git.squeep.com Git - akkoma/blob - test/pleroma/web/mastodon_api/controllers/timeline_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.MastodonAPI.TimelineControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   import Pleroma.Factory
   9   import Tesla.Mock
  10
  11   alias Pleroma.User
  12   alias Pleroma.Web.CommonAPI
  13
  14   setup do
  15     mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  16     :ok
  17   end
  18
  19   describe "home" do
  20     setup do: oauth_access(["read:statuses"])
  21
  22     test "does NOT embed account/pleroma/relationship in statuses", %{
  23       user: user,
  24       conn: conn
  25     } do
  26       other_user = insert(:user)
  27
  28       {:ok, _} = CommonAPI.post(other_user, %{status: "hi @#{user.nickname}"})
  29
  30       response =
  31         conn
  32         |> assign(:user, user)
  33         |> get("/api/v1/timelines/home")
  34         |> json_response_and_validate_schema(200)
  35
  36       assert Enum.all?(response, fn n ->
  37                get_in(n, ["account", "pleroma", "relationship"]) == %{}
  38              end)
  39     end
  40
  41     test "the home timeline when the direct messages are excluded", %{user: user, conn: conn} do
  42       {:ok, public_activity} = CommonAPI.post(user, %{status: ".", visibility: "public"})
  43       {:ok, direct_activity} = CommonAPI.post(user, %{status: ".", visibility: "direct"})
  44
  45       {:ok, unlisted_activity} = CommonAPI.post(user, %{status: ".", visibility: "unlisted"})
  46
  47       {:ok, private_activity} = CommonAPI.post(user, %{status: ".", visibility: "private"})
  48
  49       conn = get(conn, "/api/v1/timelines/home?exclude_visibilities[]=direct")
  50
  51       assert status_ids = json_response_and_validate_schema(conn, :ok) |> Enum.map(& &1["id"])
  52       assert public_activity.id in status_ids
  53       assert unlisted_activity.id in status_ids
  54       assert private_activity.id in status_ids
  55       refute direct_activity.id in status_ids
  56     end
  57
  58     test "muted emotions", %{user: user, conn: conn} do
  59       other_user = insert(:user)
  60       {:ok, activity} = CommonAPI.post(user, %{status: "."})
  61
  62       {:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
  63       User.mute(user, other_user)
  64
  65       result =
  66         conn
  67         |> assign(:user, user)
  68         |> get("/api/v1/timelines/home")
  69         |> json_response_and_validate_schema(200)
  70
  71       assert [
  72                %{
  73                  "pleroma" => %{
  74                    "emoji_reactions" => []
  75                  }
  76                }
  77              ] = result
  78
  79       result =
  80         conn
  81         |> assign(:user, user)
  82         |> get("/api/v1/timelines/home?with_muted=true")
  83         |> json_response_and_validate_schema(200)
  84
  85       assert [
  86                %{
  87                  "pleroma" => %{
  88                    "emoji_reactions" => [%{"count" => 1, "me" => false, "name" => "🎅"}]
  89                  }
  90                }
  91              ] = result
  92     end
  93
  94     test "filtering", %{conn: conn, user: user} do
  95       local_user = insert(:user)
  96       {:ok, user, local_user} = User.follow(user, local_user)
  97       {:ok, local_activity} = CommonAPI.post(local_user, %{status: "Status"})
  98       with_media = create_with_media_activity(local_user)
  99
 100       remote_user = insert(:user, local: false)
 101       {:ok, _user, remote_user} = User.follow(user, remote_user)
 102       remote_activity = create_remote_activity(remote_user)
 103
 104       without_filter_ids =
 105         conn
 106         |> get("/api/v1/timelines/home")
 107         |> json_response_and_validate_schema(200)
 108         |> Enum.map(& &1["id"])
 109
 110       assert local_activity.id in without_filter_ids
 111       assert remote_activity.id in without_filter_ids
 112       assert with_media.id in without_filter_ids
 113
 114       only_local_ids =
 115         conn
 116         |> get("/api/v1/timelines/home?local=true")
 117         |> json_response_and_validate_schema(200)
 118         |> Enum.map(& &1["id"])
 119
 120       assert local_activity.id in only_local_ids
 121       refute remote_activity.id in only_local_ids
 122       assert with_media.id in only_local_ids
 123
 124       only_local_media_ids =
 125         conn
 126         |> get("/api/v1/timelines/home?local=true&only_media=true")
 127         |> json_response_and_validate_schema(200)
 128         |> Enum.map(& &1["id"])
 129
 130       refute local_activity.id in only_local_media_ids
 131       refute remote_activity.id in only_local_media_ids
 132       assert with_media.id in only_local_media_ids
 133
 134       remote_ids =
 135         conn
 136         |> get("/api/v1/timelines/home?remote=true")
 137         |> json_response_and_validate_schema(200)
 138         |> Enum.map(& &1["id"])
 139
 140       refute local_activity.id in remote_ids
 141       assert remote_activity.id in remote_ids
 142       refute with_media.id in remote_ids
 143
 144       assert conn
 145              |> get("/api/v1/timelines/home?remote=true&only_media=true")
 146              |> json_response_and_validate_schema(200) == []
 147
 148       assert conn
 149              |> get("/api/v1/timelines/home?remote=true&local=true")
 150              |> json_response_and_validate_schema(200) == []
 151     end
 152   end
 153
 154   describe "public" do
 155     @tag capture_log: true
 156     test "the public timeline", %{conn: conn} do
 157       user = insert(:user)
 158
 159       {:ok, activity} = CommonAPI.post(user, %{status: "test"})
 160       with_media = create_with_media_activity(user)
 161
 162       remote = insert(:note_activity, local: false)
 163
 164       assert conn
 165              |> get("/api/v1/timelines/public?local=False")
 166              |> json_response_and_validate_schema(:ok)
 167              |> length == 3
 168
 169       local_ids =
 170         conn
 171         |> get("/api/v1/timelines/public?local=True")
 172         |> json_response_and_validate_schema(:ok)
 173         |> Enum.map(& &1["id"])
 174
 175       assert activity.id in local_ids
 176       assert with_media.id in local_ids
 177       refute remote.id in local_ids
 178
 179       local_ids =
 180         conn
 181         |> get("/api/v1/timelines/public?local=True")
 182         |> json_response_and_validate_schema(:ok)
 183         |> Enum.map(& &1["id"])
 184
 185       assert activity.id in local_ids
 186       assert with_media.id in local_ids
 187       refute remote.id in local_ids
 188
 189       local_ids =
 190         conn
 191         |> get("/api/v1/timelines/public?local=True&only_media=true")
 192         |> json_response_and_validate_schema(:ok)
 193         |> Enum.map(& &1["id"])
 194
 195       refute activity.id in local_ids
 196       assert with_media.id in local_ids
 197       refute remote.id in local_ids
 198
 199       local_ids =
 200         conn
 201         |> get("/api/v1/timelines/public?local=1")
 202         |> json_response_and_validate_schema(:ok)
 203         |> Enum.map(& &1["id"])
 204
 205       assert activity.id in local_ids
 206       assert with_media.id in local_ids
 207       refute remote.id in local_ids
 208
 209       remote_id = remote.id
 210
 211       assert [%{"id" => ^remote_id}] =
 212                conn
 213                |> get("/api/v1/timelines/public?remote=true")
 214                |> json_response_and_validate_schema(:ok)
 215
 216       with_media_id = with_media.id
 217
 218       assert [%{"id" => ^with_media_id}] =
 219                conn
 220                |> get("/api/v1/timelines/public?only_media=true")
 221                |> json_response_and_validate_schema(:ok)
 222
 223       assert conn
 224              |> get("/api/v1/timelines/public?remote=true&only_media=true")
 225              |> json_response_and_validate_schema(:ok) == []
 226
 227       # does not contain repeats
 228       {:ok, _} = CommonAPI.repeat(activity.id, user)
 229
 230       assert [_, _] =
 231                conn
 232                |> get("/api/v1/timelines/public?local=true")
 233                |> json_response_and_validate_schema(:ok)
 234     end
 235
 236     test "the public timeline includes only public statuses for an authenticated user" do
 237       %{user: user, conn: conn} = oauth_access(["read:statuses"])
 238
 239       {:ok, _activity} = CommonAPI.post(user, %{status: "test"})
 240       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "private"})
 241       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "unlisted"})
 242       {:ok, _activity} = CommonAPI.post(user, %{status: "test", visibility: "direct"})
 243
 244       res_conn = get(conn, "/api/v1/timelines/public")
 245       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 246     end
 247
 248     test "doesn't return replies if follower is posting with blocked user" do
 249       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 250       [blockee, friend] = insert_list(2, :user)
 251       {:ok, blocker, friend} = User.follow(blocker, friend)
 252       {:ok, _} = User.block(blocker, blockee)
 253
 254       conn = assign(conn, :user, blocker)
 255
 256       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 257
 258       {:ok, reply_from_blockee} =
 259         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 260
 261       {:ok, _reply_from_friend} =
 262         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 263
 264       # Still shows replies from yourself
 265       {:ok, %{id: reply_from_me}} =
 266         CommonAPI.post(blocker, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 267
 268       response =
 269         get(conn, "/api/v1/timelines/public")
 270         |> json_response_and_validate_schema(200)
 271
 272       assert length(response) == 2
 273       [%{"id" => ^reply_from_me}, %{"id" => ^activity_id}] = response
 274     end
 275
 276     test "doesn't return posts from users who blocked you when :blockers_visible is disabled" do
 277       clear_config([:activitypub, :blockers_visible], false)
 278
 279       %{conn: conn, user: blockee} = oauth_access(["read:statuses"])
 280       blocker = insert(:user)
 281       {:ok, _} = User.block(blocker, blockee)
 282
 283       conn = assign(conn, :user, blockee)
 284
 285       {:ok, _} = CommonAPI.post(blocker, %{status: "hey!"})
 286
 287       response =
 288         get(conn, "/api/v1/timelines/public")
 289         |> json_response_and_validate_schema(200)
 290
 291       assert length(response) == 0
 292     end
 293
 294     test "doesn't return replies if follow is posting with users from blocked domain" do
 295       %{conn: conn, user: blocker} = oauth_access(["read:statuses"])
 296       friend = insert(:user)
 297       blockee = insert(:user, ap_id: "https://example.com/users/blocked")
 298       {:ok, blocker, friend} = User.follow(blocker, friend)
 299       {:ok, blocker} = User.block_domain(blocker, "example.com")
 300
 301       conn = assign(conn, :user, blocker)
 302
 303       {:ok, %{id: activity_id} = activity} = CommonAPI.post(friend, %{status: "hey!"})
 304
 305       {:ok, reply_from_blockee} =
 306         CommonAPI.post(blockee, %{status: "heya", in_reply_to_status_id: activity})
 307
 308       {:ok, _reply_from_friend} =
 309         CommonAPI.post(friend, %{status: "status", in_reply_to_status_id: reply_from_blockee})
 310
 311       res_conn = get(conn, "/api/v1/timelines/public")
 312
 313       activities = json_response_and_validate_schema(res_conn, 200)
 314       [%{"id" => ^activity_id}] = activities
 315     end
 316
 317     test "can be filtered by instance", %{conn: conn} do
 318       user = insert(:user, ap_id: "https://lain.com/users/lain")
 319       insert(:note_activity, local: false)
 320       insert(:note_activity, local: false)
 321
 322       {:ok, _} = CommonAPI.post(user, %{status: "test"})
 323
 324       conn = get(conn, "/api/v1/timelines/public?instance=lain.com")
 325
 326       assert length(json_response_and_validate_schema(conn, :ok)) == 1
 327     end
 328
 329     test "muted emotions", %{conn: conn} do
 330       user = insert(:user)
 331       token = insert(:oauth_token, user: user, scopes: ["read:statuses"])
 332
 333       conn =
 334         conn
 335         |> assign(:user, user)
 336         |> assign(:token, token)
 337
 338       other_user = insert(:user)
 339       {:ok, activity} = CommonAPI.post(user, %{status: "."})
 340
 341       {:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
 342       User.mute(user, other_user)
 343
 344       result =
 345         conn
 346         |> get("/api/v1/timelines/public")
 347         |> json_response_and_validate_schema(200)
 348
 349       assert [
 350                %{
 351                  "pleroma" => %{
 352                    "emoji_reactions" => []
 353                  }
 354                }
 355              ] = result
 356
 357       result =
 358         conn
 359         |> get("/api/v1/timelines/public?with_muted=true")
 360         |> json_response_and_validate_schema(200)
 361
 362       assert [
 363                %{
 364                  "pleroma" => %{
 365                    "emoji_reactions" => [%{"count" => 1, "me" => false, "name" => "🎅"}]
 366                  }
 367                }
 368              ] = result
 369     end
 370   end
 371
 372   defp local_and_remote_activities do
 373     insert(:note_activity)
 374     insert(:note_activity, local: false)
 375     :ok
 376   end
 377
 378   describe "public with restrict unauthenticated timeline for local and federated timelines" do
 379     setup do: local_and_remote_activities()
 380
 381     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 382
 383     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 384
 385     test "if user is unauthenticated", %{conn: conn} do
 386       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 387
 388       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 389                "error" => "authorization required for timeline view"
 390              }
 391
 392       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 393
 394       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 395                "error" => "authorization required for timeline view"
 396              }
 397     end
 398
 399     test "if user is authenticated" do
 400       %{conn: conn} = oauth_access(["read:statuses"])
 401
 402       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 403       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 404
 405       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 406       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 407     end
 408   end
 409
 410   describe "public with restrict unauthenticated timeline for local" do
 411     setup do: local_and_remote_activities()
 412
 413     setup do: clear_config([:restrict_unauthenticated, :timelines, :local], true)
 414
 415     test "if user is unauthenticated", %{conn: conn} do
 416       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 417
 418       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 419                "error" => "authorization required for timeline view"
 420              }
 421
 422       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 423       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 424     end
 425
 426     test "if user is authenticated", %{conn: _conn} do
 427       %{conn: conn} = oauth_access(["read:statuses"])
 428
 429       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 430       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 431
 432       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 433       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 434     end
 435   end
 436
 437   describe "public with restrict unauthenticated timeline for remote" do
 438     setup do: local_and_remote_activities()
 439
 440     setup do: clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 441
 442     test "if user is unauthenticated", %{conn: conn} do
 443       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 444       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 445
 446       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 447
 448       assert json_response_and_validate_schema(res_conn, :unauthorized) == %{
 449                "error" => "authorization required for timeline view"
 450              }
 451     end
 452
 453     test "if user is authenticated", %{conn: _conn} do
 454       %{conn: conn} = oauth_access(["read:statuses"])
 455
 456       res_conn = get(conn, "/api/v1/timelines/public?local=true")
 457       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 458
 459       res_conn = get(conn, "/api/v1/timelines/public?local=false")
 460       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 461     end
 462   end
 463
 464   describe "direct" do
 465     test "direct timeline", %{conn: conn} do
 466       user_one = insert(:user)
 467       user_two = insert(:user)
 468
 469       {:ok, user_two, user_one} = User.follow(user_two, user_one)
 470
 471       {:ok, direct} =
 472         CommonAPI.post(user_one, %{
 473           status: "Hi @#{user_two.nickname}!",
 474           visibility: "direct"
 475         })
 476
 477       {:ok, _follower_only} =
 478         CommonAPI.post(user_one, %{
 479           status: "Hi @#{user_two.nickname}!",
 480           visibility: "private"
 481         })
 482
 483       conn_user_two =
 484         conn
 485         |> assign(:user, user_two)
 486         |> assign(:token, insert(:oauth_token, user: user_two, scopes: ["read:statuses"]))
 487
 488       # Only direct should be visible here
 489       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 490
 491       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 492
 493       assert %{"visibility" => "direct"} = status
 494       assert status["url"] != direct.data["id"]
 495
 496       # User should be able to see their own direct message
 497       res_conn =
 498         build_conn()
 499         |> assign(:user, user_one)
 500         |> assign(:token, insert(:oauth_token, user: user_one, scopes: ["read:statuses"]))
 501         |> get("api/v1/timelines/direct")
 502
 503       [status] = json_response_and_validate_schema(res_conn, :ok)
 504
 505       assert %{"visibility" => "direct"} = status
 506
 507       # Both should be visible here
 508       res_conn = get(conn_user_two, "api/v1/timelines/home")
 509
 510       [_s1, _s2] = json_response_and_validate_schema(res_conn, :ok)
 511
 512       # Test pagination
 513       Enum.each(1..20, fn _ ->
 514         {:ok, _} =
 515           CommonAPI.post(user_one, %{
 516             status: "Hi @#{user_two.nickname}!",
 517             visibility: "direct"
 518           })
 519       end)
 520
 521       res_conn = get(conn_user_two, "api/v1/timelines/direct")
 522
 523       statuses = json_response_and_validate_schema(res_conn, :ok)
 524       assert length(statuses) == 20
 525
 526       max_id = List.last(statuses)["id"]
 527
 528       res_conn = get(conn_user_two, "api/v1/timelines/direct?max_id=#{max_id}")
 529
 530       assert [status] = json_response_and_validate_schema(res_conn, :ok)
 531
 532       assert status["url"] != direct.data["id"]
 533     end
 534
 535     test "doesn't include DMs from blocked users" do
 536       %{user: blocker, conn: conn} = oauth_access(["read:statuses"])
 537       blocked = insert(:user)
 538       other_user = insert(:user)
 539       {:ok, _user_relationship} = User.block(blocker, blocked)
 540
 541       {:ok, _blocked_direct} =
 542         CommonAPI.post(blocked, %{
 543           status: "Hi @#{blocker.nickname}!",
 544           visibility: "direct"
 545         })
 546
 547       {:ok, direct} =
 548         CommonAPI.post(other_user, %{
 549           status: "Hi @#{blocker.nickname}!",
 550           visibility: "direct"
 551         })
 552
 553       res_conn = get(conn, "api/v1/timelines/direct")
 554
 555       [status] = json_response_and_validate_schema(res_conn, :ok)
 556       assert status["id"] == direct.id
 557     end
 558   end
 559
 560   describe "list" do
 561     setup do: oauth_access(["read:lists"])
 562
 563     test "does not contain retoots", %{user: user, conn: conn} do
 564       other_user = insert(:user)
 565       {:ok, activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 566       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is stupid."})
 567       {:ok, _} = CommonAPI.repeat(activity_one.id, other_user)
 568
 569       {:ok, list} = Pleroma.List.create("name", user)
 570       {:ok, list} = Pleroma.List.follow(list, other_user)
 571
 572       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 573
 574       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 575
 576       assert id == to_string(activity_two.id)
 577     end
 578
 579     test "works with pagination", %{user: user, conn: conn} do
 580       other_user = insert(:user)
 581       {:ok, list} = Pleroma.List.create("name", user)
 582       {:ok, list} = Pleroma.List.follow(list, other_user)
 583
 584       Enum.each(1..30, fn i ->
 585         CommonAPI.post(other_user, %{status: "post number #{i}"})
 586       end)
 587
 588       res =
 589         get(conn, "/api/v1/timelines/list/#{list.id}?limit=1")
 590         |> json_response_and_validate_schema(:ok)
 591
 592       assert length(res) == 1
 593
 594       [first] = res
 595
 596       res =
 597         get(conn, "/api/v1/timelines/list/#{list.id}?max_id=#{first["id"]}&limit=30")
 598         |> json_response_and_validate_schema(:ok)
 599
 600       assert length(res) == 29
 601     end
 602
 603     test "list timeline", %{user: user, conn: conn} do
 604       other_user = insert(:user)
 605       {:ok, _activity_one} = CommonAPI.post(user, %{status: "Marisa is cute."})
 606       {:ok, activity_two} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 607       {:ok, list} = Pleroma.List.create("name", user)
 608       {:ok, list} = Pleroma.List.follow(list, other_user)
 609
 610       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 611
 612       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 613
 614       assert id == to_string(activity_two.id)
 615     end
 616
 617     test "list timeline does not leak non-public statuses for unfollowed users", %{
 618       user: user,
 619       conn: conn
 620     } do
 621       other_user = insert(:user)
 622       {:ok, activity_one} = CommonAPI.post(other_user, %{status: "Marisa is cute."})
 623
 624       {:ok, _activity_two} =
 625         CommonAPI.post(other_user, %{
 626           status: "Marisa is cute.",
 627           visibility: "private"
 628         })
 629
 630       {:ok, list} = Pleroma.List.create("name", user)
 631       {:ok, list} = Pleroma.List.follow(list, other_user)
 632
 633       conn = get(conn, "/api/v1/timelines/list/#{list.id}")
 634
 635       assert [%{"id" => id}] = json_response_and_validate_schema(conn, :ok)
 636
 637       assert id == to_string(activity_one.id)
 638     end
 639
 640     test "muted emotions", %{user: user, conn: conn} do
 641       user2 = insert(:user)
 642       user3 = insert(:user)
 643       {:ok, activity} = CommonAPI.post(user2, %{status: "."})
 644
 645       {:ok, _} = CommonAPI.react_with_emoji(activity.id, user3, "🎅")
 646       User.mute(user, user3)
 647
 648       {:ok, list} = Pleroma.List.create("name", user)
 649       {:ok, list} = Pleroma.List.follow(list, user2)
 650
 651       result =
 652         conn
 653         |> get("/api/v1/timelines/list/#{list.id}")
 654         |> json_response_and_validate_schema(200)
 655
 656       assert [
 657                %{
 658                  "pleroma" => %{
 659                    "emoji_reactions" => []
 660                  }
 661                }
 662              ] = result
 663
 664       result =
 665         conn
 666         |> get("/api/v1/timelines/list/#{list.id}?with_muted=true")
 667         |> json_response_and_validate_schema(200)
 668
 669       assert [
 670                %{
 671                  "pleroma" => %{
 672                    "emoji_reactions" => [%{"count" => 1, "me" => false, "name" => "🎅"}]
 673                  }
 674                }
 675              ] = result
 676     end
 677
 678     test "filtering", %{user: user, conn: conn} do
 679       {:ok, list} = Pleroma.List.create("name", user)
 680
 681       local_user = insert(:user)
 682       {:ok, local_activity} = CommonAPI.post(local_user, %{status: "Marisa is stupid."})
 683       with_media = create_with_media_activity(local_user)
 684       {:ok, list} = Pleroma.List.follow(list, local_user)
 685
 686       remote_user = insert(:user, local: false)
 687       remote_activity = create_remote_activity(remote_user)
 688       {:ok, list} = Pleroma.List.follow(list, remote_user)
 689
 690       all_ids =
 691         conn
 692         |> get("/api/v1/timelines/list/#{list.id}")
 693         |> json_response_and_validate_schema(200)
 694         |> Enum.map(& &1["id"])
 695
 696       assert local_activity.id in all_ids
 697       assert with_media.id in all_ids
 698       assert remote_activity.id in all_ids
 699
 700       only_local_ids =
 701         conn
 702         |> get("/api/v1/timelines/list/#{list.id}?local=true")
 703         |> json_response_and_validate_schema(200)
 704         |> Enum.map(& &1["id"])
 705
 706       assert local_activity.id in only_local_ids
 707       assert with_media.id in only_local_ids
 708       refute remote_activity.id in only_local_ids
 709
 710       only_local_media_ids =
 711         conn
 712         |> get("/api/v1/timelines/list/#{list.id}?local=true&only_media=true")
 713         |> json_response_and_validate_schema(200)
 714         |> Enum.map(& &1["id"])
 715
 716       refute local_activity.id in only_local_media_ids
 717       assert with_media.id in only_local_media_ids
 718       refute remote_activity.id in only_local_media_ids
 719
 720       remote_ids =
 721         conn
 722         |> get("/api/v1/timelines/list/#{list.id}?remote=true")
 723         |> json_response_and_validate_schema(200)
 724         |> Enum.map(& &1["id"])
 725
 726       refute local_activity.id in remote_ids
 727       refute with_media.id in remote_ids
 728       assert remote_activity.id in remote_ids
 729
 730       assert conn
 731              |> get("/api/v1/timelines/list/#{list.id}?remote=true&only_media=true")
 732              |> json_response_and_validate_schema(200) == []
 733
 734       only_media_ids =
 735         conn
 736         |> get("/api/v1/timelines/list/#{list.id}?only_media=true")
 737         |> json_response_and_validate_schema(200)
 738         |> Enum.map(& &1["id"])
 739
 740       refute local_activity.id in only_media_ids
 741       assert with_media.id in only_media_ids
 742       refute remote_activity.id in only_media_ids
 743
 744       assert conn
 745              |> get("/api/v1/timelines/list/#{list.id}?only_media=true&local=true&remote=true")
 746              |> json_response_and_validate_schema(200) == []
 747     end
 748   end
 749
 750   describe "hashtag" do
 751     setup do: oauth_access(["n/a"])
 752
 753     @tag capture_log: true
 754     test "hashtag timeline", %{conn: conn} do
 755       following = insert(:user)
 756
 757       {:ok, activity} = CommonAPI.post(following, %{status: "test #2hu"})
 758       with_media = create_with_media_activity(following)
 759
 760       remote = insert(:user, local: false)
 761       remote_activity = create_remote_activity(remote)
 762
 763       all_ids =
 764         conn
 765         |> get("/api/v1/timelines/tag/2hu")
 766         |> json_response_and_validate_schema(:ok)
 767         |> Enum.map(& &1["id"])
 768
 769       assert activity.id in all_ids
 770       assert with_media.id in all_ids
 771       assert remote_activity.id in all_ids
 772
 773       # works for different capitalization too
 774       all_ids =
 775         conn
 776         |> get("/api/v1/timelines/tag/2HU")
 777         |> json_response_and_validate_schema(:ok)
 778         |> Enum.map(& &1["id"])
 779
 780       assert activity.id in all_ids
 781       assert with_media.id in all_ids
 782       assert remote_activity.id in all_ids
 783
 784       local_ids =
 785         conn
 786         |> get("/api/v1/timelines/tag/2hu?local=true")
 787         |> json_response_and_validate_schema(:ok)
 788         |> Enum.map(& &1["id"])
 789
 790       assert activity.id in local_ids
 791       assert with_media.id in local_ids
 792       refute remote_activity.id in local_ids
 793
 794       remote_ids =
 795         conn
 796         |> get("/api/v1/timelines/tag/2hu?remote=true")
 797         |> json_response_and_validate_schema(:ok)
 798         |> Enum.map(& &1["id"])
 799
 800       refute activity.id in remote_ids
 801       refute with_media.id in remote_ids
 802       assert remote_activity.id in remote_ids
 803
 804       media_ids =
 805         conn
 806         |> get("/api/v1/timelines/tag/2hu?only_media=true")
 807         |> json_response_and_validate_schema(:ok)
 808         |> Enum.map(& &1["id"])
 809
 810       refute activity.id in media_ids
 811       assert with_media.id in media_ids
 812       refute remote_activity.id in media_ids
 813
 814       media_local_ids =
 815         conn
 816         |> get("/api/v1/timelines/tag/2hu?only_media=true&local=true")
 817         |> json_response_and_validate_schema(:ok)
 818         |> Enum.map(& &1["id"])
 819
 820       refute activity.id in media_local_ids
 821       assert with_media.id in media_local_ids
 822       refute remote_activity.id in media_local_ids
 823
 824       ids =
 825         conn
 826         |> get("/api/v1/timelines/tag/2hu?only_media=true&local=true&remote=true")
 827         |> json_response_and_validate_schema(:ok)
 828         |> Enum.map(& &1["id"])
 829
 830       refute activity.id in ids
 831       refute with_media.id in ids
 832       refute remote_activity.id in ids
 833
 834       assert conn
 835              |> get("/api/v1/timelines/tag/2hu?only_media=true&remote=true")
 836              |> json_response_and_validate_schema(:ok) == []
 837     end
 838
 839     test "multi-hashtag timeline", %{conn: conn} do
 840       user = insert(:user)
 841
 842       {:ok, activity_test} = CommonAPI.post(user, %{status: "#test"})
 843       {:ok, activity_test1} = CommonAPI.post(user, %{status: "#test #test1"})
 844       {:ok, activity_none} = CommonAPI.post(user, %{status: "#test #none"})
 845
 846       any_test = get(conn, "/api/v1/timelines/tag/test?any[]=test1")
 847
 848       [status_none, status_test1, status_test] = json_response_and_validate_schema(any_test, :ok)
 849
 850       assert to_string(activity_test.id) == status_test["id"]
 851       assert to_string(activity_test1.id) == status_test1["id"]
 852       assert to_string(activity_none.id) == status_none["id"]
 853
 854       restricted_test = get(conn, "/api/v1/timelines/tag/test?all[]=test1&none[]=none")
 855
 856       assert [status_test1] == json_response_and_validate_schema(restricted_test, :ok)
 857
 858       all_test = get(conn, "/api/v1/timelines/tag/test?all[]=none")
 859
 860       assert [status_none] == json_response_and_validate_schema(all_test, :ok)
 861     end
 862
 863     test "muted emotions", %{conn: conn} do
 864       user = insert(:user)
 865       token = insert(:oauth_token, user: user, scopes: ["read:statuses"])
 866
 867       conn =
 868         conn
 869         |> assign(:user, user)
 870         |> assign(:token, token)
 871
 872       other_user = insert(:user)
 873       {:ok, activity} = CommonAPI.post(user, %{status: "test #2hu"})
 874
 875       {:ok, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
 876       User.mute(user, other_user)
 877
 878       result =
 879         conn
 880         |> get("/api/v1/timelines/tag/2hu")
 881         |> json_response_and_validate_schema(200)
 882
 883       assert [
 884                %{
 885                  "pleroma" => %{
 886                    "emoji_reactions" => []
 887                  }
 888                }
 889              ] = result
 890
 891       result =
 892         conn
 893         |> get("/api/v1/timelines/tag/2hu?with_muted=true")
 894         |> json_response_and_validate_schema(200)
 895
 896       assert [
 897                %{
 898                  "pleroma" => %{
 899                    "emoji_reactions" => [%{"count" => 1, "me" => false, "name" => "🎅"}]
 900                  }
 901                }
 902              ] = result
 903     end
 904   end
 905
 906   describe "hashtag timeline handling of :restrict_unauthenticated setting" do
 907     setup do
 908       user = insert(:user)
 909       {:ok, activity1} = CommonAPI.post(user, %{status: "test #tag1"})
 910       {:ok, _activity2} = CommonAPI.post(user, %{status: "test #tag1"})
 911
 912       activity1
 913       |> Ecto.Changeset.change(%{local: false})
 914       |> Pleroma.Repo.update()
 915
 916       base_uri = "/api/v1/timelines/tag/tag1"
 917       error_response = %{"error" => "authorization required for timeline view"}
 918
 919       %{base_uri: base_uri, error_response: error_response}
 920     end
 921
 922     defp ensure_authenticated_access(base_uri) do
 923       %{conn: auth_conn} = oauth_access(["read:statuses"])
 924
 925       res_conn = get(auth_conn, "#{base_uri}?local=true")
 926       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 927
 928       res_conn = get(auth_conn, "#{base_uri}?local=false")
 929       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 930     end
 931
 932     test "with default settings on private instances, returns 403 for unauthenticated users", %{
 933       conn: conn,
 934       base_uri: base_uri,
 935       error_response: error_response
 936     } do
 937       clear_config([:instance, :public], false)
 938       clear_config([:restrict_unauthenticated, :timelines])
 939
 940       for local <- [true, false] do
 941         res_conn = get(conn, "#{base_uri}?local=#{local}")
 942
 943         assert json_response_and_validate_schema(res_conn, :unauthorized) == error_response
 944       end
 945
 946       ensure_authenticated_access(base_uri)
 947     end
 948
 949     test "with `%{local: true, federated: true}`, returns 403 for unauthenticated users", %{
 950       conn: conn,
 951       base_uri: base_uri,
 952       error_response: error_response
 953     } do
 954       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 955       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 956
 957       for local <- [true, false] do
 958         res_conn = get(conn, "#{base_uri}?local=#{local}")
 959
 960         assert json_response_and_validate_schema(res_conn, :unauthorized) == error_response
 961       end
 962
 963       ensure_authenticated_access(base_uri)
 964     end
 965
 966     test "with `%{local: false, federated: true}`, forbids unauthenticated access to federated timeline",
 967          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 968       clear_config([:restrict_unauthenticated, :timelines, :local], false)
 969       clear_config([:restrict_unauthenticated, :timelines, :federated], true)
 970
 971       res_conn = get(conn, "#{base_uri}?local=true")
 972       assert length(json_response_and_validate_schema(res_conn, 200)) == 1
 973
 974       res_conn = get(conn, "#{base_uri}?local=false")
 975       assert json_response_and_validate_schema(res_conn, :unauthorized) == error_response
 976
 977       ensure_authenticated_access(base_uri)
 978     end
 979
 980     test "with `%{local: true, federated: false}`, forbids unauthenticated access to public timeline" <>
 981            "(but not to local public activities which are delivered as part of federated timeline)",
 982          %{conn: conn, base_uri: base_uri, error_response: error_response} do
 983       clear_config([:restrict_unauthenticated, :timelines, :local], true)
 984       clear_config([:restrict_unauthenticated, :timelines, :federated], false)
 985
 986       res_conn = get(conn, "#{base_uri}?local=true")
 987       assert json_response_and_validate_schema(res_conn, :unauthorized) == error_response
 988
 989       # Note: local activities get delivered as part of federated timeline
 990       res_conn = get(conn, "#{base_uri}?local=false")
 991       assert length(json_response_and_validate_schema(res_conn, 200)) == 2
 992
 993       ensure_authenticated_access(base_uri)
 994     end
 995   end
 996
 997   defp create_remote_activity(user) do
 998     obj =
 999       insert(:note, %{
1000         data: %{
1001           "to" => [
1002             "https://www.w3.org/ns/activitystreams#Public",
1003             User.ap_followers(user)
1004           ]
1005         },
1006         user: user
1007       })
1008
1009     insert(:note_activity, %{
1010       note: obj,
1011       recipients: [
1012         "https://www.w3.org/ns/activitystreams#Public",
1013         User.ap_followers(user)
1014       ],
1015       user: user,
1016       local: false
1017     })
1018   end
1019
1020   defp create_with_media_activity(user) do
1021     obj = insert(:attachment_note, user: user)
1022
1023     insert(:note_activity, %{
1024       note: obj,
1025       recipients: ["https://www.w3.org/ns/activitystreams#Public", User.ap_followers(user)],
1026       user: user
1027     })
1028   end
1029 end