Version 4.5.0

applications/core/api/GraphQL/Mutations/ChangeNotificationSetting.php

@@ -0,0 +1,156 @@
+<?php
+/**
+ * @brief		GraphQL: Change a notification setting
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		4 Aug 2019
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Change notification setting mutation for GraphQL API
+ */
+class _ChangeNotificationSetting
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Change a notification setting";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'id' => TypeRegistry::nonNull( TypeRegistry::string() ),
+			'extension' => TypeRegistry::nonNull( TypeRegistry::string() ),
+			'type' => TypeRegistry::nonNull( TypeRegistry::string() ),
+			'email' => TypeRegistry::boolean(),
+			'push' => TypeRegistry::boolean(),
+			'inline' => TypeRegistry::boolean(),
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return \IPS\core\Api\GraphQL\TypeRegistry::notificationType();
+	}
+
+	/**
+	 * Resolves this mutation
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0003/1', 403 );
+		}
+
+		$pieces = explode('_', $args['extension']);
+
+		if( \count( $pieces ) !== 2 )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'INVALID_EXTENSION', 'GQL/0003/1', 403 );
+		}
+
+		$extensions = \IPS\Application::load( $pieces[0] )->extensions('core', 'Notifications');
+
+		if( !isset( $extensions[ $pieces[1] ] ) )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'INVALID_EXTENSION', 'GQL/0003/1', 403 );
+		}
+
+		$extensionOptions = \IPS\Notification::availableOptions( \IPS\Member::loggedIn(), $extensions[ $pieces[1] ] );
+
+		if( !isset( $extensionOptions[ $args['type'] ] ) || $extensionOptions[ $args['type'] ]['type'] !== 'standard' ) // Only standard types supported right now
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'INVALID_TYPE', 'GQL/0003/1', 403 );
+		}
+
+		$value = array();
+		$extensionType = $extensionOptions[ $args['type'] ];
+		$options = $extensionType['options'];
+
+		foreach( $options as $type => $typeSettings )
+		{
+			// If the mutation is trying to change a setting...
+			if( isset( $args[ $type ] ) )
+			{
+				if( $args[ $type ] === TRUE && $typeSettings['editable'] == TRUE && !\in_array( $type, $extensionType['disabled'] ) )
+				{
+					$value[ $type ] = $type;
+				}
+			}
+			// If we're taking the existing value
+			else if( $typeSettings['value'] === TRUE )
+			{
+				$value[ $type ] = $type;
+			}
+		}
+
+		// If push is true, inline must also be true
+		if( isset( $value['push'] ) )
+		{
+			$value['inline'] = 'inline';
+		}
+
+		foreach ( $extensionType['notificationTypes'] as $notificationKey )
+		{
+			\IPS\Db::i()->insert( 'core_notification_preferences', array(
+				'member_id'			=> \IPS\Member::loggedIn()->member_id,
+				'notification_key'	=> $notificationKey,
+				'preference'		=> implode( ',', $value )
+			), TRUE );
+		}
+
+		// Get the data we need to return
+		$methods = array('inline' => array(), 'email' => array(), 'push' => array());
+
+		foreach( $methods as $method => $methodData )
+		{
+			if( !isset( $options[ $method ] ) )
+			{
+				continue;
+			}
+
+			$option = $options[ $method ];
+			$methods[ $method ]['default'] = isset( $option['default'] ) && \in_array( $method, $option['default'] );
+			$methods[ $method ]['disabled'] = isset( $option['disabled'] ) && \in_array( $method, $option['disabled'] );
+			$methods[ $method ]['member'] = isset( $value[ $method ] );
+		}
+
+		return array(
+			'id' => $args['id'],
+			'extension' => $args['extension'],
+			'type' => $type,
+			'name' => $extensionType['title'],
+			'description' => $extensionType['description'],
+			'inline' => $methods['inline'],
+			'email' => $methods['email'],
+			'push' => $methods['push']
+		);
+	}
+}
+

applications/core/api/GraphQL/Mutations/DeleteAttachment.php

@@ -0,0 +1,122 @@
+<?php
+/**
+ * @brief		GraphQL: Delete attachment mutation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		22 May 2019
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Delete attachment mutation for GraphQL API
+ */
+class _DeleteAttachment
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Delete an attachment";
+	
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'id'				=> TypeRegistry::nonNull( TypeRegistry::id() ),
+			'editorLocation'	=> TypeRegistry::string(),
+			'locationId1'		=> TypeRegistry::int(),
+			'locationId2'		=> TypeRegistry::int(),
+			'locationId3'		=> TypeRegistry::string(),
+		];
+	}
+	
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return TypeRegistry::boolean();
+	}
+	
+	/**
+	 * Resolves this mutation
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args, $context, $info)
+	{
+		/* Get the attachment */
+		try
+		{				
+			$attachment = \IPS\Db::i()->select( '*', 'core_attachments', array( 'attach_id=?', $args['id'] ) )->first();
+		}
+		catch ( \UnderflowException $e )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NO_ATTACHMENT', '2C398/1', 404 );
+		}
+				
+		/* Delete the maps - Only do this for attachments that have actually been saved (if they haven't been saved, there's nothing in core_attachments_map for us to delete */
+		if ( isset( $args['editorLocation'] ) and ( isset( $args['locationId1'] ) or isset( $args['locationId2'] ) or isset( $args['locationId3'] ) ) )
+		{
+			$where = array( array( 'location_key=?', $args['editorLocation'] ), array( 'attachment_id=?', $attachment['attach_id'] ) );
+			
+			foreach ( range( 1, 3 ) as $i )
+			{
+				if ( isset( $args["locationId{$i}"] ) )
+				{
+					$where[] = array( "id{$i}=?", $args["locationId{$i}"] );
+				}
+			}
+
+			\IPS\Db::i()->delete( 'core_attachments_map', $where );
+		}
+		else
+		{
+			/* If the attachment hasn't been claimed yet, it should only be deletable by the person who uploaded it */
+			if( $attachment['attach_member_id'] != \IPS\Member::loggedIn()->member_id )
+			{
+				throw new \IPS\Api\GraphQL\SafeException( 'CANNOT_DELETE_OTHERS_ATTACHMENTS', '2C398/2', 403 );
+			}
+		}
+		
+		/* If there's no other maps, we can delete the attachment itself */
+		$otherMaps = \IPS\Db::i()->select( 'COUNT(*)', 'core_attachments_map', array( 'attachment_id=?', $attachment['attach_id'] ) )->first();
+		if ( !$otherMaps )
+		{
+			\IPS\Db::i()->delete( 'core_attachments', array( 'attach_id=?', $attachment['attach_id'] ) );
+			try
+			{
+				\IPS\File::get( 'core_Attachment', $attachment['attach_location'] )->delete();
+			}
+			catch ( \Exception $e ) { }
+			if ( $attachment['attach_thumb_location'] )
+			{
+				try
+				{
+					\IPS\File::get( 'core_Attachment', $attachment['attach_thumb_location'] )->delete();
+				}
+				catch ( \Exception $e ) { }
+			}
+		}
+		
+		/* Return that we're done */
+		return true;
+	}
+}

applications/core/api/GraphQL/Mutations/Follow.php

@@ -0,0 +1,271 @@
+<?php
+/**
+ * @brief		GraphQL: Follow something mutation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		9 Sep 2018
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Follow something mutation for GraphQL API
+ */
+class _Follow
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Follow a node, item or member";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'app' => TypeRegistry::nonNull( TypeRegistry::string() ),
+			'area' => TypeRegistry::nonNull( TypeRegistry::string() ),
+			'id' => TypeRegistry::nonNull( TypeRegistry::id() ),
+			'anonymous' => TypeRegistry::nonNull( TypeRegistry::boolean() ),
+			'type' => TypeRegistry::nonNull( TypeRegistry::eNum([
+				'name' => 'core_Follow_followOptions',
+				'values' => ['IMMEDIATE', 'WEEKLY', 'DAILY', 'NONE'],
+				'defaultValue' => 'IMMEDIATE'
+			]))
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return TypeRegistry::follow();
+	}
+
+	/**
+	 * Resolves this mutation
+	 * @todo this is basically copied and pasted from notifications.php which isn't ideal, so we 
+	 * might want to consider refactoring to abstract this functionality.
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0001/6', 403 );
+		}
+		
+		/* Get class */
+		$class = NULL;
+		foreach ( \IPS\Application::load( $args['app'] )->extensions( 'core', 'ContentRouter' ) as $ext )
+		{
+			foreach ( $ext->classes as $classname )
+			{
+				if ( $classname == 'IPS\\' . $args['app'] . '\\' . mb_ucfirst( $args['area'] ) )
+				{
+					$class = $classname;
+					break;
+				}
+				if ( isset( $classname::$containerNodeClass ) and $classname::$containerNodeClass == 'IPS\\' . $args['app'] . '\\' . mb_ucfirst( $args['area'] ) )
+				{
+					$class = $classname::$containerNodeClass;
+					break;
+				}
+				if( isset( $classname::$containerFollowClasses ) )
+				{
+					foreach( $classname::$containerFollowClasses as $followClass )
+					{
+						if( $followClass == 'IPS\\' . $args['app'] . '\\' . mb_ucfirst( $args['area'] ) )
+						{
+							$class = $followClass;
+							break;
+						}
+					}
+				}
+			}
+		}
+
+		if( $args['app'] == 'core' and $args['area'] == 'member' )
+		{
+			/* You can't follow yourself */
+			if( $args['id'] == \IPS\Member::loggedIn()->member_id )
+			{
+				throw new \IPS\Api\GraphQL\SafeException( 'CANT_FOLLOW_SELF', 'GQL/0001/1', 403 );
+			}
+			
+			/* Following disabled */
+			$member = \IPS\Member::load( $args['id'] );
+
+			if( !$member->member_id )
+			{
+				throw new \IPS\Api\GraphQL\SafeException( 'CANT_FOLLOW_MEMBER', 'GQL/0001/2', 403 );
+			}
+
+			if( $member->members_bitoptions['pp_setting_moderate_followers'] and !\IPS\Member::loggedIn()->following( 'core', 'member', $member->member_id ) )
+			{
+				throw new \IPS\Api\GraphQL\SafeException( 'CANT_FOLLOW_MEMBER', 'GQL/0001/3', 403 );
+			}
+				
+			$class = 'IPS\\Member';
+		}
+
+		if( $args['app'] == 'core' and $args['area'] == 'club' )
+		{
+			$class = 'IPS\Member\Club';
+		}
+		
+		if ( !$class )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_FOUND', 'GQL/0001/4', 404 );
+		}
+
+		/* Get our return info ready */
+		$return = array(
+			'app' => $args['app'],
+			'area' => $args['area'],
+			'id' => $args['id']
+		);
+		
+		/* Get thing */
+		$thing = NULL;
+		try
+		{
+			if ( \in_array( 'IPS\Node\Model', class_parents( $class ) ) )
+			{
+				$thing = $class::loadAndCheckPerms( $args['id'] );
+			}
+			elseif ( $class == 'IPS\Member\Club' )
+			{
+				$thing = $class::loadAndCheckPerms( $args['id'] );
+			}
+			elseif ( $class != "IPS\Member" )
+			{
+				$thing = $class::loadAndCheckPerms( $args['id'] );
+			}
+			else 
+			{
+				$thing = $class::load( $args['id'] );
+			}
+		}
+		catch ( \OutOfRangeException $e )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_FOUND', 'GQL/0001/5', 404 );
+		}
+
+		/* Do we follow it? */
+		try
+		{
+			$current = \IPS\Db::i()->select( '*', 'core_follow', array( 'follow_app=? AND follow_area=? AND follow_rel_id=? AND follow_member_id=?', $args['app'], $args['area'], $args['id'], \IPS\Member::loggedIn()->member_id ) )->first();
+		}
+		catch ( \UnderflowException $e )
+		{
+			$current = FALSE;
+		}
+
+		/* Insert */
+		$save = array(
+			'follow_id'				=> md5( $args['app'] . ';' . $args['area'] . ';' . $args['id'] . ';' .  \IPS\Member::loggedIn()->member_id ),
+			'follow_app'			=> $args['app'],
+			'follow_area'			=> $args['area'],
+			'follow_rel_id'			=> $args['id'],
+			'follow_member_id'		=> \IPS\Member::loggedIn()->member_id,
+			'follow_is_anon'		=> $args['anonymous'],
+			'follow_added'			=> time(),
+			'follow_notify_do'		=> $args['type'] == 'NONE' ? 0 : 1,
+			'follow_notify_meta'	=> '',
+			'follow_notify_freq'	=> ( $class == "IPS\Member" ) ? 'immediate' : mb_strtolower($args['type']),
+			'follow_notify_sent'	=> 0,
+			'follow_visible'		=> 1,
+		);
+		if ( $current )
+		{
+			\IPS\Db::i()->update( 'core_follow', $save, array( 'follow_id=?', $current['follow_id'] ) );
+		}
+		else
+		{
+			\IPS\Db::i()->insert( 'core_follow', $save );
+		}
+
+		/* Also follow all nodes if following club */
+		if( $class == "IPS\Member\Club"  )
+		{
+			foreach ( $thing->nodes() as $node )
+			{
+				$itemClass = $node['node_class']::$contentItemClass;
+				$followApp = $itemClass::$application;
+				$followArea = mb_strtolower( mb_substr( $node['node_class'], mb_strrpos( $node['node_class'], '\\' ) + 1 ) );
+				
+				$save = array(
+					'follow_id'				=> md5( $followApp . ';' . $followArea . ';' . $node['node_id'] . ';' .  \IPS\Member::loggedIn()->member_id ),
+					'follow_app'			=> $followApp,
+					'follow_area'			=> $followArea,
+					'follow_rel_id'			=> $node['node_id'],
+					'follow_member_id'		=> \IPS\Member::loggedIn()->member_id,
+					'follow_is_anon'		=> $args['anonymous'],
+					'follow_added'			=> time(),
+					'follow_notify_do'		=> $args['type'] == 'NONE' ? 0 : 1,
+					'follow_notify_meta'	=> '',
+					'follow_notify_freq'	=> mb_strtolower($args['type']),
+					'follow_notify_sent'	=> 0,
+					'follow_visible'		=> 1,
+				);
+				\IPS\Db::i()->insert( 'core_follow', $save, TRUE );
+			}
+		}
+		
+		/* Send notification if following member */
+		if( $class == "IPS\Member"  )
+		{
+			$notification = new \IPS\Notification( \IPS\Application::load( 'core' ), 'member_follow', \IPS\Member::loggedIn(), array( \IPS\Member::loggedIn() ) );
+			$notification->recipients->attach( $thing );
+			$notification->send();
+		}
+
+		
+
+		if ( \in_array( 'IPS\Node\Model', class_parents( $class ) ) )
+		{
+			$return = array_merge($return, array(
+				'node' => $thing,
+				'nodeClass' => \get_class( $thing )
+			));
+		}
+		else if( $class == 'IPS\Member' )
+		{
+			$return = array_merge($return, array(
+				'member' => $thing
+			));
+		}
+		else if( $class == 'IPS\Member\Club' )
+		{
+			// @future Support club follows
+		}
+		else
+		{
+			$return = array_merge($return, array(
+				'item' => $thing,
+				'itemClass' => \get_class( $thing )
+			));
+		}
+
+		return $return;
+	}
+}

applications/core/api/GraphQL/Mutations/IgnoreUser.php

@@ -0,0 +1,111 @@
+<?php
+/**
+ * @brief		GraphQL: Ignore user mutation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		29 May 2020
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Ignore user mutation for GraphQL API
+ */
+class _IgnoreUser
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Ignore a member";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'member' => TypeRegistry::nonNull( TypeRegistry::int() ),
+			'type' => TypeRegistry::nonNull( TypeRegistry::string() ),
+			'isIgnoring' => TypeRegistry::nonNull( TypeRegistry::boolean() )
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return \IPS\core\api\GraphQL\TypeRegistry::ignoreOption();
+	}
+
+	/**
+	 * Resolves this mutation
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if ( !\in_array( $args['type'], \IPS\core\Ignore::types() ) )
+        {
+            throw new \IPS\Api\GraphQL\SafeException( 'INVALID_TYPE', 'GQL/0001/4', 404 );
+        }
+        
+        $type = $args['type'];
+        $member = \IPS\Member::load( $args['member'] );
+
+        if( !$member->member_id )
+        {
+            throw new \IPS\Api\GraphQL\SafeException( 'INVALID_MEMBER', 'GQL/0001/4', 403 );
+        }
+
+        if ( $member->member_id == \IPS\Member::loggedIn()->member_id )
+        {
+            throw new \IPS\Api\GraphQL\SafeException( 'NO_IGNORE_SELF', 'GQL/0001/4', 403 );
+        }
+        
+        if ( !$member->canBeIgnored() )
+        {
+            throw new \IPS\Api\GraphQL\SafeException( 'NO_IGNORE_MEMBER', 'GQL/0001/4', 403 );
+        }
+
+        try
+        {
+            $ignore = \IPS\core\Ignore::load( $member->member_id, 'ignore_ignore_id', array( 'ignore_owner_id=?', \IPS\Member::loggedIn()->member_id ) );
+            $ignore->$type = $args['isIgnoring'];
+            $ignore->save();
+        }
+        catch( \OutOfRangeException $e )
+        {
+            $ignore = new \IPS\core\Ignore;
+            $ignore->$type = $args['isIgnoring'];
+            $ignore->owner_id	= \IPS\Member::loggedIn()->member_id;
+            $ignore->ignore_id	= $member->member_id;
+            $ignore->save();
+        }
+
+        $return = array(
+            'type' => $type,
+            'is_being_ignored' => $args['isIgnoring']
+        );
+
+        \IPS\Member::loggedIn()->members_bitoptions['has_no_ignored_users'] = FALSE;
+		\IPS\Member::loggedIn()->save();
+
+		return $return;
+	}
+}

applications/core/api/GraphQL/Mutations/MarkNotificationRead.php

@@ -0,0 +1,99 @@
+<?php
+/**
+ * @brief		GraphQL: Mark a notification read mutation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		6 Nov 2018
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Mark notification read mutation for GraphQL API
+ */
+class _MarkNotificationRead
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Mark a notification as read";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'id' => TypeRegistry::int()
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return \IPS\core\Api\GraphQL\TypeRegistry::notification();
+	}
+
+	/**
+	 * Resolves this mutation
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0003/1', 403 );
+		}
+
+		$where = array();
+		$where[] = array( "notification_app IN('" . implode( "','", array_keys( \IPS\Application::enabledApplications() ) ) . "')" );
+		$where[] = array( "member = ?", \IPS\Member::loggedIn()->member_id );
+
+		if( isset( $args['id'] ) && $args['id'] !== NULL )
+		{
+			$where[] = array( "id = ?", \intval( $args['id'] ) );
+		}
+
+		try 
+		{
+			$row = \IPS\Db::i()->select( '*', 'core_notifications', $where )->first();
+			$notification = \IPS\Notification\Api::constructFromData( $row );
+		}
+		catch ( \UnderflowException $e )
+		{
+			if( isset( $args['id'] ) && $args['id'] !== NULL )
+			{
+				// Only throw an error if we were trying to work on a specific notification
+				throw new \IPS\Api\GraphQL\SafeException( 'INVALID_NOTIFICATION', 'GQL/0003/2', 403 );
+			}
+		}
+
+		\IPS\Db::i()->update( 'core_notifications', array( 'read_time' => time() ), $where );
+		\IPS\Member::loggedIn()->recountNotifications();		
+
+		if( $notification )
+		{
+			return array( 'notification' => $notification, 'data' => $notification->getData() );
+		}
+
+		return NULL;
+	}
+}

applications/core/api/GraphQL/Mutations/Messenger/AddConversationUser.php

@@ -0,0 +1,147 @@
+<?php
+/**
+ * @brief		GraphQL: Add user to PM conversation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		23 Oct 2019
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations\Messenger;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Add user to conversation mutation for GraphQL API
+ */
+class _AddConversationUser
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Add a user to a PM conversation";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'id' => TypeRegistry::nonNull( TypeRegistry::id() ),
+			'memberId' => TypeRegistry::nonNull( TypeRegistry::id() ),
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return \IPS\core\Api\GraphQL\TypeRegistry::messengerConversation();
+	}
+
+	/**
+	 * Resolves this mutation
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0003/1', 403 );
+		}
+
+		try
+		{
+			$conversation = \IPS\core\Messenger\Conversation::loadAndCheckPerms( $args['id'] );
+		}
+		catch ( \OutOfRangeException $e )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NO_MESSAGE', '1F294/2', 400 );
+		}
+
+		// Fetch our new member
+		$member = \IPS\Member::load( $args['memberId'] );
+		
+		if( !$member->member_id ){
+			throw new \IPS\Api\GraphQL\SafeException( 'INVALID_MEMBER', '1F294/2', 403 );
+		}
+
+		// Check member limit
+		if ( \IPS\Member::loggedIn()->group['g_max_mass_pm'] !== -1 AND $conversation->to_count + 1 > \IPS\Member::loggedIn()->group['g_max_mass_pm'] )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'TOO_MANY_RECIPIENTS', '1F294/2', 400 );
+		}
+
+		$maps = $conversation->maps( TRUE );
+
+		// Authorize the member
+		if ( array_key_exists( $member->member_id, $maps ) and !$maps[ $member->member_id ]['map_user_active'] AND !$maps[ $member->member_id ]['map_user_banned'] )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'MEMBER_LEFT', '1F294/2', 403 );
+		}
+			
+		if ( !$this->memberCanReceiveNewMessage( $member ) )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'BAD_RECIPIENT', '1F294/2', 403 );
+		}
+
+		//echo 'here';
+			
+		$conversation->authorize( $member );
+		$conversation->maps(TRUE); // Need to rebuild participant maps here to reflect this change
+
+		$notification = new \IPS\Notification( \IPS\Application::load('core'), 'private_message_added', $conversation, array( $conversation, \IPS\Member::loggedIn() ) );
+		$notification->recipients->attach( $member );
+		$notification->send();
+
+		return $conversation;
+	}
+
+	/**
+	 * Can the member recieve new messages?
+	 *
+	 * @param 	\IPS\Member 	The member to check
+	 * @return	boolean
+	 */
+	public function memberCanReceiveNewMessage( $member )
+	{
+		if ( $member->members_disable_pm )
+		{
+			return FALSE;
+		}
+		
+		/* Group can not use messenger */
+		if ( !$member->canAccessModule( \IPS\Application\Module::get( 'core', 'messaging', 'front' ) ) )
+		{
+			return FALSE;
+		}
+		
+		/* Inbox is full */
+		if ( ( $member->group['g_max_messages'] > 0 AND $member->msg_count_total >= $member->group['g_max_messages'] ) and !\IPS\Member::loggedIn()->group['gbw_pm_override_inbox_full'] )
+		{
+			return FALSE;
+		}
+		
+		/* Is being ignored */
+		if ( $member->isIgnoring( \IPS\Member::loggedIn(), 'messages' ) )
+		{
+			return FALSE;
+		}
+
+		return TRUE;
+	}
+}

applications/core/api/GraphQL/Mutations/Messenger/LeaveConversation.php

@@ -0,0 +1,78 @@
+<?php
+/**
+ * @brief		GraphQL: Leave a PM conversation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		23 Oct 2019
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations\Messenger;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Leave conversation mutation for GraphQL API
+ */
+class _LeaveConversation
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Leave a PM conversation";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'id' => TypeRegistry::nonNull( TypeRegistry::id() )
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return \IPS\core\Api\GraphQL\TypeRegistry::messengerConversation();
+	}
+
+	/**
+	 * Resolves this mutation
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0003/1', 403 );
+		}
+
+		try
+		{
+            $conversation = \IPS\core\Messenger\Conversation::loadAndCheckPerms( $args['id'] );
+            $conversation->deauthorize( \IPS\Member::loggedIn() );
+		}
+		catch ( \OutOfRangeException $e )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NO_MESSAGE', '1F294/2', 400 );
+		}
+
+		return NULL;
+	}
+}

applications/core/api/GraphQL/Mutations/Messenger/RemoveConversationUser.php

@@ -0,0 +1,86 @@
+<?php
+/**
+ * @brief		GraphQL: Remove a user from a conversation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		23 Oct 2019
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations\Messenger;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Remove user from conversation mutation for GraphQL API
+ */
+class _RemoveConversationUser
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Leave a PM conversation";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+            'id' => TypeRegistry::nonNull( TypeRegistry::id() ),
+            'memberId' => TypeRegistry::id()
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return \IPS\core\Api\GraphQL\TypeRegistry::messengerConversation();
+	}
+
+	/**
+	 * Resolves this mutation
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0003/1', 403 );
+		}
+
+		try
+		{
+            $conversation = \IPS\core\Messenger\Conversation::loadAndCheckPerms( $args['id'] );
+		}
+		catch ( \OutOfRangeException $e )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NO_MESSAGE', '1F294/2', 400 );
+        }
+        
+        if( $conversation->starter_id !== \IPS\Member::loggedIn()->member_id )
+        {
+            throw new \IPS\Api\GraphQL\SafeException( 'NOT_OWNER', 'GQL/0003/1', 403 );
+        }
+
+        $conversation->deauthorize( \IPS\Member::load( $args['memberId'] ), TRUE );
+        $conversation->maps(TRUE); // Need to rebuild participant maps here to reflect this change
+
+		return $conversation;
+	}
+}

applications/core/api/GraphQL/Mutations/SessionEnd.php

@@ -0,0 +1,102 @@
+<?php
+/**
+ * @brief		GraphQL: End a session for the user
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		02 Apr 2019
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Register a push token for a specific user
+ */
+class _SessionEnd
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "End a user session";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'token' => TypeRegistry::string()
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return \IPS\core\Api\GraphQL\TypeRegistry::member();
+	}
+
+	/**
+	 * Resolves this mutation
+	 * @todo this is basically copied and pasted from notifications.php which isn't ideal, so we 
+	 * might want to consider refactoring to abstract this functionality.
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0001/6', 403 );
+		}
+		
+		\IPS\Db::i()->delete( 'core_oauth_server_access_tokens', array( 'member_id=? AND access_token=?', \IPS\Member::loggedIn()->member_id, \IPS\Dispatcher::i()->accessToken['access_token'] ) );
+		if ( isset( \IPS\Dispatcher::i()->accessToken['device_key'] ) )
+		{
+			\IPS\Db::i()->delete( 'core_oauth_server_access_tokens', array( 'member_id=? AND device_key=?', \IPS\Member::loggedIn()->member_id, \IPS\Dispatcher::i()->accessToken['device_key'] ) );
+		}
+		
+		if ( isset( $args['token'] ) and $args['token'] )
+		{
+			try
+			{
+				$response = \IPS\Http\Url::ips('mobile/signout')->request()->login( \IPS\Settings::i()->mobile_app_id, \IPS\Settings::i()->mobile_app_secret )->post( array(
+					'member'	=> \IPS\Member::loggedIn()->member_id,
+					'token'	=> $args['token']
+				) )->decodeJson();
+							
+				if ( $response->httpResponseCode != 200 )
+				{
+					throw new \DomainException( (string) $response );
+				}
+				
+				if ( !$response['remainingDevices'] )
+				{
+					\IPS\Member::loggedIn()->members_bitoptions['mobile_notifications'] = FALSE;
+					\IPS\Member::loggedIn()->save();
+				}
+			}
+			catch ( \Exception $e )
+			{
+				\IPS\Log::log( $e, 'mobile-push-notifications' );
+			}
+		}
+
+		return \IPS\Member::loggedIn();
+	}
+}

applications/core/api/GraphQL/Mutations/SessionStart.php

@@ -0,0 +1,116 @@
+<?php
+/**
+ * @brief		GraphQL: Start a session for a user
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		20 Mar 2019
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Register a push token for a specific user
+ */
+class _SessionStart
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Start a session for an authenticated user";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'token' => TypeRegistry::string()
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return \IPS\core\Api\GraphQL\TypeRegistry::member();
+	}
+
+	/**
+	 * Resolves this mutation
+	 * @todo this is basically copied and pasted from notifications.php which isn't ideal, so we 
+	 * might want to consider refactoring to abstract this functionality.
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0001/6', 403 );
+		}
+		
+		if ( isset( $args['token'] ) and $args['token'] )
+		{
+			try
+			{
+				/* Register the token with the backend */
+				$response = \IPS\Http\Url::ips('mobile/signin')->request()->login( \IPS\Settings::i()->mobile_app_id, \IPS\Settings::i()->mobile_app_secret )->post( array(
+					'member'	=> \IPS\Member::loggedIn()->member_id,
+					'token'		=> $args['token']
+				) );
+				if ( !\in_array( $response->httpResponseCode, array( 200, 201 ) ) )
+				{
+					throw new \DomainException( (string) $response );
+				}
+				
+				/* If we didn't already have notifications enabled, enable them and set the defaults */
+				if ( !\IPS\Member::loggedIn()->members_bitoptions['mobile_notifications'] )
+				{
+					\IPS\Member::loggedIn()->members_bitoptions['mobile_notifications'] = TRUE;
+					\IPS\Member::loggedIn()->save();
+					
+					$notificationPreferences = \IPS\Db::i()->select( '*', 'core_notification_preferences', array( 'member_id=?', \IPS\Member::loggedIn()->member_id ) );
+					if ( \count( $notificationPreferences ) )
+					{
+						$keysToAddPushTo = array();
+						
+						foreach ( $notificationPreferences as $row )
+						{
+							if ( \in_array( 'inline', explode( ',', $row['preference'] ) ) )
+							{
+								$keysToAddPushTo[] = $row['notification_key'];
+							}
+						}
+						
+						if ( \count( $keysToAddPushTo ) )
+						{
+							\IPS\Db::i()->update( 'core_notification_preferences', "`preference` = IF( `preference` = '', 'push', CONCAT_WS( ',', `preference`, 'push' ) )", array( array( 'member_id=?', \IPS\Member::loggedIn()->member_id ), array( \IPS\Db::i()->in( 'notification_key', $keysToAddPushTo ) ) ) );
+						}
+					}
+				}
+			}
+			catch ( \Exception $e )
+			{
+				\IPS\Log::log( $e, 'mobile-push-notifications' );
+			}
+		}
+
+		return \IPS\Member::loggedIn();
+	}
+}

applications/core/api/GraphQL/Mutations/Unfollow.php

@@ -0,0 +1,185 @@
+<?php
+/**
+ * @brief		GraphQL: Unfollow something mutation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		9 Sep 2018
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Follow something mutation for GraphQL API
+ */
+class _Unfollow
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Unfollow a node, item or member";
+
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'app' => TypeRegistry::nonNull( TypeRegistry::string() ),
+			'area' => TypeRegistry::nonNull( TypeRegistry::string() ),
+			'id' => TypeRegistry::nonNull( TypeRegistry::id() ),
+			'followID' => TypeRegistry::nonNull( TypeRegistry::id() )
+		];
+	}
+
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return TypeRegistry::follow();
+	}
+
+	/**
+	 * Resolves this mutation
+	 * @todo this is basically copied and pasted from notifications.php which isn't ideal, so we 
+	 * might want to consider refactoring to abstract this functionality.
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	\IPS\forums\Forum
+	 */
+	public function resolve($val, $args)
+	{
+		if( !\IPS\Member::loggedIn()->member_id )
+		{
+			throw new \IPS\Api\GraphQL\SafeException( 'NOT_LOGGED_IN', 'GQL/0002/6', 403 );
+		}
+
+		try
+		{
+			$follow = \IPS\Db::i()->select( '*', 'core_follow', array( 'follow_id=? AND follow_member_id=?', $args['followID'], \IPS\Member::loggedIn()->member_id ) )->first();
+		}
+		catch ( \OutOfRangeException $e ) {}
+		
+		\IPS\Db::i()->delete( 'core_follow', array( 'follow_id=? AND follow_member_id=?', $args['followID'], \IPS\Member::loggedIn()->member_id ) );
+
+		/* Get class */		
+		if( $args['app'] == 'core' and $args['area'] == 'member' )
+		{
+			$class = 'IPS\\Member';
+		}
+		elseif( $args['app'] == 'core' and $args['area'] == 'club' )
+		{
+			$class = 'IPS\\Member\Club';
+		}
+		else
+		{
+			$class = NULL;
+			foreach ( \IPS\Application::load( $args['app'] )->extensions( 'core', 'ContentRouter' ) as $ext )
+			{
+				foreach ( $ext->classes as $classname )
+				{
+					if ( $classname == 'IPS\\' . $args['app'] . '\\' . mb_ucfirst( $args['area'] ) )
+					{
+						$class = $classname;
+						break;
+					}
+					if ( isset( $classname::$containerNodeClass ) and $classname::$containerNodeClass == 'IPS\\' . $args['app'] . '\\' . mb_ucfirst( $args['area'] ) )
+					{
+						$class = $classname::$containerNodeClass;
+						break;
+					}
+					if( isset( $classname::$containerFollowClasses ) )
+					{
+						foreach( $classname::$containerFollowClasses as $followClass )
+						{
+							if( $followClass == 'IPS\\' . $args['app'] . '\\' . mb_ucfirst( $args['area'] ) )
+							{
+								$class = $followClass;
+								break;
+							}
+						}
+					}
+				}
+			}
+		}
+
+		/* Get our return info ready */
+		$return = array(
+			'app' => $args['app'],
+			'area' => $args['area'],
+			'id' => $args['id']
+		);
+
+		/* Get thing */
+		$thing = NULL;
+
+		try
+		{
+			if ( $class != "IPS\Member" )
+			{
+				$thing = $class::loadAndCheckPerms( $follow['follow_rel_id'] );
+			}
+			else
+			{
+				$thing = $class::load( $follow['follow_rel_id'] );
+			}
+
+			/* Unfollow club areas */
+			if( $class == "IPS\Member\Club"  )
+			{
+				foreach ( $thing->nodes() as $node )
+				{
+					$itemClass = $node['node_class']::$contentItemClass;
+					$followApp = $itemClass::$application;
+					$followArea = mb_strtolower( mb_substr( $node['node_class'], mb_strrpos( $node['node_class'], '\\' ) + 1 ) );
+					
+					\IPS\Db::i()->delete( 'core_follow', array( 'follow_id=? AND follow_member_id=?', md5( $followApp . ';' . $followArea . ';' . $node['node_id'] . ';' .  \IPS\Member::loggedIn()->member_id ), \IPS\Member::loggedIn()->member_id ) );
+				}
+			}
+
+			if ( \in_array( 'IPS\Node\Model', class_parents( $class ) ) )
+			{
+				$return = array_merge($return, array(
+					'node' => $thing,
+					'nodeClass' => \get_class( $thing )
+				));
+			}
+			else if( $class == 'IPS\Member' )
+			{
+				$return = array_merge($return, array(
+					'member' => $thing
+				));
+			}
+			else if( $class == 'IPS\Member\Club' )
+			{
+				// @future Support clubs
+			}
+			else
+			{
+				$return = array_merge($return, array(
+					'item' => $thing,
+					'itemClass' => \get_class( $thing )
+				));
+			}
+		}
+		catch ( \OutOfRangeException $e )
+		{
+		}
+
+		return $return;
+	}
+}

applications/core/api/GraphQL/Mutations/UploadAttachment.php

@@ -0,0 +1,172 @@
+<?php
+/**
+ * @brief		GraphQL: Upload attachment mutation
+ * @author		<a href='http://www.invisionpower.com'>Invision Power Services, Inc.</a>
+ * @copyright	(c) 2001 - 2016 Invision Power Services, Inc.
+ * @license		http://www.invisionpower.com/legal/standards/
+ * @package		IPS Community Suite
+ * @since		22 May 2019
+ * @version		SVN_VERSION_NUMBER
+ */
+
+namespace IPS\core\api\GraphQL\Mutations;
+use GraphQL\Type\Definition\ObjectType;
+use GraphQL\Type\Definition\UnionType;
+use IPS\Api\GraphQL\TypeRegistry;
+
+/* To prevent PHP errors (extending class does not exist) revealing path */
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+{
+	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
+	exit;
+}
+
+/**
+ * Upload attachment mutation for GraphQL API
+ */
+class _UploadAttachment
+{
+	/*
+	 * @brief 	Query description
+	 */
+	public static $description = "Upload a file to be an attachment";
+	
+	/*
+	 * Mutation arguments
+	 */
+	public function args()
+	{
+		return [
+			'name'			=> TypeRegistry::nonNull( TypeRegistry::string() ),
+			'contents'		=> TypeRegistry::nonNull( TypeRegistry::string() ),
+			'postKey'		=> TypeRegistry::nonNull( TypeRegistry::string() ),
+			'chunk'			=> TypeRegistry::int(),
+			'totalChunks'	=> TypeRegistry::int(),
+			'ref'			=> TypeRegistry::nonNull( TypeRegistry::string() ),
+		];
+	}
+	
+	/**
+	 * Return the mutation return type
+	 */
+	public function type() 
+	{
+		return new UnionType([
+			'name' => 'core_UploadAttachment',
+			'types' => [
+				\IPS\core\api\GraphQL\TypeRegistry::attachment(),
+				\IPS\core\api\GraphQL\TypeRegistry::uploadProgress(),
+			],
+			'resolveType' => function ($obj) {
+				if ( isset( $obj['ref'] ) )
+				{
+					return \IPS\core\api\GraphQL\TypeRegistry::uploadProgress();
+				}
+				else
+				{
+					return \IPS\core\api\GraphQL\TypeRegistry::attachment();
+				} 
+			}
+		]);
+	}
+	
+	/**
+	 * Resolves this mutation
+	 *
+	 * @param 	mixed 	Value passed into this resolver
+	 * @param 	array 	Arguments
+	 * @param 	array 	Context values
+	 * @return	array
+	 */
+	public function resolve($val, $args, $context, $info)
+	{
+		$storageClass = \IPS\File::getClass( 'core_Attachment' );
+		$contents = base64_decode( $args['contents'] );
+		
+		/* Check allowed types */
+		$ext = mb_substr( $args['name'], mb_strrpos( $args['name'], '.' ) + 1 );
+		if( $allowedFileTypes = \IPS\Helpers\Form\Editor::allowedFileExtensions() )
+		{
+			if( !\in_array( mb_strtolower( $ext ), array_map( 'mb_strtolower', $allowedFileTypes ) ) )
+			{
+				throw new \IPS\Api\GraphQL\SafeException( 'FILE_TYPE_NOT_ALLOWED', '2C399/1', 403 );
+			}
+		}
+		
+		/* Chunking? */
+		if ( $storageClass::$supportsChunking and isset( $args['chunk'] ) )
+		{
+			/* If this is the FIRST chunk, start the process */		
+			if ( $args['chunk'] === 1 )
+			{
+				$ref = $storageClass->chunkInit( $args['name'] );
+			}
+			else
+			{
+				$ref = json_decode( $args['ref'] );
+			}
+			
+			/* Process this chunk */
+			$ref = $storageClass->chunkProcess( $ref, $contents, --$args['chunk'], TRUE );
+			
+			/* If this is the LAST chunk, finish the process */	
+			if ( $args['chunk'] === $args['totalChunks'] )
+			{
+				$url = $storageClass->chunkFinish( $ref );
+				$file = \IPS\File::get( 'core_Attachment', $url );
+				
+				/* If it's got an image extension, check it's actually a valid image */
+				if ( \in_array( $ext, \IPS\Image::$imageExtensions ) )
+				{
+					try
+					{
+						$file->getImageDimensions();
+					}
+					catch ( \Exception $e )
+					{
+						throw new \IPS\Api\GraphQL\SafeException( 'NOT_VALID_IMAGE', '2C399/2', 403 );
+					}
+				}
+			}
+			else
+			{
+				// If we're continuing to the next chunk, return an UploadProgress object containing the ref
+				$ref = json_encode( $ref );
+
+				return array(
+					'name' => $args['name'],
+					'ref' => $args['ref']
+				);
+			}
+		}
+		else
+		{
+			/* If it's got an image extension, check it's actually a valid image */
+			if ( \in_array( $ext, \IPS\Image::$imageExtensions ) )
+			{
+				try
+				{
+					$image = \IPS\Image::create( $contents );
+				}
+				catch ( \InvalidArgumentException $e )
+				{
+					throw new \IPS\Api\GraphQL\SafeException( $e->getMessage(), '2C399/2', 403 );
+				}
+			}
+			
+			/* Create the file */
+			try
+			{
+				$file = \IPS\File::create( 'core_Attachment', $args['name'], $contents );
+			}
+			catch ( \Exception $e )
+			{
+				throw new \IPS\Api\GraphQL\SafeException( 'FILE_CREATION_FAILED', '2C399/3', 403 );
+			}
+		}
+		
+		/* Make it into an attachment */		
+		$attachment = $file->makeAttachment( $args['postKey'], \IPS\Member::loggedIn() );
+		return $attachment;
+	}
+}