git.squeep.com Git - akkoma/blob - test/web/activity_pub/activity_pub_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
   6   use Pleroma.Web.ConnCase
   7   import Pleroma.Factory
   8   alias Pleroma.Activity
   9   alias Pleroma.Instances
  10   alias Pleroma.Object
  11   alias Pleroma.User
  12   alias Pleroma.Web.ActivityPub.ObjectView
  13   alias Pleroma.Web.ActivityPub.UserView
  14   alias Pleroma.Web.ActivityPub.Utils
  15   alias Pleroma.Web.CommonAPI
  16
  17   setup_all do
  18     Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
  19
  20     config_path = [:instance, :federating]
  21     initial_setting = Pleroma.Config.get(config_path)
  22
  23     Pleroma.Config.put(config_path, true)
  24     on_exit(fn -> Pleroma.Config.put(config_path, initial_setting) end)
  25
  26     :ok
  27   end
  28
  29   describe "/relay" do
  30     test "with the relay active, it returns the relay user", %{conn: conn} do
  31       res =
  32         conn
  33         |> get(activity_pub_path(conn, :relay))
  34         |> json_response(200)
  35
  36       assert res["id"] =~ "/relay"
  37     end
  38
  39     test "with the relay disabled, it returns 404", %{conn: conn} do
  40       Pleroma.Config.put([:instance, :allow_relay], false)
  41
  42       conn
  43       |> get(activity_pub_path(conn, :relay))
  44       |> json_response(404)
  45       |> assert
  46
  47       Pleroma.Config.put([:instance, :allow_relay], true)
  48     end
  49   end
  50
  51   describe "/internal/fetch" do
  52     test "it returns the internal fetch user", %{conn: conn} do
  53       res =
  54         conn
  55         |> get(activity_pub_path(conn, :internal_fetch))
  56         |> json_response(200)
  57
  58       assert res["id"] =~ "/fetch"
  59     end
  60   end
  61
  62   describe "/users/:nickname" do
  63     test "it returns a json representation of the user with accept application/json", %{
  64       conn: conn
  65     } do
  66       user = insert(:user)
  67
  68       conn =
  69         conn
  70         |> put_req_header("accept", "application/json")
  71         |> get("/users/#{user.nickname}")
  72
  73       user = User.get_cached_by_id(user.id)
  74
  75       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
  76     end
  77
  78     test "it returns a json representation of the user with accept application/activity+json", %{
  79       conn: conn
  80     } do
  81       user = insert(:user)
  82
  83       conn =
  84         conn
  85         |> put_req_header("accept", "application/activity+json")
  86         |> get("/users/#{user.nickname}")
  87
  88       user = User.get_cached_by_id(user.id)
  89
  90       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
  91     end
  92
  93     test "it returns a json representation of the user with accept application/ld+json", %{
  94       conn: conn
  95     } do
  96       user = insert(:user)
  97
  98       conn =
  99         conn
 100         |> put_req_header(
 101           "accept",
 102           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 103         )
 104         |> get("/users/#{user.nickname}")
 105
 106       user = User.get_cached_by_id(user.id)
 107
 108       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 109     end
 110   end
 111
 112   describe "/object/:uuid" do
 113     test "it returns a json representation of the object with accept application/json", %{
 114       conn: conn
 115     } do
 116       note = insert(:note)
 117       uuid = String.split(note.data["id"], "/") |> List.last()
 118
 119       conn =
 120         conn
 121         |> put_req_header("accept", "application/json")
 122         |> get("/objects/#{uuid}")
 123
 124       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 125     end
 126
 127     test "it returns a json representation of the object with accept application/activity+json",
 128          %{conn: conn} do
 129       note = insert(:note)
 130       uuid = String.split(note.data["id"], "/") |> List.last()
 131
 132       conn =
 133         conn
 134         |> put_req_header("accept", "application/activity+json")
 135         |> get("/objects/#{uuid}")
 136
 137       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 138     end
 139
 140     test "it returns a json representation of the object with accept application/ld+json", %{
 141       conn: conn
 142     } do
 143       note = insert(:note)
 144       uuid = String.split(note.data["id"], "/") |> List.last()
 145
 146       conn =
 147         conn
 148         |> put_req_header(
 149           "accept",
 150           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 151         )
 152         |> get("/objects/#{uuid}")
 153
 154       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 155     end
 156
 157     test "it returns 404 for non-public messages", %{conn: conn} do
 158       note = insert(:direct_note)
 159       uuid = String.split(note.data["id"], "/") |> List.last()
 160
 161       conn =
 162         conn
 163         |> put_req_header("accept", "application/activity+json")
 164         |> get("/objects/#{uuid}")
 165
 166       assert json_response(conn, 404)
 167     end
 168
 169     test "it returns 404 for tombstone objects", %{conn: conn} do
 170       tombstone = insert(:tombstone)
 171       uuid = String.split(tombstone.data["id"], "/") |> List.last()
 172
 173       conn =
 174         conn
 175         |> put_req_header("accept", "application/activity+json")
 176         |> get("/objects/#{uuid}")
 177
 178       assert json_response(conn, 404)
 179     end
 180   end
 181
 182   describe "/object/:uuid/likes" do
 183     test "it returns the like activities in a collection", %{conn: conn} do
 184       like = insert(:like_activity)
 185       like_object_ap_id = Object.normalize(like).data["id"]
 186       uuid = String.split(like_object_ap_id, "/") |> List.last()
 187
 188       result =
 189         conn
 190         |> put_req_header("accept", "application/activity+json")
 191         |> get("/objects/#{uuid}/likes")
 192         |> json_response(200)
 193
 194       assert List.first(result["first"]["orderedItems"])["id"] == like.data["id"]
 195     end
 196   end
 197
 198   describe "/activities/:uuid" do
 199     test "it returns a json representation of the activity", %{conn: conn} do
 200       activity = insert(:note_activity)
 201       uuid = String.split(activity.data["id"], "/") |> List.last()
 202
 203       conn =
 204         conn
 205         |> put_req_header("accept", "application/activity+json")
 206         |> get("/activities/#{uuid}")
 207
 208       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 209     end
 210
 211     test "it returns 404 for non-public activities", %{conn: conn} do
 212       activity = insert(:direct_note_activity)
 213       uuid = String.split(activity.data["id"], "/") |> List.last()
 214
 215       conn =
 216         conn
 217         |> put_req_header("accept", "application/activity+json")
 218         |> get("/activities/#{uuid}")
 219
 220       assert json_response(conn, 404)
 221     end
 222   end
 223
 224   describe "/inbox" do
 225     test "it inserts an incoming activity into the database", %{conn: conn} do
 226       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 227
 228       conn =
 229         conn
 230         |> assign(:valid_signature, true)
 231         |> put_req_header("content-type", "application/activity+json")
 232         |> post("/inbox", data)
 233
 234       assert "ok" == json_response(conn, 200)
 235       :timer.sleep(500)
 236       assert Activity.get_by_ap_id(data["id"])
 237     end
 238
 239     test "it clears `unreachable` federation status of the sender", %{conn: conn} do
 240       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 241
 242       sender_url = data["actor"]
 243       Instances.set_consistently_unreachable(sender_url)
 244       refute Instances.reachable?(sender_url)
 245
 246       conn =
 247         conn
 248         |> assign(:valid_signature, true)
 249         |> put_req_header("content-type", "application/activity+json")
 250         |> post("/inbox", data)
 251
 252       assert "ok" == json_response(conn, 200)
 253       assert Instances.reachable?(sender_url)
 254     end
 255   end
 256
 257   describe "/users/:nickname/inbox" do
 258     setup do
 259       data =
 260         File.read!("test/fixtures/mastodon-post-activity.json")
 261         |> Poison.decode!()
 262
 263       [data: data]
 264     end
 265
 266     test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
 267       user = insert(:user)
 268       data = Map.put(data, "bcc", [user.ap_id])
 269
 270       conn =
 271         conn
 272         |> assign(:valid_signature, true)
 273         |> put_req_header("content-type", "application/activity+json")
 274         |> post("/users/#{user.nickname}/inbox", data)
 275
 276       assert "ok" == json_response(conn, 200)
 277       :timer.sleep(500)
 278       assert Activity.get_by_ap_id(data["id"])
 279     end
 280
 281     test "it accepts messages from actors that are followed by the user", %{
 282       conn: conn,
 283       data: data
 284     } do
 285       recipient = insert(:user)
 286       actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})
 287
 288       {:ok, recipient} = User.follow(recipient, actor)
 289
 290       object =
 291         data["object"]
 292         |> Map.put("attributedTo", actor.ap_id)
 293
 294       data =
 295         data
 296         |> Map.put("actor", actor.ap_id)
 297         |> Map.put("object", object)
 298
 299       conn =
 300         conn
 301         |> assign(:valid_signature, true)
 302         |> put_req_header("content-type", "application/activity+json")
 303         |> post("/users/#{recipient.nickname}/inbox", data)
 304
 305       assert "ok" == json_response(conn, 200)
 306       :timer.sleep(500)
 307       assert Activity.get_by_ap_id(data["id"])
 308     end
 309
 310     test "it rejects reads from other users", %{conn: conn} do
 311       user = insert(:user)
 312       otheruser = insert(:user)
 313
 314       conn =
 315         conn
 316         |> assign(:user, otheruser)
 317         |> put_req_header("accept", "application/activity+json")
 318         |> get("/users/#{user.nickname}/inbox")
 319
 320       assert json_response(conn, 403)
 321     end
 322
 323     test "it returns a note activity in a collection", %{conn: conn} do
 324       note_activity = insert(:direct_note_activity)
 325       note_object = Object.normalize(note_activity)
 326       user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))
 327
 328       conn =
 329         conn
 330         |> assign(:user, user)
 331         |> put_req_header("accept", "application/activity+json")
 332         |> get("/users/#{user.nickname}/inbox")
 333
 334       assert response(conn, 200) =~ note_object.data["content"]
 335     end
 336
 337     test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
 338       user = insert(:user)
 339       data = Map.put(data, "bcc", [user.ap_id])
 340
 341       sender_host = URI.parse(data["actor"]).host
 342       Instances.set_consistently_unreachable(sender_host)
 343       refute Instances.reachable?(sender_host)
 344
 345       conn =
 346         conn
 347         |> assign(:valid_signature, true)
 348         |> put_req_header("content-type", "application/activity+json")
 349         |> post("/users/#{user.nickname}/inbox", data)
 350
 351       assert "ok" == json_response(conn, 200)
 352       assert Instances.reachable?(sender_host)
 353     end
 354
 355     test "it removes all follower collections but actor's", %{conn: conn} do
 356       [actor, recipient] = insert_pair(:user)
 357
 358       data =
 359         File.read!("test/fixtures/activitypub-client-post-activity.json")
 360         |> Poison.decode!()
 361
 362       object = Map.put(data["object"], "attributedTo", actor.ap_id)
 363
 364       data =
 365         data
 366         |> Map.put("id", Utils.generate_object_id())
 367         |> Map.put("actor", actor.ap_id)
 368         |> Map.put("object", object)
 369         |> Map.put("cc", [
 370           recipient.follower_address,
 371           actor.follower_address
 372         ])
 373         |> Map.put("to", [
 374           recipient.ap_id,
 375           recipient.follower_address,
 376           "https://www.w3.org/ns/activitystreams#Public"
 377         ])
 378
 379       conn
 380       |> assign(:valid_signature, true)
 381       |> put_req_header("content-type", "application/activity+json")
 382       |> post("/users/#{recipient.nickname}/inbox", data)
 383       |> json_response(200)
 384
 385       activity = Activity.get_by_ap_id(data["id"])
 386
 387       assert activity.id
 388       assert actor.follower_address in activity.recipients
 389       assert actor.follower_address in activity.data["cc"]
 390
 391       refute recipient.follower_address in activity.recipients
 392       refute recipient.follower_address in activity.data["cc"]
 393       refute recipient.follower_address in activity.data["to"]
 394     end
 395   end
 396
 397   describe "/users/:nickname/outbox" do
 398     test "it will not bomb when there is no activity", %{conn: conn} do
 399       user = insert(:user)
 400
 401       conn =
 402         conn
 403         |> put_req_header("accept", "application/activity+json")
 404         |> get("/users/#{user.nickname}/outbox")
 405
 406       result = json_response(conn, 200)
 407       assert user.ap_id <> "/outbox" == result["id"]
 408     end
 409
 410     test "it returns a note activity in a collection", %{conn: conn} do
 411       note_activity = insert(:note_activity)
 412       note_object = Object.normalize(note_activity)
 413       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 414
 415       conn =
 416         conn
 417         |> put_req_header("accept", "application/activity+json")
 418         |> get("/users/#{user.nickname}/outbox")
 419
 420       assert response(conn, 200) =~ note_object.data["content"]
 421     end
 422
 423     test "it returns an announce activity in a collection", %{conn: conn} do
 424       announce_activity = insert(:announce_activity)
 425       user = User.get_cached_by_ap_id(announce_activity.data["actor"])
 426
 427       conn =
 428         conn
 429         |> put_req_header("accept", "application/activity+json")
 430         |> get("/users/#{user.nickname}/outbox")
 431
 432       assert response(conn, 200) =~ announce_activity.data["object"]
 433     end
 434
 435     test "it rejects posts from other users", %{conn: conn} do
 436       data = File.read!("test/fixtures/activitypub-client-post-activity.json") |> Poison.decode!()
 437       user = insert(:user)
 438       otheruser = insert(:user)
 439
 440       conn =
 441         conn
 442         |> assign(:user, otheruser)
 443         |> put_req_header("content-type", "application/activity+json")
 444         |> post("/users/#{user.nickname}/outbox", data)
 445
 446       assert json_response(conn, 403)
 447     end
 448
 449     test "it inserts an incoming create activity into the database", %{conn: conn} do
 450       data = File.read!("test/fixtures/activitypub-client-post-activity.json") |> Poison.decode!()
 451       user = insert(:user)
 452
 453       conn =
 454         conn
 455         |> assign(:user, user)
 456         |> put_req_header("content-type", "application/activity+json")
 457         |> post("/users/#{user.nickname}/outbox", data)
 458
 459       result = json_response(conn, 201)
 460       assert Activity.get_by_ap_id(result["id"])
 461     end
 462
 463     test "it rejects an incoming activity with bogus type", %{conn: conn} do
 464       data = File.read!("test/fixtures/activitypub-client-post-activity.json") |> Poison.decode!()
 465       user = insert(:user)
 466
 467       data =
 468         data
 469         |> Map.put("type", "BadType")
 470
 471       conn =
 472         conn
 473         |> assign(:user, user)
 474         |> put_req_header("content-type", "application/activity+json")
 475         |> post("/users/#{user.nickname}/outbox", data)
 476
 477       assert json_response(conn, 400)
 478     end
 479
 480     test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
 481       note_activity = insert(:note_activity)
 482       note_object = Object.normalize(note_activity)
 483       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 484
 485       data = %{
 486         type: "Delete",
 487         object: %{
 488           id: note_object.data["id"]
 489         }
 490       }
 491
 492       conn =
 493         conn
 494         |> assign(:user, user)
 495         |> put_req_header("content-type", "application/activity+json")
 496         |> post("/users/#{user.nickname}/outbox", data)
 497
 498       result = json_response(conn, 201)
 499       assert Activity.get_by_ap_id(result["id"])
 500
 501       assert object = Object.get_by_ap_id(note_object.data["id"])
 502       assert object.data["type"] == "Tombstone"
 503     end
 504
 505     test "it rejects delete activity of object from other actor", %{conn: conn} do
 506       note_activity = insert(:note_activity)
 507       note_object = Object.normalize(note_activity)
 508       user = insert(:user)
 509
 510       data = %{
 511         type: "Delete",
 512         object: %{
 513           id: note_object.data["id"]
 514         }
 515       }
 516
 517       conn =
 518         conn
 519         |> assign(:user, user)
 520         |> put_req_header("content-type", "application/activity+json")
 521         |> post("/users/#{user.nickname}/outbox", data)
 522
 523       assert json_response(conn, 400)
 524     end
 525
 526     test "it increases like count when receiving a like action", %{conn: conn} do
 527       note_activity = insert(:note_activity)
 528       note_object = Object.normalize(note_activity)
 529       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 530
 531       data = %{
 532         type: "Like",
 533         object: %{
 534           id: note_object.data["id"]
 535         }
 536       }
 537
 538       conn =
 539         conn
 540         |> assign(:user, user)
 541         |> put_req_header("content-type", "application/activity+json")
 542         |> post("/users/#{user.nickname}/outbox", data)
 543
 544       result = json_response(conn, 201)
 545       assert Activity.get_by_ap_id(result["id"])
 546
 547       assert object = Object.get_by_ap_id(note_object.data["id"])
 548       assert object.data["like_count"] == 1
 549     end
 550   end
 551
 552   describe "/users/:nickname/followers" do
 553     test "it returns the followers in a collection", %{conn: conn} do
 554       user = insert(:user)
 555       user_two = insert(:user)
 556       User.follow(user, user_two)
 557
 558       result =
 559         conn
 560         |> get("/users/#{user_two.nickname}/followers")
 561         |> json_response(200)
 562
 563       assert result["first"]["orderedItems"] == [user.ap_id]
 564     end
 565
 566     test "it returns returns a uri if the user has 'hide_followers' set", %{conn: conn} do
 567       user = insert(:user)
 568       user_two = insert(:user, %{info: %{hide_followers: true}})
 569       User.follow(user, user_two)
 570
 571       result =
 572         conn
 573         |> get("/users/#{user_two.nickname}/followers")
 574         |> json_response(200)
 575
 576       assert is_binary(result["first"])
 577     end
 578
 579     test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is not authenticated",
 580          %{conn: conn} do
 581       user = insert(:user, %{info: %{hide_followers: true}})
 582
 583       result =
 584         conn
 585         |> get("/users/#{user.nickname}/followers?page=1")
 586
 587       assert result.status == 403
 588       assert result.resp_body == ""
 589     end
 590
 591     test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
 592          %{conn: conn} do
 593       user = insert(:user, %{info: %{hide_followers: true}})
 594       other_user = insert(:user)
 595       {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
 596
 597       result =
 598         conn
 599         |> assign(:user, user)
 600         |> get("/users/#{user.nickname}/followers?page=1")
 601         |> json_response(200)
 602
 603       assert result["totalItems"] == 1
 604       assert result["orderedItems"] == [other_user.ap_id]
 605     end
 606
 607     test "it works for more than 10 users", %{conn: conn} do
 608       user = insert(:user)
 609
 610       Enum.each(1..15, fn _ ->
 611         other_user = insert(:user)
 612         User.follow(other_user, user)
 613       end)
 614
 615       result =
 616         conn
 617         |> get("/users/#{user.nickname}/followers")
 618         |> json_response(200)
 619
 620       assert length(result["first"]["orderedItems"]) == 10
 621       assert result["first"]["totalItems"] == 15
 622       assert result["totalItems"] == 15
 623
 624       result =
 625         conn
 626         |> get("/users/#{user.nickname}/followers?page=2")
 627         |> json_response(200)
 628
 629       assert length(result["orderedItems"]) == 5
 630       assert result["totalItems"] == 15
 631     end
 632   end
 633
 634   describe "/users/:nickname/following" do
 635     test "it returns the following in a collection", %{conn: conn} do
 636       user = insert(:user)
 637       user_two = insert(:user)
 638       User.follow(user, user_two)
 639
 640       result =
 641         conn
 642         |> get("/users/#{user.nickname}/following")
 643         |> json_response(200)
 644
 645       assert result["first"]["orderedItems"] == [user_two.ap_id]
 646     end
 647
 648     test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
 649       user = insert(:user, %{info: %{hide_follows: true}})
 650       user_two = insert(:user)
 651       User.follow(user, user_two)
 652
 653       result =
 654         conn
 655         |> get("/users/#{user.nickname}/following")
 656         |> json_response(200)
 657
 658       assert is_binary(result["first"])
 659     end
 660
 661     test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is not authenticated",
 662          %{conn: conn} do
 663       user = insert(:user, %{info: %{hide_follows: true}})
 664
 665       result =
 666         conn
 667         |> get("/users/#{user.nickname}/following?page=1")
 668
 669       assert result.status == 403
 670       assert result.resp_body == ""
 671     end
 672
 673     test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
 674          %{conn: conn} do
 675       user = insert(:user, %{info: %{hide_follows: true}})
 676       other_user = insert(:user)
 677       {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
 678
 679       result =
 680         conn
 681         |> assign(:user, user)
 682         |> get("/users/#{user.nickname}/following?page=1")
 683         |> json_response(200)
 684
 685       assert result["totalItems"] == 1
 686       assert result["orderedItems"] == [other_user.ap_id]
 687     end
 688
 689     test "it works for more than 10 users", %{conn: conn} do
 690       user = insert(:user)
 691
 692       Enum.each(1..15, fn _ ->
 693         user = User.get_cached_by_id(user.id)
 694         other_user = insert(:user)
 695         User.follow(user, other_user)
 696       end)
 697
 698       result =
 699         conn
 700         |> get("/users/#{user.nickname}/following")
 701         |> json_response(200)
 702
 703       assert length(result["first"]["orderedItems"]) == 10
 704       assert result["first"]["totalItems"] == 15
 705       assert result["totalItems"] == 15
 706
 707       result =
 708         conn
 709         |> get("/users/#{user.nickname}/following?page=2")
 710         |> json_response(200)
 711
 712       assert length(result["orderedItems"]) == 5
 713       assert result["totalItems"] == 15
 714     end
 715   end
 716 end