git.squeep.com Git - akkoma/blob - test/pleroma/web/twitter_api/remote_follow_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowControllerTest do
   6   use Pleroma.Web.ConnCase
   7
   8   alias Pleroma.MFA
   9   alias Pleroma.MFA.TOTP
  10   alias Pleroma.User
  11   alias Pleroma.Web.CommonAPI
  12
  13   import ExUnit.CaptureLog
  14   import Pleroma.Factory
  15   import Ecto.Query
  16
  17   setup_all do: clear_config([:instance, :federating], true)
  18   setup do: clear_config([:user, :deny_follow_blocked])
  19
  20   describe "GET /ostatus_subscribe - remote_follow/2" do
  21     test "adds status to pleroma instance if the `acct` is a status", %{conn: conn} do
  22       Tesla.Mock.mock(fn
  23         %{method: :get, url: "https://mastodon.social/users/emelie/statuses/101849165031453009"} ->
  24           %Tesla.Env{
  25             status: 200,
  26             headers: [{"content-type", "application/activity+json"}],
  27             body: File.read!("test/fixtures/tesla_mock/status.emelie.json")
  28           }
  29
  30         %{method: :get, url: "https://mastodon.social/users/emelie"} ->
  31           %Tesla.Env{
  32             status: 200,
  33             headers: [{"content-type", "application/activity+json"}],
  34             body: File.read!("test/fixtures/tesla_mock/emelie.json")
  35           }
  36       end)
  37
  38       assert conn
  39              |> get(
  40                remote_follow_path(conn, :follow, %{
  41                  acct: "https://mastodon.social/users/emelie/statuses/101849165031453009"
  42                })
  43              )
  44              |> redirected_to() =~ "/notice/"
  45     end
  46
  47     test "show follow account page if the `acct` is a account link", %{conn: conn} do
  48       Tesla.Mock.mock(fn
  49         %{method: :get, url: "https://mastodon.social/users/emelie"} ->
  50           %Tesla.Env{
  51             status: 200,
  52             headers: [{"content-type", "application/activity+json"}],
  53             body: File.read!("test/fixtures/tesla_mock/emelie.json")
  54           }
  55       end)
  56
  57       response =
  58         conn
  59         |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
  60         |> html_response(200)
  61
  62       assert response =~ "Log in to follow"
  63     end
  64
  65     test "show follow page if the `acct` is a account link", %{conn: conn} do
  66       Tesla.Mock.mock(fn
  67         %{method: :get, url: "https://mastodon.social/users/emelie"} ->
  68           %Tesla.Env{
  69             status: 200,
  70             headers: [{"content-type", "application/activity+json"}],
  71             body: File.read!("test/fixtures/tesla_mock/emelie.json")
  72           }
  73       end)
  74
  75       user = insert(:user)
  76
  77       response =
  78         conn
  79         |> assign(:user, user)
  80         |> get(remote_follow_path(conn, :follow, %{acct: "https://mastodon.social/users/emelie"}))
  81         |> html_response(200)
  82
  83       assert response =~ "Remote follow"
  84     end
  85
  86     test "show follow page with error when user can not be fetched by `acct` link", %{conn: conn} do
  87       Tesla.Mock.mock(fn
  88         %{method: :get, url: "https://mastodon.social/users/not_found"} ->
  89           %Tesla.Env{
  90             status: 404
  91           }
  92       end)
  93
  94       user = insert(:user)
  95
  96       assert capture_log(fn ->
  97                response =
  98                  conn
  99                  |> assign(:user, user)
 100                  |> get(
 101                    remote_follow_path(conn, :follow, %{
 102                      acct: "https://mastodon.social/users/not_found"
 103                    })
 104                  )
 105                  |> html_response(200)
 106
 107                assert response =~ "Error fetching user"
 108              end) =~ "Object has been deleted"
 109     end
 110   end
 111
 112   describe "POST /ostatus_subscribe - do_follow/2 with assigned user " do
 113     test "required `follow | write:follows` scope", %{conn: conn} do
 114       user = insert(:user)
 115       user2 = insert(:user)
 116       read_token = insert(:oauth_token, user: user, scopes: ["read"])
 117
 118       assert capture_log(fn ->
 119                response =
 120                  conn
 121                  |> assign(:user, user)
 122                  |> assign(:token, read_token)
 123                  |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 124                  |> response(200)
 125
 126                assert response =~ "Error following account"
 127              end) =~ "Insufficient permissions: follow | write:follows."
 128     end
 129
 130     test "follows user", %{conn: conn} do
 131       user = insert(:user)
 132       user2 = insert(:user)
 133
 134       conn =
 135         conn
 136         |> assign(:user, user)
 137         |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
 138         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 139
 140       assert redirected_to(conn) == "/users/#{user2.id}"
 141     end
 142
 143     test "returns error when user is deactivated", %{conn: conn} do
 144       user = insert(:user, is_active: false)
 145       user2 = insert(:user)
 146
 147       response =
 148         conn
 149         |> assign(:user, user)
 150         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 151         |> response(200)
 152
 153       assert response =~ "Error following account"
 154     end
 155
 156     test "returns error when user is blocked", %{conn: conn} do
 157       clear_config([:user, :deny_follow_blocked], true)
 158       user = insert(:user)
 159       user2 = insert(:user)
 160
 161       {:ok, _user_block} = Pleroma.User.block(user2, user)
 162
 163       response =
 164         conn
 165         |> assign(:user, user)
 166         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 167         |> response(200)
 168
 169       assert response =~ "Error following account"
 170     end
 171
 172     test "returns error when followee not found", %{conn: conn} do
 173       user = insert(:user)
 174
 175       response =
 176         conn
 177         |> assign(:user, user)
 178         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => "jimm"}})
 179         |> response(200)
 180
 181       assert response =~ "Error following account"
 182     end
 183
 184     test "returns success result when user already in followers", %{conn: conn} do
 185       user = insert(:user)
 186       user2 = insert(:user)
 187       {:ok, _, _, _} = CommonAPI.follow(user, user2)
 188
 189       conn =
 190         conn
 191         |> assign(:user, refresh_record(user))
 192         |> assign(:token, insert(:oauth_token, user: user, scopes: ["write:follows"]))
 193         |> post(remote_follow_path(conn, :do_follow), %{"user" => %{"id" => user2.id}})
 194
 195       assert redirected_to(conn) == "/users/#{user2.id}"
 196     end
 197   end
 198
 199   describe "POST /ostatus_subscribe - follow/2 with enabled Two-Factor Auth " do
 200     test "render the MFA login form", %{conn: conn} do
 201       otp_secret = TOTP.generate_secret()
 202
 203       user =
 204         insert(:user,
 205           multi_factor_authentication_settings: %MFA.Settings{
 206             enabled: true,
 207             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 208           }
 209         )
 210
 211       user2 = insert(:user)
 212
 213       response =
 214         conn
 215         |> post(remote_follow_path(conn, :do_follow), %{
 216           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 217         })
 218         |> response(200)
 219
 220       mfa_token = Pleroma.Repo.one(from(q in Pleroma.MFA.Token, where: q.user_id == ^user.id))
 221
 222       assert response =~ "Two-factor authentication"
 223       assert response =~ "Authentication code"
 224       assert response =~ mfa_token.token
 225       refute user2.follower_address in User.following(user)
 226     end
 227
 228     test "returns error when password is incorrect", %{conn: conn} do
 229       otp_secret = TOTP.generate_secret()
 230
 231       user =
 232         insert(:user,
 233           multi_factor_authentication_settings: %MFA.Settings{
 234             enabled: true,
 235             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 236           }
 237         )
 238
 239       user2 = insert(:user)
 240
 241       response =
 242         conn
 243         |> post(remote_follow_path(conn, :do_follow), %{
 244           "authorization" => %{"name" => user.nickname, "password" => "test1", "id" => user2.id}
 245         })
 246         |> response(200)
 247
 248       assert response =~ "Wrong username or password"
 249       refute user2.follower_address in User.following(user)
 250     end
 251
 252     test "follows", %{conn: conn} do
 253       otp_secret = TOTP.generate_secret()
 254
 255       user =
 256         insert(:user,
 257           multi_factor_authentication_settings: %MFA.Settings{
 258             enabled: true,
 259             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 260           }
 261         )
 262
 263       {:ok, %{token: token}} = MFA.Token.create(user)
 264
 265       user2 = insert(:user)
 266       otp_token = TOTP.generate_token(otp_secret)
 267
 268       conn =
 269         conn
 270         |> post(
 271           remote_follow_path(conn, :do_follow),
 272           %{
 273             "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
 274           }
 275         )
 276
 277       assert redirected_to(conn) == "/users/#{user2.id}"
 278       assert user2.follower_address in User.following(user)
 279     end
 280
 281     test "returns error when auth code is incorrect", %{conn: conn} do
 282       otp_secret = TOTP.generate_secret()
 283
 284       user =
 285         insert(:user,
 286           multi_factor_authentication_settings: %MFA.Settings{
 287             enabled: true,
 288             totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
 289           }
 290         )
 291
 292       {:ok, %{token: token}} = MFA.Token.create(user)
 293
 294       user2 = insert(:user)
 295       otp_token = TOTP.generate_token(TOTP.generate_secret())
 296
 297       response =
 298         conn
 299         |> post(
 300           remote_follow_path(conn, :do_follow),
 301           %{
 302             "mfa" => %{"code" => otp_token, "token" => token, "id" => user2.id}
 303           }
 304         )
 305         |> response(200)
 306
 307       assert response =~ "Wrong authentication code"
 308       refute user2.follower_address in User.following(user)
 309     end
 310   end
 311
 312   describe "POST /ostatus_subscribe - follow/2 without assigned user " do
 313     test "follows", %{conn: conn} do
 314       user = insert(:user)
 315       user2 = insert(:user)
 316
 317       conn =
 318         conn
 319         |> post(remote_follow_path(conn, :do_follow), %{
 320           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 321         })
 322
 323       assert redirected_to(conn) == "/users/#{user2.id}"
 324       assert user2.follower_address in User.following(user)
 325     end
 326
 327     test "returns error when followee not found", %{conn: conn} do
 328       user = insert(:user)
 329
 330       response =
 331         conn
 332         |> post(remote_follow_path(conn, :do_follow), %{
 333           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => "jimm"}
 334         })
 335         |> response(200)
 336
 337       assert response =~ "Error following account"
 338     end
 339
 340     test "returns error when login invalid", %{conn: conn} do
 341       user = insert(:user)
 342
 343       response =
 344         conn
 345         |> post(remote_follow_path(conn, :do_follow), %{
 346           "authorization" => %{"name" => "jimm", "password" => "test", "id" => user.id}
 347         })
 348         |> response(200)
 349
 350       assert response =~ "Wrong username or password"
 351     end
 352
 353     test "returns error when password invalid", %{conn: conn} do
 354       user = insert(:user)
 355       user2 = insert(:user)
 356
 357       response =
 358         conn
 359         |> post(remote_follow_path(conn, :do_follow), %{
 360           "authorization" => %{"name" => user.nickname, "password" => "42", "id" => user2.id}
 361         })
 362         |> response(200)
 363
 364       assert response =~ "Wrong username or password"
 365     end
 366
 367     test "returns error when user is blocked", %{conn: conn} do
 368       clear_config([:user, :deny_follow_blocked], true)
 369       user = insert(:user)
 370       user2 = insert(:user)
 371       {:ok, _user_block} = Pleroma.User.block(user2, user)
 372
 373       response =
 374         conn
 375         |> post(remote_follow_path(conn, :do_follow), %{
 376           "authorization" => %{"name" => user.nickname, "password" => "test", "id" => user2.id}
 377         })
 378         |> response(200)
 379
 380       assert response =~ "Error following account"
 381     end
 382   end
 383 end