git.squeep.com Git - akkoma/blob - test/pleroma/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.User
  12   alias Pleroma.Web.CommonAPI
  13
  14   setup do
  15     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  16     :ok
  17   end
  18
  19   describe "home" do
  20     setup do: oauth_access(["read:statuses"])
  21
  22     test "does NOT embed account/pleroma/relationship in statuses", %{
  23       user: user,
  24       conn: conn
  25     } do
  26       other_user = insert(:user)
  27
  28       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  29
  30       response =
  31         conn
  32         |> assign(:user, user)
  33         |> get("/api/v1/timelines/home")
  34         |> json_response_and_validate_schema(200)
  35
  36       assert Enum.all?(response, fn n ->
  37                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  38              end)
  39     end
  40
  41     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  42       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  43       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  44
  45       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  46
  47       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  48
  49       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  50
  51       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  52       assert public_activity.id in status_ids
  53       assert unlisted_activity.id in status_ids
  54       assert private_activity.id in status_ids
  55       refute direct_activity.id in status_ids
  56     end
  57   end
  58
  59   describe "public" do
  60     @tag capture_log: true
  61     test "the public timeline", %{conn: conn} do
  62       user = insert(:user)
  63
  64       {:ok, activity} = CommonAPI.post(user, %{status: "test"})
  65
  66       _activity = insert(:note_activity, local: false)
  67
  68       conn = get(conn, "/api/v1/timelines/public?local=False")
  69
  70       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  71
  72       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  73
  74       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  75
  76       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  77
  78       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  79
  80       # does not contain repeats
  81       {:ok, _} = CommonAPI.repeat(activity.id, user)
  82
  83       conn = get(build_conn(), "/api/v1/timelines/public?local=true")
  84
  85       assert [_] = json_response_and_validate_schema(conn, :ok)
  86     end
  87
  88     test "the public timeline includes only public statuses for an authenticated user" do
  89       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  90
  91       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  92       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  93       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  94       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  95
  96       res_conn = get(conn, "/api/v1/timelines/public")
  97       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  98     end
  99
 100     test "doesn't return replies if follower is posting with blocked user" do
 101       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 102       [blockee, friend] = insert_list(2, :user)
 103       {:ok, blocker} = User.follow(blocker, friend)
 104       {:ok, _} = User.block(blocker, blockee)
 105
 106       conn = assign(conn, :user, blocker)
 107
 108       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 109
 110       {:ok, reply_from_blockee} =
 111         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 112
 113       {:ok, _reply_from_friend} =
 114         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 115
 116       # Still shows replies from yourself
 117       {:ok, %{id: reply_from_me}} =
 118         CommonAPI.post(blocker, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 119
 120       response =
 121         get(conn, "/api/v1/timelines/public")
 122         |> json_response_and_validate_schema(200)
 123
 124       assert length(response) == 2
 125       [%{"id" => ^reply_from_me}, %{"id" => ^activity_id}] = response
 126     end
 127
 128     test "doesn't return replies if follow is posting with users from blocked domain" do
 129       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 130       friend = insert(:user)
 131       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 132       {:ok, blocker} = User.follow(blocker, friend)
 133       {:ok, blocker} = User.block_domain(blocker, "example.com")
 134
 135       conn = assign(conn, :user, blocker)
 136
 137       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 138
 139       {:ok, reply_from_blockee} =
 140         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 141
 142       {:ok, _reply_from_friend} =
 143         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 144
 145       res_conn = get(conn, "/api/v1/timelines/public")
 146
 147       activities = json_response_and_validate_schema(res_conn, 200)
 148       [%{"id" => ^activity_id}] = activities
 149     end
 150   end
 151
 152   defp local_and_remote_activities do
 153     insert(:note_activity)
 154     insert(:note_activity, local: false)
 155     :ok
 156   end
 157
 158   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 159     setup do: local_and_remote_activities()
 160
 161     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 162
 163     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 164
 165     test "if user is unauthenticated", %{conn: conn} do
 166       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 167
 168       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 169                "error" => "authorization required for timeline view"
 170              }
 171
 172       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 173
 174       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 175                "error" => "authorization required for timeline view"
 176              }
 177     end
 178
 179     test "if user is authenticated" do
 180       %{conn: conn} = oauth_access(["read:statuses"])
 181
 182       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 183       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 184
 185       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 186       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 187     end
 188   end
 189
 190   describe "public with restrict unauthenticated timeline for local" do
 191     setup do: local_and_remote_activities()
 192
 193     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 194
 195     test "if user is unauthenticated", %{conn: conn} do
 196       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 197
 198       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 199                "error" => "authorization required for timeline view"
 200              }
 201
 202       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 203       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 204     end
 205
 206     test "if user is authenticated", %{conn: _conn} do
 207       %{conn: conn} = oauth_access(["read:statuses"])
 208
 209       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 210       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 211
 212       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 213       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 214     end
 215   end
 216
 217   describe "public with restrict unauthenticated timeline for remote" do
 218     setup do: local_and_remote_activities()
 219
 220     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 221
 222     test "if user is unauthenticated", %{conn: conn} do
 223       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 224       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 225
 226       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 227
 228       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 229                "error" => "authorization required for timeline view"
 230              }
 231     end
 232
 233     test "if user is authenticated", %{conn: _conn} do
 234       %{conn: conn} = oauth_access(["read:statuses"])
 235
 236       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 237       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 238
 239       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 240       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 241     end
 242   end
 243
 244   describe "direct" do
 245     test "direct timeline", %{conn: conn} do
 246       user_one = insert(:user)
 247       user_two = insert(:user)
 248
 249       {:ok, user_two} = User.follow(user_two, user_one)
 250
 251       {:ok, direct} =
 252         CommonAPI.post(user_one, %{
 253           status: "Hi @#{user_two.nickname}!",
 254           visibility: "direct"
 255         })
 256
 257       {:ok, _follower_only} =
 258         CommonAPI.post(user_one, %{
 259           status: "Hi @#{user_two.nickname}!",
 260           visibility: "private"
 261         })
 262
 263       conn_user_two =
 264         conn
 265         |> assign(:user, user_two)
 266         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 267
 268       # Only direct should be visible here
 269       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 270
 271       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 272
 273       assert %{"visibility" => "direct"} = status
 274       assert status["url"] != direct.data["id"]
 275
 276       # User should be able to see their own direct message
 277       res_conn =
 278         build_conn()
 279         |> assign(:user, user_one)
 280         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 281         |> get("api/v1/timelines/direct")
 282
 283       [status] = json_response_and_validate_schema(res_conn, :ok)
 284
 285       assert %{"visibility" => "direct"} = status
 286
 287       # Both should be visible here
 288       res_conn = get(conn_user_two, "api/v1/timelines/home")
 289
 290       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 291
 292       # Test pagination
 293       Enum.each(1..20, fn _ ->
 294         {:ok, _} =
 295           CommonAPI.post(user_one, %{
 296             status: "Hi @#{user_two.nickname}!",
 297             visibility: "direct"
 298           })
 299       end)
 300
 301       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 302
 303       statuses = json_response_and_validate_schema(res_conn, :ok)
 304       assert length(statuses) == 20
 305
 306       max_id = List.last(statuses)["id"]
 307
 308       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 309
 310       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 311
 312       assert status["url"] != direct.data["id"]
 313     end
 314
 315     test "doesn't include DMs from blocked users" do
 316       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 317       blocked = insert(:user)
 318       other_user = insert(:user)
 319       {:ok, _user_relationship} = User.block(blocker, blocked)
 320
 321       {:ok, _blocked_direct} =
 322         CommonAPI.post(blocked, %{
 323           status: "Hi @#{blocker.nickname}!",
 324           visibility: "direct"
 325         })
 326
 327       {:ok, direct} =
 328         CommonAPI.post(other_user, %{
 329           status: "Hi @#{blocker.nickname}!",
 330           visibility: "direct"
 331         })
 332
 333       res_conn = get(conn, "api/v1/timelines/direct")
 334
 335       [status] = json_response_and_validate_schema(res_conn, :ok)
 336       assert status["id"] == direct.id
 337     end
 338   end
 339
 340   describe "list" do
 341     setup do: oauth_access(["read:lists"])
 342
 343     test "does not contain retoots", %{user: user, conn: conn} do
 344       other_user = insert(:user)
 345       {:ok, activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 346       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is stupid."})
 347       {:ok, _} = CommonAPI.repeat(activity_one.id, other_user)
 348
 349       {:ok, list} = Pleroma.List.create("name", user)
 350       {:ok, list} = Pleroma.List.follow(list, other_user)
 351
 352       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 353
 354       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 355
 356       assert id == to_string(activity_two.id)
 357     end
 358
 359     test "works with pagination", %{user: user, conn: conn} do
 360       other_user = insert(:user)
 361       {:ok, list} = Pleroma.List.create("name", user)
 362       {:ok, list} = Pleroma.List.follow(list, other_user)
 363
 364       Enum.each(1..30, fn i ->
 365         CommonAPI.post(other_user, %{status: "post number #{i}"})
 366       end)
 367
 368       res =
 369         get(conn, "/api/v1/timelines/list/#{list.id}?limit=1")
 370         |> json_response_and_validate_schema(:ok)
 371
 372       assert length(res) == 1
 373
 374       [first] = res
 375
 376       res =
 377         get(conn, "/api/v1/timelines/list/#{list.id}?max_id=#{first["id"]}&limit=30")
 378         |> json_response_and_validate_schema(:ok)
 379
 380       assert length(res) == 29
 381     end
 382
 383     test "list timeline", %{user: user, conn: conn} do
 384       other_user = insert(:user)
 385       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 386       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 387       {:ok, list} = Pleroma.List.create("name", user)
 388       {:ok, list} = Pleroma.List.follow(list, other_user)
 389
 390       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 391
 392       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 393
 394       assert id == to_string(activity_two.id)
 395     end
 396
 397     test "list timeline does not leak non-public statuses for unfollowed users", %{
 398       user: user,
 399       conn: conn
 400     } do
 401       other_user = insert(:user)
 402       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 403
 404       {:ok, _activity_two} =
 405         CommonAPI.post(other_user, %{
 406           status: "Marisa is cute.",
 407           visibility: "private"
 408         })
 409
 410       {:ok, list} = Pleroma.List.create("name", user)
 411       {:ok, list} = Pleroma.List.follow(list, other_user)
 412
 413       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 414
 415       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 416
 417       assert id == to_string(activity_one.id)
 418     end
 419   end
 420
 421   describe "hashtag" do
 422     setup do: oauth_access(["n/a"])
 423
 424     @tag capture_log: true
 425     test "hashtag timeline", %{conn: conn} do
 426       following = insert(:user)
 427
 428       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 429
 430       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 431
 432       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 433
 434       assert id == to_string(activity.id)
 435
 436       # works for different capitalization too
 437       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 438
 439       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 440
 441       assert id == to_string(activity.id)
 442     end
 443
 444     test "multi-hashtag timeline", %{conn: conn} do
 445       user = insert(:user)
 446
 447       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 448       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 449       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 450
 451       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 452
 453       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 454
 455       assert to_string(activity_test.id) == status_test["id"]
 456       assert to_string(activity_test1.id) == status_test1["id"]
 457       assert to_string(activity_none.id) == status_none["id"]
 458
 459       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 460
 461       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 462
 463       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 464
 465       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 466     end
 467   end
 468
 469   describe "hashtag timeline handling of :restrict_unauthenticated setting" do
 470     setup do
 471       user = insert(:user)
 472       {:ok, activity1} = CommonAPI.post(user, %{status: "test #tag1"})
 473       {:ok, _activity2} = CommonAPI.post(user, %{status: "test #tag1"})
 474
 475       activity1
 476       |> Ecto.Changeset.change(%{local: false})
 477       |> Pleroma.Repo.update()
 478
 479       base_uri = "/api/v1/timelines/tag/tag1"
 480       error_response = %{"error" => "authorization required for timeline view"}
 481
 482       %{base_uri: base_uri, error_response: error_response}
 483     end
 484
 485     defp ensure_authenticated_access(base_uri) do
 486       %{conn: auth_conn} = oauth_access(["read:statuses"])
 487
 488       res_conn = get(auth_conn, "#{base_uri}?local=true")
 489       assert length(json_response(res_conn, 200)) == 1
 490
 491       res_conn = get(auth_conn, "#{base_uri}?local=false")
 492       assert length(json_response(res_conn, 200)) == 2
 493     end
 494
 495     test "with default settings on private instances, returns 403 for unauthenticated users", %{
 496       conn: conn,
 497       base_uri: base_uri,
 498       error_response: error_response
 499     } do
 500       clear_config([:instance, :public], false)
 501       clear_config([:restrict_unauthenticated, :timelines])
 502
 503       for local <- [true, false] do
 504         res_conn = get(conn, "#{base_uri}?local=#{local}")
 505
 506         assert json_response(res_conn, :unauthorized) == error_response
 507       end
 508
 509       ensure_authenticated_access(base_uri)
 510     end
 511
 512     test "with `%{local: true, federated: true}`, returns 403 for unauthenticated users", %{
 513       conn: conn,
 514       base_uri: base_uri,
 515       error_response: error_response
 516     } do
 517       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 518       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 519
 520       for local <- [true, false] do
 521         res_conn = get(conn, "#{base_uri}?local=#{local}")
 522
 523         assert json_response(res_conn, :unauthorized) == error_response
 524       end
 525
 526       ensure_authenticated_access(base_uri)
 527     end
 528
 529     test "with `%{local: false, federated: true}`, forbids unauthenticated access to federated timeline",
 530          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 531       clear_config([:restrict_unauthenticated, :timelines, :local], false)
 532       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 533
 534       res_conn = get(conn, "#{base_uri}?local=true")
 535       assert length(json_response(res_conn, 200)) == 1
 536
 537       res_conn = get(conn, "#{base_uri}?local=false")
 538       assert json_response(res_conn, :unauthorized) == error_response
 539
 540       ensure_authenticated_access(base_uri)
 541     end
 542
 543     test "with `%{local: true, federated: false}`, forbids unauthenticated access to public timeline" <>
 544            "(but not to local public activities which are delivered as part of federated timeline)",
 545          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 546       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 547       clear_config([:restrict_unauthenticated, :timelines, :federated], false)
 548
 549       res_conn = get(conn, "#{base_uri}?local=true")
 550       assert json_response(res_conn, :unauthorized) == error_response
 551
 552       # Note: local activities get delivered as part of federated timeline
 553       res_conn = get(conn, "#{base_uri}?local=false")
 554       assert length(json_response(res_conn, 200)) == 2
 555
 556       ensure_authenticated_access(base_uri)
 557     end
 558   end
 559 end