Return private / direct posts on user timelines, too.

lib/pleroma/web/activity_pub/activity_pub.ex

@@ -260,6 +260,25 @@ defmodule Pleroma.Web.ActivityPub.ActivityPub do
     |> Enum.reverse()
   end
 
+  def fetch_user_activities(user, reading_user, params \\ %{}) do
+    params =
+      params
+      |> Map.put("type", ["Create", "Announce"])
+      |> Map.put("actor_id", user.ap_id)
+      |> Map.put("whole_db", true)
+
+    recipients =
+      if reading_user do
+        ["https://www.w3.org/ns/activitystreams#Public"] ++
+          [reading_user.ap_id | reading_user.following]
+      else
+        ["https://www.w3.org/ns/activitystreams#Public"]
+      end
+
+    fetch_activities(recipients, params)
+    |> Enum.reverse()
+  end
+
   defp restrict_since(query, %{"since_id" => since_id}) do
     from(activity in query, where: activity.id > ^since_id)
   end

lib/pleroma/web/mastodon_api/mastodon_api_controller.ex

@@ -204,21 +204,14 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
     |> render(StatusView, "index.json", %{activities: activities, for: user, as: :activity})
   end
 
-  def user_statuses(%{assigns: %{user: user}} = conn, params) do
-    with %User{ap_id: ap_id} <- Repo.get(User, params["id"]) do
-      params =
-        params
-        |> Map.put("type", ["Create", "Announce"])
-        |> Map.put("actor_id", ap_id)
-        |> Map.put("whole_db", true)
-
+  def user_statuses(%{assigns: %{user: reading_user}} = conn, params) do
+    with %User{} = user <- Repo.get(User, params["id"]) do
+      # Since Pleroma has no "pinned" posts feature, we'll just set an empty list here
       activities =
         if params["pinned"] == "true" do
-          # Since Pleroma has no "pinned" posts feature, we'll just set an empty list here
           []
         else
-          ActivityPub.fetch_public_activities(params)
-          |> Enum.reverse()
+          ActivityPub.fetch_user_activities(user, reading_user, params)
         end
 
       conn

lib/pleroma/web/twitter_api/twitter_api_controller.ex

@@ -96,13 +96,7 @@ defmodule Pleroma.Web.TwitterAPI.Controller do
   def user_timeline(%{assigns: %{user: user}} = conn, params) do
     case TwitterAPI.get_user(user, params) do
       {:ok, target_user} ->
-        params =
-          params
-          |> Map.put("type", ["Create", "Announce"])
-          |> Map.put("actor_id", target_user.ap_id)
-          |> Map.put("whole_db", true)
-
-        activities = ActivityPub.fetch_public_activities(params)
+        activities = ActivityPub.fetch_user_activities(target_user, user, params)
 
         conn
         |> render(ActivityView, "index.json", %{activities: activities, for: user})

test/web/mastodon_api/mastodon_api_controller_test.exs

@@ -354,18 +354,47 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do
 
   describe "user timelines" do
     test "gets a users statuses", %{conn: conn} do
-      _note = insert(:note_activity)
-      note_two = insert(:note_activity)
+      user_one = insert(:user)
+      user_two = insert(:user)
+      user_three = insert(:user)
 
-      user = User.get_by_ap_id(note_two.data["actor"])
+      {:ok, user_three} = User.follow(user_three, user_one)
 
-      conn =
+      {:ok, activity} = CommonAPI.post(user_one, %{"status" => "HI!!!"})
+
+      {:ok, direct_activity} =
+        CommonAPI.post(user_one, %{
+          "status" => "Hi, @#{user_two.nickname}.",
+          "visibility" => "direct"
+        })
+
+      {:ok, private_activity} =
+        CommonAPI.post(user_one, %{"status" => "private", "visibility" => "private"})
+
+      resp =
         conn
-        |> get("/api/v1/accounts/#{user.id}/statuses")
+        |> get("/api/v1/accounts/#{user_one.id}/statuses")
 
-      assert [%{"id" => id}] = json_response(conn, 200)
+      assert [%{"id" => id}] = json_response(resp, 200)
+      assert id == to_string(activity.id)
 
-      assert id == to_string(note_two.id)
+      resp =
+        conn
+        |> assign(:user, user_two)
+        |> get("/api/v1/accounts/#{user_one.id}/statuses")
+
+      assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
+      assert id_one == to_string(direct_activity.id)
+      assert id_two == to_string(activity.id)
+
+      resp =
+        conn
+        |> assign(:user, user_three)
+        |> get("/api/v1/accounts/#{user_one.id}/statuses")
+
+      assert [%{"id" => id_one}, %{"id" => id_two}] = json_response(resp, 200)
+      assert id_one == to_string(private_activity.id)
+      assert id_two == to_string(activity.id)
     end
 
     test "unimplemented pinned statuses feature", %{conn: conn} do