 @@ defmodule Mobilizon.Federation.ActivityPub do
  @doc """
  Make an actor follow another
  """
-  def follow(%Actor{} = follower, %Actor{} = followed, activity_id \\ nil, local \\ true) do
+  def follow(
+        %Actor{} = follower,
+        %Actor{} = followed,
+        activity_id \\ nil,
+        local \\ true,
+        additional \\ %{}
+      ) do
    with {:different_actors, true} <- {:different_actors, followed.id != follower.id},
-         {:ok, %Follower{} = follower} <-
-           Actors.follow(followed, follower, activity_id, false),
-         :ok <- FollowMailer.send_notification_to_admins(follower),
-         follower_as_data <- Convertible.model_to_as(follower),
-         {:ok, activity} <- create_activity(follower_as_data, local),
+         {:ok, activity_data, %Follower{} = follower} <-
+           Types.Actors.follow(
+             follower,
+             followed,
+             local,
+             Map.merge(additional, %{"activity_id" => activity_id})
+           ),
+         {:ok, activity} <- create_activity(activity_data, local),
         :ok <- maybe_federate(activity) do
      {:ok, activity, follower}
    else
--- a/lib/federation/activity_pub/transmogrifier.ex
+++ b/lib/federation/activity_pub/transmogrifier.ex
@ -302,6 +302,10 @@ defmodule Mobilizon.Federation.ActivityPub.Transmogrifier do
              do_handle_incoming_accept_join(accepted_object, actor)} do
      {:ok, activity, object}
    else
+      {:object_not_found, {:error, "Follow already accepted"}} ->
+        Logger.info("Follow was already accepted. Ignoring.")
+        :error
+
      {:object_not_found, nil} ->
        Logger.warn(
          "Unable to process Accept activity #{inspect(id)}. Object #{inspect(accepted_object)} wasn't found."
@ -761,6 +765,10 @@ defmodule Mobilizon.Federation.ActivityPub.Transmogrifier do

      {:ok, activity, follow}
    else
+      {:follow, {:ok, %Follower{approved: true} = _follow}} ->
+        Logger.debug("Follow already accepted")
+        {:error, "Follow already accepted"}
+
      {:follow, _} ->
        Logger.debug(
          "Tried to handle an Accept activity but it's not containing a Follow activity"
@ -770,9 +778,6 @@ defmodule Mobilizon.Federation.ActivityPub.Transmogrifier do

      {:same_actor} ->
        {:error, "Actor who accepted the follow wasn't the target. Quite odd."}
-
-      {:ok, %Follower{approved: true} = _follow} ->
-        {:error, "Follow already accepted"}
    end
  end

--- a/lib/federation/activity_pub/types/actors.ex
+++ b/lib/federation/activity_pub/types/actors.ex
@ -1,7 +1,7 @@
 defmodule Mobilizon.Federation.ActivityPub.Types.Actors do
  @moduledoc false
  alias Mobilizon.Actors
-  alias Mobilizon.Actors.{Actor, Member}
+  alias Mobilizon.Actors.{Actor, Follower, Member}
  alias Mobilizon.Federation.ActivityPub
  alias Mobilizon.Federation.ActivityPub.Audience
  alias Mobilizon.Federation.ActivityPub.Types.Entity
@ -9,6 +9,7 @@ defmodule Mobilizon.Federation.ActivityPub.Types.Actors do
  alias Mobilizon.GraphQL.API.Utils, as: APIUtils
  alias Mobilizon.Service.Formatter.HTML
  alias Mobilizon.Service.Notifications.Scheduler
+  alias Mobilizon.Web.Email.Follow, as: FollowMailer
  alias Mobilizon.Web.Endpoint
  import Mobilizon.Federation.ActivityPub.Utils, only: [make_create_data: 2, make_update_data: 2]

@ -130,6 +131,15 @@ defmodule Mobilizon.Federation.ActivityPub.Types.Actors do
    end
  end

+  def follow(%Actor{} = follower_actor, %Actor{} = followed, _local, additional) do
+    with {:ok, %Follower{} = follower} <-
+           Mobilizon.Actors.follow(followed, follower_actor, additional["activity_id"], false),
+         :ok <- FollowMailer.send_notification_to_admins(follower),
+         follower_as_data <- Convertible.model_to_as(follower) do
+      approve_if_manually_approves_followers(follower, follower_as_data)
+    end
+  end
+
  defp prepare_args_for_actor(args) do
    args
    |> maybe_sanitize_username()
@ -189,4 +199,21 @@ defmodule Mobilizon.Federation.ActivityPub.Types.Actors do
      {:ok, activity_data, member}
    end
  end
+
+  defp approve_if_manually_approves_followers(
+         %Follower{} = follower,
+         follow_as_data
+       ) do
+    unless follower.target_actor.manually_approves_followers do
+      {:accept,
+       ActivityPub.accept(
+         :follow,
+         follower,
+         true,
+         %{"actor" => follower.actor.url}
+       )}
+    end
+
+    {:ok, follow_as_data, follower}
+  end
 end
--- a/lib/graphql/resolvers/followers.ex
+++ b/lib/graphql/resolvers/followers.ex
@ -0,0 +1,64 @@
+defmodule Mobilizon.GraphQL.Resolvers.Followers do
+  @moduledoc """
+  Handles the followers-related GraphQL calls.
+  """
+
+  import Mobilizon.Users.Guards
+  alias Mobilizon.{Actors, Users}
+  alias Mobilizon.Actors.{Actor, Follower}
+  alias Mobilizon.Federation.ActivityPub
+  alias Mobilizon.Storage.Page
+  alias Mobilizon.Users.User
+
+  @spec find_followers_for_group(Actor.t(), map(), map()) :: {:ok, Page.t()}
+  def find_followers_for_group(
+        %Actor{id: group_id} = group,
+        %{page: page, limit: limit} = args,
+        %{
+          context: %{
+            current_user: %User{role: user_role} = user
+          }
+        }
+      ) do
+    with {:actor, %Actor{id: actor_id} = _actor} <- {:actor, Users.get_actor_for_user(user)},
+         {:member, true} <-
+           {:member, Actors.is_moderator?(actor_id, group_id) or is_moderator(user_role)} do
+      {:ok,
+       Actors.list_paginated_followers_for_actor(group, Map.get(args, :approved), page, limit)}
+    else
+      _ -> {:error, :unauthorized}
+    end
+  end
+
+  def find_followers_for_group(_, _, _), do: {:error, :unauthenticated}
+
+  @spec update_follower(any(), map(), map()) :: {:ok, Follower.t()} | {:error, any()}
+  def update_follower(_, %{id: follower_id, approved: approved}, %{
+        context: %{
+          current_user: %User{} = user
+        }
+      }) do
+    with {:actor, %Actor{id: actor_id} = _actor} <- {:actor, Users.get_actor_for_user(user)},
+         %Follower{target_actor: %Actor{type: :Group, id: group_id}} = follower <-
+           Actors.get_follower(follower_id),
+         {:member, true} <-
+           {:member, Actors.is_moderator?(actor_id, group_id)},
+         {:ok, _activity, %Follower{} = follower} <-
+           (if approved do
+              ActivityPub.accept(:follow, follower)
+            else
+              ActivityPub.reject(:follow, follower)
+            end) do
+      {:ok, follower}
+    else
+      {:member, _} ->
+        {:error, :unauthorized}
+
+      _ ->
+        {:error,
+         if(approved, do: "Unable to approve follower", else: "Unable to reject follower")}
+    end
+  end
+
+  def update_follower(_, _, _), do: {:error, :unauthenticated}
+end
--- a/lib/graphql/resolvers/group.ex
+++ b/lib/graphql/resolvers/group.ex
@ -26,8 +26,8 @@ defmodule Mobilizon.GraphQL.Resolvers.Group do
          }
        }
      ) do
-    with {:ok, %Actor{id: group_id} = group} <-
-           ActivityPub.find_or_make_group_from_nickname(name),
+    with {:group, {:ok, %Actor{id: group_id} = group}} <-
+           {:group, ActivityPub.find_or_make_group_from_nickname(name)},
         {:actor, %Actor{id: actor_id} = _actor} <- {:actor, Users.get_actor_for_user(user)},
         {:member, true} <- {:member, Actors.is_member?(actor_id, group_id)} do
      {:ok, group}
@ -35,8 +35,11 @@ defmodule Mobilizon.GraphQL.Resolvers.Group do
      {:member, false} ->
        find_group(parent, args, nil)

-      _ ->
+      {:group, _} ->
        {:error, :group_not_found}
+
+      _ ->
+        {:error, :unknown}
    end
  end

--- a/lib/graphql/schema.ex
+++ b/lib/graphql/schema.ex
@ -177,6 +177,7 @@ defmodule Mobilizon.GraphQL.Schema do
    import_fields(:resource_mutations)
    import_fields(:post_mutations)
    import_fields(:actor_mutations)
+    import_fields(:follower_mutations)
  end

  @desc """
--- a/lib/graphql/schema/actor.ex
+++ b/lib/graphql/schema/actor.ex
@ -32,8 +32,6 @@ defmodule Mobilizon.GraphQL.Schema.ActorInterface do
    field(:banner, :media, description: "The actor's banner media")

    # These one should have a privacy setting
-    field(:following, list_of(:follower), description: "List of followings")
-    field(:followers, list_of(:follower), description: "List of followers")
    field(:followersCount, :integer, description: "Number of followers for this actor")
    field(:followingCount, :integer, description: "Number of actors following this actor")

--- a/lib/graphql/schema/actors/application.ex
+++ b/lib/graphql/schema/actors/application.ex
@ -31,8 +31,6 @@ defmodule Mobilizon.GraphQL.Schema.Actors.ApplicationType do
    field(:banner, :media, description: "The actor's banner media")

    # These one should have a privacy setting
-    field(:following, list_of(:follower), description: "List of followings")
-    field(:followers, list_of(:follower), description: "List of followers")
    field(:followersCount, :integer, description: "Number of followers for this actor")
    field(:followingCount, :integer, description: "Number of actors following this actor")

--- a/lib/graphql/schema/actors/follower.ex
+++ b/lib/graphql/schema/actors/follower.ex
@ -3,11 +3,13 @@ defmodule Mobilizon.GraphQL.Schema.Actors.FollowerType do
  Schema representation for Follower
  """
  use Absinthe.Schema.Notation
+  alias Mobilizon.GraphQL.Resolvers.Followers

  @desc """
  Represents an actor's follower
  """
  object :follower do
+    field(:id, :id, description: "The follow ID")
    field(:target_actor, :actor, description: "What or who the profile follows")
    field(:actor, :actor, description: "Which profile follows")

@ -26,4 +28,17 @@ defmodule Mobilizon.GraphQL.Schema.Actors.FollowerType do
    field(:elements, list_of(:follower), description: "A list of followers")
    field(:total, :integer, description: "The total number of elements in the list")
  end
+
+  object :follower_mutations do
+    @desc "Update follower"
+    field :update_follower, :follower do
+      arg(:id, non_null(:id), description: "The follower ID")
+
+      arg(:approved, non_null(:boolean),
+        description: "Whether the follower has been approved by the target actor or not"
+      )
+
+      resolve(&Followers.update_follower/3)
+    end
+  end
 end
--- a/lib/graphql/schema/actors/group.ex
+++ b/lib/graphql/schema/actors/group.ex
@ -8,7 +8,18 @@ defmodule Mobilizon.GraphQL.Schema.Actors.GroupType do
  import Absinthe.Resolution.Helpers, only: [dataloader: 1]

  alias Mobilizon.Addresses
-  alias Mobilizon.GraphQL.Resolvers.{Discussion, Group, Media, Member, Post, Resource, Todos}
+
+  alias Mobilizon.GraphQL.Resolvers.{
+    Discussion,
+    Followers,
+    Group,
+    Media,
+    Member,
+    Post,
+    Resource,
+    Todos
+  }
+
  alias Mobilizon.GraphQL.Schema

  import_types(Schema.Actors.MemberType)
@ -47,8 +58,6 @@ defmodule Mobilizon.GraphQL.Schema.Actors.GroupType do
    )

    # These one should have a privacy setting
-    field(:following, list_of(:follower), description: "List of followings")
-    field(:followers, list_of(:follower), description: "List of followers")
    field(:followersCount, :integer, description: "Number of followers for this actor")
    field(:followingCount, :integer, description: "Number of actors following this actor")

@ -116,6 +125,23 @@ defmodule Mobilizon.GraphQL.Schema.Actors.GroupType do
      resolve(&Todos.find_todo_lists_for_group/3)
      description("A paginated list of the todo lists this group has")
    end
+
+    field :followers, :paginated_follower_list do
+      arg(:page, :integer,
+        default_value: 1,
+        description: "The page in the paginated followers list"
+      )
+
+      arg(:limit, :integer, default_value: 10, description: "The limit of followers per page")
+
+      arg(:approved, :boolean,
+        default_value: nil,
+        description: "Used to filter the followers list by approved status"
+      )
+
+      resolve(&Followers.find_followers_for_group/3)
+      description("A paginated list of the followers this group has")
+    end
  end

  @desc """
@ -232,6 +258,10 @@ defmodule Mobilizon.GraphQL.Schema.Actors.GroupType do
        description: "Whether the group can be join freely, with approval or is invite-only."
      )

+      arg(:manually_approves_followers, :boolean,
+        description: "Whether this group approves new followers manually"
+      )
+
      arg(:avatar, :media_input,
        description:
          "The avatar for the group, either as an object or directly the ID of an existing media"
--- a/lib/graphql/schema/actors/person.ex
+++ b/lib/graphql/schema/actors/person.ex
@ -44,8 +44,6 @@ defmodule Mobilizon.GraphQL.Schema.Actors.PersonType do
    field(:banner, :media, description: "The actor's banner media")

    # These one should have a privacy setting
-    field(:following, list_of(:follower), description: "List of followings")
-    field(:followers, list_of(:follower), description: "List of followers")
    field(:followersCount, :integer, description: "Number of followers for this actor")
    field(:followingCount, :integer, description: "Number of actors following this actor")

--- a/lib/mobilizon/actors/actors.ex
+++ b/lib/mobilizon/actors/actors.ex
@ -1022,6 +1022,16 @@ defmodule Mobilizon.Actors do
  @spec list_bots :: [Bot.t()]
  def list_bots, do: Repo.all(Bot)

+  @doc """
+  Gets a single follower.
+  """
+  @spec get_follower(integer | String.t()) :: Follower.t() | nil
+  def get_follower(id) do
+    Follower
+    |> Repo.get(id)
+    |> Repo.preload([:actor, :target_actor])
+  end
+
  @doc """
  Gets a single follower.
  Raises `Ecto.NoResultsError` if the follower does not exist.
@ -1149,6 +1159,25 @@ defmodule Mobilizon.Actors do
    |> Repo.aggregate(:count)
  end

+  @doc """
+  Returns a paginated list of followers for an actor.
+  """
+  @spec list_paginated_followers_for_actor(Actor.t(), boolean | nil, integer | nil, integer | nil) ::
+          Page.t()
+  def list_paginated_followers_for_actor(
+        %Actor{id: actor_id},
+        approved \\ nil,
+        page \\ nil,
+        limit \\ nil
+      ) do
+    actor_id
+    |> follower_for_actor_query()
+    |> filter_followed_by_approved_status(approved)
+    |> order_by(desc: :updated_at)
+    |> preload([:actor, :target_actor])
+    |> Page.build_page(page, limit)
+  end
+
  @doc """
  Returns the list of followings for an actor.
  If actor A follows actor B and C, actor A's followings are B and C.
@ -1688,6 +1717,13 @@ defmodule Mobilizon.Actors do
    from(a in query, where: a.preferred_username == ^name and a.domain == ^domain)
  end

+  @spec filter_by_name(Ecto.Query.t(), boolean | nil) :: Ecto.Query.t()
+  defp filter_followed_by_approved_status(query, nil), do: query
+
+  defp filter_followed_by_approved_status(query, approved) do
+    from(f in query, where: f.approved == ^approved)
+  end
+
  @spec preload_followers(Actor.t(), boolean) :: Actor.t()
  defp preload_followers(actor, true), do: Repo.preload(actor, [:followers])
  defp preload_followers(actor, false), do: actor
--- a/mix.exs
+++ b/mix.exs
@ -1,7 +1,7 @@
 defmodule Mobilizon.Mixfile do
  use Mix.Project

-  @version "1.0.3"
+  @version "1.0.4"

  def project do
    [
@ -104,11 +104,13 @@ defmodule Mobilizon.Mixfile do
      {:geolix, "~> 2.0"},
      {:geolix_adapter_mmdb2, "~> 0.6.0"},
      {:absinthe, "~> 1.6"},
-      {:absinthe_phoenix, github: "tcitworld/absinthe_phoenix", branch: "patch-1"},
+      {:absinthe_phoenix,
+       github: "absinthe-graphql/absinthe_phoenix",
+       ref: "67dc53db5b826ea12f37860bcce4334d4aaad028"},
      {:absinthe_plug, "~> 1.5.0"},
      {:dataloader, "~> 1.0.6"},
      {:plug_cowboy, "~> 2.0"},
-      {:atomex, "0.3.0"},
+      {:atomex, github: "Betree/atomex"},
      {:cachex, "~> 3.1"},
      {:geohax, "~> 0.4.0"},
      {:mogrify, "~> 0.8.0"},
@ -135,7 +137,7 @@ defmodule Mobilizon.Mixfile do
      {:ecto_shortuuid, "~> 0.1"},
      {:tesla, "~> 1.4.0"},
      {:sitemapper, "~> 0.5.0"},
-      {:xml_builder, "~> 2.1.1", override: true},
+      {:xml_builder, "~> 2.1.1"},
      {:remote_ip, "~> 0.2.0"},
      {:ex_cldr_languages, "~> 0.2.1"},
      {:slugger, "~> 0.3"},
--- a/mix.lock
+++ b/mix.lock
@ -1,10 +1,10 @@
 %{
  "absinthe": {:hex, :absinthe, "1.6.0", "7cb42eebbb9cbf5077541d73c189e205ebe12caf1c78372fc5b9e706fc8ac298", [:mix], [{:dataloader, "~> 1.0.0", [hex: :dataloader, repo: "hexpm", optional: true]}, {:decimal, "~> 1.0 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: true]}, {:nimble_parsec, "~> 0.5 or ~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "99915841495522332b3af8ff10c9cbb51e256b28d9b19c0dfaac5f044b6bfb66"},
  "absinthe_ecto": {:hex, :absinthe_ecto, "0.1.3", "420b68129e79fe4571a4838904ba03e282330d335da47729ad52ffd7b8c5fcb1", [:mix], [{:absinthe, "~> 1.3.0 or ~> 1.4.0", [hex: :absinthe, repo: "hexpm", optional: false]}, {:ecto, ">= 0.0.0", [hex: :ecto, repo: "hexpm", optional: false]}], "hexpm", "355b9db34abfab96ae1e025434b66e11002babcf4fe6b7144d26ff7548985f52"},
-  "absinthe_phoenix": {:git, "https://github.com/tcitworld/absinthe_phoenix.git", "4759d4141fb6254f5e7726ad6a00d7618116fb9e", [branch: "patch-1"]},
+  "absinthe_phoenix": {:git, "https://github.com/absinthe-graphql/absinthe_phoenix.git", "67dc53db5b826ea12f37860bcce4334d4aaad028", [ref: "67dc53db5b826ea12f37860bcce4334d4aaad028"]},
  "absinthe_plug": {:hex, :absinthe_plug, "1.5.3", "40b62edddc7db94098ab2f4a3011c17189862a3dbc50580fc92e3cb7953e9b36", [:mix], [{:absinthe, "~> 1.5", [hex: :absinthe, repo: "hexpm", optional: false]}, {:plug, "~> 1.4", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "8378204b9b0c1f37bd7a52ecde8fa627e553a8bf04610d20e1bce2dbde71fdb2"},
  "argon2_elixir": {:hex, :argon2_elixir, "2.4.0", "2a22ea06e979f524c53b42b598fc6ba38cdcbc977a155e33e057732cfb1fb311", [:make, :mix], [{:comeonin, "~> 5.3", [hex: :comeonin, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "4ea82e183cf8e7f66dab1f767fedcfe6a195e140357ef2b0423146b72e0a551d"},
-  "atomex": {:hex, :atomex, "0.3.0", "19b5d1a2aef8706dbd307385f7d5d9f6f273869226d317492c396c7bacf26402", [:mix], [{:xml_builder, "~> 2.0.0", [hex: :xml_builder, repo: "hexpm", optional: false]}], "hexpm", "025dbc3a3e99380894791a093019f535d0ef6cf1916f6ec1b778ac107fcfc3e4"},
+  "atomex": {:git, "https://github.com/Betree/atomex.git", "d1cc0988fe9d2c5f4d1feb8c6a89b1ea2266199c", []},
  "auto_linker": {:git, "https://git.pleroma.social/pleroma/auto_linker.git", "95e8188490e97505c56636c1379ffdf036c1fdde", [ref: "95e8188490e97505c56636c1379ffdf036c1fdde"]},
  "bamboo": {:hex, :bamboo, "1.6.0", "adfb583bef028923aae6f22deaea6667290561da1246058556ecaeb0fec5a175", [:mix], [{:hackney, ">= 1.13.0", [hex: :hackney, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "454e67feacbc9b6e00553ce1d2fba003c861e0035600d59b09d6159985b17f9b"},
  "bamboo_smtp": {:hex, :bamboo_smtp, "3.0.0", "b7f0c371af96a1cb7131908918b02abb228f9db234910bf10cf4fb177c083259", [:mix], [{:bamboo, "~> 1.2", [hex: :bamboo, repo: "hexpm", optional: false]}, {:gen_smtp, "~> 0.15.0", [hex: :gen_smtp, repo: "hexpm", optional: false]}], "hexpm", "77cb1fa3076b24109e54df622161fe1e5619376b4ecf86d8b99b46f327acc49f"},
@ -13,7 +13,7 @@
  "certifi": {:hex, :certifi, "2.5.3", "70bdd7e7188c804f3a30ee0e7c99655bc35d8ac41c23e12325f36ab449b70651", [:rebar3], [{:parse_trans, "~>3.3", [hex: :parse_trans, repo: "hexpm", optional: false]}], "hexpm", "ed516acb3929b101208a9d700062d520f3953da3b6b918d866106ffa980e1c10"},
  "cldr_utils": {:hex, :cldr_utils, "2.14.0", "edcef8dd2654b93d84a90087f3536ffabf9c9d82b34ff82bc9ca54c0668b3a4a", [:mix], [{:castore, "~> 0.1", [hex: :castore, repo: "hexpm", optional: true]}, {:certifi, "~> 2.5", [hex: :certifi, repo: "hexpm", optional: true]}, {:decimal, "~> 1.6 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}], "hexpm", "6903356ff6988342a29b90637eece4ca98a4ed2b9759c22233d3474ade57645a"},
  "combine": {:hex, :combine, "0.10.0", "eff8224eeb56498a2af13011d142c5e7997a80c8f5b97c499f84c841032e429f", [:mix], [], "hexpm", "1b1dbc1790073076580d0d1d64e42eae2366583e7aecd455d1215b0d16f2451b"},
-  "comeonin": {:hex, :comeonin, "5.3.1", "7fe612b739c78c9c1a75186ef2d322ce4d25032d119823269d0aa1e2f1e20025", [:mix], [], "hexpm", "d6222483060c17f0977fad1b7401ef0c5863c985a64352755f366aee3799c245"},
+  "comeonin": {:hex, :comeonin, "5.3.2", "5c2f893d05c56ae3f5e24c1b983c2d5dfb88c6d979c9287a76a7feb1e1d8d646", [:mix], [], "hexpm", "d0993402844c49539aeadb3fe46a3c9bd190f1ecf86b6f9ebd71957534c95f04"},
  "connection": {:hex, :connection, "1.1.0", "ff2a49c4b75b6fb3e674bfc5536451607270aac754ffd1bdfe175abe4a6d7a68", [:mix], [], "hexpm", "722c1eb0a418fbe91ba7bd59a47e28008a189d47e37e0e7bb85585a016b2869c"},
  "cors_plug": {:hex, :cors_plug, "2.0.2", "2b46083af45e4bc79632bd951550509395935d3e7973275b2b743bd63cc942ce", [:mix], [{:plug, "~> 1.8", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "f0d0e13f71c51fd4ef8b2c7e051388e4dfb267522a83a22392c856de7e46465f"},
  "cowboy": {:hex, :cowboy, "2.8.0", "f3dc62e35797ecd9ac1b50db74611193c29815401e53bac9a5c0577bd7bc667d", [:rebar3], [{:cowlib, "~> 2.9.1", [hex: :cowlib, repo: "hexpm", optional: false]}, {:ranch, "~> 1.7.1", [hex: :ranch, repo: "hexpm", optional: false]}], "hexpm", "4643e4fba74ac96d4d152c75803de6fad0b3fa5df354c71afdd6cbeeb15fac8a"},
@ -22,7 +22,7 @@
  "credo": {:hex, :credo, "1.5.4", "9914180105b438e378e94a844ec3a5088ae5875626fc945b7c1462b41afc3198", [:mix], [{:bunt, "~> 0.2.0", [hex: :bunt, repo: "hexpm", optional: false]}, {:file_system, "~> 0.2.8", [hex: :file_system, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "cf51af45eadc0a3f39ba13b56fdac415c91b34f7b7533a13dc13550277141bc4"},
  "dataloader": {:hex, :dataloader, "1.0.8", "114294362db98a613f231589246aa5b0ce847412e8e75c4c94f31f204d272cbf", [:mix], [{:ecto, ">= 3.4.3 and < 4.0.0", [hex: :ecto, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "eaf3c2aa2bc9dbd2f1e960561d616b7f593396c4754185b75904f6d66c82a667"},
  "db_connection": {:hex, :db_connection, "2.3.1", "4c9f3ed1ef37471cbdd2762d6655be11e38193904d9c5c1c9389f1b891a3088e", [:mix], [{:connection, "~> 1.0", [hex: :connection, repo: "hexpm", optional: false]}], "hexpm", "abaab61780dde30301d840417890bd9f74131041afd02174cf4e10635b3a63f5"},
-  "decimal": {:hex, :decimal, "1.9.0", "83e8daf59631d632b171faabafb4a9f4242c514b0a06ba3df493951c08f64d07", [:mix], [], "hexpm", "b1f2343568eed6928f3e751cf2dffde95bfaa19dd95d09e8a9ea92ccfd6f7d85"},
+  "decimal": {:hex, :decimal, "2.0.0", "a78296e617b0f5dd4c6caf57c714431347912ffb1d0842e998e9792b5642d697", [:mix], [], "hexpm", "34666e9c55dea81013e77d9d87370fe6cb6291d1ef32f46a1600230b1d44f577"},
  "dialyxir": {:hex, :dialyxir, "1.0.0", "6a1fa629f7881a9f5aaf3a78f094b2a51a0357c843871b8bc98824e7342d00a5", [:mix], [{:erlex, ">= 0.2.6", [hex: :erlex, repo: "hexpm", optional: false]}], "hexpm", "aeb06588145fac14ca08d8061a142d52753dbc2cf7f0d00fc1013f53f8654654"},
  "earmark": {:hex, :earmark, "1.4.13", "2c6ce9768fc9fdbf4046f457e207df6360ee6c91ee1ecb8e9a139f96a4289d91", [:mix], [{:earmark_parser, ">= 1.4.12", [hex: :earmark_parser, repo: "hexpm", optional: false]}], "hexpm", "a0cf3ed88ef2b1964df408889b5ecb886d1a048edde53497fc935ccd15af3403"},
  "earmark_parser": {:hex, :earmark_parser, "1.4.12", "b245e875ec0a311a342320da0551da407d9d2b65d98f7a9597ae078615af3449", [:mix], [], "hexpm", "711e2cc4d64abb7d566d43f54b78f7dc129308a63bc103fbd88550d2174b3160"},
@ -35,7 +35,7 @@
  "elixir_make": {:hex, :elixir_make, "0.6.2", "7dffacd77dec4c37b39af867cedaabb0b59f6a871f89722c25b28fcd4bd70530", [:mix], [], "hexpm", "03e49eadda22526a7e5279d53321d1cced6552f344ba4e03e619063de75348d9"},
  "erlex": {:hex, :erlex, "0.2.6", "c7987d15e899c7a2f34f5420d2a2ea0d659682c06ac607572df55a43753aa12e", [:mix], [], "hexpm", "2ed2e25711feb44d52b17d2780eabf998452f6efda104877a3881c2f8c0c0c75"},
  "esaml": {:git, "git://github.com/wrren/esaml.git", "2cace5778e4323216bcff2085ca9739e42a68a42", [branch: "ueberauth_saml"]},
-  "eternal": {:hex, :eternal, "1.2.1", "d5b6b2499ba876c57be2581b5b999ee9bdf861c647401066d3eeed111d096bc4", [:mix], [], "hexpm", "b14f1dc204321429479c569cfbe8fb287541184ed040956c8862cb7a677b8406"},
+  "eternal": {:hex, :eternal, "1.2.2", "d1641c86368de99375b98d183042dd6c2b234262b8d08dfd72b9eeaafc2a1abd", [:mix], [], "hexpm", "2c9fe32b9c3726703ba5e1d43a1d255a4f3f2d8f8f9bc19f094c7cb1a7a9e782"},
  "ex_cldr": {:hex, :ex_cldr, "2.18.2", "c0557145c234a4d31ff450a0438c5a70e786ccba9449a9f9f895809be20bed7d", [:mix], [{:castore, "~> 0.1", [hex: :castore, repo: "hexpm", optional: true]}, {:certifi, "~> 2.5", [hex: :certifi, repo: "hexpm", optional: true]}, {:cldr_utils, "~> 2.12", [hex: :cldr_utils, repo: "hexpm", optional: false]}, {:decimal, "~> 1.6 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:gettext, "~> 0.13", [hex: :gettext, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:nimble_parsec, "~> 0.5 or ~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: false]}, {:plug, "~> 1.9", [hex: :plug, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4.0", [hex: :telemetry, repo: "hexpm", optional: true]}], "hexpm", "ac28055ae6df438b72f98703c842c2c0d969af6bd68662a8f586862a9a0ddc79"},
  "ex_cldr_calendars": {:hex, :ex_cldr_calendars, "1.12.0", "0cf7c804937a93baa9c3b471667ad05c478942865cc457e8397b5d83fc6f2c7a", [:mix], [{:calendar_interval, "~> 0.2", [hex: :calendar_interval, repo: "hexpm", optional: true]}, {:earmark, "~> 1.0", [hex: :earmark, repo: "hexpm", optional: false]}, {:ex_cldr_numbers, "~> 2.16", [hex: :ex_cldr_numbers, repo: "hexpm", optional: false]}, {:ex_cldr_units, "~> 3.3", [hex: :ex_cldr_units, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "edcb91ec52ee4e24a928e2bcf6d3354da465eced42887fbdb3f878a7a329963f"},
  "ex_cldr_currencies": {:hex, :ex_cldr_currencies, "2.8.0", "b2ecc94e9fa4b8ec07614830f4d6e811e5df5e7679c6d2be92f4fe4f31184913", [:mix], [{:ex_cldr, "~> 2.18", [hex: :ex_cldr, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm", "a39780667b73bfd3d2bd08e61981bca23a97912b86f3236042850ecb062f48eb"},
@ -76,7 +76,7 @@
  "html_sanitize_ex": {:hex, :html_sanitize_ex, "1.4.0", "0310d27d7bafb662f30bff22ec732a72414799c83eaf44239781fd23b96216c0", [:mix], [{:mochiweb, "~> 2.15", [hex: :mochiweb, repo: "hexpm", optional: false]}], "hexpm", "c5d79626be0b6e50c19ecdfb783ee26e85bd3a77436b488379ce6dc104ec4593"},
  "http_sign": {:hex, :http_sign, "0.1.1", "b16edb83aa282892f3271f9a048c155e772bf36e15700ab93901484c55f8dd10", [:mix], [{:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "2d4b1c2579d85534035f12c9e1260abdf6d03a9ad4f515b2ee53b50e68c8b787"},
  "http_signatures": {:hex, :http_signatures, "0.1.0", "4e4b501a936dbf4cb5222597038a89ea10781776770d2e185849fa829686b34c", [:mix], [], "hexpm", "f8a7b3731e3fd17d38fa6e343fcad7b03d6874a3b0a108c8568a71ed9c2cf824"},
-  "httpoison": {:hex, :httpoison, "1.7.0", "abba7d086233c2d8574726227b6c2c4f6e53c4deae7fe5f6de531162ce9929a0", [:mix], [{:hackney, "~> 1.16", [hex: :hackney, repo: "hexpm", optional: false]}], "hexpm", "975cc87c845a103d3d1ea1ccfd68a2700c211a434d8428b10c323dc95dc5b980"},
+  "httpoison": {:hex, :httpoison, "1.8.0", "6b85dea15820b7804ef607ff78406ab449dd78bed923a49c7160e1886e987a3d", [:mix], [{:hackney, "~> 1.17", [hex: :hackney, repo: "hexpm", optional: false]}], "hexpm", "28089eaa98cf90c66265b6b5ad87c59a3729bea2e74e9d08f9b51eb9729b3c3a"},
  "icalendar": {:git, "https://github.com/tcitworld/icalendar.git", "e16a3a0b74e07ba79044361fbf5014bed344f2da", []},
  "idna": {:hex, :idna, "6.1.1", "8a63070e9f7d0c62eb9d9fcb360a7de382448200fbbd1b106cc96d3d8099df8d", [:rebar3], [{:unicode_util_compat, "~>0.7.0", [hex: :unicode_util_compat, repo: "hexpm", optional: false]}], "hexpm", "92376eb7894412ed19ac475e4a86f7b413c1b9fbb5bd16dccd57934157944cea"},
  "inet_cidr": {:hex, :inet_cidr, "1.0.4", "a05744ab7c221ca8e395c926c3919a821eb512e8f36547c062f62c4ca0cf3d6e", [:mix], [], "hexpm", "64a2d30189704ae41ca7dbdd587f5291db5d1dda1414e0774c29ffc81088c1bc"},
@ -118,8 +118,8 @@
  "plug_crypto": {:hex, :plug_crypto, "1.2.0", "1cb20793aa63a6c619dd18bb33d7a3aa94818e5fd39ad357051a67f26dfa2df6", [:mix], [], "hexpm", "a48b538ae8bf381ffac344520755f3007cc10bd8e90b240af98ea29b69683fc2"},
  "poison": {:hex, :poison, "4.0.1", "bcb755a16fac91cad79bfe9fc3585bb07b9331e50cfe3420a24bcc2d735709ae", [:mix], [], "hexpm", "ba8836feea4b394bb718a161fc59a288fe0109b5006d6bdf97b6badfcf6f0f25"},
  "poolboy": {:hex, :poolboy, "1.5.2", "392b007a1693a64540cead79830443abf5762f5d30cf50bc95cb2c1aaafa006b", [:rebar3], [], "hexpm", "dad79704ce5440f3d5a3681c8590b9dc25d1a561e8f5a9c995281012860901e3"},
-  "postgrex": {:hex, :postgrex, "0.15.7", "724410acd48abac529d0faa6c2a379fb8ae2088e31247687b16cacc0e0883372", [:mix], [{:connection, "~> 1.0", [hex: :connection, repo: "hexpm", optional: false]}, {:db_connection, "~> 2.1", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm", "88310c010ff047cecd73d5ceca1d99205e4b1ab1b9abfdab7e00f5c9d20ef8f9"},
-  "progress_bar": {:hex, :progress_bar, "2.0.0", "447285f533b4b8717881fdb7160c7360c2f2ab57276f8904ce6d40482857e573", [:mix], [{:decimal, "~> 1.0", [hex: :decimal, repo: "hexpm", optional: false]}], "hexpm", "9d8b879f322fd5563e8e7ec39f1d02a9da3ffc36019f05287788744e88260fde"},
+  "postgrex": {:hex, :postgrex, "0.15.8", "f5e782bbe5e8fa178d5e3cd1999c857dc48eda95f0a4d7f7bd92a50e84a0d491", [:mix], [{:connection, "~> 1.0", [hex: :connection, repo: "hexpm", optional: false]}, {:db_connection, "~> 2.1", [hex: :db_connection, repo: "hexpm", optional: false]}, {:decimal, "~> 1.5 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}], "hexpm", "698fbfacea34c4cf22c8281abeb5cf68d99628d541874f085520ab3b53d356fe"},
+  "progress_bar": {:hex, :progress_bar, "2.0.1", "7b40200112ae533d5adceb80ff75fbe66dc753bca5f6c55c073bfc122d71896d", [:mix], [{:decimal, "~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}], "hexpm", "2519eb58a2f149a3a094e729378256d8cb6d96a259ec94841bd69fdc71f18f87"},
  "ranch": {:hex, :ranch, "1.7.1", "6b1fab51b49196860b733a49c07604465a47bdb78aa10c1c16a3d199f7f8c881", [:rebar3], [], "hexpm", "451d8527787df716d99dc36162fca05934915db0b6141bbdac2ea8d3c7afc7d7"},
  "remote_ip": {:hex, :remote_ip, "0.2.1", "cd27cd8ea54ecaaf3532776ff4c5e353b3804e710302e88c01eadeaaf42e7e24", [:mix], [{:combine, "~> 0.10", [hex: :combine, repo: "hexpm", optional: false]}, {:inet_cidr, "~> 1.0", [hex: :inet_cidr, repo: "hexpm", optional: false]}, {:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "2e7ab1a461cc3cd5719f37e116a08f45c8b8493923063631b164315d6b7ee8e0"},
  "rsa_ex": {:hex, :rsa_ex, "0.4.0", "e28dd7dc5236e156df434af0e4aa822384c8866c928e17b785d4edb7c253b558", [:mix], [], "hexpm", "40e1f08e8401da4be59a6dd0f4da30c42d5bb01703161f0208d839d97db27f4e"},
--- a/test/federation/activity_pub/transmogrifier/follow_test.exs
+++ b/test/federation/activity_pub/transmogrifier/follow_test.exs
@ -3,19 +3,73 @@ defmodule Mobilizon.Federation.ActivityPub.Transmogrifier.FollowTest do

  import Mobilizon.Factory
  alias Mobilizon.Actors
+  alias Mobilizon.Actors.Follower
  alias Mobilizon.Federation.ActivityPub
  alias Mobilizon.Federation.ActivityPub.{Activity, Transmogrifier}

+  describe "handle incoming follow requests" do
+    test "it works for incoming follow requests" do
+      actor = insert(:actor)
+
+      data =
+        File.read!("test/fixtures/mastodon-follow-activity.json")
+        |> Jason.decode!()
+        |> Map.put("object", actor.url)
+
+      {:ok, %Activity{data: data, local: false}, _} = Transmogrifier.handle_incoming(data)
+
+      assert data["actor"] == "https://social.tcit.fr/users/tcit"
+      assert data["type"] == "Follow"
+      assert data["id"] == "https://social.tcit.fr/users/tcit#follows/2"
+
+      actor = Actors.get_actor_with_preload(actor.id)
+      assert Actors.is_following(Actors.get_actor_by_url!(data["actor"], true), actor)
+    end
+
+    test "it rejects activities without a valid ID" do
+      actor = insert(:actor)
+
+      data =
+        File.read!("test/fixtures/mastodon-follow-activity.json")
+        |> Jason.decode!()
+        |> Map.put("object", actor.url)
+        |> Map.put("id", "")
+
+      :error = Transmogrifier.handle_incoming(data)
+    end
+
+    #     test "it works for incoming follow requests from hubzilla" do
+    #       user = insert(:user)
+
+    #       data =
+    #         File.read!("test/fixtures/hubzilla-follow-activity.json")
+    #         |> Jason.decode!()
+    #         |> Map.put("object", user.ap_id)
+    #         |> Utils.normalize_params()
+
+    #       {:ok, %Activity{data: data, local: false}} = Transmogrifier.handle_incoming(data)
+
+    #       assert data["actor"] == "https://hubzilla.example.org/channel/kaniini"
+    #       assert data["type"] == "Follow"
+    #       assert data["id"] == "https://hubzilla.example.org/channel/kaniini#follows/2"
+    #       assert User.is_following(User.get_by_ap_id(data["actor"]), user)
+    #     end
+  end
+
  describe "handle incoming follow accept activities" do
-    test "it works for incoming accepts which were pre-accepted" do
+    test "it works for incoming accepts" do
      follower = insert(:actor)
-      followed = insert(:actor)
+      followed = insert(:actor, manually_approves_followers: false)

      refute Actors.is_following(follower, followed)

      {:ok, follow_activity, _} = ActivityPub.follow(follower, followed)
      assert Actors.is_following(follower, followed)

+      follow_object_id = follow_activity.data["id"]
+
+      assert %Follower{} = Actors.get_follower_by_url(follow_object_id)
+
      accept_data =
        File.read!("test/fixtures/mastodon-accept-activity.json")
        |> Jason.decode!()
@ -24,7 +78,39 @@ defmodule Mobilizon.Federation.ActivityPub.Transmogrifier.FollowTest do
      object =
        accept_data["object"]
        |> Map.put("actor", follower.url)
-        |> Map.put("id", follow_activity.data["id"])
+        |> Map.put("id", follow_object_id)
+
+      accept_data = Map.put(accept_data, "object", object)
+
+      :error = Transmogrifier.handle_incoming(accept_data)
+
+      {:ok, follower} = Actors.get_actor_by_url(follower.url)
+
+      assert Actors.is_following(follower, followed)
+    end
+
+    test "it works for incoming accepts which were pre-accepted" do
+      follower = insert(:actor)
+      followed = insert(:actor, manually_approves_followers: true)
+
+      refute Actors.is_following(follower, followed)
+
+      {:ok, follow_activity, _} = ActivityPub.follow(follower, followed)
+      assert Actors.is_following(follower, followed)
+
+      follow_object_id = follow_activity.data["id"]
+
+      assert %Follower{} = Actors.get_follower_by_url(follow_object_id)
+
+      accept_data =
+        File.read!("test/fixtures/mastodon-accept-activity.json")
+        |> Jason.decode!()
+        |> Map.put("actor", followed.url)
+
+      object =
+        accept_data["object"]
+        |> Map.put("actor", follower.url)
+        |> Map.put("id", follow_object_id)

      accept_data = Map.put(accept_data, "object", object)

@ -40,7 +126,7 @@ defmodule Mobilizon.Federation.ActivityPub.Transmogrifier.FollowTest do

    test "it works for incoming accepts which are referenced by IRI only" do
      follower = insert(:actor)
-      followed = insert(:actor)
+      followed = insert(:actor, manually_approves_followers: true)

      {:ok, follow_activity, _} = ActivityPub.follow(follower, followed)

--- a/test/federation/activity_pub/transmogrifier_test.exs
+++ b/test/federation/activity_pub/transmogrifier_test.exs
@ -556,57 +556,6 @@ defmodule Mobilizon.Federation.ActivityPub.TransmogrifierTest do
    end
  end

-  describe "handle incoming follow requests" do
-    test "it works for incoming follow requests" do
-      use_cassette "activity_pub/mastodon_follow_activity" do
-        actor = insert(:actor)
-
-        data =
-          File.read!("test/fixtures/mastodon-follow-activity.json")
-          |> Jason.decode!()
-          |> Map.put("object", actor.url)
-
-        {:ok, %Activity{data: data, local: false}, _} = Transmogrifier.handle_incoming(data)
-
-        assert data["actor"] == "https://social.tcit.fr/users/tcit"
-        assert data["type"] == "Follow"
-        assert data["id"] == "https://social.tcit.fr/users/tcit#follows/2"
-
-        actor = Actors.get_actor_with_preload(actor.id)
-        assert Actors.is_following(Actors.get_actor_by_url!(data["actor"], true), actor)
-      end
-    end
-
-    test "it rejects activities without a valid ID" do
-      actor = insert(:actor)
-
-      data =
-        File.read!("test/fixtures/mastodon-follow-activity.json")
-        |> Jason.decode!()
-        |> Map.put("object", actor.url)
-        |> Map.put("id", "")
-
-      :error = Transmogrifier.handle_incoming(data)
-    end
-
-    #     test "it works for incoming follow requests from hubzilla" do
-    #       user = insert(:user)
-
-    #       data =
-    #         File.read!("test/fixtures/hubzilla-follow-activity.json")
-    #         |> Jason.decode!()
-    #         |> Map.put("object", user.ap_id)
-    #         |> Utils.normalize_params()
-
-    #       {:ok, %Activity{data: data, local: false}} = Transmogrifier.handle_incoming(data)
-
-    #       assert data["actor"] == "https://hubzilla.example.org/channel/kaniini"
-    #       assert data["type"] == "Follow"
-    #       assert data["id"] == "https://hubzilla.example.org/channel/kaniini#follows/2"
-    #       assert User.is_following(User.get_by_ap_id(data["actor"]), user)
-    #     end
-  end
-
  # test "it works for incoming likes" do
  #   %Comment{url: url} = insert(:comment)

--- a/test/graphql/resolvers/follower_test.exs
+++ b/test/graphql/resolvers/follower_test.exs
@ -0,0 +1,275 @@
+defmodule Mobilizon.Web.Resolvers.FollowerTest do
+  use Mobilizon.Web.ConnCase
+  use Oban.Testing, repo: Mobilizon.Storage.Repo
+
+  alias Mobilizon.Actors
+  alias Mobilizon.Actors.{Actor, Follower}
+
+  import Mobilizon.Factory
+
+  alias Mobilizon.GraphQL.AbsintheHelpers
+
+  setup %{conn: conn} do
+    user = insert(:user)
+    actor = insert(:actor, user: user)
+    group = insert(:group)
+    insert(:member, parent: group, actor: actor, role: :moderator)
+    follower = insert(:follower, target_actor: group)
+
+    {:ok, conn: conn, actor: actor, user: user, group: group, follower: follower}
+  end
+
+  @group_followers_query """
+  query(
+    $name: String!
+    $followersPage: Int
+    $followersLimit: Int
+    $approved: Boolean
+  ) {
+    group(preferredUsername: $name) {
+      id
+      preferredUsername
+      name
+      domain
+      followers(
+        page: $followersPage
+        limit: $followersLimit
+        approved: $approved
+      ) {
+        total
+        elements {
+          id
+          actor {
+            id
+            preferredUsername
+            name
+            domain
+            avatar {
+              id
+              url
+            }
+          }
+          approved
+          insertedAt
+          updatedAt
+        }
+      }
+    }
+  }
+  """
+
+  describe "list group followers find_followers_for_group/3" do
+    test "without being logged-in", %{
+      conn: conn,
+      group: %Actor{preferred_username: preferred_username}
+    } do
+      res =
+        conn
+        |> AbsintheHelpers.graphql_query(
+          query: @group_followers_query,
+          variables: %{name: preferred_username}
+        )
+
+      assert hd(res["errors"])["message"] == "unauthenticated"
+    end
+
+    test "without being a member", %{
+      conn: conn,
+      group: %Actor{preferred_username: preferred_username}
+    } do
+      user = insert(:user)
+      insert(:actor, user: user)
+
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @group_followers_query,
+          variables: %{name: preferred_username}
+        )
+
+      assert hd(res["errors"])["message"] == "unauthorized"
+    end
+
+    test "without being a moderator", %{
+      conn: conn,
+      group: %Actor{preferred_username: preferred_username} = group
+    } do
+      user = insert(:user)
+      actor = insert(:actor, user: user)
+      insert(:member, parent: group, actor: actor, role: :member)
+
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @group_followers_query,
+          variables: %{name: preferred_username}
+        )
+
+      assert hd(res["errors"])["message"] == "unauthorized"
+    end
+
+    test "while being a moderator", %{
+      conn: conn,
+      user: user,
+      group: %Actor{preferred_username: preferred_username, id: group_id} = group,
+      follower: %Follower{id: follower_id}
+    } do
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @group_followers_query,
+          variables: %{name: preferred_username}
+        )
+
+      assert res["errors"] == nil
+      assert res["data"]["group"]["id"] == to_string(group_id)
+      assert res["data"]["group"]["followers"]["total"] == 1
+      assert hd(res["data"]["group"]["followers"]["elements"])["id"] == to_string(follower_id)
+
+      Process.sleep(1000)
+      insert(:follower, target_actor: group)
+      Process.sleep(1000)
+      follower3 = insert(:follower, target_actor: group)
+
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @group_followers_query,
+          variables: %{
+            name: preferred_username,
+            followersLimit: 2,
+            followersPage: 1
+          }
+        )
+
+      assert res["errors"] == nil
+      assert res["data"]["group"]["id"] == to_string(group_id)
+      assert res["data"]["group"]["followers"]["total"] == 3
+      assert hd(res["data"]["group"]["followers"]["elements"])["id"] == to_string(follower3.id)
+
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @group_followers_query,
+          variables: %{
+            name: preferred_username,
+            followersLimit: 2,
+            followersPage: 2
+          }
+        )
+
+      assert res["errors"] == nil
+      assert res["data"]["group"]["id"] == to_string(group_id)
+      assert res["data"]["group"]["followers"]["total"] == 3
+      assert hd(res["data"]["group"]["followers"]["elements"])["id"] == to_string(follower_id)
+    end
+  end
+
+  @update_follower_mutation """
+  mutation UpdateFollower($id: ID!, $approved: Boolean) {
+    updateFollower(id: $id, approved: $approved) {
+      id
+      approved
+    }
+  }
+  """
+  describe "update a follower update_follower/3" do
+    test "without being logged-in", %{
+      conn: conn,
+      group: %Actor{} = group
+    } do
+      %Follower{id: follower_id} = insert(:follower, target_actor: group)
+
+      res =
+        conn
+        |> AbsintheHelpers.graphql_query(
+          query: @update_follower_mutation,
+          variables: %{id: follower_id, approved: true}
+        )
+
+      assert hd(res["errors"])["message"] == "You need to be logged in"
+    end
+
+    test "without being a member", %{
+      conn: conn,
+      group: %Actor{} = group
+    } do
+      user = insert(:user)
+      insert(:actor, user: user)
+      %Follower{id: follower_id} = insert(:follower, target_actor: group)
+
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @update_follower_mutation,
+          variables: %{id: follower_id, approved: true}
+        )
+
+      assert hd(res["errors"])["message"] == "You don't have permission to do this"
+    end
+
+    test "without being a moderator", %{
+      conn: conn,
+      group: %Actor{} = group
+    } do
+      user = insert(:user)
+      actor = insert(:actor, user: user)
+      insert(:member, parent: group, actor: actor, role: :member)
+      %Follower{id: follower_id} = insert(:follower, target_actor: group)
+
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @update_follower_mutation,
+          variables: %{id: follower_id, approved: true}
+        )
+
+      assert hd(res["errors"])["message"] == "You don't have permission to do this"
+    end
+
+    test "while being a moderator", %{
+      conn: conn,
+      user: user,
+      follower: %Follower{id: follower_id, approved: false}
+    } do
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @update_follower_mutation,
+          variables: %{id: follower_id, approved: true}
+        )
+
+      assert res["errors"] == nil
+      assert res["data"]["updateFollower"]["id"] == to_string(follower_id)
+
+      assert %Follower{approved: true} = Actors.get_follower(follower_id)
+    end
+
+    test "reject deletes the follower", %{
+      conn: conn,
+      user: user,
+      follower: %Follower{id: follower_id, approved: false}
+    } do
+      res =
+        conn
+        |> auth_conn(user)
+        |> AbsintheHelpers.graphql_query(
+          query: @update_follower_mutation,
+          variables: %{id: follower_id, approved: false}
+        )
+
+      assert res["errors"] == nil
+      assert res["data"]["updateFollower"]["id"] == to_string(follower_id)
+
+      assert is_nil(Actors.get_follower(follower_id))
+    end
+  end
+end
--- a/test/support/factory.ex
+++ b/test/support/factory.ex
@ -55,7 +55,8 @@ defmodule Mobilizon.Factory do
      shared_inbox_url: "#{Endpoint.url()}/inbox",
      last_refreshed_at: DateTime.utc_now(),
      user: build(:user),
-      visibility: :public
+      visibility: :public,
+      manually_approves_followers: false
    }
  end

@ -108,7 +109,8 @@ defmodule Mobilizon.Factory do
      target_actor: build(:actor),
      actor: build(:actor),
      id: uuid,
-      url: "#{Endpoint.url()}/follows/#{uuid}"
+      url: "#{Endpoint.url()}/follows/#{uuid}",
+      approved: false
    }
  end