diff --git a/.github/workflows/build-container-image.yml b/.github/workflows/build-container-image.yml
new file mode 100644
index 0000000000..1b15d19885
--- /dev/null
+++ b/.github/workflows/build-container-image.yml
@@ -0,0 +1,94 @@
+on:
+  workflow_call:
+    inputs:
+      platforms:
+        required: true
+        type: string
+      use_native_arm64_builder:
+        type: boolean
+      push_to_images:
+        type: string
+      version_suffix:
+        type: string
+      flavor:
+        type: string
+      tags:
+        type: string
+      labels:
+        type: string
+
+jobs:
+  build-image:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: docker/setup-qemu-action@v2
+        if: contains(inputs.platforms, 'linux/arm64') && !inputs.use_native_arm64_builder
+
+      - uses: docker/setup-buildx-action@v2
+        id: buildx
+        if: ${{ !(inputs.use_native_arm64_builder && contains(inputs.platforms, 'linux/arm64')) }}
+
+      - name: Start a local Docker Builder
+        if: inputs.use_native_arm64_builder && contains(inputs.platforms, 'linux/arm64')
+        run: |
+          docker run --rm -d --name buildkitd -p 1234:1234 --privileged moby/buildkit:latest --addr tcp://0.0.0.0:1234
+
+      - uses: docker/setup-buildx-action@v2
+        id: buildx-native
+        if: inputs.use_native_arm64_builder && contains(inputs.platforms, 'linux/arm64')
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+          platforms: linux/amd64
+          append: |
+            - endpoint: tcp://${{ vars.DOCKER_BUILDER_HETZNER_ARM64_01_HOST }}:13865
+              platforms: linux/arm64
+              name: mastodon-docker-builder-arm64-01
+              driver-opts:
+                - servername=mastodon-docker-builder-arm64-01
+        env:
+          BUILDER_NODE_1_AUTH_TLS_CACERT: ${{ secrets.DOCKER_BUILDER_HETZNER_ARM64_01_CACERT }}
+          BUILDER_NODE_1_AUTH_TLS_CERT: ${{ secrets.DOCKER_BUILDER_HETZNER_ARM64_01_CERT }}
+          BUILDER_NODE_1_AUTH_TLS_KEY: ${{ secrets.DOCKER_BUILDER_HETZNER_ARM64_01_KEY }}
+
+      - name: Log in to Docker Hub
+        if: contains(inputs.push_to_images, 'tootsuite')
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log in to the Github Container registry
+        if: contains(inputs.push_to_images, 'ghcr.io')
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/metadata-action@v4
+        id: meta
+        if: ${{ inputs.push_to_images != '' }}
+        with:
+          images: ${{ inputs.push_to_images }}
+          # Only tag with latest when ran against the latest stable branch
+          # This needs to be updated after each minor version release
+          flavor: ${{ inputs.flavor }}
+          tags: ${{ inputs.tags }}
+          labels: ${{ inputs.labels }}
+
+      - uses: docker/build-push-action@v4
+        with:
+          context: .
+          build-args: MASTODON_VERSION_SUFFIX=${{ inputs.version_suffix }}
+          platforms: ${{ inputs.platforms }}
+          provenance: false
+          builder: ${{ steps.buildx.outputs.name || steps.buildx-native.outputs.name }}
+          push: ${{ inputs.push_to_images != '' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
deleted file mode 100644
index c01914a97f..0000000000
--- a/.github/workflows/build-image.yml
+++ /dev/null
@@ -1,79 +0,0 @@
-name: Build container image
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - 'main'
-    tags:
-      - '*'
-  pull_request:
-    paths:
-      - .github/workflows/build-image.yml
-      - Dockerfile
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  build-image:
-    runs-on: ubuntu-latest
-
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
-
-    steps:
-      - uses: actions/checkout@v3
-      - uses: hadolint/hadolint-action@v3.1.0
-      - uses: docker/setup-qemu-action@v2
-      - uses: docker/setup-buildx-action@v2
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-        if: github.repository == 'mastodon/mastodon' && github.event_name != 'pull_request'
-
-      - name: Log in to the Github Container registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-        if: github.repository == 'mastodon/mastodon' && github.event_name != 'pull_request'
-
-      - uses: docker/metadata-action@v4
-        id: meta
-        with:
-          images: |
-            tootsuite/mastodon
-            ghcr.io/mastodon/mastodon
-          # Only tag with latest when ran against the latest stable branch
-          # This needs to be updated after each minor version release
-          flavor: |
-            latest=${{ startsWith(github.ref, 'refs/tags/v4.1.') }}
-          tags: |
-            type=edge,branch=main
-            type=pep440,pattern={{raw}}
-            type=pep440,pattern=v{{major}}.{{minor}}
-            type=ref,event=pr
-
-      - name: Generate version suffix
-        id: version_vars
-        if: github.repository == 'mastodon/mastodon' && github.event_name == 'push' && github.ref_name == 'main'
-        run: |
-          echo mastodon_version_suffix=+edge-$(git rev-parse --short HEAD) >> $GITHUB_OUTPUT
-
-      - uses: docker/build-push-action@v4
-        with:
-          context: .
-          build-args: MASTODON_VERSION_SUFFIX=${{ steps.version_vars.outputs.mastodon_version_suffix }}
-          platforms: linux/amd64,linux/arm64
-          provenance: false
-          builder: ${{ steps.buildx.outputs.name }}
-          push: ${{ github.repository == 'mastodon/mastodon' && github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
diff --git a/.github/workflows/build-nightly.yml b/.github/workflows/build-nightly.yml
index f07f7447ca..1841456e89 100644
--- a/.github/workflows/build-nightly.yml
+++ b/.github/workflows/build-nightly.yml
@@ -3,58 +3,37 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '0 2 * * *' # run at 2 AM UTC
+
 permissions:
   contents: read
   packages: write
 
 jobs:
-  build-nightly-image:
+  compute-suffix:
     runs-on: ubuntu-latest
-
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
-
     steps:
-      - uses: actions/checkout@v3
-      - uses: hadolint/hadolint-action@v3.1.0
-      - uses: docker/setup-qemu-action@v2
-      - uses: docker/setup-buildx-action@v2
-
-      - name: Log in to the Github Container registry
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: docker/metadata-action@v4
-        id: meta
-        with:
-          images: |
-            ghcr.io/mastodon/mastodon
-          flavor: |
-            latest=auto
-          tags: |
-            type=raw,value=nightly
-            type=schedule,pattern=nightly-{{date 'YYYY-MM-DD' tz='Etc/UTC'}}
-          labels: |
-            org.opencontainers.image.description=Nightly build image used for testing purposes
-
-      - name: Generate version suffix
-        id: version_vars
+      - id: version_vars
         run: |
           echo mastodon_version_suffix=+nightly-$(date +'%Y%m%d') >> $GITHUB_OUTPUT
+    outputs:
+      suffix: ${{ steps.version_vars.outputs.mastodon_version_suffix }}
 
-      - uses: docker/build-push-action@v4
-        with:
-          context: .
-          build-args: MASTODON_VERSION_SUFFIX=${{ steps.version_vars.outputs.mastodon_version_suffix }}
-          platforms: linux/amd64,linux/arm64
-          provenance: false
-          builder: ${{ steps.buildx.outputs.name }}
-          push: ${{ github.repository == 'mastodon/mastodon' && github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+  build-image:
+    needs: compute-suffix
+    uses: ./.github/workflows/build-container-image.yml
+    with:
+      platforms: linux/amd64,linux/arm64
+      use_native_arm64_builder: true
+      push_to_images: |
+        tootsuite/mastodon
+        ghcr.io/mastodon/mastodon
+      version_suffix: ${{ needs.compute-suffix.outputs.suffix }}
+      labels: |
+        org.opencontainers.image.description=Nightly build image used for testing purposes
+      flavor: |
+        latest=auto
+      tags: |
+        type=raw,value=edge
+        type=raw,value=nightly
+        type=schedule,pattern=nightly-{{date 'YYYY-MM-DD' tz='Etc/UTC'}}
+    secrets: inherit
diff --git a/.github/workflows/build-push-pr.yml b/.github/workflows/build-push-pr.yml
new file mode 100644
index 0000000000..06b95358db
--- /dev/null
+++ b/.github/workflows/build-push-pr.yml
@@ -0,0 +1,34 @@
+name: Build container image for PR
+on:
+  pull_request:
+    types: [labeled, synchronize, reopened, ready_for_review, opened]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  compute-suffix:
+    runs-on: ubuntu-latest
+    if: ${{ !github.event.pull_request.draft && contains(github.event.pull_request.labels.*.name, 'build-image') }}
+    steps:
+      - id: version_vars
+        run: |
+          echo mastodon_version_suffix=+pr-${{ github.event.pull_request.number }}-$(git rev-parse --short HEAD) >> $GITHUB_OUTPUT
+    outputs:
+      suffix: ${{ steps.version_vars.outputs.mastodon_version_suffix }}
+
+  build-image:
+    needs: compute-suffix
+    uses: ./.github/workflows/build-container-image.yml
+    with:
+      platforms: linux/amd64,linux/arm64
+      use_native_arm64_builder: true
+      push_to_images: |
+        ghcr.io/mastodon/mastodon
+      version_suffix: ${{ needs.compute-suffix.outputs.suffix }}
+      flavor: |
+        latest=auto
+      tags: |
+        type=ref,event=pr
+    secrets: inherit
diff --git a/.github/workflows/build-releases.yml b/.github/workflows/build-releases.yml
new file mode 100644
index 0000000000..b408174688
--- /dev/null
+++ b/.github/workflows/build-releases.yml
@@ -0,0 +1,25 @@
+name: Build container release images
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-image:
+    uses: ./.github/workflows/build-container-image.yml
+    with:
+      platforms: linux/amd64,linux/arm64
+      use_native_arm64_builder: true
+      push_to_images: |
+        tootsuite/mastodon
+        ghcr.io/mastodon/mastodon
+      flavor: |
+        latest=${{ startsWith(github.ref, 'refs/tags/v4.1.') }}
+      tags: |
+        type=pep440,pattern={{raw}}
+        type=pep440,pattern=v{{major}}.{{minor}}
+    secrets: inherit
diff --git a/.github/workflows/test-image-build.yml b/.github/workflows/test-image-build.yml
new file mode 100644
index 0000000000..778e341771
--- /dev/null
+++ b/.github/workflows/test-image-build.yml
@@ -0,0 +1,21 @@
+name: Test container image build
+on:
+  pull_request:
+    paths:
+      - .github/workflows/build-nightly.yml
+      - .github/workflows/build-push-pr.yml
+      - .github/workflows/build-releases.yml
+      - .github/workflows/test-image-build.yml
+      - Dockerfile
+permissions:
+  contents: read
+
+jobs:
+  build-image:
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+
+    uses: ./.github/workflows/build-container-image.yml
+    with:
+      platforms: linux/amd64 # Testing only on native platform so it is performant
diff --git a/.haml-lint_todo.yml b/.haml-lint_todo.yml
index 94aeadfff0..dd5e8cf7f9 100644
--- a/.haml-lint_todo.yml
+++ b/.haml-lint_todo.yml
@@ -1,6 +1,6 @@
 # This configuration was generated by
 # `haml-lint --auto-gen-config`
-# on 2023-07-17 12:00:21 -0400 using Haml-Lint version 0.48.0.
+# on 2023-07-17 15:30:11 -0400 using Haml-Lint version 0.48.0.
 # The point is for the user to remove these configuration records
 # one by one as the lints are removed from the code base.
 # Note that changes in the inspected code, or installation of new
@@ -41,13 +41,6 @@ linters:
       - 'app/views/shared/_og.html.haml'
       - 'app/views/statuses/_status.html.haml'
 
-  # Offense count: 6
-  ConsecutiveSilentScripts:
-    exclude:
-      - 'app/views/admin/settings/shared/_links.html.haml'
-      - 'app/views/settings/login_activities/_login_activity.html.haml'
-      - 'app/views/statuses/_poll.html.haml'
-
   # Offense count: 3
   IdNames:
     exclude:
diff --git a/Gemfile.lock b/Gemfile.lock
index 1d43b687d5..a75746355a 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -472,7 +472,7 @@ GEM
     openssl-signature_algorithm (1.3.0)
       openssl (> 2.0)
     orm_adapter (0.5.0)
-    ox (2.14.16)
+    ox (2.14.17)
     parallel (1.23.0)
     parser (3.2.2.3)
       ast (~> 2.4.1)
diff --git a/app/views/admin/settings/shared/_links.html.haml b/app/views/admin/settings/shared/_links.html.haml
index 1294c26ce1..d8b697592a 100644
--- a/app/views/admin/settings/shared/_links.html.haml
+++ b/app/views/admin/settings/shared/_links.html.haml
@@ -1,8 +1,9 @@
 .content__heading__tabs
   = render_navigation renderer: :links do |primary|
-    - primary.item :branding, safe_join([fa_icon('pencil fw'), t('admin.settings.branding.title')]), admin_settings_branding_path
-    - primary.item :about, safe_join([fa_icon('file-text fw'), t('admin.settings.about.title')]), admin_settings_about_path
-    - primary.item :registrations, safe_join([fa_icon('users fw'), t('admin.settings.registrations.title')]), admin_settings_registrations_path
-    - primary.item :discovery, safe_join([fa_icon('search fw'), t('admin.settings.discovery.title')]), admin_settings_discovery_path
-    - primary.item :content_retention, safe_join([fa_icon('history fw'), t('admin.settings.content_retention.title')]), admin_settings_content_retention_path
-    - primary.item :appearance, safe_join([fa_icon('desktop fw'), t('admin.settings.appearance.title')]), admin_settings_appearance_path
+    :ruby
+      primary.item :branding, safe_join([fa_icon('pencil fw'), t('admin.settings.branding.title')]), admin_settings_branding_path
+      primary.item :about, safe_join([fa_icon('file-text fw'), t('admin.settings.about.title')]), admin_settings_about_path
+      primary.item :registrations, safe_join([fa_icon('users fw'), t('admin.settings.registrations.title')]), admin_settings_registrations_path
+      primary.item :discovery, safe_join([fa_icon('search fw'), t('admin.settings.discovery.title')]), admin_settings_discovery_path
+      primary.item :content_retention, safe_join([fa_icon('history fw'), t('admin.settings.content_retention.title')]), admin_settings_content_retention_path
+      primary.item :appearance, safe_join([fa_icon('desktop fw'), t('admin.settings.appearance.title')]), admin_settings_appearance_path
diff --git a/app/views/settings/login_activities/_login_activity.html.haml b/app/views/settings/login_activities/_login_activity.html.haml
index 94ed60312c..2e001cdcef 100644
--- a/app/views/settings/login_activities/_login_activity.html.haml
+++ b/app/views/settings/login_activities/_login_activity.html.haml
@@ -1,6 +1,7 @@
-- method_str = content_tag(:span, login_activity.omniauth? ? t(login_activity.provider, scope: 'auth.providers') : t(login_activity.authentication_method, scope: 'login_activities.authentication_methods'), class: 'target')
-- ip_str = content_tag(:span, login_activity.ip, class: 'target')
-- browser_str = content_tag(:span, t('sessions.description', browser: t("sessions.browsers.#{login_activity.browser}", default: login_activity.browser.to_s), platform: t("sessions.platforms.#{login_activity.platform}", default: login_activity.platform.to_s)), class: 'target', title: login_activity.user_agent)
+:ruby
+  method_str = content_tag(:span, login_activity.omniauth? ? t(login_activity.provider, scope: 'auth.providers') : t(login_activity.authentication_method, scope: 'login_activities.authentication_methods'), class: 'target')
+  ip_str = content_tag(:span, login_activity.ip, class: 'target')
+  browser_str = content_tag(:span, t('sessions.description', browser: t("sessions.browsers.#{login_activity.browser}", default: login_activity.browser.to_s), platform: t("sessions.platforms.#{login_activity.platform}", default: login_activity.platform.to_s)), class: 'target', title: login_activity.user_agent)
 
 .log-entry
   .log-entry__header
diff --git a/app/views/statuses/_poll.html.haml b/app/views/statuses/_poll.html.haml
index 0805c48958..21870af446 100644
--- a/app/views/statuses/_poll.html.haml
+++ b/app/views/statuses/_poll.html.haml
@@ -1,6 +1,7 @@
-- show_results = (user_signed_in? && poll.voted?(current_account)) || poll.expired?
-- own_votes = user_signed_in? ? poll.own_votes(current_account) : []
-- total_votes_count = poll.voters_count || poll.votes_count
+:ruby
+  show_results = (user_signed_in? && poll.voted?(current_account)) || poll.expired?
+  own_votes = user_signed_in? ? poll.own_votes(current_account) : []
+  total_votes_count = poll.voters_count || poll.votes_count
 
 .poll
   %ul
diff --git a/spec/controllers/api/v1/bookmarks_controller_spec.rb b/spec/controllers/api/v1/bookmarks_controller_spec.rb
deleted file mode 100644
index 69a37388ea..0000000000
--- a/spec/controllers/api/v1/bookmarks_controller_spec.rb
+++ /dev/null
@@ -1,80 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-RSpec.describe Api::V1::BookmarksController do
-  render_views
-
-  let(:user)  { Fabricate(:user) }
-  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read:bookmarks') }
-
-  describe 'GET #index' do
-    context 'without token' do
-      it 'returns http unauthorized' do
-        get :index
-        expect(response).to have_http_status 401
-      end
-    end
-
-    context 'with token' do
-      context 'without read scope' do
-        before do
-          allow(controller).to receive(:doorkeeper_token) do
-            Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: '')
-          end
-        end
-
-        it 'returns http forbidden' do
-          get :index
-          expect(response).to have_http_status 403
-        end
-      end
-
-      context 'without valid resource owner' do
-        before do
-          token = Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read')
-          user.destroy!
-
-          allow(controller).to receive(:doorkeeper_token) { token }
-        end
-
-        it 'returns http unprocessable entity' do
-          get :index
-          expect(response).to have_http_status 422
-        end
-      end
-
-      context 'with read scope and valid resource owner' do
-        before do
-          allow(controller).to receive(:doorkeeper_token) do
-            Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read')
-          end
-        end
-
-        it 'shows bookmarks owned by the user' do
-          bookmarked_by_user = Fabricate(:bookmark, account: user.account)
-          bookmarked_by_others = Fabricate(:bookmark)
-
-          get :index
-
-          expect(assigns(:statuses)).to contain_exactly(bookmarked_by_user.status)
-        end
-
-        it 'adds pagination headers if necessary' do
-          bookmark = Fabricate(:bookmark, account: user.account)
-
-          get :index, params: { limit: 1 }
-
-          expect(response.headers['Link'].find_link(%w(rel next)).href).to eq "http://test.host/api/v1/bookmarks?limit=1&max_id=#{bookmark.id}"
-          expect(response.headers['Link'].find_link(%w(rel prev)).href).to eq "http://test.host/api/v1/bookmarks?limit=1&min_id=#{bookmark.id}"
-        end
-
-        it 'does not add pagination headers if not necessary' do
-          get :index
-
-          expect(response.headers['Link']).to be_nil
-        end
-      end
-    end
-  end
-end
diff --git a/spec/controllers/api/v1/mutes_controller_spec.rb b/spec/controllers/api/v1/mutes_controller_spec.rb
deleted file mode 100644
index 2645ed4e9d..0000000000
--- a/spec/controllers/api/v1/mutes_controller_spec.rb
+++ /dev/null
@@ -1,65 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-RSpec.describe Api::V1::MutesController do
-  render_views
-
-  let(:user)   { Fabricate(:user) }
-  let(:scopes) { 'read:mutes' }
-  let(:token)  { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
-
-  before { allow(controller).to receive(:doorkeeper_token) { token } }
-
-  describe 'GET #index' do
-    it 'limits according to limit parameter' do
-      Array.new(2) { Fabricate(:mute, account: user.account) }
-      get :index, params: { limit: 1 }
-      expect(body_as_json.size).to eq 1
-    end
-
-    it 'queries mutes in range according to max_id' do
-      mutes = Array.new(2) { Fabricate(:mute, account: user.account) }
-
-      get :index, params: { max_id: mutes[1] }
-
-      expect(body_as_json.size).to eq 1
-      expect(body_as_json[0][:id]).to eq mutes[0].target_account_id.to_s
-    end
-
-    it 'queries mutes in range according to since_id' do
-      mutes = Array.new(2) { Fabricate(:mute, account: user.account) }
-
-      get :index, params: { since_id: mutes[0] }
-
-      expect(body_as_json.size).to eq 1
-      expect(body_as_json[0][:id]).to eq mutes[1].target_account_id.to_s
-    end
-
-    it 'sets pagination header for next path' do
-      mutes = Array.new(2) { Fabricate(:mute, account: user.account) }
-      get :index, params: { limit: 1, since_id: mutes[0] }
-      expect(response.headers['Link'].find_link(%w(rel next)).href).to eq api_v1_mutes_url(limit: 1, max_id: mutes[1])
-    end
-
-    it 'sets pagination header for previous path' do
-      mute = Fabricate(:mute, account: user.account)
-      get :index
-      expect(response.headers['Link'].find_link(%w(rel prev)).href).to eq api_v1_mutes_url(since_id: mute)
-    end
-
-    it 'returns http success' do
-      get :index
-      expect(response).to have_http_status(200)
-    end
-
-    context 'with wrong scopes' do
-      let(:scopes) { 'write:mutes' }
-
-      it 'returns http forbidden' do
-        get :index
-        expect(response).to have_http_status(403)
-      end
-    end
-  end
-end
diff --git a/spec/controllers/api/v1/timelines/public_controller_spec.rb b/spec/controllers/api/v1/timelines/public_controller_spec.rb
deleted file mode 100644
index 31e594d22b..0000000000
--- a/spec/controllers/api/v1/timelines/public_controller_spec.rb
+++ /dev/null
@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails_helper'
-
-describe Api::V1::Timelines::PublicController do
-  render_views
-
-  let(:user) { Fabricate(:user) }
-
-  before do
-    allow(controller).to receive(:doorkeeper_token) { token }
-  end
-
-  context 'with a user context' do
-    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id) }
-
-    describe 'GET #show' do
-      before do
-        PostStatusService.new.call(user.account, text: 'New status from user for federated public timeline.')
-      end
-
-      it 'returns http success' do
-        get :show
-
-        expect(response).to have_http_status(200)
-        expect(response.headers['Link'].links.size).to eq(2)
-      end
-    end
-
-    describe 'GET #show with local only' do
-      before do
-        PostStatusService.new.call(user.account, text: 'New status from user for local public timeline.')
-      end
-
-      it 'returns http success' do
-        get :show, params: { local: true }
-
-        expect(response).to have_http_status(200)
-        expect(response.headers['Link'].links.size).to eq(2)
-      end
-    end
-  end
-
-  context 'without a user context' do
-    let(:token) { Fabricate(:accessible_access_token, resource_owner_id: nil) }
-
-    describe 'GET #show' do
-      it 'returns http success' do
-        get :show
-
-        expect(response).to have_http_status(200)
-        expect(response.headers['Link']).to be_nil
-      end
-    end
-  end
-end
diff --git a/spec/requests/api/v1/bookmarks_spec.rb b/spec/requests/api/v1/bookmarks_spec.rb
new file mode 100644
index 0000000000..1f1cd35caa
--- /dev/null
+++ b/spec/requests/api/v1/bookmarks_spec.rb
@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Bookmarks' do
+  let(:user)    { Fabricate(:user) }
+  let(:token)   { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:scopes)  { 'read:bookmarks' }
+  let(:headers) { { 'Authorization' => "Bearer #{token.token}" } }
+
+  describe 'GET /api/v1/bookmarks' do
+    subject do
+      get '/api/v1/bookmarks', headers: headers, params: params
+    end
+
+    let(:params)     { {} }
+    let!(:bookmarks) { Fabricate.times(3, :bookmark, account: user.account) }
+
+    let(:expected_response) do
+      bookmarks.map do |bookmark|
+        a_hash_including(id: bookmark.status.id.to_s, account: a_hash_including(id: bookmark.status.account.id.to_s))
+      end
+    end
+
+    it_behaves_like 'forbidden for wrong scope', 'write'
+
+    it 'returns http success' do
+      subject
+
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns the bookmarked statuses' do
+      subject
+
+      expect(body_as_json).to match_array(expected_response)
+    end
+
+    context 'with limit param' do
+      let(:params) { { limit: 2 } }
+
+      it 'paginates correctly', :aggregate_failures do
+        subject
+
+        expect(body_as_json.size).to eq(params[:limit])
+        expect(response.headers['Link'].find_link(%w(rel prev)).href).to eq(api_v1_bookmarks_url(limit: params[:limit], min_id: bookmarks.last.id))
+        expect(response.headers['Link'].find_link(%w(rel next)).href).to eq(api_v1_bookmarks_url(limit: params[:limit], max_id: bookmarks[1].id))
+      end
+    end
+
+    context 'without the authorization header' do
+      let(:headers) { {} }
+
+      it 'returns http unauthorized' do
+        subject
+
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/mutes_spec.rb b/spec/requests/api/v1/mutes_spec.rb
new file mode 100644
index 0000000000..9a1d16200a
--- /dev/null
+++ b/spec/requests/api/v1/mutes_spec.rb
@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'Mutes' do
+  let(:user)    { Fabricate(:user) }
+  let(:scopes)  { 'read:mutes' }
+  let(:token)   { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:headers) { { 'Authorization' => "Bearer #{token.token}" } }
+
+  describe 'GET /api/v1/mutes' do
+    subject do
+      get '/api/v1/mutes', headers: headers, params: params
+    end
+
+    let!(:mutes) { Fabricate.times(3, :mute, account: user.account) }
+    let(:params) { {} }
+
+    it_behaves_like 'forbidden for wrong scope', 'write write:mutes'
+
+    it 'returns http success' do
+      subject
+
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns the muted accounts' do
+      subject
+
+      muted_accounts = mutes.map(&:target_account)
+
+      expect(body_as_json.pluck(:id)).to match_array(muted_accounts.map { |account| account.id.to_s })
+    end
+
+    context 'with limit param' do
+      let(:params) { { limit: 2 } }
+
+      it 'returns only the requested number of muted accounts' do
+        subject
+
+        expect(body_as_json.size).to eq(params[:limit])
+      end
+
+      it 'sets the correct pagination headers', :aggregate_failures do
+        subject
+
+        headers = response.headers['Link']
+
+        expect(headers.find_link(%w(rel prev)).href).to eq(api_v1_mutes_url(limit: params[:limit], since_id: mutes[2].id.to_s))
+        expect(headers.find_link(%w(rel next)).href).to eq(api_v1_mutes_url(limit: params[:limit], max_id: mutes[1].id.to_s))
+      end
+    end
+
+    context 'with max_id param' do
+      let(:params) { { max_id: mutes[1].id } }
+
+      it 'queries mutes in range according to max_id', :aggregate_failures do
+        subject
+
+        body = body_as_json
+
+        expect(body.size).to eq 1
+        expect(body[0][:id]).to eq mutes[0].target_account_id.to_s
+      end
+    end
+
+    context 'with since_id param' do
+      let(:params) { { since_id: mutes[0].id } }
+
+      it 'queries mutes in range according to since_id', :aggregate_failures do
+        subject
+
+        body = body_as_json
+
+        expect(body.size).to eq 2
+        expect(body[0][:id]).to eq mutes[2].target_account_id.to_s
+      end
+    end
+
+    context 'without an authentication header' do
+      let(:headers) { {} }
+
+      it 'returns http unauthorized' do
+        subject
+
+        expect(response).to have_http_status(401)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v1/timelines/public_spec.rb b/spec/requests/api/v1/timelines/public_spec.rb
new file mode 100644
index 0000000000..7ed0fee2d1
--- /dev/null
+++ b/spec/requests/api/v1/timelines/public_spec.rb
@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe 'Public' do
+  let(:user)    { Fabricate(:user) }
+  let(:scopes)  { 'read:statuses' }
+  let(:token)   { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
+  let(:headers) { { 'Authorization' => "Bearer #{token.token}" } }
+
+  shared_examples 'a successful request to the public timeline' do
+    it 'returns the expected statuses successfully', :aggregate_failures do
+      subject
+
+      expect(response).to have_http_status(200)
+      expect(body_as_json.pluck(:id)).to match_array(expected_statuses.map { |status| status.id.to_s })
+    end
+  end
+
+  describe 'GET /api/v1/timelines/public' do
+    subject do
+      get '/api/v1/timelines/public', headers: headers, params: params
+    end
+
+    let!(:private_status) { Fabricate(:status, visibility: :private) } # rubocop:disable RSpec/LetSetup
+    let!(:local_status)   { Fabricate(:status, account: Fabricate.build(:account, domain: nil)) }
+    let!(:remote_status)  { Fabricate(:status, account: Fabricate.build(:account, domain: 'example.com')) }
+    let!(:media_status)   { Fabricate(:status, media_attachments: [Fabricate.build(:media_attachment)]) }
+
+    let(:params) { {} }
+
+    context 'when the instance allows public preview' do
+      let(:expected_statuses) { [local_status, remote_status, media_status] }
+
+      context 'with an authorized user' do
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with an anonymous user' do
+        let(:headers) { {} }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with local param' do
+        let(:params) { { local: true } }
+        let(:expected_statuses) { [local_status, media_status] }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with remote param' do
+        let(:params) { { remote: true } }
+        let(:expected_statuses) { [remote_status] }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with only_media param' do
+        let(:params) { { only_media: true } }
+        let(:expected_statuses) { [media_status] }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with limit param' do
+        let(:params) { { limit: 1 } }
+
+        it 'returns only the requested number of statuses', :aggregate_failures do
+          subject
+
+          expect(response).to have_http_status(200)
+          expect(body_as_json.size).to eq(params[:limit])
+        end
+
+        it 'sets the correct pagination headers', :aggregate_failures do
+          subject
+
+          headers = response.headers['Link']
+
+          expect(headers.find_link(%w(rel prev)).href).to eq(api_v1_timelines_public_url(limit: 1, min_id: media_status.id.to_s))
+          expect(headers.find_link(%w(rel next)).href).to eq(api_v1_timelines_public_url(limit: 1, max_id: media_status.id.to_s))
+        end
+      end
+    end
+
+    context 'when the instance does not allow public preview' do
+      before do
+        Form::AdminSettings.new(timeline_preview: false).save
+      end
+
+      context 'with an authenticated user' do
+        let(:expected_statuses) { [local_status, remote_status, media_status] }
+
+        it_behaves_like 'a successful request to the public timeline'
+      end
+
+      context 'with an unauthenticated user' do
+        let(:headers) { {} }
+
+        it 'returns http unprocessable entity' do
+          subject
+
+          expect(response).to have_http_status(422)
+        end
+      end
+    end
+  end
+end