git.squeep.com Git - akkoma/blob - test/pleroma/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.Config
  12   alias Pleroma.User
  13   alias Pleroma.Web.CommonAPI
  14
  15   setup do
  16     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  17     :ok
  18   end
  19
  20   describe "home" do
  21     setup do: oauth_access(["read:statuses"])
  22
  23     test "does NOT embed account/pleroma/relationship in statuses", %{
  24       user: user,
  25       conn: conn
  26     } do
  27       other_user = insert(:user)
  28
  29       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  30
  31       response =
  32         conn
  33         |> assign(:user, user)
  34         |> get("/api/v1/timelines/home")
  35         |> json_response_and_validate_schema(200)
  36
  37       assert Enum.all?(response, fn n ->
  38                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  39              end)
  40     end
  41
  42     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  43       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  44       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  45
  46       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  47
  48       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  49
  50       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  51
  52       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  53       assert public_activity.id in status_ids
  54       assert unlisted_activity.id in status_ids
  55       assert private_activity.id in status_ids
  56       refute direct_activity.id in status_ids
  57     end
  58   end
  59
  60   describe "public" do
  61     @tag capture_log: true
  62     test "the public timeline", %{conn: conn} do
  63       user = insert(:user)
  64
  65       {:ok, activity} = CommonAPI.post(user, %{status: "test"})
  66
  67       _activity = insert(:note_activity, local: false)
  68
  69       conn = get(conn, "/api/v1/timelines/public?local=False")
  70
  71       assert length(json_response_and_validate_schema(conn, :ok)) == 2
  72
  73       conn = get(build_conn(), "/api/v1/timelines/public?local=True")
  74
  75       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  76
  77       conn = get(build_conn(), "/api/v1/timelines/public?local=1")
  78
  79       assert [%{"content" => "test"}] = json_response_and_validate_schema(conn, :ok)
  80
  81       # does not contain repeats
  82       {:ok, _} = CommonAPI.repeat(activity.id, user)
  83
  84       conn = get(build_conn(), "/api/v1/timelines/public?local=true")
  85
  86       assert [_] = json_response_and_validate_schema(conn, :ok)
  87     end
  88
  89     test "the public timeline includes only public statuses for an authenticated user" do
  90       %{user: user, conn: conn} = oauth_access(["read:statuses"])
  91
  92       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
  93       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
  94       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
  95       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
  96
  97       res_conn = get(conn, "/api/v1/timelines/public")
  98       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
  99     end
 100
 101     test "doesn't return replies if follower is posting with blocked user" do
 102       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 103       [blockee, friend] = insert_list(2, :user)
 104       {:ok, blocker} = User.follow(blocker, friend)
 105       {:ok, _} = User.block(blocker, blockee)
 106
 107       conn = assign(conn, :user, blocker)
 108
 109       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 110
 111       {:ok, reply_from_blockee} =
 112         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 113
 114       {:ok, _reply_from_friend} =
 115         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 116
 117       # Still shows replies from yourself
 118       {:ok, %{id: reply_from_me}} =
 119         CommonAPI.post(blocker, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 120
 121       response =
 122         get(conn, "/api/v1/timelines/public")
 123         |> json_response_and_validate_schema(200)
 124
 125       assert length(response) == 2
 126       [%{"id" => ^reply_from_me}, %{"id" => ^activity_id}] = response
 127     end
 128
 129     test "doesn't return posts from users who blocked you when :blockers_visible is disabled" do
 130       clear_config([:activitypub, :blockers_visible], false)
 131
 132       %{conn: conn, user: blockee} = oauth_access(["read:statuses"])
 133       blocker = insert(:user)
 134       {:ok, _} = User.block(blocker, blockee)
 135
 136       conn = assign(conn, :user, blockee)
 137
 138       {:ok, _} = CommonAPI.post(blocker, %{status: "hey!"})
 139
 140       response =
 141         get(conn, "/api/v1/timelines/public")
 142         |> json_response_and_validate_schema(200)
 143
 144       assert length(response) == 0
 145     end
 146
 147     test "doesn't return replies if follow is posting with users from blocked domain" do
 148       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 149       friend = insert(:user)
 150       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 151       {:ok, blocker} = User.follow(blocker, friend)
 152       {:ok, blocker} = User.block_domain(blocker, "example.com")
 153
 154       conn = assign(conn, :user, blocker)
 155
 156       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 157
 158       {:ok, reply_from_blockee} =
 159         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 160
 161       {:ok, _reply_from_friend} =
 162         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 163
 164       res_conn = get(conn, "/api/v1/timelines/public")
 165
 166       activities = json_response_and_validate_schema(res_conn, 200)
 167       [%{"id" => ^activity_id}] = activities
 168     end
 169   end
 170
 171   defp local_and_remote_activities do
 172     insert(:note_activity)
 173     insert(:note_activity, local: false)
 174     :ok
 175   end
 176
 177   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 178     setup do: local_and_remote_activities()
 179
 180     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 181
 182     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 183
 184     test "if user is unauthenticated", %{conn: conn} do
 185       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 186
 187       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 188                "error" => "authorization required for timeline view"
 189              }
 190
 191       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 192
 193       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 194                "error" => "authorization required for timeline view"
 195              }
 196     end
 197
 198     test "if user is authenticated" do
 199       %{conn: conn} = oauth_access(["read:statuses"])
 200
 201       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 202       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 203
 204       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 205       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 206     end
 207   end
 208
 209   describe "public with restrict unauthenticated timeline for local" do
 210     setup do: local_and_remote_activities()
 211
 212     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 213
 214     test "if user is unauthenticated", %{conn: conn} do
 215       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 216
 217       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 218                "error" => "authorization required for timeline view"
 219              }
 220
 221       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 222       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 223     end
 224
 225     test "if user is authenticated", %{conn: _conn} do
 226       %{conn: conn} = oauth_access(["read:statuses"])
 227
 228       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 229       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 230
 231       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 232       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 233     end
 234   end
 235
 236   describe "public with restrict unauthenticated timeline for remote" do
 237     setup do: local_and_remote_activities()
 238
 239     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 240
 241     test "if user is unauthenticated", %{conn: conn} do
 242       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 243       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 244
 245       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 246
 247       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 248                "error" => "authorization required for timeline view"
 249              }
 250     end
 251
 252     test "if user is authenticated", %{conn: _conn} do
 253       %{conn: conn} = oauth_access(["read:statuses"])
 254
 255       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 256       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 257
 258       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 259       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 260     end
 261   end
 262
 263   describe "direct" do
 264     test "direct timeline", %{conn: conn} do
 265       user_one = insert(:user)
 266       user_two = insert(:user)
 267
 268       {:ok, user_two} = User.follow(user_two, user_one)
 269
 270       {:ok, direct} =
 271         CommonAPI.post(user_one, %{
 272           status: "Hi @#{user_two.nickname}!",
 273           visibility: "direct"
 274         })
 275
 276       {:ok, _follower_only} =
 277         CommonAPI.post(user_one, %{
 278           status: "Hi @#{user_two.nickname}!",
 279           visibility: "private"
 280         })
 281
 282       conn_user_two =
 283         conn
 284         |> assign(:user, user_two)
 285         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 286
 287       # Only direct should be visible here
 288       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 289
 290       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 291
 292       assert %{"visibility" => "direct"} = status
 293       assert status["url"] != direct.data["id"]
 294
 295       # User should be able to see their own direct message
 296       res_conn =
 297         build_conn()
 298         |> assign(:user, user_one)
 299         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 300         |> get("api/v1/timelines/direct")
 301
 302       [status] = json_response_and_validate_schema(res_conn, :ok)
 303
 304       assert %{"visibility" => "direct"} = status
 305
 306       # Both should be visible here
 307       res_conn = get(conn_user_two, "api/v1/timelines/home")
 308
 309       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 310
 311       # Test pagination
 312       Enum.each(1..20, fn _ ->
 313         {:ok, _} =
 314           CommonAPI.post(user_one, %{
 315             status: "Hi @#{user_two.nickname}!",
 316             visibility: "direct"
 317           })
 318       end)
 319
 320       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 321
 322       statuses = json_response_and_validate_schema(res_conn, :ok)
 323       assert length(statuses) == 20
 324
 325       max_id = List.last(statuses)["id"]
 326
 327       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 328
 329       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 330
 331       assert status["url"] != direct.data["id"]
 332     end
 333
 334     test "doesn't include DMs from blocked users" do
 335       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 336       blocked = insert(:user)
 337       other_user = insert(:user)
 338       {:ok, _user_relationship} = User.block(blocker, blocked)
 339
 340       {:ok, _blocked_direct} =
 341         CommonAPI.post(blocked, %{
 342           status: "Hi @#{blocker.nickname}!",
 343           visibility: "direct"
 344         })
 345
 346       {:ok, direct} =
 347         CommonAPI.post(other_user, %{
 348           status: "Hi @#{blocker.nickname}!",
 349           visibility: "direct"
 350         })
 351
 352       res_conn = get(conn, "api/v1/timelines/direct")
 353
 354       [status] = json_response_and_validate_schema(res_conn, :ok)
 355       assert status["id"] == direct.id
 356     end
 357   end
 358
 359   describe "list" do
 360     setup do: oauth_access(["read:lists"])
 361
 362     test "does not contain retoots", %{user: user, conn: conn} do
 363       other_user = insert(:user)
 364       {:ok, activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 365       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is stupid."})
 366       {:ok, _} = CommonAPI.repeat(activity_one.id, other_user)
 367
 368       {:ok, list} = Pleroma.List.create("name", user)
 369       {:ok, list} = Pleroma.List.follow(list, other_user)
 370
 371       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 372
 373       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 374
 375       assert id == to_string(activity_two.id)
 376     end
 377
 378     test "works with pagination", %{user: user, conn: conn} do
 379       other_user = insert(:user)
 380       {:ok, list} = Pleroma.List.create("name", user)
 381       {:ok, list} = Pleroma.List.follow(list, other_user)
 382
 383       Enum.each(1..30, fn i ->
 384         CommonAPI.post(other_user, %{status: "post number #{i}"})
 385       end)
 386
 387       res =
 388         get(conn, "/api/v1/timelines/list/#{list.id}?limit=1")
 389         |> json_response_and_validate_schema(:ok)
 390
 391       assert length(res) == 1
 392
 393       [first] = res
 394
 395       res =
 396         get(conn, "/api/v1/timelines/list/#{list.id}?max_id=#{first["id"]}&limit=30")
 397         |> json_response_and_validate_schema(:ok)
 398
 399       assert length(res) == 29
 400     end
 401
 402     test "list timeline", %{user: user, conn: conn} do
 403       other_user = insert(:user)
 404       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 405       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 406       {:ok, list} = Pleroma.List.create("name", user)
 407       {:ok, list} = Pleroma.List.follow(list, other_user)
 408
 409       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 410
 411       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 412
 413       assert id == to_string(activity_two.id)
 414     end
 415
 416     test "list timeline does not leak non-public statuses for unfollowed users", %{
 417       user: user,
 418       conn: conn
 419     } do
 420       other_user = insert(:user)
 421       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 422
 423       {:ok, _activity_two} =
 424         CommonAPI.post(other_user, %{
 425           status: "Marisa is cute.",
 426           visibility: "private"
 427         })
 428
 429       {:ok, list} = Pleroma.List.create("name", user)
 430       {:ok, list} = Pleroma.List.follow(list, other_user)
 431
 432       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 433
 434       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 435
 436       assert id == to_string(activity_one.id)
 437     end
 438   end
 439
 440   describe "hashtag" do
 441     setup do: oauth_access(["n/a"])
 442
 443     @tag capture_log: true
 444     test "hashtag timeline", %{conn: conn} do
 445       following = insert(:user)
 446
 447       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 448
 449       nconn = get(conn, "/api/v1/timelines/tag/2hu")
 450
 451       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 452
 453       assert id == to_string(activity.id)
 454
 455       # works for different capitalization too
 456       nconn = get(conn, "/api/v1/timelines/tag/2HU")
 457
 458       assert [%{"id" => id}] = json_response_and_validate_schema(nconn, :ok)
 459
 460       assert id == to_string(activity.id)
 461     end
 462
 463     test "multi-hashtag timeline", %{conn: conn} do
 464       user = insert(:user)
 465
 466       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 467       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 468       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 469
 470       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 471
 472       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 473
 474       assert to_string(activity_test.id) == status_test["id"]
 475       assert to_string(activity_test1.id) == status_test1["id"]
 476       assert to_string(activity_none.id) == status_none["id"]
 477
 478       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 479
 480       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 481
 482       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 483
 484       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 485     end
 486   end
 487
 488   describe "hashtag timeline handling of :restrict_unauthenticated setting" do
 489     setup do
 490       user = insert(:user)
 491       {:ok, activity1} = CommonAPI.post(user, %{status: "test #tag1"})
 492       {:ok, _activity2} = CommonAPI.post(user, %{status: "test #tag1"})
 493
 494       activity1
 495       |> Ecto.Changeset.change(%{local: false})
 496       |> Pleroma.Repo.update()
 497
 498       base_uri = "/api/v1/timelines/tag/tag1"
 499       error_response = %{"error" => "authorization required for timeline view"}
 500
 501       %{base_uri: base_uri, error_response: error_response}
 502     end
 503
 504     defp ensure_authenticated_access(base_uri) do
 505       %{conn: auth_conn} = oauth_access(["read:statuses"])
 506
 507       res_conn = get(auth_conn, "#{base_uri}?local=true")
 508       assert length(json_response(res_conn, 200)) == 1
 509
 510       res_conn = get(auth_conn, "#{base_uri}?local=false")
 511       assert length(json_response(res_conn, 200)) == 2
 512     end
 513
 514     test "with default settings on private instances, returns 403 for unauthenticated users", %{
 515       conn: conn,
 516       base_uri: base_uri,
 517       error_response: error_response
 518     } do
 519       clear_config([:instance, :public], false)
 520       clear_config([:restrict_unauthenticated, :timelines])
 521
 522       for local <- [true, false] do
 523         res_conn = get(conn, "#{base_uri}?local=#{local}")
 524
 525         assert json_response(res_conn, :unauthorized) == error_response
 526       end
 527
 528       ensure_authenticated_access(base_uri)
 529     end
 530
 531     test "with `%{local: true, federated: true}`, returns 403 for unauthenticated users", %{
 532       conn: conn,
 533       base_uri: base_uri,
 534       error_response: error_response
 535     } do
 536       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 537       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 538
 539       for local <- [true, false] do
 540         res_conn = get(conn, "#{base_uri}?local=#{local}")
 541
 542         assert json_response(res_conn, :unauthorized) == error_response
 543       end
 544
 545       ensure_authenticated_access(base_uri)
 546     end
 547
 548     test "with `%{local: false, federated: true}`, forbids unauthenticated access to federated timeline",
 549          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 550       clear_config([:restrict_unauthenticated, :timelines, :local], false)
 551       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 552
 553       res_conn = get(conn, "#{base_uri}?local=true")
 554       assert length(json_response(res_conn, 200)) == 1
 555
 556       res_conn = get(conn, "#{base_uri}?local=false")
 557       assert json_response(res_conn, :unauthorized) == error_response
 558
 559       ensure_authenticated_access(base_uri)
 560     end
 561
 562     test "with `%{local: true, federated: false}`, forbids unauthenticated access to public timeline" <>
 563            "(but not to local public activities which are delivered as part of federated timeline)",
 564          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 565       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 566       clear_config([:restrict_unauthenticated, :timelines, :federated], false)
 567
 568       res_conn = get(conn, "#{base_uri}?local=true")
 569       assert json_response(res_conn, :unauthorized) == error_response
 570
 571       # Note: local activities get delivered as part of federated timeline
 572       res_conn = get(conn, "#{base_uri}?local=false")
 573       assert length(json_response(res_conn, 200)) == 2
 574
 575       ensure_authenticated_access(base_uri)
 576     end
 577   end
 578 end