Merge commit 'origin/testing' into 0.9.x

Conflicts:
	lib/action.php
	lib/adminpanelaction.php

19 files changed, 798 insertions, 360 deletions

diff --git a/plugins/Facebook/FacebookPlugin.php b/plugins/Facebook/FacebookPlugin.php
index 443cb396f..5dba73a5d 100644
--- a/plugins/Facebook/FacebookPlugin.php
+++ b/plugins/Facebook/FacebookPlugin.php
@@ -80,6 +80,25 @@ class FacebookPlugin extends Plugin
     }
 
     /**
+     * Check to see if there is an API key and secret defined
+     * for Facebook integration.
+     *
+     * @return boolean result
+     */
+
+    static function hasKeys()
+    {
+        $apiKey    = common_config('facebook', 'apikey');
+        $apiSecret = common_config('facebook', 'secret');
+
+        if (!empty($apiKey) && !empty($apiSecret)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
      * Add Facebook app actions to the router table
      *
      * Hook for RouterInitialized event.
@@ -91,23 +110,26 @@ class FacebookPlugin extends Plugin
 
     function onStartInitializeRouter($m)
     {
+        $m->connect('admin/facebook', array('action' => 'facebookadminpanel'));
 
-        // Facebook App stuff
+        if (self::hasKeys()) {
 
-        $m->connect('facebook/app', array('action' => 'facebookhome'));
-        $m->connect('facebook/app/index.php', array('action' => 'facebookhome'));
-        $m->connect('facebook/app/settings.php',
-                    array('action' => 'facebooksettings'));
-        $m->connect('facebook/app/invite.php', array('action' => 'facebookinvite'));
-        $m->connect('facebook/app/remove', array('action' => 'facebookremove'));
-        $m->connect('admin/facebook', array('action' => 'facebookadminpanel'));
+            // Facebook App stuff
 
-        // Facebook Connect stuff
+            $m->connect('facebook/app', array('action' => 'facebookhome'));
+            $m->connect('facebook/app/index.php', array('action' => 'facebookhome'));
+            $m->connect('facebook/app/settings.php',
+                        array('action' => 'facebooksettings'));
+            $m->connect('facebook/app/invite.php', array('action' => 'facebookinvite'));
+            $m->connect('facebook/app/remove', array('action' => 'facebookremove'));
 
-        $m->connect('main/facebookconnect', array('action' => 'FBConnectAuth'));
-        $m->connect('main/facebooklogin', array('action' => 'FBConnectLogin'));
-        $m->connect('settings/facebook', array('action' => 'FBConnectSettings'));
-        $m->connect('xd_receiver.html', array('action' => 'FBC_XDReceiver'));
+            // Facebook Connect stuff
+
+            $m->connect('main/facebookconnect', array('action' => 'FBConnectAuth'));
+            $m->connect('main/facebooklogin', array('action' => 'FBConnectLogin'));
+            $m->connect('settings/facebook', array('action' => 'FBConnectSettings'));
+            $m->connect('xd_receiver.html', array('action' => 'FBC_XDReceiver'));
+        }
 
         return true;
     }
@@ -338,6 +360,9 @@ class FacebookPlugin extends Plugin
 
     function reqFbScripts($action)
     {
+        if (!self::hasKeys()) {
+            return false;
+        }
 
         // If you're logged in w/FB Connect, you always need the FB stuff
 
@@ -410,42 +435,35 @@ class FacebookPlugin extends Plugin
 
     function onStartPrimaryNav($action)
     {
-        $user = common_current_user();
+        if (self::hasKeys()) {
+            $user = common_current_user();
+            if (!empty($user)) {
 
-        $connect = 'FBConnectSettings';
-        if (common_config('xmpp', 'enabled')) {
-            $connect = 'imsettings';
-        } else if (common_config('sms', 'enabled')) {
-            $connect = 'smssettings';
-        }
+                $fbuid = $this->loggedIn();
 
-        if (!empty($user)) {
+                if (!empty($fbuid)) {
 
-            $fbuid = $this->loggedIn();
+                    /* Default FB silhouette pic for FB users who haven't
+                       uploaded a profile pic yet. */
 
-            if (!empty($fbuid)) {
-
-                /* Default FB silhouette pic for FB users who haven't
-                   uploaded a profile pic yet. */
-
-                $silhouetteUrl =
-                    'http://static.ak.fbcdn.net/pics/q_silhouette.gif';
+                    $silhouetteUrl =
+                        'http://static.ak.fbcdn.net/pics/q_silhouette.gif';
 
-                $url = $this->getProfilePicURL($fbuid);
+                    $url = $this->getProfilePicURL($fbuid);
 
-                $action->elementStart('li', array('id' => 'nav_fb'));
+                    $action->elementStart('li', array('id' => 'nav_fb'));
 
-                $action->element('img', array('id' => 'fbc_profile-pic',
-                    'src' => (!empty($url)) ? $url : $silhouetteUrl,
-                    'alt' => 'Facebook Connect User',
-                    'width' => '16'), '');
+                    $action->element('img', array('id' => 'fbc_profile-pic',
+                        'src' => (!empty($url)) ? $url : $silhouetteUrl,
+                        'alt' => 'Facebook Connect User',
+                        'width' => '16'), '');
 
-                $iconurl =  common_path('plugins/Facebook/fbfavicon.ico');
-                $action->element('img', array('id' => 'fb_favicon',
-                    'src' => $iconurl));
-
-                $action->elementEnd('li');
+                    $iconurl =  common_path('plugins/Facebook/fbfavicon.ico');
+                    $action->element('img', array('id' => 'fb_favicon',
+                        'src' => $iconurl));
 
+                    $action->elementEnd('li');
+                }
             }
         }
 
@@ -462,14 +480,15 @@ class FacebookPlugin extends Plugin
 
     function onEndLoginGroupNav(&$action)
     {
+        if (self::hasKeys()) {
 
-        $action_name = $action->trimmed('action');
-
-        $action->menuItem(common_local_url('FBConnectLogin'),
-                                           _m('Facebook'),
-                                           _m('Login or register using Facebook'),
-                                           'FBConnectLogin' === $action_name);
+            $action_name = $action->trimmed('action');
 
+            $action->menuItem(common_local_url('FBConnectLogin'),
+                                               _m('Facebook'),
+                                               _m('Login or register using Facebook'),
+                                               'FBConnectLogin' === $action_name);
+        }
         return true;
     }
 
@@ -483,13 +502,15 @@ class FacebookPlugin extends Plugin
 
     function onEndConnectSettingsNav(&$action)
     {
-        $action_name = $action->trimmed('action');
+        if (self::hasKeys()) {
 
-        $action->menuItem(common_local_url('FBConnectSettings'),
-                          _m('Facebook'),
-                          _m('Facebook Connect Settings'),
-                          $action_name === 'FBConnectSettings');
+            $action_name = $action->trimmed('action');
 
+            $action->menuItem(common_local_url('FBConnectSettings'),
+                              _m('Facebook'),
+                              _m('Facebook Connect Settings'),
+                              $action_name === 'FBConnectSettings');
+        }
         return true;
     }
 
@@ -503,20 +524,22 @@ class FacebookPlugin extends Plugin
 
     function onStartLogout($action)
     {
-        $action->logout();
-        $fbuid = $this->loggedIn();
+        if (self::hasKeys()) {
 
-        if (!empty($fbuid)) {
-            try {
-                $facebook = getFacebook();
-                $facebook->expire_session();
-            } catch (Exception $e) {
-                common_log(LOG_WARNING, 'Facebook Connect Plugin - ' .
-                           'Could\'t logout of Facebook: ' .
-                           $e->getMessage());
+            $action->logout();
+            $fbuid = $this->loggedIn();
+
+            if (!empty($fbuid)) {
+                try {
+                    $facebook = getFacebook();
+                    $facebook->expire_session();
+                } catch (Exception $e) {
+                    common_log(LOG_WARNING, 'Facebook Connect Plugin - ' .
+                               'Could\'t logout of Facebook: ' .
+                               $e->getMessage());
+                }
             }
         }
-
         return true;
     }
 
@@ -562,7 +585,9 @@ class FacebookPlugin extends Plugin
 
     function onStartEnqueueNotice($notice, &$transports)
     {
-        array_push($transports, 'facebook');
+        if (self::hasKeys()) {
+            array_push($transports, 'facebook');
+        }
         return true;
     }
 
@@ -575,7 +600,9 @@ class FacebookPlugin extends Plugin
      */
     function onEndInitializeQueueManager($manager)
     {
-        $manager->connect('facebook', 'FacebookQueueHandler');
+        if (self::hasKeys()) {
+            $manager->connect('facebook', 'FacebookQueueHandler');
+        }
         return true;
     }
 
diff --git a/plugins/MobileProfile/MobileProfilePlugin.php b/plugins/MobileProfile/MobileProfilePlugin.php
index f788639ae..0b37734b7 100644
--- a/plugins/MobileProfile/MobileProfilePlugin.php
+++ b/plugins/MobileProfile/MobileProfilePlugin.php
@@ -307,23 +307,14 @@ class MobileProfilePlugin extends WAP20Plugin
     function _showPrimaryNav($action)
     {
         $user    = common_current_user();
-        $connect = '';
-        if (common_config('xmpp', 'enabled')) {
-            $connect = 'imsettings';
-        } else if (common_config('sms', 'enabled')) {
-            $connect = 'smssettings';
-        }
-
         $action->elementStart('ul', array('id' => 'site_nav_global_primary'));
         if ($user) {
             $action->menuItem(common_local_url('all', array('nickname' => $user->nickname)),
                             _('Home'));
             $action->menuItem(common_local_url('profilesettings'),
                             _('Account'));
-            if ($connect) {
-                $action->menuItem(common_local_url($connect),
+            $action->menuItem(common_local_url('oauthconnectionssettings'),
                                 _('Connect'));
-            }
             if ($user->hasRight(Right::CONFIGURESITE)) {
                 $action->menuItem(common_local_url('siteadminpanel'),
                                 _('Admin'), _('Change site configuration'), false, 'nav_admin');
diff --git a/plugins/OStatus/OStatusPlugin.php b/plugins/OStatus/OStatusPlugin.php
index b69430ea7..033325c9e 100644
--- a/plugins/OStatus/OStatusPlugin.php
+++ b/plugins/OStatus/OStatusPlugin.php
@@ -44,15 +44,19 @@ class OStatusPlugin extends Plugin
         $m->connect('.well-known/host-meta',
                     array('action' => 'hostmeta'));
         $m->connect('main/xrd',
-                    array('action' => 'xrd'));
+                    array('action' => 'userxrd'));
+        $m->connect('main/ownerxrd',
+                    array('action' => 'ownerxrd'));
         $m->connect('main/ostatus',
                     array('action' => 'ostatusinit'));
         $m->connect('main/ostatus?nickname=:nickname',
                   array('action' => 'ostatusinit'), array('nickname' => '[A-Za-z0-9_-]+'));
+        $m->connect('main/ostatus?group=:group',
+                  array('action' => 'ostatusinit'), array('group' => '[A-Za-z0-9_-]+'));
         $m->connect('main/ostatussub',
                     array('action' => 'ostatussub'));
-        $m->connect('main/ostatussub',
-                    array('action' => 'ostatussub'), array('feed' => '[A-Za-z0-9\.\/\:]+'));
+        $m->connect('main/ostatusgroup',
+                    array('action' => 'ostatusgroup'));
 
         // PuSH actions
         $m->connect('main/push/hub', array('action' => 'pushhub'));
@@ -109,13 +113,13 @@ class OStatusPlugin extends Plugin
     {
         if ($action instanceof ShowstreamAction) {
             $acct = 'acct:'. $action->profile->nickname .'@'. common_config('site', 'server');
-            $url = common_local_url('xrd');
+            $url = common_local_url('userxrd');
             $url.= '?uri='. $acct;
-            
+
             header('Link: <'.$url.'>; rel="'. Discovery::LRDD_REL.'"; type="application/xrd+xml"');
         }
     }
-    
+
     /**
      * Set up a PuSH hub link to our internal link for canonical timeline
      * Atom feeds for users and groups.
@@ -210,6 +214,22 @@ class OStatusPlugin extends Plugin
         return false;
     }
 
+    function onStartGroupSubscribe($output, $group)
+    {
+        $cur = common_current_user();
+
+        if (empty($cur)) {
+            // Add an OStatus subscribe
+            $url = common_local_url('ostatusinit',
+                                    array('group' => $group->nickname));
+            $output->element('a', array('href' => $url,
+                                        'class' => 'entity_remote_subscribe'),
+                                _m('Join'));
+        }
+
+        return true;
+    }
+
     /**
      * Check if we've got remote replies to send via Salmon.
      *
@@ -233,70 +253,70 @@ class OStatusPlugin extends Plugin
 
     function onEndFindMentions($sender, $text, &$mentions)
     {
-        preg_match_all('!(?:^|\s+)
-                        @(                                # Webfinger:
-                          (?:\w+\.)*\w+                   #   user
-                          @                               #   @
-                          (?:\w+\.)*\w+(?:\w+\-\w+)*\.\w+ #   domain
-                         |                                # Profile:
-                          (?:\w+\.)*\w+(?:\w+\-\w+)*\.\w+ #   domain
-                          (?:/\w+)+                       #   /path1(/path2...)
-                         )!x',
+        $matches = array();
+
+        // Webfinger matches: @user@example.com
+        if (preg_match_all('!(?:^|\s+)@((?:\w+\.)*\w+@(?:\w+\.)*\w+(?:\w+\-\w+)*\.\w+)!',
                        $text,
                        $wmatches,
-                       PREG_OFFSET_CAPTURE);
-
-        foreach ($wmatches[1] as $wmatch) {
-            $target = $wmatch[0];
-            $oprofile = null;
-
-            if (strpos($target, '/') === false) {
-                $this->log(LOG_INFO, "Checking Webfinger for address '$target'");
+                       PREG_OFFSET_CAPTURE)) {
+            foreach ($wmatches[1] as $wmatch) {
+                list($target, $pos) = $wmatch;
+                $this->log(LOG_INFO, "Checking webfinger '$target'");
                 try {
                     $oprofile = Ostatus_profile::ensureWebfinger($target);
+                    if ($oprofile && !$oprofile->isGroup()) {
+                        $profile = $oprofile->localProfile();
+                        $matches[$pos] = array('mentioned' => array($profile),
+                                               'text' => $target,
+                                               'position' => $pos,
+                                               'url' => $profile->profileurl);
+                    }
                 } catch (Exception $e) {
                     $this->log(LOG_ERR, "Webfinger check failed: " . $e->getMessage());
                 }
-            } else {
-                $schemes = array('https', 'http');
+            }
+        }
+
+        // Profile matches: @example.com/mublog/user
+        if (preg_match_all('!(?:^|\s+)@((?:\w+\.)*\w+(?:\w+\-\w+)*\.\w+(?:/\w+)+)!',
+                       $text,
+                       $wmatches,
+                       PREG_OFFSET_CAPTURE)) {
+            foreach ($wmatches[1] as $wmatch) {
+                list($target, $pos) = $wmatch;
+                $schemes = array('http', 'https');
                 foreach ($schemes as $scheme) {
                     $url = "$scheme://$target";
                     $this->log(LOG_INFO, "Checking profile address '$url'");
                     try {
                         $oprofile = Ostatus_profile::ensureProfile($url);
-                        if ($oprofile) {
-                            continue;
+                        if ($oprofile && !$oprofile->isGroup()) {
+                            $profile = $oprofile->localProfile();
+                            $matches[$pos] = array('mentioned' => array($profile),
+                                                   'text' => $target,
+                                                   'position' => $pos,
+                                                   'url' => $profile->profileurl);
+                            break;
                         }
                     } catch (Exception $e) {
                         $this->log(LOG_ERR, "Profile check failed: " . $e->getMessage());
                     }
                 }
             }
+        }
 
-            if (empty($oprofile)) {
-                $this->log(LOG_INFO, "No Ostatus_profile found for address '$target'");
-            } else {
-
-                $this->log(LOG_INFO, "Ostatus_profile found for address '$target'");
-
-                if ($oprofile->isGroup()) {
-                    continue;
-                }
-                $profile = $oprofile->localProfile();
-
-                $pos = $wmatch[1];
-                foreach ($mentions as $i => $other) {
-                    // If we share a common prefix with a local user, override it!
-                    if ($other['position'] == $pos) {
-                        unset($mentions[$i]);
-                    }
-                }
-                $mentions[] = array('mentioned' => array($profile),
-                                    'text' => $target,
-                                    'position' => $pos,
-                                    'url' => $profile->profileurl);
+        foreach ($mentions as $i => $other) {
+            // If we share a common prefix with a local user, override it!
+            $pos = $other['position'];
+            if (isset($matches[$pos])) {
+                $mentions[$i] = $matches[$pos];
+                unset($matches[$pos]);
             }
         }
+        foreach ($matches as $mention) {
+            $mentions[] = $mention;
+        }
 
         return true;
     }
@@ -567,7 +587,6 @@ class OStatusPlugin extends Plugin
             // Drop the PuSH subscription if there are no other subscribers.
             $oprofile->garbageCollect();
 
-
             $member = Profile::staticGet($user->id);
 
             $act = new Activity();
@@ -711,23 +730,37 @@ class OStatusPlugin extends Plugin
         return true;
     }
 
-    function onStartShowAllContent($action)
+    function onStartShowUserGroupsContent($action)
+    {
+        $this->showEntityRemoteSubscribe($action, 'ostatusgroup');
+
+        return true;
+    }
+
+    function onEndShowSubscriptionsMiniList($action)
     {
         $this->showEntityRemoteSubscribe($action);
 
         return true;
     }
 
-    function showEntityRemoteSubscribe($action)
+    function onEndShowGroupsMiniList($action)
+    {
+        $this->showEntityRemoteSubscribe($action, 'ostatusgroup');
+
+        return true;
+    }
+
+    function showEntityRemoteSubscribe($action, $target='ostatussub')
     {
         $user = common_current_user();
         if ($user && ($user->id == $action->profile->id)) {
             $action->elementStart('div', 'entity_actions');
             $action->elementStart('p', array('id' => 'entity_remote_subscribe',
                                              'class' => 'entity_subscribe'));
-            $action->element('a', array('href' => common_local_url('ostatussub'),
+            $action->element('a', array('href' => common_local_url($target),
                                         'class' => 'entity_remote_subscribe')
-                                , _m('Subscribe to remote user'));
+                                , _m('Remote'));
             $action->elementEnd('p');
             $action->elementEnd('div');
         }
@@ -779,4 +812,28 @@ class OStatusPlugin extends Plugin
 
         return true;
     }
+
+    function onStartProfileListItemActionElements($item)
+    {
+        if (!common_logged_in()) {
+
+            $profileUser = User::staticGet('id', $item->profile->id);
+
+            if (!empty($profileUser)) {
+
+                $output = $item->out;
+
+                // Add an OStatus subscribe
+                $output->elementStart('li', 'entity_subscribe');
+                $url = common_local_url('ostatusinit',
+                                        array('nickname' => $profileUser->nickname));
+                $output->element('a', array('href' => $url,
+                                            'class' => 'entity_remote_subscribe'),
+                                 _m('Subscribe'));
+                $output->elementEnd('li');
+            }
+        }
+
+        return true;
+    }
 }
diff --git a/plugins/OStatus/actions/hostmeta.php b/plugins/OStatus/actions/hostmeta.php
index 3d00b98ae..6d35ada6c 100644
--- a/plugins/OStatus/actions/hostmeta.php
+++ b/plugins/OStatus/actions/hostmeta.php
@@ -32,7 +32,7 @@ class HostMetaAction extends Action
         parent::handle();
 
         $domain = common_config('site', 'server');
-        $url = common_local_url('xrd');
+        $url = common_local_url('userxrd');
         $url.= '?uri={uri}';
 
         $xrd = new XRD();
diff --git a/plugins/OStatus/actions/ostatusgroup.php b/plugins/OStatus/actions/ostatusgroup.php
new file mode 100644
index 000000000..f325ba053
--- /dev/null
+++ b/plugins/OStatus/actions/ostatusgroup.php
@@ -0,0 +1,181 @@
+<?php
+/*
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2009-2010, StatusNet, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @package OStatusPlugin
+ * @maintainer Brion Vibber <brion@status.net>
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
+
+/**
+ * Key UI methods:
+ *
+ *  showInputForm() - form asking for a remote profile account or URL
+ *                    We end up back here on errors
+ *
+ *  showPreviewForm() - surrounding form for preview-and-confirm
+ *    preview() - display profile for a remote group
+ *
+ *  success() - redirects to groups page on join
+ */
+class OStatusGroupAction extends OStatusSubAction
+{
+    protected $profile_uri; // provided acct: or URI of remote entity
+    protected $oprofile; // Ostatus_profile of remote entity, if valid
+
+
+    function validateRemoteProfile()
+    {
+        if (!$this->oprofile->isGroup()) {
+            // Send us to the user subscription form for conf
+            $target = common_local_url('ostatussub', array(), array('profile' => $this->profile_uri));
+            common_redirect($target, 303);
+        }
+    }
+
+    /**
+     * Show the initial form, when we haven't yet been given a valid
+     * remote profile.
+     */
+    function showInputForm()
+    {
+        $user = common_current_user();
+
+        $profile = $user->getProfile();
+
+        $this->elementStart('form', array('method' => 'post',
+                                          'id' => 'form_ostatus_sub',
+                                          'class' => 'form_settings',
+                                          'action' => $this->selfLink()));
+
+        $this->hidden('token', common_session_token());
+
+        $this->elementStart('fieldset', array('id' => 'settings_feeds'));
+
+        $this->elementStart('ul', 'form_data');
+        $this->elementStart('li');
+        $this->input('profile',
+                     _m('Join group'),
+                     $this->profile_uri,
+                     _m("OStatus group's address, like http://example.net/group/nickname"));
+        $this->elementEnd('li');
+        $this->elementEnd('ul');
+
+        $this->submit('validate', _m('Continue'));
+
+        $this->elementEnd('fieldset');
+
+        $this->elementEnd('form');
+    }
+
+    /**
+     * Show a preview for a remote group's profile
+     * @return boolean true if we're ok to try joining
+     */
+    function preview()
+    {
+        $oprofile = $this->oprofile;
+        $group = $oprofile->localGroup();
+
+        $cur = common_current_user();
+        if ($cur->isMember($group)) {
+            $this->element('div', array('class' => 'error'),
+                           _m("You are already a member of this group."));
+            $ok = false;
+        } else {
+            $ok = true;
+        }
+
+        $this->showEntity($group,
+                          $group->getProfileUrl(),
+                          $group->homepage_logo,
+                          $group->description);
+        return $ok;
+    }
+
+    /**
+     * Redirect on successful remote group join
+     */
+    function success()
+    {
+        $cur = common_current_user();
+        $url = common_local_url('usergroups', array('nickname' => $cur->nickname));
+        common_redirect($url, 303);
+    }
+
+    /**
+     * Attempt to finalize subscription.
+     * validateFeed must have been run first.
+     *
+     * Calls showForm on failure or success on success.
+     */
+    function saveFeed()
+    {
+        $user = common_current_user();
+        $group = $this->oprofile->localGroup();
+        if ($user->isMember($group)) {
+            // TRANS: OStatus remote group subscription dialog error.
+            $this->showForm(_m('Already a member!'));
+            return;
+        }
+
+        if (Event::handle('StartJoinGroup', array($group, $user))) {
+            $ok = Group_member::join($this->oprofile->group_id, $user->id);
+            if ($ok) {
+                Event::handle('EndJoinGroup', array($group, $user));
+                $this->success();
+            } else {
+                // TRANS: OStatus remote group subscription dialog error.
+                $this->showForm(_m('Remote group join failed!'));
+            }
+        } else {
+            // TRANS: OStatus remote group subscription dialog error.
+            $this->showForm(_m('Remote group join aborted!'));
+        }
+    }
+
+    /**
+     * Title of the page
+     *
+     * @return string Title of the page
+     */
+
+    function title()
+    {
+        // TRANS: Page title for OStatus remote group join form
+        return _m('Confirm joining remote group');
+    }
+
+    /**
+     * Instructions for use
+     *
+     * @return instructions for use
+     */
+
+    function getInstructions()
+    {
+        return _m('You can subscribe to groups from other supported sites. Paste the group\'s profile URI below:');
+    }
+
+    function selfLink()
+    {
+        return common_local_url('ostatusgroup');
+    }
+}
diff --git a/plugins/OStatus/actions/ostatusinit.php b/plugins/OStatus/actions/ostatusinit.php
index 8ba8dcdcc..1e45025b0 100644
--- a/plugins/OStatus/actions/ostatusinit.php
+++ b/plugins/OStatus/actions/ostatusinit.php
@@ -29,6 +29,7 @@ class OStatusInitAction extends Action
 {
 
     var $nickname;
+    var $group;
     var $profile;
     var $err;
 
@@ -41,8 +42,9 @@ class OStatusInitAction extends Action
             return false;
         }
 
-        // Local user the remote wants to subscribe to
+        // Local user or group the remote wants to subscribe to
         $this->nickname = $this->trimmed('nickname');
+        $this->group = $this->trimmed('group');
         
         // Webfinger or profile URL of the remote user
         $this->profile = $this->trimmed('profile');
@@ -89,25 +91,33 @@ class OStatusInitAction extends Action
 
     function showContent()
     {
+        if ($this->group) {
+            $header = sprintf(_m('Join group %s'), $this->group);
+            $submit = _m('Join');
+        } else {
+            $header = sprintf(_m('Subscribe to %s'), $this->nickname);
+            $submit = _m('Subscribe');
+        }
         $this->elementStart('form', array('id' => 'form_ostatus_connect',
                                           'method' => 'post',
                                           'class' => 'form_settings',
                                           'action' => common_local_url('ostatusinit')));
         $this->elementStart('fieldset');
-        $this->element('legend', null,  sprintf(_m('Subscribe to %s'), $this->nickname));
+        $this->element('legend', null,  $header);
         $this->hidden('token', common_session_token());
 
         $this->elementStart('ul', 'form_data');
         $this->elementStart('li', array('id' => 'ostatus_nickname'));
         $this->input('nickname', _m('User nickname'), $this->nickname,
                      _m('Nickname of the user you want to follow'));
+        $this->hidden('group', $this->group); // pass-through for magic links
         $this->elementEnd('li');
         $this->elementStart('li', array('id' => 'ostatus_profile'));
         $this->input('profile', _m('Profile Account'), $this->profile,
                      _m('Your account id (i.e. user@identi.ca)'));
         $this->elementEnd('li');
         $this->elementEnd('ul');
-        $this->submit('submit', _m('Subscribe'));
+        $this->submit('submit', $submit);
         $this->elementEnd('fieldset');
         $this->elementEnd('form');
     }
@@ -131,19 +141,17 @@ class OStatusInitAction extends Action
 
     function connectWebfinger($acct)
     {
-        $disco = new Discovery;
+        $target_profile = $this->targetProfile();
 
+        $disco = new Discovery;
         $result = $disco->lookup($acct);
         if (!$result) {
             $this->clientError(_m("Couldn't look up OStatus account profile."));
         }
+
         foreach ($result->links as $link) {
             if ($link['rel'] == 'http://ostatus.org/schema/1.0/subscribe') {
                 // We found a URL - let's redirect!
-
-                $user = User::staticGet('nickname', $this->nickname);
-                $target_profile = common_local_url('userbyid', array('id' => $user->id));
-
                 $url = Discovery::applyTemplate($link['template'], $target_profile);
                 common_log(LOG_INFO, "Sending remote subscriber $acct to $url");
                 common_redirect($url, 303);
@@ -155,8 +163,7 @@ class OStatusInitAction extends Action
 
     function connectProfile($subscriber_profile)
     {
-        $user = User::staticGet('nickname', $this->nickname);
-        $target_profile = common_local_url('userbyid', array('id' => $user->id));
+        $target_profile = $this->targetProfile();
 
         // @fixme hack hack! We should look up the remote sub URL from XRDS
         $suburl = preg_replace('!^(.*)/(.*?)$!', '$1/main/ostatussub', $subscriber_profile);
@@ -166,6 +173,30 @@ class OStatusInitAction extends Action
         common_redirect($suburl, 303);
     }
 
+    /**
+     * Build the canonical profile URI+URL of the requested user or group
+     */
+    function targetProfile()
+    {
+        if ($this->nickname) {
+            $user = User::staticGet('nickname', $this->nickname);
+            if ($user) {
+                return common_local_url('userbyid', array('id' => $user->id));
+            } else {
+                $this->clientError("No such user.");
+            }
+        } else if ($this->group) {
+            $group = Local_group::staticGet('id', $this->group);
+            if ($group) {
+                return common_local_url('groupbyid', array('id' => $group->group_id));
+            } else {
+                $this->clientError("No such group.");
+            }
+        } else {
+            $this->clientError("No local user or group nickname provided.");
+        }
+    }
+
     function title()
     {
       return _m('OStatus Connect');  
diff --git a/plugins/OStatus/actions/ostatussub.php b/plugins/OStatus/actions/ostatussub.php
index e318701a2..65dee2392 100644
--- a/plugins/OStatus/actions/ostatussub.php
+++ b/plugins/OStatus/actions/ostatussub.php
@@ -1,7 +1,7 @@
 <?php
 /*
  * StatusNet - the distributed open-source microblogging tool
- * Copyright (C) 2009, StatusNet, Inc.
+ * Copyright (C) 2009-2010, StatusNet, Inc.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
@@ -31,11 +31,9 @@ if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
  *                    We end up back here on errors
  *
  *  showPreviewForm() - surrounding form for preview-and-confirm
- *    previewUser() - display profile for a remote user
- *    previewGroup() - display profile for a remote group
+ *    preview() - display profile for a remote user
  *
- *  successUser() - redirects to subscriptions page on subscribe
- *  successGroup() - redirects to groups page on join
+ *  success() - redirects to subscriptions page on subscribe
  */
 class OStatusSubAction extends Action
 {
@@ -55,8 +53,7 @@ class OStatusSubAction extends Action
         $this->elementStart('form', array('method' => 'post',
                                           'id' => 'form_ostatus_sub',
                                           'class' => 'form_settings',
-                                          'action' =>
-                                          common_local_url('ostatussub')));
+                                          'action' => $this->selfLink()));
 
         $this->hidden('token', common_session_token());
 
@@ -65,9 +62,9 @@ class OStatusSubAction extends Action
         $this->elementStart('ul', 'form_data');
         $this->elementStart('li');
         $this->input('profile',
-                     _m('Address or profile URL'),
+                     _m('Subscribe to'),
                      $this->profile_uri,
-                     _m('Enter the profile URL of a PubSubHubbub-enabled feed'));
+                     _m("OStatus user's address, like nickname@example.com or http://example.net/nickname"));
         $this->elementEnd('li');
         $this->elementEnd('ul');
 
@@ -87,11 +84,7 @@ class OStatusSubAction extends Action
      */
     function showPreviewForm()
     {
-        if ($this->oprofile->isGroup()) {
-            $ok = $this->previewGroup();
-        } else {
-            $ok = $this->previewUser();
-        }
+        $ok = $this->preview();
         if (!$ok) {
             // @fixme maybe provide a cancel button or link back?
             return;
@@ -104,7 +97,7 @@ class OStatusSubAction extends Action
                                           'id' => 'form_ostatus_sub',
                                           'class' => 'form_remote_authorize',
                                           'action' =>
-                                          common_local_url('ostatussub')));
+                                          $this->selfLink()));
         $this->elementStart('fieldset');
         $this->hidden('token', common_session_token());
         $this->hidden('profile', $this->profile_uri);
@@ -126,7 +119,7 @@ class OStatusSubAction extends Action
      * Show a preview for a remote user's profile
      * @return boolean true if we're ok to try subscribing
      */
-    function previewUser()
+    function preview()
     {
         $oprofile = $this->oprofile;
         $profile = $oprofile->localProfile();
@@ -150,32 +143,6 @@ class OStatusSubAction extends Action
         return $ok;
     }
 
-    /**
-     * Show a preview for a remote group's profile
-     * @return boolean true if we're ok to try joining
-     */
-    function previewGroup()
-    {
-        $oprofile = $this->oprofile;
-        $group = $oprofile->localGroup();
-
-        $cur = common_current_user();
-        if ($cur->isMember($group)) {
-            $this->element('div', array('class' => 'error'),
-                           _m("You are already a member of this group."));
-            $ok = false;
-        } else {
-            $ok = true;
-        }
-
-        $this->showEntity($group,
-                          $group->getProfileUrl(),
-                          $group->homepage_logo,
-                          $group->description);
-        return $ok;
-    }
-
-
     function showEntity($entity, $profile, $avatar, $note)
     {
         $nickname = $entity->nickname;
@@ -254,7 +221,7 @@ class OStatusSubAction extends Action
     /**
      * Redirect on successful remote user subscription
      */
-    function successUser()
+    function success()
     {
         $cur = common_current_user();
         $url = common_local_url('subscriptions', array('nickname' => $cur->nickname));
@@ -262,104 +229,81 @@ class OStatusSubAction extends Action
     }
 
     /**
-     * Redirect on successful remote group join
-     */
-    function successGroup()
-    {
-        $cur = common_current_user();
-        $url = common_local_url('usergroups', array('nickname' => $cur->nickname));
-        common_redirect($url, 303);
-    }
-
-    /**
      * Pull data for a remote profile and check if it's valid.
      * Fills out error UI string in $this->error
      * Fills out $this->oprofile on success.
      *
      * @return boolean
      */
-    function validateFeed()
+    function pullRemoteProfile()
     {
-        $profile_uri = trim($this->arg('profile'));
-
-        if ($profile_uri == '') {
-            $this->showForm(_m('Empty remote profile URL!'));
-            return;
-        }
-        $this->profile_uri = $profile_uri;
-
+        $this->profile_uri = $this->trimmed('profile');
         try {
             if (Validate::email($this->profile_uri)) {
                 $this->oprofile = Ostatus_profile::ensureWebfinger($this->profile_uri);
             } else if (Validate::uri($this->profile_uri)) {
                 $this->oprofile = Ostatus_profile::ensureProfile($this->profile_uri);
             } else {
-                $this->error = _m("Invalid address format.");
+                $this->error = _m("Sorry, we could not reach that address. Please make sure that the OStatus address is like nickname@example.com or http://example.net/nickname");
+                common_debug('Invalid address format.', __FILE__);
                 return false;
             }
             return true;
         } catch (FeedSubBadURLException $e) {
-            $this->error = _m('Invalid URL or could not reach server.');
+            $this->error = _m("Sorry, we could not reach that address. Please make sure that the OStatus address is like nickname@example.com or http://example.net/nickname");
+            common_debug('Invalid URL or could not reach server.', __FILE__);
         } catch (FeedSubBadResponseException $e) {
-            $this->error = _m('Cannot read feed; server returned error.');
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Cannot read feed; server returned error.', __FILE__);
         } catch (FeedSubEmptyException $e) {
-            $this->error = _m('Cannot read feed; server returned an empty page.');
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Cannot read feed; server returned an empty page.', __FILE__);
         } catch (FeedSubBadHTMLException $e) {
-            $this->error = _m('Bad HTML, could not find feed link.');
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Bad HTML, could not find feed link.', __FILE__);
         } catch (FeedSubNoFeedException $e) {
-            $this->error = _m('Could not find a feed linked from this URL.');
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Could not find a feed linked from this URL.', __FILE__);
         } catch (FeedSubUnrecognizedTypeException $e) {
-            $this->error = _m('Not a recognized feed type.');
-        } catch (FeedSubException $e) {
+            $this->error = _m("Sorry, we could not reach that feed. Please try that OStatus address again later.");
+            common_debug('Not a recognized feed type.', __FILE__);
+        } catch (Exception $e) {
             // Any new ones we forgot about
-            $this->error = sprintf(_m('Bad feed URL: %s %s'), get_class($e), $e->getMessage());
+            $this->error = _m("Sorry, we could not reach that address. Please make sure that the OStatus address is like nickname@example.com or http://example.net/nickname");
+            common_debug(sprintf('Bad feed URL: %s %s', get_class($e), $e->getMessage()), __FILE__);
         }
 
         return false;
     }
 
+    function validateRemoteProfile()
+    {
+        if ($this->oprofile->isGroup()) {
+            // Send us to the group subscription form for conf
+            $target = common_local_url('ostatusgroup', array(), array('profile' => $this->profile_uri));
+            common_redirect($target, 303);
+        }
+    }
+
     /**
      * Attempt to finalize subscription.
      * validateFeed must have been run first.
      *
-     * Calls showForm on failure or successUser/successGroup on success.
+     * Calls showForm on failure or success on success.
      */
     function saveFeed()
     {
         // And subscribe the current user to the local profile
         $user = common_current_user();
-
-        if ($this->oprofile->isGroup()) {
-            $group = $this->oprofile->localGroup();
-            if ($user->isMember($group)) {
-                // TRANS: OStatus remote group subscription dialog error.
-                $this->showForm(_m('Already a member!'));
-                return;
-            }
-            if (Event::handle('StartJoinGroup', array($group, $user))) {
-                $ok = Group_member::join($this->oprofile->group_id, $user->id);
-                if ($ok) {
-                    Event::handle('EndJoinGroup', array($group, $user));
-                    $this->successGroup();
-                } else {
-                    // TRANS: OStatus remote group subscription dialog error.
-                    $this->showForm(_m('Remote group join failed!'));
-                }
-            } else {
-                // TRANS: OStatus remote group subscription dialog error.
-                $this->showForm(_m('Remote group join aborted!'));
-            }
+        $local = $this->oprofile->localProfile();
+        if ($user->isSubscribed($local)) {
+            // TRANS: OStatus remote subscription dialog error.
+            $this->showForm(_m('Already subscribed!'));
+        } elseif ($this->oprofile->subscribeLocalToRemote($user)) {
+            $this->success();
         } else {
-            $local = $this->oprofile->localProfile();
-            if ($user->isSubscribed($local)) {
-                // TRANS: OStatus remote subscription dialog error.
-                $this->showForm(_m('Already subscribed!'));
-            } elseif ($this->oprofile->subscribeLocalToRemote($user)) {
-                $this->successUser();
-            } else {
-                // TRANS: OStatus remote subscription dialog error.
-                $this->showForm(_m('Remote subscription failed!'));
-            }
+            // TRANS: OStatus remote subscription dialog error.
+            $this->showForm(_m('Remote subscription failed!'));
         }
     }
 
@@ -376,8 +320,9 @@ class OStatusSubAction extends Action
             return false;
         }
 
-        $this->profile_uri = $this->arg('profile');
-
+        if ($this->pullRemoteProfile()) {
+            $this->validateRemoteProfile();
+        }
         return true;
     }
 
@@ -390,9 +335,6 @@ class OStatusSubAction extends Action
         if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             $this->handlePost();
         } else {
-            if ($this->arg('profile')) {
-                $this->validateFeed();
-            }
             $this->showForm();
         }
     }
@@ -414,7 +356,7 @@ class OStatusSubAction extends Action
             return;
         }
 
-        if ($this->validateFeed()) {
+        if ($this->oprofile) {
             if ($this->arg('submit')) {
                 $this->saveFeed();
                 return;
@@ -456,7 +398,7 @@ class OStatusSubAction extends Action
     function title()
     {
         // TRANS: Page title for OStatus remote subscription form
-        return _m('Authorize subscription');
+        return _m('Confirm');
     }
 
     /**
@@ -500,4 +442,9 @@ class OStatusSubAction extends Action
         parent::showScripts();
         $this->autofocus('feedurl');
     }
+
+    function selfLink()
+    {
+        return common_local_url('ostatussub');
+    }
 }
diff --git a/plugins/OStatus/actions/ownerxrd.php b/plugins/OStatus/actions/ownerxrd.php
new file mode 100644
index 000000000..9c141d8c7
--- /dev/null
+++ b/plugins/OStatus/actions/ownerxrd.php
@@ -0,0 +1,56 @@
+<?php
+/*
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2010, StatusNet, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @package OStatusPlugin
+ * @maintainer James Walker <james@status.net>
+ */
+
+if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
+
+class OwnerxrdAction extends XrdAction
+{
+
+    public $uri;
+
+    function prepare($args)
+    {
+        $this->user = User::siteOwner();
+        
+        if (!$this->user) {
+            $this->clientError(_('No such user.'), 404);
+            return false;
+        }
+
+        $nick = common_canonical_nickname($this->user->nickname);
+        $acct = 'acct:' . $nick . '@' . common_config('site', 'server');
+        
+        $this->xrd = new XRD();
+
+        // Check to see if a $config['webfinger']['owner'] has been set
+        if ($owner = common_config('webfinger', 'owner')) {
+            $this->xrd->subject = Discovery::normalize($owner);
+            $this->xrd->alias[] = $acct;
+        } else {
+            $this->xrd->subject = $acct;
+        }
+
+        return true;
+    }
+}
diff --git a/plugins/OStatus/actions/userxrd.php b/plugins/OStatus/actions/userxrd.php
new file mode 100644
index 000000000..414de9364
--- /dev/null
+++ b/plugins/OStatus/actions/userxrd.php
@@ -0,0 +1,48 @@
+<?php
+/*
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2010, StatusNet, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @package OStatusPlugin
+ * @maintainer James Walker <james@status.net>
+ */
+
+if (!defined('STATUSNET')) { exit(1); }
+
+class UserxrdAction extends XrdAction
+{
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+
+        $this->uri = $this->trimmed('uri');
+        $acct = Discovery::normalize($this->uri);
+
+        list($nick, $domain) = explode('@', substr(urldecode($acct), 5));
+        $nick = common_canonical_nickname($nick);
+
+        $this->user = User::staticGet('nickname', $nick);
+        if (!$this->user) {
+            $this->clientError(_('No such user.'), 404);
+            return false;
+        }
+
+        return true;
+    }
+}
diff --git a/plugins/OStatus/classes/Ostatus_profile.php b/plugins/OStatus/classes/Ostatus_profile.php
index a33e95d93..fcca1a252 100644
--- a/plugins/OStatus/classes/Ostatus_profile.php
+++ b/plugins/OStatus/classes/Ostatus_profile.php
@@ -550,7 +550,8 @@ class Ostatus_profile extends Memcached_DataObject
                         'rendered' => $rendered,
                         'replies' => array(),
                         'groups' => array(),
-                        'tags' => array());
+                        'tags' => array(),
+                        'urls' => array());
 
         // Check for optional attributes...
 
@@ -595,6 +596,12 @@ class Ostatus_profile extends Memcached_DataObject
             }
         }
 
+        // Atom enclosures -> attachment URLs
+        foreach ($activity->enclosures as $href) {
+            // @fixme save these locally or....?
+            $options['urls'][] = $href;
+        }
+
         try {
             $saved = Notice::saveNew($oprofile->profile_id,
                                      $content,
@@ -620,7 +627,8 @@ class Ostatus_profile extends Memcached_DataObject
     protected function purify($html)
     {
         require_once INSTALLDIR.'/extlib/htmLawed/htmLawed.php';
-        $config = array('safe' => 1);
+        $config = array('safe' => 1,
+                        'deny_attribute' => 'id,style,on*');
         return htmLawed($html, $config);
     }
 
@@ -1259,6 +1267,11 @@ class Ostatus_profile extends Memcached_DataObject
         }
     }
 
+    /**
+     * @param string $addr webfinger address
+     * @return Ostatus_profile
+     * @throws Exception on error conditions
+     */
     public static function ensureWebfinger($addr)
     {
         // First, try the cache
@@ -1267,7 +1280,8 @@ class Ostatus_profile extends Memcached_DataObject
 
         if ($uri !== false) {
             if (is_null($uri)) {
-                return null;
+                // Negative cache entry
+                throw new Exception('Not a valid webfinger address.');
             }
             $oprofile = Ostatus_profile::staticGet('uri', $uri);
             if (!empty($oprofile)) {
@@ -1291,20 +1305,24 @@ class Ostatus_profile extends Memcached_DataObject
         try {
             $result = $disco->lookup($addr);
         } catch (Exception $e) {
+            // Save negative cache entry so we don't waste time looking it up again.
+            // @fixme distinguish temporary failures?
             self::cacheSet(sprintf('ostatus_profile:webfinger:%s', $addr), null);
-            return null;
+            throw new Exception('Not a valid webfinger address.');
         }
 
+        $hints = array('webfinger' => $addr);
+
         foreach ($result->links as $link) {
             switch ($link['rel']) {
             case Discovery::PROFILEPAGE:
-                $profileUrl = $link['href'];
+                $hints['profileurl'] = $profileUrl = $link['href'];
                 break;
             case Salmon::NS_REPLIES:
-                $salmonEndpoint = $link['href'];
+                $hints['salmon'] = $salmonEndpoint = $link['href'];
                 break;
             case Discovery::UPDATESFROM:
-                $feedUrl = $link['href'];
+                $hints['feedurl'] = $feedUrl = $link['href'];
                 break;
             case Discovery::HCARD:
                 $hcardUrl = $link['href'];
@@ -1315,11 +1333,6 @@ class Ostatus_profile extends Memcached_DataObject
             }
         }
 
-        $hints = array('webfinger' => $addr,
-                       'profileurl' => $profileUrl,
-                       'feedurl' => $feedUrl,
-                       'salmon' => $salmonEndpoint);
-
         if (isset($hcardUrl)) {
             $hcardHints = self::slurpHcard($hcardUrl);
             // Note: Webfinger > hcard
@@ -1402,7 +1415,7 @@ class Ostatus_profile extends Memcached_DataObject
             return $oprofile;
         }
 
-        return null;
+        throw new Exception("Couldn't find a valid profile for '$addr'");
     }
 
     function saveHTMLFile($title, $rendered)
@@ -1492,7 +1505,7 @@ class Ostatus_profile extends Memcached_DataObject
         if (array_key_exists('url', $hcard)) {
             if (is_string($hcard['url'])) {
                 $hints['homepage'] = $hcard['url'];
-            } else if (is_array($hcard['adr'])) {
+            } else if (is_array($hcard['url'])) {
                 // HACK get the last one; that's how our hcards look
                 $hints['homepage'] = $hcard['url'][count($hcard['url'])-1];
             }
diff --git a/plugins/OStatus/lib/magicenvelope.php b/plugins/OStatus/lib/magicenvelope.php
index 230d81ba1..fb8c57c71 100644
--- a/plugins/OStatus/lib/magicenvelope.php
+++ b/plugins/OStatus/lib/magicenvelope.php
@@ -156,18 +156,32 @@ class MagicEnvelope
     public function verify($env)
     {
         if ($env['alg'] != 'RSA-SHA256') {
+            common_log(LOG_DEBUG, "Salmon error: bad algorithm");
             return false;
         }
 
         if ($env['encoding'] != MagicEnvelope::ENCODING) {
+            common_log(LOG_DEBUG, "Salmon error: bad encoding");
             return false;
         }
 
         $text = base64_decode($env['data']);
         $signer_uri = $this->getAuthor($text);
 
-        $verifier = Magicsig::fromString($this->getKeyPair($signer_uri));
+        try {
+            $keypair = $this->getKeyPair($signer_uri);
+        } catch (Exception $e) {
+            common_log(LOG_DEBUG, "Salmon error: ".$e->getMessage());
+            return false;
+        }
+        
+        $verifier = Magicsig::fromString($keypair);
 
+        if (!$verifier) {
+            common_log(LOG_DEBUG, "Salmon error: unable to parse keypair");
+            return false;
+        }
+        
         return $verifier->verify($env['data'], $env['sig']);
     }
 
diff --git a/plugins/OStatus/lib/ostatusqueuehandler.php b/plugins/OStatus/lib/ostatusqueuehandler.php
index 6ca31c485..d1e58f1d6 100644
--- a/plugins/OStatus/lib/ostatusqueuehandler.php
+++ b/plugins/OStatus/lib/ostatusqueuehandler.php
@@ -164,46 +164,21 @@ class OStatusQueueHandler extends QueueHandler
      */
     function userFeedForNotice()
     {
-        // @fixme this feels VERY hacky...
-        // should probably be a cleaner way to do it
-
-        ob_start();
-        $api = new ApiTimelineUserAction();
-        $api->prepare(array('id' => $this->notice->profile_id,
-                            'format' => 'atom',
-                            'max_id' => $this->notice->id,
-                            'since_id' => $this->notice->id - 1));
-        $api->showTimeline();
-        $feed = ob_get_clean();
-        
-        // ...and override the content-type back to something normal... eww!
-        // hope there's no other headers that got set while we weren't looking.
-        header('Content-Type: text/html; charset=utf-8');
-
-        common_log(LOG_DEBUG, $feed);
+        $atom = new AtomUserNoticeFeed($this->user);
+        $atom->addEntryFromNotice($this->notice);
+        $feed = $atom->getString();
+
         return $feed;
     }
 
     function groupFeedForNotice($group_id)
     {
-        // @fixme this feels VERY hacky...
-        // should probably be a cleaner way to do it
-
-        ob_start();
-        $api = new ApiTimelineGroupAction();
-        $args = array('id' => $group_id,
-                      'format' => 'atom',
-                      'max_id' => $this->notice->id,
-                      'since_id' => $this->notice->id - 1);
-        $api->prepare($args);
-        $api->handle($args);
-        $feed = ob_get_clean();
-        
-        // ...and override the content-type back to something normal... eww!
-        // hope there's no other headers that got set while we weren't looking.
-        header('Content-Type: text/html; charset=utf-8');
-
-        common_log(LOG_DEBUG, $feed);
+        $group = User_group::staticGet('id', $group_id);
+
+        $atom = new AtomGroupNoticeFeed($group);
+        $atom->addEntryFromNotice($this->notice);
+        $feed = $atom->getString();
+
         return $feed;
     }
 
diff --git a/plugins/OStatus/lib/xrd.php b/plugins/OStatus/lib/xrd.php
index 85df26c54..aa13ef024 100644
--- a/plugins/OStatus/lib/xrd.php
+++ b/plugins/OStatus/lib/xrd.php
@@ -57,6 +57,9 @@ class XRD
             throw new Exception("Invalid XML");
         }
         $xrd_element = $dom->getElementsByTagName('XRD')->item(0);
+        if (!$xrd_element) {
+            throw new Exception("Invalid XML, missing XRD root");
+        }
 
         // Check for host-meta host
         $host = $xrd_element->getElementsByTagName('Host')->item(0);
@@ -149,9 +152,11 @@ class XRD
         $link['href'] = $element->getAttribute('href');
         $link['template'] = $element->getAttribute('template');
         foreach ($element->childNodes as $node) {
-            switch($node->tagName) {
-            case 'Title':
-                $link['title'][] = $node->nodeValue;
+            if ($node instanceof DOMElement) {
+                switch($node->tagName) {
+                case 'Title':
+                    $link['title'][] = $node->nodeValue;
+                }
             }
         }
 
diff --git a/plugins/OStatus/actions/xrd.php b/plugins/OStatus/lib/xrdaction.php
index f574b60ee..6881292ad 100644
--- a/plugins/OStatus/actions/xrd.php
+++ b/plugins/OStatus/lib/xrdaction.php
@@ -28,32 +28,24 @@ class XrdAction extends Action
 {
 
     public $uri;
+    
+    public $user;
 
-    function prepare($args)
-    {
-        parent::prepare($args);
-
-        $this->uri = $this->trimmed('uri');
-
-        return true;
-    }
-
+    public $xrd;
+    
     function handle()
     {
-        $acct = Discovery::normalize($this->uri);
-
-        $xrd = new XRD();
+        $nick =  $this->user->nickname;
 
-        list($nick, $domain) = explode('@', substr(urldecode($acct), 5));
-        $nick = common_canonical_nickname($nick);
-
-        $this->user = User::staticGet('nickname', $nick);
-        if (!$this->user) {
-            $this->clientError(_('No such user.'), 404);
-            return false;
+        if (empty($this->xrd)) {
+            $xrd = new XRD();
+        } else {
+            $xrd = $this->xrd;
         }
 
-        $xrd->subject = $this->uri;
+        if (empty($xrd->subject)) {
+            $xrd->subject = Discovery::normalize($this->uri);
+        }
         $xrd->alias[] = common_profile_url($nick);
         $xrd->links[] = array('rel' => Discovery::PROFILEPAGE,
                               'type' => 'text/html',
diff --git a/plugins/OStatus/theme/base/css/ostatus.css b/plugins/OStatus/theme/base/css/ostatus.css
index 13e30ef5d..f7d9853cf 100644
--- a/plugins/OStatus/theme/base/css/ostatus.css
+++ b/plugins/OStatus/theme/base/css/ostatus.css
@@ -41,8 +41,34 @@ min-width:96px;
 #entity_remote_subscribe {
 padding:0;
 float:right;
+position:relative;
 }
 
-#all #entity_remote_subscribe {
-margin-top:-52px;
+.section .entity_actions {
+margin-bottom:0;
+}
+
+#entity_remote_subscribe .dialogbox {
+width:405px;
+}
+
+.aside #entity_subscriptions .more,
+.aside #entity_groups .more {
+float:left;
+}
+
+.section #entity_remote_subscribe {
+border:0;
+}
+
+.section .entity_remote_subscribe {
+color:#002FA7;
+box-shadow:none;
+-moz-box-shadow:none;
+-webkit-box-shadow:none;
+background-color:transparent;
+background-position:0 -1183px;
+padding:0 0 0 23px;
+border:0;
+
 }
diff --git a/plugins/TwitterBridge/README b/plugins/TwitterBridge/README
index 72278b32e..d0d34b7ef 100644
--- a/plugins/TwitterBridge/README
+++ b/plugins/TwitterBridge/README
@@ -20,7 +20,7 @@ on Twitter (http://twitter.com/apps).  During the application
 registration process your application will be assigned a "consumer" key
 and secret, which the plugin will use to make OAuth requests to Twitter.
 You can either pass the consumer key and secret in when you enable the
-plugin, or set it using the Twitter administration panel.
+plugin, or set it using the Twitter administration panel**.
 
 When registering your application with Twitter set the type to "Browser"
 and your Callback URL to:
@@ -42,11 +42,26 @@ To enable the plugin, add the following to your config.php:
         )
     );
 
+or just:
+
+   addPlugin('TwitterBridge');
+
+if you want to set the consumer key and secret from the Twitter bridge
+administration panel.  (The Twitter bridge wont work at all
+unless you configure it with a consumer key and secret.)
+
 * Note: The plugin will still push notices to Twitter for users who
   have previously set up the Twitter bridge using their Twitter name and
   password under an older version of StatusNet, but all new Twitter
   bridge connections will use OAuth.
 
+** For multi-site setups you can also set a global consumer key and
+   secret.  The Twitter bridge will fall back on the global key pair if
+   it can't find a local pair, e.g.:
+
+   $config['twitter']['global_consumer_key']    = 'YOUR_CONSUMER_KEY'
+   $config['twitter']['global_consumer_secret'] = 'YOUR_CONSUMER_SECRET'
+
 Administration panel
 --------------------
 
diff --git a/plugins/TwitterBridge/TwitterBridgePlugin.php b/plugins/TwitterBridge/TwitterBridgePlugin.php
index 6ce69d5e2..1a0a69682 100644
--- a/plugins/TwitterBridge/TwitterBridgePlugin.php
+++ b/plugins/TwitterBridge/TwitterBridgePlugin.php
@@ -80,6 +80,30 @@ class TwitterBridgePlugin extends Plugin
     }
 
     /**
+     * Check to see if there is a consumer key and secret defined
+     * for Twitter integration.
+     *
+     * @return boolean result
+     */
+
+    static function hasKeys()
+    {
+        $ckey    = common_config('twitter', 'consumer_key');
+        $csecret = common_config('twitter', 'consumer_secret');
+
+        if (empty($ckey) && empty($csecret)) {
+            $ckey    = common_config('twitter', 'global_consumer_key');
+            $csecret = common_config('twitter', 'global_consumer_secret');
+        }
+
+        if (!empty($ckey) && !empty($csecret)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
      * Add Twitter-related paths to the router table
      *
      * Hook for RouterInitialized event.
@@ -91,18 +115,26 @@ class TwitterBridgePlugin extends Plugin
 
     function onRouterInitialized($m)
     {
-        $m->connect(
-            'twitter/authorization',
-            array('action' => 'twitterauthorization')
-        );
-        $m->connect('settings/twitter', array('action' => 'twittersettings'));
+        $m->connect('admin/twitter', array('action' => 'twitteradminpanel'));
 
-        if (common_config('twitter', 'signin')) {
-            $m->connect('main/twitterlogin', array('action' => 'twitterlogin'));
+        if (self::hasKeys()) {
+            $m->connect(
+                'twitter/authorization',
+                array('action' => 'twitterauthorization')
+            );
+            $m->connect(
+                'settings/twitter', array(
+                    'action' => 'twittersettings'
+                    )
+                );
+            if (common_config('twitter', 'signin')) {
+                $m->connect(
+                    'main/twitterlogin',
+                    array('action' => 'twitterlogin')
+                );
+            }
         }
 
-        $m->connect('admin/twitter', array('action' => 'twitteradminpanel'));
-
         return true;
     }
 
@@ -117,7 +149,7 @@ class TwitterBridgePlugin extends Plugin
     {
         $action_name = $action->trimmed('action');
 
-        if (common_config('twitter', 'signin')) {
+        if (self::hasKeys() && common_config('twitter', 'signin')) {
             $action->menuItem(
                 common_local_url('twitterlogin'),
                 _m('Twitter'),
@@ -138,15 +170,16 @@ class TwitterBridgePlugin extends Plugin
      */
     function onEndConnectSettingsNav(&$action)
     {
-        $action_name = $action->trimmed('action');
-
-        $action->menuItem(
-            common_local_url('twittersettings'),
-            _m('Twitter'),
-            _m('Twitter integration options'),
-            $action_name === 'twittersettings'
-        );
+        if (self::hasKeys()) {
+            $action_name = $action->trimmed('action');
 
+            $action->menuItem(
+                common_local_url('twittersettings'),
+                _m('Twitter'),
+                _m('Twitter integration options'),
+                $action_name === 'twittersettings'
+            );
+        }
         return true;
     }
 
@@ -188,12 +221,12 @@ class TwitterBridgePlugin extends Plugin
      */
     function onStartEnqueueNotice($notice, &$transports)
     {
-        // Avoid a possible loop
-
-        if ($notice->source != 'twitter') {
-            array_push($transports, 'twitter');
+        if (self::hasKeys()) {
+            // Avoid a possible loop
+            if ($notice->source != 'twitter') {
+                array_push($transports, 'twitter');
+            }
         }
-
         return true;
     }
 
@@ -206,18 +239,19 @@ class TwitterBridgePlugin extends Plugin
      */
     function onGetValidDaemons($daemons)
     {
-        array_push(
-            $daemons,
-            INSTALLDIR
-            . '/plugins/TwitterBridge/daemons/synctwitterfriends.php'
-        );
-
-        if (common_config('twitterimport', 'enabled')) {
+        if (self::hasKeys()) {
             array_push(
                 $daemons,
                 INSTALLDIR
-                . '/plugins/TwitterBridge/daemons/twitterstatusfetcher.php'
+                . '/plugins/TwitterBridge/daemons/synctwitterfriends.php'
             );
+            if (common_config('twitterimport', 'enabled')) {
+                array_push(
+                    $daemons,
+                    INSTALLDIR
+                    . '/plugins/TwitterBridge/daemons/twitterstatusfetcher.php'
+                    );
+            }
         }
 
         return true;
@@ -232,7 +266,9 @@ class TwitterBridgePlugin extends Plugin
      */
     function onEndInitializeQueueManager($manager)
     {
-        $manager->connect('twitter', 'TwitterQueueHandler');
+        if (self::hasKeys()) {
+            $manager->connect('twitter', 'TwitterQueueHandler');
+        }
         return true;
     }
 
diff --git a/plugins/TwitterBridge/twitteradminpanel.php b/plugins/TwitterBridge/twitteradminpanel.php
index b22e6d99f..a78a92c66 100644
--- a/plugins/TwitterBridge/twitteradminpanel.php
+++ b/plugins/TwitterBridge/twitteradminpanel.php
@@ -225,6 +225,15 @@ class TwitterAdminPanelForm extends AdminForm
         );
         $this->unli();
 
+        $globalConsumerKey = common_config('twitter', 'global_consumer_key');
+        $globalConsumerSec = common_config('twitter', 'global_consumer_secret');
+
+        if (!empty($globalConsumerKey) && !empty($globalConsumerSec)) {
+            $this->li();
+            $this->out->element('p', 'form_guide', _('Note: a global consumer key and secret are set.'));
+            $this->unli();
+        }
+
         $this->li();
         $this->input(
             'source',
diff --git a/plugins/TwitterBridge/twitteroauthclient.php b/plugins/TwitterBridge/twitteroauthclient.php
index ba45b533d..93f6aadd1 100644
--- a/plugins/TwitterBridge/twitteroauthclient.php
+++ b/plugins/TwitterBridge/twitteroauthclient.php
@@ -22,7 +22,7 @@
  * @category  Integration
  * @package   StatusNet
  * @author    Zach Copley <zach@status.net>
- * @copyright 2009 StatusNet, Inc.
+ * @copyright 2009-2010 StatusNet, Inc.
  * @license   http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  * @link      http://status.net/
  */
@@ -61,8 +61,23 @@ class TwitterOAuthClient extends OAuthClient
         $consumer_key    = common_config('twitter', 'consumer_key');
         $consumer_secret = common_config('twitter', 'consumer_secret');
 
-        parent::__construct($consumer_key, $consumer_secret,
-                            $oauth_token, $oauth_token_secret);
+        if (empty($consumer_key) && empty($consumer_secret)) {
+            $consumer_key = common_config(
+                'twitter',
+                'global_consumer_key'
+            );
+            $consumer_secret = common_config(
+                'twitter',
+                'global_consumer_secret'
+            );
+        }
+
+        parent::__construct(
+            $consumer_key,
+            $consumer_secret,
+            $oauth_token,
+            $oauth_token_secret
+        );
     }
 
     // XXX: the following two functions are to support the horrible hack