git.squeep.com Git - akkoma/blob - test/pleroma/web/twitter_api/remote_follow_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.Config
   9   alias Pleroma.MFA
  10   alias Pleroma.MFA.TOTP
  11   alias Pleroma.User
  12   alias Pleroma.Web.CommonAPI
  13
  14   import ExUnit.CaptureLog
  15   import Pleroma.Factory
  16   import Ecto.Query
  17
  18   setup do
  19     Tesla.Mock.mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  20     :ok
  21   end
  22
  23   setup_all do: clear_config([:instance, :federating], true)
  24   setup do: clear_config([:instance])
  25   setup do: clear_config([:frontend_configurations, :pleroma_fe])
  26   setup do: clear_config([:user, :deny_follow_blocked])
  27
  28   describe "GET /ostatus_subscribe - remote_follow/2" do
  29     test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
  30       assert conn
  31              |> get(
  32                remote_follow_path(conn, :follow, %{
  33                  acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
  34                })
  35              )
  36              |> redirected_to() =~ "/notice/"
  37     end
  38
  39     test "show follow account page if the `acct` is a account link", %{conn: conn} do
  40       response =
  41         conn
  42         |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
  43         |> html_response(200)
  44
  45       assert response =~ "Log in to follow"
  46     end
  47
  48     test "show follow page if the `acct` is a account link", %{conn: conn} do
  49       user = insert(:user)
  50
  51       response =
  52         conn
  53         |> assign(:user, user)
  54         |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
  55         |> html_response(200)
  56
  57       assert response =~ "Remote follow"
  58     end
  59
  60     test "show follow page with error when user cannot fecth by `acct` link", %{conn: conn} do
  61       user = insert(:user)
  62
  63       assert capture_log(fn ->
  64                response =
  65                  conn
  66                  |> assign(:user, user)
  67                  |> get(
  68                    remote_follow_path(conn, :follow, %{
  69                      acct: "https://mastodon.social/users/not_found"
  70                    })
  71                  )
  72                  |> html_response(200)
  73
  74                assert response =~ "Error fetching user"
  75              end) =~ "Object has been deleted"
  76     end
  77   end
  78
  79   describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
  80     test "required `follow | write:follows` scope", %{conn: conn} do
  81       user = insert(:user)
  82       user2 = insert(:user)
  83       read_token = insert(:oauth_token, user: user, scopes: ["read"])
  84
  85       assert capture_log(fn ->
  86                response =
  87                  conn
  88                  |> assign(:user, user)
  89                  |> assign(:token, read_token)
  90                  |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
  91                  |> response(200)
  92
  93                assert response =~ "Error following account"
  94              end) =~ "Insufficient permissions: follow | write:follows."
  95     end
  96
  97     test "follows user", %{conn: conn} do
  98       user = insert(:user)
  99       user2 = insert(:user)
 100
 101       conn =
 102         conn
 103         |> assign(:user, user)
 104         |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
 105         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 106
 107       assert redirected_to(conn) == "/users/#{user2.id}"
 108     end
 109
 110     test "returns error when user is deactivated", %{conn: conn} do
 111       user = insert(:user, deactivated: true)
 112       user2 = insert(:user)
 113
 114       response =
 115         conn
 116         |> assign(:user, user)
 117         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 118         |> response(200)
 119
 120       assert response =~ "Error following account"
 121     end
 122
 123     test "returns error when user is blocked", %{conn: conn} do
 124       Pleroma.Config.put([:user, :deny_follow_blocked], true)
 125       user = insert(:user)
 126       user2 = insert(:user)
 127
 128       {:ok, _user_block} = Pleroma.User.block(user2, user)
 129
 130       response =
 131         conn
 132         |> assign(:user, user)
 133         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 134         |> response(200)
 135
 136       assert response =~ "Error following account"
 137     end
 138
 139     test "returns error when followee not found", %{conn: conn} do
 140       user = insert(:user)
 141
 142       response =
 143         conn
 144         |> assign(:user, user)
 145         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
 146         |> response(200)
 147
 148       assert response =~ "Error following account"
 149     end
 150
 151     test "returns success result when user already in followers", %{conn: conn} do
 152       user = insert(:user)
 153       user2 = insert(:user)
 154       {:ok, _, _, _} = CommonAPI.follow(user, user2)
 155
 156       conn =
 157         conn
 158         |> assign(:user, refresh_record(user))
 159         |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
 160         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 161
 162       assert redirected_to(conn) == "/users/#{user2.id}"
 163     end
 164   end
 165
 166   describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
 167     test "render the MFA login form", %{conn: conn} do
 168       otp_secret = TOTP.generate_secret()
 169
 170       user =
 171         insert(:user,
 172           multi_factor_authentication_settings: %MFA.Settings{
 173             enabled: true,
 174             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 175           }
 176         )
 177
 178       user2 = insert(:user)
 179
 180       response =
 181         conn
 182         |> post(remote_follow_path(conn, :do_follow), %{
 183           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 184         })
 185         |> response(200)
 186
 187       mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))
 188
 189       assert response =~ "Two-factor authentication"
 190       assert response =~ "Authentication code"
 191       assert response =~ mfa_token.token
 192       refute user2.follower_address in User.following(user)
 193     end
 194
 195     test "returns error when password is incorrect", %{conn: conn} do
 196       otp_secret = TOTP.generate_secret()
 197
 198       user =
 199         insert(:user,
 200           multi_factor_authentication_settings: %MFA.Settings{
 201             enabled: true,
 202             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 203           }
 204         )
 205
 206       user2 = insert(:user)
 207
 208       response =
 209         conn
 210         |> post(remote_follow_path(conn, :do_follow), %{
 211           "authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
 212         })
 213         |> response(200)
 214
 215       assert response =~ "Wrong username or password"
 216       refute user2.follower_address in User.following(user)
 217     end
 218
 219     test "follows", %{conn: conn} do
 220       otp_secret = TOTP.generate_secret()
 221
 222       user =
 223         insert(:user,
 224           multi_factor_authentication_settings: %MFA.Settings{
 225             enabled: true,
 226             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 227           }
 228         )
 229
 230       {:ok, %{token: token}} = MFA.Token.create(user)
 231
 232       user2 = insert(:user)
 233       otp_token = TOTP.generate_token(otp_secret)
 234
 235       conn =
 236         conn
 237         |> post(
 238           remote_follow_path(conn, :do_follow),
 239           %{
 240             "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
 241           }
 242         )
 243
 244       assert redirected_to(conn) == "/users/#{user2.id}"
 245       assert user2.follower_address in User.following(user)
 246     end
 247
 248     test "returns error when auth code is incorrect", %{conn: conn} do
 249       otp_secret = TOTP.generate_secret()
 250
 251       user =
 252         insert(:user,
 253           multi_factor_authentication_settings: %MFA.Settings{
 254             enabled: true,
 255             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 256           }
 257         )
 258
 259       {:ok, %{token: token}} = MFA.Token.create(user)
 260
 261       user2 = insert(:user)
 262       otp_token = TOTP.generate_token(TOTP.generate_secret())
 263
 264       response =
 265         conn
 266         |> post(
 267           remote_follow_path(conn, :do_follow),
 268           %{
 269             "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
 270           }
 271         )
 272         |> response(200)
 273
 274       assert response =~ "Wrong authentication code"
 275       refute user2.follower_address in User.following(user)
 276     end
 277   end
 278
 279   describe "POST /ostatus_subscribe - follow/2 without assigned user " do
 280     test "follows", %{conn: conn} do
 281       user = insert(:user)
 282       user2 = insert(:user)
 283
 284       conn =
 285         conn
 286         |> post(remote_follow_path(conn, :do_follow), %{
 287           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 288         })
 289
 290       assert redirected_to(conn) == "/users/#{user2.id}"
 291       assert user2.follower_address in User.following(user)
 292     end
 293
 294     test "returns error when followee not found", %{conn: conn} do
 295       user = insert(:user)
 296
 297       response =
 298         conn
 299         |> post(remote_follow_path(conn, :do_follow), %{
 300           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
 301         })
 302         |> response(200)
 303
 304       assert response =~ "Error following account"
 305     end
 306
 307     test "returns error when login invalid", %{conn: conn} do
 308       user = insert(:user)
 309
 310       response =
 311         conn
 312         |> post(remote_follow_path(conn, :do_follow), %{
 313           "authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
 314         })
 315         |> response(200)
 316
 317       assert response =~ "Wrong username or password"
 318     end
 319
 320     test "returns error when password invalid", %{conn: conn} do
 321       user = insert(:user)
 322       user2 = insert(:user)
 323
 324       response =
 325         conn
 326         |> post(remote_follow_path(conn, :do_follow), %{
 327           "authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
 328         })
 329         |> response(200)
 330
 331       assert response =~ "Wrong username or password"
 332     end
 333
 334     test "returns error when user is blocked", %{conn: conn} do
 335       Pleroma.Config.put([:user, :deny_follow_blocked], true)
 336       user = insert(:user)
 337       user2 = insert(:user)
 338       {:ok, _user_block} = Pleroma.User.block(user2, user)
 339
 340       response =
 341         conn
 342         |> post(remote_follow_path(conn, :do_follow), %{
 343           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 344         })
 345         |> response(200)
 346
 347       assert response =~ "Error following account"
 348     end
 349   end
 350 end