git.squeep.com Git - akkoma/blob - test/web/activity_pub/activity_pub_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.ActivityPub.ActivityPubControllerTest do
   6   use Pleroma.Web.ConnCase
   7   use Oban.Testing, repo: Pleroma.Repo
   8
   9   import Pleroma.Factory
  10   alias Pleroma.Activity
  11   alias Pleroma.Config
  12   alias Pleroma.Delivery
  13   alias Pleroma.Instances
  14   alias Pleroma.Object
  15   alias Pleroma.Tests.ObanHelpers
  16   alias Pleroma.User
  17   alias Pleroma.Web.ActivityPub.ObjectView
  18   alias Pleroma.Web.ActivityPub.Relay
  19   alias Pleroma.Web.ActivityPub.UserView
  20   alias Pleroma.Web.ActivityPub.Utils
  21   alias Pleroma.Web.CommonAPI
  22   alias Pleroma.Workers.ReceiverWorker
  23
  24   setup_all do
  25     Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
  26     :ok
  27   end
  28
  29   setup do: clear_config([:instance, :federating], true)
  30
  31   describe "/relay" do
  32     setup do: clear_config([:instance, :allow_relay])
  33
  34     test "with the relay active, it returns the relay user", %{conn: conn} do
  35       res =
  36         conn
  37         |> get(activity_pub_path(conn, :relay))
  38         |> json_response(200)
  39
  40       assert res["id"] =~ "/relay"
  41     end
  42
  43     test "with the relay disabled, it returns 404", %{conn: conn} do
  44       Config.put([:instance, :allow_relay], false)
  45
  46       conn
  47       |> get(activity_pub_path(conn, :relay))
  48       |> json_response(404)
  49     end
  50
  51     test "on non-federating instance, it returns 404", %{conn: conn} do
  52       Config.put([:instance, :federating], false)
  53       user = insert(:user)
  54
  55       conn
  56       |> assign(:user, user)
  57       |> get(activity_pub_path(conn, :relay))
  58       |> json_response(404)
  59     end
  60   end
  61
  62   describe "/internal/fetch" do
  63     test "it returns the internal fetch user", %{conn: conn} do
  64       res =
  65         conn
  66         |> get(activity_pub_path(conn, :internal_fetch))
  67         |> json_response(200)
  68
  69       assert res["id"] =~ "/fetch"
  70     end
  71
  72     test "on non-federating instance, it returns 404", %{conn: conn} do
  73       Config.put([:instance, :federating], false)
  74       user = insert(:user)
  75
  76       conn
  77       |> assign(:user, user)
  78       |> get(activity_pub_path(conn, :internal_fetch))
  79       |> json_response(404)
  80     end
  81   end
  82
  83   describe "/users/:nickname" do
  84     test "it returns a json representation of the user with accept application/json", %{
  85       conn: conn
  86     } do
  87       user = insert(:user)
  88
  89       conn =
  90         conn
  91         |> put_req_header("accept", "application/json")
  92         |> get("/users/#{user.nickname}")
  93
  94       user = User.get_cached_by_id(user.id)
  95
  96       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
  97     end
  98
  99     test "it returns a json representation of the user with accept application/activity+json", %{
 100       conn: conn
 101     } do
 102       user = insert(:user)
 103
 104       conn =
 105         conn
 106         |> put_req_header("accept", "application/activity+json")
 107         |> get("/users/#{user.nickname}")
 108
 109       user = User.get_cached_by_id(user.id)
 110
 111       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 112     end
 113
 114     test "it returns a json representation of the user with accept application/ld+json", %{
 115       conn: conn
 116     } do
 117       user = insert(:user)
 118
 119       conn =
 120         conn
 121         |> put_req_header(
 122           "accept",
 123           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 124         )
 125         |> get("/users/#{user.nickname}")
 126
 127       user = User.get_cached_by_id(user.id)
 128
 129       assert json_response(conn, 200) == UserView.render("user.json", %{user: user})
 130     end
 131
 132     test "it returns 404 for remote users", %{
 133       conn: conn
 134     } do
 135       user = insert(:user, local: false, nickname: "remoteuser@example.com")
 136
 137       conn =
 138         conn
 139         |> put_req_header("accept", "application/json")
 140         |> get("/users/#{user.nickname}.json")
 141
 142       assert json_response(conn, 404)
 143     end
 144
 145     test "it returns error when user is not found", %{conn: conn} do
 146       response =
 147         conn
 148         |> put_req_header("accept", "application/json")
 149         |> get("/users/jimm")
 150         |> json_response(404)
 151
 152       assert response == "Not found"
 153     end
 154
 155     test "it requires authentication if instance is NOT federating", %{
 156       conn: conn
 157     } do
 158       user = insert(:user)
 159
 160       conn =
 161         put_req_header(
 162           conn,
 163           "accept",
 164           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 165         )
 166
 167       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}.json", user)
 168     end
 169   end
 170
 171   describe "/objects/:uuid" do
 172     test "it returns a json representation of the object with accept application/json", %{
 173       conn: conn
 174     } do
 175       note = insert(:note)
 176       uuid = String.split(note.data["id"], "/") |> List.last()
 177
 178       conn =
 179         conn
 180         |> put_req_header("accept", "application/json")
 181         |> get("/objects/#{uuid}")
 182
 183       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 184     end
 185
 186     test "it returns a json representation of the object with accept application/activity+json",
 187          %{conn: conn} do
 188       note = insert(:note)
 189       uuid = String.split(note.data["id"], "/") |> List.last()
 190
 191       conn =
 192         conn
 193         |> put_req_header("accept", "application/activity+json")
 194         |> get("/objects/#{uuid}")
 195
 196       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 197     end
 198
 199     test "it returns a json representation of the object with accept application/ld+json", %{
 200       conn: conn
 201     } do
 202       note = insert(:note)
 203       uuid = String.split(note.data["id"], "/") |> List.last()
 204
 205       conn =
 206         conn
 207         |> put_req_header(
 208           "accept",
 209           "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""
 210         )
 211         |> get("/objects/#{uuid}")
 212
 213       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: note})
 214     end
 215
 216     test "it returns 404 for non-public messages", %{conn: conn} do
 217       note = insert(:direct_note)
 218       uuid = String.split(note.data["id"], "/") |> List.last()
 219
 220       conn =
 221         conn
 222         |> put_req_header("accept", "application/activity+json")
 223         |> get("/objects/#{uuid}")
 224
 225       assert json_response(conn, 404)
 226     end
 227
 228     test "it returns 404 for tombstone objects", %{conn: conn} do
 229       tombstone = insert(:tombstone)
 230       uuid = String.split(tombstone.data["id"], "/") |> List.last()
 231
 232       conn =
 233         conn
 234         |> put_req_header("accept", "application/activity+json")
 235         |> get("/objects/#{uuid}")
 236
 237       assert json_response(conn, 404)
 238     end
 239
 240     test "it caches a response", %{conn: conn} do
 241       note = insert(:note)
 242       uuid = String.split(note.data["id"], "/") |> List.last()
 243
 244       conn1 =
 245         conn
 246         |> put_req_header("accept", "application/activity+json")
 247         |> get("/objects/#{uuid}")
 248
 249       assert json_response(conn1, :ok)
 250       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 251
 252       conn2 =
 253         conn
 254         |> put_req_header("accept", "application/activity+json")
 255         |> get("/objects/#{uuid}")
 256
 257       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 258       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 259     end
 260
 261     test "cached purged after object deletion", %{conn: conn} do
 262       note = insert(:note)
 263       uuid = String.split(note.data["id"], "/") |> List.last()
 264
 265       conn1 =
 266         conn
 267         |> put_req_header("accept", "application/activity+json")
 268         |> get("/objects/#{uuid}")
 269
 270       assert json_response(conn1, :ok)
 271       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 272
 273       Object.delete(note)
 274
 275       conn2 =
 276         conn
 277         |> put_req_header("accept", "application/activity+json")
 278         |> get("/objects/#{uuid}")
 279
 280       assert "Not found" == json_response(conn2, :not_found)
 281     end
 282
 283     test "it requires authentication if instance is NOT federating", %{
 284       conn: conn
 285     } do
 286       user = insert(:user)
 287       note = insert(:note)
 288       uuid = String.split(note.data["id"], "/") |> List.last()
 289
 290       conn = put_req_header(conn, "accept", "application/activity+json")
 291
 292       ensure_federating_or_authenticated(conn, "/objects/#{uuid}", user)
 293     end
 294   end
 295
 296   describe "/activities/:uuid" do
 297     test "it returns a json representation of the activity", %{conn: conn} do
 298       activity = insert(:note_activity)
 299       uuid = String.split(activity.data["id"], "/") |> List.last()
 300
 301       conn =
 302         conn
 303         |> put_req_header("accept", "application/activity+json")
 304         |> get("/activities/#{uuid}")
 305
 306       assert json_response(conn, 200) == ObjectView.render("object.json", %{object: activity})
 307     end
 308
 309     test "it returns 404 for non-public activities", %{conn: conn} do
 310       activity = insert(:direct_note_activity)
 311       uuid = String.split(activity.data["id"], "/") |> List.last()
 312
 313       conn =
 314         conn
 315         |> put_req_header("accept", "application/activity+json")
 316         |> get("/activities/#{uuid}")
 317
 318       assert json_response(conn, 404)
 319     end
 320
 321     test "it caches a response", %{conn: conn} do
 322       activity = insert(:note_activity)
 323       uuid = String.split(activity.data["id"], "/") |> List.last()
 324
 325       conn1 =
 326         conn
 327         |> put_req_header("accept", "application/activity+json")
 328         |> get("/activities/#{uuid}")
 329
 330       assert json_response(conn1, :ok)
 331       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 332
 333       conn2 =
 334         conn
 335         |> put_req_header("accept", "application/activity+json")
 336         |> get("/activities/#{uuid}")
 337
 338       assert json_response(conn1, :ok) == json_response(conn2, :ok)
 339       assert Enum.any?(conn2.resp_headers, &(&1 == {"x-cache", "HIT from Pleroma"}))
 340     end
 341
 342     test "cached purged after activity deletion", %{conn: conn} do
 343       user = insert(:user)
 344       {:ok, activity} = CommonAPI.post(user, %{"status" => "cofe"})
 345
 346       uuid = String.split(activity.data["id"], "/") |> List.last()
 347
 348       conn1 =
 349         conn
 350         |> put_req_header("accept", "application/activity+json")
 351         |> get("/activities/#{uuid}")
 352
 353       assert json_response(conn1, :ok)
 354       assert Enum.any?(conn1.resp_headers, &(&1 == {"x-cache", "MISS from Pleroma"}))
 355
 356       Activity.delete_all_by_object_ap_id(activity.object.data["id"])
 357
 358       conn2 =
 359         conn
 360         |> put_req_header("accept", "application/activity+json")
 361         |> get("/activities/#{uuid}")
 362
 363       assert "Not found" == json_response(conn2, :not_found)
 364     end
 365
 366     test "it requires authentication if instance is NOT federating", %{
 367       conn: conn
 368     } do
 369       user = insert(:user)
 370       activity = insert(:note_activity)
 371       uuid = String.split(activity.data["id"], "/") |> List.last()
 372
 373       conn = put_req_header(conn, "accept", "application/activity+json")
 374
 375       ensure_federating_or_authenticated(conn, "/activities/#{uuid}", user)
 376     end
 377   end
 378
 379   describe "/inbox" do
 380     test "it inserts an incoming activity into the database", %{conn: conn} do
 381       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 382
 383       conn =
 384         conn
 385         |> assign(:valid_signature, true)
 386         |> put_req_header("content-type", "application/activity+json")
 387         |> post("/inbox", data)
 388
 389       assert "ok" == json_response(conn, 200)
 390
 391       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 392       assert Activity.get_by_ap_id(data["id"])
 393     end
 394
 395     test "it clears `unreachable` federation status of the sender", %{conn: conn} do
 396       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 397
 398       sender_url = data["actor"]
 399       Instances.set_consistently_unreachable(sender_url)
 400       refute Instances.reachable?(sender_url)
 401
 402       conn =
 403         conn
 404         |> assign(:valid_signature, true)
 405         |> put_req_header("content-type", "application/activity+json")
 406         |> post("/inbox", data)
 407
 408       assert "ok" == json_response(conn, 200)
 409       assert Instances.reachable?(sender_url)
 410     end
 411
 412     test "accept follow activity", %{conn: conn} do
 413       Pleroma.Config.put([:instance, :federating], true)
 414       relay = Relay.get_actor()
 415
 416       assert {:ok, %Activity{} = activity} = Relay.follow("https://relay.mastodon.host/actor")
 417
 418       followed_relay = Pleroma.User.get_by_ap_id("https://relay.mastodon.host/actor")
 419       relay = refresh_record(relay)
 420
 421       accept =
 422         File.read!("test/fixtures/relay/accept-follow.json")
 423         |> String.replace("{{ap_id}}", relay.ap_id)
 424         |> String.replace("{{activity_id}}", activity.data["id"])
 425
 426       assert "ok" ==
 427                conn
 428                |> assign(:valid_signature, true)
 429                |> put_req_header("content-type", "application/activity+json")
 430                |> post("/inbox", accept)
 431                |> json_response(200)
 432
 433       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 434
 435       assert Pleroma.FollowingRelationship.following?(
 436                relay,
 437                followed_relay
 438              )
 439
 440       Mix.shell(Mix.Shell.Process)
 441
 442       on_exit(fn ->
 443         Mix.shell(Mix.Shell.IO)
 444       end)
 445
 446       :ok = Mix.Tasks.Pleroma.Relay.run(["list"])
 447       assert_receive {:mix_shell, :info, ["relay.mastodon.host"]}
 448     end
 449
 450     test "without valid signature, " <>
 451            "it only accepts Create activities and requires enabled federation",
 452          %{conn: conn} do
 453       data = File.read!("test/fixtures/mastodon-post-activity.json") |> Poison.decode!()
 454       non_create_data = File.read!("test/fixtures/mastodon-announce.json") |> Poison.decode!()
 455
 456       conn = put_req_header(conn, "content-type", "application/activity+json")
 457
 458       Config.put([:instance, :federating], false)
 459
 460       conn
 461       |> post("/inbox", data)
 462       |> json_response(403)
 463
 464       conn
 465       |> post("/inbox", non_create_data)
 466       |> json_response(403)
 467
 468       Config.put([:instance, :federating], true)
 469
 470       ret_conn = post(conn, "/inbox", data)
 471       assert "ok" == json_response(ret_conn, 200)
 472
 473       conn
 474       |> post("/inbox", non_create_data)
 475       |> json_response(400)
 476     end
 477   end
 478
 479   describe "/users/:nickname/inbox" do
 480     setup do
 481       data =
 482         File.read!("test/fixtures/mastodon-post-activity.json")
 483         |> Poison.decode!()
 484
 485       [data: data]
 486     end
 487
 488     test "it inserts an incoming activity into the database", %{conn: conn, data: data} do
 489       user = insert(:user)
 490       data = Map.put(data, "bcc", [user.ap_id])
 491
 492       conn =
 493         conn
 494         |> assign(:valid_signature, true)
 495         |> put_req_header("content-type", "application/activity+json")
 496         |> post("/users/#{user.nickname}/inbox", data)
 497
 498       assert "ok" == json_response(conn, 200)
 499       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 500       assert Activity.get_by_ap_id(data["id"])
 501     end
 502
 503     test "it accepts messages with to as string instead of array", %{conn: conn, data: data} do
 504       user = insert(:user)
 505
 506       data =
 507         Map.put(data, "to", user.ap_id)
 508         |> Map.delete("cc")
 509
 510       conn =
 511         conn
 512         |> assign(:valid_signature, true)
 513         |> put_req_header("content-type", "application/activity+json")
 514         |> post("/users/#{user.nickname}/inbox", data)
 515
 516       assert "ok" == json_response(conn, 200)
 517       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 518       assert Activity.get_by_ap_id(data["id"])
 519     end
 520
 521     test "it accepts messages with cc as string instead of array", %{conn: conn, data: data} do
 522       user = insert(:user)
 523
 524       data =
 525         Map.put(data, "cc", user.ap_id)
 526         |> Map.delete("to")
 527
 528       conn =
 529         conn
 530         |> assign(:valid_signature, true)
 531         |> put_req_header("content-type", "application/activity+json")
 532         |> post("/users/#{user.nickname}/inbox", data)
 533
 534       assert "ok" == json_response(conn, 200)
 535       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 536       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 537       assert user.ap_id in activity.recipients
 538     end
 539
 540     test "it accepts messages with bcc as string instead of array", %{conn: conn, data: data} do
 541       user = insert(:user)
 542
 543       data =
 544         Map.put(data, "bcc", user.ap_id)
 545         |> Map.delete("to")
 546         |> Map.delete("cc")
 547
 548       conn =
 549         conn
 550         |> assign(:valid_signature, true)
 551         |> put_req_header("content-type", "application/activity+json")
 552         |> post("/users/#{user.nickname}/inbox", data)
 553
 554       assert "ok" == json_response(conn, 200)
 555       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 556       assert Activity.get_by_ap_id(data["id"])
 557     end
 558
 559     test "it accepts announces with to as string instead of array", %{conn: conn} do
 560       user = insert(:user)
 561
 562       data = %{
 563         "@context" => "https://www.w3.org/ns/activitystreams",
 564         "actor" => "http://mastodon.example.org/users/admin",
 565         "id" => "http://mastodon.example.org/users/admin/statuses/19512778738411822/activity",
 566         "object" => "https://mastodon.social/users/emelie/statuses/101849165031453009",
 567         "to" => "https://www.w3.org/ns/activitystreams#Public",
 568         "cc" => [user.ap_id],
 569         "type" => "Announce"
 570       }
 571
 572       conn =
 573         conn
 574         |> assign(:valid_signature, true)
 575         |> put_req_header("content-type", "application/activity+json")
 576         |> post("/users/#{user.nickname}/inbox", data)
 577
 578       assert "ok" == json_response(conn, 200)
 579       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 580       %Activity{} = activity = Activity.get_by_ap_id(data["id"])
 581       assert "https://www.w3.org/ns/activitystreams#Public" in activity.recipients
 582     end
 583
 584     test "it accepts messages from actors that are followed by the user", %{
 585       conn: conn,
 586       data: data
 587     } do
 588       recipient = insert(:user)
 589       actor = insert(:user, %{ap_id: "http://mastodon.example.org/users/actor"})
 590
 591       {:ok, recipient} = User.follow(recipient, actor)
 592
 593       object =
 594         data["object"]
 595         |> Map.put("attributedTo", actor.ap_id)
 596
 597       data =
 598         data
 599         |> Map.put("actor", actor.ap_id)
 600         |> Map.put("object", object)
 601
 602       conn =
 603         conn
 604         |> assign(:valid_signature, true)
 605         |> put_req_header("content-type", "application/activity+json")
 606         |> post("/users/#{recipient.nickname}/inbox", data)
 607
 608       assert "ok" == json_response(conn, 200)
 609       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 610       assert Activity.get_by_ap_id(data["id"])
 611     end
 612
 613     test "it rejects reads from other users", %{conn: conn} do
 614       user = insert(:user)
 615       other_user = insert(:user)
 616
 617       conn =
 618         conn
 619         |> assign(:user, other_user)
 620         |> put_req_header("accept", "application/activity+json")
 621         |> get("/users/#{user.nickname}/inbox")
 622
 623       assert json_response(conn, 403)
 624     end
 625
 626     test "it returns a note activity in a collection", %{conn: conn} do
 627       note_activity = insert(:direct_note_activity)
 628       note_object = Object.normalize(note_activity)
 629       user = User.get_cached_by_ap_id(hd(note_activity.data["to"]))
 630
 631       conn =
 632         conn
 633         |> assign(:user, user)
 634         |> put_req_header("accept", "application/activity+json")
 635         |> get("/users/#{user.nickname}/inbox?page=true")
 636
 637       assert response(conn, 200) =~ note_object.data["content"]
 638     end
 639
 640     test "it clears `unreachable` federation status of the sender", %{conn: conn, data: data} do
 641       user = insert(:user)
 642       data = Map.put(data, "bcc", [user.ap_id])
 643
 644       sender_host = URI.parse(data["actor"]).host
 645       Instances.set_consistently_unreachable(sender_host)
 646       refute Instances.reachable?(sender_host)
 647
 648       conn =
 649         conn
 650         |> assign(:valid_signature, true)
 651         |> put_req_header("content-type", "application/activity+json")
 652         |> post("/users/#{user.nickname}/inbox", data)
 653
 654       assert "ok" == json_response(conn, 200)
 655       assert Instances.reachable?(sender_host)
 656     end
 657
 658     test "it removes all follower collections but actor's", %{conn: conn} do
 659       [actor, recipient] = insert_pair(:user)
 660
 661       data =
 662         File.read!("test/fixtures/activitypub-client-post-activity.json")
 663         |> Poison.decode!()
 664
 665       object = Map.put(data["object"], "attributedTo", actor.ap_id)
 666
 667       data =
 668         data
 669         |> Map.put("id", Utils.generate_object_id())
 670         |> Map.put("actor", actor.ap_id)
 671         |> Map.put("object", object)
 672         |> Map.put("cc", [
 673           recipient.follower_address,
 674           actor.follower_address
 675         ])
 676         |> Map.put("to", [
 677           recipient.ap_id,
 678           recipient.follower_address,
 679           "https://www.w3.org/ns/activitystreams#Public"
 680         ])
 681
 682       conn
 683       |> assign(:valid_signature, true)
 684       |> put_req_header("content-type", "application/activity+json")
 685       |> post("/users/#{recipient.nickname}/inbox", data)
 686       |> json_response(200)
 687
 688       ObanHelpers.perform(all_enqueued(worker: ReceiverWorker))
 689
 690       activity = Activity.get_by_ap_id(data["id"])
 691
 692       assert activity.id
 693       assert actor.follower_address in activity.recipients
 694       assert actor.follower_address in activity.data["cc"]
 695
 696       refute recipient.follower_address in activity.recipients
 697       refute recipient.follower_address in activity.data["cc"]
 698       refute recipient.follower_address in activity.data["to"]
 699     end
 700
 701     test "it requires authentication", %{conn: conn} do
 702       user = insert(:user)
 703       conn = put_req_header(conn, "accept", "application/activity+json")
 704
 705       ret_conn = get(conn, "/users/#{user.nickname}/inbox")
 706       assert json_response(ret_conn, 403)
 707
 708       ret_conn =
 709         conn
 710         |> assign(:user, user)
 711         |> get("/users/#{user.nickname}/inbox")
 712
 713       assert json_response(ret_conn, 200)
 714     end
 715   end
 716
 717   describe "GET /users/:nickname/outbox" do
 718     test "it returns 200 even if there're no activities", %{conn: conn} do
 719       user = insert(:user)
 720
 721       conn =
 722         conn
 723         |> assign(:user, user)
 724         |> put_req_header("accept", "application/activity+json")
 725         |> get("/users/#{user.nickname}/outbox")
 726
 727       result = json_response(conn, 200)
 728       assert user.ap_id <> "/outbox" == result["id"]
 729     end
 730
 731     test "it returns a note activity in a collection", %{conn: conn} do
 732       note_activity = insert(:note_activity)
 733       note_object = Object.normalize(note_activity)
 734       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 735
 736       conn =
 737         conn
 738         |> assign(:user, user)
 739         |> put_req_header("accept", "application/activity+json")
 740         |> get("/users/#{user.nickname}/outbox?page=true")
 741
 742       assert response(conn, 200) =~ note_object.data["content"]
 743     end
 744
 745     test "it returns an announce activity in a collection", %{conn: conn} do
 746       announce_activity = insert(:announce_activity)
 747       user = User.get_cached_by_ap_id(announce_activity.data["actor"])
 748
 749       conn =
 750         conn
 751         |> assign(:user, user)
 752         |> put_req_header("accept", "application/activity+json")
 753         |> get("/users/#{user.nickname}/outbox?page=true")
 754
 755       assert response(conn, 200) =~ announce_activity.data["object"]
 756     end
 757
 758     test "it requires authentication if instance is NOT federating", %{
 759       conn: conn
 760     } do
 761       user = insert(:user)
 762       conn = put_req_header(conn, "accept", "application/activity+json")
 763
 764       ensure_federating_or_authenticated(conn, "/users/#{user.nickname}/outbox", user)
 765     end
 766   end
 767
 768   describe "POST /users/:nickname/outbox" do
 769     test "it rejects posts from other users / unauuthenticated users", %{conn: conn} do
 770       data = File.read!("test/fixtures/activitypub-client-post-activity.json") |> Poison.decode!()
 771       user = insert(:user)
 772       other_user = insert(:user)
 773       conn = put_req_header(conn, "content-type", "application/activity+json")
 774
 775       conn
 776       |> post("/users/#{user.nickname}/outbox", data)
 777       |> json_response(403)
 778
 779       conn
 780       |> assign(:user, other_user)
 781       |> post("/users/#{user.nickname}/outbox", data)
 782       |> json_response(403)
 783     end
 784
 785     test "it inserts an incoming create activity into the database", %{conn: conn} do
 786       data = File.read!("test/fixtures/activitypub-client-post-activity.json") |> Poison.decode!()
 787       user = insert(:user)
 788
 789       conn =
 790         conn
 791         |> assign(:user, user)
 792         |> put_req_header("content-type", "application/activity+json")
 793         |> post("/users/#{user.nickname}/outbox", data)
 794
 795       result = json_response(conn, 201)
 796
 797       assert Activity.get_by_ap_id(result["id"])
 798     end
 799
 800     test "it rejects an incoming activity with bogus type", %{conn: conn} do
 801       data = File.read!("test/fixtures/activitypub-client-post-activity.json") |> Poison.decode!()
 802       user = insert(:user)
 803
 804       data =
 805         data
 806         |> Map.put("type", "BadType")
 807
 808       conn =
 809         conn
 810         |> assign(:user, user)
 811         |> put_req_header("content-type", "application/activity+json")
 812         |> post("/users/#{user.nickname}/outbox", data)
 813
 814       assert json_response(conn, 400)
 815     end
 816
 817     test "it erects a tombstone when receiving a delete activity", %{conn: conn} do
 818       note_activity = insert(:note_activity)
 819       note_object = Object.normalize(note_activity)
 820       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 821
 822       data = %{
 823         type: "Delete",
 824         object: %{
 825           id: note_object.data["id"]
 826         }
 827       }
 828
 829       conn =
 830         conn
 831         |> assign(:user, user)
 832         |> put_req_header("content-type", "application/activity+json")
 833         |> post("/users/#{user.nickname}/outbox", data)
 834
 835       result = json_response(conn, 201)
 836       assert Activity.get_by_ap_id(result["id"])
 837
 838       assert object = Object.get_by_ap_id(note_object.data["id"])
 839       assert object.data["type"] == "Tombstone"
 840     end
 841
 842     test "it rejects delete activity of object from other actor", %{conn: conn} do
 843       note_activity = insert(:note_activity)
 844       note_object = Object.normalize(note_activity)
 845       user = insert(:user)
 846
 847       data = %{
 848         type: "Delete",
 849         object: %{
 850           id: note_object.data["id"]
 851         }
 852       }
 853
 854       conn =
 855         conn
 856         |> assign(:user, user)
 857         |> put_req_header("content-type", "application/activity+json")
 858         |> post("/users/#{user.nickname}/outbox", data)
 859
 860       assert json_response(conn, 400)
 861     end
 862
 863     test "it increases like count when receiving a like action", %{conn: conn} do
 864       note_activity = insert(:note_activity)
 865       note_object = Object.normalize(note_activity)
 866       user = User.get_cached_by_ap_id(note_activity.data["actor"])
 867
 868       data = %{
 869         type: "Like",
 870         object: %{
 871           id: note_object.data["id"]
 872         }
 873       }
 874
 875       conn =
 876         conn
 877         |> assign(:user, user)
 878         |> put_req_header("content-type", "application/activity+json")
 879         |> post("/users/#{user.nickname}/outbox", data)
 880
 881       result = json_response(conn, 201)
 882       assert Activity.get_by_ap_id(result["id"])
 883
 884       assert object = Object.get_by_ap_id(note_object.data["id"])
 885       assert object.data["like_count"] == 1
 886     end
 887   end
 888
 889   describe "/relay/followers" do
 890     test "it returns relay followers", %{conn: conn} do
 891       relay_actor = Relay.get_actor()
 892       user = insert(:user)
 893       User.follow(user, relay_actor)
 894
 895       result =
 896         conn
 897         |> get("/relay/followers")
 898         |> json_response(200)
 899
 900       assert result["first"]["orderedItems"] == [user.ap_id]
 901     end
 902
 903     test "on non-federating instance, it returns 404", %{conn: conn} do
 904       Config.put([:instance, :federating], false)
 905       user = insert(:user)
 906
 907       conn
 908       |> assign(:user, user)
 909       |> get("/relay/followers")
 910       |> json_response(404)
 911     end
 912   end
 913
 914   describe "/relay/following" do
 915     test "it returns relay following", %{conn: conn} do
 916       result =
 917         conn
 918         |> get("/relay/following")
 919         |> json_response(200)
 920
 921       assert result["first"]["orderedItems"] == []
 922     end
 923
 924     test "on non-federating instance, it returns 404", %{conn: conn} do
 925       Config.put([:instance, :federating], false)
 926       user = insert(:user)
 927
 928       conn
 929       |> assign(:user, user)
 930       |> get("/relay/following")
 931       |> json_response(404)
 932     end
 933   end
 934
 935   describe "/users/:nickname/followers" do
 936     test "it returns the followers in a collection", %{conn: conn} do
 937       user = insert(:user)
 938       user_two = insert(:user)
 939       User.follow(user, user_two)
 940
 941       result =
 942         conn
 943         |> assign(:user, user_two)
 944         |> get("/users/#{user_two.nickname}/followers")
 945         |> json_response(200)
 946
 947       assert result["first"]["orderedItems"] == [user.ap_id]
 948     end
 949
 950     test "it returns a uri if the user has 'hide_followers' set", %{conn: conn} do
 951       user = insert(:user)
 952       user_two = insert(:user, hide_followers: true)
 953       User.follow(user, user_two)
 954
 955       result =
 956         conn
 957         |> assign(:user, user)
 958         |> get("/users/#{user_two.nickname}/followers")
 959         |> json_response(200)
 960
 961       assert is_binary(result["first"])
 962     end
 963
 964     test "it returns a 403 error on pages, if the user has 'hide_followers' set and the request is from another user",
 965          %{conn: conn} do
 966       user = insert(:user)
 967       other_user = insert(:user, hide_followers: true)
 968
 969       result =
 970         conn
 971         |> assign(:user, user)
 972         |> get("/users/#{other_user.nickname}/followers?page=1")
 973
 974       assert result.status == 403
 975       assert result.resp_body == ""
 976     end
 977
 978     test "it renders the page, if the user has 'hide_followers' set and the request is authenticated with the same user",
 979          %{conn: conn} do
 980       user = insert(:user, hide_followers: true)
 981       other_user = insert(:user)
 982       {:ok, _other_user, user, _activity} = CommonAPI.follow(other_user, user)
 983
 984       result =
 985         conn
 986         |> assign(:user, user)
 987         |> get("/users/#{user.nickname}/followers?page=1")
 988         |> json_response(200)
 989
 990       assert result["totalItems"] == 1
 991       assert result["orderedItems"] == [other_user.ap_id]
 992     end
 993
 994     test "it works for more than 10 users", %{conn: conn} do
 995       user = insert(:user)
 996
 997       Enum.each(1..15, fn _ ->
 998         other_user = insert(:user)
 999         User.follow(other_user, user)
1000       end)
1001
1002       result =
1003         conn
1004         |> assign(:user, user)
1005         |> get("/users/#{user.nickname}/followers")
1006         |> json_response(200)
1007
1008       assert length(result["first"]["orderedItems"]) == 10
1009       assert result["first"]["totalItems"] == 15
1010       assert result["totalItems"] == 15
1011
1012       result =
1013         conn
1014         |> assign(:user, user)
1015         |> get("/users/#{user.nickname}/followers?page=2")
1016         |> json_response(200)
1017
1018       assert length(result["orderedItems"]) == 5
1019       assert result["totalItems"] == 15
1020     end
1021
1022     test "returns 403 if requester is not logged in", %{conn: conn} do
1023       user = insert(:user)
1024
1025       conn
1026       |> get("/users/#{user.nickname}/followers")
1027       |> json_response(403)
1028     end
1029   end
1030
1031   describe "/users/:nickname/following" do
1032     test "it returns the following in a collection", %{conn: conn} do
1033       user = insert(:user)
1034       user_two = insert(:user)
1035       User.follow(user, user_two)
1036
1037       result =
1038         conn
1039         |> assign(:user, user)
1040         |> get("/users/#{user.nickname}/following")
1041         |> json_response(200)
1042
1043       assert result["first"]["orderedItems"] == [user_two.ap_id]
1044     end
1045
1046     test "it returns a uri if the user has 'hide_follows' set", %{conn: conn} do
1047       user = insert(:user)
1048       user_two = insert(:user, hide_follows: true)
1049       User.follow(user, user_two)
1050
1051       result =
1052         conn
1053         |> assign(:user, user)
1054         |> get("/users/#{user_two.nickname}/following")
1055         |> json_response(200)
1056
1057       assert is_binary(result["first"])
1058     end
1059
1060     test "it returns a 403 error on pages, if the user has 'hide_follows' set and the request is from another user",
1061          %{conn: conn} do
1062       user = insert(:user)
1063       user_two = insert(:user, hide_follows: true)
1064
1065       result =
1066         conn
1067         |> assign(:user, user)
1068         |> get("/users/#{user_two.nickname}/following?page=1")
1069
1070       assert result.status == 403
1071       assert result.resp_body == ""
1072     end
1073
1074     test "it renders the page, if the user has 'hide_follows' set and the request is authenticated with the same user",
1075          %{conn: conn} do
1076       user = insert(:user, hide_follows: true)
1077       other_user = insert(:user)
1078       {:ok, user, _other_user, _activity} = CommonAPI.follow(user, other_user)
1079
1080       result =
1081         conn
1082         |> assign(:user, user)
1083         |> get("/users/#{user.nickname}/following?page=1")
1084         |> json_response(200)
1085
1086       assert result["totalItems"] == 1
1087       assert result["orderedItems"] == [other_user.ap_id]
1088     end
1089
1090     test "it works for more than 10 users", %{conn: conn} do
1091       user = insert(:user)
1092
1093       Enum.each(1..15, fn _ ->
1094         user = User.get_cached_by_id(user.id)
1095         other_user = insert(:user)
1096         User.follow(user, other_user)
1097       end)
1098
1099       result =
1100         conn
1101         |> assign(:user, user)
1102         |> get("/users/#{user.nickname}/following")
1103         |> json_response(200)
1104
1105       assert length(result["first"]["orderedItems"]) == 10
1106       assert result["first"]["totalItems"] == 15
1107       assert result["totalItems"] == 15
1108
1109       result =
1110         conn
1111         |> assign(:user, user)
1112         |> get("/users/#{user.nickname}/following?page=2")
1113         |> json_response(200)
1114
1115       assert length(result["orderedItems"]) == 5
1116       assert result["totalItems"] == 15
1117     end
1118
1119     test "returns 403 if requester is not logged in", %{conn: conn} do
1120       user = insert(:user)
1121
1122       conn
1123       |> get("/users/#{user.nickname}/following")
1124       |> json_response(403)
1125     end
1126   end
1127
1128   describe "delivery tracking" do
1129     test "it tracks a signed object fetch", %{conn: conn} do
1130       user = insert(:user, local: false)
1131       activity = insert(:note_activity)
1132       object = Object.normalize(activity)
1133
1134       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1135
1136       conn
1137       |> put_req_header("accept", "application/activity+json")
1138       |> assign(:user, user)
1139       |> get(object_path)
1140       |> json_response(200)
1141
1142       assert Delivery.get(object.id, user.id)
1143     end
1144
1145     test "it tracks a signed activity fetch", %{conn: conn} do
1146       user = insert(:user, local: false)
1147       activity = insert(:note_activity)
1148       object = Object.normalize(activity)
1149
1150       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1151
1152       conn
1153       |> put_req_header("accept", "application/activity+json")
1154       |> assign(:user, user)
1155       |> get(activity_path)
1156       |> json_response(200)
1157
1158       assert Delivery.get(object.id, user.id)
1159     end
1160
1161     test "it tracks a signed object fetch when the json is cached", %{conn: conn} do
1162       user = insert(:user, local: false)
1163       other_user = insert(:user, local: false)
1164       activity = insert(:note_activity)
1165       object = Object.normalize(activity)
1166
1167       object_path = String.trim_leading(object.data["id"], Pleroma.Web.Endpoint.url())
1168
1169       conn
1170       |> put_req_header("accept", "application/activity+json")
1171       |> assign(:user, user)
1172       |> get(object_path)
1173       |> json_response(200)
1174
1175       build_conn()
1176       |> put_req_header("accept", "application/activity+json")
1177       |> assign(:user, other_user)
1178       |> get(object_path)
1179       |> json_response(200)
1180
1181       assert Delivery.get(object.id, user.id)
1182       assert Delivery.get(object.id, other_user.id)
1183     end
1184
1185     test "it tracks a signed activity fetch when the json is cached", %{conn: conn} do
1186       user = insert(:user, local: false)
1187       other_user = insert(:user, local: false)
1188       activity = insert(:note_activity)
1189       object = Object.normalize(activity)
1190
1191       activity_path = String.trim_leading(activity.data["id"], Pleroma.Web.Endpoint.url())
1192
1193       conn
1194       |> put_req_header("accept", "application/activity+json")
1195       |> assign(:user, user)
1196       |> get(activity_path)
1197       |> json_response(200)
1198
1199       build_conn()
1200       |> put_req_header("accept", "application/activity+json")
1201       |> assign(:user, other_user)
1202       |> get(activity_path)
1203       |> json_response(200)
1204
1205       assert Delivery.get(object.id, user.id)
1206       assert Delivery.get(object.id, other_user.id)
1207     end
1208   end
1209
1210   describe "Additional ActivityPub C2S endpoints" do
1211     test "GET /api/ap/whoami", %{conn: conn} do
1212       user = insert(:user)
1213
1214       conn =
1215         conn
1216         |> assign(:user, user)
1217         |> get("/api/ap/whoami")
1218
1219       user = User.get_cached_by_id(user.id)
1220
1221       assert UserView.render("user.json", %{user: user}) == json_response(conn, 200)
1222
1223       conn
1224       |> get("/api/ap/whoami")
1225       |> json_response(403)
1226     end
1227
1228     setup do: clear_config([:media_proxy])
1229     setup do: clear_config([Pleroma.Upload])
1230
1231     test "POST /api/ap/upload_media", %{conn: conn} do
1232       user = insert(:user)
1233
1234       desc = "Description of the image"
1235
1236       image = %Plug.Upload{
1237         content_type: "image/jpg",
1238         path: Path.absname("test/fixtures/image.jpg"),
1239         filename: "an_image.jpg"
1240       }
1241
1242       object =
1243         conn
1244         |> assign(:user, user)
1245         |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1246         |> json_response(:created)
1247
1248       assert object["name"] == desc
1249       assert object["type"] == "Document"
1250       assert object["actor"] == user.ap_id
1251       assert [%{"href" => object_href, "mediaType" => object_mediatype}] = object["url"]
1252       assert is_binary(object_href)
1253       assert object_mediatype == "image/jpeg"
1254
1255       activity_request = %{
1256         "@context" => "https://www.w3.org/ns/activitystreams",
1257         "type" => "Create",
1258         "object" => %{
1259           "type" => "Note",
1260           "content" => "AP C2S test, attachment",
1261           "attachment" => [object]
1262         },
1263         "to" => "https://www.w3.org/ns/activitystreams#Public",
1264         "cc" => []
1265       }
1266
1267       activity_response =
1268         conn
1269         |> assign(:user, user)
1270         |> post("/users/#{user.nickname}/outbox", activity_request)
1271         |> json_response(:created)
1272
1273       assert activity_response["id"]
1274       assert activity_response["object"]
1275       assert activity_response["actor"] == user.ap_id
1276
1277       assert %Object{data: %{"attachment" => [attachment]}} =
1278                Object.normalize(activity_response["object"])
1279
1280       assert attachment["type"] == "Document"
1281       assert attachment["name"] == desc
1282
1283       assert [
1284                %{
1285                  "href" => ^object_href,
1286                  "type" => "Link",
1287                  "mediaType" => ^object_mediatype
1288                }
1289              ] = attachment["url"]
1290
1291       # Fails if unauthenticated
1292       conn
1293       |> post("/api/ap/upload_media", %{"file" => image, "description" => desc})
1294       |> json_response(403)
1295     end
1296   end
1297 end