git.squeep.com Git - akkoma/blob - test/pleroma/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.User
  12   alias Pleroma.Web.CommonAPI
  13
  14   setup do
  15     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  16     :ok
  17   end
  18
  19   describe "home" do
  20     setup do: oauth_access(["read:statuses"])
  21
  22     test "does NOT embed account/pleroma/relationship in statuses", %{
  23       user: user,
  24       conn: conn
  25     } do
  26       other_user = insert(:user)
  27
  28       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  29
  30       response =
  31         conn
  32         |> assign(:user, user)
  33         |> get("/api/v1/timelines/home")
  34         |> json_response_and_validate_schema(200)
  35
  36       assert Enum.all?(response, fn n ->
  37                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  38              end)
  39     end
  40
  41     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  42       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  43       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  44
  45       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  46
  47       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  48
  49       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  50
  51       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  52       assert public_activity.id in status_ids
  53       assert unlisted_activity.id in status_ids
  54       assert private_activity.id in status_ids
  55       refute direct_activity.id in status_ids
  56     end
  57   end
  58
  59   describe "public" do
  60     @tag capture_log: true
  61     test "the public timeline", %{conn: conn} do
  62       user = insert(:user)
  63
  64       {:ok, activity} = CommonAPI.post(user, %{status: "test"})
  65
  66       _activity = insert(:note_activity, local: false)
  67
  68       conn = get(conn, "/api/v1/timelines/public?local=False")
  69
  70       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  71
  72       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  73
  74       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  75
  76       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  77
  78       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  79
  80       # does not contain repeats
  81       {:ok, _} = CommonAPI.repeat(activity.id, user)
  82
  83       conn = get(build_conn(), "/api/v1/timelines/public?local=true")
  84
  85       assert [_] = json_response_and_validate_schema(conn, :ok)
  86     end
  87
  88     test "the public timeline includes only public statuses for an authenticated user" do
  89       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  90
  91       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  92       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  93       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  94       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  95
  96       res_conn = get(conn, "/api/v1/timelines/public")
  97       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  98     end
  99
 100     test "doesn't return replies if follower is posting with blocked user" do
 101       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 102       [blockee, friend] = insert_list(2, :user)
 103       {:ok, blocker} = User.follow(blocker, friend)
 104       {:ok, _} = User.block(blocker, blockee)
 105
 106       conn = assign(conn, :user, blocker)
 107
 108       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 109
 110       {:ok, reply_from_blockee} =
 111         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 112
 113       {:ok, _reply_from_friend} =
 114         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 115
 116       # Still shows replies from yourself
 117       {:ok, %{id: reply_from_me}} =
 118         CommonAPI.post(blocker, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 119
 120       response =
 121         get(conn, "/api/v1/timelines/public")
 122         |> json_response_and_validate_schema(200)
 123
 124       assert length(response) == 2
 125       [%{"id" => ^reply_from_me}, %{"id" => ^activity_id}] = response
 126     end
 127
 128     test "doesn't return posts from users who blocked you when :blockers_visible is disabled" do
 129       clear_config([:activitypub, :blockers_visible], false)
 130
 131       %{conn: conn, user: blockee} = oauth_access(["read:statuses"])
 132       blocker = insert(:user)
 133       {:ok, _} = User.block(blocker, blockee)
 134
 135       conn = assign(conn, :user, blockee)
 136
 137       {:ok, _} = CommonAPI.post(blocker, %{status: "hey!"})
 138
 139       response =
 140         get(conn, "/api/v1/timelines/public")
 141         |> json_response_and_validate_schema(200)
 142
 143       assert length(response) == 0
 144     end
 145
 146     test "doesn't return replies if follow is posting with users from blocked domain" do
 147       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 148       friend = insert(:user)
 149       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 150       {:ok, blocker} = User.follow(blocker, friend)
 151       {:ok, blocker} = User.block_domain(blocker, "example.com")
 152
 153       conn = assign(conn, :user, blocker)
 154
 155       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 156
 157       {:ok, reply_from_blockee} =
 158         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 159
 160       {:ok, _reply_from_friend} =
 161         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 162
 163       res_conn = get(conn, "/api/v1/timelines/public")
 164
 165       activities = json_response_and_validate_schema(res_conn, 200)
 166       [%{"id" => ^activity_id}] = activities
 167     end
 168
 169     test "can be filtered by instance", %{conn: conn} do
 170       user = insert(:user, ap_id: "https://lain.com/users/lain")
 171       insert(:note_activity, local: false)
 172       insert(:note_activity, local: false)
 173
 174       {:ok, _} = CommonAPI.post(user, %{status: "test"})
 175
 176       conn = get(conn, "/api/v1/timelines/public?instance=lain.com")
 177
 178       assert length(json_response_and_validate_schema(conn, :ok)) == 1
 179     end
 180   end
 181
 182   defp local_and_remote_activities do
 183     insert(:note_activity)
 184     insert(:note_activity, local: false)
 185     :ok
 186   end
 187
 188   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 189     setup do: local_and_remote_activities()
 190
 191     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 192
 193     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 194
 195     test "if user is unauthenticated", %{conn: conn} do
 196       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 197
 198       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 199                "error" => "authorization required for timeline view"
 200              }
 201
 202       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 203
 204       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 205                "error" => "authorization required for timeline view"
 206              }
 207     end
 208
 209     test "if user is authenticated" do
 210       %{conn: conn} = oauth_access(["read:statuses"])
 211
 212       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 213       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 214
 215       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 216       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 217     end
 218   end
 219
 220   describe "public with restrict unauthenticated timeline for local" do
 221     setup do: local_and_remote_activities()
 222
 223     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 224
 225     test "if user is unauthenticated", %{conn: conn} do
 226       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 227
 228       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 229                "error" => "authorization required for timeline view"
 230              }
 231
 232       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 233       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 234     end
 235
 236     test "if user is authenticated", %{conn: _conn} do
 237       %{conn: conn} = oauth_access(["read:statuses"])
 238
 239       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 240       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 241
 242       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 243       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 244     end
 245   end
 246
 247   describe "public with restrict unauthenticated timeline for remote" do
 248     setup do: local_and_remote_activities()
 249
 250     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 251
 252     test "if user is unauthenticated", %{conn: conn} do
 253       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 254       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 255
 256       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 257
 258       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 259                "error" => "authorization required for timeline view"
 260              }
 261     end
 262
 263     test "if user is authenticated", %{conn: _conn} do
 264       %{conn: conn} = oauth_access(["read:statuses"])
 265
 266       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 267       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 268
 269       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 270       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 271     end
 272   end
 273
 274   describe "direct" do
 275     test "direct timeline", %{conn: conn} do
 276       user_one = insert(:user)
 277       user_two = insert(:user)
 278
 279       {:ok, user_two} = User.follow(user_two, user_one)
 280
 281       {:ok, direct} =
 282         CommonAPI.post(user_one, %{
 283           status: "Hi @#{user_two.nickname}!",
 284           visibility: "direct"
 285         })
 286
 287       {:ok, _follower_only} =
 288         CommonAPI.post(user_one, %{
 289           status: "Hi @#{user_two.nickname}!",
 290           visibility: "private"
 291         })
 292
 293       conn_user_two =
 294         conn
 295         |> assign(:user, user_two)
 296         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 297
 298       # Only direct should be visible here
 299       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 300
 301       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 302
 303       assert %{"visibility" => "direct"} = status
 304       assert status["url"] != direct.data["id"]
 305
 306       # User should be able to see their own direct message
 307       res_conn =
 308         build_conn()
 309         |> assign(:user, user_one)
 310         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 311         |> get("api/v1/timelines/direct")
 312
 313       [status] = json_response_and_validate_schema(res_conn, :ok)
 314
 315       assert %{"visibility" => "direct"} = status
 316
 317       # Both should be visible here
 318       res_conn = get(conn_user_two, "api/v1/timelines/home")
 319
 320       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 321
 322       # Test pagination
 323       Enum.each(1..20, fn _ ->
 324         {:ok, _} =
 325           CommonAPI.post(user_one, %{
 326             status: "Hi @#{user_two.nickname}!",
 327             visibility: "direct"
 328           })
 329       end)
 330
 331       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 332
 333       statuses = json_response_and_validate_schema(res_conn, :ok)
 334       assert length(statuses) == 20
 335
 336       max_id = List.last(statuses)["id"]
 337
 338       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 339
 340       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 341
 342       assert status["url"] != direct.data["id"]
 343     end
 344
 345     test "doesn't include DMs from blocked users" do
 346       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 347       blocked = insert(:user)
 348       other_user = insert(:user)
 349       {:ok, _user_relationship} = User.block(blocker, blocked)
 350
 351       {:ok, _blocked_direct} =
 352         CommonAPI.post(blocked, %{
 353           status: "Hi @#{blocker.nickname}!",
 354           visibility: "direct"
 355         })
 356
 357       {:ok, direct} =
 358         CommonAPI.post(other_user, %{
 359           status: "Hi @#{blocker.nickname}!",
 360           visibility: "direct"
 361         })
 362
 363       res_conn = get(conn, "api/v1/timelines/direct")
 364
 365       [status] = json_response_and_validate_schema(res_conn, :ok)
 366       assert status["id"] == direct.id
 367     end
 368   end
 369
 370   describe "list" do
 371     setup do: oauth_access(["read:lists"])
 372
 373     test "does not contain retoots", %{user: user, conn: conn} do
 374       other_user = insert(:user)
 375       {:ok, activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 376       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is stupid."})
 377       {:ok, _} = CommonAPI.repeat(activity_one.id, other_user)
 378
 379       {:ok, list} = Pleroma.List.create("name", user)
 380       {:ok, list} = Pleroma.List.follow(list, other_user)
 381
 382       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 383
 384       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 385
 386       assert id == to_string(activity_two.id)
 387     end
 388
 389     test "works with pagination", %{user: user, conn: conn} do
 390       other_user = insert(:user)
 391       {:ok, list} = Pleroma.List.create("name", user)
 392       {:ok, list} = Pleroma.List.follow(list, other_user)
 393
 394       Enum.each(1..30, fn i ->
 395         CommonAPI.post(other_user, %{status: "post number #{i}"})
 396       end)
 397
 398       res =
 399         get(conn, "/api/v1/timelines/list/#{list.id}?limit=1")
 400         |> json_response_and_validate_schema(:ok)
 401
 402       assert length(res) == 1
 403
 404       [first] = res
 405
 406       res =
 407         get(conn, "/api/v1/timelines/list/#{list.id}?max_id=#{first["id"]}&limit=30")
 408         |> json_response_and_validate_schema(:ok)
 409
 410       assert length(res) == 29
 411     end
 412
 413     test "list timeline", %{user: user, conn: conn} do
 414       other_user = insert(:user)
 415       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 416       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 417       {:ok, list} = Pleroma.List.create("name", user)
 418       {:ok, list} = Pleroma.List.follow(list, other_user)
 419
 420       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 421
 422       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 423
 424       assert id == to_string(activity_two.id)
 425     end
 426
 427     test "list timeline does not leak non-public statuses for unfollowed users", %{
 428       user: user,
 429       conn: conn
 430     } do
 431       other_user = insert(:user)
 432       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 433
 434       {:ok, _activity_two} =
 435         CommonAPI.post(other_user, %{
 436           status: "Marisa is cute.",
 437           visibility: "private"
 438         })
 439
 440       {:ok, list} = Pleroma.List.create("name", user)
 441       {:ok, list} = Pleroma.List.follow(list, other_user)
 442
 443       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 444
 445       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 446
 447       assert id == to_string(activity_one.id)
 448     end
 449   end
 450
 451   describe "hashtag" do
 452     setup do: oauth_access(["n/a"])
 453
 454     @tag capture_log: true
 455     test "hashtag timeline", %{conn: conn} do
 456       following = insert(:user)
 457
 458       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 459
 460       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 461
 462       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 463
 464       assert id == to_string(activity.id)
 465
 466       # works for different capitalization too
 467       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 468
 469       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 470
 471       assert id == to_string(activity.id)
 472     end
 473
 474     test "multi-hashtag timeline", %{conn: conn} do
 475       user = insert(:user)
 476
 477       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 478       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 479       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 480
 481       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 482
 483       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 484
 485       assert to_string(activity_test.id) == status_test["id"]
 486       assert to_string(activity_test1.id) == status_test1["id"]
 487       assert to_string(activity_none.id) == status_none["id"]
 488
 489       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 490
 491       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 492
 493       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 494
 495       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 496     end
 497   end
 498
 499   describe "hashtag timeline handling of :restrict_unauthenticated setting" do
 500     setup do
 501       user = insert(:user)
 502       {:ok, activity1} = CommonAPI.post(user, %{status: "test #tag1"})
 503       {:ok, _activity2} = CommonAPI.post(user, %{status: "test #tag1"})
 504
 505       activity1
 506       |> Ecto.Changeset.change(%{local: false})
 507       |> Pleroma.Repo.update()
 508
 509       base_uri = "/api/v1/timelines/tag/tag1"
 510       error_response = %{"error" => "authorization required for timeline view"}
 511
 512       %{base_uri: base_uri, error_response: error_response}
 513     end
 514
 515     defp ensure_authenticated_access(base_uri) do
 516       %{conn: auth_conn} = oauth_access(["read:statuses"])
 517
 518       res_conn = get(auth_conn, "#{base_uri}?local=true")
 519       assert length(json_response(res_conn, 200)) == 1
 520
 521       res_conn = get(auth_conn, "#{base_uri}?local=false")
 522       assert length(json_response(res_conn, 200)) == 2
 523     end
 524
 525     test "with default settings on private instances, returns 403 for unauthenticated users", %{
 526       conn: conn,
 527       base_uri: base_uri,
 528       error_response: error_response
 529     } do
 530       clear_config([:instance, :public], false)
 531       clear_config([:restrict_unauthenticated, :timelines])
 532
 533       for local <- [true, false] do
 534         res_conn = get(conn, "#{base_uri}?local=#{local}")
 535
 536         assert json_response(res_conn, :unauthorized) == error_response
 537       end
 538
 539       ensure_authenticated_access(base_uri)
 540     end
 541
 542     test "with `%{local: true, federated: true}`, returns 403 for unauthenticated users", %{
 543       conn: conn,
 544       base_uri: base_uri,
 545       error_response: error_response
 546     } do
 547       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 548       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 549
 550       for local <- [true, false] do
 551         res_conn = get(conn, "#{base_uri}?local=#{local}")
 552
 553         assert json_response(res_conn, :unauthorized) == error_response
 554       end
 555
 556       ensure_authenticated_access(base_uri)
 557     end
 558
 559     test "with `%{local: false, federated: true}`, forbids unauthenticated access to federated timeline",
 560          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 561       clear_config([:restrict_unauthenticated, :timelines, :local], false)
 562       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 563
 564       res_conn = get(conn, "#{base_uri}?local=true")
 565       assert length(json_response(res_conn, 200)) == 1
 566
 567       res_conn = get(conn, "#{base_uri}?local=false")
 568       assert json_response(res_conn, :unauthorized) == error_response
 569
 570       ensure_authenticated_access(base_uri)
 571     end
 572
 573     test "with `%{local: true, federated: false}`, forbids unauthenticated access to public timeline" <>
 574            "(but not to local public activities which are delivered as part of federated timeline)",
 575          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 576       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 577       clear_config([:restrict_unauthenticated, :timelines, :federated], false)
 578
 579       res_conn = get(conn, "#{base_uri}?local=true")
 580       assert json_response(res_conn, :unauthorized) == error_response
 581
 582       # Note: local activities get delivered as part of federated timeline
 583       res_conn = get(conn, "#{base_uri}?local=false")
 584       assert length(json_response(res_conn, 200)) == 2
 585
 586       ensure_authenticated_access(base_uri)
 587     end
 588   end
 589 end