Merge pull request #11301 from misskey-dev/develop

Release: 13.14.0

28 files changed, 897 insertions, 381 deletions

diff --git a/packages/backend/test/e2e/2fa.ts b/packages/backend/test/e2e/2fa.ts
index 5da997f28b..04be97ad9d 100644
--- a/packages/backend/test/e2e/2fa.ts
+++ b/packages/backend/test/e2e/2fa.ts
@@ -7,10 +7,11 @@ import * as OTPAuth from 'otpauth';
 import { loadConfig } from '../../src/config.js';
 import { signup, api, post, react, startServer, waitFire } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('2要素認証', () => {
 	let app: INestApplicationContext;
-	let alice: unknown;
+	let alice: misskey.entities.MeSignup;
 
 	const config = loadConfig();
 	const password = 'test';
@@ -68,7 +69,7 @@ describe('2要素認証', () => {
 		]));
 
 		// AuthenticatorAssertionResponse.authenticatorData
-		// https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAssertionResponse/authenticatorData 
+		// https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAssertionResponse/authenticatorData
 		const credentialIdLength = Buffer.allocUnsafe(2);
 		credentialIdLength.writeUInt16BE(param.credentialId.length);
 		const authData = Buffer.concat([
@@ -80,7 +81,7 @@ describe('2要素認証', () => {
 			param.credentialId,
 			credentialPublicKey,
 		]);
-		
+
 		return {
 			attestationObject: cbor.encode({
 				fmt: 'none',
@@ -98,7 +99,7 @@ describe('2要素認証', () => {
 			name: param.keyName,
 		};
 	};
-	
+
 	const signinParam = (): {
 		username: string,
 		password: string,
@@ -130,7 +131,7 @@ describe('2要素認証', () => {
 		'hcaptcha-response'?: string | null,
 	} => {
 		// AuthenticatorAssertionResponse.authenticatorData
-		// https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAssertionResponse/authenticatorData 
+		// https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAssertionResponse/authenticatorData
 		const authenticatorData = Buffer.concat([
 			rpIdHash(),
 			Buffer.from([0x05]), // flags(1)
@@ -146,7 +147,7 @@ describe('2要素認証', () => {
 			.update(clientDataJSONBuffer)
 			.digest();
 		const privateKey = crypto.createPrivateKey(pemToSign);
-		const signature = crypto.createSign('SHA256') 
+		const signature = crypto.createSign('SHA256')
 			.update(Buffer.concat([authenticatorData, hashedclientDataJSON]))
 			.sign(privateKey);
 		return {
@@ -186,14 +187,14 @@ describe('2要素認証', () => {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
 		assert.strictEqual(doneResponse.status, 204);
-		
+
 		const usersShowResponse = await api('/users/show', {
 			username,
 		}, alice);
 		assert.strictEqual(usersShowResponse.status, 200);
 		assert.strictEqual(usersShowResponse.body.twoFactorEnabled, true);
-		
-		const signinResponse = await api('/signin', { 
+
+		const signinResponse = await api('/signin', {
 			...signinParam(),
 			token: otpToken(registerResponse.body.secret),
 		});
@@ -211,7 +212,7 @@ describe('2要素認証', () => {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
 		assert.strictEqual(doneResponse.status, 204);
-		
+
 		const registerKeyResponse = await api('/i/2fa/register-key', {
 			password,
 		}, alice);
@@ -230,7 +231,7 @@ describe('2要素認証', () => {
 		assert.strictEqual(keyDoneResponse.status, 200);
 		assert.strictEqual(keyDoneResponse.body.id, credentialId.toString('hex'));
 		assert.strictEqual(keyDoneResponse.body.name, keyName);
-		
+
 		const usersShowResponse = await api('/users/show', {
 			username,
 		});
@@ -267,7 +268,7 @@ describe('2要素認証', () => {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
 		assert.strictEqual(doneResponse.status, 204);
-		
+
 		const registerKeyResponse = await api('/i/2fa/register-key', {
 			password,
 		}, alice);
@@ -282,7 +283,7 @@ describe('2要素認証', () => {
 			credentialId,
 		}), alice);
 		assert.strictEqual(keyDoneResponse.status, 200);
-		
+
 		const passwordLessResponse = await api('/i/2fa/password-less', {
 			value: true,
 		}, alice);
@@ -301,7 +302,7 @@ describe('2要素認証', () => {
 		assert.strictEqual(signinResponse.status, 200);
 		assert.strictEqual(signinResponse.body.i, undefined);
 
-		const signinResponse2 = await api('/signin', { 
+		const signinResponse2 = await api('/signin', {
 			...signinWithSecurityKeyParam({
 				keyName,
 				challengeId: signinResponse.body.challengeId,
@@ -324,7 +325,7 @@ describe('2要素認証', () => {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
 		assert.strictEqual(doneResponse.status, 204);
-		
+
 		const registerKeyResponse = await api('/i/2fa/register-key', {
 			password,
 		}, alice);
@@ -339,14 +340,14 @@ describe('2要素認証', () => {
 			credentialId,
 		}), alice);
 		assert.strictEqual(keyDoneResponse.status, 200);
-		
+
 		const renamedKey = 'other-key';
 		const updateKeyResponse = await api('/i/2fa/update-key', {
 			name: renamedKey,
 			credentialId: credentialId.toString('hex'),
 		}, alice);
 		assert.strictEqual(updateKeyResponse.status, 200);
-				
+
 		const iResponse = await api('/i', {
 		}, alice);
 		assert.strictEqual(iResponse.status, 200);
@@ -366,7 +367,7 @@ describe('2要素認証', () => {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
 		assert.strictEqual(doneResponse.status, 204);
-		
+
 		const registerKeyResponse = await api('/i/2fa/register-key', {
 			password,
 		}, alice);
@@ -381,7 +382,7 @@ describe('2要素認証', () => {
 			credentialId,
 		}), alice);
 		assert.strictEqual(keyDoneResponse.status, 200);
-		
+
 		// テストの実行順によっては複数残ってるので全部消す
 		const iResponse = await api('/i', {
 		}, alice);
@@ -400,14 +401,14 @@ describe('2要素認証', () => {
 		assert.strictEqual(usersShowResponse.status, 200);
 		assert.strictEqual(usersShowResponse.body.securityKeys, false);
 
-		const signinResponse = await api('/signin', { 
+		const signinResponse = await api('/signin', {
 			...signinParam(),
 			token: otpToken(registerResponse.body.secret),
 		});
 		assert.strictEqual(signinResponse.status, 200);
 		assert.notEqual(signinResponse.body.i, undefined);
 	});
-	
+
 	test('が設定でき、設定解除できる。（パスワードのみでログインできる。）', async () => {
 		const registerResponse = await api('/i/2fa/register', {
 			password,
@@ -418,7 +419,7 @@ describe('2要素認証', () => {
 			token: otpToken(registerResponse.body.secret),
 		}, alice);
 		assert.strictEqual(doneResponse.status, 204);
-		
+
 		const usersShowResponse = await api('/users/show', {
 			username,
 		});
diff --git a/packages/backend/test/e2e/antennas.ts b/packages/backend/test/e2e/antennas.ts
index dd3b09f85a..cb526669f5 100644
--- a/packages/backend/test/e2e/antennas.ts
+++ b/packages/backend/test/e2e/antennas.ts
@@ -32,7 +32,7 @@ describe('アンテナ', () => {
 	// - srcのenumにgroupが残っている
 	// - userGroupIdが残っている, isActiveがない
 	type Antenna = misskey.entities.Antenna | Packed<'Antenna'>;
-	type User = misskey.entities.MeDetailed & { token: string };
+	type User = misskey.entities.MeSignup;
 	type Note = misskey.entities.Note;
 
 	// アンテナを作成できる最小のパラメタ
diff --git a/packages/backend/test/e2e/api-visibility.ts b/packages/backend/test/e2e/api-visibility.ts
index 3af0d35182..f781559d50 100644
--- a/packages/backend/test/e2e/api-visibility.ts
+++ b/packages/backend/test/e2e/api-visibility.ts
@@ -3,6 +3,7 @@ process.env.NODE_ENV = 'test';
 import * as assert from 'assert';
 import { signup, api, post, startServer } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('API visibility', () => {
 	let app: INestApplicationContext;
@@ -18,15 +19,15 @@ describe('API visibility', () => {
 	describe('Note visibility', () => {
 		//#region vars
 		/** ヒロイン */
-		let alice: any;
+		let alice: misskey.entities.MeSignup;
 		/** フォロワー */
-		let follower: any;
+		let follower: misskey.entities.MeSignup;
 		/** 非フォロワー */
-		let other: any;
+		let other: misskey.entities.MeSignup;
 		/** 非フォロワーでもリプライやメンションをされた人 */
-		let target: any;
+		let target: misskey.entities.MeSignup;
 		/** specified mentionでmentionを飛ばされる人 */
-		let target2: any;
+		let target2: misskey.entities.MeSignup;
 
 		/** public-post */
 		let pub: any;
diff --git a/packages/backend/test/e2e/api.ts b/packages/backend/test/e2e/api.ts
index a46f336a70..c6beec4f88 100644
--- a/packages/backend/test/e2e/api.ts
+++ b/packages/backend/test/e2e/api.ts
@@ -1,14 +1,16 @@
 process.env.NODE_ENV = 'test';
 
 import * as assert from 'assert';
-import { signup, api, startServer } from '../utils.js';
+import { signup, api, startServer, successfulApiCall, failedApiCall, uploadFile, waitFire, connectStream } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
+import { IncomingMessage } from 'http';
 
 describe('API', () => {
 	let app: INestApplicationContext;
-	let alice: any;
-	let bob: any;
-	let carol: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
+	let carol: misskey.entities.MeSignup;
 
 	beforeAll(async () => {
 		app = await startServer();
@@ -80,4 +82,142 @@ describe('API', () => {
 			assert.strictEqual(res.body.nullableDefault, 'hello');
 		});
 	});
+
+	test('管理者専用のAPIのアクセス制限', async () => {
+		// aliceは管理者、APIを使える
+		await successfulApiCall({
+			endpoint: '/admin/get-index-stats',
+			parameters: {},
+			user: alice,
+		});
+
+		// bobは一般ユーザーだからダメ
+		await failedApiCall({
+			endpoint: '/admin/get-index-stats',
+			parameters: {},
+			user: bob,
+		}, {
+			status: 403,
+			code: 'ROLE_PERMISSION_DENIED',
+			id: 'c3d38592-54c0-429d-be96-5636b0431a61',
+		});
+
+		// publicアクセスももちろんダメ
+		await failedApiCall({
+			endpoint: '/admin/get-index-stats',
+			parameters: {},
+			user: undefined,
+		}, {
+			status: 401,
+			code: 'CREDENTIAL_REQUIRED',
+			id: '1384574d-a912-4b81-8601-c7b1c4085df1',
+		});
+
+		// ごまがしもダメ
+		await failedApiCall({
+			endpoint: '/admin/get-index-stats',
+			parameters: {},
+			user: { token: 'tsukawasete' },
+		}, {
+			status: 401,
+			code: 'AUTHENTICATION_FAILED',
+			id: 'b0a7f5f8-dc2f-4171-b91f-de88ad238e14',
+		});
+	});
+
+	describe('Authentication header', () => {
+		test('一般リクエスト', async () => {
+			await successfulApiCall({
+				endpoint: '/admin/get-index-stats',
+				parameters: {},
+				user: {
+					token: alice.token,
+					bearer: true,
+				},
+			});
+		});
+
+		test('multipartリクエスト', async () => {
+			const result = await uploadFile({
+				token: alice.token,
+				bearer: true,
+			});
+			assert.strictEqual(result.status, 200);
+		});
+
+		test('streaming', async () => {
+			const fired = await waitFire(
+				{
+					token: alice.token,
+					bearer: true,
+				},
+				'homeTimeline',
+				() => api('notes/create', { text: 'foo' }, alice),
+				msg => msg.type === 'note' && msg.body.text === 'foo',
+			);
+			assert.strictEqual(fired, true);
+		});
+	});
+
+	describe('tokenエラー応答でWWW-Authenticate headerを送る', () => {
+		describe('invalid_token', () => {
+			test('一般リクエスト', async () => {
+				const result = await api('/admin/get-index-stats', {}, {
+					token: 'syuilo',
+					bearer: true,
+				});
+				assert.strictEqual(result.status, 401);
+				assert.ok(result.headers.get('WWW-Authenticate')?.startsWith('Bearer realm="Misskey", error="invalid_token", error_description'));
+			});
+
+			test('multipartリクエスト', async () => {
+				const result = await uploadFile({
+					token: 'syuilo',
+					bearer: true,
+				});
+				assert.strictEqual(result.status, 401);
+				assert.ok(result.headers.get('WWW-Authenticate')?.startsWith('Bearer realm="Misskey", error="invalid_token", error_description'));
+			});
+
+			test('streaming', async () => {
+				await assert.rejects(connectStream(
+					{
+						token: 'syuilo',
+						bearer: true,
+					},
+					'homeTimeline',
+					() => { },
+				), (err: IncomingMessage) => {
+					assert.strictEqual(err.statusCode, 401);
+					assert.ok(err.headers['www-authenticate']?.startsWith('Bearer realm="Misskey", error="invalid_token", error_description'));
+					return true;
+				});
+			});
+		});
+
+		describe('tokenがないとrealmだけおくる', () => {
+			test('一般リクエスト', async () => {
+				const result = await api('/admin/get-index-stats', {});
+				assert.strictEqual(result.status, 401);
+				assert.strictEqual(result.headers.get('WWW-Authenticate'), 'Bearer realm="Misskey"');
+			});
+
+			test('multipartリクエスト', async () => {
+				const result = await uploadFile();
+				assert.strictEqual(result.status, 401);
+				assert.strictEqual(result.headers.get('WWW-Authenticate'), 'Bearer realm="Misskey"');
+			});
+		});
+
+		test('invalid_request', async () => {
+			const result = await api('/notes/create', { text: true }, {
+				token: alice.token,
+				bearer: true,
+			});
+			assert.strictEqual(result.status, 400);
+			assert.ok(result.headers.get('WWW-Authenticate')?.startsWith('Bearer realm="Misskey", error="invalid_request", error_description'));
+		});
+
+		// TODO: insufficient_scope test (authテストが全然なくて書けない)
+	});
 });
diff --git a/packages/backend/test/e2e/block.ts b/packages/backend/test/e2e/block.ts
index 57a46ab38a..8357884092 100644
--- a/packages/backend/test/e2e/block.ts
+++ b/packages/backend/test/e2e/block.ts
@@ -3,14 +3,15 @@ process.env.NODE_ENV = 'test';
 import * as assert from 'assert';
 import { signup, api, post, startServer } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('Block', () => {
 	let app: INestApplicationContext;
 
 	// alice blocks bob
-	let alice: any;
-	let bob: any;
-	let carol: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
+	let carol: misskey.entities.MeSignup;
 
 	beforeAll(async () => {
 		app = await startServer();
diff --git a/packages/backend/test/e2e/clips.ts b/packages/backend/test/e2e/clips.ts
index f35aae9dc6..175f2cac97 100644
--- a/packages/backend/test/e2e/clips.ts
+++ b/packages/backend/test/e2e/clips.ts
@@ -13,12 +13,12 @@ import { paramDef as UnfavoriteParamDef } from '@/server/api/endpoints/clips/unf
 import { paramDef as AddNoteParamDef } from '@/server/api/endpoints/clips/add-note.js';
 import { paramDef as RemoveNoteParamDef } from '@/server/api/endpoints/clips/remove-note.js';
 import { paramDef as NotesParamDef } from '@/server/api/endpoints/clips/notes.js';
-import { 
-	signup, 
-	post, 
-	startServer, 
+import {
+	signup,
+	post,
+	startServer,
 	api,
-	successfulApiCall, 
+	successfulApiCall,
 	failedApiCall,
 	ApiRequest,
 	hiddenNote,
@@ -82,14 +82,14 @@ describe('クリップ', () => {
 	const update = async (parameters: Partial<UpdateParam>, request: Partial<ApiRequest> = {}): Promise<Clip> => {
 		const clip = await successfulApiCall<Clip>({
 			endpoint: '/clips/update',
-			parameters: { 
+			parameters: {
 				name: 'updated',
 				...parameters,
 			},
 			user: alice,
 			...request,
 		});
-		
+
 		// 入力が結果として入っていること。clipIdはidになるので消しておく
 		delete (parameters as { clipId?: string }).clipId;
 		assert.deepStrictEqual(clip, {
@@ -98,7 +98,7 @@ describe('クリップ', () => {
 		});
 		return clip;
 	};
-	
+
 	type DeleteParam = JTDDataType<typeof DeleteParamDef>;
 	const deleteClip = async (parameters: DeleteParam, request: Partial<ApiRequest> = {}): Promise<void> => {
 		return await successfulApiCall<void>({
@@ -129,7 +129,7 @@ describe('クリップ', () => {
 			...request,
 		});
 	};
-	
+
 	const usersClips = async (request: Partial<ApiRequest>): Promise<Clip[]> => {
 		return await successfulApiCall<Clip[]>({
 			endpoint: '/users/clips',
@@ -145,14 +145,14 @@ describe('クリップ', () => {
 		bob = await signup({ username: 'bob' });
 
 		// FIXME: misskey-jsのNoteはoutdatedなので直接変換できない
-		aliceNote = await post(alice, { text: 'test' }) as any; 
-		aliceHomeNote = await post(alice, { text: 'home only', visibility: 'home' }) as any; 
-		aliceFollowersNote = await post(alice, { text: 'followers only', visibility: 'followers' }) as any; 
-		aliceSpecifiedNote = await post(alice, { text: 'specified only', visibility: 'specified' }) as any; 
-		bobNote = await post(bob, { text: 'test' }) as any; 
-		bobHomeNote = await post(bob, { text: 'home only', visibility: 'home' }) as any; 
-		bobFollowersNote = await post(bob, { text: 'followers only', visibility: 'followers' }) as any; 
-		bobSpecifiedNote = await post(bob, { text: 'specified only', visibility: 'specified' }) as any; 
+		aliceNote = await post(alice, { text: 'test' }) as any;
+		aliceHomeNote = await post(alice, { text: 'home only', visibility: 'home' }) as any;
+		aliceFollowersNote = await post(alice, { text: 'followers only', visibility: 'followers' }) as any;
+		aliceSpecifiedNote = await post(alice, { text: 'specified only', visibility: 'specified' }) as any;
+		bobNote = await post(bob, { text: 'test' }) as any;
+		bobHomeNote = await post(bob, { text: 'home only', visibility: 'home' }) as any;
+		bobFollowersNote = await post(bob, { text: 'followers only', visibility: 'followers' }) as any;
+		bobSpecifiedNote = await post(bob, { text: 'specified only', visibility: 'specified' }) as any;
 	}, 1000 * 60 * 2);
 
 	afterAll(async () => {
@@ -172,7 +172,7 @@ describe('クリップ', () => {
 	test('の作成ができる', async () => {
 		const res = await create();
 		// ISO 8601で日付が返ってくること
-		assert.strictEqual(res.createdAt, new Date(res.createdAt).toISOString());	
+		assert.strictEqual(res.createdAt, new Date(res.createdAt).toISOString());
 		assert.strictEqual(res.lastClippedAt, null);
 		assert.strictEqual(res.name, 'test');
 		assert.strictEqual(res.description, null);
@@ -217,7 +217,7 @@ describe('クリップ', () => {
 	];
 	test.each(createClipDenyPattern)('の作成は$labelならできない', async ({ parameters }) => failedApiCall({
 		endpoint: '/clips/create',
-		parameters: { 
+		parameters: {
 			...defaultCreate(),
 			...parameters,
 		},
@@ -229,7 +229,7 @@ describe('クリップ', () => {
 	}));
 
 	test('の更新ができる', async () => {
-		const res = await update({ 
+		const res = await update({
 			clipId: (await create()).id,
 			name: 'updated',
 			description: 'new description',
@@ -237,7 +237,7 @@ describe('クリップ', () => {
 		});
 
 		// ISO 8601で日付が返ってくること
-		assert.strictEqual(res.createdAt, new Date(res.createdAt).toISOString());	
+		assert.strictEqual(res.createdAt, new Date(res.createdAt).toISOString());
 		assert.strictEqual(res.lastClippedAt, null);
 		assert.strictEqual(res.name, 'updated');
 		assert.strictEqual(res.description, 'new description');
@@ -251,7 +251,7 @@ describe('クリップ', () => {
 		name: 'updated',
 		...parameters,
 	}));
-	
+
 	test.each([
 		{ label: 'clipIdがnull', parameters: { clipId: null } },
 		{ label: '存在しないクリップ', parameters: { clipId: 'xxxxxx' }, assertion: {
@@ -265,7 +265,7 @@ describe('クリップ', () => {
 		...createClipDenyPattern as any,
 	])('の更新は$labelならできない', async ({ parameters, user, assertion }) => failedApiCall({
 		endpoint: '/clips/update',
-		parameters: { 
+		parameters: {
 			clipId: (await create({}, { user: (user ?? ((): User => alice))() })).id,
 			name: 'updated',
 			...parameters,
@@ -279,7 +279,7 @@ describe('クリップ', () => {
 	}));
 
 	test('の削除ができる', async () => {
-		await deleteClip({ 
+		await deleteClip({
 			clipId: (await create()).id,
 		});
 		assert.deepStrictEqual(await list({}), []);
@@ -297,7 +297,7 @@ describe('クリップ', () => {
 		} },
 	])('の削除は$labelならできない', async ({ parameters, user, assertion }) => failedApiCall({
 		endpoint: '/clips/delete',
-		parameters: { 
+		parameters: {
 			clipId: (await create({}, { user: (user ?? ((): User => alice))() })).id,
 			...parameters,
 		},
@@ -329,14 +329,14 @@ describe('クリップ', () => {
 	});
 
 	test.each([
-		{ label: 'clipId未指定', parameters: { clipId: undefined } }, 
-		{ label: '存在しないクリップ', parameters: { clipId: 'xxxxxx' }, assetion: { 
+		{ label: 'clipId未指定', parameters: { clipId: undefined } },
+		{ label: '存在しないクリップ', parameters: { clipId: 'xxxxxx' }, assetion: {
 			code: 'NO_SUCH_CLIP',
 			id: 'c3c5fe33-d62c-44d2-9ea5-d997703f5c20',
 		} },
 	])('のID指定取得は$labelならできない', async ({ parameters, assetion }) => failedApiCall({
 		endpoint: '/clips/show',
-		parameters: { 
+		parameters: {
 			...parameters,
 		},
 		user: alice,
@@ -361,14 +361,14 @@ describe('クリップ', () => {
 
 		// 返ってくる配列には順序保障がないのでidでソートして厳密比較
 		assert.deepStrictEqual(
-			res.sort(compareBy(s => s.id)), 
+			res.sort(compareBy(s => s.id)),
 			clips.sort(compareBy(s => s.id)),
 		);
 	});
 
 	test('の一覧が取得できる(空)', async () => {
 		const res = await usersClips({
-			parameters: { 
+			parameters: {
 				userId: alice.id,
 			},
 		});
@@ -381,14 +381,14 @@ describe('クリップ', () => {
 	])('の一覧が$label取得できる', async () => {
 		const clips = await createMany({ isPublic: true });
 		const res = await usersClips({
-			parameters: { 
+			parameters: {
 				userId: alice.id,
 			},
 		});
 
 		// 返ってくる配列には順序保障がないのでidでソートして厳密比較
 		assert.deepStrictEqual(
-			res.sort(compareBy<Clip>(s => s.id)), 
+			res.sort(compareBy<Clip>(s => s.id)),
 			clips.sort(compareBy(s => s.id)));
 
 		// 認証状態で見たときだけisFavoritedが入っている
@@ -421,7 +421,7 @@ describe('クリップ', () => {
 		await create({ isPublic: false });
 		const aliceClip = await create({ isPublic: true });
 		const res = await usersClips({
-			parameters: { 
+			parameters: {
 				userId: alice.id,
 				limit: 2,
 			},
@@ -433,7 +433,7 @@ describe('クリップ', () => {
 		const clips = await createMany({ isPublic: true }, 7);
 		clips.sort(compareBy(s => s.id));
 		const res = await usersClips({
-			parameters: { 
+			parameters: {
 				userId: alice.id,
 				sinceId: clips[1].id,
 				untilId: clips[5].id,
@@ -443,7 +443,7 @@ describe('クリップ', () => {
 
 		// Promise.allで返ってくる配列には順序保障がないのでidでソートして厳密比較
 		assert.deepStrictEqual(
-			res.sort(compareBy<Clip>(s => s.id)), 
+			res.sort(compareBy<Clip>(s => s.id)),
 			[clips[2], clips[3], clips[4]], // sinceIdとuntilId自体は結果に含まれない
 			clips[1].id + ' ... ' + clips[3].id + ' with ' + clips.map(s => s.id) + ' vs. ' + res.map(s => s.id));
 	});
@@ -454,7 +454,7 @@ describe('クリップ', () => {
 		{ label: 'limit最大+1', parameters: { limit: 101 } },
 	])('の一覧は$labelだと取得できない', async ({ parameters }) => failedApiCall({
 		endpoint: '/users/clips',
-		parameters: { 
+		parameters: {
 			userId: alice.id,
 			...parameters,
 		},
@@ -520,7 +520,7 @@ describe('クリップ', () => {
 				...request,
 			});
 		};
-	
+
 		beforeEach(async () => {
 			aliceClip = await create();
 		});
@@ -544,7 +544,7 @@ describe('クリップ', () => {
 			assert.strictEqual(clip2.favoritedCount, 1);
 			assert.strictEqual(clip2.isFavorited, false);
 		});
-		
+
 		test('は1つのクリップに対して複数人が設定できる。', async () => {
 			const publicClip = await create({ isPublic: true });
 			await favorite({ clipId: publicClip.id }, { user: bob });
@@ -552,7 +552,7 @@ describe('クリップ', () => {
 			const clip = await show({ clipId: publicClip.id }, { user: bob });
 			assert.strictEqual(clip.favoritedCount, 2);
 			assert.strictEqual(clip.isFavorited, true);
-			
+
 			const clip2 = await show({ clipId: publicClip.id });
 			assert.strictEqual(clip2.favoritedCount, 2);
 			assert.strictEqual(clip2.isFavorited, true);
@@ -581,7 +581,7 @@ describe('クリップ', () => {
 			await favorite({ clipId: aliceClip.id });
 			await failedApiCall({
 				endpoint: '/clips/favorite',
-				parameters: { 
+				parameters: {
 					clipId: aliceClip.id,
 				},
 				user: alice,
@@ -604,7 +604,7 @@ describe('クリップ', () => {
 			} },
 		])('の設定は$labelならできない', async ({ parameters, user, assertion }) => failedApiCall({
 			endpoint: '/clips/favorite',
-			parameters: { 
+			parameters: {
 				clipId: (await create({}, { user: (user ?? ((): User => alice))() })).id,
 				...parameters,
 			},
@@ -615,7 +615,7 @@ describe('クリップ', () => {
 			id: '3d81ceae-475f-4600-b2a8-2bc116157532',
 			...assertion,
 		}));
-		
+
 		test('を設定解除できる。', async () => {
 			await favorite({ clipId: aliceClip.id });
 			await unfavorite({ clipId: aliceClip.id });
@@ -641,7 +641,7 @@ describe('クリップ', () => {
 			} },
 		])('の設定解除は$labelならできない', async ({ parameters, user, assertion }) => failedApiCall({
 			endpoint: '/clips/unfavorite',
-			parameters: { 
+			parameters: {
 				clipId: (await create({}, { user: (user ?? ((): User => alice))() })).id,
 				...parameters,
 			},
@@ -652,7 +652,7 @@ describe('クリップ', () => {
 			id: '3d81ceae-475f-4600-b2a8-2bc116157532',
 			...assertion,
 		}));
-		
+
 		test('を取得できる。', async () => {
 			await favorite({ clipId: aliceClip.id });
 			const favorited = await myFavorites();
@@ -717,7 +717,7 @@ describe('クリップ', () => {
 			const res = await show({ clipId: aliceClip.id });
 			assert.strictEqual(res.lastClippedAt, new Date(res.lastClippedAt ?? '').toISOString());
 			assert.deepStrictEqual(await notes({ clipId: aliceClip.id }), [aliceNote]);
-			
+
 			// 他人の非公開ノートも突っ込める
 			await addNote({ clipId: aliceClip.id, noteId: bobHomeNote.id });
 			await addNote({ clipId: aliceClip.id, noteId: bobFollowersNote.id });
@@ -728,7 +728,7 @@ describe('クリップ', () => {
 			await addNote({ clipId: aliceClip.id, noteId: aliceNote.id });
 			await failedApiCall({
 				endpoint: '/clips/add-note',
-				parameters: { 
+				parameters: {
 					clipId: aliceClip.id,
 					noteId: aliceNote.id,
 				},
@@ -747,10 +747,10 @@ describe('クリップ', () => {
 				text: `test ${i}`,
 			}) as unknown)) as Note[];
 			await Promise.all(noteList.map(s => addNote({ clipId: aliceClip.id, noteId: s.id })));
-			
+
 			await failedApiCall({
 				endpoint: '/clips/add-note',
-				parameters: { 
+				parameters: {
 					clipId: aliceClip.id,
 					noteId: aliceNote.id,
 				},
@@ -764,7 +764,7 @@ describe('クリップ', () => {
 
 		test('は他人のクリップへ追加できない。', async () => await failedApiCall({
 			endpoint: '/clips/add-note',
-			parameters: { 
+			parameters: {
 				clipId: aliceClip.id,
 				noteId: aliceNote.id,
 			},
@@ -776,9 +776,9 @@ describe('クリップ', () => {
 		}));
 
 		test.each([
-			{ label: 'clipId未指定', parameters: { clipId: undefined } }, 
-			{ label: 'noteId未指定', parameters: { noteId: undefined } }, 
-			{ label: '存在しないクリップ', parameters: { clipId: 'xxxxxx' }, assetion: { 
+			{ label: 'clipId未指定', parameters: { clipId: undefined } },
+			{ label: 'noteId未指定', parameters: { noteId: undefined } },
+			{ label: '存在しないクリップ', parameters: { clipId: 'xxxxxx' }, assetion: {
 				code: 'NO_SUCH_CLIP',
 				id: 'd6e76cc0-a1b5-4c7c-a287-73fa9c716dcf',
 			} },
@@ -792,7 +792,7 @@ describe('クリップ', () => {
 			} },
 		])('の追加は$labelだとできない', async ({ parameters, user, assetion }) => failedApiCall({
 			endpoint: '/clips/add-note',
-			parameters: { 
+			parameters: {
 				clipId: aliceClip.id,
 				noteId: aliceNote.id,
 				...parameters,
@@ -810,11 +810,11 @@ describe('クリップ', () => {
 			await removeNote({ clipId: aliceClip.id, noteId: aliceNote.id });
 			assert.deepStrictEqual(await notes({ clipId: aliceClip.id }), []);
 		});
-		
+
 		test.each([
-			{ label: 'clipId未指定', parameters: { clipId: undefined } }, 
-			{ label: 'noteId未指定', parameters: { noteId: undefined } }, 
-			{ label: '存在しないクリップ', parameters: { clipId: 'xxxxxx' }, assetion: { 
+			{ label: 'clipId未指定', parameters: { clipId: undefined } },
+			{ label: 'noteId未指定', parameters: { noteId: undefined } },
+			{ label: '存在しないクリップ', parameters: { clipId: 'xxxxxx' }, assetion: {
 				code: 'NO_SUCH_CLIP',
 				id: 'b80525c6-97f7-49d7-a42d-ebccd49cfd52', // add-noteと異なる
 			} },
@@ -828,7 +828,7 @@ describe('クリップ', () => {
 			} },
 		])('の削除は$labelだとできない', async ({ parameters, user, assetion }) => failedApiCall({
 			endpoint: '/clips/remove-note',
-			parameters: { 
+			parameters: {
 				clipId: aliceClip.id,
 				noteId: aliceNote.id,
 				...parameters,
@@ -848,12 +848,12 @@ describe('クリップ', () => {
 			}
 
 			const res = await notes({ clipId: aliceClip.id });
-			
+
 			// 自分のノートは非公開でも入れられるし、見える
 			// 他人の非公開ノートは入れられるけど、除外される
 			const expects = [
 				aliceNote, aliceHomeNote, aliceFollowersNote, aliceSpecifiedNote,
-				bobNote, bobHomeNote, 
+				bobNote, bobHomeNote,
 			];
 			assert.deepStrictEqual(
 				res.sort(compareBy(s => s.id)),
@@ -867,7 +867,7 @@ describe('クリップ', () => {
 				await addNote({ clipId: aliceClip.id, noteId: note.id });
 			}
 
-			const res = await notes({ 
+			const res = await notes({
 				clipId: aliceClip.id,
 				sinceId: noteList[2].id,
 				limit: 3,
@@ -892,7 +892,7 @@ describe('クリップ', () => {
 				sinceId: noteList[1].id,
 				untilId: noteList[4].id,
 			});
-			
+
 			// Promise.allで返ってくる配列はID順で並んでないのでソートして厳密比較
 			const expects = [noteList[2], noteList[3]];
 			assert.deepStrictEqual(
@@ -918,7 +918,7 @@ describe('クリップ', () => {
 
 			const res = await notes({ clipId: publicClip.id }, { user: undefined });
 			const expects = [
-				aliceNote, aliceHomeNote, 
+				aliceNote, aliceHomeNote,
 				// 認証なしだと非公開ノートは結果には含むけどhideされる。
 				hiddenNote(aliceFollowersNote), hiddenNote(aliceSpecifiedNote),
 			];
@@ -926,7 +926,7 @@ describe('クリップ', () => {
 				res.sort(compareBy(s => s.id)),
 				expects.sort(compareBy(s => s.id)));
 		});
-		
+
 		test.todo('ブロック、ミュートされたユーザーからの設定＆取得etc.');
 
 		test.each([
@@ -947,7 +947,7 @@ describe('クリップ', () => {
 			} },
 		])('は$labelだと取得できない', async ({ parameters, user, assertion }) => failedApiCall({
 			endpoint: '/clips/notes',
-			parameters: { 
+			parameters: {
 				clipId: aliceClip.id,
 				...parameters,
 			},
diff --git a/packages/backend/test/e2e/endpoints.ts b/packages/backend/test/e2e/endpoints.ts
index f885209b7f..a1e89d4833 100644
--- a/packages/backend/test/e2e/endpoints.ts
+++ b/packages/backend/test/e2e/endpoints.ts
@@ -4,17 +4,18 @@ import * as assert from 'assert';
 // node-fetch only supports it's own Blob yet
 // https://github.com/node-fetch/node-fetch/pull/1664
 import { Blob } from 'node-fetch';
+import { User } from '@/models/index.js';
 import { startServer, signup, post, api, uploadFile, simpleGet, initTestDb } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
-import { User } from '@/models/index.js';
+import type * as misskey from 'misskey-js';
 
 describe('Endpoints', () => {
 	let app: INestApplicationContext;
 
-	let alice: any;
-	let bob: any;
-	let carol: any;
-	let dave: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
+	let carol: misskey.entities.MeSignup;
+	let dave: misskey.entities.MeSignup;
 
 	beforeAll(async () => {
 		app = await startServer();
diff --git a/packages/backend/test/e2e/fetch-resource.ts b/packages/backend/test/e2e/fetch-resource.ts
index 78ca8b43ba..115945dd3d 100644
--- a/packages/backend/test/e2e/fetch-resource.ts
+++ b/packages/backend/test/e2e/fetch-resource.ts
@@ -4,6 +4,7 @@ import * as assert from 'assert';
 import { startServer, channel, clip, cookie, galleryPost, signup, page, play, post, simpleGet, uploadFile } from '../utils.js';
 import type { SimpleGetResponse } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 // Request Accept
 const ONLY_AP = 'application/activity+json';
@@ -19,7 +20,7 @@ const JSON_UTF8 = 'application/json; charset=utf-8';
 describe('Webリソース', () => {
 	let app: INestApplicationContext;
 
-	let alice: any;
+	let alice: misskey.entities.MeSignup;
 	let aliceUploadedFile: any;
 	let alicesPost: any;
 	let alicePage: any;
@@ -28,8 +29,8 @@ describe('Webリソース', () => {
 	let aliceGalleryPost: any;
 	let aliceChannel: any;
 
-	type Request = { 
-		path: string, 
+	type Request = {
+		path: string,
 		accept?: string,
 		cookie?: string,
 	};
@@ -46,7 +47,7 @@ describe('Webリソース', () => {
 	const notOk = async (param: Request & {
 		status?: number,
 		code?: string,
-	}): Promise<SimpleGetResponse> => {	
+	}): Promise<SimpleGetResponse> => {
 		const { path, accept, cookie, status, code } = param;
 		const res = await simpleGet(path, accept, cookie);
 		assert.notStrictEqual(res.status, 200);
@@ -58,8 +59,8 @@ describe('Webリソース', () => {
 		}
 		return res;
 	};
-	
-	const notFound = async (param: Request): Promise<SimpleGetResponse> => {	
+
+	const notFound = async (param: Request): Promise<SimpleGetResponse> => {
 		return await notOk({
 			...param,
 			status: 404,
@@ -94,23 +95,23 @@ describe('Webリソース', () => {
 		{ path: '/', type: HTML },
 		{ path: '/docs/ja-JP/about', type: HTML }, // "指定されたURLに該当するページはありませんでした。"
 		// fastify-static gives charset=UTF-8 instead of utf-8 and that's okay
-		{ path: '/api-doc', type: 'text/html; charset=UTF-8' }, 
-		{ path: '/api.json', type: JSON_UTF8 }, 
-		{ path: '/api-console', type: HTML }, 
-		{ path: '/_info_card_', type: HTML }, 
-		{ path: '/bios', type: HTML }, 
-		{ path: '/cli', type: HTML }, 
-		{ path: '/flush', type: HTML }, 
+		{ path: '/api-doc', type: 'text/html; charset=UTF-8' },
+		{ path: '/api.json', type: JSON_UTF8 },
+		{ path: '/api-console', type: HTML },
+		{ path: '/_info_card_', type: HTML },
+		{ path: '/bios', type: HTML },
+		{ path: '/cli', type: HTML },
+		{ path: '/flush', type: HTML },
 		{ path: '/robots.txt', type: 'text/plain; charset=UTF-8' },
-		{ path: '/favicon.ico', type: 'image/vnd.microsoft.icon' }, 
+		{ path: '/favicon.ico', type: 'image/vnd.microsoft.icon' },
 		{ path: '/opensearch.xml', type: 'application/opensearchdescription+xml' },
-		{ path: '/apple-touch-icon.png', type: 'image/png' }, 
-		{ path: '/twemoji/2764.svg', type: 'image/svg+xml' }, 
-		{ path: '/twemoji/2764-fe0f-200d-1f525.svg', type: 'image/svg+xml' }, 
-		{ path: '/twemoji-badge/2764.png', type: 'image/png' }, 
+		{ path: '/apple-touch-icon.png', type: 'image/png' },
+		{ path: '/twemoji/2764.svg', type: 'image/svg+xml' },
+		{ path: '/twemoji/2764-fe0f-200d-1f525.svg', type: 'image/svg+xml' },
+		{ path: '/twemoji-badge/2764.png', type: 'image/png' },
 		{ path: '/twemoji-badge/2764-fe0f-200d-1f525.png', type: 'image/png' },
-		{ path: '/fluent-emoji/2764.png', type: 'image/png' }, 
-		{ path: '/fluent-emoji/2764-fe0f-200d-1f525.png', type: 'image/png' }, 
+		{ path: '/fluent-emoji/2764.png', type: 'image/png' },
+		{ path: '/fluent-emoji/2764-fe0f-200d-1f525.png', type: 'image/png' },
 	])('$path', (p) => {
 		test('がGETできる。', async () => await ok({ ...p }));
 
@@ -120,58 +121,58 @@ describe('Webリソース', () => {
 	});
 
 	describe.each([
-		{ path: '/twemoji/2764.png' }, 
-		{ path: '/twemoji/2764-fe0f-200d-1f525.png' }, 
-		{ path: '/twemoji-badge/2764.svg' }, 
+		{ path: '/twemoji/2764.png' },
+		{ path: '/twemoji/2764-fe0f-200d-1f525.png' },
+		{ path: '/twemoji-badge/2764.svg' },
 		{ path: '/twemoji-badge/2764-fe0f-200d-1f525.svg' },
-		{ path: '/fluent-emoji/2764.svg' }, 
-		{ path: '/fluent-emoji/2764-fe0f-200d-1f525.svg' }, 
+		{ path: '/fluent-emoji/2764.svg' },
+		{ path: '/fluent-emoji/2764-fe0f-200d-1f525.svg' },
 	])('$path', ({ path }) => {
 		test('はGETできない。', async () => await notFound({ path }));
 	});
 
 	describe.each([
-		{ ext: 'rss', type: 'application/rss+xml; charset=utf-8' }, 
-		{ ext: 'atom', type: 'application/atom+xml; charset=utf-8' }, 
-		{ ext: 'json', type: 'application/json; charset=utf-8' }, 
+		{ ext: 'rss', type: 'application/rss+xml; charset=utf-8' },
+		{ ext: 'atom', type: 'application/atom+xml; charset=utf-8' },
+		{ ext: 'json', type: 'application/json; charset=utf-8' },
 	])('/@:username.$ext', ({ ext, type }) => {
 		const path = (username: string): string => `/@${username}.${ext}`;
 
-		test('がGETできる。', async () => await ok({ 
+		test('がGETできる。', async () => await ok({
 			path: path(alice.username),
 			type,
 		}));
 
-		test('は存在しないユーザーはGETできない。', async () => await notOk({ 
+		test('は存在しないユーザーはGETできない。', async () => await notOk({
 			path: path('nonexisting'),
-			status: 404, 
+			status: 404,
 		}));
 	});
 
 	describe.each([{ path: '/api/foo' }])('$path', ({ path }) => {
-		test('はGETできない。', async () => await notOk({ 
+		test('はGETできない。', async () => await notOk({
 			path,
-			status: 404, 
+			status: 404,
 			code: 'UNKNOWN_API_ENDPOINT',
 		}));
 	});
 
 	describe.each([{ path: '/queue' }])('$path', ({ path }) => {
-		test('はadminでなければGETできない。', async () => await notOk({ 
+		test('はadminでなければGETできない。', async () => await notOk({
 			path,
 			status: 500, // FIXME? 403ではない。
 		}));
-		
-		test('はadminならGETできる。', async () => await ok({ 
+
+		test('はadminならGETできる。', async () => await ok({
 			path,
 			cookie: cookie(alice),
-		}));	
+		}));
 	});
 
 	describe.each([{ path: '/streaming' }])('$path', ({ path }) => {
-		test('はGETできない。', async () => await notOk({ 
+		test('はGETできない。', async () => await notOk({
 			path,
-			status: 503, 
+			status: 503,
 		}));
 	});
 
@@ -183,21 +184,21 @@ describe('Webリソース', () => {
 			{ accept: UNSPECIFIED },
 		])('(Acceptヘッダ: $accept)', ({ accept }) => {
 			test('はHTMLとしてGETできる。', async () => {
-				const res = await ok({ 
-					path: path(alice.username), 
-					accept, 
+				const res = await ok({
+					path: path(alice.username),
+					accept,
 					type: HTML,
 				});
 				assert.strictEqual(metaTag(res, 'misskey:user-username'), alice.username);
 				assert.strictEqual(metaTag(res, 'misskey:user-id'), alice.id);
-				
+
 				// TODO ogタグの検証
 				// TODO profile.noCrawleの検証
 				// TODO twitter:creatorの検証
 				// TODO <link rel="me" ...>の検証
 			});
-			test('はHTMLとしてGETできる。(存在しないIDでも。)', async () => await ok({ 
-				path: path('xxxxxxxxxx'), 
+			test('はHTMLとしてGETできる。(存在しないIDでも。)', async () => await ok({
+				path: path('xxxxxxxxxx'),
 				type: HTML,
 			}));
 		});
@@ -207,22 +208,22 @@ describe('Webリソース', () => {
 			{ accept: PREFER_AP },
 		])('(Acceptヘッダ: $accept)', ({ accept }) => {
 			test('はActivityPubとしてGETできる。', async () => {
-				const res = await ok({ 
-					path: path(alice.username), 
-					accept, 
+				const res = await ok({
+					path: path(alice.username),
+					accept,
 					type: AP,
 				});
 				assert.strictEqual(res.body.type, 'Person');
 			});
 
-			test('は存在しないIDのときActivityPubとしてGETできない。', async () => await notFound({ 
-				path: path('xxxxxxxxxx'), 
+			test('は存在しないIDのときActivityPubとしてGETできない。', async () => await notFound({
+				path: path('xxxxxxxxxx'),
 				accept,
 			}));
 		});
 	});
 
-	describe.each([ 
+	describe.each([
 		// 実際のハンドルはフロントエンド(index.vue)で行われる
 		{ sub: 'home' },
 		{ sub: 'notes' },
@@ -236,32 +237,32 @@ describe('Webリソース', () => {
 		const path = (username: string): string => `/@${username}/${sub}`;
 
 		test('はHTMLとしてGETできる。', async () => {
-			const res = await ok({ 
-				path: path(alice.username), 
+			const res = await ok({
+				path: path(alice.username),
 			});
 			assert.strictEqual(metaTag(res, 'misskey:user-username'), alice.username);
 			assert.strictEqual(metaTag(res, 'misskey:user-id'), alice.id);
 		});
 	});
-	
+
 	describe('/@:user/pages/:page', () => {
 		const path = (username: string, pagename: string): string => `/@${username}/pages/${pagename}`;
 
 		test('はHTMLとしてGETできる。', async () => {
-			const res = await ok({ 
-				path: path(alice.username, alicePage.name), 
+			const res = await ok({
+				path: path(alice.username, alicePage.name),
 			});
 			assert.strictEqual(metaTag(res, 'misskey:user-username'), alice.username);
 			assert.strictEqual(metaTag(res, 'misskey:user-id'), alice.id);
 			assert.strictEqual(metaTag(res, 'misskey:page-id'), alicePage.id);
-			
+
 			// TODO ogタグの検証
 			// TODO profile.noCrawleの検証
 			// TODO twitter:creatorの検証
 		});
-		
-		test('はGETできる。(存在しないIDでも。)', async () => await ok({ 
-			path: path(alice.username, 'xxxxxxxxxx'), 
+
+		test('はGETできる。(存在しないIDでも。)', async () => await ok({
+			path: path(alice.username, 'xxxxxxxxxx'),
 		}));
 	});
 
@@ -278,7 +279,7 @@ describe('Webリソース', () => {
 				assert.strictEqual(res.location, `/@${alice.username}`);
 			});
 
-			test('は存在しないユーザーはGETできない。', async () => await notFound({ 
+			test('は存在しないユーザーはGETできない。', async () => await notFound({
 				path: path('xxxxxxxx'),
 			}));
 		});
@@ -288,24 +289,24 @@ describe('Webリソース', () => {
 			{ accept: PREFER_AP },
 		])('(Acceptヘッダ: $accept)', ({ accept }) => {
 			test('はActivityPubとしてGETできる。', async () => {
-				const res = await ok({ 
-					path: path(alice.id), 
-					accept, 
+				const res = await ok({
+					path: path(alice.id),
+					accept,
 					type: AP,
 				});
 				assert.strictEqual(res.body.type, 'Person');
 			});
 
-			test('は存在しないIDのときActivityPubとしてGETできない。', async () => await notOk({ 
+			test('は存在しないIDのときActivityPubとしてGETできない。', async () => await notOk({
 				path: path('xxxxxxxx'),
 				accept,
 				status: 404,
 			}));
 		});
 	});
-	
+
 	describe('/users/inbox', () => {
-		test('がGETできる。(POST専用だけど4xx/5xxにならずHTMLが返ってくる)', async () => await ok({ 
+		test('がGETできる。(POST専用だけど4xx/5xxにならずHTMLが返ってくる)', async () => await ok({
 			path: '/inbox',
 		}));
 
@@ -315,7 +316,7 @@ describe('Webリソース', () => {
 	describe('/users/:id/inbox', () => {
 		const path = (id: string): string => `/users/${id}/inbox`;
 
-		test('がGETできる。(POST専用だけど4xx/5xxにならずHTMLが返ってくる)', async () => await ok({ 
+		test('がGETできる。(POST専用だけど4xx/5xxにならずHTMLが返ってくる)', async () => await ok({
 			path: path(alice.id),
 		}));
 
@@ -326,14 +327,14 @@ describe('Webリソース', () => {
 		const path = (id: string): string => `/users/${id}/outbox`;
 
 		test('がGETできる。', async () => {
-			const res = await ok({ 
-				path: path(alice.id), 
+			const res = await ok({
+				path: path(alice.id),
 				type: AP,
 			});
 			assert.strictEqual(res.body.type, 'OrderedCollection');
 		});
 	});
-	
+
 	describe('/notes/:id', () => {
 		const path = (noteId: string): string => `/notes/${noteId}`;
 
@@ -342,22 +343,22 @@ describe('Webリソース', () => {
 			{ accept: UNSPECIFIED },
 		])('(Acceptヘッダ: $accept)', ({ accept }) => {
 			test('はHTMLとしてGETできる。', async () => {
-				const res = await ok({ 
-					path: path(alicesPost.id), 
-					accept, 
+				const res = await ok({
+					path: path(alicesPost.id),
+					accept,
 					type: HTML,
 				});
 				assert.strictEqual(metaTag(res, 'misskey:user-username'), alice.username);
 				assert.strictEqual(metaTag(res, 'misskey:user-id'), alice.id);
-				assert.strictEqual(metaTag(res, 'misskey:note-id'), alicesPost.id);	
-				
+				assert.strictEqual(metaTag(res, 'misskey:note-id'), alicesPost.id);
+
 				// TODO ogタグの検証
 				// TODO profile.noCrawleの検証
 				// TODO twitter:creatorの検証
 			});
 
-			test('はHTMLとしてGETできる。(存在しないIDでも。)', async () => await ok({ 
-				path: path('xxxxxxxxxx'), 
+			test('はHTMLとしてGETできる。(存在しないIDでも。)', async () => await ok({
+				path: path('xxxxxxxxxx'),
 			}));
 		});
 
@@ -366,48 +367,48 @@ describe('Webリソース', () => {
 			{ accept: PREFER_AP },
 		])('(Acceptヘッダ: $accept)', ({ accept }) => {
 			test('はActivityPubとしてGETできる。', async () => {
-				const res = await ok({ 
-					path: path(alicesPost.id), 
+				const res = await ok({
+					path: path(alicesPost.id),
 					accept,
 					type: AP,
 				});
 				assert.strictEqual(res.body.type, 'Note');
 			});
 
-			test('は存在しないIDのときActivityPubとしてGETできない。', async () => await notFound({ 
-				path: path('xxxxxxxxxx'), 
+			test('は存在しないIDのときActivityPubとしてGETできない。', async () => await notFound({
+				path: path('xxxxxxxxxx'),
 				accept,
 			}));
 		});
 	});
-	
+
 	describe('/play/:id', () => {
 		const path = (playid: string): string => `/play/${playid}`;
 
 		test('がGETできる。', async () => {
-			const res = await ok({ 
-				path: path(alicePlay.id), 
+			const res = await ok({
+				path: path(alicePlay.id),
 			});
 			assert.strictEqual(metaTag(res, 'misskey:user-username'), alice.username);
 			assert.strictEqual(metaTag(res, 'misskey:user-id'), alice.id);
 			assert.strictEqual(metaTag(res, 'misskey:flash-id'), alicePlay.id);
-			
+
 			// TODO ogタグの検証
 			// TODO profile.noCrawleの検証
 			// TODO twitter:creatorの検証
 		});
 
-		test('がGETできる。(存在しないIDでも。)', async () => await ok({ 
-			path: path('xxxxxxxxxx'), 
+		test('がGETできる。(存在しないIDでも。)', async () => await ok({
+			path: path('xxxxxxxxxx'),
 		}));
 	});
-	
+
 	describe('/clips/:clip', () => {
 		const path = (clip: string): string => `/clips/${clip}`;
 
 		test('がGETできる。', async () => {
-			const res = await ok({ 
-				path: path(aliceClip.id), 
+			const res = await ok({
+				path: path(aliceClip.id),
 			});
 			assert.strictEqual(metaTag(res, 'misskey:user-username'), alice.username);
 			assert.strictEqual(metaTag(res, 'misskey:user-id'), alice.id);
@@ -416,9 +417,9 @@ describe('Webリソース', () => {
 			// TODO ogタグの検証
 			// TODO profile.noCrawleの検証
 		});
-		
-		test('がGETできる。(存在しないIDでも。)', async () => await ok({ 
-			path: path('xxxxxxxxxx'), 
+
+		test('がGETできる。(存在しないIDでも。)', async () => await ok({
+			path: path('xxxxxxxxxx'),
 		}));
 	});
 
@@ -426,8 +427,8 @@ describe('Webリソース', () => {
 		const path = (post: string): string => `/gallery/${post}`;
 
 		test('がGETできる。', async () => {
-			const res = await ok({ 
-				path: path(aliceGalleryPost.id), 
+			const res = await ok({
+				path: path(aliceGalleryPost.id),
 			});
 			assert.strictEqual(metaTag(res, 'misskey:user-username'), alice.username);
 			assert.strictEqual(metaTag(res, 'misskey:user-id'), alice.id);
@@ -436,26 +437,26 @@ describe('Webリソース', () => {
 			// TODO profile.noCrawleの検証
 			// TODO twitter:creatorの検証
 		});
-		
-		test('がGETできる。(存在しないIDでも。)', async () => await ok({ 
-			path: path('xxxxxxxxxx'), 
+
+		test('がGETできる。(存在しないIDでも。)', async () => await ok({
+			path: path('xxxxxxxxxx'),
 		}));
 	});
-	
+
 	describe('/channels/:channel', () => {
 		const path = (channel: string): string => `/channels/${channel}`;
 
 		test('はGETできる。', async () => {
 			const res = await ok({
-				path: path(aliceChannel.id), 
+				path: path(aliceChannel.id),
 			});
 
 			// FIXME: misskey関連のmetaタグの設定がない
 			// TODO ogタグの検証
 		});
-		
-		test('がGETできる。(存在しないIDでも。)', async () => await ok({ 
-			path: path('xxxxxxxxxx'), 
+
+		test('がGETできる。(存在しないIDでも。)', async () => await ok({
+			path: path('xxxxxxxxxx'),
 		}));
 	});
 });
diff --git a/packages/backend/test/e2e/ff-visibility.ts b/packages/backend/test/e2e/ff-visibility.ts
index 7b75005a39..9082c77f07 100644
--- a/packages/backend/test/e2e/ff-visibility.ts
+++ b/packages/backend/test/e2e/ff-visibility.ts
@@ -3,12 +3,13 @@ process.env.NODE_ENV = 'test';
 import * as assert from 'assert';
 import { signup, api, startServer, simpleGet } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('FF visibility', () => {
 	let app: INestApplicationContext;
 
-	let alice: any;
-	let bob: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
 
 	beforeAll(async () => {
 		app = await startServer();
diff --git a/packages/backend/test/e2e/move.ts b/packages/backend/test/e2e/move.ts
index 7d6c646090..2fefcd0f0e 100644
--- a/packages/backend/test/e2e/move.ts
+++ b/packages/backend/test/e2e/move.ts
@@ -1,12 +1,13 @@
 process.env.NODE_ENV = 'test';
 
 import * as assert from 'assert';
-import rndstr from 'rndstr';
 import { loadConfig } from '@/config.js';
 import { User, UsersRepository } from '@/models/index.js';
 import { jobQueue } from '@/boot/common.js';
+import { secureRndstr } from '@/misc/secure-rndstr.js';
 import { uploadFile, signup, startServer, initTestDb, api, sleep, successfulApiCall } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('Account Move', () => {
 	let app: INestApplicationContext;
@@ -14,12 +15,12 @@ describe('Account Move', () => {
 	let url: URL;
 
 	let root: any;
-	let alice: any;
-	let bob: any;
-	let carol: any;
-	let dave: any;
-	let eve: any;
-	let frank: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
+	let carol: misskey.entities.MeSignup;
+	let dave: misskey.entities.MeSignup;
+	let eve: misskey.entities.MeSignup;
+	let frank: misskey.entities.MeSignup;
 
 	let Users: UsersRepository;
 
@@ -162,7 +163,7 @@ describe('Account Move', () => {
 				alsoKnownAs: [`@alice@${url.hostname}`],
 			}, root);
 			const listRoot = await api('/users/lists/create', {
-				name: rndstr('0-9a-z', 8),
+				name: secureRndstr(8),
 			}, root);
 			await api('/users/lists/push', {
 				listId: listRoot.body.id,
@@ -176,9 +177,9 @@ describe('Account Move', () => {
 				userId: eve.id,
 			}, alice);
 			const antenna = await api('/antennas/create', {
-				name: rndstr('0-9a-z', 8),
+				name: secureRndstr(8),
 				src: 'home',
-				keywords: [rndstr('0-9a-z', 8)],
+				keywords: [secureRndstr(8)],
 				excludeKeywords: [],
 				users: [],
 				caseSensitive: false,
@@ -210,7 +211,7 @@ describe('Account Move', () => {
 				userId: dave.id,
 			}, eve);
 			const listEve = await api('/users/lists/create', {
-				name: rndstr('0-9a-z', 8),
+				name: secureRndstr(8),
 			}, eve);
 			await api('/users/lists/push', {
 				listId: listEve.body.id,
@@ -419,9 +420,9 @@ describe('Account Move', () => {
 		test('Prohibit access after moving: /antennas/update', async () => {
 			const res = await api('/antennas/update', {
 				antennaId,
-				name: rndstr('0-9a-z', 8),
+				name: secureRndstr(8),
 				src: 'users',
-				keywords: [rndstr('0-9a-z', 8)],
+				keywords: [secureRndstr(8)],
 				excludeKeywords: [],
 				users: [eve.id],
 				caseSensitive: false,
diff --git a/packages/backend/test/e2e/mute.ts b/packages/backend/test/e2e/mute.ts
index 25bd532cfb..79e2c90f64 100644
--- a/packages/backend/test/e2e/mute.ts
+++ b/packages/backend/test/e2e/mute.ts
@@ -3,14 +3,15 @@ process.env.NODE_ENV = 'test';
 import * as assert from 'assert';
 import { signup, api, post, react, startServer, waitFire } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('Mute', () => {
 	let app: INestApplicationContext;
 
 	// alice mutes carol
-	let alice: any;
-	let bob: any;
-	let carol: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
+	let carol: misskey.entities.MeSignup;
 
 	beforeAll(async () => {
 		app = await startServer();
diff --git a/packages/backend/test/e2e/note.ts b/packages/backend/test/e2e/note.ts
index d2eb8f01d7..33da811a26 100644
--- a/packages/backend/test/e2e/note.ts
+++ b/packages/backend/test/e2e/note.ts
@@ -4,13 +4,14 @@ import * as assert from 'assert';
 import { Note } from '@/models/entities/Note.js';
 import { signup, post, uploadUrl, startServer, initTestDb, api, uploadFile } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('Note', () => {
 	let app: INestApplicationContext;
 	let Notes: any;
 
-	let alice: any;
-	let bob: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
 
 	beforeAll(async () => {
 		app = await startServer();
@@ -378,7 +379,7 @@ describe('Note', () => {
 					},
 				},
 			}, alice);
-			
+
 			assert.strictEqual(res.status, 200);
 
 			const assign = await api('admin/roles/assign', {
diff --git a/packages/backend/test/e2e/renote-mute.ts b/packages/backend/test/e2e/renote-mute.ts
index 0f73b8d09f..72fc599aaf 100644
--- a/packages/backend/test/e2e/renote-mute.ts
+++ b/packages/backend/test/e2e/renote-mute.ts
@@ -3,14 +3,15 @@ process.env.NODE_ENV = 'test';
 import * as assert from 'assert';
 import { signup, api, post, react, startServer, waitFire } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('Renote Mute', () => {
 	let app: INestApplicationContext;
 
 	// alice mutes carol
-	let alice: any;
-	let bob: any;
-	let carol: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
+	let carol: misskey.entities.MeSignup;
 
 	beforeAll(async () => {
 		app = await startServer();
diff --git a/packages/backend/test/e2e/streaming.ts b/packages/backend/test/e2e/streaming.ts
index d1394ef7a8..2cddafed2e 100644
--- a/packages/backend/test/e2e/streaming.ts
+++ b/packages/backend/test/e2e/streaming.ts
@@ -4,6 +4,7 @@ import * as assert from 'assert';
 import { Following } from '@/models/entities/Following.js';
 import { connectStream, signup, api, post, startServer, initTestDb, waitFire } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('Streaming', () => {
 	let app: INestApplicationContext;
@@ -26,13 +27,13 @@ describe('Streaming', () => {
 
 	describe('Streaming', () => {
 		// Local users
-		let ayano: any;
-		let kyoko: any;
-		let chitose: any;
+		let ayano: misskey.entities.MeSignup;
+		let kyoko: misskey.entities.MeSignup;
+		let chitose: misskey.entities.MeSignup;
 
 		// Remote users
-		let akari: any;
-		let chinatsu: any;
+		let akari: misskey.entities.MeSignup;
+		let chinatsu: misskey.entities.MeSignup;
 
 		let kyokoNote: any;
 		let list: any;
diff --git a/packages/backend/test/e2e/thread-mute.ts b/packages/backend/test/e2e/thread-mute.ts
index 2ae2eb67c1..e01ea90fe0 100644
--- a/packages/backend/test/e2e/thread-mute.ts
+++ b/packages/backend/test/e2e/thread-mute.ts
@@ -3,13 +3,14 @@ process.env.NODE_ENV = 'test';
 import * as assert from 'assert';
 import { signup, api, post, connectStream, startServer } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('Note thread mute', () => {
 	let app: INestApplicationContext;
 
-	let alice: any;
-	let bob: any;
-	let carol: any;
+	let alice: misskey.entities.MeSignup;
+	let bob: misskey.entities.MeSignup;
+	let carol: misskey.entities.MeSignup;
 
 	beforeAll(async () => {
 		app = await startServer();
diff --git a/packages/backend/test/e2e/user-notes.ts b/packages/backend/test/e2e/user-notes.ts
index c11099e7b5..3681456c7e 100644
--- a/packages/backend/test/e2e/user-notes.ts
+++ b/packages/backend/test/e2e/user-notes.ts
@@ -3,11 +3,12 @@ process.env.NODE_ENV = 'test';
 import * as assert from 'assert';
 import { signup, api, post, uploadUrl, startServer } from '../utils.js';
 import type { INestApplicationContext } from '@nestjs/common';
+import type * as misskey from 'misskey-js';
 
 describe('users/notes', () => {
 	let app: INestApplicationContext;
 
-	let alice: any;
+	let alice: misskey.entities.MeSignup;
 	let jpgNote: any;
 	let pngNote: any;
 	let jpgPngNote: any;
diff --git a/packages/backend/test/e2e/users.ts b/packages/backend/test/e2e/users.ts
index 02684c93b8..64efaa57cc 100644
--- a/packages/backend/test/e2e/users.ts
+++ b/packages/backend/test/e2e/users.ts
@@ -4,14 +4,14 @@ import * as assert from 'assert';
 import { inspect } from 'node:util';
 import { DEFAULT_POLICIES } from '@/core/RoleService.js';
 import type { Packed } from '@/misc/json-schema.js';
-import { 
-	signup, 
-	post, 
+import {
+	signup,
+	post,
 	page,
 	role,
-	startServer, 
+	startServer,
 	api,
-	successfulApiCall, 
+	successfulApiCall,
 	failedApiCall,
 	uploadFile,
 } from '../utils.js';
@@ -36,19 +36,19 @@ describe('ユーザー', () => {
 		badgeRoles: any[],
 	};
 
-	type UserDetailedNotMe = UserLite & 
+	type UserDetailedNotMe = UserLite &
 	misskey.entities.UserDetailed & {
 		roles: any[],
 	};
 
-	type MeDetailed = UserDetailedNotMe & 
+	type MeDetailed = UserDetailedNotMe &
 		misskey.entities.MeDetailed & {
 		achievements: object[],
 		loggedInDays: number,
 		policies: object,
 	};
-	
-	type User = MeDetailed & { token: string };	
+
+	type User = MeDetailed & { token: string };
 
 	const show = async (id: string, me = root): Promise<MeDetailed | UserDetailedNotMe> => {
 		return successfulApiCall({ endpoint: 'users/show', parameters: { userId: id }, user: me }) as any;
@@ -159,7 +159,7 @@ describe('ユーザー', () => {
 			mutedInstances: user.mutedInstances,
 			mutingNotificationTypes: user.mutingNotificationTypes,
 			emailNotificationTypes: user.emailNotificationTypes,
-			achievements: user.achievements, 
+			achievements: user.achievements,
 			loggedInDays: user.loggedInDays,
 			policies: user.policies,
 			...(security ? {
@@ -222,11 +222,11 @@ describe('ユーザー', () => {
 	beforeAll(async () => {
 		root = await signup({ username: 'root' });
 		alice = await signup({ username: 'alice' });
-		aliceNote = await post(alice, { text: 'test' }) as any; 
+		aliceNote = await post(alice, { text: 'test' }) as any;
 		alicePage = await page(alice);
 		aliceList = (await api('users/list/create', { name: 'aliceList' }, alice)).body;
 		bob = await signup({ username: 'bob' });
-		bobNote = await post(bob, { text: 'test' }) as any; 
+		bobNote = await post(bob, { text: 'test' }) as any;
 		carol = await signup({ username: 'carol' });
 		dave = await signup({ username: 'dave' });
 		ellen = await signup({ username: 'ellen' });
@@ -236,10 +236,10 @@ describe('ユーザー', () => {
 		usersReplying = await [...Array(10)].map((_, i) => i).reduce(async (acc, i) => {
 			const u = await signup({ username: `replying${i}` });
 			for (let j = 0; j < 10 - i; j++) {
-				const p = await post(u, { text: `test${j}` }); 
+				const p = await post(u, { text: `test${j}` });
 				await post(alice, { text: `@${u.username} test${j}`, replyId: p.id });
 			}
-			
+
 			return (await acc).concat(u);
 		}, Promise.resolve([] as User[]));
 
@@ -376,7 +376,7 @@ describe('ユーザー', () => {
 		assert.strictEqual(response.securityKeys, false);
 		assert.deepStrictEqual(response.roles, []);
 		assert.strictEqual(response.memo, null);
-		
+
 		// MeDetailedOnly
 		assert.strictEqual(response.avatarId, null);
 		assert.strictEqual(response.bannerId, null);
@@ -406,7 +406,7 @@ describe('ユーザー', () => {
 		assert.deepStrictEqual(response.emailNotificationTypes, ['follow', 'receiveFollowRequest']);
 		assert.deepStrictEqual(response.achievements, []);
 		assert.deepStrictEqual(response.loggedInDays, 0);
-		assert.deepStrictEqual(response.policies, DEFAULT_POLICIES); 
+		assert.deepStrictEqual(response.policies, DEFAULT_POLICIES);
 		assert.notStrictEqual(response.email, undefined);
 		assert.strictEqual(response.emailVerified, false);
 		assert.deepStrictEqual(response.securityKeysList, []);
@@ -499,8 +499,8 @@ describe('ユーザー', () => {
 		const response = await successfulApiCall({ endpoint: 'i/update', parameters: parameters, user: alice });
 		assert.match(response.avatarUrl ?? '.', /^[-a-zA-Z0-9@:%._\+~#&?=\/]+$/);
 		assert.match(response.avatarBlurhash ?? '.', /[ -~]{54}/);
-		const expected = { 
-			...meDetailed(alice, true), 
+		const expected = {
+			...meDetailed(alice, true),
 			avatarId: aliceFile.id,
 			avatarBlurhash: response.avatarBlurhash,
 			avatarUrl: response.avatarUrl,
@@ -509,8 +509,8 @@ describe('ユーザー', () => {
 
 		const parameters2 = { avatarId: null };
 		const response2 = await successfulApiCall({ endpoint: 'i/update', parameters: parameters2, user: alice });
-		const expected2 = { 
-			...meDetailed(alice, true), 
+		const expected2 = {
+			...meDetailed(alice, true),
 			avatarId: null,
 			avatarBlurhash: null,
 			avatarUrl: alice.avatarUrl, // 解除した場合、identiconになる
@@ -524,8 +524,8 @@ describe('ユーザー', () => {
 		const response = await successfulApiCall({ endpoint: 'i/update', parameters: parameters, user: alice });
 		assert.match(response.bannerUrl ?? '.', /^[-a-zA-Z0-9@:%._\+~#&?=\/]+$/);
 		assert.match(response.bannerBlurhash ?? '.', /[ -~]{54}/);
-		const expected = { 
-			...meDetailed(alice, true), 
+		const expected = {
+			...meDetailed(alice, true),
 			bannerId: aliceFile.id,
 			bannerBlurhash: response.bannerBlurhash,
 			bannerUrl: response.bannerUrl,
@@ -534,8 +534,8 @@ describe('ユーザー', () => {
 
 		const parameters2 = { bannerId: null };
 		const response2 = await successfulApiCall({ endpoint: 'i/update', parameters: parameters2, user: alice });
-		const expected2 = { 
-			...meDetailed(alice, true), 
+		const expected2 = {
+			...meDetailed(alice, true),
 			bannerId: null,
 			bannerBlurhash: null,
 			bannerUrl: null,
@@ -551,7 +551,7 @@ describe('ユーザー', () => {
 		const response = await successfulApiCall({ endpoint: 'i/pin', parameters, user: alice });
 		const expected = { ...meDetailed(alice, false), pinnedNoteIds: [aliceNote.id], pinnedNotes: [aliceNote] };
 		assert.deepStrictEqual(response, expected);
-		
+
 		const response2 = await successfulApiCall({ endpoint: 'i/unpin', parameters, user: alice });
 		const expected2 = meDetailed(alice, false);
 		assert.deepStrictEqual(response2, expected2);
@@ -612,7 +612,7 @@ describe('ユーザー', () => {
 	});
 	test.todo('をリスト形式で取得することができる（リモート, hostname指定）');
 	test.todo('をリスト形式で取得することができる（pagenation）');
-	
+
 	//#endregion
 	//#region ユーザー情報(users/show)
 
@@ -684,9 +684,9 @@ describe('ユーザー', () => {
 		const parameters = { userIds: [bob.id, alice.id, carol.id] };
 		const response = await successfulApiCall({ endpoint: 'users/show', parameters, user: alice });
 		const expected = [
-			await successfulApiCall({ endpoint: 'users/show', parameters: { userId: bob.id }, user: alice }), 
-			await successfulApiCall({ endpoint: 'users/show', parameters: { userId: alice.id }, user: alice }), 
-			await successfulApiCall({ endpoint: 'users/show', parameters: { userId: carol.id }, user: alice }), 
+			await successfulApiCall({ endpoint: 'users/show', parameters: { userId: bob.id }, user: alice }),
+			await successfulApiCall({ endpoint: 'users/show', parameters: { userId: alice.id }, user: alice }),
+			await successfulApiCall({ endpoint: 'users/show', parameters: { userId: carol.id }, user: alice }),
 		];
 		assert.deepStrictEqual(response, expected);
 	});
@@ -701,7 +701,7 @@ describe('ユーザー', () => {
 		// BUG サスペンドユーザーを一般ユーザーから見るとrootユーザーが返ってくる
 		//{ label: 'サスペンドユーザーが（一般ユーザーが見るときは）含まれない', user: (): User => userSuspended, me: (): User => bob, excluded: true },
 		{ label: '削除済ユーザーが含まれる', user: (): User => userDeletedBySelf },
-		{ label: '削除済(byAdmin)ユーザーが含まれる', user: (): User => userDeletedByAdmin },	
+		{ label: '削除済(byAdmin)ユーザーが含まれる', user: (): User => userDeletedByAdmin },
 	] as const)('をID指定のリスト形式で取得することができ、結果に$label', async ({ user, me, excluded }) => {
 		const parameters = { userIds: [user().id] };
 		const response = await successfulApiCall({ endpoint: 'users/show', parameters, user: me?.() ?? alice });
@@ -734,7 +734,7 @@ describe('ユーザー', () => {
 		{ label: 'サイレンスユーザーが含まれる', user: (): User => userSilenced },
 		{ label: 'サスペンドユーザーが含まれない', user: (): User => userSuspended, excluded: true },
 		{ label: '削除済ユーザーが含まれる', user: (): User => userDeletedBySelf },
-		{ label: '削除済(byAdmin)ユーザーが含まれる', user: (): User => userDeletedByAdmin },	
+		{ label: '削除済(byAdmin)ユーザーが含まれる', user: (): User => userDeletedByAdmin },
 	] as const)('を検索することができ、結果に$labelが含まれる', async ({ user, excluded }) => {
 		const parameters = { query: user().username, limit: 1 };
 		const response = await successfulApiCall({ endpoint: 'users/search', parameters, user: alice });
@@ -747,7 +747,7 @@ describe('ユーザー', () => {
 	//#endregion
 	//#region ID指定検索(users/search-by-username-and-host)
 
-	test.each([ 
+	test.each([
 		{ label: '自分', parameters: { username: 'alice' }, user: (): User[] => [alice] },
 		{ label: '自分かつusernameが大文字', parameters: { username: 'ALICE' }, user: (): User[] => [alice] },
 		{ label: 'ローカルのフォロイーでノートなし', parameters: { username: 'userFollowedByAlice' }, user: (): User[] => [userFollowedByAlice] },
@@ -786,7 +786,7 @@ describe('ユーザー', () => {
 	test('がよくリプライをするユーザーのリストを取得できる', async () => {
 		const parameters = { userId: alice.id, limit: 5 };
 		const response = await successfulApiCall({ endpoint: 'users/get-frequently-replied-users', parameters, user: alice });
-		const expected = await Promise.all(usersReplying.slice(0, parameters.limit).map(async (s, i) => ({ 
+		const expected = await Promise.all(usersReplying.slice(0, parameters.limit).map(async (s, i) => ({
 			user: await show(s.id, alice),
 			weight: (usersReplying.length - i) / usersReplying.length,
 		})));
diff --git a/packages/backend/test/misc/mock-resolver.ts b/packages/backend/test/misc/mock-resolver.ts
index a7bcd859ae..9dbe77a7c4 100644
--- a/packages/backend/test/misc/mock-resolver.ts
+++ b/packages/backend/test/misc/mock-resolver.ts
@@ -18,7 +18,8 @@ type MockResponse = {
 };
 
 export class MockResolver extends Resolver {
-	private _rs = new Map<string, MockResponse>();
+	#responseMap = new Map<string, MockResponse>();
+	#remoteGetTrials: string[] = [];
 
 	constructor(loggerService: LoggerService) {
 		super(
@@ -38,18 +39,28 @@ export class MockResolver extends Resolver {
 		);
 	}
 
-	public async _register(uri: string, content: string | Record<string, any>, type = 'application/activity+json') {
-		this._rs.set(uri, {
+	public register(uri: string, content: string | Record<string, any>, type = 'application/activity+json'): void {
+		this.#responseMap.set(uri, {
 			type,
 			content: typeof content === 'string' ? content : JSON.stringify(content),
 		});
 	}
 
+	public clear(): void {
+		this.#responseMap.clear();
+		this.#remoteGetTrials.length = 0;
+	}
+
+	public remoteGetTrials(): string[] {
+		return this.#remoteGetTrials;
+	}
+
 	@bindThis
 	public async resolve(value: string | IObject): Promise<IObject> {
 		if (typeof value !== 'string') return value;
 
-		const r = this._rs.get(value);
+		this.#remoteGetTrials.push(value);
+		const r = this.#responseMap.get(value);
 
 		if (!r) {
 			throw new Error('Not registed for mock');
diff --git a/packages/backend/test/prelude/get-api-validator.ts b/packages/backend/test/prelude/get-api-validator.ts
index 1f4a2dbc95..f095774760 100644
--- a/packages/backend/test/prelude/get-api-validator.ts
+++ b/packages/backend/test/prelude/get-api-validator.ts
@@ -5,7 +5,7 @@ export const getValidator = (paramDef: Schema) => {
     const ajv = new Ajv({
         useDefaults: true,
     });
-    ajv.addFormat('misskey:id', /^[a-zA-Z0-9]+$/);		
+    ajv.addFormat('misskey:id', /^[a-zA-Z0-9]+$/);
 
     return ajv.compile(paramDef);
 }
diff --git a/packages/backend/test/tsconfig.json b/packages/backend/test/tsconfig.json
index 8a024a678b..21afe1aaf3 100644
--- a/packages/backend/test/tsconfig.json
+++ b/packages/backend/test/tsconfig.json
@@ -9,9 +9,9 @@
 		"noFallthroughCasesInSwitch": true,
 		"declaration": false,
 		"sourceMap": true,
-		"target": "es2021",
+		"target": "ES2022",
 		"module": "es2020",
-		"moduleResolution": "node",
+		"moduleResolution": "node16",
 		"allowSyntheticDefaultImports": true,
 		"removeComments": false,
 		"noLib": false,
@@ -39,6 +39,6 @@
 	"include": [
 		"./**/*.ts",
 		"../src/**/*.test.ts",
-		"../src/@types/**/*.ts",
+		"../src/@types/**/*.ts"
 	]
 }
diff --git a/packages/backend/test/unit/DriveService.ts b/packages/backend/test/unit/DriveService.ts
index 4065665579..9ee6d4bcfb 100644
--- a/packages/backend/test/unit/DriveService.ts
+++ b/packages/backend/test/unit/DriveService.ts
@@ -34,7 +34,7 @@ describe('DriveService', () => {
 		test('delete a file', async () => {
 			s3Mock.on(DeleteObjectCommand)
 				.resolves({} as DeleteObjectCommandOutput);
-			
+
 			await driveService.deleteObjectStorageFile('peace of the world');
 		});
 
diff --git a/packages/backend/test/unit/FetchInstanceMetadataService.ts b/packages/backend/test/unit/FetchInstanceMetadataService.ts
new file mode 100644
index 0000000000..1ee2939829
--- /dev/null
+++ b/packages/backend/test/unit/FetchInstanceMetadataService.ts
@@ -0,0 +1,109 @@
+process.env.NODE_ENV = 'test';
+
+import { jest } from '@jest/globals';
+import { ModuleMocker } from 'jest-mock';
+import { Test } from '@nestjs/testing';
+import { GlobalModule } from '@/GlobalModule.js';
+import { FetchInstanceMetadataService } from '@/core/FetchInstanceMetadataService.js';
+import { FederatedInstanceService } from '@/core/FederatedInstanceService.js';
+import { HttpRequestService } from '@/core/HttpRequestService.js';
+import { LoggerService } from '@/core/LoggerService.js';
+import { UtilityService } from '@/core/UtilityService.js';
+import { IdService } from '@/core/IdService.js';
+import { DI } from '@/di-symbols.js';
+import type { TestingModule } from '@nestjs/testing';
+import type { MockFunctionMetadata } from 'jest-mock';
+import { Redis } from 'ioredis'
+
+function mockRedis() {
+	const hash = {};
+	const set = jest.fn((key, value) => {
+			const ret = hash[key];
+			hash[key] = value;
+			return ret;
+		});
+	return set;
+}
+
+describe('FetchInstanceMetadataService', () => {
+	let app: TestingModule;
+	let fetchInstanceMetadataService: jest.Mocked<FetchInstanceMetadataService>;
+	let federatedInstanceService: jest.Mocked<FederatedInstanceService>;
+	let httpRequestService: jest.Mocked<HttpRequestService>;
+	let redisClient: jest.Mocked<Redis.Redis>;
+
+	beforeAll(async () => {
+		app = await Test
+			.createTestingModule({
+				imports: [
+					GlobalModule,
+				],
+				providers: [
+					FetchInstanceMetadataService,
+					LoggerService,
+					UtilityService,
+					IdService,
+				],
+			})
+			.useMocker((token) => {
+				if (token === HttpRequestService) {
+					return { getJson: jest.fn(), getHtml: jest.fn(), send: jest.fn(), };
+				} else if (token === FederatedInstanceService) {
+					return { fetch: jest.fn() };
+				} else if (token === DI.redis) {
+					return mockRedis;
+				}})
+			.compile();
+
+		app.enableShutdownHooks();
+
+		fetchInstanceMetadataService = app.get<FetchInstanceMetadataService>(FetchInstanceMetadataService);
+		federatedInstanceService = app.get<FederatedInstanceService>(FederatedInstanceService) as jest.Mocked<FederatedInstanceService>;
+		redisClient = app.get<Redis.Redis>(DI.redis) as jest.Mocked<Redis.Redis>;
+		httpRequestService = app.get<HttpRequestService>(HttpRequestService) as jest.Mocked<HttpRequestService>;
+	});
+
+	afterAll(async () => {
+		await app.close();
+	});
+
+	test('Lock and update', async () => {
+		redisClient.set = mockRedis();
+		const now = Date.now();
+		federatedInstanceService.fetch.mockReturnValue({ infoUpdatedAt: { getTime: () => { return now - 10 * 1000 * 60 * 60 * 24; } } });
+		httpRequestService.getJson.mockImplementation(() => { throw Error(); });
+		const tryLockSpy = jest.spyOn(fetchInstanceMetadataService, 'tryLock');
+		const unlockSpy = jest.spyOn(fetchInstanceMetadataService, 'unlock');
+		await fetchInstanceMetadataService.fetchInstanceMetadata({ host: "example.com" });
+		expect(tryLockSpy).toHaveBeenCalledTimes(1);
+		expect(unlockSpy).toHaveBeenCalledTimes(1);
+		expect(federatedInstanceService.fetch).toHaveBeenCalledTimes(1);
+		expect(httpRequestService.getJson).toHaveBeenCalled();
+	});
+	test("Lock and don't update", async () => {
+		redisClient.set = mockRedis();
+		const now = Date.now();
+		federatedInstanceService.fetch.mockReturnValue({ infoUpdatedAt: { getTime: () => now } });
+		httpRequestService.getJson.mockImplementation(() => { throw Error(); });
+		const tryLockSpy = jest.spyOn(fetchInstanceMetadataService, 'tryLock');
+		const unlockSpy = jest.spyOn(fetchInstanceMetadataService, 'unlock');
+		await fetchInstanceMetadataService.fetchInstanceMetadata({ host: "example.com" });
+		expect(tryLockSpy).toHaveBeenCalledTimes(1);
+		expect(unlockSpy).toHaveBeenCalledTimes(1);
+		expect(federatedInstanceService.fetch).toHaveBeenCalledTimes(1);
+		expect(httpRequestService.getJson).toHaveBeenCalledTimes(0);
+	});
+	test('Do nothing when lock not acquired', async () => {
+		redisClient.set = mockRedis();
+		federatedInstanceService.fetch.mockReturnValue({ infoUpdatedAt: { getTime: () => now - 10 * 1000 * 60 * 60 * 24 } });
+		httpRequestService.getJson.mockImplementation(() => { throw Error(); });
+		const tryLockSpy = jest.spyOn(fetchInstanceMetadataService, 'tryLock');
+		const unlockSpy = jest.spyOn(fetchInstanceMetadataService, 'unlock');
+		await fetchInstanceMetadataService.tryLock("example.com");
+		await fetchInstanceMetadataService.fetchInstanceMetadata({ host: "example.com" });
+		expect(tryLockSpy).toHaveBeenCalledTimes(2);
+		expect(unlockSpy).toHaveBeenCalledTimes(0);
+		expect(federatedInstanceService.fetch).toHaveBeenCalledTimes(0);
+		expect(httpRequestService.getJson).toHaveBeenCalledTimes(0);
+	});
+});
diff --git a/packages/backend/test/unit/FileInfoService.ts b/packages/backend/test/unit/FileInfoService.ts
index f378184c74..efb9bdacc3 100644
--- a/packages/backend/test/unit/FileInfoService.ts
+++ b/packages/backend/test/unit/FileInfoService.ts
@@ -94,7 +94,7 @@ describe('FileInfoService', () => {
 				orientation: undefined,
 			});
 		});
-	
+
 		test('Generic APNG', async () => {
 			const path = `${resources}/anime.png`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -114,7 +114,7 @@ describe('FileInfoService', () => {
 				orientation: undefined,
 			});
 		});
-	
+
 		test('Generic AGIF', async () => {
 			const path = `${resources}/anime.gif`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -134,7 +134,7 @@ describe('FileInfoService', () => {
 				orientation: undefined,
 			});
 		});
-	
+
 		test('PNG with alpha', async () => {
 			const path = `${resources}/with-alpha.png`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -154,7 +154,7 @@ describe('FileInfoService', () => {
 				orientation: undefined,
 			});
 		});
-	
+
 		test('Generic SVG', async () => {
 			const path = `${resources}/image.svg`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -174,7 +174,7 @@ describe('FileInfoService', () => {
 				orientation: undefined,
 			});
 		});
-	
+
 		test('SVG with XML definition', async () => {
 			// https://github.com/misskey-dev/misskey/issues/4413
 			const path = `${resources}/with-xml-def.svg`;
@@ -195,7 +195,7 @@ describe('FileInfoService', () => {
 				orientation: undefined,
 			});
 		});
-	
+
 		test('Dimension limit', async () => {
 			const path = `${resources}/25000x25000.png`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -215,7 +215,7 @@ describe('FileInfoService', () => {
 				orientation: undefined,
 			});
 		});
-	
+
 		test('Rotate JPEG', async () => {
 			const path = `${resources}/rotate.jpg`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -257,7 +257,7 @@ describe('FileInfoService', () => {
 				},
 			});
 		});
-	
+
 		test('WAV', async () => {
 			const path = `${resources}/kick_gaba7.wav`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -277,7 +277,7 @@ describe('FileInfoService', () => {
 				},
 			});
 		});
-	
+
 		test('AAC', async () => {
 			const path = `${resources}/kick_gaba7.aac`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -297,7 +297,7 @@ describe('FileInfoService', () => {
 				},
 			});
 		});
-	
+
 		test('FLAC', async () => {
 			const path = `${resources}/kick_gaba7.flac`;
 			const info = await fileInfoService.getFileInfo(path, { skipSensitiveDetection: true }) as any;
@@ -317,7 +317,7 @@ describe('FileInfoService', () => {
 				},
 			});
 		});
-	
+
 		/*
 		 * video/webmとして検出されてしまう
 		test('WEBM AUDIO', async () => {
diff --git a/packages/backend/test/unit/RelayService.ts b/packages/backend/test/unit/RelayService.ts
index c2280142a6..6bf08f5091 100644
--- a/packages/backend/test/unit/RelayService.ts
+++ b/packages/backend/test/unit/RelayService.ts
@@ -61,7 +61,7 @@ describe('RelayService', () => {
 		await app.close();
 	});
 
-	test('addRelay', async () => {	
+	test('addRelay', async () => {
 		const result = await relayService.addRelay('https://example.com');
 
 		expect(result.inbox).toBe('https://example.com');
@@ -72,7 +72,7 @@ describe('RelayService', () => {
 		//expect(queueService.deliver.mock.lastCall![0].username).toBe('relay.actor');
 	});
 
-	test('listRelay', async () => {	
+	test('listRelay', async () => {
 		const result = await relayService.listRelay();
 
 		expect(result.length).toBe(1);
@@ -80,7 +80,7 @@ describe('RelayService', () => {
 		expect(result[0].status).toBe('requesting');
 	});
 
-	test('removeRelay: succ', async () => {	
+	test('removeRelay: succ', async () => {
 		await relayService.removeRelay('https://example.com');
 
 		expect(queueService.deliver).toHaveBeenCalled();
@@ -93,7 +93,7 @@ describe('RelayService', () => {
 		expect(list.length).toBe(0);
 	});
 
-	test('removeRelay: fail', async () => {	
+	test('removeRelay: fail', async () => {
 		await expect(relayService.removeRelay('https://x.example.com'))
 			.rejects.toThrow('relay not found');
 	});
diff --git a/packages/backend/test/unit/RoleService.ts b/packages/backend/test/unit/RoleService.ts
index 907f1f2edc..6979f23e0c 100644
--- a/packages/backend/test/unit/RoleService.ts
+++ b/packages/backend/test/unit/RoleService.ts
@@ -4,7 +4,6 @@ import { jest } from '@jest/globals';
 import { ModuleMocker } from 'jest-mock';
 import { Test } from '@nestjs/testing';
 import * as lolex from '@sinonjs/fake-timers';
-import rndstr from 'rndstr';
 import { GlobalModule } from '@/GlobalModule.js';
 import { RoleService } from '@/core/RoleService.js';
 import type { Role, RolesRepository, RoleAssignmentsRepository, UsersRepository, User } from '@/models/index.js';
@@ -14,6 +13,7 @@ import { genAid } from '@/misc/id/aid.js';
 import { CacheService } from '@/core/CacheService.js';
 import { IdService } from '@/core/IdService.js';
 import { GlobalEventService } from '@/core/GlobalEventService.js';
+import { secureRndstr } from '@/misc/secure-rndstr.js';
 import { sleep } from '../utils.js';
 import type { TestingModule } from '@nestjs/testing';
 import type { MockFunctionMetadata } from 'jest-mock';
@@ -30,7 +30,7 @@ describe('RoleService', () => {
 	let clock: lolex.InstalledClock;
 
 	function createUser(data: Partial<User> = {}) {
-		const un = rndstr('a-z0-9', 16);
+		const un = secureRndstr(16);
 		return usersRepository.insert({
 			id: genAid(new Date()),
 			createdAt: new Date(),
@@ -106,19 +106,19 @@ describe('RoleService', () => {
 	});
 
 	describe('getUserPolicies', () => {
-		test('instance default policies', async () => {	
+		test('instance default policies', async () => {
 			const user = await createUser();
 			metaService.fetch.mockResolvedValue({
 				policies: {
 					canManageCustomEmojis: false,
 				},
 			} as any);
-	
+
 			const result = await roleService.getUserPolicies(user.id);
-	
+
 			expect(result.canManageCustomEmojis).toBe(false);
 		});
-	
+
 		test('instance default policies 2', async () => {
 			const user = await createUser();
 			metaService.fetch.mockResolvedValue({
@@ -126,12 +126,12 @@ describe('RoleService', () => {
 					canManageCustomEmojis: true,
 				},
 			} as any);
-	
+
 			const result = await roleService.getUserPolicies(user.id);
-	
+
 			expect(result.canManageCustomEmojis).toBe(true);
 		});
-	
+
 		test('with role', async () => {
 			const user = await createUser();
 			const role = await createRole({
@@ -150,9 +150,9 @@ describe('RoleService', () => {
 					canManageCustomEmojis: false,
 				},
 			} as any);
-	
+
 			const result = await roleService.getUserPolicies(user.id);
-	
+
 			expect(result.canManageCustomEmojis).toBe(true);
 		});
 
@@ -185,9 +185,9 @@ describe('RoleService', () => {
 					driveCapacityMb: 50,
 				},
 			} as any);
-	
+
 			const result = await roleService.getUserPolicies(user.id);
-	
+
 			expect(result.driveCapacityMb).toBe(100);
 		});
 
@@ -226,7 +226,7 @@ describe('RoleService', () => {
 					canManageCustomEmojis: false,
 				},
 			} as any);
-	
+
 			const user1Policies = await roleService.getUserPolicies(user1.id);
 			const user2Policies = await roleService.getUserPolicies(user2.id);
 			expect(user1Policies.canManageCustomEmojis).toBe(false);
@@ -251,7 +251,7 @@ describe('RoleService', () => {
 					canManageCustomEmojis: false,
 				},
 			} as any);
-	
+
 			const result = await roleService.getUserPolicies(user.id);
 			expect(result.canManageCustomEmojis).toBe(true);
 
diff --git a/packages/backend/test/unit/activitypub.ts b/packages/backend/test/unit/activitypub.ts
index 146998937e..78b916c112 100644
--- a/packages/backend/test/unit/activitypub.ts
+++ b/packages/backend/test/unit/activitypub.ts
@@ -1,10 +1,10 @@
 process.env.NODE_ENV = 'test';
 
 import * as assert from 'assert';
-import rndstr from 'rndstr';
 import { Test } from '@nestjs/testing';
 import { jest } from '@jest/globals';
 
+import { ApImageService } from '@/core/activitypub/models/ApImageService.js';
 import { ApNoteService } from '@/core/activitypub/models/ApNoteService.js';
 import { ApPersonService } from '@/core/activitypub/models/ApPersonService.js';
 import { ApRendererService } from '@/core/activitypub/ApRendererService.js';
@@ -12,15 +12,22 @@ import { GlobalModule } from '@/GlobalModule.js';
 import { CoreModule } from '@/core/CoreModule.js';
 import { FederatedInstanceService } from '@/core/FederatedInstanceService.js';
 import { LoggerService } from '@/core/LoggerService.js';
-import type { IActor } from '@/core/activitypub/type.js';
+import type { IActor, IApDocument, ICollection, IPost } from '@/core/activitypub/type.js';
+import { Meta, Note } from '@/models/index.js';
+import { secureRndstr } from '@/misc/secure-rndstr.js';
+import { DownloadService } from '@/core/DownloadService.js';
+import { MetaService } from '@/core/MetaService.js';
+import type { RemoteUser } from '@/models/entities/User.js';
 import { MockResolver } from '../misc/mock-resolver.js';
-import { Note } from '@/models/index.js';
 
 const host = 'https://host1.test';
 
-function createRandomActor(): IActor & { id: string } {
-	const preferredUsername = `${rndstr('A-Z', 4)}${rndstr('a-z', 4)}`;
-	const actorId = `${host}/users/${preferredUsername.toLowerCase()}`;
+type NonTransientIActor = IActor & { id: string };
+type NonTransientIPost = IPost & { id: string };
+
+function createRandomActor({ actorHost = host } = {}): NonTransientIActor {
+	const preferredUsername = secureRndstr(8);
+	const actorId = `${actorHost}/users/${preferredUsername.toLowerCase()}`;
 
 	return {
 		'@context': 'https://www.w3.org/ns/activitystreams',
@@ -32,16 +39,75 @@ function createRandomActor(): IActor & { id: string } {
 	};
 }
 
+function createRandomNote(actor: NonTransientIActor): NonTransientIPost {
+	const id = secureRndstr(8);
+	const noteId = `${new URL(actor.id).origin}/notes/${id}`;
+
+	return {
+		id: noteId,
+		type: 'Note',
+		attributedTo: actor.id,
+		content: 'test test foo',
+	};
+}
+
+function createRandomNotes(actor: NonTransientIActor, length: number): NonTransientIPost[] {
+	return new Array(length).fill(null).map(() => createRandomNote(actor));
+}
+
+function createRandomFeaturedCollection(actor: NonTransientIActor, length: number): ICollection {
+	const items = createRandomNotes(actor, length);
+
+	return {
+		'@context': 'https://www.w3.org/ns/activitystreams',
+		type: 'Collection',
+		id: actor.outbox as string,
+		totalItems: items.length,
+		items,
+	};
+}
+
+async function createRandomRemoteUser(
+	resolver: MockResolver,
+	personService: ApPersonService,
+): Promise<RemoteUser> {
+	const actor = createRandomActor();
+	resolver.register(actor.id, actor);
+
+	return await personService.createPerson(actor.id, resolver);
+}
+
 describe('ActivityPub', () => {
+	let imageService: ApImageService;
 	let noteService: ApNoteService;
 	let personService: ApPersonService;
 	let rendererService: ApRendererService;
 	let resolver: MockResolver;
 
-	beforeEach(async () => {
+	const metaInitial = {
+		cacheRemoteFiles: true,
+		cacheRemoteSensitiveFiles: true,
+		blockedHosts: [] as string[],
+		sensitiveWords: [] as string[],
+	} as Meta;
+	let meta = metaInitial;
+
+	beforeAll(async () => {
 		const app = await Test.createTestingModule({
 			imports: [GlobalModule, CoreModule],
-		}).compile();
+		})
+			.overrideProvider(DownloadService).useValue({
+				async downloadUrl(): Promise<{ filename: string }> {
+					return {
+						filename: 'dummy.tmp',
+					};
+				},
+			})
+			.overrideProvider(MetaService).useValue({
+				async fetch(): Promise<Meta> {
+					return meta;
+				},
+			}).compile();
 
 		await app.init();
 		app.enableShutdownHooks();
@@ -49,11 +115,16 @@ describe('ActivityPub', () => {
 		noteService = app.get<ApNoteService>(ApNoteService);
 		personService = app.get<ApPersonService>(ApPersonService);
 		rendererService = app.get<ApRendererService>(ApRendererService);
+		imageService = app.get<ApImageService>(ApImageService);
 		resolver = new MockResolver(await app.resolve<LoggerService>(LoggerService));
 
 		// Prevent ApPersonService from fetching instance, as it causes Jest import-after-test error
 		const federatedInstanceService = app.get<FederatedInstanceService>(FederatedInstanceService);
-		jest.spyOn(federatedInstanceService, 'fetch').mockImplementation(() => new Promise(() => {}));
+		jest.spyOn(federatedInstanceService, 'fetch').mockImplementation(() => new Promise(() => { }));
+	});
+
+	beforeEach(() => {
+		resolver.clear();
 	});
 
 	describe('Parse minimum object', () => {
@@ -61,7 +132,7 @@ describe('ActivityPub', () => {
 
 		const post = {
 			'@context': 'https://www.w3.org/ns/activitystreams',
-			id: `${host}/users/${rndstr('0-9a-z', 8)}`,
+			id: `${host}/users/${secureRndstr(8)}`,
 			type: 'Note',
 			attributedTo: actor.id,
 			to: 'https://www.w3.org/ns/activitystreams#Public',
@@ -69,7 +140,7 @@ describe('ActivityPub', () => {
 		};
 
 		test('Minimum Actor', async () => {
-			resolver._register(actor.id, actor);
+			resolver.register(actor.id, actor);
 
 			const user = await personService.createPerson(actor.id, resolver);
 
@@ -79,8 +150,8 @@ describe('ActivityPub', () => {
 		});
 
 		test('Minimum Note', async () => {
-			resolver._register(actor.id, actor);
-			resolver._register(post.id, post);
+			resolver.register(actor.id, actor);
+			resolver.register(post.id, post);
 
 			const note = await noteService.createNote(post.id, resolver, true);
 
@@ -94,10 +165,10 @@ describe('ActivityPub', () => {
 		test('Truncate long name', async () => {
 			const actor = {
 				...createRandomActor(),
-				name: rndstr('0-9a-z', 129),
+				name: secureRndstr(129),
 			};
 
-			resolver._register(actor.id, actor);
+			resolver.register(actor.id, actor);
 
 			const user = await personService.createPerson(actor.id, resolver);
 
@@ -110,7 +181,7 @@ describe('ActivityPub', () => {
 				name: '',
 			};
 
-			resolver._register(actor.id, actor);
+			resolver.register(actor.id, actor);
 
 			const user = await personService.createPerson(actor.id, resolver);
 
@@ -126,4 +197,149 @@ describe('ActivityPub', () => {
 			} as Note);
 		});
 	});
+
+	describe('Featured', () => {
+		test('Fetch featured notes from IActor', async () => {
+			const actor = createRandomActor();
+			actor.featured = `${actor.id}/collections/featured`;
+
+			const featured = createRandomFeaturedCollection(actor, 5);
+
+			resolver.register(actor.id, actor);
+			resolver.register(actor.featured, featured);
+
+			await personService.createPerson(actor.id, resolver);
+
+			// All notes in `featured` are same-origin, no need to fetch notes again
+			assert.deepStrictEqual(resolver.remoteGetTrials(), [actor.id, actor.featured]);
+
+			// Created notes without resolving anything
+			for (const item of featured.items as IPost[]) {
+				const note = await noteService.fetchNote(item);
+				assert.ok(note);
+				assert.strictEqual(note.text, 'test test foo');
+				assert.strictEqual(note.uri, item.id);
+			}
+		});
+
+		test('Fetch featured notes from IActor pointing to another remote server', async () => {
+			const actor1 = createRandomActor();
+			actor1.featured = `${actor1.id}/collections/featured`;
+			const actor2 = createRandomActor({ actorHost: 'https://host2.test' });
+
+			const actor2Note = createRandomNote(actor2);
+			const featured = createRandomFeaturedCollection(actor1, 0);
+			(featured.items as IPost[]).push({
+				...actor2Note,
+				content: 'test test bar', // fraud!
+			});
+
+			resolver.register(actor1.id, actor1);
+			resolver.register(actor1.featured, featured);
+			resolver.register(actor2.id, actor2);
+			resolver.register(actor2Note.id, actor2Note);
+
+			await personService.createPerson(actor1.id, resolver);
+
+			// actor2Note is from a different server and needs to be fetched again
+			assert.deepStrictEqual(
+				resolver.remoteGetTrials(),
+				[actor1.id, actor1.featured, actor2Note.id, actor2.id],
+			);
+
+			const note = await noteService.fetchNote(actor2Note.id);
+			assert.ok(note);
+
+			// Reflects the original content instead of the fraud
+			assert.strictEqual(note.text, 'test test foo');
+			assert.strictEqual(note.uri, actor2Note.id);
+		});
+	});
+
+	describe('Images', () => {
+		test('Create images', async () => {
+			const imageObject: IApDocument = {
+				type: 'Document',
+				mediaType: 'image/png',
+				url: 'http://host1.test/foo.png',
+				name: '',
+			};
+			const driveFile = await imageService.createImage(
+				await createRandomRemoteUser(resolver, personService),
+				imageObject,
+			);
+			assert.ok(!driveFile.isLink);
+
+			const sensitiveImageObject: IApDocument = {
+				type: 'Document',
+				mediaType: 'image/png',
+				url: 'http://host1.test/bar.png',
+				name: '',
+				sensitive: true,
+			};
+			const sensitiveDriveFile = await imageService.createImage(
+				await createRandomRemoteUser(resolver, personService),
+				sensitiveImageObject,
+			);
+			assert.ok(!sensitiveDriveFile.isLink);
+		});
+
+		test('cacheRemoteFiles=false disables caching', async () => {
+			meta = { ...metaInitial, cacheRemoteFiles: false };
+
+			const imageObject: IApDocument = {
+				type: 'Document',
+				mediaType: 'image/png',
+				url: 'http://host1.test/foo.png',
+				name: '',
+			};
+			const driveFile = await imageService.createImage(
+				await createRandomRemoteUser(resolver, personService),
+				imageObject,
+			);
+			assert.ok(driveFile.isLink);
+
+			const sensitiveImageObject: IApDocument = {
+				type: 'Document',
+				mediaType: 'image/png',
+				url: 'http://host1.test/bar.png',
+				name: '',
+				sensitive: true,
+			};
+			const sensitiveDriveFile = await imageService.createImage(
+				await createRandomRemoteUser(resolver, personService),
+				sensitiveImageObject,
+			);
+			assert.ok(sensitiveDriveFile.isLink);
+		});
+
+		test('cacheRemoteSensitiveFiles=false only affects sensitive files', async () => {
+			meta = { ...metaInitial, cacheRemoteSensitiveFiles: false };
+
+			const imageObject: IApDocument = {
+				type: 'Document',
+				mediaType: 'image/png',
+				url: 'http://host1.test/foo.png',
+				name: '',
+			};
+			const driveFile = await imageService.createImage(
+				await createRandomRemoteUser(resolver, personService),
+				imageObject,
+			);
+			assert.ok(!driveFile.isLink);
+
+			const sensitiveImageObject: IApDocument = {
+				type: 'Document',
+				mediaType: 'image/png',
+				url: 'http://host1.test/bar.png',
+				name: '',
+				sensitive: true,
+			};
+			const sensitiveDriveFile = await imageService.createImage(
+				await createRandomRemoteUser(resolver, personService),
+				sensitiveImageObject,
+			);
+			assert.ok(sensitiveDriveFile.isLink);
+		});
+	});
 });
diff --git a/packages/backend/test/unit/chart.ts b/packages/backend/test/unit/chart.ts
index 5ac4cc18a2..40554d3a47 100644
--- a/packages/backend/test/unit/chart.ts
+++ b/packages/backend/test/unit/chart.ts
@@ -475,16 +475,16 @@ describe('Chart', () => {
 				await testIntersectionChart.addA('bob');
 				await testIntersectionChart.addB('carol');
 				await testIntersectionChart.save();
-	
+
 				const chartHours = await testIntersectionChart.getChart('hour', 3, null);
 				const chartDays = await testIntersectionChart.getChart('day', 3, null);
-	
+
 				assert.deepStrictEqual(chartHours, {
 					a: [2, 0, 0],
 					b: [1, 0, 0],
 					aAndB: [0, 0, 0],
 				});
-	
+
 				assert.deepStrictEqual(chartDays, {
 					a: [2, 0, 0],
 					b: [1, 0, 0],
@@ -498,16 +498,16 @@ describe('Chart', () => {
 				await testIntersectionChart.addB('carol');
 				await testIntersectionChart.addB('alice');
 				await testIntersectionChart.save();
-	
+
 				const chartHours = await testIntersectionChart.getChart('hour', 3, null);
 				const chartDays = await testIntersectionChart.getChart('day', 3, null);
-	
+
 				assert.deepStrictEqual(chartHours, {
 					a: [2, 0, 0],
 					b: [2, 0, 0],
 					aAndB: [1, 0, 0],
 				});
-	
+
 				assert.deepStrictEqual(chartDays, {
 					a: [2, 0, 0],
 					b: [2, 0, 0],
diff --git a/packages/backend/test/utils.ts b/packages/backend/test/utils.ts
index 22f7d81e4e..31ea3e5ab8 100644
--- a/packages/backend/test/utils.ts
+++ b/packages/backend/test/utils.ts
@@ -2,7 +2,7 @@ import * as assert from 'node:assert';
 import { readFile } from 'node:fs/promises';
 import { isAbsolute, basename } from 'node:path';
 import { inspect } from 'node:util';
-import WebSocket from 'ws';
+import WebSocket, { ClientOptions } from 'ws';
 import fetch, { Blob, File, RequestInit } from 'node-fetch';
 import { DataSource } from 'typeorm';
 import { JSDOM } from 'jsdom';
@@ -13,14 +13,19 @@ import type * as misskey from 'misskey-js';
 
 export { server as startServer } from '@/boot/common.js';
 
+interface UserToken {
+	token: string;
+	bearer?: boolean;
+}
+
 const config = loadConfig();
 export const port = config.port;
 
-export const cookie = (me: any): string => {
+export const cookie = (me: UserToken): string => {
 	return `token=${me.token};`;
 };
 
-export const api = async (endpoint: string, params: any, me?: any) => {
+export const api = async (endpoint: string, params: any, me?: UserToken) => {
 	const normalized = endpoint.replace(/^\//, '');
 	return await request(`api/${normalized}`, params, me);
 };
@@ -28,7 +33,7 @@ export const api = async (endpoint: string, params: any, me?: any) => {
 export type ApiRequest = {
 	endpoint: string,
 	parameters: object,
-	user: object | undefined,
+	user: UserToken | undefined,
 };
 
 export const successfulApiCall = async <T, >(request: ApiRequest, assertion: {
@@ -55,27 +60,33 @@ export const failedApiCall = async <T, >(request: ApiRequest, assertion: {
 	return res.body;
 };
 
-const request = async (path: string, params: any, me?: any): Promise<{ body: any, status: number }> => {
-	const auth = me ? {
-		i: me.token,
-	} : {};
+const request = async (path: string, params: any, me?: UserToken): Promise<{ status: number, headers: Headers, body: any }> => {
+	const bodyAuth: Record<string, string> = {};
+	const headers: Record<string, string> = {
+		'Content-Type': 'application/json',
+	};
+
+	if (me?.bearer) {
+		headers.Authorization = `Bearer ${me.token}`;
+	} else if (me) {
+		bodyAuth.i = me.token;
+	}
 
 	const res = await relativeFetch(path, {
 		method: 'POST',
-		headers: {
-			'Content-Type': 'application/json',
-		},
-		body: JSON.stringify(Object.assign(auth, params)),
+		headers,
+		body: JSON.stringify(Object.assign(bodyAuth, params)),
 		redirect: 'manual',
 	});
 
-	const status = res.status;
 	const body = res.headers.get('content-type') === 'application/json; charset=utf-8'
 		? await res.json()
 		: null;
 
 	return {
-		body, status,
+		status: res.status,
+		headers: res.headers,
+		body,
 	};
 };
 
@@ -83,7 +94,7 @@ const relativeFetch = async (path: string, init?: RequestInit | undefined) => {
 	return await fetch(new URL(path, `http://127.0.0.1:${port}/`).toString(), init);
 };
 
-export const signup = async (params?: any): Promise<any> => {
+export const signup = async (params?: Partial<misskey.Endpoints['signup']['req']>): Promise<NonNullable<misskey.Endpoints['signup']['res']>> => {
 	const q = Object.assign({
 		username: 'test',
 		password: 'test',
@@ -94,7 +105,7 @@ export const signup = async (params?: any): Promise<any> => {
 	return res.body;
 };
 
-export const post = async (user: any, params?: misskey.Endpoints['notes/create']['req']): Promise<misskey.entities.Note> => {
+export const post = async (user: UserToken, params?: misskey.Endpoints['notes/create']['req']): Promise<misskey.entities.Note> => {
 	const q = params;
 
 	const res = await api('notes/create', q, user);
@@ -117,21 +128,21 @@ export const hiddenNote = (note: any): any => {
 	return temp;
 };
 
-export const react = async (user: any, note: any, reaction: string): Promise<any> => {
+export const react = async (user: UserToken, note: any, reaction: string): Promise<any> => {
 	await api('notes/reactions/create', {
 		noteId: note.id,
 		reaction: reaction,
 	}, user);
 };
 
-export const userList = async (user: any, userList: any = {}): Promise<any> => {
+export const userList = async (user: UserToken, userList: any = {}): Promise<any> => {
 	const res = await api('users/lists/create', {
 		name: 'test',
 	}, user);
 	return res.body;
 };
 
-export const page = async (user: any, page: any = {}): Promise<any> => {
+export const page = async (user: UserToken, page: any = {}): Promise<any> => {
 	const res = await api('pages/create', {
 		alignCenter: false,
 		content: [
@@ -154,7 +165,7 @@ export const page = async (user: any, page: any = {}): Promise<any> => {
 	return res.body;
 };
 
-export const play = async (user: any, play: any = {}): Promise<any> => {
+export const play = async (user: UserToken, play: any = {}): Promise<any> => {
 	const res = await api('flash/create', {
 		permissions: [],
 		script: 'test',
@@ -165,7 +176,7 @@ export const play = async (user: any, play: any = {}): Promise<any> => {
 	return res.body;
 };
 
-export const clip = async (user: any, clip: any = {}): Promise<any> => {
+export const clip = async (user: UserToken, clip: any = {}): Promise<any> => {
 	const res = await api('clips/create', {
 		description: null,
 		isPublic: true,
@@ -175,7 +186,7 @@ export const clip = async (user: any, clip: any = {}): Promise<any> => {
 	return res.body;
 };
 
-export const galleryPost = async (user: any, channel: any = {}): Promise<any> => {
+export const galleryPost = async (user: UserToken, channel: any = {}): Promise<any> => {
 	const res = await api('gallery/posts/create', {
 		description: null,
 		fileIds: [],
@@ -186,7 +197,7 @@ export const galleryPost = async (user: any, channel: any = {}): Promise<any> =>
 	return res.body;
 };
 
-export const channel = async (user: any, channel: any = {}): Promise<any> => {
+export const channel = async (user: UserToken, channel: any = {}): Promise<any> => {
 	const res = await api('channels/create', {
 		bannerId: null,
 		description: null,
@@ -196,7 +207,7 @@ export const channel = async (user: any, channel: any = {}): Promise<any> => {
 	return res.body;
 };
 
-export const role = async (user: any, role: any = {}, policies: any = {}): Promise<any> => {
+export const role = async (user: UserToken, role: any = {}, policies: any = {}): Promise<any> => {
 	const res = await api('admin/roles/create', {
 		asBadge: false,
 		canEditMembersByModerator: false,
@@ -213,8 +224,8 @@ export const role = async (user: any, role: any = {}, policies: any = {}): Promi
 		isPublic: false,
 		name: 'New Role',
 		target: 'manual',
-		policies: { 
-			...Object.entries(DEFAULT_POLICIES).map(([k, v]) => [k, { 
+		policies: {
+			...Object.entries(DEFAULT_POLICIES).map(([k, v]) => [k, {
 				priority: 0,
 				useDefault: true,
 				value: v,
@@ -239,7 +250,7 @@ interface UploadOptions {
  * Upload file
  * @param user User
  */
-export const uploadFile = async (user: any, { path, name, blob }: UploadOptions = {}): Promise<any> => {
+export const uploadFile = async (user?: UserToken, { path, name, blob }: UploadOptions = {}): Promise<{ status: number, headers: Headers, body: misskey.Endpoints['drive/files/create']['res'] | null }> => {
 	const absPath = path == null
 		? new URL('resources/Lenna.jpg', import.meta.url)
 		: isAbsolute(path.toString())
@@ -247,7 +258,6 @@ export const uploadFile = async (user: any, { path, name, blob }: UploadOptions
 			: new URL(path, new URL('resources/', import.meta.url));
 
 	const formData = new FormData();
-	formData.append('i', user.token);
 	formData.append('file', blob ??
 		new File([await readFile(absPath)], basename(absPath.toString())));
 	formData.append('force', 'true');
@@ -255,20 +265,29 @@ export const uploadFile = async (user: any, { path, name, blob }: UploadOptions
 		formData.append('name', name);
 	}
 
+	const headers: Record<string, string> = {};
+	if (user?.bearer) {
+		headers.Authorization = `Bearer ${user.token}`;
+	} else if (user) {
+		formData.append('i', user.token);
+	}
+
 	const res = await relativeFetch('api/drive/files/create', {
 		method: 'POST',
 		body: formData,
+		headers,
 	});
 
-	const body = res.status !== 204 ? await res.json() : null;
+	const body = res.status !== 204 ? await res.json() as misskey.Endpoints['drive/files/create']['res'] : null;
 
 	return {
 		status: res.status,
+		headers: res.headers,
 		body,
 	};
 };
 
-export const uploadUrl = async (user: any, url: string) => {
+export const uploadUrl = async (user: UserToken, url: string) => {
 	let file: any;
 	const marker = Math.random().toString();
 
@@ -290,10 +309,18 @@ export const uploadUrl = async (user: any, url: string) => {
 	return file;
 };
 
-export function connectStream(user: any, channel: string, listener: (message: Record<string, any>) => any, params?: any): Promise<WebSocket> {
+export function connectStream(user: UserToken, channel: string, listener: (message: Record<string, any>) => any, params?: any): Promise<WebSocket> {
 	return new Promise((res, rej) => {
-		const ws = new WebSocket(`ws://127.0.0.1:${port}/streaming?i=${user.token}`);
+		const url = new URL(`ws://127.0.0.1:${port}/streaming`);
+		const options: ClientOptions = {};
+		if (user.bearer) {
+			options.headers = { Authorization: `Bearer ${user.token}` };
+		} else {
+			url.searchParams.set('i', user.token);
+		}
+		const ws = new WebSocket(url, options);
 
+		ws.on('unexpected-response', (req, res) => rej(res));
 		ws.on('open', () => {
 			ws.on('message', data => {
 				const msg = JSON.parse(data.toString());
@@ -317,7 +344,7 @@ export function connectStream(user: any, channel: string, listener: (message: Re
 	});
 }
 
-export const waitFire = async (user: any, channel: string, trgr: () => any, cond: (msg: Record<string, any>) => boolean, params?: any) => {
+export const waitFire = async (user: UserToken, channel: string, trgr: () => any, cond: (msg: Record<string, any>) => boolean, params?: any) => {
 	return new Promise<boolean>(async (res, rej) => {
 		let timer: NodeJS.Timeout | null = null;
 
@@ -351,11 +378,11 @@ export const waitFire = async (user: any, channel: string, trgr: () => any, cond
 	});
 };
 
-export type SimpleGetResponse = { 
-	status: number, 
-	body: any | JSDOM | null, 
-	type: string | null, 
-	location: string | null 
+export type SimpleGetResponse = {
+	status: number,
+	body: any | JSDOM | null,
+	type: string | null,
+	location: string | null
 };
 export const simpleGet = async (path: string, accept = '*/*', cookie: any = undefined): Promise<SimpleGetResponse> => {
 	const res = await relativeFetch(path, {
@@ -374,9 +401,9 @@ export const simpleGet = async (path: string, accept = '*/*', cookie: any = unde
 		'text/html; charset=utf-8',
 	];
 
-	const body = 
-		jsonTypes.includes(res.headers.get('content-type') ?? '')	? await res.json() : 
-		htmlTypes.includes(res.headers.get('content-type') ?? '')	? new JSDOM(await res.text()) : 
+	const body =
+		jsonTypes.includes(res.headers.get('content-type') ?? '')	? await res.json() :
+		htmlTypes.includes(res.headers.get('content-type') ?? '')	? new JSDOM(await res.text()) :
 		null;
 
 	return {
@@ -420,12 +447,12 @@ export async function testPaginationConsistency<Entity extends { id: string, cre
 	for (const limit of [1, 5, 10, 100, undefined]) {
 		// 1. sinceId/DateとuntilId/Dateで両端を指定して取得した結果が期待通りになっていること
 		if (ordering === 'desc') {
-			const end = expected[expected.length - 1];
+			const end = expected.at(-1)!;
 			let last = await fetchEntities(rangeToParam({ limit, since: end }));
 			const actual: Entity[] = [];
 			while (last.length !== 0) {
 				actual.push(...last);
-				last = await fetchEntities(rangeToParam({ limit, until: last[last.length - 1], since: end }));
+				last = await fetchEntities(rangeToParam({ limit, until: last.at(-1), since: end }));
 			}
 			actual.push(end);
 			assert.deepStrictEqual(
@@ -440,7 +467,7 @@ export async function testPaginationConsistency<Entity extends { id: string, cre
 			const actual: Entity[] = [];
 			while (last.length !== 0) {
 				actual.push(...last);
-				last = await fetchEntities(rangeToParam({ limit, since: last[last.length - 1] }));
+				last = await fetchEntities(rangeToParam({ limit, since: last.at(-1) }));
 			}
 			assert.deepStrictEqual(
 				actual.map(({ id, createdAt }) => id + ':' + createdAt),
@@ -453,7 +480,7 @@ export async function testPaginationConsistency<Entity extends { id: string, cre
 			const actual: Entity[] = [];
 			while (last.length !== 0) {
 				actual.push(...last);
-				last = await fetchEntities(rangeToParam({ limit, until: last[last.length - 1] }));
+				last = await fetchEntities(rangeToParam({ limit, until: last.at(-1) }));
 			}
 			assert.deepStrictEqual(
 				actual.map(({ id, createdAt }) => id + ':' + createdAt),