Major refactor and improvements

- Reorganised all namespaces and class names for consistency and structure. Following PSR bylaws (Abstract prefix, Interface/Trait suffix).
  - Move models into root of Core, because writing `use Flarum\Core\Discussion` is nice. Namespace the rest by type. (Namespacing by entity was too arbitrary.)
  - Moved some non-domain stuff out of Core: Database, Formatter, Settings.
  - Renamed config table and all references to "settings" for consistency.
  - Remove Core class and add url()/isInstalled()/inDebugMode() as instance methods of Foundation\Application.
  - Cleanup, docblocking, etc.

- Improvements to HTTP architecture
  - API and forum/admin Actions are now actually all the same thing (simple PSR-7 Request handlers), renamed to Controllers.
  - Upgrade to tobscure/json-api 0.2 branch.
  - Where possible, moved generic functionality to tobscure/json-api (e.g. pagination links). I'm quite happy with the backend balance now re: #262

- Improvements to other architecture
  - Use Illuminate's Auth\Access\Gate interface/implementation instead of our old Locked trait. We still use events to actually determine the permissions though. Our Policy classes are actually glorified event subscribers.
  - Extract model validation into Core\Validator classes.
  - Make post visibility permission stuff much more efficient and DRY.

- Renamed Flarum\Event classes for consistency. ref #246
  - `Configure` prefix for events dedicated to configuring an object.
  - `Get` prefix for events whose listeners should return something.
  - `Prepare` prefix when a variable is passed by reference so it can be modified.
  - `Scope` prefix when a query builder is passed.

- Miscellaneous improvements/bug-fixes. I'm easily distracted!
  - Increase default height of post composer.
  - Improve post stream redraw flickering in Safari by keying loading post placeholders with their IDs. ref #451
  - Use a PHP JavaScript minification library for minifying TextFormatter's JavaScript, instead of ClosureCompilerService (can't rely on external service!)
  - Use UrlGenerator properly in various places. closes #123
  - Make Api\Client return Response object. closes #128
  - Allow extensions to specify custom icon images.
  - Allow external API/admin URLs to be optionally specified in config.php. If the value or "url" is an array, we look for the corresponding path inside. Otherwise, we append the path to the base URL, using the corresponding value in "paths" if present. closes #244

src/Api/Controller/AbstractCollectionController.php

@@ -0,0 +1,25 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Tobscure\JsonApi\Collection;
+use Tobscure\JsonApi\SerializerInterface;
+
+abstract class AbstractCollectionController extends AbstractSerializeController
+{
+    /**
+     * {@inheritdoc}
+     */
+    protected function createElement($data, SerializerInterface $serializer)
+    {
+        return new Collection($data, $serializer);
+    }
+}

src/Api/Controller/AbstractCreateController.php

@@ -0,0 +1,24 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Psr\Http\Message\ServerRequestInterface;
+
+abstract class AbstractCreateController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function handle(ServerRequestInterface $request)
+    {
+        return parent::handle($request)->withStatus(201);
+    }
+}

src/Api/Controller/AbstractDeleteController.php

@@ -0,0 +1,35 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Http\Controller\ControllerInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use Zend\Diactoros\Response\EmptyResponse;
+
+abstract class AbstractDeleteController implements ControllerInterface
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function handle(ServerRequestInterface $request)
+    {
+        $this->delete($request);
+
+        return new EmptyResponse(204);
+    }
+
+    /**
+     * Delete the resource.
+     *
+     * @param ServerRequestInterface $request
+     */
+    abstract protected function delete(ServerRequestInterface $request);
+}

src/Api/Controller/AbstractResourceController.php

@@ -0,0 +1,25 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Tobscure\JsonApi\Resource;
+use Tobscure\JsonApi\SerializerInterface;
+
+abstract class AbstractResourceController extends AbstractSerializeController
+{
+    /**
+     * {@inheritdoc}
+     */
+    protected function createElement($data, SerializerInterface $serializer)
+    {
+        return new Resource($data, $serializer);
+    }
+}

src/Api/Controller/AbstractSerializeController.php

@@ -0,0 +1,231 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Api\JsonApiResponse;
+use Flarum\Http\Controller\ControllerInterface;
+use Illuminate\Contracts\Container\Container;
+use Flarum\Event\ConfigureApiController;
+use Flarum\Event\PrepareApiData;
+use Illuminate\Contracts\Events\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+use Tobscure\JsonApi\Parameters;
+use Tobscure\JsonApi\SerializerInterface;
+
+abstract class AbstractSerializeController implements ControllerInterface
+{
+    /**
+     * The name of the serializer class to output results with.
+     *
+     * @var string
+     */
+    public $serializer;
+
+    /**
+     * The relationships that are included by default.
+     *
+     * @var array
+     */
+    public $include = [];
+
+    /**
+     * The relationships that are available to be included.
+     *
+     * @var array
+     */
+    public $optionalInclude = [];
+
+    /**
+     * The maximum number of records that can be requested.
+     *
+     * @var int
+     */
+    public $maxLimit = 50;
+
+    /**
+     * The number of records included by default.
+     *
+     * @var int
+     */
+    public $limit = 20;
+
+    /**
+     * The fields that are available to be sorted by.
+     *
+     * @var array
+     */
+    public $sortFields = [];
+
+    /**
+     * The default sort field and order to user.
+     *
+     * @var array|null
+     */
+    public $sort;
+
+    /**
+     * @var Container
+     */
+    protected static $container;
+
+    /**
+     * @var Dispatcher
+     */
+    protected static $events;
+
+    /**
+     * {@inheritdoc}
+     */
+    public function handle(ServerRequestInterface $request)
+    {
+        $document = new Document;
+
+        static::$events->fire(
+            new ConfigureApiController($this)
+        );
+
+        $data = $this->data($request, $document);
+
+        static::$events->fire(
+            new PrepareApiData($this, $data, $request, $document)
+        );
+
+        $serializer = static::$container->make($this->serializer);
+        $serializer->setActor($request->getAttribute('actor'));
+
+        $element = $this->createElement($data, $serializer)
+            ->with($this->extractInclude($request))
+            ->fields($this->extractFields($request));
+
+        $document->setData($element);
+
+        return new JsonApiResponse($document);
+    }
+
+    /**
+     * Get the data to be serialized and assigned to the response document.
+     *
+     * @param ServerRequestInterface $request
+     * @param Document $document
+     * @return mixed
+     */
+    abstract protected function data(ServerRequestInterface $request, Document $document);
+
+    /**
+     * Create a PHP JSON-API Element for output in the document.
+     *
+     * @param mixed $data
+     * @param SerializerInterface $serializer
+     * @return \Tobscure\JsonApi\ElementInterface
+     */
+    abstract protected function createElement($data, SerializerInterface $serializer);
+
+    /**
+     * @param ServerRequestInterface $request
+     * @return array
+     * @throws \Tobscure\JsonApi\Exception\InvalidParameterException
+     */
+    protected function extractInclude(ServerRequestInterface $request)
+    {
+        $available = array_merge($this->include, $this->optionalInclude);
+
+        return $this->buildParameters($request)->getInclude($available) ?: $this->include;
+    }
+
+    /**
+     * @param ServerRequestInterface $request
+     * @return array
+     */
+    protected function extractFields(ServerRequestInterface $request)
+    {
+        return $this->buildParameters($request)->getFields();
+    }
+
+    /**
+     * @param ServerRequestInterface $request
+     * @return array|null
+     * @throws \Tobscure\JsonApi\Exception\InvalidParameterException
+     */
+    protected function extractSort(ServerRequestInterface $request)
+    {
+        return $this->buildParameters($request)->getSort($this->sortFields) ?: $this->sort;
+    }
+
+    /**
+     * @param ServerRequestInterface $request
+     * @return int
+     * @throws \Tobscure\JsonApi\Exception\InvalidParameterException
+     */
+    protected function extractOffset(ServerRequestInterface $request)
+    {
+        return $this->buildParameters($request)->getOffset($this->extractLimit($request)) ?: 0;
+    }
+
+    /**
+     * @param ServerRequestInterface $request
+     * @return int
+     */
+    protected function extractLimit(ServerRequestInterface $request)
+    {
+        return $this->buildParameters($request)->getLimit($this->maxLimit) ?: $this->limit;
+    }
+
+    /**
+     * @param ServerRequestInterface $request
+     * @return array
+     */
+    protected function extractFilter(ServerRequestInterface $request)
+    {
+        return $this->buildParameters($request)->getFilter();
+    }
+
+    /**
+     * @param ServerRequestInterface $request
+     * @return Parameters
+     */
+    protected function buildParameters(ServerRequestInterface $request)
+    {
+        return new Parameters($request->getQueryParams());
+    }
+
+    /**
+     * @return Dispatcher
+     */
+    public static function getEventDispatcher()
+    {
+        return static::$events;
+    }
+
+    /**
+     * @param Dispatcher $events
+     */
+    public static function setEventDispatcher(Dispatcher $events)
+    {
+        static::$events = $events;
+    }
+
+    /**
+     * @return Container
+     */
+    public static function getContainer()
+    {
+        return static::$container;
+    }
+
+    /**
+     * @param Container $container
+     */
+    public static function setContainer(Container $container)
+    {
+        static::$container = $container;
+    }
+}

src/Api/Controller/CreateDiscussionController.php

@@ -0,0 +1,72 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\StartDiscussion;
+use Flarum\Core\Command\ReadDiscussion;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class CreateDiscussionController extends AbstractCreateController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\DiscussionSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = [
+        'posts',
+        'startUser',
+        'lastUser',
+        'startPost',
+        'lastPost'
+    ];
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $actor = $request->getAttribute('actor');
+
+        $discussion = $this->bus->dispatch(
+            new StartDiscussion($actor, array_get($request->getParsedBody(), 'data'))
+        );
+
+        // After creating the discussion, we assume that the user has seen all
+        // of the posts in the discussion; thus, we will mark the discussion
+        // as read if they are logged in.
+        if ($actor->exists) {
+            $this->bus->dispatch(
+                new ReadDiscussion($discussion->id, $actor, 1)
+            );
+        }
+
+        return $discussion;
+    }
+}

src/Api/Controller/CreateGroupController.php

@@ -0,0 +1,47 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\CreateGroup;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class CreateGroupController extends AbstractCreateController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\GroupSerializer';
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        return $this->bus->dispatch(
+            new CreateGroup($request->getAttribute('actor'), array_get($request->getParsedBody(), 'data'))
+        );
+    }
+}

src/Api/Controller/CreatePostController.php

@@ -0,0 +1,76 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\PostReply;
+use Flarum\Core\Command\ReadDiscussion;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class CreatePostController extends AbstractCreateController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\PostSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = [
+        'user',
+        'discussion',
+        'discussion.posts',
+        'discussion.lastUser'
+    ];
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $actor = $request->getAttribute('actor');
+        $data = array_get($request->getParsedBody(), 'data');
+        $discussionId = array_get($data, 'relationships.discussion.data.id');
+
+        $post = $this->bus->dispatch(
+            new PostReply($discussionId, $actor, $data)
+        );
+
+        // After replying, we assume that the user has seen all of the posts
+        // in the discussion; thus, we will mark the discussion as read if
+        // they are logged in.
+        if ($actor->exists) {
+            $this->bus->dispatch(
+                new ReadDiscussion($discussionId, $actor, $post->number)
+            );
+        }
+
+        $discussion = $post->discussion;
+        $discussion->posts = $discussion->postsVisibleTo($actor)->orderBy('time')->lists('id');
+
+        return $post;
+    }
+}

src/Api/Controller/CreateUserController.php

@@ -0,0 +1,47 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\RegisterUser;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class CreateUserController extends AbstractCreateController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\CurrentUserSerializer';
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        return $this->bus->dispatch(
+            new RegisterUser($request->getAttribute('actor'), array_get($request->getParsedBody(), 'data'))
+        );
+    }
+}

src/Api/Controller/DeleteAvatarController.php

@@ -0,0 +1,47 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\DeleteAvatar;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class DeleteAvatarController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\UserSerializer';
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        return $this->bus->dispatch(
+            new DeleteAvatar(array_get($request->getQueryParams(), 'id'), $request->getAttribute('actor'))
+        );
+    }
+}

src/Api/Controller/DeleteDiscussionController.php

@@ -0,0 +1,45 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\DeleteDiscussion;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+
+class DeleteDiscussionController extends AbstractDeleteController
+{
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function delete(ServerRequestInterface $request)
+    {
+        $id = array_get($request->getQueryParams(), 'id');
+        $actor = $request->getAttribute('actor');
+        $input = $request->getParsedBody();
+
+        $this->bus->dispatch(
+            new DeleteDiscussion($id, $actor, $input)
+        );
+    }
+}

src/Api/Controller/DeleteGroupController.php

@@ -0,0 +1,41 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\DeleteGroup;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+
+class DeleteGroupController extends AbstractDeleteController
+{
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function delete(ServerRequestInterface $request)
+    {
+        $this->bus->dispatch(
+            new DeleteGroup(array_get($request->getQueryParams(), 'id'), $request->getAttribute('actor'))
+        );
+    }
+}

src/Api/Controller/DeletePostController.php

@@ -0,0 +1,41 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\DeletePost;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+
+class DeletePostController extends AbstractDeleteController
+{
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function delete(ServerRequestInterface $request)
+    {
+        $this->bus->dispatch(
+            new DeletePost(array_get($request->getQueryParams(), 'id'), $request->getAttribute('actor'))
+        );
+    }
+}

src/Api/Controller/DeleteUserController.php

@@ -0,0 +1,41 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\DeleteUser;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+
+class DeleteUserController extends AbstractDeleteController
+{
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function delete(ServerRequestInterface $request)
+    {
+        $this->bus->dispatch(
+            new DeleteUser(array_get($request->getQueryParams(), 'id'), $request->getAttribute('actor'))
+        );
+    }
+}

src/Api/Controller/ForgotPasswordController.php

@@ -0,0 +1,55 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Repository\UserRepository;
+use Flarum\Core\Command\RequestPasswordReset;
+use Flarum\Http\Controller\ControllerInterface;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Zend\Diactoros\Response\EmptyResponse;
+
+class ForgotPasswordController implements ControllerInterface
+{
+    /**
+     * @var \Flarum\Core\Repository\UserRepository
+     */
+    protected $users;
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param \Flarum\Core\Repository\UserRepository $users
+     * @param Dispatcher $bus
+     */
+    public function __construct(UserRepository $users, Dispatcher $bus)
+    {
+        $this->users = $users;
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function handle(ServerRequestInterface $request)
+    {
+        $email = array_get($request->getParsedBody(), 'email');
+
+        $this->bus->dispatch(
+            new RequestPasswordReset($email)
+        );
+
+        return new EmptyResponse;
+    }
+}

src/Api/Controller/ListDiscussionsController.php

@@ -0,0 +1,97 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Search\SearchCriteria;
+use Flarum\Core\Search\Discussion\DiscussionSearcher;
+use Flarum\Api\UrlGenerator;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class ListDiscussionsController extends AbstractCollectionController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\DiscussionSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = [
+        'startUser',
+        'lastUser',
+        'relevantPosts',
+        'relevantPosts.discussion',
+        'relevantPosts.user'
+    ];
+
+    /**
+     * {@inheritdoc}
+     */
+    public $optionalInclude = [
+        'startPost',
+        'lastPost'
+    ];
+
+    /**
+     * {@inheritdoc}
+     */
+    public $sortFields = ['lastTime', 'commentsCount', 'startTime'];
+
+    /**
+     * @var DiscussionSearcher
+     */
+    protected $searcher;
+
+    /**
+     * @var UrlGenerator
+     */
+    protected $url;
+
+    /**
+     * @param DiscussionSearcher $searcher
+     * @param UrlGenerator $url
+     */
+    public function __construct(DiscussionSearcher $searcher, UrlGenerator $url)
+    {
+        $this->searcher = $searcher;
+        $this->url = $url;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $actor = $request->getAttribute('actor');
+        $query = array_get($this->extractFilter($request), 'q');
+        $sort = $this->extractSort($request);
+
+        $criteria = new SearchCriteria($actor, $query, $sort);
+
+        $limit = $this->extractLimit($request);
+        $offset = $this->extractOffset($request);
+        $load = array_merge($this->extractInclude($request), ['state']);
+
+        $results = $this->searcher->search($criteria, $limit, $offset, $load);
+
+        $document->addPaginationLinks(
+            $this->url->toRoute('discussions.index'),
+            $request->getQueryParams(),
+            $offset,
+            $limit,
+            $results->areMoreResults() ? null : 0
+        );
+
+        return $results->getResults();
+    }
+}

src/Api/Controller/ListGroupsController.php

@@ -0,0 +1,31 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Group;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class ListGroupsController extends AbstractCollectionController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\GroupSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        return Group::all();
+    }
+}

src/Api/Controller/ListNotificationsController.php

@@ -0,0 +1,71 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Repository\NotificationRepository;
+use Flarum\Core\Exception\PermissionDeniedException;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class ListNotificationsController extends AbstractCollectionController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\NotificationSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = [
+        'sender',
+        'subject',
+        'subject.discussion'
+    ];
+
+    /**
+     * {@inheritdoc}
+     */
+    public $limit = 10;
+
+    /**
+     * @var \Flarum\Core\Repository\NotificationRepository
+     */
+    protected $notifications;
+
+    /**
+     * @param \Flarum\Core\Repository\NotificationRepository $notifications
+     */
+    public function __construct(NotificationRepository $notifications)
+    {
+        $this->notifications = $notifications;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $actor = $request->getAttribute('actor');
+
+        if ($actor->isGuest()) {
+            throw new PermissionDeniedException;
+        }
+
+        $actor->markNotificationsAsRead()->save();
+
+        $limit = $this->extractLimit($request);
+        $offset = $this->extractOffset($request);
+        $include = $this->extractInclude($request);
+
+        return $this->notifications->findByUser($actor, $limit, $offset)->load($include);
+    }
+}

src/Api/Controller/ListPostsController.php

@@ -0,0 +1,113 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Repository\PostRepository;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+use Tobscure\JsonApi\Exception\InvalidParameterException;
+
+class ListPostsController extends AbstractCollectionController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\PostSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = [
+        'user',
+        'user.groups',
+        'editUser',
+        'hideUser',
+        'discussion'
+    ];
+
+    /**
+     * {@inheritdoc}
+     */
+    public $sortFields = ['time'];
+
+    /**
+     * @var \Flarum\Core\Repository\PostRepository
+     */
+    private $posts;
+
+    /**
+     * @param \Flarum\Core\Repository\PostRepository $posts
+     */
+    public function __construct(PostRepository $posts)
+    {
+        $this->posts = $posts;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $actor = $request->getAttribute('actor');
+        $filter = $this->extractFilter($request);
+        $include = $this->extractInclude($request);
+        $where = [];
+
+        if ($postIds = array_get($filter, 'id')) {
+            $posts = $this->posts->findByIds(explode(',', $postIds), $actor);
+        } else {
+            if ($discussionId = array_get($filter, 'discussion')) {
+                $where['discussion_id'] = $discussionId;
+            }
+            if ($number = array_get($filter, 'number')) {
+                $where['number'] = $number;
+            }
+            if ($userId = array_get($filter, 'user')) {
+                $where['user_id'] = $userId;
+            }
+            if ($type = array_get($filter, 'type')) {
+                $where['type'] = $type;
+            }
+
+            $posts = $this->getPosts($request, $where);
+        }
+
+        return $posts->load($include);
+    }
+
+    /**
+     * @param ServerRequestInterface $request
+     * @param array $where
+     * @return \Illuminate\Database\Eloquent\Collection
+     * @throws InvalidParameterException
+     */
+    private function getPosts(ServerRequestInterface $request, array $where)
+    {
+        $queryParams = $request->getQueryParams();
+        $actor = $request->getAttribute('actor');
+        $sort = $this->extractSort($request);
+        $limit = $this->extractLimit($request);
+
+        if (($near = array_get($queryParams, 'page.near')) > 1) {
+            if (count($where) > 1 || ! isset($where['discussion_id']) || $sort) {
+                throw new InvalidParameterException('You can only use page[near] with '
+                    . 'filter[discussion] and the default sort order');
+            }
+
+            $offset = $this->posts->getIndexForNumber($where['discussion_id'], $near, $actor);
+            $offset = max(0, $offset - $limit / 2);
+        } else {
+            $offset = $this->extractOffset($request);
+        }
+
+        return $this->posts->findWhere($where, $actor, $sort, $limit, $offset);
+    }
+}

src/Api/Controller/ListUsersController.php

@@ -0,0 +1,89 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Search\SearchCriteria;
+use Flarum\Core\Search\User\UserSearcher;
+use Flarum\Api\UrlGenerator;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class ListUsersController extends AbstractCollectionController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\UserSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = ['groups'];
+
+    /**
+     * {@inheritdoc}
+     */
+    public $sortFields = [
+        'username',
+        'postsCount',
+        'discussionsCount',
+        'lastSeenTime',
+        'joinTime'
+    ];
+
+    /**
+     * @var UserSearcher
+     */
+    protected $searcher;
+
+    /**
+     * @var UrlGenerator
+     */
+    protected $url;
+
+    /**
+     * @param UserSearcher $searcher
+     * @param UrlGenerator $url
+     */
+    public function __construct(UserSearcher $searcher, UrlGenerator $url)
+    {
+        $this->searcher = $searcher;
+        $this->url = $url;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $actor = $request->getAttribute('actor');
+        $query = array_get($this->extractFilter($request), 'q');
+        $sort = $this->extractSort($request);
+
+        $criteria = new SearchCriteria($actor, $query, $sort);
+
+        $limit = $this->extractLimit($request);
+        $offset = $this->extractOffset($request);
+        $load = $this->extractInclude($request);
+
+        $results = $this->searcher->search($criteria, $limit, $offset, $load);
+
+        $document->addPaginationLinks(
+            $this->url->toRoute('users.index'),
+            $request->getQueryParams(),
+            $offset,
+            $limit,
+            $results->areMoreResults() ? null : 0
+        );
+
+        return $results->getResults();
+    }
+}

src/Api/Controller/ReadAllNotificationsController.php

@@ -0,0 +1,41 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\ReadAllNotifications;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+
+class ReadAllNotificationsController extends AbstractDeleteController
+{
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function delete(ServerRequestInterface $request)
+    {
+        $this->bus->dispatch(
+            new ReadAllNotifications($request->getAttribute('actor'))
+        );
+    }
+}

src/Api/Controller/SetPermissionController.php

@@ -0,0 +1,45 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Access\AssertPermissionTrait;
+use Flarum\Core\Permission;
+use Flarum\Http\Controller\ControllerInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use Zend\Diactoros\Response\EmptyResponse;
+
+class SetPermissionController implements ControllerInterface
+{
+    use AssertPermissionTrait;
+
+    /**
+     * {@inheritdoc}
+     */
+    public function handle(ServerRequestInterface $request)
+    {
+        $this->assertAdmin($request->getAttribute('actor'));
+
+        $body = $request->getParsedBody();
+        $permission = array_get($body, 'permission');
+        $groupIds = array_get($body, 'groupIds');
+
+        Permission::where('permission', $permission)->delete();
+
+        Permission::insert(array_map(function ($groupId) use ($permission) {
+            return [
+                'permission' => $permission,
+                'group_id' => $groupId
+            ];
+        }, $groupIds));
+
+        return new EmptyResponse(204);
+    }
+}

src/Api/Controller/SetSettingsController.php

@@ -0,0 +1,64 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Access\AssertPermissionTrait;
+use Flarum\Http\Controller\ControllerInterface;
+use Flarum\Settings\SettingsRepository;
+use Flarum\Event\SettingWasSet;
+use Flarum\Event\PrepareSerializedSetting;
+use Illuminate\Contracts\Events\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Zend\Diactoros\Response\EmptyResponse;
+
+class SetSettingsController implements ControllerInterface
+{
+    use AssertPermissionTrait;
+
+    /**
+     * @var \Flarum\Settings\SettingsRepository
+     */
+    protected $settings;
+
+    /**
+     * @var Dispatcher
+     */
+    protected $dispatcher;
+
+    /**
+     * @param SettingsRepository $settings
+     */
+    public function __construct(SettingsRepository $settings, Dispatcher $dispatcher)
+    {
+        $this->settings = $settings;
+        $this->dispatcher = $dispatcher;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function handle(ServerRequestInterface $request)
+    {
+        $this->assertAdmin($request->getAttribute('actor'));
+
+        $settings = $request->getParsedBody();
+
+        foreach ($settings as $k => $v) {
+            $this->dispatcher->fire(new PrepareSerializedSetting($k, $v));
+
+            $this->settings->set($k, $v);
+
+            $this->dispatcher->fire(new SettingWasSet($k, $v));
+        }
+
+        return new EmptyResponse(204);
+    }
+}

src/Api/Controller/ShowDiscussionController.php

@@ -0,0 +1,168 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Discussion;
+use Flarum\Core\Repository\DiscussionRepository;
+use Flarum\Core\Repository\PostRepository;
+use Flarum\Core\User;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class ShowDiscussionController extends AbstractResourceController
+{
+    /**
+     * @var DiscussionRepository
+     */
+    protected $discussions;
+
+    /**
+     * @inheritdoc
+     */
+    public $serializer = 'Flarum\Api\Serializer\DiscussionSerializer';
+
+    /**
+     * @inheritdoc
+     */
+    public $include = [
+        'posts',
+        'posts.discussion',
+        'posts.user',
+        'posts.user.groups',
+        'posts.editUser',
+        'posts.hideUser'
+    ];
+
+    /**
+     * @inheritdoc
+     */
+    public $optionalInclude = [
+        'startUser',
+        'lastUser',
+        'startPost',
+        'lastPost'
+    ];
+
+    /**
+     * @param \Flarum\Core\Repository\DiscussionRepository $discussions
+     * @param \Flarum\Core\Repository\PostRepository $posts
+     */
+    public function __construct(DiscussionRepository $discussions, PostRepository $posts)
+    {
+        $this->discussions = $discussions;
+        $this->posts = $posts;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $discussionId = array_get($request->getQueryParams(), 'id');
+        $actor = $request->getAttribute('actor');
+        $include = $this->extractInclude($request);
+
+        $discussion = $this->discussions->findOrFail($discussionId, $actor);
+
+        if (in_array('posts', $include)) {
+            $postRelationships = $this->getPostRelationships($include);
+
+            $this->includePosts($discussion, $request, $postRelationships);
+        }
+
+        return $discussion;
+    }
+
+    /**
+     * @param Discussion $discussion
+     * @param ServerRequestInterface $request
+     * @param array $include
+     */
+    private function includePosts(Discussion $discussion, ServerRequestInterface $request, array $include)
+    {
+        $actor = $request->getAttribute('actor');
+        $limit = $this->extractLimit($request);
+        $offset = $this->getPostsOffset($request, $discussion, $limit);
+
+        $allPosts = $this->loadPostIds($discussion, $actor);
+        $loadedPosts = $this->loadPosts($discussion, $actor, $offset, $limit, $include);
+
+        array_splice($allPosts, $offset, $limit, $loadedPosts);
+
+        $discussion->setRelation('posts', $allPosts);
+    }
+
+    /**
+     * @param Discussion $discussion
+     * @param User $actor
+     * @return array
+     */
+    private function loadPostIds(Discussion $discussion, User $actor)
+    {
+        return $discussion->postsVisibleTo($actor)->orderBy('time')->lists('id')->all();
+    }
+
+    /**
+     * @param array $include
+     * @return array
+     */
+    private function getPostRelationships(array $include)
+    {
+        $prefixLength = strlen($prefix = 'posts.');
+        $relationships = [];
+
+        foreach ($include as $relationship) {
+            if (substr($relationship, 0, $prefixLength) === $prefix) {
+                $relationships[] = substr($relationship, $prefixLength);
+            }
+        }
+
+        return $relationships;
+    }
+
+    /**
+     * @param ServerRequestInterface $request
+     * @param Discussion$discussion
+     * @param int $limit
+     * @return int
+     */
+    private function getPostsOffset(ServerRequestInterface $request, Discussion $discussion, $limit)
+    {
+        $queryParams = $request->getQueryParams();
+        $actor = $request->getAttribute('actor');
+
+        if (($near = array_get($queryParams, 'page.near')) > 1) {
+            $offset = $this->posts->getIndexForNumber($discussion->id, $near, $actor);
+            $offset = max(0, $offset - $limit / 2);
+        } else {
+            $offset = $this->extractOffset($request);
+        }
+
+        return $offset;
+    }
+
+    /**
+     * @param Discussion $discussion
+     * @param User $actor
+     * @param int $offset
+     * @param int $limit
+     * @param array $include
+     * @return mixed
+     */
+    private function loadPosts($discussion, $actor, $offset, $limit, array $include)
+    {
+        $query = $discussion->postsVisibleTo($actor);
+
+        $query->orderBy('time')->skip($offset)->take($limit)->with($include);
+
+        return $query->get()->all();
+    }
+}

src/Api/Controller/ShowForumController.php

@@ -0,0 +1,38 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Group;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class ShowForumController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\ForumSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = ['groups'];
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        return [
+            'groups' => Group::whereVisibleTo($request->getAttribute('actor'))->get()
+        ];
+    }
+}

src/Api/Controller/ShowPostController.php

@@ -0,0 +1,55 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Repository\PostRepository;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class ShowPostController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\PostSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = [
+        'user',
+        'user.groups',
+        'editUser',
+        'hideUser',
+        'discussion'
+    ];
+
+    /**
+     * @var \Flarum\Core\Repository\PostRepository
+     */
+    protected $posts;
+
+    /**
+     * @param PostRepository $posts
+     */
+    public function __construct(PostRepository $posts)
+    {
+        $this->posts = $posts;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        return $this->posts->findOrFail(array_get($request->getQueryParams(), 'id'), $request->getAttribute('actor'));
+    }
+}

src/Api/Controller/ShowUserController.php

@@ -0,0 +1,61 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Repository\UserRepository;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class ShowUserController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\UserSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = ['groups'];
+
+    /**
+     * @var UserRepository
+     */
+    protected $users;
+
+    /**
+     * @param UserRepository $users
+     */
+    public function __construct(UserRepository $users)
+    {
+        $this->users = $users;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $id = array_get($request->getQueryParams(), 'id');
+
+        if (! is_numeric($id)) {
+            $id = $this->users->getIdForUsername($id);
+        }
+
+        $actor = $request->getAttribute('actor');
+
+        if ($actor->id == $id) {
+            $this->serializer = 'Flarum\Api\Serializer\CurrentUserSerializer';
+        }
+
+        return $this->users->findOrFail($id, $actor);
+    }
+}

src/Api/Controller/TokenController.php

@@ -0,0 +1,86 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Api\Command\GenerateAccessToken;
+use Flarum\Core\Repository\UserRepository;
+use Flarum\Core\Exception\PermissionDeniedException;
+use Flarum\Event\UserEmailChangeWasRequested;
+use Flarum\Http\Controller\ControllerInterface;
+use Illuminate\Contracts\Bus\Dispatcher as BusDispatcher;
+use Illuminate\Contracts\Events\Dispatcher as EventDispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Zend\Diactoros\Response\JsonResponse;
+
+class TokenController implements ControllerInterface
+{
+    /**
+     * @var UserRepository
+     */
+    protected $users;
+
+    /**
+     * @var BusDispatcher
+     */
+    protected $bus;
+
+    /**
+     * @var EventDispatcher
+     */
+    protected $events;
+
+    /**
+     * @param UserRepository $users
+     * @param BusDispatcher $bus
+     * @param EventDispatcher $events
+     */
+    public function __construct(UserRepository $users, BusDispatcher $bus, EventDispatcher $events)
+    {
+        $this->users = $users;
+        $this->bus = $bus;
+        $this->events = $events;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function handle(ServerRequestInterface $request)
+    {
+        $body = $request->getParsedBody();
+
+        $identification = array_get($body, 'identification');
+        $password = array_get($body, 'password');
+
+        $user = $this->users->findByIdentification($identification);
+
+        if (! $user || ! $user->checkPassword($password)) {
+            throw new PermissionDeniedException;
+        }
+
+        if (! $user->is_activated) {
+            $this->events->fire(new UserEmailChangeWasRequested($user, $user->email));
+
+            return new JsonResponse([
+                'code' => 'confirm_email',
+                'email' => $user->email
+            ], 401);
+        }
+
+        $token = $this->bus->dispatch(
+            new GenerateAccessToken($user->id)
+        );
+
+        return new JsonResponse([
+            'token' => $token->id,
+            'userId' => $user->id
+        ]);
+    }
+}

src/Api/Controller/UninstallExtensionController.php

@@ -0,0 +1,43 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Access\AssertPermissionTrait;
+use Flarum\Extension\ExtensionManager;
+use Psr\Http\Message\ServerRequestInterface;
+
+class UninstallExtensionController extends AbstractDeleteController
+{
+    use AssertPermissionTrait;
+
+    /**
+     * @var ExtensionManager
+     */
+    protected $extensions;
+
+    /**
+     * @param \Flarum\Extension\ExtensionManager $extensions
+     */
+    public function __construct(ExtensionManager $extensions)
+    {
+        $this->extensions = $extensions;
+    }
+
+    protected function delete(ServerRequestInterface $request)
+    {
+        $this->assertAdmin($request->getAttribute('actor'));
+
+        $name = array_get($request->getParsedBody(), 'name');
+
+        $this->extensions->disable($name);
+        $this->extensions->uninstall($name);
+    }
+}

src/Api/Controller/UpdateDiscussionController.php

@@ -0,0 +1,82 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\EditDiscussion;
+use Flarum\Core\Command\ReadDiscussion;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class UpdateDiscussionController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\DiscussionSerializer';
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $actor = $request->getAttribute('actor');
+        $discussionId = array_get($request->getQueryParams(), 'id');
+        $data = array_get($request->getParsedBody(), 'data', []);
+
+        $discussion = $this->bus->dispatch(
+            new EditDiscussion($discussionId, $actor, $data)
+        );
+
+        // TODO: Refactor the ReadDiscussion (state) command into EditDiscussion?
+        // That's what extensions will do anyway.
+        if ($readNumber = array_get($data, 'attributes.readNumber')) {
+            $state = $this->bus->dispatch(
+                new ReadDiscussion($discussionId, $actor, $readNumber)
+            );
+
+            $discussion = $state->discussion;
+        }
+
+        if ($posts = $discussion->getModifiedPosts()) {
+            $discussionPosts = $discussion->postsVisibleTo($actor)->orderBy('time')->lists('id')->all();
+
+            foreach ($discussionPosts as &$id) {
+                foreach ($posts as $post) {
+                    if ($id == $post->id) {
+                        $id = $post;
+                        $post->discussion = $post->discussion_id;
+                        $post->user = $post->user_id;
+                    }
+                }
+            }
+
+            $discussion->setRelation('posts', $discussionPosts);
+
+            $this->include = array_merge($this->include, ['posts', 'posts.discussion', 'posts.user']);
+        }
+
+        return $discussion;
+    }
+}

src/Api/Controller/UpdateExtensionController.php

@@ -0,0 +1,52 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Access\AssertPermissionTrait;
+use Flarum\Extension\ExtensionManager;
+use Flarum\Http\Controller\ControllerInterface;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+
+class UpdateExtensionController implements ControllerInterface
+{
+    use AssertPermissionTrait;
+
+    /**
+     * @var ExtensionManager
+     */
+    protected $extensions;
+
+    /**
+     * @param ExtensionManager $extensions
+     */
+    public function __construct(ExtensionManager $extensions)
+    {
+        $this->extensions = $extensions;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function handle(ServerRequestInterface $request)
+    {
+        $this->assertAdmin($request->getAttribute('actor'));
+
+        $enabled = array_get($request->getParsedBody(), 'enabled');
+        $name = array_get($request->getQueryParams(), 'name');
+
+        if ($enabled === true) {
+            $this->extensions->enable($name);
+        } elseif ($enabled === false) {
+            $this->extensions->disable($name);
+        }
+    }
+}

src/Api/Controller/UpdateGroupController.php

@@ -0,0 +1,51 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\EditGroup;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class UpdateGroupController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\GroupSerializer';
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $id = array_get($request->getQueryParams(), 'id');
+        $actor = $request->getAttribute('actor');
+        $data = array_get($request->getParsedBody(), 'data', []);
+
+        return $this->bus->dispatch(
+            new EditGroup($id, $actor, $data)
+        );
+    }
+}

src/Api/Controller/UpdateNotificationController.php

@@ -0,0 +1,50 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\ReadNotification;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class UpdateNotificationController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\NotificationSerializer';
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $id = array_get($request->getQueryParams(), 'id');
+        $actor = $request->getAttribute('actor');
+
+        return $this->bus->dispatch(
+            new ReadNotification($id, $actor)
+        );
+    }
+}

src/Api/Controller/UpdatePostController.php

@@ -0,0 +1,59 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\EditPost;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class UpdatePostController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\PostSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = [
+        'editUser',
+        'discussion'
+    ];
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $id = array_get($request->getQueryParams(), 'id');
+        $actor = $request->getAttribute('actor');
+        $data = array_get($request->getParsedBody(), 'data', []);
+
+        return $this->bus->dispatch(
+            new EditPost($id, $actor, $data)
+        );
+    }
+}

src/Api/Controller/UpdateUserController.php

@@ -0,0 +1,56 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\EditUser;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class UpdateUserController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\CurrentUserSerializer';
+
+    /**
+     * {@inheritdoc}
+     */
+    public $include = ['groups'];
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $id = array_get($request->getQueryParams(), 'id');
+        $actor = $request->getAttribute('actor');
+        $data = array_get($request->getParsedBody(), 'data', []);
+
+        return $this->bus->dispatch(
+            new EditUser($id, $actor, $data)
+        );
+    }
+}

src/Api/Controller/UploadAvatarController.php

@@ -0,0 +1,51 @@
+<?php
+/*
+ * This file is part of Flarum.
+ *
+ * (c) Toby Zerner <toby.zerner@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Flarum\Api\Controller;
+
+use Flarum\Core\Command\UploadAvatar;
+use Illuminate\Contracts\Bus\Dispatcher;
+use Psr\Http\Message\ServerRequestInterface;
+use Tobscure\JsonApi\Document;
+
+class UploadAvatarController extends AbstractResourceController
+{
+    /**
+     * {@inheritdoc}
+     */
+    public $serializer = 'Flarum\Api\Serializer\UserSerializer';
+
+    /**
+     * @var Dispatcher
+     */
+    protected $bus;
+
+    /**
+     * @param Dispatcher $bus
+     */
+    public function __construct(Dispatcher $bus)
+    {
+        $this->bus = $bus;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function data(ServerRequestInterface $request, Document $document)
+    {
+        $id = array_get($request->getQueryParams(), 'id');
+        $actor = $request->getAttribute('actor');
+        $file = array_get($request->getUploadedFiles(), 'avatar');
+
+        return $this->bus->dispatch(
+            new UploadAvatar($id, $file, $actor)
+        );
+    }
+}