git.squeep.com Git - akkoma/blob - test/pleroma/web/twitter_api/remote_follow_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.MFA
   9   alias Pleroma.MFA.TOTP
  10   alias Pleroma.User
  11   alias Pleroma.Web.CommonAPI
  12
  13   import ExUnit.CaptureLog
  14   import Pleroma.Factory
  15   import Ecto.Query
  16
  17   setup do
  18     Tesla.Mock.mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
  19     :ok
  20   end
  21
  22   setup_all do: clear_config([:instance, :federating], true)
  23   setup do: clear_config([:instance])
  24   setup do: clear_config([:frontend_configurations, :pleroma_fe])
  25   setup do: clear_config([:user, :deny_follow_blocked])
  26
  27   describe "GET /ostatus_subscribe - remote_follow/2" do
  28     test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
  29       assert conn
  30              |> get(
  31                remote_follow_path(conn, :follow, %{
  32                  acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
  33                })
  34              )
  35              |> redirected_to() =~ "/notice/"
  36     end
  37
  38     test "show follow account page if the `acct` is a account link", %{conn: conn} do
  39       response =
  40         conn
  41         |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
  42         |> html_response(200)
  43
  44       assert response =~ "Log in to follow"
  45     end
  46
  47     test "show follow page if the `acct` is a account link", %{conn: conn} do
  48       user = insert(:user)
  49
  50       response =
  51         conn
  52         |> assign(:user, user)
  53         |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
  54         |> html_response(200)
  55
  56       assert response =~ "Remote follow"
  57     end
  58
  59     test "show follow page with error when user cannot fecth by `acct` link", %{conn: conn} do
  60       user = insert(:user)
  61
  62       assert capture_log(fn ->
  63                response =
  64                  conn
  65                  |> assign(:user, user)
  66                  |> get(
  67                    remote_follow_path(conn, :follow, %{
  68                      acct: "https://mastodon.social/users/not_found"
  69                    })
  70                  )
  71                  |> html_response(200)
  72
  73                assert response =~ "Error fetching user"
  74              end) =~ "Object has been deleted"
  75     end
  76   end
  77
  78   describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
  79     test "required `follow | write:follows` scope", %{conn: conn} do
  80       user = insert(:user)
  81       user2 = insert(:user)
  82       read_token = insert(:oauth_token, user: user, scopes: ["read"])
  83
  84       assert capture_log(fn ->
  85                response =
  86                  conn
  87                  |> assign(:user, user)
  88                  |> assign(:token, read_token)
  89                  |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
  90                  |> response(200)
  91
  92                assert response =~ "Error following account"
  93              end) =~ "Insufficient permissions: follow | write:follows."
  94     end
  95
  96     test "follows user", %{conn: conn} do
  97       user = insert(:user)
  98       user2 = insert(:user)
  99
 100       conn =
 101         conn
 102         |> assign(:user, user)
 103         |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
 104         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 105
 106       assert redirected_to(conn) == "/users/#{user2.id}"
 107     end
 108
 109     test "returns error when user is deactivated", %{conn: conn} do
 110       user = insert(:user, deactivated: true)
 111       user2 = insert(:user)
 112
 113       response =
 114         conn
 115         |> assign(:user, user)
 116         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 117         |> response(200)
 118
 119       assert response =~ "Error following account"
 120     end
 121
 122     test "returns error when user is blocked", %{conn: conn} do
 123       Pleroma.Config.put([:user, :deny_follow_blocked], true)
 124       user = insert(:user)
 125       user2 = insert(:user)
 126
 127       {:ok, _user_block} = Pleroma.User.block(user2, user)
 128
 129       response =
 130         conn
 131         |> assign(:user, user)
 132         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 133         |> response(200)
 134
 135       assert response =~ "Error following account"
 136     end
 137
 138     test "returns error when followee not found", %{conn: conn} do
 139       user = insert(:user)
 140
 141       response =
 142         conn
 143         |> assign(:user, user)
 144         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
 145         |> response(200)
 146
 147       assert response =~ "Error following account"
 148     end
 149
 150     test "returns success result when user already in followers", %{conn: conn} do
 151       user = insert(:user)
 152       user2 = insert(:user)
 153       {:ok, _, _, _} = CommonAPI.follow(user, user2)
 154
 155       conn =
 156         conn
 157         |> assign(:user, refresh_record(user))
 158         |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
 159         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 160
 161       assert redirected_to(conn) == "/users/#{user2.id}"
 162     end
 163   end
 164
 165   describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
 166     test "render the MFA login form", %{conn: conn} do
 167       otp_secret = TOTP.generate_secret()
 168
 169       user =
 170         insert(:user,
 171           multi_factor_authentication_settings: %MFA.Settings{
 172             enabled: true,
 173             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 174           }
 175         )
 176
 177       user2 = insert(:user)
 178
 179       response =
 180         conn
 181         |> post(remote_follow_path(conn, :do_follow), %{
 182           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 183         })
 184         |> response(200)
 185
 186       mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))
 187
 188       assert response =~ "Two-factor authentication"
 189       assert response =~ "Authentication code"
 190       assert response =~ mfa_token.token
 191       refute user2.follower_address in User.following(user)
 192     end
 193
 194     test "returns error when password is incorrect", %{conn: conn} do
 195       otp_secret = TOTP.generate_secret()
 196
 197       user =
 198         insert(:user,
 199           multi_factor_authentication_settings: %MFA.Settings{
 200             enabled: true,
 201             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 202           }
 203         )
 204
 205       user2 = insert(:user)
 206
 207       response =
 208         conn
 209         |> post(remote_follow_path(conn, :do_follow), %{
 210           "authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
 211         })
 212         |> response(200)
 213
 214       assert response =~ "Wrong username or password"
 215       refute user2.follower_address in User.following(user)
 216     end
 217
 218     test "follows", %{conn: conn} do
 219       otp_secret = TOTP.generate_secret()
 220
 221       user =
 222         insert(:user,
 223           multi_factor_authentication_settings: %MFA.Settings{
 224             enabled: true,
 225             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 226           }
 227         )
 228
 229       {:ok, %{token: token}} = MFA.Token.create(user)
 230
 231       user2 = insert(:user)
 232       otp_token = TOTP.generate_token(otp_secret)
 233
 234       conn =
 235         conn
 236         |> post(
 237           remote_follow_path(conn, :do_follow),
 238           %{
 239             "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
 240           }
 241         )
 242
 243       assert redirected_to(conn) == "/users/#{user2.id}"
 244       assert user2.follower_address in User.following(user)
 245     end
 246
 247     test "returns error when auth code is incorrect", %{conn: conn} do
 248       otp_secret = TOTP.generate_secret()
 249
 250       user =
 251         insert(:user,
 252           multi_factor_authentication_settings: %MFA.Settings{
 253             enabled: true,
 254             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 255           }
 256         )
 257
 258       {:ok, %{token: token}} = MFA.Token.create(user)
 259
 260       user2 = insert(:user)
 261       otp_token = TOTP.generate_token(TOTP.generate_secret())
 262
 263       response =
 264         conn
 265         |> post(
 266           remote_follow_path(conn, :do_follow),
 267           %{
 268             "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
 269           }
 270         )
 271         |> response(200)
 272
 273       assert response =~ "Wrong authentication code"
 274       refute user2.follower_address in User.following(user)
 275     end
 276   end
 277
 278   describe "POST /ostatus_subscribe - follow/2 without assigned user " do
 279     test "follows", %{conn: conn} do
 280       user = insert(:user)
 281       user2 = insert(:user)
 282
 283       conn =
 284         conn
 285         |> post(remote_follow_path(conn, :do_follow), %{
 286           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 287         })
 288
 289       assert redirected_to(conn) == "/users/#{user2.id}"
 290       assert user2.follower_address in User.following(user)
 291     end
 292
 293     test "returns error when followee not found", %{conn: conn} do
 294       user = insert(:user)
 295
 296       response =
 297         conn
 298         |> post(remote_follow_path(conn, :do_follow), %{
 299           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
 300         })
 301         |> response(200)
 302
 303       assert response =~ "Error following account"
 304     end
 305
 306     test "returns error when login invalid", %{conn: conn} do
 307       user = insert(:user)
 308
 309       response =
 310         conn
 311         |> post(remote_follow_path(conn, :do_follow), %{
 312           "authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
 313         })
 314         |> response(200)
 315
 316       assert response =~ "Wrong username or password"
 317     end
 318
 319     test "returns error when password invalid", %{conn: conn} do
 320       user = insert(:user)
 321       user2 = insert(:user)
 322
 323       response =
 324         conn
 325         |> post(remote_follow_path(conn, :do_follow), %{
 326           "authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
 327         })
 328         |> response(200)
 329
 330       assert response =~ "Wrong username or password"
 331     end
 332
 333     test "returns error when user is blocked", %{conn: conn} do
 334       Pleroma.Config.put([:user, :deny_follow_blocked], true)
 335       user = insert(:user)
 336       user2 = insert(:user)
 337       {:ok, _user_block} = Pleroma.User.block(user2, user)
 338
 339       response =
 340         conn
 341         |> post(remote_follow_path(conn, :do_follow), %{
 342           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 343         })
 344         |> response(200)
 345
 346       assert response =~ "Error following account"
 347     end
 348   end
 349 end